diff --git a/.dockerignore b/.dockerignore
index 31b16d2aab..ec905b5eb8 100644
--- a/.dockerignore
+++ b/.dockerignore
@@ -1,4 +1,2 @@
-.github/
-.gitpod.yml
 bin/
 tmp/
diff --git a/.editorconfig b/.editorconfig
index 27917441d8..e8fdc28f50 100644
--- a/.editorconfig
+++ b/.editorconfig
@@ -19,3 +19,12 @@ indent_style = tab
 
 [{config.yaml.dist,config.dev.yaml}]
 indent_size = 2
+
+[.golangci.yaml]
+indent_size = 2
+
+[*.nix]
+indent_size = 2
+
+[devenv.yaml]
+indent_size = 2
diff --git a/.envrc b/.envrc
deleted file mode 100644
index 5817bffc67..0000000000
--- a/.envrc
+++ /dev/null
@@ -1,6 +0,0 @@
-if ! has nix_direnv_version || ! nix_direnv_version 1.5.0; then
-  source_url "https://raw.githubusercontent.com/nix-community/nix-direnv/1.5.0/direnvrc" "sha256-carKk9aUFHMuHt+IWh74hFj58nY4K3uywpZbwXX0BTI="
-fi
-use flake
-
-dotenv_if_exists
diff --git a/.github/ISSUE_TEMPLATE/config.yml b/.github/ISSUE_TEMPLATE/config.yml
index 64156bfa7a..7b8f9b7e2e 100644
--- a/.github/ISSUE_TEMPLATE/config.yml
+++ b/.github/ISSUE_TEMPLATE/config.yml
@@ -1,5 +1,9 @@
 blank_issues_enabled: false
 contact_links:
+  - name: 📖 Documentation enhancement
+    url: https://github.com/dexidp/website/issues
+    about: Suggest an improvement to the documentation
+
   - name: ❓ Ask a question
     url: https://github.com/dexidp/dex/discussions/new?category=q-a
     about: Ask and discuss questions with other Dex community members
@@ -13,5 +17,5 @@ contact_links:
     about: Please ask and answer questions here
 
   - name: 💡 Dex Enhancement Proposal
-    url: https://github.com/dexidp/dex/tree/master/enhancements/README.md
+    url: https://github.com/dexidp/dex/tree/master/docs/enhancements/README.md
     about: Open a proposal for significant architectural change
diff --git a/.github/PULL_REQUEST_TEMPLATE.md b/.github/PULL_REQUEST_TEMPLATE.md
index bcaee00ae3..a706b551a1 100644
--- a/.github/PULL_REQUEST_TEMPLATE.md
+++ b/.github/PULL_REQUEST_TEMPLATE.md
@@ -21,15 +21,3 @@ Thank you for sending a pull request! Here are some tips for contributors:
 -->
 
 #### Special notes for your reviewer
-
-#### Does this PR introduce a user-facing change?
-
-<!--
-If no, just write "NONE" in the release-note block below.
-If yes, a release note is required:
-Enter your extended release note in the block below. If the PR requires additional action from users switching to the new release, include the string "action required".
--->
-
-```release-note
-
-```
diff --git a/.github/SECURITY.md b/.github/SECURITY.md
index 9decd34e3e..eab38858be 100644
--- a/.github/SECURITY.md
+++ b/.github/SECURITY.md
@@ -11,10 +11,10 @@ to confirm receipt of the issue.
 ## Review Process
 
 Once a maintainer has confirmed the relevance of the report, a draft security
-advisory will be created on Github. The draft advisory will be used to discuss
+advisory will be created on GitHub. The draft advisory will be used to discuss
 the issue with maintainers, the reporter(s).
 If the reporter(s) wishes to participate in this discussion, then provide
-reporter Github username(s) to be invited to the discussion. If the reporter(s)
+reporter GitHub username(s) to be invited to the discussion. If the reporter(s)
 does not wish to participate directly in the discussion, then the reporter(s)
 can request to be updated regularly via email.
 
diff --git a/.github/dependabot.yaml b/.github/dependabot.yaml
index b3129d93cf..f66cc18740 100644
--- a/.github/dependabot.yaml
+++ b/.github/dependabot.yaml
@@ -7,6 +7,10 @@ updates:
       - "area/dependencies"
     schedule:
       interval: "daily"
+    groups:
+      etcd:
+        patterns:
+          - "go.etcd.io/*"
 
   - package-ecosystem: "gomod"
     directory: "/api/v2"
@@ -15,6 +19,13 @@ updates:
     schedule:
       interval: "daily"
 
+  - package-ecosystem: "gomod"
+    directory: "/examples"
+    labels:
+      - "area/dependencies"
+    schedule:
+      interval: "daily"
+
   - package-ecosystem: "docker"
     directory: "/"
     labels:
diff --git a/.github/workflows/analysis-scorecard.yaml b/.github/workflows/analysis-scorecard.yaml
new file mode 100644
index 0000000000..49cdf2da5e
--- /dev/null
+++ b/.github/workflows/analysis-scorecard.yaml
@@ -0,0 +1,47 @@
+name: OpenSSF Scorecard
+
+on:
+  branch_protection_rule:
+  push:
+    branches: [ main ]
+  schedule:
+    - cron: '30 0 * * 5'
+
+permissions:
+  contents: read
+
+jobs:
+  analyze:
+    name: Analyze
+    runs-on: ubuntu-latest
+
+    permissions:
+      actions: read
+      contents: read
+      id-token: write
+      security-events: write
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Run analysis
+        uses: ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc # v2.4.4
+        with:
+          results_file: results.sarif
+          results_format: sarif
+          publish_results: true
+
+      - name: Upload results as artifact
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: OpenSSF Scorecard results
+          path: results.sarif
+          retention-days: 5
+
+      - name: Upload results to GitHub Security tab
+        uses: github/codeql-action/upload-sarif@f205ea1c3313d32999d8d6a48b4f6530d4437b38 # v3.29.5
+        with:
+          sarif_file: results.sarif
diff --git a/.github/workflows/artifacts.yaml b/.github/workflows/artifacts.yaml
index 0237b3ac66..aa7c5ffd15 100644
--- a/.github/workflows/artifacts.yaml
+++ b/.github/workflows/artifacts.yaml
@@ -1,12 +1,31 @@
 name: Artifacts
 
 on:
-  push:
-    branches:
-      - master
-    tags:
-      - v[0-9]+.[0-9]+.[0-9]+
-  pull_request:
+  workflow_call:
+    inputs:
+      publish:
+        description: Publish artifacts to the artifact store
+        default: false
+        required: false
+        type: boolean
+    secrets:
+      DOCKER_USERNAME:
+        required: true
+      DOCKER_PASSWORD:
+        required: true
+    outputs:
+      container-image-name:
+        description: Container image name
+        value: ${{ jobs.container-images.outputs.name }}
+      container-image-digest:
+        description: Container image digest
+        value: ${{ jobs.container-images.outputs.digest }}
+      container-image-ref:
+        description: Container image ref
+        value: ${{ jobs.container-images.outputs.ref }}
+
+permissions:
+  contents: read
 
 jobs:
   container-images:
@@ -18,80 +37,233 @@ jobs:
           - alpine
           - distroless
 
+    permissions:
+      attestations: write
+      contents: read
+      packages: write
+      id-token: write
+      security-events: write
+
+    outputs:
+      name: ${{ steps.image-name.outputs.value }}
+      digest: ${{ steps.build.outputs.digest }}
+      ref: ${{ steps.image-ref.outputs.value }}
+
     steps:
-      - name: Checkout
-        uses: actions/checkout@v3
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-tags: true
+
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
+
+      - name: Set up Syft
+        uses: anchore/sbom-action/download-syft@e22c389904149dbc22b58101806040fa8d37a610 # v0.24.0
+
+      - name: Install cosign
+        uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
+
+      - name: Set image name
+        id: image-name
+        run: echo "value=ghcr.io/${{ github.repository }}" >> "$GITHUB_OUTPUT"
 
-      - name: Gather metadata
+      - name: Gather build metadata
         id: meta
-        uses: docker/metadata-action@v4
+        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
         with:
           images: |
-            ghcr.io/dexidp/dex
-            dexidp/dex
+            ${{ steps.image-name.outputs.value }}
+            ${{ github.repository == 'dexidp/dex' && 'dexidp/dex' || '' }}
           flavor: |
             latest = false
           tags: |
             type=ref,event=branch,enable=${{ matrix.variant == 'alpine' }}
-            type=ref,event=pr,enable=${{ matrix.variant == 'alpine' }}
+            type=ref,event=pr,prefix=pr-,enable=${{ matrix.variant == 'alpine' }}
             type=semver,pattern={{raw}},enable=${{ matrix.variant == 'alpine' }}
-            type=raw,value=latest,enable=${{ github.ref == format('refs/heads/{0}', github.event.repository.default_branch) && matrix.variant == 'alpine' }}
+            type=raw,value=latest,enable=${{ github.ref_name == github.event.repository.default_branch && matrix.variant == 'alpine' }}
             type=ref,event=branch,suffix=-${{ matrix.variant }}
-            type=ref,event=pr,suffix=-${{ matrix.variant }}
+            type=ref,event=pr,prefix=pr-,suffix=-${{ matrix.variant }}
             type=semver,pattern={{raw}},suffix=-${{ matrix.variant }}
-            type=raw,value=latest,enable=${{ github.ref == format('refs/heads/{0}', github.event.repository.default_branch) }},suffix=-${{ matrix.variant }}
+            type=raw,value=latest,enable={{is_default_branch}},suffix=-${{ matrix.variant }}
           labels: |
             org.opencontainers.image.documentation=https://dexidp.io/docs/
 
-      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v2
-        with:
-          platforms: all
+      # Multiple exporters are not supported yet
+      # See https://github.com/moby/buildkit/pull/2760
+      - name: Get version from git-version script
+        id: version
+        run: echo "value=$(bash ./scripts/git-version)" >> "$GITHUB_OUTPUT"
 
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v2
+      # Multiple exporters are not supported yet
+      # See https://github.com/moby/buildkit/pull/2760
+      - name: Determine build output
+        uses: haya14busa/action-cond@94f77f7a80cd666cb3155084e428254fea4281fd # v1.2.1
+        id: build-output
+        with:
+          cond: ${{ inputs.publish }}
+          if_true: type=image,push=true
+          if_false: type=oci,dest=image.tar
 
       - name: Login to GitHub Container Registry
-        uses: docker/login-action@v2
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
         with:
           registry: ghcr.io
-          username: ${{ github.repository_owner }}
+          username: ${{ github.actor }}
           password: ${{ github.token }}
-        if: github.event_name == 'push'
+        if: inputs.publish
 
       - name: Login to Docker Hub
-        uses: docker/login-action@v2
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
         with:
           username: ${{ secrets.DOCKER_USERNAME }}
           password: ${{ secrets.DOCKER_PASSWORD }}
-        if: github.event_name == 'push'
+        if: inputs.publish && github.repository == 'dexidp/dex'
 
-      - name: Build and push
-        uses: docker/build-push-action@v3
+      - name: Build and push image
+        id: build
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
         with:
           context: .
-          platforms: linux/amd64,linux/arm/v7,linux/arm64,linux/ppc64le
-          # cache-from: type=gha
-          # cache-to: type=gha,mode=max
-          push: ${{ github.event_name == 'push' }}
+          platforms: linux/amd64,linux/arm/v7,linux/arm64,linux/ppc64le,linux/s390x
           tags: ${{ steps.meta.outputs.tags }}
           build-args: |
             BASE_IMAGE=${{ matrix.variant }}
-            VERSION=${{ fromJSON(steps.meta.outputs.json).labels['org.opencontainers.image.version'] }}
+            VERSION=${{ steps.version.outputs.value }}
             COMMIT_HASH=${{ fromJSON(steps.meta.outputs.json).labels['org.opencontainers.image.revision'] }}
             BUILD_DATE=${{ fromJSON(steps.meta.outputs.json).labels['org.opencontainers.image.created'] }}
-          labels: ${{ steps.meta.outputs.labels }}
+          labels: |
+            ${{ steps.meta.outputs.labels }}
+          # cache-from: type=gha
+          # cache-to: type=gha,mode=max
+          outputs: ${{ steps.build-output.outputs.value }}
+          # push: ${{ inputs.publish }}
+
+      - name: Sign the images with GitHub OIDC Token
+        run: |
+          cosign sign --yes ${{ steps.image-name.outputs.value }}@${{ steps.build.outputs.digest }}
+        if: inputs.publish
+
+      - name: Set image ref
+        id: image-ref
+        run: echo "value=${{ steps.image-name.outputs.value }}@${{ steps.build.outputs.digest }}" >> "$GITHUB_OUTPUT"
+
+      - name: Fetch image
+        run: skopeo --insecure-policy copy docker://${{ steps.image-ref.outputs.value }} oci-archive:image.tar
+        if: inputs.publish
+
+      # Uncomment the following lines for debugging:
+      # - name: Upload image as artifact
+      #   uses: actions/upload-artifact@v3
+      #   with:
+      #     name: "[${{ github.job }}] OCI tarball"
+      #     path: image.tar
+
+      - name: Extract OCI tarball
+        id: extract-oci
+        run: |
+          mkdir -p image
+          tar -xf image.tar -C image
+
+          image_name=$(jq -r '.manifests[0].annotations["io.containerd.image.name"]' image/index.json)
+          image_tag=$(jq -r '.manifests[0].annotations["org.opencontainers.image.ref.name"]' image/index.json)
+
+          echo "Copying $image_tag -> $image_name"
+          skopeo copy "oci:image:$image_tag" "docker-daemon:$image_name"
+
+          echo "value=$image_name" >> "$GITHUB_OUTPUT"
+        if: ${{ !inputs.publish }}
+
+
+      # - name: List tags
+      #   run: skopeo --insecure-policy list-tags oci:image
+      #
+      # # See https://github.com/anchore/syft/issues/1545
+      # - name: Extract image from multi-arch image
+      #   run: skopeo --override-os linux --override-arch amd64 --insecure-policy copy oci:image:${{ steps.image-name.outputs.value }}:${{ steps.meta.outputs.version }} docker-archive:docker.tar
+      #
+      # - name: Generate SBOM
+      #   run: syft -o spdx-json=sbom-spdx.json docker-archive:docker.tar
+      #
+      # - name: Upload SBOM as artifact
+      #   uses: actions/upload-artifact@a8a3f3ad30e3422c9c7b888a15615d19a852ae32 # v3.1.3
+      #   with:
+      #     name: "[${{ github.job }}] SBOM"
+      #     path: sbom-spdx.json
+      #     retention-days: 5
+
+      # TODO: uncomment when the action is working for non ghcr.io pushes. GH Issue: https://github.com/actions/attest-build-provenance/issues/80
+      # - name: Generate build provenance attestation
+      #   uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373 # v4.1.1
+      #   with:
+      #     subject-name: dexidp/dex
+      #     subject-digest: ${{ steps.build.outputs.digest }}
+      #     push-to-registry: true
+
+      - name: Generate build provenance attestation
+        uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373 # v4.1.1
+        with:
+          subject-name: ghcr.io/${{ github.repository }}
+          subject-digest: ${{ steps.build.outputs.digest }}
+          push-to-registry: true
+        if: inputs.publish
+
+      - name: Prepare image fs for scanning
+        run: |
+          image_ref=${{ steps.extract-oci.outputs.value != '' && steps.extract-oci.outputs.value || steps.image-ref.outputs.value }}
+          docker export $(docker create --rm $image_ref) -o docker-image.tar
+
+          mkdir -p docker-image
+          tar -xf docker-image.tar -C docker-image
+
+      ## Use cache for the trivy-db to avoid the TOOMANYREQUESTS error https://github.com/aquasecurity/trivy-action/pull/397
+      ## To avoid the trivy-db becoming outdated, we save the cache for one day
+      - name: Get data
+        id: date
+        run: echo "date=$(date +%Y-%m-%d)" >> $GITHUB_OUTPUT
+
+      - name: Restore trivy cache
+        id: trivy-cache
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        with:
+          path: cache/db
+          key: trivy-cache-${{ steps.date.outputs.date }}
+          restore-keys: trivy-cache-
 
       - name: Run Trivy vulnerability scanner
-        uses: aquasecurity/trivy-action@0.7.1
+        uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # 0.36.0
+        with:
+          input: docker-image
+          format: sarif
+          output: trivy-results.sarif
+          scan-type: "rootfs"
+          scan-ref: "."
+          cache-dir: "./cache"
+        env:
+          TRIVY_SKIP_DB_UPDATE: ${{ steps.trivy-cache.outputs.cache-hit == 'true' }}
+          TRIVY_SKIP_JAVA_DB_UPDATE: ${{ steps.trivy-cache.outputs.cache-hit == 'true' }}
+
+      ## Trivy-db uses `0600` permissions.
+      ## But `action/cache` use `runner` user by default
+      ## So we need to change the permissions before caching the database.
+      - name: change permissions for trivy.db
+        run: sudo chmod 0644 ./cache/db/trivy.db
+
+      - name: Check Trivy sarif
+        run: cat trivy-results.sarif
+
+      - name: Upload Trivy scan results as artifact
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
-          image-ref: "ghcr.io/dexidp/dex:${{ fromJSON(steps.meta.outputs.json).labels['org.opencontainers.image.version'] }}"
-          format: "sarif"
-          output: "trivy-results.sarif"
-        if: github.event_name == 'push'
+          name: "[${{ github.job }}] Trivy scan results"
+          path: trivy-results.sarif
+          retention-days: 5
+          overwrite: true
 
       - name: Upload Trivy scan results to GitHub Security tab
-        uses: github/codeql-action/upload-sarif@v2
+        uses: github/codeql-action/upload-sarif@f205ea1c3313d32999d8d6a48b4f6530d4437b38 # v3.29.5
         with:
-          sarif_file: "trivy-results.sarif"
-        if: github.event_name == 'push'
+          sarif_file: trivy-results.sarif
diff --git a/.github/workflows/checks.yaml b/.github/workflows/checks.yaml
index c7eb4ea73c..fbccdf8a18 100644
--- a/.github/workflows/checks.yaml
+++ b/.github/workflows/checks.yaml
@@ -4,14 +4,19 @@ on:
   pull_request:
     types: [opened, labeled, unlabeled, synchronize]
 
+permissions:
+  contents: read
+
 jobs:
   release-label:
     name: Release note label
     runs-on: ubuntu-latest
 
+    if: github.repository == 'dexidp/dex'
+
     steps:
       - name: Check minimum labels
-        uses: mheap/github-action-required-labels@v2
+        uses: mheap/github-action-required-labels@23e10fde7e062233401931a0eece796cd9bf3177 # v5.6.0
         with:
           mode: minimum
           count: 1
diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 192a44046e..f5c1a597a8 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -2,26 +2,30 @@ name: CI
 
 on:
   push:
-    branches:
-      - master
+    branches: [master]
   pull_request:
 
+permissions:
+  contents: read
+
 jobs:
-  build:
-    name: Build
+  test:
+    name: Test
     runs-on: ubuntu-latest
-    env:
-      GOFLAGS: -mod=readonly
 
     services:
       postgres:
         image: postgres:10.8
+        env:
+          TZ: UTC
         ports:
           - 5432
         options: --health-cmd pg_isready --health-interval 10s --health-timeout 5s --health-retries 5
 
       postgres-ent:
         image: postgres:10.8
+        env:
+          TZ: UTC
         ports:
           - 5432
         options: --health-cmd pg_isready --health-interval 10s --health-timeout 5s --health-retries 5
@@ -44,6 +48,24 @@ jobs:
           - 3306
         options: --health-cmd "mysql -proot -e \"show databases;\"" --health-interval 10s --health-timeout 5s --health-retries 5
 
+      mysql8:
+        image: mysql:8.0
+        env:
+          MYSQL_ROOT_PASSWORD: root
+          MYSQL_DATABASE: dex
+        ports:
+          - 3306
+        options: --health-cmd "mysql -proot -e \"show databases;\"" --health-interval 10s --health-timeout 5s --health-retries 5
+
+      mysql8-ent:
+        image: mysql:8.0
+        env:
+          MYSQL_ROOT_PASSWORD: root
+          MYSQL_DATABASE: dex
+        ports:
+          - 3306
+        options: --health-cmd "mysql -proot -e \"show databases;\"" --health-interval 10s --health-timeout 5s --health-retries 5
+
       etcd:
         image: gcr.io/etcd-development/etcd:v3.5.0
         ports:
@@ -60,26 +82,50 @@ jobs:
           - 35357
         options: --health-cmd "curl --fail http://localhost:5000/v3" --health-interval 10s --health-timeout 5s --health-retries 5
 
+      vault:
+        image: hashicorp/vault:1.21
+        ports:
+          - 8200
+        env:
+          VAULT_DEV_ROOT_TOKEN_ID: root-token
+          VAULT_DEV_LISTEN_ADDRESS: "0.0.0.0:8200"
+        options: --health-cmd "vault status -address=http://localhost:8200 || exit 1" --health-interval 10s --health-timeout 5s --health-retries 5
+
+      openbao:
+        image: quay.io/openbao/openbao:2.5
+        ports:
+          - 8210
+        env:
+          BAO_DEV_ROOT_TOKEN_ID: root-token
+          BAO_DEV_LISTEN_ADDRESS: "0.0.0.0:8210"
+        options: --health-cmd "bao status -address=http://localhost:8210 || exit 1" --health-interval 10s --health-timeout 5s --health-retries 5
+
     steps:
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
       - name: Set up Go
-        uses: actions/setup-go@v3
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
-          go-version: 1.18
+          go-version: "1.25"
+
+      - name: Download tool dependencies
+        run: make deps
 
-      - name: Checkout code
-        uses: actions/checkout@v3
+      # Ensure that generated files were committed.
+      # It can help us determine, that the code is in the intermediate state, which should not be tested.
+      # Thus, heavy jobs like creating a kind cluster and testing / linting will be skipped.
+      - name: Verify
+        run: make verify
 
       - name: Start services
-        run: docker-compose -f docker-compose.test.yaml up -d
+        run: docker compose -f docker-compose.test.yaml up -d
 
       - name: Create kind cluster
-        uses: helm/kind-action@v1.3.0
+        uses: helm/kind-action@ef37e7f390d99f746eb8b610417061a60e82a6cc # v1.14.0
         with:
-          version: v0.11.1
-          node_image: kindest/node:v1.19.11@sha256:07db187ae84b4b7de440a73886f008cf903fcf5764ba8106a9fd5243d6f32729
-
-      - name: Download tool dependencies
-        run: make deps
+          version: "v0.17.0"
+          node_image: "kindest/node:v1.25.3@sha256:cd248d1438192f7814fbca8fede13cfe5b9918746dfa12583976158a834fd5c5"
 
       - name: Test
         run: make testall
@@ -96,6 +142,18 @@ jobs:
           DEX_MYSQL_ENT_HOST: 127.0.0.1
           DEX_MYSQL_ENT_PORT: ${{ job.services.mysql-ent.ports[3306] }}
 
+          DEX_MYSQL8_DATABASE: dex
+          DEX_MYSQL8_USER: root
+          DEX_MYSQL8_PASSWORD: root
+          DEX_MYSQL8_HOST: 127.0.0.1
+          DEX_MYSQL8_PORT: ${{ job.services.mysql8.ports[3306] }}
+
+          DEX_MYSQL8_ENT_DATABASE: dex
+          DEX_MYSQL8_ENT_USER: root
+          DEX_MYSQL8_ENT_PASSWORD: root
+          DEX_MYSQL8_ENT_HOST: 127.0.0.1
+          DEX_MYSQL8_ENT_PORT: ${{ job.services.mysql8-ent.ports[3306] }}
+
           DEX_POSTGRES_DATABASE: postgres
           DEX_POSTGRES_USER: postgres
           DEX_POSTGRES_PASSWORD: postgres
@@ -111,19 +169,63 @@ jobs:
           DEX_ETCD_ENDPOINTS: http://localhost:${{ job.services.etcd.ports[2379] }}
 
           DEX_LDAP_HOST: localhost
-          DEX_LDAP_PORT: 389
-          DEX_LDAP_TLS_PORT: 636
+          DEX_LDAP_PORT: 3890
+          DEX_LDAP_TLS_PORT: 6360
 
           DEX_KEYSTONE_URL: http://localhost:${{ job.services.keystone.ports[5000] }}
           DEX_KEYSTONE_ADMIN_URL: http://localhost:${{ job.services.keystone.ports[35357] }}
           DEX_KEYSTONE_ADMIN_USER: demo
           DEX_KEYSTONE_ADMIN_PASS: DEMO_PASS
 
+          DEX_VAULT_ADDR: http://localhost:${{ job.services.vault.ports[8200] }}
+          DEX_VAULT_TOKEN: root-token
+          DEX_OPENBAO_ADDR: http://localhost:${{ job.services.openbao.ports[8210] }}
+          DEX_OPENBAO_TOKEN: root-token
+
           DEX_KUBERNETES_CONFIG_PATH: ~/.kube/config
 
+  lint:
+    name: Lint
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Set up Go
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
+        with:
+          go-version: "1.25"
+
+      - name: Download golangci-lint
+        run: make bin/golangci-lint
+
       - name: Lint
         run: make lint
 
-      # Ensure proto generation doesn't depend on external packages.
-      - name: Verify proto
-        run: make verify-proto
+  artifacts:
+    name: Artifacts
+    uses: ./.github/workflows/artifacts.yaml
+    with:
+      publish: ${{ github.event_name == 'push' }}
+    secrets:
+      DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }}
+      DOCKER_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}
+    permissions:
+      attestations: write
+      contents: read
+      packages: write
+      id-token: write
+      security-events: write
+
+  dependency-review:
+    name: Dependency review
+    runs-on: ubuntu-latest
+    if: github.event_name == 'pull_request'
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Dependency Review
+        uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0
diff --git a/.github/workflows/codeql-analysis.yaml b/.github/workflows/codeql-analysis.yaml
deleted file mode 100644
index 926f8be539..0000000000
--- a/.github/workflows/codeql-analysis.yaml
+++ /dev/null
@@ -1,67 +0,0 @@
-# For most projects, this workflow file will not need changing; you simply need
-# to commit it to your repository.
-#
-# You may wish to alter this file to override the set of languages analyzed,
-# or to provide custom queries or build logic.
-#
-# ******** NOTE ********
-# We have attempted to detect the languages in your repository. Please check
-# the `language` matrix defined below to confirm you have the correct set of
-# supported CodeQL languages.
-#
-name: "CodeQL"
-
-on:
-  push:
-    branches: [ master, v1 ]
-  pull_request:
-    # The branches below must be a subset of the branches above
-    branches: [ master ]
-  schedule:
-    - cron: '28 10 * * 6'
-
-jobs:
-  analyze:
-    name: Analyze
-    runs-on: ubuntu-latest
-
-    strategy:
-      fail-fast: false
-      matrix:
-        language: [ 'go' ]
-        # CodeQL supports [ 'cpp', 'csharp', 'go', 'java', 'javascript', 'python' ]
-        # Learn more:
-        # https://docs.github.com/en/free-pro-team@latest/github/finding-security-vulnerabilities-and-errors-in-your-code/configuring-code-scanning#changing-the-languages-that-are-analyzed
-
-    steps:
-    - name: Checkout repository
-      uses: actions/checkout@v3
-
-    # Initializes the CodeQL tools for scanning.
-    - name: Initialize CodeQL
-      uses: github/codeql-action/init@v2
-      with:
-        languages: ${{ matrix.language }}
-        # If you wish to specify custom queries, you can do so here or in a config file.
-        # By default, queries listed here will override any specified in a config file.
-        # Prefix the list here with "+" to use these queries and those in the config file.
-        # queries: ./path/to/local/query, your-org/your-repo/queries@main
-
-    # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
-    # If this step fails, then you should remove it and run the build manually (see below)
-    - name: Autobuild
-      uses: github/codeql-action/autobuild@v2
-
-    # ℹ️ Command-line programs to run using the OS shell.
-    # 📚 https://git.io/JvXDl
-
-    # ✏️ If the Autobuild fails above, remove it and uncomment the following three lines
-    #    and modify them (or add more) to build your code if your project
-    #    uses a compiled language
-
-    #- run: |
-    #   make bootstrap
-    #   make release
-
-    - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v2
diff --git a/.github/workflows/docker.yaml b/.github/workflows/docker.yaml
deleted file mode 100644
index f841d55640..0000000000
--- a/.github/workflows/docker.yaml
+++ /dev/null
@@ -1,111 +0,0 @@
-name: Docker
-
-on:
-  # push:
-  #   branches:
-  #     - master
-  #   tags:
-  #     - v[0-9]+.[0-9]+.[0-9]+
-  pull_request:
-
-jobs:
-  docker:
-    name: Docker
-    runs-on: ubuntu-latest
-
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v3
-
-      - name: Calculate Docker image tags
-        id: tags
-        env:
-          DOCKER_IMAGES: "ghcr.io/dexidp/dex dexidp/dex"
-        run: |
-          case $GITHUB_REF in
-            refs/tags/*)  VERSION=${GITHUB_REF#refs/tags/};;
-            refs/heads/*) VERSION=$(echo ${GITHUB_REF#refs/heads/} | sed -r 's#/+#-#g');;
-            refs/pull/*)  VERSION=pr-${{ github.event.number }};;
-            *)            VERSION=sha-${GITHUB_SHA::8};;
-          esac
-
-          TAGS=()
-          for image in $DOCKER_IMAGES; do
-            TAGS+=("${image}:${VERSION}")
-
-            if [[ "${{ github.event.repository.default_branch }}" == "$VERSION" ]]; then
-              TAGS+=("${image}:latest")
-            fi
-          done
-
-          echo ::set-output name=version::${VERSION}
-          echo ::set-output name=tags::$(IFS=,; echo "${TAGS[*]}")
-          echo ::set-output name=commit_hash::${GITHUB_SHA::8}
-          echo ::set-output name=build_date::$(git show -s --format=%cI)
-
-      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v2
-        with:
-          platforms: all
-
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v2
-        with:
-          install: true
-          version: latest
-          # TODO: Remove driver-opts once fix is released docker/buildx#386
-          driver-opts: image=moby/buildkit:master
-
-      - name: Login to GitHub Container Registry
-        uses: docker/login-action@v2
-        with:
-          registry: ghcr.io
-          username: ${{ github.repository_owner }}
-          password: ${{ github.token }}
-        if: github.event_name == 'push'
-
-      - name: Login to Docker Hub
-        uses: docker/login-action@v2
-        with:
-          username: ${{ secrets.DOCKER_USERNAME }}
-          password: ${{ secrets.DOCKER_PASSWORD }}
-        if: github.event_name == 'push'
-
-      - name: Build and push
-        uses: docker/build-push-action@v3
-        with:
-          context: .
-          platforms: linux/amd64,linux/arm/v7,linux/arm64,linux/ppc64le
-          # cache-from: type=gha
-          # cache-to: type=gha,mode=max
-          push: ${{ github.event_name == 'push' }}
-          tags: ${{ steps.tags.outputs.tags }}
-          build-args: |
-            VERSION=${{ steps.tags.outputs.version }}
-            COMMIT_HASH=${{ steps.tags.outputs.commit_hash }}
-            BUILD_DATE=${{ steps.tags.outputs.build_date }}
-          labels: |
-            org.opencontainers.image.title=${{ github.event.repository.name }}
-            org.opencontainers.image.description=${{ github.event.repository.description }}
-            org.opencontainers.image.url=${{ github.event.repository.html_url }}
-            org.opencontainers.image.source=${{ github.event.repository.clone_url }}
-            org.opencontainers.image.version=${{ steps.tags.outputs.version }}
-            org.opencontainers.image.created=${{ steps.tags.outputs.build_date }}
-            org.opencontainers.image.revision=${{ github.sha }}
-            org.opencontainers.image.licenses=${{ github.event.repository.license.spdx_id }}
-            org.opencontainers.image.documentation=https://dexidp.io/docs/
-
-      - name: Run Trivy vulnerability scanner
-        uses: aquasecurity/trivy-action@0.7.1
-        with:
-          image-ref: "ghcr.io/dexidp/dex:${{ steps.tags.outputs.version }}"
-          format: "template"
-          template: "@/contrib/sarif.tpl"
-          output: "trivy-results.sarif"
-        if: github.event_name == 'push'
-
-      - name: Upload Trivy scan results to GitHub Security tab
-        uses: github/codeql-action/upload-sarif@v2
-        with:
-          sarif_file: "trivy-results.sarif"
-        if: github.event_name == 'push'
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
new file mode 100644
index 0000000000..dbf397cbbe
--- /dev/null
+++ b/.github/workflows/release.yaml
@@ -0,0 +1,24 @@
+name: Release
+
+on:
+  push:
+    tags: [ "v[0-9]+.[0-9]+.[0-9]+" ]
+
+permissions:
+  contents: read
+
+jobs:
+  artifacts:
+    name: Artifacts
+    uses: ./.github/workflows/artifacts.yaml
+    with:
+      publish: true
+    secrets:
+      DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }}
+      DOCKER_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}
+    permissions:
+      attestations: write
+      contents: read
+      packages: write
+      id-token: write
+      security-events: write
diff --git a/.github/workflows/trivydb-cache.yaml b/.github/workflows/trivydb-cache.yaml
new file mode 100644
index 0000000000..feaf6da318
--- /dev/null
+++ b/.github/workflows/trivydb-cache.yaml
@@ -0,0 +1,42 @@
+# Note: This workflow only updates the cache. You should create a separate workflow for your actual Trivy scans.
+# In your scan workflow, set TRIVY_SKIP_DB_UPDATE=true and TRIVY_SKIP_JAVA_DB_UPDATE=true.
+name: Update Trivy Cache
+
+on:
+  schedule:
+    - cron: '0 0 * * *'  # Run daily at midnight UTC
+  workflow_dispatch:  # Allow manual triggering
+
+permissions:
+  contents: read
+
+jobs:
+  update-trivy-db:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Setup oras
+        uses: oras-project/setup-oras@1d808f7d7f6995cc68b7bf507bfe5c5446e1dc9d # v2.0.1
+
+      - name: Get current date
+        id: date
+        run: echo "date=$(date +'%Y-%m-%d')" >> $GITHUB_OUTPUT
+
+      - name: Download and extract the vulnerability DB
+        run: |
+          mkdir -p $GITHUB_WORKSPACE/.cache/trivy/db
+          oras pull ghcr.io/aquasecurity/trivy-db:2
+          tar -xzf db.tar.gz -C $GITHUB_WORKSPACE/.cache/trivy/db
+          rm db.tar.gz
+
+      - name: Download and extract the Java DB
+        run: |
+          mkdir -p $GITHUB_WORKSPACE/.cache/trivy/java-db
+          oras pull ghcr.io/aquasecurity/trivy-java-db:1
+          tar -xzf javadb.tar.gz -C $GITHUB_WORKSPACE/.cache/trivy/java-db
+          rm javadb.tar.gz
+
+      - name: Cache DBs
+        uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        with:
+          path: ${{ github.workspace }}/.cache/trivy
+          key: cache-trivy-${{ steps.date.outputs.date }}
diff --git a/.gitignore b/.gitignore
index 66dc41ccfe..3873e81af0 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,3 +1,4 @@
+/.devenv/
 /.direnv/
 /.idea/
 /bin/
@@ -5,3 +6,15 @@
 /docker-compose.override.yaml
 /var/
 /vendor/
+*.db
+
+# Devenv
+.devenv*
+devenv.local.nix
+devenv.local.yaml
+
+# direnv
+.direnv
+
+# pre-commit
+.pre-commit-config.yaml
diff --git a/.gitpod.yml b/.gitpod.yml
deleted file mode 100644
index 443b711f60..0000000000
--- a/.gitpod.yml
+++ /dev/null
@@ -1,3 +0,0 @@
-tasks:
-  - init: go get && go build ./... && go test ./... && make
-    command: go run
diff --git a/.golangci.yaml b/.golangci.yaml
new file mode 100644
index 0000000000..9fa3141874
--- /dev/null
+++ b/.golangci.yaml
@@ -0,0 +1,124 @@
+version: "2"
+
+run:
+  timeout: 5m
+
+linters:
+  disable:
+    - staticcheck
+    - errcheck
+  enable:
+    - depguard
+    - dogsled
+    - exhaustive
+    - gochecknoinits
+    # - gocritic
+    - goprintffuncname
+    - govet
+    - ineffassign
+    - misspell
+    - nakedret
+    - nolintlint
+    - prealloc
+    # - revive
+    # - sqlclosecheck
+    # - staticcheck
+    - unconvert
+    - unused
+    - whitespace
+
+    # Disable temporarily until everything works with Go 1.20
+    # - bodyclose
+    # - rowserrcheck
+    # - tparallel
+    # - unparam
+
+    # Disable temporarily until the following issue is resolved: https://github.com/golangci/golangci-lint/issues/3086
+    # - sqlclosecheck
+
+    # TODO: fix linter errors before enabling
+    # - exhaustivestruct
+    # - gochecknoglobals
+    # - errorlint
+    # - gocognit
+    # - godot
+    # - nlreturn
+    # - noctx
+    # - revive
+    # - wrapcheck
+
+    # TODO: fix linter errors before enabling (from original config)
+    # - dupl
+    # - errcheck
+    # - goconst
+    # - gocyclo
+    # - gosec
+    # - lll
+    # - scopelint
+
+    # unused
+    # - goheader
+    # - gomodguard
+
+    # don't enable:
+    # - asciicheck
+    # - funlen
+    # - godox
+    # - goerr113
+    # - gomnd
+    # - interfacer
+    # - maligned
+    # - nestif
+    # - testpackage
+    # - wsl
+
+  exclusions:
+    rules:
+      - linters:
+          - errcheck
+          - noctx
+        path: _test.go
+    presets:
+      - comments
+      - std-error-handling
+
+  settings:
+    misspell:
+      locale: US
+    nolintlint:
+      allow-unused: false # report any unused nolint directives
+      require-specific: false # don't require nolint directives to be specific about which linter is being skipped
+    gocritic:
+      # Enable multiple checks by tags. See "Tags" section in https://github.com/go-critic/go-critic#usage.
+      enabled-tags:
+        - diagnostic
+        - experimental
+        - opinionated
+        - style
+      disabled-checks:
+        - importShadow
+        - unnamedResult
+    depguard:
+      rules:
+        deprecated:
+          deny:
+            - pkg: "io/ioutil"
+              desc: "The 'io/ioutil' package is deprecated. Use corresponding 'os' or 'io' functions instead."
+
+formatters:
+  enable:
+    - gci
+    - gofmt
+    - gofumpt
+    - goimports
+    # - golines
+
+  settings:
+    gci:
+      sections:
+        - standard
+        - default
+        - localmodule
+# issues:
+#     exclude-dirs:
+#         - storage/ent/db # generated ent code
diff --git a/.golangci.yml b/.golangci.yml
deleted file mode 100644
index cfb64a75bf..0000000000
--- a/.golangci.yml
+++ /dev/null
@@ -1,90 +0,0 @@
-run:
-    timeout: 4m
-
-linters-settings:
-    depguard:
-        list-type: blacklist
-        include-go-root: true
-        packages:
-            - io/ioutil
-        packages-with-error-message:
-            - io/ioutil: "The 'io/ioutil' package is deprecated. Use corresponding 'os' or 'io' functions instead."
-    gci:
-        local-prefixes: github.com/dexidp/dex
-    goimports:
-        local-prefixes: github.com/dexidp/dex
-
-
-linters:
-    disable-all: true
-    enable:
-        - bodyclose
-        - deadcode
-        - depguard
-        - dogsled
-        - exhaustive
-        - exportloopref
-        - gci
-        - gochecknoinits
-        - gocritic
-        - gofmt
-        - gofumpt
-        - goimports
-        - goprintffuncname
-        - gosimple
-        - govet
-        - ineffassign
-        - misspell
-        - nakedret
-        - nolintlint
-        - prealloc
-        - revive
-        - rowserrcheck
-        - sqlclosecheck
-        - staticcheck
-        - structcheck
-        - stylecheck
-        - tparallel
-        - unconvert
-        - unparam
-        - unused
-        - varcheck
-        - whitespace
-
-        # Disable temporarily until everything works with Go 1.18
-        # - typecheck
-
-        # TODO: fix linter errors before enabling
-        # - exhaustivestruct
-        # - gochecknoglobals
-        # - errorlint
-        # - gocognit
-        # - godot
-        # - nlreturn
-        # - noctx
-        # - wrapcheck
-
-        # TODO: fix linter errors before enabling (from original config)
-        # - dupl
-        # - errcheck
-        # - goconst
-        # - gocyclo
-        # - gosec
-        # - lll
-        # - scopelint
-
-        # unused
-        # - goheader
-        # - gomodguard
-
-        # don't enable:
-        # - asciicheck
-        # - funlen
-        # - godox
-        # - goerr113
-        # - gomnd
-        # - interfacer
-        # - maligned
-        # - nestif
-        # - testpackage
-        # - wsl
diff --git a/ADOPTERS.md b/ADOPTERS.md
index 50f9ba988d..88a835cbdd 100644
--- a/ADOPTERS.md
+++ b/ADOPTERS.md
@@ -1,15 +1,26 @@
 # Adopters
 
-This is a list of production adopters of Dex (in alphabetical order):
+This is a list of production adopters of Dex (in alphabetical order).
+
+# Companies
 
 - [Aspect](https://www.aspect.com/) uses Dex for authenticating users across their Kubernetes infrastructure (using Kubernetes OIDC support).
 - [Banzai Cloud](https://banzaicloud.com) is using Dex for authenticating to its Pipeline control plane and also to authenticate users against provisioned Kubernetes clusters (via Kubernetes OIDC support).
-- [Chef](https://chef.io) uses Dex for authenticating users in [Chef Automate](https://automate.chef.io/). The code is Open Source, available at [`github.com/chef/automate`](https://github.com/chef/automate).
-- [Elastisys](https://elastisys.com) uses Dex for authentication in their [Compliant Kubernetes](https://compliantkubernetes.io) distribution, including SSO to the custom dashboard, Grafana, Kibana, and Harbor.
+- [Ericsson](https://www.ericsson.com) is using Dex to authenticate access to Kubernetes API server in [Cloud Container Distribution](https://www.ericsson.com/en/portfolio/cloud-software-and-services/cloud-core/cloud-infrastructure/nfvi/cloud-container-distribution).
 - [Flant](https://flant.com) uses Dex for providing access to core components of [Managed Kubernetes as a Service](https://flant.com/services/managed-kubernetes-as-a-service), integration with various authentication providers, plugging custom applications.
 - [JuliaBox](https://juliabox.com/) is leveraging federated OIDC provided by Dex for authenticating users to their compute infrastructure based on Kubernetes.
+- [Pusher](https://pusher.com) uses Dex for authenticating users across their Kubernetes infrastructure (using Kubernetes OIDC support) in conjunction with the [OAuth2 Proxy](https://github.com/pusher/oauth2_proxy) for protecting web UIs.
+
+# Projects
+
+- [Argo CD](https://argoproj.github.io/cd) integrates Dex to provide convenient Single Sign On capabilities to its web UI and CLI
+- [Chef](https://chef.io) uses Dex for authenticating users in [Chef Automate](https://automate.chef.io/). The code is Open Source, available at [`github.com/chef/automate`](https://github.com/chef/automate).
+- [Elastisys](https://elastisys.com) uses Dex for authentication in [Welkin, The Application Platform for Software Critical to Society](https://elastisys.io/welkin/), including SSO to Grafana, OpenSearch, and Harbor.
 - [Kasten](https://www.kasten.io) is using Dex for authenticating access to the dashboard of [K10](https://www.kasten.io/product/), a Kubernetes-native platform for backup, disaster recovery and mobility of Kubernetes applications. K10 is widely used by a variety of customers including large enterprises, financial services, design firms, and IT companies.
+- [Kubeflow](https://www.kubeflow.org/) [uses](https://github.com/kubeflow/manifests#dex) Dex as one of its components in the Kubeflow Platform for external OIDC authentication.
 - [Kyma](https://kyma-project.io) is using Dex to authenticate access to Kubernetes API server (even for managed Kubernetes like Google Kubernetes Engine or Azure Kubernetes Service) and for protecting web UI of [Kyma Console](https://github.com/kyma-project/console) and other UIs integrated in Kyma ([Grafana](https://github.com/grafana/grafana), [Loki](https://github.com/grafana/loki), and [Jaeger](https://github.com/jaegertracing/jaeger)). Kyma is an open-source project ([`github.com/kyma-project`](https://github.com/kyma-project/kyma)) designed natively on Kubernetes, that allows you to extend and customize your applications in a quick and modern way, using serverless computing or microservice architecture. 
-- [Pusher](https://pusher.com) uses Dex for authenticating users across their Kubernetes infrastructure (using Kubernetes OIDC support) in conjunction with the [OAuth2 Proxy](https://github.com/pusher/oauth2_proxy) for protecting web UIs.
+- [LitmusChaos](https://litmuschaos.io/) uses Dex to [implement](https://docs.litmuschaos.io/docs/user-guides/chaoscenter-oauth-dex-installation#deploy-dex-oidc-provider) OAuth2 login support in ChaosCenter, its centralized chaos management tool.
+- [LLMariner](https://llmariner.ai/) uses Dex for [user management](https://llmariner.ai/docs/features/user_management/).
 - [Pydio](https://pydio.com/) Pydio Cells is an open source sync & share platform written in Go. Cells is using Dex as an OIDC service for authentication and authorizations. Check out [Pydio Cells repository](https://github.com/pydio/cells) for more information and/or to contribute.
 - [sigstore](https://sigstore.dev) uses Dex for authentication in their public Fulcio instance, which is a certificate authority for code signing certificates bound to OIDC-based identities.
+- [Terrakube](https://docs.terrakube.io/) relies on Dex for [user authentication](https://docs.terrakube.io/getting-started/deployment/user-authentication-dex). Its Helm chart uses Dex as a dependency.
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
new file mode 100644
index 0000000000..0bc91cd893
--- /dev/null
+++ b/CONTRIBUTING.md
@@ -0,0 +1,161 @@
+# Contributing to Dex
+
+Dex is [Apache 2.0 licensed](LICENSE) and accepts contributions via GitHub pull requests.
+This document outlines how to contribute to the project.
+
+- [Code of Conduct](#code-of-conduct)
+- [Finding something to work on](#finding-something-to-work-on)
+- [Setting up a development environment](#setting-up-a-development-environment)
+- [Making changes](#making-changes)
+- [Running the example app](#running-the-example-app)
+- [Committing your changes](#committing-your-changes)
+- [Submitting a pull request](#submitting-a-pull-request)
+- [Enhancement proposals](#enhancement-proposals)
+- [Getting help](#getting-help)
+
+## Code of Conduct
+
+This project follows the [CNCF Code of Conduct](https://github.com/cncf/foundation/blob/master/code-of-conduct.md).
+
+## Finding something to work on
+
+If you have a bug fix or a small improvement, go ahead and open a pull request.
+
+For larger changes, please open a [discussion](https://github.com/dexidp/dex/discussions/new?category=Ideas) first
+to align with the community and avoid unnecessary work. Major features or significant architectural
+changes should go through the [Enhancement Proposal](#enhancement-proposals) process.
+
+If you're looking for something to work on, check:
+
+- Issues labeled with [good first issue](https://github.com/dexidp/dex/labels/good%20first%20issue)
+- Issues labeled with [help wanted](https://github.com/dexidp/dex/labels/help%20wanted)
+
+Please comment on the issue to claim it before starting work to avoid duplicated efforts.
+
+## Setting up a development environment
+
+For the best developer experience, install [Nix](https://builtwithnix.org/) and [direnv](https://direnv.net/).
+This will automatically set up all required tools (Go, golangci-lint, protobuf compiler, kind, etc.).
+
+Alternatively, you can set up the environment manually:
+
+1. Install [Go](https://go.dev/doc/install) (see the version in [go.mod](go.mod)).
+2. Install [Docker](https://docs.docker.com/get-started/).
+3. Install development dependencies:
+
+```shell
+make deps
+```
+
+This installs `golangci-lint`, `gotestsum`, `protoc`, `protoc-gen-go`, `protoc-gen-go-grpc`, and `kind`.
+
+You can also use [GitHub Codespaces](https://github.com/codespaces/new?repo=dexidp/dex) for a ready-to-code cloud environment.
+
+## Making changes
+
+Run `make help` to see all available commands. The key ones for contributors:
+
+```shell
+make deps        # Install development dependencies
+make build       # Build Dex binaries
+make testall     # Run all tests (includes race detection)
+make lint        # Run linter
+make generate    # Regenerate protobuf, ent, and go mod tidy
+```
+
+## Running the example app
+
+To test the login flow locally, run Dex with the dev config and the example OIDC client app.
+
+**Terminal 1** — start Dex:
+
+```shell
+make build
+./bin/dex serve config.dev.yaml
+```
+
+**Terminal 2** — start the example app:
+
+```shell
+make examples
+./bin/example-app
+```
+
+Open http://127.0.0.1:5555 in your browser, click "Login", and authenticate with:
+
+- **Email:** `admin@example.com`
+- **Password:** `password`
+
+After successful login, the example app displays the ID token claims returned by Dex.
+
+## Committing your changes
+
+The project follows [Conventional Commits](https://www.conventionalcommits.org/) style:
+
+```
+<type>[optional scope]: <description>
+
+[optional body]
+
+Signed-off-by: First Last <email@example.com>
+```
+
+Common types: `feat`, `fix`, `build`, `chore`, `docs`, `refactor`, `test`.
+
+Examples from the project:
+
+```
+feat: use protobuf for session cookie (#4675)
+fix: non-constant format string in call to newRedirectedErr (#4671)
+build(deps): bump github/codeql-action from 4.33.0 to 4.34.1 (#4679)
+```
+
+### Developer Certificate of Origin
+
+As a CNCF project, Dex requires all contributors to sign the [Developer Certificate of Origin (DCO)](https://developercertificate.org/).
+This certifies that you have the right to submit your contribution under the project's open source license.
+
+You must add a `Signed-off-by` line to every commit. Use git's `-s` flag to do this automatically:
+
+```shell
+git commit -s -m "feat: add new feature"
+```
+
+The DCO check will fail on pull requests with unsigned commits.
+
+## Submitting a pull request
+
+1. Fork the repository and create your branch from `master`.
+2. Make your changes, following the guidelines above.
+3. Ensure all tests pass (`make testall`) and the linter is clean (`make lint`).
+4. Ensure generated code is up to date (`make generate`).
+5. Push your branch and open a pull request.
+
+When opening a pull request:
+
+- Fill in the [pull request template](.github/PULL_REQUEST_TEMPLATE.md) with an overview and explanation of the change.
+- After opening a PR, a maintainer will add least one [release note label](https://github.com/dexidp/dex/labels?q=release-note) to the PR.
+  Valid labels include: `kind/feature`, `kind/enhancement`, `kind/bug`, `release-note/new-feature`,
+  `release-note/enhancement`, `release-note/bug-fix`, `release-note/breaking-change`,
+  `release-note/deprecation`, `release-note/ignore`, `area/dependencies`, `release-note/dependency-update`.
+- If the PR is still in progress, use GitHub's [Draft PR](https://github.blog/2019-02-14-introducing-draft-pull-requests/) feature.
+
+All CI checks (tests, linting, DCO, release label) must pass before the PR can be merged.
+
+## Enhancement proposals
+
+Significant features or architectural changes require a [Dex Enhancement Proposal (DEP)](docs/enhancements/README.md).
+
+The process:
+
+1. Search existing [issues](https://github.com/dexidp/dex/issues), [discussions](https://github.com/dexidp/dex/discussions), and [DEPs](https://github.com/dexidp/dex/tree/master/docs/enhancements).
+2. Open a [discussion](https://github.com/dexidp/dex/discussions/new?category=Ideas) to get initial feedback.
+3. Fork the repo and copy the [DEP template](docs/enhancements/_title-YYYY-MM-DD-#issue.md) with an appropriate name.
+4. Fill in all sections and submit a PR for review.
+
+## Getting help
+
+- For bugs and feature requests, file an [issue](https://github.com/dexidp/dex/issues).
+- For general discussion, open a [discussion](https://github.com/dexidp/dex/discussions) or join [#dexidp](https://cloud-native.slack.com/messages/dexidp) on the CNCF Slack.
+- Mailing list (as a backup): [dex-dev](https://groups.google.com/forum/#!forum/dex-dev).
+- For security vulnerabilities, see the [security policy](.github/SECURITY.md).
diff --git a/Dockerfile b/Dockerfile
index 3462ae52ac..43ec35238d 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,48 +1,65 @@
 ARG BASE_IMAGE=alpine
 
-FROM golang:1.19.1-alpine3.16 AS builder
+FROM --platform=$BUILDPLATFORM tonistiigi/xx:1.9.0@sha256:c64defb9ed5a91eacb37f96ccc3d4cd72521c4bd18d5442905b95e2226b0e707 AS xx
 
-WORKDIR /usr/local/src/dex
+FROM --platform=$BUILDPLATFORM golang:1.26.4-alpine3.22@sha256:727cfc3c40be55cd1bc9a4a059406b28a059857e3be752aa9d09531e12c20c56 AS builder
 
-RUN apk add --no-cache --update alpine-sdk ca-certificates openssl
+COPY --from=xx / /
 
-ARG TARGETOS
-ARG TARGETARCH
-ARG TARGETVARIANT=""
+RUN apk add --update alpine-sdk ca-certificates openssl clang lld
+
+ARG TARGETPLATFORM
 
-ENV GOOS=${TARGETOS} GOARCH=${TARGETARCH} GOARM=${TARGETVARIANT}
+RUN xx-apk --update add musl-dev gcc
+
+# lld has issues building static binaries for ppc so prefer ld for it
+RUN [ "$(xx-info arch)" != "ppc64le" ] || XX_CC_PREFER_LINKER=ld xx-clang --setup-target-triple
+
+RUN xx-go --wrap
+
+WORKDIR /usr/local/src/dex
 
 ARG GOPROXY
 
+ENV CGO_ENABLED=1
+
 COPY go.mod go.sum ./
 COPY api/v2/go.mod api/v2/go.sum ./api/v2/
 RUN go mod download
 
 COPY . .
 
+# Propagate Dex version from build args to the build environment
+ARG VERSION
 RUN make release-binary
 
-FROM alpine:3.16.2 AS stager
+RUN xx-verify /go/bin/dex && xx-verify /go/bin/docker-entrypoint
+
+FROM alpine:3.24.1@sha256:28bd5fe8b56d1bd048e5babf5b10710ebe0bae67db86916198a6eec434943f8b AS stager
 
 RUN mkdir -p /var/dex
 RUN mkdir -p /etc/dex
 COPY config.docker.yaml /etc/dex/
 
-FROM alpine:3.16.2 AS gomplate
+FROM alpine:3.24.1@sha256:28bd5fe8b56d1bd048e5babf5b10710ebe0bae67db86916198a6eec434943f8b AS gomplate
 
 ARG TARGETOS
 ARG TARGETARCH
 ARG TARGETVARIANT
 
-ENV GOMPLATE_VERSION=v3.11.2
+ENV GOMPLATE_VERSION=v5.2.0
 
 RUN wget -O /usr/local/bin/gomplate \
     "https://github.com/hairyhenderson/gomplate/releases/download/${GOMPLATE_VERSION}/gomplate_${TARGETOS:-linux}-${TARGETARCH:-amd64}${TARGETVARIANT}" \
     && chmod +x /usr/local/bin/gomplate
 
 # For Dependabot to detect base image versions
-FROM alpine:3.16.2 AS alpine
-FROM gcr.io/distroless/static:latest AS distroless
+FROM alpine:3.24.1@sha256:28bd5fe8b56d1bd048e5babf5b10710ebe0bae67db86916198a6eec434943f8b AS alpine
+
+FROM alpine AS user-setup
+RUN addgroup -g 1001 -S dex && adduser -u 1001 -S -G dex -D -H -s /sbin/nologin dex
+
+FROM gcr.io/distroless/static-debian13:nonroot@sha256:f7f8f729987ad0fdf6b05eeeae94b26e6a0f613bdf46feea7fc40f7bd72953e6 AS distroless
 
 FROM $BASE_IMAGE
 
@@ -53,6 +70,10 @@ FROM $BASE_IMAGE
 # See https://go.dev/src/crypto/x509/root_linux.go for Go root CA bundle locations.
 COPY --from=builder /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt
 
+# Ensure the dex user/group exist before setting ownership or switching to them.
+COPY --from=user-setup /etc/passwd /etc/passwd
+COPY --from=user-setup /etc/group /etc/group
+
 COPY --from=stager --chown=1001:1001 /var/dex /var/dex
 COPY --from=stager --chown=1001:1001 /etc/dex /etc/dex
 
@@ -66,7 +87,7 @@ COPY --from=builder /usr/local/src/dex/web /srv/dex/web
 
 COPY --from=gomplate /usr/local/bin/gomplate /usr/local/bin/gomplate
 
-USER 1001:1001
+USER dex:dex
 
 ENTRYPOINT ["/usr/local/bin/docker-entrypoint"]
 CMD ["dex", "serve", "/etc/dex/config.docker.yaml"]
diff --git a/MAINTAINERS b/MAINTAINERS
deleted file mode 100644
index b95c2499de..0000000000
--- a/MAINTAINERS
+++ /dev/null
@@ -1,6 +0,0 @@
-Joel Speed <Joel.speed@hotmail.co.uk> (@JoelSpeed)
-Maksim Nabokikh <max.nabokih@gmail.com> (@nabokihms)
-Mark Sagi-Kazar <mark.sagikazar@gmail.com> (@sagikazarmark)
-Nandor Kracser <bonifaido@gmail.com> (@bonifaido)
-Rithu John <rithujohn191@gmail.com> (@rithujohn191)
-Stephen Augustus <foo@auggie.dev> (@justaugustus)
diff --git a/MAINTAINERS.md b/MAINTAINERS.md
new file mode 100644
index 0000000000..889cbc05d8
--- /dev/null
+++ b/MAINTAINERS.md
@@ -0,0 +1,25 @@
+# Dex Maintainers
+
+The current Maintainers Group for the Dex Project consists of:
+
+| Name | GitHub | Employer | Responsibilities |
+| ---- | ------ | -------- | ---------------- |
+| Maksim Nabokikh | [@nabokihms](https://github.com/nabokihms) | [Palark GmbH](https://palark.de/) | ALL |
+| Márk Sági-Kazár | [@sagikazarmark](https://github.com/sagikazarmark) | <!-- TODO: employer --> | ALL |
+
+This list must be kept in sync with the [CNCF Project Maintainers list](https://github.com/cncf/foundation/blob/master/project-maintainers.csv).
+
+<!-- TODO (nabokihms): Add the Governance
+See [the project Governance](./GOVERNANCE.md) for how maintainers are selected and replaced.
+-->
+
+## Emeritus Maintainers
+
+We are grateful to our former maintainers for their contributions to the Dex project.
+
+- [@ericchiang](https://github.com/ericchiang) - Eric Chiang
+- [@JoelSpeed](https://github.com/JoelSpeed) - Joel Speed
+- [@bonifaido](https://github.com/bonifaido) - Nandor Kracser
+- [@rithujohn191](https://github.com/rithujohn191) - Rithu John
+- [@justaugustus](https://github.com/justaugustus) - Stephen Augustus
+- [@srenatus](https://github.com/srenatus) - Stephan Renatus
diff --git a/Makefile b/Makefile
index 9c55ad2b11..2722be7d8d 100644
--- a/Makefile
+++ b/Makefile
@@ -1,139 +1,85 @@
-OS = $(shell uname | tr A-Z a-z)
-
 export PATH := $(abspath bin/protoc/bin/):$(abspath bin/):${PATH}
 
-PROJ=dex
-ORG_PATH=github.com/dexidp
-REPO_PATH=$(ORG_PATH)/$(PROJ)
-
-VERSION ?= $(shell ./scripts/git-version)
+OS = $(shell uname | tr A-Z a-z)
 
-DOCKER_REPO=quay.io/dexidp/dex
-DOCKER_IMAGE=$(DOCKER_REPO):$(VERSION)
+user=$(shell id -u -n)
+group=$(shell id -g -n)
 
 $( shell mkdir -p bin )
 
-user=$(shell id -u -n)
-group=$(shell id -g -n)
+PROJ      = dex
+ORG_PATH  = github.com/dexidp
+REPO_PATH = $(ORG_PATH)/$(PROJ)
+VERSION  ?= $(shell ./scripts/git-version)
 
-export GOBIN=$(PWD)/bin
 
+export GOBIN=$(PWD)/bin
 LD_FLAGS="-w -X main.version=$(VERSION)"
 
 # Dependency versions
+GOLANGCI_VERSION   = 2.4.0
+GOTESTSUM_VERSION ?= 1.12.0
 
-KIND_NODE_IMAGE = "kindest/node:v1.19.11@sha256:07db187ae84b4b7de440a73886f008cf903fcf5764ba8106a9fd5243d6f32729"
-KIND_TMP_DIR = "$(PWD)/bin/test/dex-kind-kubeconfig"
+PROTOC_VERSION             = 29.3
+PROTOC_GEN_GO_VERSION      = 1.36.5
+PROTOC_GEN_GO_GRPC_VERSION = 1.5.1
 
-.PHONY: generate
-generate:
-	@go generate $(REPO_PATH)/storage/ent/
+KIND_VERSION    = 0.22.0
+KIND_NODE_IMAGE = "kindest/node:v1.25.3@sha256:cd248d1438192f7814fbca8fede13cfe5b9918746dfa12583976158a834fd5c5"
+KIND_TMP_DIR    = "$(PWD)/bin/test/dex-kind-kubeconfig"
 
-build: generate bin/dex
 
-bin/dex:
-	@mkdir -p bin/
-	@go install -v -ldflags $(LD_FLAGS) $(REPO_PATH)/cmd/dex
+##@ Build
 
-examples: bin/grpc-client bin/example-app
+build: bin/dex ## Build Dex binaries.
 
-bin/grpc-client:
-	@mkdir -p bin/
-	@cd examples/ && go install -v -ldflags $(LD_FLAGS) $(REPO_PATH)/examples/grpc-client
+examples: bin/grpc-client bin/example-app ## Build example app.
 
-bin/example-app:
-	@mkdir -p bin/
-	@cd examples/ && go install -v -ldflags $(LD_FLAGS) $(REPO_PATH)/examples/example-app
+.PHONY: update-gomplate
+update-gomplate: ## Check and update gomplate version in Dockerfile.
+	@./scripts/update-gomplate
 
 .PHONY: release-binary
 release-binary: LD_FLAGS = "-w -X main.version=$(VERSION) -extldflags \"-static\""
-release-binary: generate
+release-binary: ## Build release binaries (used to build a final container image).
 	@go build -o /go/bin/dex -v -ldflags $(LD_FLAGS) $(REPO_PATH)/cmd/dex
 	@go build -o /go/bin/docker-entrypoint -v -ldflags $(LD_FLAGS) $(REPO_PATH)/cmd/docker-entrypoint
 
-docker-compose.override.yaml:
-	cp docker-compose.override.yaml.dist docker-compose.override.yaml
-
-.PHONY: up
-up: docker-compose.override.yaml ## Launch the development environment
-	@ if [ docker-compose.override.yaml -ot docker-compose.override.yaml.dist ]; then diff -u docker-compose.override.yaml docker-compose.override.yaml.dist || (echo "!!! The distributed docker-compose.override.yaml example changed. Please update your file accordingly (or at least touch it). !!!" && false); fi
-	docker-compose up -d
-
-.PHONY: down
-down: clear ## Destroy the development environment
-	docker-compose down --volumes --remove-orphans --rmi local
-
-test:
-	@go test -v ./...
-
-testrace:
-	@go test -v --race ./...
-
-.PHONY: kind-up kind-down kind-tests
-kind-up:
-	@mkdir -p bin/test
-	@kind create cluster --image ${KIND_NODE_IMAGE} --kubeconfig ${KIND_TMP_DIR}
-
-kind-down:
-	@kind delete cluster
-	rm ${KIND_TMP_DIR}
-
-kind-tests: export DEX_KUBERNETES_CONFIG_PATH=${KIND_TMP_DIR}
-kind-tests: testall
-
-.PHONY: lint lint-fix
-lint: ## Run linter
-	golangci-lint run
-
-.PHONY: fix
-fix: ## Fix lint violations
-	golangci-lint run --fix
+bin/dex:
+	@mkdir -p bin/
+	@go install -v -ldflags $(LD_FLAGS) $(REPO_PATH)/cmd/dex
 
-.PHONY: docker-image
-docker-image:
-	@sudo docker build -t $(DOCKER_IMAGE) .
+bin/grpc-client:
+	@mkdir -p bin/
+	@cd examples/ && go install -v -ldflags $(LD_FLAGS) $(REPO_PATH)/examples/grpc-client
 
-.PHONY: verify-proto
-verify-proto: proto
-	@./scripts/git-diff
+bin/example-app:
+	@mkdir -p bin/
+	@cd examples/ && go install -v -ldflags $(LD_FLAGS) $(REPO_PATH)/examples/example-app
 
-clean:
-	@rm -rf bin/
 
-testall: testrace
+##@ Generate
 
-FORCE:
+.PHONY: generate
+generate: generate-proto generate-proto-internal generate-ent go-mod-tidy ## Run all generators.
 
-.PHONY: test testrace testall
+.PHONY: generate-ent
+generate-ent: ## Generate code for database ORM.
+	@go generate $(REPO_PATH)/storage/ent/
 
-.PHONY: proto
-proto:
+.PHONY: generate-proto
+generate-proto: ## Generate the Dex client's protobuf code.
 	@protoc --go_out=paths=source_relative:. --go-grpc_out=paths=source_relative:. api/v2/*.proto
 	@protoc --go_out=paths=source_relative:. --go-grpc_out=paths=source_relative:. api/*.proto
-	#@cp api/v2/*.proto api/
 
-.PHONY: proto-internal
-proto-internal:
+.PHONY: generate-proto-internal
+generate-proto-internal: ## Generate protobuf code for token encoding.
 	@protoc --go_out=paths=source_relative:. server/internal/*.proto
 
-# Dependency versions
-GOLANGCI_VERSION = 1.46.0
-GOTESTSUM_VERSION ?= 1.7.0
-PROTOC_VERSION = 3.15.6
-PROTOC_GEN_GO_VERSION = 1.26.0
-PROTOC_GEN_GO_GRPC_VERSION = 1.1.0
-KIND_VERSION = 0.11.1
-
-deps: bin/gotestsum bin/golangci-lint bin/protoc bin/protoc-gen-go bin/protoc-gen-go-grpc bin/kind
-
-bin/gotestsum:
-	@mkdir -p bin
-	curl -L https://github.com/gotestyourself/gotestsum/releases/download/v${GOTESTSUM_VERSION}/gotestsum_${GOTESTSUM_VERSION}_$(shell uname | tr A-Z a-z)_amd64.tar.gz | tar -zOxf - gotestsum > ./bin/gotestsum
-	@chmod +x ./bin/gotestsum
-
-bin/golangci-lint:
-	@mkdir -p bin
-	curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | BINARY=golangci-lint bash -s -- v${GOLANGCI_VERSION}
+go-mod-tidy: ## Run go mod tidy for all targets.
+	@go mod tidy
+	@cd examples/ && go mod tidy
+	@cd api/v2/ && go mod tidy
 
 bin/protoc:
 	@mkdir -p bin/protoc
@@ -156,7 +102,128 @@ bin/protoc-gen-go-grpc:
 	curl -L https://github.com/grpc/grpc-go/releases/download/cmd/protoc-gen-go-grpc/v${PROTOC_GEN_GO_GRPC_VERSION}/protoc-gen-go-grpc.v${PROTOC_GEN_GO_GRPC_VERSION}.$(shell uname | tr A-Z a-z).amd64.tar.gz | tar -zOxf - ./protoc-gen-go-grpc > ./bin/protoc-gen-go-grpc
 	@chmod +x ./bin/protoc-gen-go-grpc
 
+##@ Verify
+
+verify: generate ## Verify that all the code was generated and committed to repository.
+	@git diff --exit-code
+
+.PHONY: verify-proto
+verify-proto: generate-proto ## Verify that the Dex client's protobuf code was generated.
+	@git diff --exit-code
+
+.PHONY: verify-proto
+verify-proto-internal: generate-proto-internal ## Verify internal protobuf code for token encoding was generated.
+	@git diff --exit-code
+
+.PHONY: verify-ent
+verify-ent: generate-ent ## Verify code for database ORM was generated.
+	@git diff --exit-code
+
+.PHONY: verify-go-mod
+verify-go-mod: go-mod-tidy ## Check that go.mod and go.sum formatted according to the changes.
+	@git diff --exit-code
+
+##@ Test and Lint
+
+deps: bin/gotestsum bin/golangci-lint bin/protoc bin/protoc-gen-go bin/protoc-gen-go-grpc bin/kind ## Install dev dependencies.
+
+# Detect if we're running in GitHub Actions
+ifdef GITHUB_ACTIONS
+GOTESTSUM_FORMAT = github-actions
+else
+GOTESTSUM_FORMAT = testname
+GOTESTSUM_FORMAT_ICONS = hivis
+endif
+
+.PHONY: test testrace testall
+test: bin/gotestsum ## Test go code.
+ifdef GOTESTSUM_FORMAT_ICONS
+	@gotestsum --format $(GOTESTSUM_FORMAT) --format-icons $(GOTESTSUM_FORMAT_ICONS) -- -v ./...
+else
+	@gotestsum --format $(GOTESTSUM_FORMAT) -- -v ./...
+endif
+
+testrace: bin/gotestsum ## Test go code and check for possible race conditions.
+ifdef GOTESTSUM_FORMAT_ICONS
+	@gotestsum --format $(GOTESTSUM_FORMAT) --format-icons $(GOTESTSUM_FORMAT_ICONS) -- -v --race ./...
+else
+	@gotestsum --format $(GOTESTSUM_FORMAT) -- -v --race ./...
+endif
+
+testall: testrace ## Run all tests for go code.
+
+.PHONY: lint
+lint: ## Run linter.
+	@golangci-lint version
+	@golangci-lint run
+
+.PHONY: fix
+fix: ## Fix lint violations.
+	@golangci-lint version
+	@golangci-lint fmt
+
+docker-compose.override.yaml:
+	cp docker-compose.override.yaml.dist docker-compose.override.yaml
+
+.PHONY: up
+up: docker-compose.override.yaml ## Launch the development environment.
+	@ if [ docker-compose.override.yaml -ot docker-compose.override.yaml.dist ]; then diff -u docker-compose.override.yaml docker-compose.override.yaml.dist || (echo "!!! The distributed docker-compose.override.yaml example changed. Please update your file accordingly (or at least touch it). !!!" && false); fi
+	docker-compose up -d
+
+.PHONY: down
+down: clear ## Destroy the development environment.
+	docker-compose down --volumes --remove-orphans --rmi local
+
+.PHONY: kind-up kind-down kind-tests
+kind-up: ## Create a kind cluster.
+	@mkdir -p bin/test
+	@kind create cluster --image ${KIND_NODE_IMAGE} --kubeconfig ${KIND_TMP_DIR} --name dex-tests
+
+kind-tests: export DEX_KUBERNETES_CONFIG_PATH=${KIND_TMP_DIR}
+kind-tests: testall ## Run test on kind cluster (kind cluster must be created).
+
+kind-down: ## Delete the kind cluster.
+	@kind delete cluster --name dex-tests
+	rm ${KIND_TMP_DIR}
+
+bin/golangci-lint:
+	@mkdir -p bin
+	curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | BINARY=golangci-lint bash -s -- v${GOLANGCI_VERSION}
+
+bin/gotestsum:
+	@mkdir -p bin
+	curl -L https://github.com/gotestyourself/gotestsum/releases/download/v${GOTESTSUM_VERSION}/gotestsum_${GOTESTSUM_VERSION}_$(shell uname | tr A-Z a-z)_amd64.tar.gz | tar -zOxf - gotestsum > ./bin/gotestsum
+	@chmod +x ./bin/gotestsum
+
 bin/kind:
 	@mkdir -p bin
 	curl -L https://github.com/kubernetes-sigs/kind/releases/download/v${KIND_VERSION}/kind-$(shell uname | tr A-Z a-z)-amd64 > ./bin/kind
 	@chmod +x ./bin/kind
+
+##@ Clean
+clean: ## Delete all builds and downloaded dependencies.
+	@rm -rf bin/
+
+
+FORMATTING_BEGIN_YELLOW = \033[0;33m
+FORMATTING_BEGIN_BLUE = \033[36m
+FORMATTING_END = \033[0m
+
+.PHONY: help
+help:
+	@printf -- "${FORMATTING_BEGIN_BLUE}%s${FORMATTING_END}\n" \
+	"" \
+	"       ___             " \
+	"      / _ \_____ __    " \
+	"     / // / -_) \ /    " \
+	"    /____/\__/_\_\     " \
+	"" \
+	"-----------------------" \
+	""
+	@awk 'BEGIN {\
+	    FS = ":.*##"; \
+	    printf                "Usage: ${FORMATTING_BEGIN_BLUE}OPTION${FORMATTING_END}=<value> make ${FORMATTING_BEGIN_YELLOW}<target>${FORMATTING_END}\n"\
+	  } \
+	  /^[a-zA-Z0-9_-]+:.*?##/ { printf "  ${FORMATTING_BEGIN_BLUE}%-46s${FORMATTING_END} %s\n", $$1, $$2 } \
+	  /^.?.?##~/              { printf "   %-46s${FORMATTING_BEGIN_YELLOW}%-46s${FORMATTING_END}\n", "", substr($$1, 6) } \
+	  /^##@/                  { printf "\n\033[1m%s\033[0m\n", substr($$0, 5) } ' $(MAKEFILE_LIST)
diff --git a/README.md b/README.md
index 271376d65e..41fc3f2281 100644
--- a/README.md
+++ b/README.md
@@ -1,8 +1,10 @@
 # dex - A federated OpenID Connect provider
 
-![GitHub Workflow Status](https://img.shields.io/github/workflow/status/dexidp/dex/CI?style=flat-square)
+![GitHub Workflow Status](https://img.shields.io/github/actions/workflow/status/dexidp/dex/ci.yaml?style=flat-square&branch=master)
+[![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/dexidp/dex/badge?style=flat-square)](https://api.securityscorecards.dev/projects/github.com/dexidp/dex)
+[![OpenSSF Best Practices](https://www.bestpractices.dev/projects/12566/badge)](https://www.bestpractices.dev/projects/12566)
 [![Go Report Card](https://goreportcard.com/badge/github.com/dexidp/dex?style=flat-square)](https://goreportcard.com/report/github.com/dexidp/dex)
-[![Gitpod ready-to-code](https://img.shields.io/badge/Gitpod-ready--to--code-blue?logo=gitpod&style=flat-square)](https://gitpod.io/#https://github.com/dexidp/dex)
+[![LFX Health Score](https://insights.linuxfoundation.org/api/badge/health-score?project=dex)](https://insights.linuxfoundation.org/project/dex/contributors)
 
 ![logo](docs/logos/dex-horizontal-color.png)
 
@@ -12,7 +14,7 @@ Dex acts as a portal to other identity providers through ["connectors."](#connec
 
 ## ID Tokens
 
-ID Tokens are an OAuth2 extension introduced by OpenID Connect and dex's primary feature. ID Tokens are [JSON Web Tokens][jwt-io] (JWTs) signed by dex and returned as part of the OAuth2 response that attest to the end user's identity. An example JWT might look like:
+ID Tokens are an OAuth2 extension introduced by OpenID Connect and dex's primary feature. ID Tokens are [JSON Web Tokens][jwt-io] (JWTs) signed by dex and returned as part of the OAuth2 response that attests to the end user's identity. An example JWT might look like:
 
 ```
 eyJhbGciOiJSUzI1NiIsImtpZCI6IjlkNDQ3NDFmNzczYjkzOGNmNjVkZDMyNjY4NWI4NjE4MGMzMjRkOTkifQ.eyJpc3MiOiJodHRwOi8vMTI3LjAuMC4xOjU1NTYvZGV4Iiwic3ViIjoiQ2djeU16UXlOelE1RWdabmFYUm9kV0kiLCJhdWQiOiJleGFtcGxlLWFwcCIsImV4cCI6MTQ5Mjg4MjA0MiwiaWF0IjoxNDkyNzk1NjQyLCJhdF9oYXNoIjoiYmk5NmdPWFpTaHZsV1l0YWw5RXFpdyIsImVtYWlsIjoiZXJpYy5jaGlhbmdAY29yZW9zLmNvbSIsImVtYWlsX3ZlcmlmaWVkIjp0cnVlLCJncm91cHMiOlsiYWRtaW5zIiwiZGV2ZWxvcGVycyJdLCJuYW1lIjoiRXJpYyBDaGlhbmcifQ.OhROPq_0eP-zsQRjg87KZ4wGkjiQGnTi5QuG877AdJDb3R2ZCOk2Vkf5SdP8cPyb3VMqL32G4hLDayniiv8f1_ZXAde0sKrayfQ10XAXFgZl_P1yilkLdknxn6nbhDRVllpWcB12ki9vmAxklAr0B1C4kr5nI3-BZLrFcUR5sQbxwJj4oW1OuG6jJCNGHXGNTBTNEaM28eD-9nhfBeuBTzzO7BKwPsojjj4C9ogU4JQhGvm_l4yfVi0boSx8c0FX3JsiB0yLa1ZdJVWVl9m90XmbWRSD85pNDQHcWZP9hR6CMgbvGkZsgjG32qeRwUL_eNkNowSBNWLrGNPoON1gMg
@@ -43,14 +45,14 @@ Because these tokens are signed by dex and [contain standard-based claims][stand
 * [Kubernetes][kubernetes]
 * [AWS STS][aws-sts]
 
-For details on how to request or validate an ID Token, see [_"Writing apps that use dex"_][using-dex].
+For details on how to request or validate an ID Token, see [_"Writing apps that use dex"_](https://dexidp.io/docs/using-dex/).
 
 ## Kubernetes and Dex
 
-Dex runs natively on top of any Kubernetes cluster using Custom Resource Definitions and can drive API server authentication through the OpenID Connect plugin. Clients, such as the [`kubernetes-dashboard`](https://github.com/kubernetes/dashboard) and `kubectl`, can act on behalf of users who can login to the cluster through any identity provider dex supports.
+Dex runs natively on top of any Kubernetes cluster using Custom Resource Definitions and can drive API server authentication through the OpenID Connect plugin. Clients, such as [`kubelogin`](https://github.com/int128/kubelogin) and `kubectl`, can act on behalf of users who can login to the cluster through any identity provider dex supports.
 
-* More docs for running dex as a Kubernetes authenticator can be found [here](https://dexidp.io/docs/kubernetes/).
-* You can find more about companies and projects, which uses dex, [here](./ADOPTERS.md).
+* More docs for running dex as a Kubernetes authenticator can be found [here](https://dexidp.io/docs/guides/kubernetes/).
+* You can find more about companies and projects which use dex, [here](./ADOPTERS.md).
 
 ## Connectors
 
@@ -77,8 +79,8 @@ Dex implements the following connectors:
 | [Microsoft](https://dexidp.io/docs/connectors/microsoft/) | yes | yes | no | beta | |
 | [AuthProxy](https://dexidp.io/docs/connectors/authproxy/) | no | yes | no | alpha | Authentication proxies such as Apache2 mod_auth, etc. |
 | [Bitbucket Cloud](https://dexidp.io/docs/connectors/bitbucketcloud/) | yes | yes | no | alpha | |
-| [OpenShift](https://dexidp.io/docs/connectors/openshift/) | no | yes | no | alpha | |
-| [Atlassian Crowd](https://dexidp.io/docs/connectors/atlassiancrowd/) | yes | yes | yes * | beta | preferred_username claim must be configured through config |
+| [OpenShift](https://dexidp.io/docs/connectors/openshift/) | yes | yes | no | alpha | |
+| [Atlassian Crowd](https://dexidp.io/docs/connectors/atlassian-crowd/) | yes | yes | yes * | beta | preferred_username claim must be configured through config |
 | [Gitea](https://dexidp.io/docs/connectors/gitea/) | yes | no | yes | beta | |
 | [OpenStack Keystone](https://dexidp.io/docs/connectors/keystone/) | yes | yes | no | alpha | |
 
@@ -92,16 +94,7 @@ All changes or deprecations of connector features will be announced in the [rele
 
 ## Documentation
 
-* [Getting started](https://dexidp.io/docs/getting-started/)
-* [Intro to OpenID Connect](https://dexidp.io/docs/openid-connect/)
-* [Writing apps that use dex][using-dex]
-* [What's new in v2](https://dexidp.io/docs/v2/)
-* [Custom scopes, claims, and client features](https://dexidp.io/docs/custom-scopes-claims-clients/)
-* [Storage options](https://dexidp.io/docs/storage/)
-* [gRPC API](https://dexidp.io/docs/api/)
-* [Using Kubernetes with dex](https://dexidp.io/docs/kubernetes/)
-* Client libraries
-  * [Go][go-oidc]
+See the [official documentation](https://dexidp.io/docs/) for getting started, configuration, and usage guides.
 
 ## Reporting a vulnerability
 
@@ -113,30 +106,18 @@ Please see our [security policy](.github/SECURITY.md) for details about reportin
 - For general discussion about both using and developing Dex:
     - join the [#dexidp](https://cloud-native.slack.com/messages/dexidp) on the CNCF Slack
     - open a new [discussion](https://github.com/dexidp/dex/discussions)
-    - join the [dex-dev](https://groups.google.com/forum/#!forum/dex-dev) mailing list
 
 [openid-connect]: https://openid.net/connect/
 [standard-claims]: https://openid.net/specs/openid-connect-core-1_0.html#StandardClaims
 [scopes]: https://dexidp.io/docs/custom-scopes-claims-clients/#scopes
-[using-dex]: https://dexidp.io/docs/using-dex/
 [jwt-io]: https://jwt.io/
-[kubernetes]: http://kubernetes.io/docs/admin/authentication/#openid-connect-tokens
+[kubernetes]: https://kubernetes.io/docs/reference/access-authn-authz/authentication/#openid-connect-tokens
 [aws-sts]: https://docs.aws.amazon.com/STS/latest/APIReference/Welcome.html
-[go-oidc]: https://github.com/coreos/go-oidc
-[issue-1065]: https://github.com/dexidp/dex/issues/1065
 [release-notes]: https://github.com/dexidp/dex/releases
 
-## Development
+## Contributing
 
-When all coding and testing is done, please run the test suite:
-
-```shell
-make testall
-```
-
-For the best developer experience, install [Nix](https://builtwithnix.org/) and [direnv](https://direnv.net/).
-
-Alternatively, install Go and Docker manually or using a package manager. Install the rest of the dependencies by running `make deps`.
+Please see [CONTRIBUTING.md](CONTRIBUTING.md) for development setup, guidelines, and how to submit pull requests.
 
 ## License
 
diff --git a/api/api.pb.go b/api/api.pb.go
index 6d1c2ca82e..23c6141071 100644
--- a/api/api.pb.go
+++ b/api/api.pb.go
@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.26.0
-// 	protoc        v3.15.6
+// 	protoc-gen-go v1.36.5
+// 	protoc        v5.29.3
 // source: api/api.proto
 
 package api
@@ -11,6 +11,7 @@ import (
 	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
 	reflect "reflect"
 	sync "sync"
+	unsafe "unsafe"
 )
 
 const (
@@ -22,26 +23,24 @@ const (
 
 // Client represents an OAuth2 client.
 type Client struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-
-	Id           string   `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
-	Secret       string   `protobuf:"bytes,2,opt,name=secret,proto3" json:"secret,omitempty"`
-	RedirectUris []string `protobuf:"bytes,3,rep,name=redirect_uris,json=redirectUris,proto3" json:"redirect_uris,omitempty"`
-	TrustedPeers []string `protobuf:"bytes,4,rep,name=trusted_peers,json=trustedPeers,proto3" json:"trusted_peers,omitempty"`
-	Public       bool     `protobuf:"varint,5,opt,name=public,proto3" json:"public,omitempty"`
-	Name         string   `protobuf:"bytes,6,opt,name=name,proto3" json:"name,omitempty"`
-	LogoUrl      string   `protobuf:"bytes,7,opt,name=logo_url,json=logoUrl,proto3" json:"logo_url,omitempty"`
+	state             protoimpl.MessageState `protogen:"open.v1"`
+	Id                string                 `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
+	Secret            string                 `protobuf:"bytes,2,opt,name=secret,proto3" json:"secret,omitempty"`
+	RedirectUris      []string               `protobuf:"bytes,3,rep,name=redirect_uris,json=redirectUris,proto3" json:"redirect_uris,omitempty"`
+	TrustedPeers      []string               `protobuf:"bytes,4,rep,name=trusted_peers,json=trustedPeers,proto3" json:"trusted_peers,omitempty"`
+	Public            bool                   `protobuf:"varint,5,opt,name=public,proto3" json:"public,omitempty"`
+	Name              string                 `protobuf:"bytes,6,opt,name=name,proto3" json:"name,omitempty"`
+	LogoUrl           string                 `protobuf:"bytes,7,opt,name=logo_url,json=logoUrl,proto3" json:"logo_url,omitempty"`
+	AllowedConnectors []string               `protobuf:"bytes,8,rep,name=allowed_connectors,json=allowedConnectors,proto3" json:"allowed_connectors,omitempty"`
+	unknownFields     protoimpl.UnknownFields
+	sizeCache         protoimpl.SizeCache
 }
 
 func (x *Client) Reset() {
 	*x = Client{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_api_api_proto_msgTypes[0]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_api_api_proto_msgTypes[0]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *Client) String() string {
@@ -52,7 +51,7 @@ func (*Client) ProtoMessage() {}
 
 func (x *Client) ProtoReflect() protoreflect.Message {
 	mi := &file_api_api_proto_msgTypes[0]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -116,22 +115,26 @@ func (x *Client) GetLogoUrl() string {
 	return ""
 }
 
+func (x *Client) GetAllowedConnectors() []string {
+	if x != nil {
+		return x.AllowedConnectors
+	}
+	return nil
+}
+
 // CreateClientReq is a request to make a client.
 type CreateClientReq struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Client        *Client                `protobuf:"bytes,1,opt,name=client,proto3" json:"client,omitempty"`
 	unknownFields protoimpl.UnknownFields
-
-	Client *Client `protobuf:"bytes,1,opt,name=client,proto3" json:"client,omitempty"`
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *CreateClientReq) Reset() {
 	*x = CreateClientReq{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_api_api_proto_msgTypes[1]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_api_api_proto_msgTypes[1]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *CreateClientReq) String() string {
@@ -142,7 +145,7 @@ func (*CreateClientReq) ProtoMessage() {}
 
 func (x *CreateClientReq) ProtoReflect() protoreflect.Message {
 	mi := &file_api_api_proto_msgTypes[1]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -166,21 +169,18 @@ func (x *CreateClientReq) GetClient() *Client {
 
 // CreateClientResp returns the response from creating a client.
 type CreateClientResp struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	AlreadyExists bool                   `protobuf:"varint,1,opt,name=already_exists,json=alreadyExists,proto3" json:"already_exists,omitempty"`
+	Client        *Client                `protobuf:"bytes,2,opt,name=client,proto3" json:"client,omitempty"`
 	unknownFields protoimpl.UnknownFields
-
-	AlreadyExists bool    `protobuf:"varint,1,opt,name=already_exists,json=alreadyExists,proto3" json:"already_exists,omitempty"`
-	Client        *Client `protobuf:"bytes,2,opt,name=client,proto3" json:"client,omitempty"`
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *CreateClientResp) Reset() {
 	*x = CreateClientResp{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_api_api_proto_msgTypes[2]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_api_api_proto_msgTypes[2]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *CreateClientResp) String() string {
@@ -191,7 +191,7 @@ func (*CreateClientResp) ProtoMessage() {}
 
 func (x *CreateClientResp) ProtoReflect() protoreflect.Message {
 	mi := &file_api_api_proto_msgTypes[2]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -222,21 +222,18 @@ func (x *CreateClientResp) GetClient() *Client {
 
 // DeleteClientReq is a request to delete a client.
 type DeleteClientReq struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-
+	state protoimpl.MessageState `protogen:"open.v1"`
 	// The ID of the client.
-	Id string `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
+	Id            string `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *DeleteClientReq) Reset() {
 	*x = DeleteClientReq{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_api_api_proto_msgTypes[3]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_api_api_proto_msgTypes[3]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *DeleteClientReq) String() string {
@@ -247,7 +244,7 @@ func (*DeleteClientReq) ProtoMessage() {}
 
 func (x *DeleteClientReq) ProtoReflect() protoreflect.Message {
 	mi := &file_api_api_proto_msgTypes[3]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -271,20 +268,17 @@ func (x *DeleteClientReq) GetId() string {
 
 // DeleteClientResp determines if the client is deleted successfully.
 type DeleteClientResp struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	NotFound      bool                   `protobuf:"varint,1,opt,name=not_found,json=notFound,proto3" json:"not_found,omitempty"`
 	unknownFields protoimpl.UnknownFields
-
-	NotFound bool `protobuf:"varint,1,opt,name=not_found,json=notFound,proto3" json:"not_found,omitempty"`
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *DeleteClientResp) Reset() {
 	*x = DeleteClientResp{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_api_api_proto_msgTypes[4]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_api_api_proto_msgTypes[4]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *DeleteClientResp) String() string {
@@ -295,7 +289,7 @@ func (*DeleteClientResp) ProtoMessage() {}
 
 func (x *DeleteClientResp) ProtoReflect() protoreflect.Message {
 	mi := &file_api_api_proto_msgTypes[4]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -319,24 +313,22 @@ func (x *DeleteClientResp) GetNotFound() bool {
 
 // UpdateClientReq is a request to update an existing client.
 type UpdateClientReq struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-
-	Id           string   `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
-	RedirectUris []string `protobuf:"bytes,2,rep,name=redirect_uris,json=redirectUris,proto3" json:"redirect_uris,omitempty"`
-	TrustedPeers []string `protobuf:"bytes,3,rep,name=trusted_peers,json=trustedPeers,proto3" json:"trusted_peers,omitempty"`
-	Name         string   `protobuf:"bytes,4,opt,name=name,proto3" json:"name,omitempty"`
-	LogoUrl      string   `protobuf:"bytes,5,opt,name=logo_url,json=logoUrl,proto3" json:"logo_url,omitempty"`
+	state             protoimpl.MessageState `protogen:"open.v1"`
+	Id                string                 `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
+	RedirectUris      []string               `protobuf:"bytes,2,rep,name=redirect_uris,json=redirectUris,proto3" json:"redirect_uris,omitempty"`
+	TrustedPeers      []string               `protobuf:"bytes,3,rep,name=trusted_peers,json=trustedPeers,proto3" json:"trusted_peers,omitempty"`
+	Name              string                 `protobuf:"bytes,4,opt,name=name,proto3" json:"name,omitempty"`
+	LogoUrl           string                 `protobuf:"bytes,5,opt,name=logo_url,json=logoUrl,proto3" json:"logo_url,omitempty"`
+	AllowedConnectors []string               `protobuf:"bytes,6,rep,name=allowed_connectors,json=allowedConnectors,proto3" json:"allowed_connectors,omitempty"`
+	unknownFields     protoimpl.UnknownFields
+	sizeCache         protoimpl.SizeCache
 }
 
 func (x *UpdateClientReq) Reset() {
 	*x = UpdateClientReq{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_api_api_proto_msgTypes[5]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_api_api_proto_msgTypes[5]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *UpdateClientReq) String() string {
@@ -347,7 +339,7 @@ func (*UpdateClientReq) ProtoMessage() {}
 
 func (x *UpdateClientReq) ProtoReflect() protoreflect.Message {
 	mi := &file_api_api_proto_msgTypes[5]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -397,22 +389,26 @@ func (x *UpdateClientReq) GetLogoUrl() string {
 	return ""
 }
 
+func (x *UpdateClientReq) GetAllowedConnectors() []string {
+	if x != nil {
+		return x.AllowedConnectors
+	}
+	return nil
+}
+
 // UpdateClientResp returns the response from updating a client.
 type UpdateClientResp struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	NotFound      bool                   `protobuf:"varint,1,opt,name=not_found,json=notFound,proto3" json:"not_found,omitempty"`
 	unknownFields protoimpl.UnknownFields
-
-	NotFound bool `protobuf:"varint,1,opt,name=not_found,json=notFound,proto3" json:"not_found,omitempty"`
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *UpdateClientResp) Reset() {
 	*x = UpdateClientResp{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_api_api_proto_msgTypes[6]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_api_api_proto_msgTypes[6]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *UpdateClientResp) String() string {
@@ -423,7 +419,7 @@ func (*UpdateClientResp) ProtoMessage() {}
 
 func (x *UpdateClientResp) ProtoReflect() protoreflect.Message {
 	mi := &file_api_api_proto_msgTypes[6]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -447,24 +443,21 @@ func (x *UpdateClientResp) GetNotFound() bool {
 
 // Password is an email for password mapping managed by the storage.
 type Password struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-
-	Email string `protobuf:"bytes,1,opt,name=email,proto3" json:"email,omitempty"`
+	state protoimpl.MessageState `protogen:"open.v1"`
+	Email string                 `protobuf:"bytes,1,opt,name=email,proto3" json:"email,omitempty"`
 	// Currently we do not accept plain text passwords. Could be an option in the future.
-	Hash     []byte `protobuf:"bytes,2,opt,name=hash,proto3" json:"hash,omitempty"`
-	Username string `protobuf:"bytes,3,opt,name=username,proto3" json:"username,omitempty"`
-	UserId   string `protobuf:"bytes,4,opt,name=user_id,json=userId,proto3" json:"user_id,omitempty"`
+	Hash          []byte `protobuf:"bytes,2,opt,name=hash,proto3" json:"hash,omitempty"`
+	Username      string `protobuf:"bytes,3,opt,name=username,proto3" json:"username,omitempty"`
+	UserId        string `protobuf:"bytes,4,opt,name=user_id,json=userId,proto3" json:"user_id,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *Password) Reset() {
 	*x = Password{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_api_api_proto_msgTypes[7]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_api_api_proto_msgTypes[7]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *Password) String() string {
@@ -475,7 +468,7 @@ func (*Password) ProtoMessage() {}
 
 func (x *Password) ProtoReflect() protoreflect.Message {
 	mi := &file_api_api_proto_msgTypes[7]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -520,20 +513,17 @@ func (x *Password) GetUserId() string {
 
 // CreatePasswordReq is a request to make a password.
 type CreatePasswordReq struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Password      *Password              `protobuf:"bytes,1,opt,name=password,proto3" json:"password,omitempty"`
 	unknownFields protoimpl.UnknownFields
-
-	Password *Password `protobuf:"bytes,1,opt,name=password,proto3" json:"password,omitempty"`
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *CreatePasswordReq) Reset() {
 	*x = CreatePasswordReq{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_api_api_proto_msgTypes[8]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_api_api_proto_msgTypes[8]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *CreatePasswordReq) String() string {
@@ -544,7 +534,7 @@ func (*CreatePasswordReq) ProtoMessage() {}
 
 func (x *CreatePasswordReq) ProtoReflect() protoreflect.Message {
 	mi := &file_api_api_proto_msgTypes[8]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -568,20 +558,17 @@ func (x *CreatePasswordReq) GetPassword() *Password {
 
 // CreatePasswordResp returns the response from creating a password.
 type CreatePasswordResp struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	AlreadyExists bool                   `protobuf:"varint,1,opt,name=already_exists,json=alreadyExists,proto3" json:"already_exists,omitempty"`
 	unknownFields protoimpl.UnknownFields
-
-	AlreadyExists bool `protobuf:"varint,1,opt,name=already_exists,json=alreadyExists,proto3" json:"already_exists,omitempty"`
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *CreatePasswordResp) Reset() {
 	*x = CreatePasswordResp{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_api_api_proto_msgTypes[9]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_api_api_proto_msgTypes[9]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *CreatePasswordResp) String() string {
@@ -592,7 +579,7 @@ func (*CreatePasswordResp) ProtoMessage() {}
 
 func (x *CreatePasswordResp) ProtoReflect() protoreflect.Message {
 	mi := &file_api_api_proto_msgTypes[9]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -616,23 +603,20 @@ func (x *CreatePasswordResp) GetAlreadyExists() bool {
 
 // UpdatePasswordReq is a request to modify an existing password.
 type UpdatePasswordReq struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-
+	state protoimpl.MessageState `protogen:"open.v1"`
 	// The email used to lookup the password. This field cannot be modified
-	Email       string `protobuf:"bytes,1,opt,name=email,proto3" json:"email,omitempty"`
-	NewHash     []byte `protobuf:"bytes,2,opt,name=new_hash,json=newHash,proto3" json:"new_hash,omitempty"`
-	NewUsername string `protobuf:"bytes,3,opt,name=new_username,json=newUsername,proto3" json:"new_username,omitempty"`
+	Email         string `protobuf:"bytes,1,opt,name=email,proto3" json:"email,omitempty"`
+	NewHash       []byte `protobuf:"bytes,2,opt,name=new_hash,json=newHash,proto3" json:"new_hash,omitempty"`
+	NewUsername   string `protobuf:"bytes,3,opt,name=new_username,json=newUsername,proto3" json:"new_username,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *UpdatePasswordReq) Reset() {
 	*x = UpdatePasswordReq{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_api_api_proto_msgTypes[10]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_api_api_proto_msgTypes[10]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *UpdatePasswordReq) String() string {
@@ -643,7 +627,7 @@ func (*UpdatePasswordReq) ProtoMessage() {}
 
 func (x *UpdatePasswordReq) ProtoReflect() protoreflect.Message {
 	mi := &file_api_api_proto_msgTypes[10]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -681,20 +665,17 @@ func (x *UpdatePasswordReq) GetNewUsername() string {
 
 // UpdatePasswordResp returns the response from modifying an existing password.
 type UpdatePasswordResp struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	NotFound      bool                   `protobuf:"varint,1,opt,name=not_found,json=notFound,proto3" json:"not_found,omitempty"`
 	unknownFields protoimpl.UnknownFields
-
-	NotFound bool `protobuf:"varint,1,opt,name=not_found,json=notFound,proto3" json:"not_found,omitempty"`
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *UpdatePasswordResp) Reset() {
 	*x = UpdatePasswordResp{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_api_api_proto_msgTypes[11]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_api_api_proto_msgTypes[11]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *UpdatePasswordResp) String() string {
@@ -705,7 +686,7 @@ func (*UpdatePasswordResp) ProtoMessage() {}
 
 func (x *UpdatePasswordResp) ProtoReflect() protoreflect.Message {
 	mi := &file_api_api_proto_msgTypes[11]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -729,20 +710,17 @@ func (x *UpdatePasswordResp) GetNotFound() bool {
 
 // DeletePasswordReq is a request to delete a password.
 type DeletePasswordReq struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Email         string                 `protobuf:"bytes,1,opt,name=email,proto3" json:"email,omitempty"`
 	unknownFields protoimpl.UnknownFields
-
-	Email string `protobuf:"bytes,1,opt,name=email,proto3" json:"email,omitempty"`
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *DeletePasswordReq) Reset() {
 	*x = DeletePasswordReq{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_api_api_proto_msgTypes[12]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_api_api_proto_msgTypes[12]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *DeletePasswordReq) String() string {
@@ -753,7 +731,7 @@ func (*DeletePasswordReq) ProtoMessage() {}
 
 func (x *DeletePasswordReq) ProtoReflect() protoreflect.Message {
 	mi := &file_api_api_proto_msgTypes[12]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -777,20 +755,17 @@ func (x *DeletePasswordReq) GetEmail() string {
 
 // DeletePasswordResp returns the response from deleting a password.
 type DeletePasswordResp struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	NotFound      bool                   `protobuf:"varint,1,opt,name=not_found,json=notFound,proto3" json:"not_found,omitempty"`
 	unknownFields protoimpl.UnknownFields
-
-	NotFound bool `protobuf:"varint,1,opt,name=not_found,json=notFound,proto3" json:"not_found,omitempty"`
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *DeletePasswordResp) Reset() {
 	*x = DeletePasswordResp{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_api_api_proto_msgTypes[13]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_api_api_proto_msgTypes[13]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *DeletePasswordResp) String() string {
@@ -801,7 +776,7 @@ func (*DeletePasswordResp) ProtoMessage() {}
 
 func (x *DeletePasswordResp) ProtoReflect() protoreflect.Message {
 	mi := &file_api_api_proto_msgTypes[13]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -825,18 +800,16 @@ func (x *DeletePasswordResp) GetNotFound() bool {
 
 // ListPasswordReq is a request to enumerate passwords.
 type ListPasswordReq struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
+	state         protoimpl.MessageState `protogen:"open.v1"`
 	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *ListPasswordReq) Reset() {
 	*x = ListPasswordReq{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_api_api_proto_msgTypes[14]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_api_api_proto_msgTypes[14]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *ListPasswordReq) String() string {
@@ -847,7 +820,7 @@ func (*ListPasswordReq) ProtoMessage() {}
 
 func (x *ListPasswordReq) ProtoReflect() protoreflect.Message {
 	mi := &file_api_api_proto_msgTypes[14]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -864,20 +837,17 @@ func (*ListPasswordReq) Descriptor() ([]byte, []int) {
 
 // ListPasswordResp returns a list of passwords.
 type ListPasswordResp struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Passwords     []*Password            `protobuf:"bytes,1,rep,name=passwords,proto3" json:"passwords,omitempty"`
 	unknownFields protoimpl.UnknownFields
-
-	Passwords []*Password `protobuf:"bytes,1,rep,name=passwords,proto3" json:"passwords,omitempty"`
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *ListPasswordResp) Reset() {
 	*x = ListPasswordResp{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_api_api_proto_msgTypes[15]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_api_api_proto_msgTypes[15]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *ListPasswordResp) String() string {
@@ -888,7 +858,7 @@ func (*ListPasswordResp) ProtoMessage() {}
 
 func (x *ListPasswordResp) ProtoReflect() protoreflect.Message {
 	mi := &file_api_api_proto_msgTypes[15]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -912,18 +882,16 @@ func (x *ListPasswordResp) GetPasswords() []*Password {
 
 // VersionReq is a request to fetch version info.
 type VersionReq struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
+	state         protoimpl.MessageState `protogen:"open.v1"`
 	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *VersionReq) Reset() {
 	*x = VersionReq{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_api_api_proto_msgTypes[16]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_api_api_proto_msgTypes[16]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *VersionReq) String() string {
@@ -934,7 +902,7 @@ func (*VersionReq) ProtoMessage() {}
 
 func (x *VersionReq) ProtoReflect() protoreflect.Message {
 	mi := &file_api_api_proto_msgTypes[16]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -951,24 +919,21 @@ func (*VersionReq) Descriptor() ([]byte, []int) {
 
 // VersionResp holds the version info of components.
 type VersionResp struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-
+	state protoimpl.MessageState `protogen:"open.v1"`
 	// Semantic version of the server.
 	Server string `protobuf:"bytes,1,opt,name=server,proto3" json:"server,omitempty"`
-	// Numeric version of the API. It increases everytime a new call is added to the API.
+	// Numeric version of the API. It increases every time a new call is added to the API.
 	// Clients should use this info to determine if the server supports specific features.
-	Api int32 `protobuf:"varint,2,opt,name=api,proto3" json:"api,omitempty"`
+	Api           int32 `protobuf:"varint,2,opt,name=api,proto3" json:"api,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *VersionResp) Reset() {
 	*x = VersionResp{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_api_api_proto_msgTypes[17]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_api_api_proto_msgTypes[17]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *VersionResp) String() string {
@@ -979,7 +944,7 @@ func (*VersionResp) ProtoMessage() {}
 
 func (x *VersionResp) ProtoReflect() protoreflect.Message {
 	mi := &file_api_api_proto_msgTypes[17]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -1010,24 +975,21 @@ func (x *VersionResp) GetApi() int32 {
 
 // RefreshTokenRef contains the metadata for a refresh token that is managed by the storage.
 type RefreshTokenRef struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-
+	state protoimpl.MessageState `protogen:"open.v1"`
 	// ID of the refresh token.
-	Id        string `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
-	ClientId  string `protobuf:"bytes,2,opt,name=client_id,json=clientId,proto3" json:"client_id,omitempty"`
-	CreatedAt int64  `protobuf:"varint,5,opt,name=created_at,json=createdAt,proto3" json:"created_at,omitempty"`
-	LastUsed  int64  `protobuf:"varint,6,opt,name=last_used,json=lastUsed,proto3" json:"last_used,omitempty"`
+	Id            string `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
+	ClientId      string `protobuf:"bytes,2,opt,name=client_id,json=clientId,proto3" json:"client_id,omitempty"`
+	CreatedAt     int64  `protobuf:"varint,5,opt,name=created_at,json=createdAt,proto3" json:"created_at,omitempty"`
+	LastUsed      int64  `protobuf:"varint,6,opt,name=last_used,json=lastUsed,proto3" json:"last_used,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *RefreshTokenRef) Reset() {
 	*x = RefreshTokenRef{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_api_api_proto_msgTypes[18]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_api_api_proto_msgTypes[18]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *RefreshTokenRef) String() string {
@@ -1038,7 +1000,7 @@ func (*RefreshTokenRef) ProtoMessage() {}
 
 func (x *RefreshTokenRef) ProtoReflect() protoreflect.Message {
 	mi := &file_api_api_proto_msgTypes[18]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -1083,21 +1045,18 @@ func (x *RefreshTokenRef) GetLastUsed() int64 {
 
 // ListRefreshReq is a request to enumerate the refresh tokens of a user.
 type ListRefreshReq struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-
+	state protoimpl.MessageState `protogen:"open.v1"`
 	// The "sub" claim returned in the ID Token.
-	UserId string `protobuf:"bytes,1,opt,name=user_id,json=userId,proto3" json:"user_id,omitempty"`
+	UserId        string `protobuf:"bytes,1,opt,name=user_id,json=userId,proto3" json:"user_id,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *ListRefreshReq) Reset() {
 	*x = ListRefreshReq{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_api_api_proto_msgTypes[19]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_api_api_proto_msgTypes[19]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *ListRefreshReq) String() string {
@@ -1108,7 +1067,7 @@ func (*ListRefreshReq) ProtoMessage() {}
 
 func (x *ListRefreshReq) ProtoReflect() protoreflect.Message {
 	mi := &file_api_api_proto_msgTypes[19]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -1132,20 +1091,17 @@ func (x *ListRefreshReq) GetUserId() string {
 
 // ListRefreshResp returns a list of refresh tokens for a user.
 type ListRefreshResp struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	RefreshTokens []*RefreshTokenRef     `protobuf:"bytes,1,rep,name=refresh_tokens,json=refreshTokens,proto3" json:"refresh_tokens,omitempty"`
 	unknownFields protoimpl.UnknownFields
-
-	RefreshTokens []*RefreshTokenRef `protobuf:"bytes,1,rep,name=refresh_tokens,json=refreshTokens,proto3" json:"refresh_tokens,omitempty"`
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *ListRefreshResp) Reset() {
 	*x = ListRefreshResp{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_api_api_proto_msgTypes[20]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_api_api_proto_msgTypes[20]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *ListRefreshResp) String() string {
@@ -1156,7 +1112,7 @@ func (*ListRefreshResp) ProtoMessage() {}
 
 func (x *ListRefreshResp) ProtoReflect() protoreflect.Message {
 	mi := &file_api_api_proto_msgTypes[20]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -1180,22 +1136,19 @@ func (x *ListRefreshResp) GetRefreshTokens() []*RefreshTokenRef {
 
 // RevokeRefreshReq is a request to revoke the refresh token of the user-client pair.
 type RevokeRefreshReq struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-
+	state protoimpl.MessageState `protogen:"open.v1"`
 	// The "sub" claim returned in the ID Token.
-	UserId   string `protobuf:"bytes,1,opt,name=user_id,json=userId,proto3" json:"user_id,omitempty"`
-	ClientId string `protobuf:"bytes,2,opt,name=client_id,json=clientId,proto3" json:"client_id,omitempty"`
+	UserId        string `protobuf:"bytes,1,opt,name=user_id,json=userId,proto3" json:"user_id,omitempty"`
+	ClientId      string `protobuf:"bytes,2,opt,name=client_id,json=clientId,proto3" json:"client_id,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *RevokeRefreshReq) Reset() {
 	*x = RevokeRefreshReq{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_api_api_proto_msgTypes[21]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_api_api_proto_msgTypes[21]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *RevokeRefreshReq) String() string {
@@ -1206,7 +1159,7 @@ func (*RevokeRefreshReq) ProtoMessage() {}
 
 func (x *RevokeRefreshReq) ProtoReflect() protoreflect.Message {
 	mi := &file_api_api_proto_msgTypes[21]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -1237,21 +1190,18 @@ func (x *RevokeRefreshReq) GetClientId() string {
 
 // RevokeRefreshResp determines if the refresh token is revoked successfully.
 type RevokeRefreshResp struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-
+	state protoimpl.MessageState `protogen:"open.v1"`
 	// Set to true is refresh token was not found and token could not be revoked.
-	NotFound bool `protobuf:"varint,1,opt,name=not_found,json=notFound,proto3" json:"not_found,omitempty"`
+	NotFound      bool `protobuf:"varint,1,opt,name=not_found,json=notFound,proto3" json:"not_found,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *RevokeRefreshResp) Reset() {
 	*x = RevokeRefreshResp{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_api_api_proto_msgTypes[22]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_api_api_proto_msgTypes[22]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *RevokeRefreshResp) String() string {
@@ -1262,7 +1212,7 @@ func (*RevokeRefreshResp) ProtoMessage() {}
 
 func (x *RevokeRefreshResp) ProtoReflect() protoreflect.Message {
 	mi := &file_api_api_proto_msgTypes[22]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -1285,21 +1235,18 @@ func (x *RevokeRefreshResp) GetNotFound() bool {
 }
 
 type VerifyPasswordReq struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Email         string                 `protobuf:"bytes,1,opt,name=email,proto3" json:"email,omitempty"`
+	Password      string                 `protobuf:"bytes,2,opt,name=password,proto3" json:"password,omitempty"`
 	unknownFields protoimpl.UnknownFields
-
-	Email    string `protobuf:"bytes,1,opt,name=email,proto3" json:"email,omitempty"`
-	Password string `protobuf:"bytes,2,opt,name=password,proto3" json:"password,omitempty"`
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *VerifyPasswordReq) Reset() {
 	*x = VerifyPasswordReq{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_api_api_proto_msgTypes[23]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_api_api_proto_msgTypes[23]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *VerifyPasswordReq) String() string {
@@ -1310,7 +1257,7 @@ func (*VerifyPasswordReq) ProtoMessage() {}
 
 func (x *VerifyPasswordReq) ProtoReflect() protoreflect.Message {
 	mi := &file_api_api_proto_msgTypes[23]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -1340,21 +1287,18 @@ func (x *VerifyPasswordReq) GetPassword() string {
 }
 
 type VerifyPasswordResp struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Verified      bool                   `protobuf:"varint,1,opt,name=verified,proto3" json:"verified,omitempty"`
+	NotFound      bool                   `protobuf:"varint,2,opt,name=not_found,json=notFound,proto3" json:"not_found,omitempty"`
 	unknownFields protoimpl.UnknownFields
-
-	Verified bool `protobuf:"varint,1,opt,name=verified,proto3" json:"verified,omitempty"`
-	NotFound bool `protobuf:"varint,2,opt,name=not_found,json=notFound,proto3" json:"not_found,omitempty"`
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *VerifyPasswordResp) Reset() {
 	*x = VerifyPasswordResp{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_api_api_proto_msgTypes[24]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_api_api_proto_msgTypes[24]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *VerifyPasswordResp) String() string {
@@ -1365,7 +1309,7 @@ func (*VerifyPasswordResp) ProtoMessage() {}
 
 func (x *VerifyPasswordResp) ProtoReflect() protoreflect.Message {
 	mi := &file_api_api_proto_msgTypes[24]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -1396,9 +1340,9 @@ func (x *VerifyPasswordResp) GetNotFound() bool {
 
 var File_api_api_proto protoreflect.FileDescriptor
 
-var file_api_api_proto_rawDesc = []byte{
+var file_api_api_proto_rawDesc = string([]byte{
 	0x0a, 0x0d, 0x61, 0x70, 0x69, 0x2f, 0x61, 0x70, 0x69, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x12,
-	0x03, 0x61, 0x70, 0x69, 0x22, 0xc1, 0x01, 0x0a, 0x06, 0x43, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x12,
+	0x03, 0x61, 0x70, 0x69, 0x22, 0xf0, 0x01, 0x0a, 0x06, 0x43, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x12,
 	0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x12,
 	0x16, 0x0a, 0x06, 0x73, 0x65, 0x63, 0x72, 0x65, 0x74, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52,
 	0x06, 0x73, 0x65, 0x63, 0x72, 0x65, 0x74, 0x12, 0x23, 0x0a, 0x0d, 0x72, 0x65, 0x64, 0x69, 0x72,
@@ -1410,171 +1354,177 @@ var file_api_api_proto_rawDesc = []byte{
 	0x08, 0x52, 0x06, 0x70, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x12, 0x12, 0x0a, 0x04, 0x6e, 0x61, 0x6d,
 	0x65, 0x18, 0x06, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x19, 0x0a,
 	0x08, 0x6c, 0x6f, 0x67, 0x6f, 0x5f, 0x75, 0x72, 0x6c, 0x18, 0x07, 0x20, 0x01, 0x28, 0x09, 0x52,
-	0x07, 0x6c, 0x6f, 0x67, 0x6f, 0x55, 0x72, 0x6c, 0x22, 0x36, 0x0a, 0x0f, 0x43, 0x72, 0x65, 0x61,
-	0x74, 0x65, 0x43, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x52, 0x65, 0x71, 0x12, 0x23, 0x0a, 0x06, 0x63,
-	0x6c, 0x69, 0x65, 0x6e, 0x74, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x0b, 0x2e, 0x61, 0x70,
-	0x69, 0x2e, 0x43, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x52, 0x06, 0x63, 0x6c, 0x69, 0x65, 0x6e, 0x74,
-	0x22, 0x5e, 0x0a, 0x10, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x43, 0x6c, 0x69, 0x65, 0x6e, 0x74,
-	0x52, 0x65, 0x73, 0x70, 0x12, 0x25, 0x0a, 0x0e, 0x61, 0x6c, 0x72, 0x65, 0x61, 0x64, 0x79, 0x5f,
-	0x65, 0x78, 0x69, 0x73, 0x74, 0x73, 0x18, 0x01, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0d, 0x61, 0x6c,
-	0x72, 0x65, 0x61, 0x64, 0x79, 0x45, 0x78, 0x69, 0x73, 0x74, 0x73, 0x12, 0x23, 0x0a, 0x06, 0x63,
-	0x6c, 0x69, 0x65, 0x6e, 0x74, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x0b, 0x2e, 0x61, 0x70,
-	0x69, 0x2e, 0x43, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x52, 0x06, 0x63, 0x6c, 0x69, 0x65, 0x6e, 0x74,
-	0x22, 0x21, 0x0a, 0x0f, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x43, 0x6c, 0x69, 0x65, 0x6e, 0x74,
-	0x52, 0x65, 0x71, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52,
-	0x02, 0x69, 0x64, 0x22, 0x2f, 0x0a, 0x10, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x43, 0x6c, 0x69,
-	0x65, 0x6e, 0x74, 0x52, 0x65, 0x73, 0x70, 0x12, 0x1b, 0x0a, 0x09, 0x6e, 0x6f, 0x74, 0x5f, 0x66,
-	0x6f, 0x75, 0x6e, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x08, 0x52, 0x08, 0x6e, 0x6f, 0x74, 0x46,
-	0x6f, 0x75, 0x6e, 0x64, 0x22, 0x9a, 0x01, 0x0a, 0x0f, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x43,
-	0x6c, 0x69, 0x65, 0x6e, 0x74, 0x52, 0x65, 0x71, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01,
-	0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x12, 0x23, 0x0a, 0x0d, 0x72, 0x65, 0x64, 0x69,
-	0x72, 0x65, 0x63, 0x74, 0x5f, 0x75, 0x72, 0x69, 0x73, 0x18, 0x02, 0x20, 0x03, 0x28, 0x09, 0x52,
-	0x0c, 0x72, 0x65, 0x64, 0x69, 0x72, 0x65, 0x63, 0x74, 0x55, 0x72, 0x69, 0x73, 0x12, 0x23, 0x0a,
-	0x0d, 0x74, 0x72, 0x75, 0x73, 0x74, 0x65, 0x64, 0x5f, 0x70, 0x65, 0x65, 0x72, 0x73, 0x18, 0x03,
-	0x20, 0x03, 0x28, 0x09, 0x52, 0x0c, 0x74, 0x72, 0x75, 0x73, 0x74, 0x65, 0x64, 0x50, 0x65, 0x65,
-	0x72, 0x73, 0x12, 0x12, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09,
-	0x52, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x19, 0x0a, 0x08, 0x6c, 0x6f, 0x67, 0x6f, 0x5f, 0x75,
-	0x72, 0x6c, 0x18, 0x05, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x6c, 0x6f, 0x67, 0x6f, 0x55, 0x72,
-	0x6c, 0x22, 0x2f, 0x0a, 0x10, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x43, 0x6c, 0x69, 0x65, 0x6e,
-	0x74, 0x52, 0x65, 0x73, 0x70, 0x12, 0x1b, 0x0a, 0x09, 0x6e, 0x6f, 0x74, 0x5f, 0x66, 0x6f, 0x75,
-	0x6e, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x08, 0x52, 0x08, 0x6e, 0x6f, 0x74, 0x46, 0x6f, 0x75,
-	0x6e, 0x64, 0x22, 0x69, 0x0a, 0x08, 0x50, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x12, 0x14,
-	0x0a, 0x05, 0x65, 0x6d, 0x61, 0x69, 0x6c, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x65,
-	0x6d, 0x61, 0x69, 0x6c, 0x12, 0x12, 0x0a, 0x04, 0x68, 0x61, 0x73, 0x68, 0x18, 0x02, 0x20, 0x01,
-	0x28, 0x0c, 0x52, 0x04, 0x68, 0x61, 0x73, 0x68, 0x12, 0x1a, 0x0a, 0x08, 0x75, 0x73, 0x65, 0x72,
-	0x6e, 0x61, 0x6d, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x75, 0x73, 0x65, 0x72,
-	0x6e, 0x61, 0x6d, 0x65, 0x12, 0x17, 0x0a, 0x07, 0x75, 0x73, 0x65, 0x72, 0x5f, 0x69, 0x64, 0x18,
-	0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x75, 0x73, 0x65, 0x72, 0x49, 0x64, 0x22, 0x3e, 0x0a,
-	0x11, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x50, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x52,
-	0x65, 0x71, 0x12, 0x29, 0x0a, 0x08, 0x70, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x18, 0x01,
-	0x20, 0x01, 0x28, 0x0b, 0x32, 0x0d, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x50, 0x61, 0x73, 0x73, 0x77,
-	0x6f, 0x72, 0x64, 0x52, 0x08, 0x70, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x22, 0x3b, 0x0a,
-	0x12, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x50, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x52,
+	0x07, 0x6c, 0x6f, 0x67, 0x6f, 0x55, 0x72, 0x6c, 0x12, 0x2d, 0x0a, 0x12, 0x61, 0x6c, 0x6c, 0x6f,
+	0x77, 0x65, 0x64, 0x5f, 0x63, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x6f, 0x72, 0x73, 0x18, 0x08,
+	0x20, 0x03, 0x28, 0x09, 0x52, 0x11, 0x61, 0x6c, 0x6c, 0x6f, 0x77, 0x65, 0x64, 0x43, 0x6f, 0x6e,
+	0x6e, 0x65, 0x63, 0x74, 0x6f, 0x72, 0x73, 0x22, 0x36, 0x0a, 0x0f, 0x43, 0x72, 0x65, 0x61, 0x74,
+	0x65, 0x43, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x52, 0x65, 0x71, 0x12, 0x23, 0x0a, 0x06, 0x63, 0x6c,
+	0x69, 0x65, 0x6e, 0x74, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x0b, 0x2e, 0x61, 0x70, 0x69,
+	0x2e, 0x43, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x52, 0x06, 0x63, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x22,
+	0x5e, 0x0a, 0x10, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x43, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x52,
 	0x65, 0x73, 0x70, 0x12, 0x25, 0x0a, 0x0e, 0x61, 0x6c, 0x72, 0x65, 0x61, 0x64, 0x79, 0x5f, 0x65,
 	0x78, 0x69, 0x73, 0x74, 0x73, 0x18, 0x01, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0d, 0x61, 0x6c, 0x72,
-	0x65, 0x61, 0x64, 0x79, 0x45, 0x78, 0x69, 0x73, 0x74, 0x73, 0x22, 0x67, 0x0a, 0x11, 0x55, 0x70,
-	0x64, 0x61, 0x74, 0x65, 0x50, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x52, 0x65, 0x71, 0x12,
-	0x14, 0x0a, 0x05, 0x65, 0x6d, 0x61, 0x69, 0x6c, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05,
-	0x65, 0x6d, 0x61, 0x69, 0x6c, 0x12, 0x19, 0x0a, 0x08, 0x6e, 0x65, 0x77, 0x5f, 0x68, 0x61, 0x73,
-	0x68, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x07, 0x6e, 0x65, 0x77, 0x48, 0x61, 0x73, 0x68,
-	0x12, 0x21, 0x0a, 0x0c, 0x6e, 0x65, 0x77, 0x5f, 0x75, 0x73, 0x65, 0x72, 0x6e, 0x61, 0x6d, 0x65,
-	0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x6e, 0x65, 0x77, 0x55, 0x73, 0x65, 0x72, 0x6e,
-	0x61, 0x6d, 0x65, 0x22, 0x31, 0x0a, 0x12, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x50, 0x61, 0x73,
-	0x73, 0x77, 0x6f, 0x72, 0x64, 0x52, 0x65, 0x73, 0x70, 0x12, 0x1b, 0x0a, 0x09, 0x6e, 0x6f, 0x74,
-	0x5f, 0x66, 0x6f, 0x75, 0x6e, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x08, 0x52, 0x08, 0x6e, 0x6f,
-	0x74, 0x46, 0x6f, 0x75, 0x6e, 0x64, 0x22, 0x29, 0x0a, 0x11, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65,
-	0x50, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x52, 0x65, 0x71, 0x12, 0x14, 0x0a, 0x05, 0x65,
-	0x6d, 0x61, 0x69, 0x6c, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x65, 0x6d, 0x61, 0x69,
-	0x6c, 0x22, 0x31, 0x0a, 0x12, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x50, 0x61, 0x73, 0x73, 0x77,
+	0x65, 0x61, 0x64, 0x79, 0x45, 0x78, 0x69, 0x73, 0x74, 0x73, 0x12, 0x23, 0x0a, 0x06, 0x63, 0x6c,
+	0x69, 0x65, 0x6e, 0x74, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x0b, 0x2e, 0x61, 0x70, 0x69,
+	0x2e, 0x43, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x52, 0x06, 0x63, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x22,
+	0x21, 0x0a, 0x0f, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x43, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x52,
+	0x65, 0x71, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02,
+	0x69, 0x64, 0x22, 0x2f, 0x0a, 0x10, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x43, 0x6c, 0x69, 0x65,
+	0x6e, 0x74, 0x52, 0x65, 0x73, 0x70, 0x12, 0x1b, 0x0a, 0x09, 0x6e, 0x6f, 0x74, 0x5f, 0x66, 0x6f,
+	0x75, 0x6e, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x08, 0x52, 0x08, 0x6e, 0x6f, 0x74, 0x46, 0x6f,
+	0x75, 0x6e, 0x64, 0x22, 0xc9, 0x01, 0x0a, 0x0f, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x43, 0x6c,
+	0x69, 0x65, 0x6e, 0x74, 0x52, 0x65, 0x71, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20,
+	0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x12, 0x23, 0x0a, 0x0d, 0x72, 0x65, 0x64, 0x69, 0x72,
+	0x65, 0x63, 0x74, 0x5f, 0x75, 0x72, 0x69, 0x73, 0x18, 0x02, 0x20, 0x03, 0x28, 0x09, 0x52, 0x0c,
+	0x72, 0x65, 0x64, 0x69, 0x72, 0x65, 0x63, 0x74, 0x55, 0x72, 0x69, 0x73, 0x12, 0x23, 0x0a, 0x0d,
+	0x74, 0x72, 0x75, 0x73, 0x74, 0x65, 0x64, 0x5f, 0x70, 0x65, 0x65, 0x72, 0x73, 0x18, 0x03, 0x20,
+	0x03, 0x28, 0x09, 0x52, 0x0c, 0x74, 0x72, 0x75, 0x73, 0x74, 0x65, 0x64, 0x50, 0x65, 0x65, 0x72,
+	0x73, 0x12, 0x12, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x52,
+	0x04, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x19, 0x0a, 0x08, 0x6c, 0x6f, 0x67, 0x6f, 0x5f, 0x75, 0x72,
+	0x6c, 0x18, 0x05, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x6c, 0x6f, 0x67, 0x6f, 0x55, 0x72, 0x6c,
+	0x12, 0x2d, 0x0a, 0x12, 0x61, 0x6c, 0x6c, 0x6f, 0x77, 0x65, 0x64, 0x5f, 0x63, 0x6f, 0x6e, 0x6e,
+	0x65, 0x63, 0x74, 0x6f, 0x72, 0x73, 0x18, 0x06, 0x20, 0x03, 0x28, 0x09, 0x52, 0x11, 0x61, 0x6c,
+	0x6c, 0x6f, 0x77, 0x65, 0x64, 0x43, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x6f, 0x72, 0x73, 0x22,
+	0x2f, 0x0a, 0x10, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x43, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x52,
+	0x65, 0x73, 0x70, 0x12, 0x1b, 0x0a, 0x09, 0x6e, 0x6f, 0x74, 0x5f, 0x66, 0x6f, 0x75, 0x6e, 0x64,
+	0x18, 0x01, 0x20, 0x01, 0x28, 0x08, 0x52, 0x08, 0x6e, 0x6f, 0x74, 0x46, 0x6f, 0x75, 0x6e, 0x64,
+	0x22, 0x69, 0x0a, 0x08, 0x50, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x12, 0x14, 0x0a, 0x05,
+	0x65, 0x6d, 0x61, 0x69, 0x6c, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x65, 0x6d, 0x61,
+	0x69, 0x6c, 0x12, 0x12, 0x0a, 0x04, 0x68, 0x61, 0x73, 0x68, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0c,
+	0x52, 0x04, 0x68, 0x61, 0x73, 0x68, 0x12, 0x1a, 0x0a, 0x08, 0x75, 0x73, 0x65, 0x72, 0x6e, 0x61,
+	0x6d, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x75, 0x73, 0x65, 0x72, 0x6e, 0x61,
+	0x6d, 0x65, 0x12, 0x17, 0x0a, 0x07, 0x75, 0x73, 0x65, 0x72, 0x5f, 0x69, 0x64, 0x18, 0x04, 0x20,
+	0x01, 0x28, 0x09, 0x52, 0x06, 0x75, 0x73, 0x65, 0x72, 0x49, 0x64, 0x22, 0x3e, 0x0a, 0x11, 0x43,
+	0x72, 0x65, 0x61, 0x74, 0x65, 0x50, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x52, 0x65, 0x71,
+	0x12, 0x29, 0x0a, 0x08, 0x70, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x18, 0x01, 0x20, 0x01,
+	0x28, 0x0b, 0x32, 0x0d, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x50, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72,
+	0x64, 0x52, 0x08, 0x70, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x22, 0x3b, 0x0a, 0x12, 0x43,
+	0x72, 0x65, 0x61, 0x74, 0x65, 0x50, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x52, 0x65, 0x73,
+	0x70, 0x12, 0x25, 0x0a, 0x0e, 0x61, 0x6c, 0x72, 0x65, 0x61, 0x64, 0x79, 0x5f, 0x65, 0x78, 0x69,
+	0x73, 0x74, 0x73, 0x18, 0x01, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0d, 0x61, 0x6c, 0x72, 0x65, 0x61,
+	0x64, 0x79, 0x45, 0x78, 0x69, 0x73, 0x74, 0x73, 0x22, 0x67, 0x0a, 0x11, 0x55, 0x70, 0x64, 0x61,
+	0x74, 0x65, 0x50, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x52, 0x65, 0x71, 0x12, 0x14, 0x0a,
+	0x05, 0x65, 0x6d, 0x61, 0x69, 0x6c, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x65, 0x6d,
+	0x61, 0x69, 0x6c, 0x12, 0x19, 0x0a, 0x08, 0x6e, 0x65, 0x77, 0x5f, 0x68, 0x61, 0x73, 0x68, 0x18,
+	0x02, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x07, 0x6e, 0x65, 0x77, 0x48, 0x61, 0x73, 0x68, 0x12, 0x21,
+	0x0a, 0x0c, 0x6e, 0x65, 0x77, 0x5f, 0x75, 0x73, 0x65, 0x72, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x03,
+	0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x6e, 0x65, 0x77, 0x55, 0x73, 0x65, 0x72, 0x6e, 0x61, 0x6d,
+	0x65, 0x22, 0x31, 0x0a, 0x12, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x50, 0x61, 0x73, 0x73, 0x77,
 	0x6f, 0x72, 0x64, 0x52, 0x65, 0x73, 0x70, 0x12, 0x1b, 0x0a, 0x09, 0x6e, 0x6f, 0x74, 0x5f, 0x66,
 	0x6f, 0x75, 0x6e, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x08, 0x52, 0x08, 0x6e, 0x6f, 0x74, 0x46,
-	0x6f, 0x75, 0x6e, 0x64, 0x22, 0x11, 0x0a, 0x0f, 0x4c, 0x69, 0x73, 0x74, 0x50, 0x61, 0x73, 0x73,
-	0x77, 0x6f, 0x72, 0x64, 0x52, 0x65, 0x71, 0x22, 0x3f, 0x0a, 0x10, 0x4c, 0x69, 0x73, 0x74, 0x50,
-	0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x52, 0x65, 0x73, 0x70, 0x12, 0x2b, 0x0a, 0x09, 0x70,
-	0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x0d,
-	0x2e, 0x61, 0x70, 0x69, 0x2e, 0x50, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x52, 0x09, 0x70,
-	0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x73, 0x22, 0x0c, 0x0a, 0x0a, 0x56, 0x65, 0x72, 0x73,
-	0x69, 0x6f, 0x6e, 0x52, 0x65, 0x71, 0x22, 0x37, 0x0a, 0x0b, 0x56, 0x65, 0x72, 0x73, 0x69, 0x6f,
-	0x6e, 0x52, 0x65, 0x73, 0x70, 0x12, 0x16, 0x0a, 0x06, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x18,
-	0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x12, 0x10, 0x0a,
-	0x03, 0x61, 0x70, 0x69, 0x18, 0x02, 0x20, 0x01, 0x28, 0x05, 0x52, 0x03, 0x61, 0x70, 0x69, 0x22,
-	0x7a, 0x0a, 0x0f, 0x52, 0x65, 0x66, 0x72, 0x65, 0x73, 0x68, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x52,
-	0x65, 0x66, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02,
-	0x69, 0x64, 0x12, 0x1b, 0x0a, 0x09, 0x63, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x5f, 0x69, 0x64, 0x18,
-	0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x63, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x49, 0x64, 0x12,
-	0x1d, 0x0a, 0x0a, 0x63, 0x72, 0x65, 0x61, 0x74, 0x65, 0x64, 0x5f, 0x61, 0x74, 0x18, 0x05, 0x20,
-	0x01, 0x28, 0x03, 0x52, 0x09, 0x63, 0x72, 0x65, 0x61, 0x74, 0x65, 0x64, 0x41, 0x74, 0x12, 0x1b,
-	0x0a, 0x09, 0x6c, 0x61, 0x73, 0x74, 0x5f, 0x75, 0x73, 0x65, 0x64, 0x18, 0x06, 0x20, 0x01, 0x28,
-	0x03, 0x52, 0x08, 0x6c, 0x61, 0x73, 0x74, 0x55, 0x73, 0x65, 0x64, 0x22, 0x29, 0x0a, 0x0e, 0x4c,
-	0x69, 0x73, 0x74, 0x52, 0x65, 0x66, 0x72, 0x65, 0x73, 0x68, 0x52, 0x65, 0x71, 0x12, 0x17, 0x0a,
-	0x07, 0x75, 0x73, 0x65, 0x72, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06,
-	0x75, 0x73, 0x65, 0x72, 0x49, 0x64, 0x22, 0x4e, 0x0a, 0x0f, 0x4c, 0x69, 0x73, 0x74, 0x52, 0x65,
-	0x66, 0x72, 0x65, 0x73, 0x68, 0x52, 0x65, 0x73, 0x70, 0x12, 0x3b, 0x0a, 0x0e, 0x72, 0x65, 0x66,
-	0x72, 0x65, 0x73, 0x68, 0x5f, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28,
-	0x0b, 0x32, 0x14, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x52, 0x65, 0x66, 0x72, 0x65, 0x73, 0x68, 0x54,
-	0x6f, 0x6b, 0x65, 0x6e, 0x52, 0x65, 0x66, 0x52, 0x0d, 0x72, 0x65, 0x66, 0x72, 0x65, 0x73, 0x68,
-	0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x73, 0x22, 0x48, 0x0a, 0x10, 0x52, 0x65, 0x76, 0x6f, 0x6b, 0x65,
-	0x52, 0x65, 0x66, 0x72, 0x65, 0x73, 0x68, 0x52, 0x65, 0x71, 0x12, 0x17, 0x0a, 0x07, 0x75, 0x73,
-	0x65, 0x72, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x75, 0x73, 0x65,
-	0x72, 0x49, 0x64, 0x12, 0x1b, 0x0a, 0x09, 0x63, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x5f, 0x69, 0x64,
-	0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x63, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x49, 0x64,
-	0x22, 0x30, 0x0a, 0x11, 0x52, 0x65, 0x76, 0x6f, 0x6b, 0x65, 0x52, 0x65, 0x66, 0x72, 0x65, 0x73,
-	0x68, 0x52, 0x65, 0x73, 0x70, 0x12, 0x1b, 0x0a, 0x09, 0x6e, 0x6f, 0x74, 0x5f, 0x66, 0x6f, 0x75,
+	0x6f, 0x75, 0x6e, 0x64, 0x22, 0x29, 0x0a, 0x11, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x50, 0x61,
+	0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x52, 0x65, 0x71, 0x12, 0x14, 0x0a, 0x05, 0x65, 0x6d, 0x61,
+	0x69, 0x6c, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x65, 0x6d, 0x61, 0x69, 0x6c, 0x22,
+	0x31, 0x0a, 0x12, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x50, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72,
+	0x64, 0x52, 0x65, 0x73, 0x70, 0x12, 0x1b, 0x0a, 0x09, 0x6e, 0x6f, 0x74, 0x5f, 0x66, 0x6f, 0x75,
 	0x6e, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x08, 0x52, 0x08, 0x6e, 0x6f, 0x74, 0x46, 0x6f, 0x75,
-	0x6e, 0x64, 0x22, 0x45, 0x0a, 0x11, 0x56, 0x65, 0x72, 0x69, 0x66, 0x79, 0x50, 0x61, 0x73, 0x73,
-	0x77, 0x6f, 0x72, 0x64, 0x52, 0x65, 0x71, 0x12, 0x14, 0x0a, 0x05, 0x65, 0x6d, 0x61, 0x69, 0x6c,
-	0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x65, 0x6d, 0x61, 0x69, 0x6c, 0x12, 0x1a, 0x0a,
-	0x08, 0x70, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52,
-	0x08, 0x70, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x22, 0x4d, 0x0a, 0x12, 0x56, 0x65, 0x72,
-	0x69, 0x66, 0x79, 0x50, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x52, 0x65, 0x73, 0x70, 0x12,
-	0x1a, 0x0a, 0x08, 0x76, 0x65, 0x72, 0x69, 0x66, 0x69, 0x65, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28,
-	0x08, 0x52, 0x08, 0x76, 0x65, 0x72, 0x69, 0x66, 0x69, 0x65, 0x64, 0x12, 0x1b, 0x0a, 0x09, 0x6e,
-	0x6f, 0x74, 0x5f, 0x66, 0x6f, 0x75, 0x6e, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x08, 0x52, 0x08,
-	0x6e, 0x6f, 0x74, 0x46, 0x6f, 0x75, 0x6e, 0x64, 0x32, 0xc7, 0x05, 0x0a, 0x03, 0x44, 0x65, 0x78,
-	0x12, 0x3d, 0x0a, 0x0c, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x43, 0x6c, 0x69, 0x65, 0x6e, 0x74,
-	0x12, 0x14, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x43, 0x6c, 0x69,
-	0x65, 0x6e, 0x74, 0x52, 0x65, 0x71, 0x1a, 0x15, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x43, 0x72, 0x65,
-	0x61, 0x74, 0x65, 0x43, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x52, 0x65, 0x73, 0x70, 0x22, 0x00, 0x12,
-	0x3d, 0x0a, 0x0c, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x43, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x12,
-	0x14, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x43, 0x6c, 0x69, 0x65,
-	0x6e, 0x74, 0x52, 0x65, 0x71, 0x1a, 0x15, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x55, 0x70, 0x64, 0x61,
-	0x74, 0x65, 0x43, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x52, 0x65, 0x73, 0x70, 0x22, 0x00, 0x12, 0x3d,
-	0x0a, 0x0c, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x43, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x12, 0x14,
-	0x2e, 0x61, 0x70, 0x69, 0x2e, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x43, 0x6c, 0x69, 0x65, 0x6e,
-	0x74, 0x52, 0x65, 0x71, 0x1a, 0x15, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x44, 0x65, 0x6c, 0x65, 0x74,
-	0x65, 0x43, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x52, 0x65, 0x73, 0x70, 0x22, 0x00, 0x12, 0x43, 0x0a,
-	0x0e, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x50, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x12,
-	0x16, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x50, 0x61, 0x73, 0x73,
-	0x77, 0x6f, 0x72, 0x64, 0x52, 0x65, 0x71, 0x1a, 0x17, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x43, 0x72,
-	0x65, 0x61, 0x74, 0x65, 0x50, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x52, 0x65, 0x73, 0x70,
-	0x22, 0x00, 0x12, 0x43, 0x0a, 0x0e, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x50, 0x61, 0x73, 0x73,
-	0x77, 0x6f, 0x72, 0x64, 0x12, 0x16, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x55, 0x70, 0x64, 0x61, 0x74,
-	0x65, 0x50, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x52, 0x65, 0x71, 0x1a, 0x17, 0x2e, 0x61,
-	0x70, 0x69, 0x2e, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x50, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72,
-	0x64, 0x52, 0x65, 0x73, 0x70, 0x22, 0x00, 0x12, 0x43, 0x0a, 0x0e, 0x44, 0x65, 0x6c, 0x65, 0x74,
-	0x65, 0x50, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x12, 0x16, 0x2e, 0x61, 0x70, 0x69, 0x2e,
-	0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x50, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x52, 0x65,
-	0x71, 0x1a, 0x17, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x50, 0x61,
-	0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x52, 0x65, 0x73, 0x70, 0x22, 0x00, 0x12, 0x3e, 0x0a, 0x0d,
-	0x4c, 0x69, 0x73, 0x74, 0x50, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x73, 0x12, 0x14, 0x2e,
-	0x61, 0x70, 0x69, 0x2e, 0x4c, 0x69, 0x73, 0x74, 0x50, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64,
-	0x52, 0x65, 0x71, 0x1a, 0x15, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x4c, 0x69, 0x73, 0x74, 0x50, 0x61,
-	0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x52, 0x65, 0x73, 0x70, 0x22, 0x00, 0x12, 0x31, 0x0a, 0x0a,
-	0x47, 0x65, 0x74, 0x56, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x12, 0x0f, 0x2e, 0x61, 0x70, 0x69,
-	0x2e, 0x56, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x71, 0x1a, 0x10, 0x2e, 0x61, 0x70,
-	0x69, 0x2e, 0x56, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x73, 0x70, 0x22, 0x00, 0x12,
-	0x3a, 0x0a, 0x0b, 0x4c, 0x69, 0x73, 0x74, 0x52, 0x65, 0x66, 0x72, 0x65, 0x73, 0x68, 0x12, 0x13,
-	0x2e, 0x61, 0x70, 0x69, 0x2e, 0x4c, 0x69, 0x73, 0x74, 0x52, 0x65, 0x66, 0x72, 0x65, 0x73, 0x68,
-	0x52, 0x65, 0x71, 0x1a, 0x14, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x4c, 0x69, 0x73, 0x74, 0x52, 0x65,
-	0x66, 0x72, 0x65, 0x73, 0x68, 0x52, 0x65, 0x73, 0x70, 0x22, 0x00, 0x12, 0x40, 0x0a, 0x0d, 0x52,
-	0x65, 0x76, 0x6f, 0x6b, 0x65, 0x52, 0x65, 0x66, 0x72, 0x65, 0x73, 0x68, 0x12, 0x15, 0x2e, 0x61,
-	0x70, 0x69, 0x2e, 0x52, 0x65, 0x76, 0x6f, 0x6b, 0x65, 0x52, 0x65, 0x66, 0x72, 0x65, 0x73, 0x68,
-	0x52, 0x65, 0x71, 0x1a, 0x16, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x52, 0x65, 0x76, 0x6f, 0x6b, 0x65,
-	0x52, 0x65, 0x66, 0x72, 0x65, 0x73, 0x68, 0x52, 0x65, 0x73, 0x70, 0x22, 0x00, 0x12, 0x43, 0x0a,
-	0x0e, 0x56, 0x65, 0x72, 0x69, 0x66, 0x79, 0x50, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x12,
-	0x16, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x56, 0x65, 0x72, 0x69, 0x66, 0x79, 0x50, 0x61, 0x73, 0x73,
-	0x77, 0x6f, 0x72, 0x64, 0x52, 0x65, 0x71, 0x1a, 0x17, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x56, 0x65,
-	0x72, 0x69, 0x66, 0x79, 0x50, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x52, 0x65, 0x73, 0x70,
-	0x22, 0x00, 0x42, 0x2f, 0x0a, 0x12, 0x63, 0x6f, 0x6d, 0x2e, 0x63, 0x6f, 0x72, 0x65, 0x6f, 0x73,
-	0x2e, 0x64, 0x65, 0x78, 0x2e, 0x61, 0x70, 0x69, 0x5a, 0x19, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62,
-	0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x64, 0x65, 0x78, 0x69, 0x64, 0x70, 0x2f, 0x64, 0x65, 0x78, 0x2f,
-	0x61, 0x70, 0x69, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
-}
+	0x6e, 0x64, 0x22, 0x11, 0x0a, 0x0f, 0x4c, 0x69, 0x73, 0x74, 0x50, 0x61, 0x73, 0x73, 0x77, 0x6f,
+	0x72, 0x64, 0x52, 0x65, 0x71, 0x22, 0x3f, 0x0a, 0x10, 0x4c, 0x69, 0x73, 0x74, 0x50, 0x61, 0x73,
+	0x73, 0x77, 0x6f, 0x72, 0x64, 0x52, 0x65, 0x73, 0x70, 0x12, 0x2b, 0x0a, 0x09, 0x70, 0x61, 0x73,
+	0x73, 0x77, 0x6f, 0x72, 0x64, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x0d, 0x2e, 0x61,
+	0x70, 0x69, 0x2e, 0x50, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x52, 0x09, 0x70, 0x61, 0x73,
+	0x73, 0x77, 0x6f, 0x72, 0x64, 0x73, 0x22, 0x0c, 0x0a, 0x0a, 0x56, 0x65, 0x72, 0x73, 0x69, 0x6f,
+	0x6e, 0x52, 0x65, 0x71, 0x22, 0x37, 0x0a, 0x0b, 0x56, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x52,
+	0x65, 0x73, 0x70, 0x12, 0x16, 0x0a, 0x06, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x18, 0x01, 0x20,
+	0x01, 0x28, 0x09, 0x52, 0x06, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x12, 0x10, 0x0a, 0x03, 0x61,
+	0x70, 0x69, 0x18, 0x02, 0x20, 0x01, 0x28, 0x05, 0x52, 0x03, 0x61, 0x70, 0x69, 0x22, 0x7a, 0x0a,
+	0x0f, 0x52, 0x65, 0x66, 0x72, 0x65, 0x73, 0x68, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x52, 0x65, 0x66,
+	0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64,
+	0x12, 0x1b, 0x0a, 0x09, 0x63, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x5f, 0x69, 0x64, 0x18, 0x02, 0x20,
+	0x01, 0x28, 0x09, 0x52, 0x08, 0x63, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x49, 0x64, 0x12, 0x1d, 0x0a,
+	0x0a, 0x63, 0x72, 0x65, 0x61, 0x74, 0x65, 0x64, 0x5f, 0x61, 0x74, 0x18, 0x05, 0x20, 0x01, 0x28,
+	0x03, 0x52, 0x09, 0x63, 0x72, 0x65, 0x61, 0x74, 0x65, 0x64, 0x41, 0x74, 0x12, 0x1b, 0x0a, 0x09,
+	0x6c, 0x61, 0x73, 0x74, 0x5f, 0x75, 0x73, 0x65, 0x64, 0x18, 0x06, 0x20, 0x01, 0x28, 0x03, 0x52,
+	0x08, 0x6c, 0x61, 0x73, 0x74, 0x55, 0x73, 0x65, 0x64, 0x22, 0x29, 0x0a, 0x0e, 0x4c, 0x69, 0x73,
+	0x74, 0x52, 0x65, 0x66, 0x72, 0x65, 0x73, 0x68, 0x52, 0x65, 0x71, 0x12, 0x17, 0x0a, 0x07, 0x75,
+	0x73, 0x65, 0x72, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x75, 0x73,
+	0x65, 0x72, 0x49, 0x64, 0x22, 0x4e, 0x0a, 0x0f, 0x4c, 0x69, 0x73, 0x74, 0x52, 0x65, 0x66, 0x72,
+	0x65, 0x73, 0x68, 0x52, 0x65, 0x73, 0x70, 0x12, 0x3b, 0x0a, 0x0e, 0x72, 0x65, 0x66, 0x72, 0x65,
+	0x73, 0x68, 0x5f, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32,
+	0x14, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x52, 0x65, 0x66, 0x72, 0x65, 0x73, 0x68, 0x54, 0x6f, 0x6b,
+	0x65, 0x6e, 0x52, 0x65, 0x66, 0x52, 0x0d, 0x72, 0x65, 0x66, 0x72, 0x65, 0x73, 0x68, 0x54, 0x6f,
+	0x6b, 0x65, 0x6e, 0x73, 0x22, 0x48, 0x0a, 0x10, 0x52, 0x65, 0x76, 0x6f, 0x6b, 0x65, 0x52, 0x65,
+	0x66, 0x72, 0x65, 0x73, 0x68, 0x52, 0x65, 0x71, 0x12, 0x17, 0x0a, 0x07, 0x75, 0x73, 0x65, 0x72,
+	0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x75, 0x73, 0x65, 0x72, 0x49,
+	0x64, 0x12, 0x1b, 0x0a, 0x09, 0x63, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x5f, 0x69, 0x64, 0x18, 0x02,
+	0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x63, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x49, 0x64, 0x22, 0x30,
+	0x0a, 0x11, 0x52, 0x65, 0x76, 0x6f, 0x6b, 0x65, 0x52, 0x65, 0x66, 0x72, 0x65, 0x73, 0x68, 0x52,
+	0x65, 0x73, 0x70, 0x12, 0x1b, 0x0a, 0x09, 0x6e, 0x6f, 0x74, 0x5f, 0x66, 0x6f, 0x75, 0x6e, 0x64,
+	0x18, 0x01, 0x20, 0x01, 0x28, 0x08, 0x52, 0x08, 0x6e, 0x6f, 0x74, 0x46, 0x6f, 0x75, 0x6e, 0x64,
+	0x22, 0x45, 0x0a, 0x11, 0x56, 0x65, 0x72, 0x69, 0x66, 0x79, 0x50, 0x61, 0x73, 0x73, 0x77, 0x6f,
+	0x72, 0x64, 0x52, 0x65, 0x71, 0x12, 0x14, 0x0a, 0x05, 0x65, 0x6d, 0x61, 0x69, 0x6c, 0x18, 0x01,
+	0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x65, 0x6d, 0x61, 0x69, 0x6c, 0x12, 0x1a, 0x0a, 0x08, 0x70,
+	0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x70,
+	0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x22, 0x4d, 0x0a, 0x12, 0x56, 0x65, 0x72, 0x69, 0x66,
+	0x79, 0x50, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x52, 0x65, 0x73, 0x70, 0x12, 0x1a, 0x0a,
+	0x08, 0x76, 0x65, 0x72, 0x69, 0x66, 0x69, 0x65, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x08, 0x52,
+	0x08, 0x76, 0x65, 0x72, 0x69, 0x66, 0x69, 0x65, 0x64, 0x12, 0x1b, 0x0a, 0x09, 0x6e, 0x6f, 0x74,
+	0x5f, 0x66, 0x6f, 0x75, 0x6e, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x08, 0x52, 0x08, 0x6e, 0x6f,
+	0x74, 0x46, 0x6f, 0x75, 0x6e, 0x64, 0x32, 0xc7, 0x05, 0x0a, 0x03, 0x44, 0x65, 0x78, 0x12, 0x3d,
+	0x0a, 0x0c, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x43, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x12, 0x14,
+	0x2e, 0x61, 0x70, 0x69, 0x2e, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x43, 0x6c, 0x69, 0x65, 0x6e,
+	0x74, 0x52, 0x65, 0x71, 0x1a, 0x15, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x43, 0x72, 0x65, 0x61, 0x74,
+	0x65, 0x43, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x52, 0x65, 0x73, 0x70, 0x22, 0x00, 0x12, 0x3d, 0x0a,
+	0x0c, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x43, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x12, 0x14, 0x2e,
+	0x61, 0x70, 0x69, 0x2e, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x43, 0x6c, 0x69, 0x65, 0x6e, 0x74,
+	0x52, 0x65, 0x71, 0x1a, 0x15, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65,
+	0x43, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x52, 0x65, 0x73, 0x70, 0x22, 0x00, 0x12, 0x3d, 0x0a, 0x0c,
+	0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x43, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x12, 0x14, 0x2e, 0x61,
+	0x70, 0x69, 0x2e, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x43, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x52,
+	0x65, 0x71, 0x1a, 0x15, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x43,
+	0x6c, 0x69, 0x65, 0x6e, 0x74, 0x52, 0x65, 0x73, 0x70, 0x22, 0x00, 0x12, 0x43, 0x0a, 0x0e, 0x43,
+	0x72, 0x65, 0x61, 0x74, 0x65, 0x50, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x12, 0x16, 0x2e,
+	0x61, 0x70, 0x69, 0x2e, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x50, 0x61, 0x73, 0x73, 0x77, 0x6f,
+	0x72, 0x64, 0x52, 0x65, 0x71, 0x1a, 0x17, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x43, 0x72, 0x65, 0x61,
+	0x74, 0x65, 0x50, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x52, 0x65, 0x73, 0x70, 0x22, 0x00,
+	0x12, 0x43, 0x0a, 0x0e, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x50, 0x61, 0x73, 0x73, 0x77, 0x6f,
+	0x72, 0x64, 0x12, 0x16, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x50,
+	0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x52, 0x65, 0x71, 0x1a, 0x17, 0x2e, 0x61, 0x70, 0x69,
+	0x2e, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x50, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x52,
+	0x65, 0x73, 0x70, 0x22, 0x00, 0x12, 0x43, 0x0a, 0x0e, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x50,
+	0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x12, 0x16, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x44, 0x65,
+	0x6c, 0x65, 0x74, 0x65, 0x50, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x52, 0x65, 0x71, 0x1a,
+	0x17, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x50, 0x61, 0x73, 0x73,
+	0x77, 0x6f, 0x72, 0x64, 0x52, 0x65, 0x73, 0x70, 0x22, 0x00, 0x12, 0x3e, 0x0a, 0x0d, 0x4c, 0x69,
+	0x73, 0x74, 0x50, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x73, 0x12, 0x14, 0x2e, 0x61, 0x70,
+	0x69, 0x2e, 0x4c, 0x69, 0x73, 0x74, 0x50, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x52, 0x65,
+	0x71, 0x1a, 0x15, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x4c, 0x69, 0x73, 0x74, 0x50, 0x61, 0x73, 0x73,
+	0x77, 0x6f, 0x72, 0x64, 0x52, 0x65, 0x73, 0x70, 0x22, 0x00, 0x12, 0x31, 0x0a, 0x0a, 0x47, 0x65,
+	0x74, 0x56, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x12, 0x0f, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x56,
+	0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x71, 0x1a, 0x10, 0x2e, 0x61, 0x70, 0x69, 0x2e,
+	0x56, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x73, 0x70, 0x22, 0x00, 0x12, 0x3a, 0x0a,
+	0x0b, 0x4c, 0x69, 0x73, 0x74, 0x52, 0x65, 0x66, 0x72, 0x65, 0x73, 0x68, 0x12, 0x13, 0x2e, 0x61,
+	0x70, 0x69, 0x2e, 0x4c, 0x69, 0x73, 0x74, 0x52, 0x65, 0x66, 0x72, 0x65, 0x73, 0x68, 0x52, 0x65,
+	0x71, 0x1a, 0x14, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x4c, 0x69, 0x73, 0x74, 0x52, 0x65, 0x66, 0x72,
+	0x65, 0x73, 0x68, 0x52, 0x65, 0x73, 0x70, 0x22, 0x00, 0x12, 0x40, 0x0a, 0x0d, 0x52, 0x65, 0x76,
+	0x6f, 0x6b, 0x65, 0x52, 0x65, 0x66, 0x72, 0x65, 0x73, 0x68, 0x12, 0x15, 0x2e, 0x61, 0x70, 0x69,
+	0x2e, 0x52, 0x65, 0x76, 0x6f, 0x6b, 0x65, 0x52, 0x65, 0x66, 0x72, 0x65, 0x73, 0x68, 0x52, 0x65,
+	0x71, 0x1a, 0x16, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x52, 0x65, 0x76, 0x6f, 0x6b, 0x65, 0x52, 0x65,
+	0x66, 0x72, 0x65, 0x73, 0x68, 0x52, 0x65, 0x73, 0x70, 0x22, 0x00, 0x12, 0x43, 0x0a, 0x0e, 0x56,
+	0x65, 0x72, 0x69, 0x66, 0x79, 0x50, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x12, 0x16, 0x2e,
+	0x61, 0x70, 0x69, 0x2e, 0x56, 0x65, 0x72, 0x69, 0x66, 0x79, 0x50, 0x61, 0x73, 0x73, 0x77, 0x6f,
+	0x72, 0x64, 0x52, 0x65, 0x71, 0x1a, 0x17, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x56, 0x65, 0x72, 0x69,
+	0x66, 0x79, 0x50, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x52, 0x65, 0x73, 0x70, 0x22, 0x00,
+	0x42, 0x2f, 0x0a, 0x12, 0x63, 0x6f, 0x6d, 0x2e, 0x63, 0x6f, 0x72, 0x65, 0x6f, 0x73, 0x2e, 0x64,
+	0x65, 0x78, 0x2e, 0x61, 0x70, 0x69, 0x5a, 0x19, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63,
+	0x6f, 0x6d, 0x2f, 0x64, 0x65, 0x78, 0x69, 0x64, 0x70, 0x2f, 0x64, 0x65, 0x78, 0x2f, 0x61, 0x70,
+	0x69, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+})
 
 var (
 	file_api_api_proto_rawDescOnce sync.Once
-	file_api_api_proto_rawDescData = file_api_api_proto_rawDesc
+	file_api_api_proto_rawDescData []byte
 )
 
 func file_api_api_proto_rawDescGZIP() []byte {
 	file_api_api_proto_rawDescOnce.Do(func() {
-		file_api_api_proto_rawDescData = protoimpl.X.CompressGZIP(file_api_api_proto_rawDescData)
+		file_api_api_proto_rawDescData = protoimpl.X.CompressGZIP(unsafe.Slice(unsafe.StringData(file_api_api_proto_rawDesc), len(file_api_api_proto_rawDesc)))
 	})
 	return file_api_api_proto_rawDescData
 }
 
 var file_api_api_proto_msgTypes = make([]protoimpl.MessageInfo, 25)
-var file_api_api_proto_goTypes = []interface{}{
+var file_api_api_proto_goTypes = []any{
 	(*Client)(nil),             // 0: api.Client
 	(*CreateClientReq)(nil),    // 1: api.CreateClientReq
 	(*CreateClientResp)(nil),   // 2: api.CreateClientResp
@@ -1641,313 +1591,11 @@ func file_api_api_proto_init() {
 	if File_api_api_proto != nil {
 		return
 	}
-	if !protoimpl.UnsafeEnabled {
-		file_api_api_proto_msgTypes[0].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*Client); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_api_api_proto_msgTypes[1].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*CreateClientReq); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_api_api_proto_msgTypes[2].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*CreateClientResp); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_api_api_proto_msgTypes[3].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*DeleteClientReq); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_api_api_proto_msgTypes[4].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*DeleteClientResp); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_api_api_proto_msgTypes[5].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*UpdateClientReq); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_api_api_proto_msgTypes[6].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*UpdateClientResp); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_api_api_proto_msgTypes[7].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*Password); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_api_api_proto_msgTypes[8].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*CreatePasswordReq); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_api_api_proto_msgTypes[9].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*CreatePasswordResp); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_api_api_proto_msgTypes[10].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*UpdatePasswordReq); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_api_api_proto_msgTypes[11].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*UpdatePasswordResp); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_api_api_proto_msgTypes[12].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*DeletePasswordReq); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_api_api_proto_msgTypes[13].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*DeletePasswordResp); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_api_api_proto_msgTypes[14].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*ListPasswordReq); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_api_api_proto_msgTypes[15].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*ListPasswordResp); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_api_api_proto_msgTypes[16].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*VersionReq); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_api_api_proto_msgTypes[17].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*VersionResp); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_api_api_proto_msgTypes[18].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*RefreshTokenRef); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_api_api_proto_msgTypes[19].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*ListRefreshReq); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_api_api_proto_msgTypes[20].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*ListRefreshResp); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_api_api_proto_msgTypes[21].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*RevokeRefreshReq); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_api_api_proto_msgTypes[22].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*RevokeRefreshResp); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_api_api_proto_msgTypes[23].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*VerifyPasswordReq); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_api_api_proto_msgTypes[24].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*VerifyPasswordResp); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-	}
 	type x struct{}
 	out := protoimpl.TypeBuilder{
 		File: protoimpl.DescBuilder{
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
-			RawDescriptor: file_api_api_proto_rawDesc,
+			RawDescriptor: unsafe.Slice(unsafe.StringData(file_api_api_proto_rawDesc), len(file_api_api_proto_rawDesc)),
 			NumEnums:      0,
 			NumMessages:   25,
 			NumExtensions: 0,
@@ -1958,7 +1606,6 @@ func file_api_api_proto_init() {
 		MessageInfos:      file_api_api_proto_msgTypes,
 	}.Build()
 	File_api_api_proto = out.File
-	file_api_api_proto_rawDesc = nil
 	file_api_api_proto_goTypes = nil
 	file_api_api_proto_depIdxs = nil
 }
diff --git a/api/api.proto b/api/api.proto
index 7d25771a6e..01e3db1718 100644
--- a/api/api.proto
+++ b/api/api.proto
@@ -14,6 +14,7 @@ message Client {
   bool public = 5;
   string name = 6;
   string logo_url = 7;
+  repeated string allowed_connectors = 8;
 }
 
 // CreateClientReq is a request to make a client.
@@ -45,6 +46,7 @@ message UpdateClientReq {
     repeated string trusted_peers = 3;
     string name = 4;
     string logo_url = 5;
+    repeated string allowed_connectors = 6;
 }
 
 // UpdateClientResp returns the response from updating a client.
@@ -112,7 +114,7 @@ message VersionReq {}
 message VersionResp {
   // Semantic version of the server.
   string server = 1;
-  // Numeric version of the API. It increases everytime a new call is added to the API.
+  // Numeric version of the API. It increases every time a new call is added to the API.
   // Clients should use this info to determine if the server supports specific features.
   int32 api = 2;
 }
diff --git a/api/api_grpc.pb.go b/api/api_grpc.pb.go
index e8c9873cb5..aeeaa508c0 100644
--- a/api/api_grpc.pb.go
+++ b/api/api_grpc.pb.go
@@ -1,4 +1,8 @@
 // Code generated by protoc-gen-go-grpc. DO NOT EDIT.
+// versions:
+// - protoc-gen-go-grpc v1.5.1
+// - protoc             v5.29.3
+// source: api/api.proto
 
 package api
 
@@ -11,12 +15,28 @@ import (
 
 // This is a compile-time assertion to ensure that this generated file
 // is compatible with the grpc package it is being compiled against.
-// Requires gRPC-Go v1.32.0 or later.
-const _ = grpc.SupportPackageIsVersion7
+// Requires gRPC-Go v1.64.0 or later.
+const _ = grpc.SupportPackageIsVersion9
+
+const (
+	Dex_CreateClient_FullMethodName   = "/api.Dex/CreateClient"
+	Dex_UpdateClient_FullMethodName   = "/api.Dex/UpdateClient"
+	Dex_DeleteClient_FullMethodName   = "/api.Dex/DeleteClient"
+	Dex_CreatePassword_FullMethodName = "/api.Dex/CreatePassword"
+	Dex_UpdatePassword_FullMethodName = "/api.Dex/UpdatePassword"
+	Dex_DeletePassword_FullMethodName = "/api.Dex/DeletePassword"
+	Dex_ListPasswords_FullMethodName  = "/api.Dex/ListPasswords"
+	Dex_GetVersion_FullMethodName     = "/api.Dex/GetVersion"
+	Dex_ListRefresh_FullMethodName    = "/api.Dex/ListRefresh"
+	Dex_RevokeRefresh_FullMethodName  = "/api.Dex/RevokeRefresh"
+	Dex_VerifyPassword_FullMethodName = "/api.Dex/VerifyPassword"
+)
 
 // DexClient is the client API for Dex service.
 //
 // For semantics around ctx use and closing/ending streaming RPCs, please refer to https://pkg.go.dev/google.golang.org/grpc/?tab=doc#ClientConn.NewStream.
+//
+// Dex represents the dex gRPC service.
 type DexClient interface {
 	// CreateClient creates a client.
 	CreateClient(ctx context.Context, in *CreateClientReq, opts ...grpc.CallOption) (*CreateClientResp, error)
@@ -53,8 +73,9 @@ func NewDexClient(cc grpc.ClientConnInterface) DexClient {
 }
 
 func (c *dexClient) CreateClient(ctx context.Context, in *CreateClientReq, opts ...grpc.CallOption) (*CreateClientResp, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(CreateClientResp)
-	err := c.cc.Invoke(ctx, "/api.Dex/CreateClient", in, out, opts...)
+	err := c.cc.Invoke(ctx, Dex_CreateClient_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -62,8 +83,9 @@ func (c *dexClient) CreateClient(ctx context.Context, in *CreateClientReq, opts
 }
 
 func (c *dexClient) UpdateClient(ctx context.Context, in *UpdateClientReq, opts ...grpc.CallOption) (*UpdateClientResp, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(UpdateClientResp)
-	err := c.cc.Invoke(ctx, "/api.Dex/UpdateClient", in, out, opts...)
+	err := c.cc.Invoke(ctx, Dex_UpdateClient_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -71,8 +93,9 @@ func (c *dexClient) UpdateClient(ctx context.Context, in *UpdateClientReq, opts
 }
 
 func (c *dexClient) DeleteClient(ctx context.Context, in *DeleteClientReq, opts ...grpc.CallOption) (*DeleteClientResp, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(DeleteClientResp)
-	err := c.cc.Invoke(ctx, "/api.Dex/DeleteClient", in, out, opts...)
+	err := c.cc.Invoke(ctx, Dex_DeleteClient_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -80,8 +103,9 @@ func (c *dexClient) DeleteClient(ctx context.Context, in *DeleteClientReq, opts
 }
 
 func (c *dexClient) CreatePassword(ctx context.Context, in *CreatePasswordReq, opts ...grpc.CallOption) (*CreatePasswordResp, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(CreatePasswordResp)
-	err := c.cc.Invoke(ctx, "/api.Dex/CreatePassword", in, out, opts...)
+	err := c.cc.Invoke(ctx, Dex_CreatePassword_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -89,8 +113,9 @@ func (c *dexClient) CreatePassword(ctx context.Context, in *CreatePasswordReq, o
 }
 
 func (c *dexClient) UpdatePassword(ctx context.Context, in *UpdatePasswordReq, opts ...grpc.CallOption) (*UpdatePasswordResp, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(UpdatePasswordResp)
-	err := c.cc.Invoke(ctx, "/api.Dex/UpdatePassword", in, out, opts...)
+	err := c.cc.Invoke(ctx, Dex_UpdatePassword_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -98,8 +123,9 @@ func (c *dexClient) UpdatePassword(ctx context.Context, in *UpdatePasswordReq, o
 }
 
 func (c *dexClient) DeletePassword(ctx context.Context, in *DeletePasswordReq, opts ...grpc.CallOption) (*DeletePasswordResp, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(DeletePasswordResp)
-	err := c.cc.Invoke(ctx, "/api.Dex/DeletePassword", in, out, opts...)
+	err := c.cc.Invoke(ctx, Dex_DeletePassword_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -107,8 +133,9 @@ func (c *dexClient) DeletePassword(ctx context.Context, in *DeletePasswordReq, o
 }
 
 func (c *dexClient) ListPasswords(ctx context.Context, in *ListPasswordReq, opts ...grpc.CallOption) (*ListPasswordResp, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(ListPasswordResp)
-	err := c.cc.Invoke(ctx, "/api.Dex/ListPasswords", in, out, opts...)
+	err := c.cc.Invoke(ctx, Dex_ListPasswords_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -116,8 +143,9 @@ func (c *dexClient) ListPasswords(ctx context.Context, in *ListPasswordReq, opts
 }
 
 func (c *dexClient) GetVersion(ctx context.Context, in *VersionReq, opts ...grpc.CallOption) (*VersionResp, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(VersionResp)
-	err := c.cc.Invoke(ctx, "/api.Dex/GetVersion", in, out, opts...)
+	err := c.cc.Invoke(ctx, Dex_GetVersion_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -125,8 +153,9 @@ func (c *dexClient) GetVersion(ctx context.Context, in *VersionReq, opts ...grpc
 }
 
 func (c *dexClient) ListRefresh(ctx context.Context, in *ListRefreshReq, opts ...grpc.CallOption) (*ListRefreshResp, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(ListRefreshResp)
-	err := c.cc.Invoke(ctx, "/api.Dex/ListRefresh", in, out, opts...)
+	err := c.cc.Invoke(ctx, Dex_ListRefresh_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -134,8 +163,9 @@ func (c *dexClient) ListRefresh(ctx context.Context, in *ListRefreshReq, opts ..
 }
 
 func (c *dexClient) RevokeRefresh(ctx context.Context, in *RevokeRefreshReq, opts ...grpc.CallOption) (*RevokeRefreshResp, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(RevokeRefreshResp)
-	err := c.cc.Invoke(ctx, "/api.Dex/RevokeRefresh", in, out, opts...)
+	err := c.cc.Invoke(ctx, Dex_RevokeRefresh_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -143,8 +173,9 @@ func (c *dexClient) RevokeRefresh(ctx context.Context, in *RevokeRefreshReq, opt
 }
 
 func (c *dexClient) VerifyPassword(ctx context.Context, in *VerifyPasswordReq, opts ...grpc.CallOption) (*VerifyPasswordResp, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(VerifyPasswordResp)
-	err := c.cc.Invoke(ctx, "/api.Dex/VerifyPassword", in, out, opts...)
+	err := c.cc.Invoke(ctx, Dex_VerifyPassword_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -153,7 +184,9 @@ func (c *dexClient) VerifyPassword(ctx context.Context, in *VerifyPasswordReq, o
 
 // DexServer is the server API for Dex service.
 // All implementations must embed UnimplementedDexServer
-// for forward compatibility
+// for forward compatibility.
+//
+// Dex represents the dex gRPC service.
 type DexServer interface {
 	// CreateClient creates a client.
 	CreateClient(context.Context, *CreateClientReq) (*CreateClientResp, error)
@@ -182,9 +215,12 @@ type DexServer interface {
 	mustEmbedUnimplementedDexServer()
 }
 
-// UnimplementedDexServer must be embedded to have forward compatible implementations.
-type UnimplementedDexServer struct {
-}
+// UnimplementedDexServer must be embedded to have
+// forward compatible implementations.
+//
+// NOTE: this should be embedded by value instead of pointer to avoid a nil
+// pointer dereference when methods are called.
+type UnimplementedDexServer struct{}
 
 func (UnimplementedDexServer) CreateClient(context.Context, *CreateClientReq) (*CreateClientResp, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method CreateClient not implemented")
@@ -220,6 +256,7 @@ func (UnimplementedDexServer) VerifyPassword(context.Context, *VerifyPasswordReq
 	return nil, status.Errorf(codes.Unimplemented, "method VerifyPassword not implemented")
 }
 func (UnimplementedDexServer) mustEmbedUnimplementedDexServer() {}
+func (UnimplementedDexServer) testEmbeddedByValue()             {}
 
 // UnsafeDexServer may be embedded to opt out of forward compatibility for this service.
 // Use of this interface is not recommended, as added methods to DexServer will
@@ -229,6 +266,13 @@ type UnsafeDexServer interface {
 }
 
 func RegisterDexServer(s grpc.ServiceRegistrar, srv DexServer) {
+	// If the following call pancis, it indicates UnimplementedDexServer was
+	// embedded by pointer and is nil.  This will cause panics if an
+	// unimplemented method is ever invoked, so we test this at initialization
+	// time to prevent it from happening at runtime later due to I/O.
+	if t, ok := srv.(interface{ testEmbeddedByValue() }); ok {
+		t.testEmbeddedByValue()
+	}
 	s.RegisterService(&Dex_ServiceDesc, srv)
 }
 
@@ -242,7 +286,7 @@ func _Dex_CreateClient_Handler(srv interface{}, ctx context.Context, dec func(in
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/api.Dex/CreateClient",
+		FullMethod: Dex_CreateClient_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(DexServer).CreateClient(ctx, req.(*CreateClientReq))
@@ -260,7 +304,7 @@ func _Dex_UpdateClient_Handler(srv interface{}, ctx context.Context, dec func(in
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/api.Dex/UpdateClient",
+		FullMethod: Dex_UpdateClient_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(DexServer).UpdateClient(ctx, req.(*UpdateClientReq))
@@ -278,7 +322,7 @@ func _Dex_DeleteClient_Handler(srv interface{}, ctx context.Context, dec func(in
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/api.Dex/DeleteClient",
+		FullMethod: Dex_DeleteClient_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(DexServer).DeleteClient(ctx, req.(*DeleteClientReq))
@@ -296,7 +340,7 @@ func _Dex_CreatePassword_Handler(srv interface{}, ctx context.Context, dec func(
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/api.Dex/CreatePassword",
+		FullMethod: Dex_CreatePassword_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(DexServer).CreatePassword(ctx, req.(*CreatePasswordReq))
@@ -314,7 +358,7 @@ func _Dex_UpdatePassword_Handler(srv interface{}, ctx context.Context, dec func(
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/api.Dex/UpdatePassword",
+		FullMethod: Dex_UpdatePassword_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(DexServer).UpdatePassword(ctx, req.(*UpdatePasswordReq))
@@ -332,7 +376,7 @@ func _Dex_DeletePassword_Handler(srv interface{}, ctx context.Context, dec func(
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/api.Dex/DeletePassword",
+		FullMethod: Dex_DeletePassword_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(DexServer).DeletePassword(ctx, req.(*DeletePasswordReq))
@@ -350,7 +394,7 @@ func _Dex_ListPasswords_Handler(srv interface{}, ctx context.Context, dec func(i
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/api.Dex/ListPasswords",
+		FullMethod: Dex_ListPasswords_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(DexServer).ListPasswords(ctx, req.(*ListPasswordReq))
@@ -368,7 +412,7 @@ func _Dex_GetVersion_Handler(srv interface{}, ctx context.Context, dec func(inte
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/api.Dex/GetVersion",
+		FullMethod: Dex_GetVersion_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(DexServer).GetVersion(ctx, req.(*VersionReq))
@@ -386,7 +430,7 @@ func _Dex_ListRefresh_Handler(srv interface{}, ctx context.Context, dec func(int
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/api.Dex/ListRefresh",
+		FullMethod: Dex_ListRefresh_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(DexServer).ListRefresh(ctx, req.(*ListRefreshReq))
@@ -404,7 +448,7 @@ func _Dex_RevokeRefresh_Handler(srv interface{}, ctx context.Context, dec func(i
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/api.Dex/RevokeRefresh",
+		FullMethod: Dex_RevokeRefresh_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(DexServer).RevokeRefresh(ctx, req.(*RevokeRefreshReq))
@@ -422,7 +466,7 @@ func _Dex_VerifyPassword_Handler(srv interface{}, ctx context.Context, dec func(
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/api.Dex/VerifyPassword",
+		FullMethod: Dex_VerifyPassword_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(DexServer).VerifyPassword(ctx, req.(*VerifyPasswordReq))
diff --git a/api/v2/api.pb.go b/api/v2/api.pb.go
index f49310f311..62dec99041 100644
--- a/api/v2/api.pb.go
+++ b/api/v2/api.pb.go
@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.26.0
-// 	protoc        v3.15.6
+// 	protoc-gen-go v1.36.5
+// 	protoc        v5.29.3
 // source: api/v2/api.proto
 
 package api
@@ -11,6 +11,7 @@ import (
 	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
 	reflect "reflect"
 	sync "sync"
+	unsafe "unsafe"
 )
 
 const (
@@ -22,26 +23,35 @@ const (
 
 // Client represents an OAuth2 client.
 type Client struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-
-	Id           string   `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
-	Secret       string   `protobuf:"bytes,2,opt,name=secret,proto3" json:"secret,omitempty"`
-	RedirectUris []string `protobuf:"bytes,3,rep,name=redirect_uris,json=redirectUris,proto3" json:"redirect_uris,omitempty"`
-	TrustedPeers []string `protobuf:"bytes,4,rep,name=trusted_peers,json=trustedPeers,proto3" json:"trusted_peers,omitempty"`
-	Public       bool     `protobuf:"varint,5,opt,name=public,proto3" json:"public,omitempty"`
-	Name         string   `protobuf:"bytes,6,opt,name=name,proto3" json:"name,omitempty"`
-	LogoUrl      string   `protobuf:"bytes,7,opt,name=logo_url,json=logoUrl,proto3" json:"logo_url,omitempty"`
+	state             protoimpl.MessageState `protogen:"open.v1"`
+	Id                string                 `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
+	Secret            string                 `protobuf:"bytes,2,opt,name=secret,proto3" json:"secret,omitempty"`
+	RedirectUris      []string               `protobuf:"bytes,3,rep,name=redirect_uris,json=redirectUris,proto3" json:"redirect_uris,omitempty"`
+	TrustedPeers      []string               `protobuf:"bytes,4,rep,name=trusted_peers,json=trustedPeers,proto3" json:"trusted_peers,omitempty"`
+	Public            bool                   `protobuf:"varint,5,opt,name=public,proto3" json:"public,omitempty"`
+	Name              string                 `protobuf:"bytes,6,opt,name=name,proto3" json:"name,omitempty"`
+	LogoUrl           string                 `protobuf:"bytes,7,opt,name=logo_url,json=logoUrl,proto3" json:"logo_url,omitempty"`
+	AllowedConnectors []string               `protobuf:"bytes,8,rep,name=allowed_connectors,json=allowedConnectors,proto3" json:"allowed_connectors,omitempty"`
+	SsoSharedWith     []string               `protobuf:"bytes,9,rep,name=sso_shared_with,json=ssoSharedWith,proto3" json:"sso_shared_with,omitempty"`
+	// Where dex POSTs a logout token when a session this client took part in
+	// ends, per OIDC Back-Channel Logout 1.0. Empty means the client is not
+	// notified.
+	BackchannelLogoutUri string `protobuf:"bytes,10,opt,name=backchannel_logout_uri,json=backchannelLogoutUri,proto3" json:"backchannel_logout_uri,omitempty"`
+	// Where the browser may be sent after an RP-initiated logout. A
+	// post_logout_redirect_uri that is not listed here is refused.
+	PostLogoutRedirectUris []string `protobuf:"bytes,11,rep,name=post_logout_redirect_uris,json=postLogoutRedirectUris,proto3" json:"post_logout_redirect_uris,omitempty"`
+	// Whether this client's refresh tokens outlive the browser session that
+	// issued them: "standalone" (the default) or "session".
+	RefreshTokenLifetime string `protobuf:"bytes,12,opt,name=refresh_token_lifetime,json=refreshTokenLifetime,proto3" json:"refresh_token_lifetime,omitempty"`
+	unknownFields        protoimpl.UnknownFields
+	sizeCache            protoimpl.SizeCache
 }
 
 func (x *Client) Reset() {
 	*x = Client{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_api_v2_api_proto_msgTypes[0]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_api_v2_api_proto_msgTypes[0]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *Client) String() string {
@@ -52,7 +62,7 @@ func (*Client) ProtoMessage() {}
 
 func (x *Client) ProtoReflect() protoreflect.Message {
 	mi := &file_api_v2_api_proto_msgTypes[0]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -116,22 +126,270 @@ func (x *Client) GetLogoUrl() string {
 	return ""
 }
 
-// CreateClientReq is a request to make a client.
-type CreateClientReq struct {
-	state         protoimpl.MessageState
+func (x *Client) GetAllowedConnectors() []string {
+	if x != nil {
+		return x.AllowedConnectors
+	}
+	return nil
+}
+
+func (x *Client) GetSsoSharedWith() []string {
+	if x != nil {
+		return x.SsoSharedWith
+	}
+	return nil
+}
+
+func (x *Client) GetBackchannelLogoutUri() string {
+	if x != nil {
+		return x.BackchannelLogoutUri
+	}
+	return ""
+}
+
+func (x *Client) GetPostLogoutRedirectUris() []string {
+	if x != nil {
+		return x.PostLogoutRedirectUris
+	}
+	return nil
+}
+
+func (x *Client) GetRefreshTokenLifetime() string {
+	if x != nil {
+		return x.RefreshTokenLifetime
+	}
+	return ""
+}
+
+// ClientInfo represents an OAuth2 client without sensitive information.
+type ClientInfo struct {
+	state                  protoimpl.MessageState `protogen:"open.v1"`
+	Id                     string                 `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
+	RedirectUris           []string               `protobuf:"bytes,2,rep,name=redirect_uris,json=redirectUris,proto3" json:"redirect_uris,omitempty"`
+	TrustedPeers           []string               `protobuf:"bytes,3,rep,name=trusted_peers,json=trustedPeers,proto3" json:"trusted_peers,omitempty"`
+	Public                 bool                   `protobuf:"varint,4,opt,name=public,proto3" json:"public,omitempty"`
+	Name                   string                 `protobuf:"bytes,5,opt,name=name,proto3" json:"name,omitempty"`
+	LogoUrl                string                 `protobuf:"bytes,6,opt,name=logo_url,json=logoUrl,proto3" json:"logo_url,omitempty"`
+	AllowedConnectors      []string               `protobuf:"bytes,7,rep,name=allowed_connectors,json=allowedConnectors,proto3" json:"allowed_connectors,omitempty"`
+	SsoSharedWith          []string               `protobuf:"bytes,8,rep,name=sso_shared_with,json=ssoSharedWith,proto3" json:"sso_shared_with,omitempty"`
+	BackchannelLogoutUri   string                 `protobuf:"bytes,9,opt,name=backchannel_logout_uri,json=backchannelLogoutUri,proto3" json:"backchannel_logout_uri,omitempty"`
+	PostLogoutRedirectUris []string               `protobuf:"bytes,10,rep,name=post_logout_redirect_uris,json=postLogoutRedirectUris,proto3" json:"post_logout_redirect_uris,omitempty"`
+	RefreshTokenLifetime   string                 `protobuf:"bytes,11,opt,name=refresh_token_lifetime,json=refreshTokenLifetime,proto3" json:"refresh_token_lifetime,omitempty"`
+	unknownFields          protoimpl.UnknownFields
+	sizeCache              protoimpl.SizeCache
+}
+
+func (x *ClientInfo) Reset() {
+	*x = ClientInfo{}
+	mi := &file_api_v2_api_proto_msgTypes[1]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *ClientInfo) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ClientInfo) ProtoMessage() {}
+
+func (x *ClientInfo) ProtoReflect() protoreflect.Message {
+	mi := &file_api_v2_api_proto_msgTypes[1]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ClientInfo.ProtoReflect.Descriptor instead.
+func (*ClientInfo) Descriptor() ([]byte, []int) {
+	return file_api_v2_api_proto_rawDescGZIP(), []int{1}
+}
+
+func (x *ClientInfo) GetId() string {
+	if x != nil {
+		return x.Id
+	}
+	return ""
+}
+
+func (x *ClientInfo) GetRedirectUris() []string {
+	if x != nil {
+		return x.RedirectUris
+	}
+	return nil
+}
+
+func (x *ClientInfo) GetTrustedPeers() []string {
+	if x != nil {
+		return x.TrustedPeers
+	}
+	return nil
+}
+
+func (x *ClientInfo) GetPublic() bool {
+	if x != nil {
+		return x.Public
+	}
+	return false
+}
+
+func (x *ClientInfo) GetName() string {
+	if x != nil {
+		return x.Name
+	}
+	return ""
+}
+
+func (x *ClientInfo) GetLogoUrl() string {
+	if x != nil {
+		return x.LogoUrl
+	}
+	return ""
+}
+
+func (x *ClientInfo) GetAllowedConnectors() []string {
+	if x != nil {
+		return x.AllowedConnectors
+	}
+	return nil
+}
+
+func (x *ClientInfo) GetSsoSharedWith() []string {
+	if x != nil {
+		return x.SsoSharedWith
+	}
+	return nil
+}
+
+func (x *ClientInfo) GetBackchannelLogoutUri() string {
+	if x != nil {
+		return x.BackchannelLogoutUri
+	}
+	return ""
+}
+
+func (x *ClientInfo) GetPostLogoutRedirectUris() []string {
+	if x != nil {
+		return x.PostLogoutRedirectUris
+	}
+	return nil
+}
+
+func (x *ClientInfo) GetRefreshTokenLifetime() string {
+	if x != nil {
+		return x.RefreshTokenLifetime
+	}
+	return ""
+}
+
+// GetClientReq is a request to retrieve client details.
+type GetClientReq struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// The ID of the client.
+	Id            string `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
+	unknownFields protoimpl.UnknownFields
 	sizeCache     protoimpl.SizeCache
+}
+
+func (x *GetClientReq) Reset() {
+	*x = GetClientReq{}
+	mi := &file_api_v2_api_proto_msgTypes[2]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *GetClientReq) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*GetClientReq) ProtoMessage() {}
+
+func (x *GetClientReq) ProtoReflect() protoreflect.Message {
+	mi := &file_api_v2_api_proto_msgTypes[2]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use GetClientReq.ProtoReflect.Descriptor instead.
+func (*GetClientReq) Descriptor() ([]byte, []int) {
+	return file_api_v2_api_proto_rawDescGZIP(), []int{2}
+}
+
+func (x *GetClientReq) GetId() string {
+	if x != nil {
+		return x.Id
+	}
+	return ""
+}
+
+// GetClientResp returns the client details.
+type GetClientResp struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Client        *Client                `protobuf:"bytes,1,opt,name=client,proto3" json:"client,omitempty"`
 	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
 
-	Client *Client `protobuf:"bytes,1,opt,name=client,proto3" json:"client,omitempty"`
+func (x *GetClientResp) Reset() {
+	*x = GetClientResp{}
+	mi := &file_api_v2_api_proto_msgTypes[3]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
-func (x *CreateClientReq) Reset() {
-	*x = CreateClientReq{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_api_v2_api_proto_msgTypes[1]
+func (x *GetClientResp) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*GetClientResp) ProtoMessage() {}
+
+func (x *GetClientResp) ProtoReflect() protoreflect.Message {
+	mi := &file_api_v2_api_proto_msgTypes[3]
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use GetClientResp.ProtoReflect.Descriptor instead.
+func (*GetClientResp) Descriptor() ([]byte, []int) {
+	return file_api_v2_api_proto_rawDescGZIP(), []int{3}
+}
+
+func (x *GetClientResp) GetClient() *Client {
+	if x != nil {
+		return x.Client
 	}
+	return nil
+}
+
+// CreateClientReq is a request to make a client.
+type CreateClientReq struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Client        *Client                `protobuf:"bytes,1,opt,name=client,proto3" json:"client,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *CreateClientReq) Reset() {
+	*x = CreateClientReq{}
+	mi := &file_api_v2_api_proto_msgTypes[4]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *CreateClientReq) String() string {
@@ -141,8 +399,8 @@ func (x *CreateClientReq) String() string {
 func (*CreateClientReq) ProtoMessage() {}
 
 func (x *CreateClientReq) ProtoReflect() protoreflect.Message {
-	mi := &file_api_v2_api_proto_msgTypes[1]
-	if protoimpl.UnsafeEnabled && x != nil {
+	mi := &file_api_v2_api_proto_msgTypes[4]
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -154,7 +412,7 @@ func (x *CreateClientReq) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use CreateClientReq.ProtoReflect.Descriptor instead.
 func (*CreateClientReq) Descriptor() ([]byte, []int) {
-	return file_api_v2_api_proto_rawDescGZIP(), []int{1}
+	return file_api_v2_api_proto_rawDescGZIP(), []int{4}
 }
 
 func (x *CreateClientReq) GetClient() *Client {
@@ -166,21 +424,18 @@ func (x *CreateClientReq) GetClient() *Client {
 
 // CreateClientResp returns the response from creating a client.
 type CreateClientResp struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	AlreadyExists bool                   `protobuf:"varint,1,opt,name=already_exists,json=alreadyExists,proto3" json:"already_exists,omitempty"`
+	Client        *Client                `protobuf:"bytes,2,opt,name=client,proto3" json:"client,omitempty"`
 	unknownFields protoimpl.UnknownFields
-
-	AlreadyExists bool    `protobuf:"varint,1,opt,name=already_exists,json=alreadyExists,proto3" json:"already_exists,omitempty"`
-	Client        *Client `protobuf:"bytes,2,opt,name=client,proto3" json:"client,omitempty"`
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *CreateClientResp) Reset() {
 	*x = CreateClientResp{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_api_v2_api_proto_msgTypes[2]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_api_v2_api_proto_msgTypes[5]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *CreateClientResp) String() string {
@@ -190,8 +445,8 @@ func (x *CreateClientResp) String() string {
 func (*CreateClientResp) ProtoMessage() {}
 
 func (x *CreateClientResp) ProtoReflect() protoreflect.Message {
-	mi := &file_api_v2_api_proto_msgTypes[2]
-	if protoimpl.UnsafeEnabled && x != nil {
+	mi := &file_api_v2_api_proto_msgTypes[5]
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -203,7 +458,7 @@ func (x *CreateClientResp) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use CreateClientResp.ProtoReflect.Descriptor instead.
 func (*CreateClientResp) Descriptor() ([]byte, []int) {
-	return file_api_v2_api_proto_rawDescGZIP(), []int{2}
+	return file_api_v2_api_proto_rawDescGZIP(), []int{5}
 }
 
 func (x *CreateClientResp) GetAlreadyExists() bool {
@@ -222,21 +477,18 @@ func (x *CreateClientResp) GetClient() *Client {
 
 // DeleteClientReq is a request to delete a client.
 type DeleteClientReq struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-
+	state protoimpl.MessageState `protogen:"open.v1"`
 	// The ID of the client.
-	Id string `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
+	Id            string `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *DeleteClientReq) Reset() {
 	*x = DeleteClientReq{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_api_v2_api_proto_msgTypes[3]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_api_v2_api_proto_msgTypes[6]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *DeleteClientReq) String() string {
@@ -246,8 +498,8 @@ func (x *DeleteClientReq) String() string {
 func (*DeleteClientReq) ProtoMessage() {}
 
 func (x *DeleteClientReq) ProtoReflect() protoreflect.Message {
-	mi := &file_api_v2_api_proto_msgTypes[3]
-	if protoimpl.UnsafeEnabled && x != nil {
+	mi := &file_api_v2_api_proto_msgTypes[6]
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -259,7 +511,7 @@ func (x *DeleteClientReq) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use DeleteClientReq.ProtoReflect.Descriptor instead.
 func (*DeleteClientReq) Descriptor() ([]byte, []int) {
-	return file_api_v2_api_proto_rawDescGZIP(), []int{3}
+	return file_api_v2_api_proto_rawDescGZIP(), []int{6}
 }
 
 func (x *DeleteClientReq) GetId() string {
@@ -271,20 +523,17 @@ func (x *DeleteClientReq) GetId() string {
 
 // DeleteClientResp determines if the client is deleted successfully.
 type DeleteClientResp struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	NotFound      bool                   `protobuf:"varint,1,opt,name=not_found,json=notFound,proto3" json:"not_found,omitempty"`
 	unknownFields protoimpl.UnknownFields
-
-	NotFound bool `protobuf:"varint,1,opt,name=not_found,json=notFound,proto3" json:"not_found,omitempty"`
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *DeleteClientResp) Reset() {
 	*x = DeleteClientResp{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_api_v2_api_proto_msgTypes[4]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_api_v2_api_proto_msgTypes[7]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *DeleteClientResp) String() string {
@@ -294,8 +543,8 @@ func (x *DeleteClientResp) String() string {
 func (*DeleteClientResp) ProtoMessage() {}
 
 func (x *DeleteClientResp) ProtoReflect() protoreflect.Message {
-	mi := &file_api_v2_api_proto_msgTypes[4]
-	if protoimpl.UnsafeEnabled && x != nil {
+	mi := &file_api_v2_api_proto_msgTypes[7]
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -307,7 +556,7 @@ func (x *DeleteClientResp) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use DeleteClientResp.ProtoReflect.Descriptor instead.
 func (*DeleteClientResp) Descriptor() ([]byte, []int) {
-	return file_api_v2_api_proto_rawDescGZIP(), []int{4}
+	return file_api_v2_api_proto_rawDescGZIP(), []int{7}
 }
 
 func (x *DeleteClientResp) GetNotFound() bool {
@@ -319,24 +568,32 @@ func (x *DeleteClientResp) GetNotFound() bool {
 
 // UpdateClientReq is a request to update an existing client.
 type UpdateClientReq struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-
-	Id           string   `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
-	RedirectUris []string `protobuf:"bytes,2,rep,name=redirect_uris,json=redirectUris,proto3" json:"redirect_uris,omitempty"`
-	TrustedPeers []string `protobuf:"bytes,3,rep,name=trusted_peers,json=trustedPeers,proto3" json:"trusted_peers,omitempty"`
-	Name         string   `protobuf:"bytes,4,opt,name=name,proto3" json:"name,omitempty"`
-	LogoUrl      string   `protobuf:"bytes,5,opt,name=logo_url,json=logoUrl,proto3" json:"logo_url,omitempty"`
+	state             protoimpl.MessageState `protogen:"open.v1"`
+	Id                string                 `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
+	RedirectUris      []string               `protobuf:"bytes,2,rep,name=redirect_uris,json=redirectUris,proto3" json:"redirect_uris,omitempty"`
+	TrustedPeers      []string               `protobuf:"bytes,3,rep,name=trusted_peers,json=trustedPeers,proto3" json:"trusted_peers,omitempty"`
+	Name              string                 `protobuf:"bytes,4,opt,name=name,proto3" json:"name,omitempty"`
+	LogoUrl           string                 `protobuf:"bytes,5,opt,name=logo_url,json=logoUrl,proto3" json:"logo_url,omitempty"`
+	AllowedConnectors []string               `protobuf:"bytes,6,rep,name=allowed_connectors,json=allowedConnectors,proto3" json:"allowed_connectors,omitempty"`
+	SsoSharedWith     []string               `protobuf:"bytes,7,rep,name=sso_shared_with,json=ssoSharedWith,proto3" json:"sso_shared_with,omitempty"`
+	// Optional so that an empty value clears the URI. Without explicit presence
+	// a client could be given a back-channel endpoint but never relieved of one,
+	// leaving dex posting logout tokens at something that no longer exists.
+	BackchannelLogoutUri   *string  `protobuf:"bytes,8,opt,name=backchannel_logout_uri,json=backchannelLogoutUri,proto3,oneof" json:"backchannel_logout_uri,omitempty"`
+	PostLogoutRedirectUris []string `protobuf:"bytes,9,rep,name=post_logout_redirect_uris,json=postLogoutRedirectUris,proto3" json:"post_logout_redirect_uris,omitempty"`
+	// Optional for the same reason as backchannel_logout_uri: an empty value has
+	// to be tellable apart from "leave it alone" to put a client back on the
+	// default lifetime.
+	RefreshTokenLifetime *string `protobuf:"bytes,10,opt,name=refresh_token_lifetime,json=refreshTokenLifetime,proto3,oneof" json:"refresh_token_lifetime,omitempty"`
+	unknownFields        protoimpl.UnknownFields
+	sizeCache            protoimpl.SizeCache
 }
 
 func (x *UpdateClientReq) Reset() {
 	*x = UpdateClientReq{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_api_v2_api_proto_msgTypes[5]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_api_v2_api_proto_msgTypes[8]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *UpdateClientReq) String() string {
@@ -346,8 +603,8 @@ func (x *UpdateClientReq) String() string {
 func (*UpdateClientReq) ProtoMessage() {}
 
 func (x *UpdateClientReq) ProtoReflect() protoreflect.Message {
-	mi := &file_api_v2_api_proto_msgTypes[5]
-	if protoimpl.UnsafeEnabled && x != nil {
+	mi := &file_api_v2_api_proto_msgTypes[8]
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -359,7 +616,7 @@ func (x *UpdateClientReq) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use UpdateClientReq.ProtoReflect.Descriptor instead.
 func (*UpdateClientReq) Descriptor() ([]byte, []int) {
-	return file_api_v2_api_proto_rawDescGZIP(), []int{5}
+	return file_api_v2_api_proto_rawDescGZIP(), []int{8}
 }
 
 func (x *UpdateClientReq) GetId() string {
@@ -397,33 +654,65 @@ func (x *UpdateClientReq) GetLogoUrl() string {
 	return ""
 }
 
-// UpdateClientResp returns the response from updating a client.
-type UpdateClientResp struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-
-	NotFound bool `protobuf:"varint,1,opt,name=not_found,json=notFound,proto3" json:"not_found,omitempty"`
+func (x *UpdateClientReq) GetAllowedConnectors() []string {
+	if x != nil {
+		return x.AllowedConnectors
+	}
+	return nil
 }
 
-func (x *UpdateClientResp) Reset() {
-	*x = UpdateClientResp{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_api_v2_api_proto_msgTypes[6]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
+func (x *UpdateClientReq) GetSsoSharedWith() []string {
+	if x != nil {
+		return x.SsoSharedWith
 	}
+	return nil
 }
 
-func (x *UpdateClientResp) String() string {
-	return protoimpl.X.MessageStringOf(x)
+func (x *UpdateClientReq) GetBackchannelLogoutUri() string {
+	if x != nil && x.BackchannelLogoutUri != nil {
+		return *x.BackchannelLogoutUri
+	}
+	return ""
 }
 
-func (*UpdateClientResp) ProtoMessage() {}
+func (x *UpdateClientReq) GetPostLogoutRedirectUris() []string {
+	if x != nil {
+		return x.PostLogoutRedirectUris
+	}
+	return nil
+}
+
+func (x *UpdateClientReq) GetRefreshTokenLifetime() string {
+	if x != nil && x.RefreshTokenLifetime != nil {
+		return *x.RefreshTokenLifetime
+	}
+	return ""
+}
+
+// UpdateClientResp returns the response from updating a client.
+type UpdateClientResp struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	NotFound      bool                   `protobuf:"varint,1,opt,name=not_found,json=notFound,proto3" json:"not_found,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *UpdateClientResp) Reset() {
+	*x = UpdateClientResp{}
+	mi := &file_api_v2_api_proto_msgTypes[9]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *UpdateClientResp) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*UpdateClientResp) ProtoMessage() {}
 
 func (x *UpdateClientResp) ProtoReflect() protoreflect.Message {
-	mi := &file_api_v2_api_proto_msgTypes[6]
-	if protoimpl.UnsafeEnabled && x != nil {
+	mi := &file_api_v2_api_proto_msgTypes[9]
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -435,7 +724,7 @@ func (x *UpdateClientResp) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use UpdateClientResp.ProtoReflect.Descriptor instead.
 func (*UpdateClientResp) Descriptor() ([]byte, []int) {
-	return file_api_v2_api_proto_rawDescGZIP(), []int{6}
+	return file_api_v2_api_proto_rawDescGZIP(), []int{9}
 }
 
 func (x *UpdateClientResp) GetNotFound() bool {
@@ -445,26 +734,105 @@ func (x *UpdateClientResp) GetNotFound() bool {
 	return false
 }
 
-// Password is an email for password mapping managed by the storage.
-type Password struct {
-	state         protoimpl.MessageState
+// ListClientReq is a request to enumerate clients.
+type ListClientReq struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	unknownFields protoimpl.UnknownFields
 	sizeCache     protoimpl.SizeCache
+}
+
+func (x *ListClientReq) Reset() {
+	*x = ListClientReq{}
+	mi := &file_api_v2_api_proto_msgTypes[10]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *ListClientReq) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ListClientReq) ProtoMessage() {}
+
+func (x *ListClientReq) ProtoReflect() protoreflect.Message {
+	mi := &file_api_v2_api_proto_msgTypes[10]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ListClientReq.ProtoReflect.Descriptor instead.
+func (*ListClientReq) Descriptor() ([]byte, []int) {
+	return file_api_v2_api_proto_rawDescGZIP(), []int{10}
+}
+
+// ListClientResp returns a list of clients.
+type ListClientResp struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Clients       []*ClientInfo          `protobuf:"bytes,1,rep,name=clients,proto3" json:"clients,omitempty"`
 	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *ListClientResp) Reset() {
+	*x = ListClientResp{}
+	mi := &file_api_v2_api_proto_msgTypes[11]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *ListClientResp) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ListClientResp) ProtoMessage() {}
+
+func (x *ListClientResp) ProtoReflect() protoreflect.Message {
+	mi := &file_api_v2_api_proto_msgTypes[11]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ListClientResp.ProtoReflect.Descriptor instead.
+func (*ListClientResp) Descriptor() ([]byte, []int) {
+	return file_api_v2_api_proto_rawDescGZIP(), []int{11}
+}
+
+func (x *ListClientResp) GetClients() []*ClientInfo {
+	if x != nil {
+		return x.Clients
+	}
+	return nil
+}
 
-	Email string `protobuf:"bytes,1,opt,name=email,proto3" json:"email,omitempty"`
+// Password is an email for password mapping managed by the storage.
+type Password struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	Email string                 `protobuf:"bytes,1,opt,name=email,proto3" json:"email,omitempty"`
 	// Currently we do not accept plain text passwords. Could be an option in the future.
-	Hash     []byte `protobuf:"bytes,2,opt,name=hash,proto3" json:"hash,omitempty"`
-	Username string `protobuf:"bytes,3,opt,name=username,proto3" json:"username,omitempty"`
-	UserId   string `protobuf:"bytes,4,opt,name=user_id,json=userId,proto3" json:"user_id,omitempty"`
+	Hash          []byte `protobuf:"bytes,2,opt,name=hash,proto3" json:"hash,omitempty"`
+	Username      string `protobuf:"bytes,3,opt,name=username,proto3" json:"username,omitempty"`
+	UserId        string `protobuf:"bytes,4,opt,name=user_id,json=userId,proto3" json:"user_id,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *Password) Reset() {
 	*x = Password{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_api_v2_api_proto_msgTypes[7]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_api_v2_api_proto_msgTypes[12]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *Password) String() string {
@@ -474,8 +842,8 @@ func (x *Password) String() string {
 func (*Password) ProtoMessage() {}
 
 func (x *Password) ProtoReflect() protoreflect.Message {
-	mi := &file_api_v2_api_proto_msgTypes[7]
-	if protoimpl.UnsafeEnabled && x != nil {
+	mi := &file_api_v2_api_proto_msgTypes[12]
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -487,7 +855,7 @@ func (x *Password) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use Password.ProtoReflect.Descriptor instead.
 func (*Password) Descriptor() ([]byte, []int) {
-	return file_api_v2_api_proto_rawDescGZIP(), []int{7}
+	return file_api_v2_api_proto_rawDescGZIP(), []int{12}
 }
 
 func (x *Password) GetEmail() string {
@@ -520,20 +888,17 @@ func (x *Password) GetUserId() string {
 
 // CreatePasswordReq is a request to make a password.
 type CreatePasswordReq struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Password      *Password              `protobuf:"bytes,1,opt,name=password,proto3" json:"password,omitempty"`
 	unknownFields protoimpl.UnknownFields
-
-	Password *Password `protobuf:"bytes,1,opt,name=password,proto3" json:"password,omitempty"`
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *CreatePasswordReq) Reset() {
 	*x = CreatePasswordReq{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_api_v2_api_proto_msgTypes[8]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_api_v2_api_proto_msgTypes[13]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *CreatePasswordReq) String() string {
@@ -543,8 +908,8 @@ func (x *CreatePasswordReq) String() string {
 func (*CreatePasswordReq) ProtoMessage() {}
 
 func (x *CreatePasswordReq) ProtoReflect() protoreflect.Message {
-	mi := &file_api_v2_api_proto_msgTypes[8]
-	if protoimpl.UnsafeEnabled && x != nil {
+	mi := &file_api_v2_api_proto_msgTypes[13]
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -556,7 +921,7 @@ func (x *CreatePasswordReq) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use CreatePasswordReq.ProtoReflect.Descriptor instead.
 func (*CreatePasswordReq) Descriptor() ([]byte, []int) {
-	return file_api_v2_api_proto_rawDescGZIP(), []int{8}
+	return file_api_v2_api_proto_rawDescGZIP(), []int{13}
 }
 
 func (x *CreatePasswordReq) GetPassword() *Password {
@@ -568,20 +933,17 @@ func (x *CreatePasswordReq) GetPassword() *Password {
 
 // CreatePasswordResp returns the response from creating a password.
 type CreatePasswordResp struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	AlreadyExists bool                   `protobuf:"varint,1,opt,name=already_exists,json=alreadyExists,proto3" json:"already_exists,omitempty"`
 	unknownFields protoimpl.UnknownFields
-
-	AlreadyExists bool `protobuf:"varint,1,opt,name=already_exists,json=alreadyExists,proto3" json:"already_exists,omitempty"`
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *CreatePasswordResp) Reset() {
 	*x = CreatePasswordResp{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_api_v2_api_proto_msgTypes[9]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_api_v2_api_proto_msgTypes[14]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *CreatePasswordResp) String() string {
@@ -591,8 +953,8 @@ func (x *CreatePasswordResp) String() string {
 func (*CreatePasswordResp) ProtoMessage() {}
 
 func (x *CreatePasswordResp) ProtoReflect() protoreflect.Message {
-	mi := &file_api_v2_api_proto_msgTypes[9]
-	if protoimpl.UnsafeEnabled && x != nil {
+	mi := &file_api_v2_api_proto_msgTypes[14]
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -604,7 +966,7 @@ func (x *CreatePasswordResp) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use CreatePasswordResp.ProtoReflect.Descriptor instead.
 func (*CreatePasswordResp) Descriptor() ([]byte, []int) {
-	return file_api_v2_api_proto_rawDescGZIP(), []int{9}
+	return file_api_v2_api_proto_rawDescGZIP(), []int{14}
 }
 
 func (x *CreatePasswordResp) GetAlreadyExists() bool {
@@ -616,23 +978,20 @@ func (x *CreatePasswordResp) GetAlreadyExists() bool {
 
 // UpdatePasswordReq is a request to modify an existing password.
 type UpdatePasswordReq struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-
+	state protoimpl.MessageState `protogen:"open.v1"`
 	// The email used to lookup the password. This field cannot be modified
-	Email       string `protobuf:"bytes,1,opt,name=email,proto3" json:"email,omitempty"`
-	NewHash     []byte `protobuf:"bytes,2,opt,name=new_hash,json=newHash,proto3" json:"new_hash,omitempty"`
-	NewUsername string `protobuf:"bytes,3,opt,name=new_username,json=newUsername,proto3" json:"new_username,omitempty"`
+	Email         string `protobuf:"bytes,1,opt,name=email,proto3" json:"email,omitempty"`
+	NewHash       []byte `protobuf:"bytes,2,opt,name=new_hash,json=newHash,proto3" json:"new_hash,omitempty"`
+	NewUsername   string `protobuf:"bytes,3,opt,name=new_username,json=newUsername,proto3" json:"new_username,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *UpdatePasswordReq) Reset() {
 	*x = UpdatePasswordReq{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_api_v2_api_proto_msgTypes[10]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_api_v2_api_proto_msgTypes[15]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *UpdatePasswordReq) String() string {
@@ -642,8 +1001,8 @@ func (x *UpdatePasswordReq) String() string {
 func (*UpdatePasswordReq) ProtoMessage() {}
 
 func (x *UpdatePasswordReq) ProtoReflect() protoreflect.Message {
-	mi := &file_api_v2_api_proto_msgTypes[10]
-	if protoimpl.UnsafeEnabled && x != nil {
+	mi := &file_api_v2_api_proto_msgTypes[15]
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -655,7 +1014,7 @@ func (x *UpdatePasswordReq) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use UpdatePasswordReq.ProtoReflect.Descriptor instead.
 func (*UpdatePasswordReq) Descriptor() ([]byte, []int) {
-	return file_api_v2_api_proto_rawDescGZIP(), []int{10}
+	return file_api_v2_api_proto_rawDescGZIP(), []int{15}
 }
 
 func (x *UpdatePasswordReq) GetEmail() string {
@@ -681,20 +1040,17 @@ func (x *UpdatePasswordReq) GetNewUsername() string {
 
 // UpdatePasswordResp returns the response from modifying an existing password.
 type UpdatePasswordResp struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	NotFound      bool                   `protobuf:"varint,1,opt,name=not_found,json=notFound,proto3" json:"not_found,omitempty"`
 	unknownFields protoimpl.UnknownFields
-
-	NotFound bool `protobuf:"varint,1,opt,name=not_found,json=notFound,proto3" json:"not_found,omitempty"`
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *UpdatePasswordResp) Reset() {
 	*x = UpdatePasswordResp{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_api_v2_api_proto_msgTypes[11]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_api_v2_api_proto_msgTypes[16]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *UpdatePasswordResp) String() string {
@@ -704,8 +1060,8 @@ func (x *UpdatePasswordResp) String() string {
 func (*UpdatePasswordResp) ProtoMessage() {}
 
 func (x *UpdatePasswordResp) ProtoReflect() protoreflect.Message {
-	mi := &file_api_v2_api_proto_msgTypes[11]
-	if protoimpl.UnsafeEnabled && x != nil {
+	mi := &file_api_v2_api_proto_msgTypes[16]
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -717,7 +1073,7 @@ func (x *UpdatePasswordResp) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use UpdatePasswordResp.ProtoReflect.Descriptor instead.
 func (*UpdatePasswordResp) Descriptor() ([]byte, []int) {
-	return file_api_v2_api_proto_rawDescGZIP(), []int{11}
+	return file_api_v2_api_proto_rawDescGZIP(), []int{16}
 }
 
 func (x *UpdatePasswordResp) GetNotFound() bool {
@@ -729,20 +1085,17 @@ func (x *UpdatePasswordResp) GetNotFound() bool {
 
 // DeletePasswordReq is a request to delete a password.
 type DeletePasswordReq struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Email         string                 `protobuf:"bytes,1,opt,name=email,proto3" json:"email,omitempty"`
 	unknownFields protoimpl.UnknownFields
-
-	Email string `protobuf:"bytes,1,opt,name=email,proto3" json:"email,omitempty"`
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *DeletePasswordReq) Reset() {
 	*x = DeletePasswordReq{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_api_v2_api_proto_msgTypes[12]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_api_v2_api_proto_msgTypes[17]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *DeletePasswordReq) String() string {
@@ -752,8 +1105,8 @@ func (x *DeletePasswordReq) String() string {
 func (*DeletePasswordReq) ProtoMessage() {}
 
 func (x *DeletePasswordReq) ProtoReflect() protoreflect.Message {
-	mi := &file_api_v2_api_proto_msgTypes[12]
-	if protoimpl.UnsafeEnabled && x != nil {
+	mi := &file_api_v2_api_proto_msgTypes[17]
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -765,7 +1118,7 @@ func (x *DeletePasswordReq) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use DeletePasswordReq.ProtoReflect.Descriptor instead.
 func (*DeletePasswordReq) Descriptor() ([]byte, []int) {
-	return file_api_v2_api_proto_rawDescGZIP(), []int{12}
+	return file_api_v2_api_proto_rawDescGZIP(), []int{17}
 }
 
 func (x *DeletePasswordReq) GetEmail() string {
@@ -777,20 +1130,17 @@ func (x *DeletePasswordReq) GetEmail() string {
 
 // DeletePasswordResp returns the response from deleting a password.
 type DeletePasswordResp struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	NotFound      bool                   `protobuf:"varint,1,opt,name=not_found,json=notFound,proto3" json:"not_found,omitempty"`
 	unknownFields protoimpl.UnknownFields
-
-	NotFound bool `protobuf:"varint,1,opt,name=not_found,json=notFound,proto3" json:"not_found,omitempty"`
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *DeletePasswordResp) Reset() {
 	*x = DeletePasswordResp{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_api_v2_api_proto_msgTypes[13]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_api_v2_api_proto_msgTypes[18]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *DeletePasswordResp) String() string {
@@ -800,8 +1150,8 @@ func (x *DeletePasswordResp) String() string {
 func (*DeletePasswordResp) ProtoMessage() {}
 
 func (x *DeletePasswordResp) ProtoReflect() protoreflect.Message {
-	mi := &file_api_v2_api_proto_msgTypes[13]
-	if protoimpl.UnsafeEnabled && x != nil {
+	mi := &file_api_v2_api_proto_msgTypes[18]
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -813,7 +1163,7 @@ func (x *DeletePasswordResp) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use DeletePasswordResp.ProtoReflect.Descriptor instead.
 func (*DeletePasswordResp) Descriptor() ([]byte, []int) {
-	return file_api_v2_api_proto_rawDescGZIP(), []int{13}
+	return file_api_v2_api_proto_rawDescGZIP(), []int{18}
 }
 
 func (x *DeletePasswordResp) GetNotFound() bool {
@@ -825,18 +1175,16 @@ func (x *DeletePasswordResp) GetNotFound() bool {
 
 // ListPasswordReq is a request to enumerate passwords.
 type ListPasswordReq struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
+	state         protoimpl.MessageState `protogen:"open.v1"`
 	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *ListPasswordReq) Reset() {
 	*x = ListPasswordReq{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_api_v2_api_proto_msgTypes[14]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_api_v2_api_proto_msgTypes[19]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *ListPasswordReq) String() string {
@@ -846,8 +1194,8 @@ func (x *ListPasswordReq) String() string {
 func (*ListPasswordReq) ProtoMessage() {}
 
 func (x *ListPasswordReq) ProtoReflect() protoreflect.Message {
-	mi := &file_api_v2_api_proto_msgTypes[14]
-	if protoimpl.UnsafeEnabled && x != nil {
+	mi := &file_api_v2_api_proto_msgTypes[19]
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -859,25 +1207,22 @@ func (x *ListPasswordReq) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ListPasswordReq.ProtoReflect.Descriptor instead.
 func (*ListPasswordReq) Descriptor() ([]byte, []int) {
-	return file_api_v2_api_proto_rawDescGZIP(), []int{14}
+	return file_api_v2_api_proto_rawDescGZIP(), []int{19}
 }
 
 // ListPasswordResp returns a list of passwords.
 type ListPasswordResp struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Passwords     []*Password            `protobuf:"bytes,1,rep,name=passwords,proto3" json:"passwords,omitempty"`
 	unknownFields protoimpl.UnknownFields
-
-	Passwords []*Password `protobuf:"bytes,1,rep,name=passwords,proto3" json:"passwords,omitempty"`
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *ListPasswordResp) Reset() {
 	*x = ListPasswordResp{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_api_v2_api_proto_msgTypes[15]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_api_v2_api_proto_msgTypes[20]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *ListPasswordResp) String() string {
@@ -887,8 +1232,8 @@ func (x *ListPasswordResp) String() string {
 func (*ListPasswordResp) ProtoMessage() {}
 
 func (x *ListPasswordResp) ProtoReflect() protoreflect.Message {
-	mi := &file_api_v2_api_proto_msgTypes[15]
-	if protoimpl.UnsafeEnabled && x != nil {
+	mi := &file_api_v2_api_proto_msgTypes[20]
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -900,7 +1245,7 @@ func (x *ListPasswordResp) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ListPasswordResp.ProtoReflect.Descriptor instead.
 func (*ListPasswordResp) Descriptor() ([]byte, []int) {
-	return file_api_v2_api_proto_rawDescGZIP(), []int{15}
+	return file_api_v2_api_proto_rawDescGZIP(), []int{20}
 }
 
 func (x *ListPasswordResp) GetPasswords() []*Password {
@@ -910,31 +1255,34 @@ func (x *ListPasswordResp) GetPasswords() []*Password {
 	return nil
 }
 
-// VersionReq is a request to fetch version info.
-type VersionReq struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
+// Connector is a strategy used by Dex for authenticating a user against another identity provider
+type Connector struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Id            string                 `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
+	Type          string                 `protobuf:"bytes,2,opt,name=type,proto3" json:"type,omitempty"`
+	Name          string                 `protobuf:"bytes,3,opt,name=name,proto3" json:"name,omitempty"`
+	Config        []byte                 `protobuf:"bytes,4,opt,name=config,proto3" json:"config,omitempty"`
+	GrantTypes    []string               `protobuf:"bytes,5,rep,name=grant_types,json=grantTypes,proto3" json:"grant_types,omitempty"`
 	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
 }
 
-func (x *VersionReq) Reset() {
-	*x = VersionReq{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_api_v2_api_proto_msgTypes[16]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+func (x *Connector) Reset() {
+	*x = Connector{}
+	mi := &file_api_v2_api_proto_msgTypes[21]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
-func (x *VersionReq) String() string {
+func (x *Connector) String() string {
 	return protoimpl.X.MessageStringOf(x)
 }
 
-func (*VersionReq) ProtoMessage() {}
+func (*Connector) ProtoMessage() {}
 
-func (x *VersionReq) ProtoReflect() protoreflect.Message {
-	mi := &file_api_v2_api_proto_msgTypes[16]
-	if protoimpl.UnsafeEnabled && x != nil {
+func (x *Connector) ProtoReflect() protoreflect.Message {
+	mi := &file_api_v2_api_proto_msgTypes[21]
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -944,42 +1292,70 @@ func (x *VersionReq) ProtoReflect() protoreflect.Message {
 	return mi.MessageOf(x)
 }
 
-// Deprecated: Use VersionReq.ProtoReflect.Descriptor instead.
-func (*VersionReq) Descriptor() ([]byte, []int) {
-	return file_api_v2_api_proto_rawDescGZIP(), []int{16}
+// Deprecated: Use Connector.ProtoReflect.Descriptor instead.
+func (*Connector) Descriptor() ([]byte, []int) {
+	return file_api_v2_api_proto_rawDescGZIP(), []int{21}
 }
 
-// VersionResp holds the version info of components.
-type VersionResp struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
+func (x *Connector) GetId() string {
+	if x != nil {
+		return x.Id
+	}
+	return ""
+}
 
-	// Semantic version of the server.
-	Server string `protobuf:"bytes,1,opt,name=server,proto3" json:"server,omitempty"`
-	// Numeric version of the API. It increases everytime a new call is added to the API.
-	// Clients should use this info to determine if the server supports specific features.
-	Api int32 `protobuf:"varint,2,opt,name=api,proto3" json:"api,omitempty"`
+func (x *Connector) GetType() string {
+	if x != nil {
+		return x.Type
+	}
+	return ""
 }
 
-func (x *VersionResp) Reset() {
-	*x = VersionResp{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_api_v2_api_proto_msgTypes[17]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
+func (x *Connector) GetName() string {
+	if x != nil {
+		return x.Name
 	}
+	return ""
 }
 
-func (x *VersionResp) String() string {
+func (x *Connector) GetConfig() []byte {
+	if x != nil {
+		return x.Config
+	}
+	return nil
+}
+
+func (x *Connector) GetGrantTypes() []string {
+	if x != nil {
+		return x.GrantTypes
+	}
+	return nil
+}
+
+// CreateConnectorReq is a request to make a connector.
+type CreateConnectorReq struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Connector     *Connector             `protobuf:"bytes,1,opt,name=connector,proto3" json:"connector,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *CreateConnectorReq) Reset() {
+	*x = CreateConnectorReq{}
+	mi := &file_api_v2_api_proto_msgTypes[22]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *CreateConnectorReq) String() string {
 	return protoimpl.X.MessageStringOf(x)
 }
 
-func (*VersionResp) ProtoMessage() {}
+func (*CreateConnectorReq) ProtoMessage() {}
 
-func (x *VersionResp) ProtoReflect() protoreflect.Message {
-	mi := &file_api_v2_api_proto_msgTypes[17]
-	if protoimpl.UnsafeEnabled && x != nil {
+func (x *CreateConnectorReq) ProtoReflect() protoreflect.Message {
+	mi := &file_api_v2_api_proto_msgTypes[22]
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -989,56 +1365,2455 @@ func (x *VersionResp) ProtoReflect() protoreflect.Message {
 	return mi.MessageOf(x)
 }
 
-// Deprecated: Use VersionResp.ProtoReflect.Descriptor instead.
-func (*VersionResp) Descriptor() ([]byte, []int) {
-	return file_api_v2_api_proto_rawDescGZIP(), []int{17}
+// Deprecated: Use CreateConnectorReq.ProtoReflect.Descriptor instead.
+func (*CreateConnectorReq) Descriptor() ([]byte, []int) {
+	return file_api_v2_api_proto_rawDescGZIP(), []int{22}
 }
 
-func (x *VersionResp) GetServer() string {
+func (x *CreateConnectorReq) GetConnector() *Connector {
 	if x != nil {
-		return x.Server
+		return x.Connector
 	}
-	return ""
+	return nil
 }
 
-func (x *VersionResp) GetApi() int32 {
-	if x != nil {
-		return x.Api
-	}
+// CreateConnectorResp returns the response from creating a connector.
+type CreateConnectorResp struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	AlreadyExists bool                   `protobuf:"varint,1,opt,name=already_exists,json=alreadyExists,proto3" json:"already_exists,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *CreateConnectorResp) Reset() {
+	*x = CreateConnectorResp{}
+	mi := &file_api_v2_api_proto_msgTypes[23]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *CreateConnectorResp) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*CreateConnectorResp) ProtoMessage() {}
+
+func (x *CreateConnectorResp) ProtoReflect() protoreflect.Message {
+	mi := &file_api_v2_api_proto_msgTypes[23]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use CreateConnectorResp.ProtoReflect.Descriptor instead.
+func (*CreateConnectorResp) Descriptor() ([]byte, []int) {
+	return file_api_v2_api_proto_rawDescGZIP(), []int{23}
+}
+
+func (x *CreateConnectorResp) GetAlreadyExists() bool {
+	if x != nil {
+		return x.AlreadyExists
+	}
+	return false
+}
+
+// GrantTypes wraps a list of grant types to distinguish between
+// "not specified" (no update) and "empty list" (unrestricted).
+type GrantTypes struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	GrantTypes    []string               `protobuf:"bytes,1,rep,name=grant_types,json=grantTypes,proto3" json:"grant_types,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *GrantTypes) Reset() {
+	*x = GrantTypes{}
+	mi := &file_api_v2_api_proto_msgTypes[24]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *GrantTypes) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*GrantTypes) ProtoMessage() {}
+
+func (x *GrantTypes) ProtoReflect() protoreflect.Message {
+	mi := &file_api_v2_api_proto_msgTypes[24]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use GrantTypes.ProtoReflect.Descriptor instead.
+func (*GrantTypes) Descriptor() ([]byte, []int) {
+	return file_api_v2_api_proto_rawDescGZIP(), []int{24}
+}
+
+func (x *GrantTypes) GetGrantTypes() []string {
+	if x != nil {
+		return x.GrantTypes
+	}
+	return nil
+}
+
+// UpdateConnectorReq is a request to modify an existing connector.
+type UpdateConnectorReq struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// The id used to lookup the connector. This field cannot be modified
+	Id        string `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
+	NewType   string `protobuf:"bytes,2,opt,name=new_type,json=newType,proto3" json:"new_type,omitempty"`
+	NewName   string `protobuf:"bytes,3,opt,name=new_name,json=newName,proto3" json:"new_name,omitempty"`
+	NewConfig []byte `protobuf:"bytes,4,opt,name=new_config,json=newConfig,proto3" json:"new_config,omitempty"`
+	// If set, updates the connector's allowed grant types.
+	// An empty grant_types list means unrestricted (all grant types allowed).
+	// If not set (null), grant types are not modified.
+	NewGrantTypes *GrantTypes `protobuf:"bytes,5,opt,name=new_grant_types,json=newGrantTypes,proto3" json:"new_grant_types,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *UpdateConnectorReq) Reset() {
+	*x = UpdateConnectorReq{}
+	mi := &file_api_v2_api_proto_msgTypes[25]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *UpdateConnectorReq) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*UpdateConnectorReq) ProtoMessage() {}
+
+func (x *UpdateConnectorReq) ProtoReflect() protoreflect.Message {
+	mi := &file_api_v2_api_proto_msgTypes[25]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use UpdateConnectorReq.ProtoReflect.Descriptor instead.
+func (*UpdateConnectorReq) Descriptor() ([]byte, []int) {
+	return file_api_v2_api_proto_rawDescGZIP(), []int{25}
+}
+
+func (x *UpdateConnectorReq) GetId() string {
+	if x != nil {
+		return x.Id
+	}
+	return ""
+}
+
+func (x *UpdateConnectorReq) GetNewType() string {
+	if x != nil {
+		return x.NewType
+	}
+	return ""
+}
+
+func (x *UpdateConnectorReq) GetNewName() string {
+	if x != nil {
+		return x.NewName
+	}
+	return ""
+}
+
+func (x *UpdateConnectorReq) GetNewConfig() []byte {
+	if x != nil {
+		return x.NewConfig
+	}
+	return nil
+}
+
+func (x *UpdateConnectorReq) GetNewGrantTypes() *GrantTypes {
+	if x != nil {
+		return x.NewGrantTypes
+	}
+	return nil
+}
+
+// UpdateConnectorResp returns the response from modifying an existing connector.
+type UpdateConnectorResp struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	NotFound      bool                   `protobuf:"varint,1,opt,name=not_found,json=notFound,proto3" json:"not_found,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *UpdateConnectorResp) Reset() {
+	*x = UpdateConnectorResp{}
+	mi := &file_api_v2_api_proto_msgTypes[26]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *UpdateConnectorResp) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*UpdateConnectorResp) ProtoMessage() {}
+
+func (x *UpdateConnectorResp) ProtoReflect() protoreflect.Message {
+	mi := &file_api_v2_api_proto_msgTypes[26]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use UpdateConnectorResp.ProtoReflect.Descriptor instead.
+func (*UpdateConnectorResp) Descriptor() ([]byte, []int) {
+	return file_api_v2_api_proto_rawDescGZIP(), []int{26}
+}
+
+func (x *UpdateConnectorResp) GetNotFound() bool {
+	if x != nil {
+		return x.NotFound
+	}
+	return false
+}
+
+// DeleteConnectorReq is a request to delete a connector.
+type DeleteConnectorReq struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Id            string                 `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *DeleteConnectorReq) Reset() {
+	*x = DeleteConnectorReq{}
+	mi := &file_api_v2_api_proto_msgTypes[27]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *DeleteConnectorReq) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*DeleteConnectorReq) ProtoMessage() {}
+
+func (x *DeleteConnectorReq) ProtoReflect() protoreflect.Message {
+	mi := &file_api_v2_api_proto_msgTypes[27]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use DeleteConnectorReq.ProtoReflect.Descriptor instead.
+func (*DeleteConnectorReq) Descriptor() ([]byte, []int) {
+	return file_api_v2_api_proto_rawDescGZIP(), []int{27}
+}
+
+func (x *DeleteConnectorReq) GetId() string {
+	if x != nil {
+		return x.Id
+	}
+	return ""
+}
+
+// DeleteConnectorResp returns the response from deleting a connector.
+type DeleteConnectorResp struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	NotFound      bool                   `protobuf:"varint,1,opt,name=not_found,json=notFound,proto3" json:"not_found,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *DeleteConnectorResp) Reset() {
+	*x = DeleteConnectorResp{}
+	mi := &file_api_v2_api_proto_msgTypes[28]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *DeleteConnectorResp) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*DeleteConnectorResp) ProtoMessage() {}
+
+func (x *DeleteConnectorResp) ProtoReflect() protoreflect.Message {
+	mi := &file_api_v2_api_proto_msgTypes[28]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use DeleteConnectorResp.ProtoReflect.Descriptor instead.
+func (*DeleteConnectorResp) Descriptor() ([]byte, []int) {
+	return file_api_v2_api_proto_rawDescGZIP(), []int{28}
+}
+
+func (x *DeleteConnectorResp) GetNotFound() bool {
+	if x != nil {
+		return x.NotFound
+	}
+	return false
+}
+
+// ListConnectorReq is a request to enumerate connectors.
+type ListConnectorReq struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *ListConnectorReq) Reset() {
+	*x = ListConnectorReq{}
+	mi := &file_api_v2_api_proto_msgTypes[29]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *ListConnectorReq) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ListConnectorReq) ProtoMessage() {}
+
+func (x *ListConnectorReq) ProtoReflect() protoreflect.Message {
+	mi := &file_api_v2_api_proto_msgTypes[29]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ListConnectorReq.ProtoReflect.Descriptor instead.
+func (*ListConnectorReq) Descriptor() ([]byte, []int) {
+	return file_api_v2_api_proto_rawDescGZIP(), []int{29}
+}
+
+// ListConnectorResp returns a list of connectors.
+type ListConnectorResp struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Connectors    []*Connector           `protobuf:"bytes,1,rep,name=connectors,proto3" json:"connectors,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *ListConnectorResp) Reset() {
+	*x = ListConnectorResp{}
+	mi := &file_api_v2_api_proto_msgTypes[30]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *ListConnectorResp) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ListConnectorResp) ProtoMessage() {}
+
+func (x *ListConnectorResp) ProtoReflect() protoreflect.Message {
+	mi := &file_api_v2_api_proto_msgTypes[30]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ListConnectorResp.ProtoReflect.Descriptor instead.
+func (*ListConnectorResp) Descriptor() ([]byte, []int) {
+	return file_api_v2_api_proto_rawDescGZIP(), []int{30}
+}
+
+func (x *ListConnectorResp) GetConnectors() []*Connector {
+	if x != nil {
+		return x.Connectors
+	}
+	return nil
+}
+
+// VersionReq is a request to fetch version info.
+type VersionReq struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *VersionReq) Reset() {
+	*x = VersionReq{}
+	mi := &file_api_v2_api_proto_msgTypes[31]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *VersionReq) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*VersionReq) ProtoMessage() {}
+
+func (x *VersionReq) ProtoReflect() protoreflect.Message {
+	mi := &file_api_v2_api_proto_msgTypes[31]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use VersionReq.ProtoReflect.Descriptor instead.
+func (*VersionReq) Descriptor() ([]byte, []int) {
+	return file_api_v2_api_proto_rawDescGZIP(), []int{31}
+}
+
+// VersionResp holds the version info of components.
+type VersionResp struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Semantic version of the server.
+	Server string `protobuf:"bytes,1,opt,name=server,proto3" json:"server,omitempty"`
+	// Numeric version of the API. It increases every time a new call is added to the API.
+	// Clients should use this info to determine if the server supports specific features.
+	Api           int32 `protobuf:"varint,2,opt,name=api,proto3" json:"api,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *VersionResp) Reset() {
+	*x = VersionResp{}
+	mi := &file_api_v2_api_proto_msgTypes[32]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *VersionResp) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*VersionResp) ProtoMessage() {}
+
+func (x *VersionResp) ProtoReflect() protoreflect.Message {
+	mi := &file_api_v2_api_proto_msgTypes[32]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use VersionResp.ProtoReflect.Descriptor instead.
+func (*VersionResp) Descriptor() ([]byte, []int) {
+	return file_api_v2_api_proto_rawDescGZIP(), []int{32}
+}
+
+func (x *VersionResp) GetServer() string {
+	if x != nil {
+		return x.Server
+	}
+	return ""
+}
+
+func (x *VersionResp) GetApi() int32 {
+	if x != nil {
+		return x.Api
+	}
+	return 0
+}
+
+// DiscoveryReq is a request to fetch discover information.
+type DiscoveryReq struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *DiscoveryReq) Reset() {
+	*x = DiscoveryReq{}
+	mi := &file_api_v2_api_proto_msgTypes[33]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *DiscoveryReq) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*DiscoveryReq) ProtoMessage() {}
+
+func (x *DiscoveryReq) ProtoReflect() protoreflect.Message {
+	mi := &file_api_v2_api_proto_msgTypes[33]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use DiscoveryReq.ProtoReflect.Descriptor instead.
+func (*DiscoveryReq) Descriptor() ([]byte, []int) {
+	return file_api_v2_api_proto_rawDescGZIP(), []int{33}
+}
+
+// DiscoverResp holds the version oidc disovery info.
+type DiscoveryResp struct {
+	state                             protoimpl.MessageState `protogen:"open.v1"`
+	Issuer                            string                 `protobuf:"bytes,1,opt,name=issuer,proto3" json:"issuer,omitempty"`
+	AuthorizationEndpoint             string                 `protobuf:"bytes,2,opt,name=authorization_endpoint,json=authorizationEndpoint,proto3" json:"authorization_endpoint,omitempty"`
+	TokenEndpoint                     string                 `protobuf:"bytes,3,opt,name=token_endpoint,json=tokenEndpoint,proto3" json:"token_endpoint,omitempty"`
+	JwksUri                           string                 `protobuf:"bytes,4,opt,name=jwks_uri,json=jwksUri,proto3" json:"jwks_uri,omitempty"`
+	UserinfoEndpoint                  string                 `protobuf:"bytes,5,opt,name=userinfo_endpoint,json=userinfoEndpoint,proto3" json:"userinfo_endpoint,omitempty"`
+	DeviceAuthorizationEndpoint       string                 `protobuf:"bytes,6,opt,name=device_authorization_endpoint,json=deviceAuthorizationEndpoint,proto3" json:"device_authorization_endpoint,omitempty"`
+	IntrospectionEndpoint             string                 `protobuf:"bytes,7,opt,name=introspection_endpoint,json=introspectionEndpoint,proto3" json:"introspection_endpoint,omitempty"`
+	GrantTypesSupported               []string               `protobuf:"bytes,8,rep,name=grant_types_supported,json=grantTypesSupported,proto3" json:"grant_types_supported,omitempty"`
+	ResponseTypesSupported            []string               `protobuf:"bytes,9,rep,name=response_types_supported,json=responseTypesSupported,proto3" json:"response_types_supported,omitempty"`
+	SubjectTypesSupported             []string               `protobuf:"bytes,10,rep,name=subject_types_supported,json=subjectTypesSupported,proto3" json:"subject_types_supported,omitempty"`
+	IdTokenSigningAlgValuesSupported  []string               `protobuf:"bytes,11,rep,name=id_token_signing_alg_values_supported,json=idTokenSigningAlgValuesSupported,proto3" json:"id_token_signing_alg_values_supported,omitempty"`
+	CodeChallengeMethodsSupported     []string               `protobuf:"bytes,12,rep,name=code_challenge_methods_supported,json=codeChallengeMethodsSupported,proto3" json:"code_challenge_methods_supported,omitempty"`
+	ScopesSupported                   []string               `protobuf:"bytes,13,rep,name=scopes_supported,json=scopesSupported,proto3" json:"scopes_supported,omitempty"`
+	TokenEndpointAuthMethodsSupported []string               `protobuf:"bytes,14,rep,name=token_endpoint_auth_methods_supported,json=tokenEndpointAuthMethodsSupported,proto3" json:"token_endpoint_auth_methods_supported,omitempty"`
+	ClaimsSupported                   []string               `protobuf:"bytes,15,rep,name=claims_supported,json=claimsSupported,proto3" json:"claims_supported,omitempty"`
+	unknownFields                     protoimpl.UnknownFields
+	sizeCache                         protoimpl.SizeCache
+}
+
+func (x *DiscoveryResp) Reset() {
+	*x = DiscoveryResp{}
+	mi := &file_api_v2_api_proto_msgTypes[34]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *DiscoveryResp) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*DiscoveryResp) ProtoMessage() {}
+
+func (x *DiscoveryResp) ProtoReflect() protoreflect.Message {
+	mi := &file_api_v2_api_proto_msgTypes[34]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use DiscoveryResp.ProtoReflect.Descriptor instead.
+func (*DiscoveryResp) Descriptor() ([]byte, []int) {
+	return file_api_v2_api_proto_rawDescGZIP(), []int{34}
+}
+
+func (x *DiscoveryResp) GetIssuer() string {
+	if x != nil {
+		return x.Issuer
+	}
+	return ""
+}
+
+func (x *DiscoveryResp) GetAuthorizationEndpoint() string {
+	if x != nil {
+		return x.AuthorizationEndpoint
+	}
+	return ""
+}
+
+func (x *DiscoveryResp) GetTokenEndpoint() string {
+	if x != nil {
+		return x.TokenEndpoint
+	}
+	return ""
+}
+
+func (x *DiscoveryResp) GetJwksUri() string {
+	if x != nil {
+		return x.JwksUri
+	}
+	return ""
+}
+
+func (x *DiscoveryResp) GetUserinfoEndpoint() string {
+	if x != nil {
+		return x.UserinfoEndpoint
+	}
+	return ""
+}
+
+func (x *DiscoveryResp) GetDeviceAuthorizationEndpoint() string {
+	if x != nil {
+		return x.DeviceAuthorizationEndpoint
+	}
+	return ""
+}
+
+func (x *DiscoveryResp) GetIntrospectionEndpoint() string {
+	if x != nil {
+		return x.IntrospectionEndpoint
+	}
+	return ""
+}
+
+func (x *DiscoveryResp) GetGrantTypesSupported() []string {
+	if x != nil {
+		return x.GrantTypesSupported
+	}
+	return nil
+}
+
+func (x *DiscoveryResp) GetResponseTypesSupported() []string {
+	if x != nil {
+		return x.ResponseTypesSupported
+	}
+	return nil
+}
+
+func (x *DiscoveryResp) GetSubjectTypesSupported() []string {
+	if x != nil {
+		return x.SubjectTypesSupported
+	}
+	return nil
+}
+
+func (x *DiscoveryResp) GetIdTokenSigningAlgValuesSupported() []string {
+	if x != nil {
+		return x.IdTokenSigningAlgValuesSupported
+	}
+	return nil
+}
+
+func (x *DiscoveryResp) GetCodeChallengeMethodsSupported() []string {
+	if x != nil {
+		return x.CodeChallengeMethodsSupported
+	}
+	return nil
+}
+
+func (x *DiscoveryResp) GetScopesSupported() []string {
+	if x != nil {
+		return x.ScopesSupported
+	}
+	return nil
+}
+
+func (x *DiscoveryResp) GetTokenEndpointAuthMethodsSupported() []string {
+	if x != nil {
+		return x.TokenEndpointAuthMethodsSupported
+	}
+	return nil
+}
+
+func (x *DiscoveryResp) GetClaimsSupported() []string {
+	if x != nil {
+		return x.ClaimsSupported
+	}
+	return nil
+}
+
+// RefreshTokenRef contains the metadata for a refresh token that is managed by the storage.
+type RefreshTokenRef struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// ID of the refresh token.
+	Id            string `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
+	ClientId      string `protobuf:"bytes,2,opt,name=client_id,json=clientId,proto3" json:"client_id,omitempty"`
+	CreatedAt     int64  `protobuf:"varint,5,opt,name=created_at,json=createdAt,proto3" json:"created_at,omitempty"`
+	LastUsed      int64  `protobuf:"varint,6,opt,name=last_used,json=lastUsed,proto3" json:"last_used,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *RefreshTokenRef) Reset() {
+	*x = RefreshTokenRef{}
+	mi := &file_api_v2_api_proto_msgTypes[35]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *RefreshTokenRef) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*RefreshTokenRef) ProtoMessage() {}
+
+func (x *RefreshTokenRef) ProtoReflect() protoreflect.Message {
+	mi := &file_api_v2_api_proto_msgTypes[35]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use RefreshTokenRef.ProtoReflect.Descriptor instead.
+func (*RefreshTokenRef) Descriptor() ([]byte, []int) {
+	return file_api_v2_api_proto_rawDescGZIP(), []int{35}
+}
+
+func (x *RefreshTokenRef) GetId() string {
+	if x != nil {
+		return x.Id
+	}
+	return ""
+}
+
+func (x *RefreshTokenRef) GetClientId() string {
+	if x != nil {
+		return x.ClientId
+	}
+	return ""
+}
+
+func (x *RefreshTokenRef) GetCreatedAt() int64 {
+	if x != nil {
+		return x.CreatedAt
+	}
+	return 0
+}
+
+func (x *RefreshTokenRef) GetLastUsed() int64 {
+	if x != nil {
+		return x.LastUsed
+	}
+	return 0
+}
+
+// ListRefreshReq is a request to enumerate the refresh tokens of a user.
+type ListRefreshReq struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// The "sub" claim returned in the ID Token.
+	UserId        string `protobuf:"bytes,1,opt,name=user_id,json=userId,proto3" json:"user_id,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *ListRefreshReq) Reset() {
+	*x = ListRefreshReq{}
+	mi := &file_api_v2_api_proto_msgTypes[36]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *ListRefreshReq) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ListRefreshReq) ProtoMessage() {}
+
+func (x *ListRefreshReq) ProtoReflect() protoreflect.Message {
+	mi := &file_api_v2_api_proto_msgTypes[36]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ListRefreshReq.ProtoReflect.Descriptor instead.
+func (*ListRefreshReq) Descriptor() ([]byte, []int) {
+	return file_api_v2_api_proto_rawDescGZIP(), []int{36}
+}
+
+func (x *ListRefreshReq) GetUserId() string {
+	if x != nil {
+		return x.UserId
+	}
+	return ""
+}
+
+// ListRefreshResp returns a list of refresh tokens for a user.
+type ListRefreshResp struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	RefreshTokens []*RefreshTokenRef     `protobuf:"bytes,1,rep,name=refresh_tokens,json=refreshTokens,proto3" json:"refresh_tokens,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *ListRefreshResp) Reset() {
+	*x = ListRefreshResp{}
+	mi := &file_api_v2_api_proto_msgTypes[37]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *ListRefreshResp) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ListRefreshResp) ProtoMessage() {}
+
+func (x *ListRefreshResp) ProtoReflect() protoreflect.Message {
+	mi := &file_api_v2_api_proto_msgTypes[37]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ListRefreshResp.ProtoReflect.Descriptor instead.
+func (*ListRefreshResp) Descriptor() ([]byte, []int) {
+	return file_api_v2_api_proto_rawDescGZIP(), []int{37}
+}
+
+func (x *ListRefreshResp) GetRefreshTokens() []*RefreshTokenRef {
+	if x != nil {
+		return x.RefreshTokens
+	}
+	return nil
+}
+
+// RevokeRefreshReq is a request to revoke the refresh token of the user-client pair.
+type RevokeRefreshReq struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// The "sub" claim returned in the ID Token.
+	UserId        string `protobuf:"bytes,1,opt,name=user_id,json=userId,proto3" json:"user_id,omitempty"`
+	ClientId      string `protobuf:"bytes,2,opt,name=client_id,json=clientId,proto3" json:"client_id,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *RevokeRefreshReq) Reset() {
+	*x = RevokeRefreshReq{}
+	mi := &file_api_v2_api_proto_msgTypes[38]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *RevokeRefreshReq) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*RevokeRefreshReq) ProtoMessage() {}
+
+func (x *RevokeRefreshReq) ProtoReflect() protoreflect.Message {
+	mi := &file_api_v2_api_proto_msgTypes[38]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use RevokeRefreshReq.ProtoReflect.Descriptor instead.
+func (*RevokeRefreshReq) Descriptor() ([]byte, []int) {
+	return file_api_v2_api_proto_rawDescGZIP(), []int{38}
+}
+
+func (x *RevokeRefreshReq) GetUserId() string {
+	if x != nil {
+		return x.UserId
+	}
+	return ""
+}
+
+func (x *RevokeRefreshReq) GetClientId() string {
+	if x != nil {
+		return x.ClientId
+	}
+	return ""
+}
+
+// RevokeRefreshResp determines if the refresh token is revoked successfully.
+type RevokeRefreshResp struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Set to true is refresh token was not found and token could not be revoked.
+	NotFound      bool `protobuf:"varint,1,opt,name=not_found,json=notFound,proto3" json:"not_found,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *RevokeRefreshResp) Reset() {
+	*x = RevokeRefreshResp{}
+	mi := &file_api_v2_api_proto_msgTypes[39]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *RevokeRefreshResp) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*RevokeRefreshResp) ProtoMessage() {}
+
+func (x *RevokeRefreshResp) ProtoReflect() protoreflect.Message {
+	mi := &file_api_v2_api_proto_msgTypes[39]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use RevokeRefreshResp.ProtoReflect.Descriptor instead.
+func (*RevokeRefreshResp) Descriptor() ([]byte, []int) {
+	return file_api_v2_api_proto_rawDescGZIP(), []int{39}
+}
+
+func (x *RevokeRefreshResp) GetNotFound() bool {
+	if x != nil {
+		return x.NotFound
+	}
+	return false
+}
+
+type VerifyPasswordReq struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Email         string                 `protobuf:"bytes,1,opt,name=email,proto3" json:"email,omitempty"`
+	Password      string                 `protobuf:"bytes,2,opt,name=password,proto3" json:"password,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *VerifyPasswordReq) Reset() {
+	*x = VerifyPasswordReq{}
+	mi := &file_api_v2_api_proto_msgTypes[40]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *VerifyPasswordReq) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*VerifyPasswordReq) ProtoMessage() {}
+
+func (x *VerifyPasswordReq) ProtoReflect() protoreflect.Message {
+	mi := &file_api_v2_api_proto_msgTypes[40]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use VerifyPasswordReq.ProtoReflect.Descriptor instead.
+func (*VerifyPasswordReq) Descriptor() ([]byte, []int) {
+	return file_api_v2_api_proto_rawDescGZIP(), []int{40}
+}
+
+func (x *VerifyPasswordReq) GetEmail() string {
+	if x != nil {
+		return x.Email
+	}
+	return ""
+}
+
+func (x *VerifyPasswordReq) GetPassword() string {
+	if x != nil {
+		return x.Password
+	}
+	return ""
+}
+
+type VerifyPasswordResp struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Verified      bool                   `protobuf:"varint,1,opt,name=verified,proto3" json:"verified,omitempty"`
+	NotFound      bool                   `protobuf:"varint,2,opt,name=not_found,json=notFound,proto3" json:"not_found,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *VerifyPasswordResp) Reset() {
+	*x = VerifyPasswordResp{}
+	mi := &file_api_v2_api_proto_msgTypes[41]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *VerifyPasswordResp) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*VerifyPasswordResp) ProtoMessage() {}
+
+func (x *VerifyPasswordResp) ProtoReflect() protoreflect.Message {
+	mi := &file_api_v2_api_proto_msgTypes[41]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use VerifyPasswordResp.ProtoReflect.Descriptor instead.
+func (*VerifyPasswordResp) Descriptor() ([]byte, []int) {
+	return file_api_v2_api_proto_rawDescGZIP(), []int{41}
+}
+
+func (x *VerifyPasswordResp) GetVerified() bool {
+	if x != nil {
+		return x.Verified
+	}
+	return false
+}
+
+func (x *VerifyPasswordResp) GetNotFound() bool {
+	if x != nil {
+		return x.NotFound
+	}
+	return false
+}
+
+// ClientAuthState represents authentication state for a specific client within a session.
+// The user_id and connector_id are on the parent AuthSession message.
+type ClientAuthState struct {
+	state             protoimpl.MessageState `protogen:"open.v1"`
+	ClientId          string                 `protobuf:"bytes,1,opt,name=client_id,json=clientId,proto3" json:"client_id,omitempty"`
+	AuthenticatedAt   int64                  `protobuf:"varint,2,opt,name=authenticated_at,json=authenticatedAt,proto3" json:"authenticated_at,omitempty"`
+	LastActivity      int64                  `protobuf:"varint,3,opt,name=last_activity,json=lastActivity,proto3" json:"last_activity,omitempty"`
+	LastTokenIssuedAt int64                  `protobuf:"varint,4,opt,name=last_token_issued_at,json=lastTokenIssuedAt,proto3" json:"last_token_issued_at,omitempty"`
+	// Whether this client was reached through another client's SSO sharing rather
+	// than by authenticating directly.
+	ViaSso        bool `protobuf:"varint,5,opt,name=via_sso,json=viaSso,proto3" json:"via_sso,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *ClientAuthState) Reset() {
+	*x = ClientAuthState{}
+	mi := &file_api_v2_api_proto_msgTypes[42]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *ClientAuthState) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ClientAuthState) ProtoMessage() {}
+
+func (x *ClientAuthState) ProtoReflect() protoreflect.Message {
+	mi := &file_api_v2_api_proto_msgTypes[42]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ClientAuthState.ProtoReflect.Descriptor instead.
+func (*ClientAuthState) Descriptor() ([]byte, []int) {
+	return file_api_v2_api_proto_rawDescGZIP(), []int{42}
+}
+
+func (x *ClientAuthState) GetClientId() string {
+	if x != nil {
+		return x.ClientId
+	}
+	return ""
+}
+
+func (x *ClientAuthState) GetAuthenticatedAt() int64 {
+	if x != nil {
+		return x.AuthenticatedAt
+	}
+	return 0
+}
+
+func (x *ClientAuthState) GetLastActivity() int64 {
+	if x != nil {
+		return x.LastActivity
+	}
+	return 0
+}
+
+func (x *ClientAuthState) GetLastTokenIssuedAt() int64 {
+	if x != nil {
+		return x.LastTokenIssuedAt
+	}
+	return 0
+}
+
+func (x *ClientAuthState) GetViaSso() bool {
+	if x != nil {
+		return x.ViaSso
+	}
+	return false
+}
+
+// AuthSession represents a user's authentication session.
+type AuthSession struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Random identifier of the session, published to clients as the "sid" claim. One
+	// signed-in browser is one session, so a user has as many as they have devices.
+	Id             string             `protobuf:"bytes,10,opt,name=id,proto3" json:"id,omitempty"`
+	UserId         string             `protobuf:"bytes,1,opt,name=user_id,json=userId,proto3" json:"user_id,omitempty"`
+	ConnectorId    string             `protobuf:"bytes,2,opt,name=connector_id,json=connectorId,proto3" json:"connector_id,omitempty"`
+	ClientStates   []*ClientAuthState `protobuf:"bytes,3,rep,name=client_states,json=clientStates,proto3" json:"client_states,omitempty"`
+	CreatedAt      int64              `protobuf:"varint,4,opt,name=created_at,json=createdAt,proto3" json:"created_at,omitempty"`
+	LastActivity   int64              `protobuf:"varint,5,opt,name=last_activity,json=lastActivity,proto3" json:"last_activity,omitempty"`
+	IpAddress      string             `protobuf:"bytes,6,opt,name=ip_address,json=ipAddress,proto3" json:"ip_address,omitempty"`
+	UserAgent      string             `protobuf:"bytes,7,opt,name=user_agent,json=userAgent,proto3" json:"user_agent,omitempty"`
+	AbsoluteExpiry int64              `protobuf:"varint,8,opt,name=absolute_expiry,json=absoluteExpiry,proto3" json:"absolute_expiry,omitempty"`
+	IdleExpiry     int64              `protobuf:"varint,9,opt,name=idle_expiry,json=idleExpiry,proto3" json:"idle_expiry,omitempty"`
+	unknownFields  protoimpl.UnknownFields
+	sizeCache      protoimpl.SizeCache
+}
+
+func (x *AuthSession) Reset() {
+	*x = AuthSession{}
+	mi := &file_api_v2_api_proto_msgTypes[43]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *AuthSession) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*AuthSession) ProtoMessage() {}
+
+func (x *AuthSession) ProtoReflect() protoreflect.Message {
+	mi := &file_api_v2_api_proto_msgTypes[43]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use AuthSession.ProtoReflect.Descriptor instead.
+func (*AuthSession) Descriptor() ([]byte, []int) {
+	return file_api_v2_api_proto_rawDescGZIP(), []int{43}
+}
+
+func (x *AuthSession) GetId() string {
+	if x != nil {
+		return x.Id
+	}
+	return ""
+}
+
+func (x *AuthSession) GetUserId() string {
+	if x != nil {
+		return x.UserId
+	}
+	return ""
+}
+
+func (x *AuthSession) GetConnectorId() string {
+	if x != nil {
+		return x.ConnectorId
+	}
+	return ""
+}
+
+func (x *AuthSession) GetClientStates() []*ClientAuthState {
+	if x != nil {
+		return x.ClientStates
+	}
+	return nil
+}
+
+func (x *AuthSession) GetCreatedAt() int64 {
+	if x != nil {
+		return x.CreatedAt
+	}
+	return 0
+}
+
+func (x *AuthSession) GetLastActivity() int64 {
+	if x != nil {
+		return x.LastActivity
+	}
+	return 0
+}
+
+func (x *AuthSession) GetIpAddress() string {
+	if x != nil {
+		return x.IpAddress
+	}
+	return ""
+}
+
+func (x *AuthSession) GetUserAgent() string {
+	if x != nil {
+		return x.UserAgent
+	}
+	return ""
+}
+
+func (x *AuthSession) GetAbsoluteExpiry() int64 {
+	if x != nil {
+		return x.AbsoluteExpiry
+	}
+	return 0
+}
+
+func (x *AuthSession) GetIdleExpiry() int64 {
+	if x != nil {
+		return x.IdleExpiry
+	}
+	return 0
+}
+
+// GetAuthSessionReq is a request to retrieve an auth session.
+type GetAuthSessionReq struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Id            string                 `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *GetAuthSessionReq) Reset() {
+	*x = GetAuthSessionReq{}
+	mi := &file_api_v2_api_proto_msgTypes[44]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *GetAuthSessionReq) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*GetAuthSessionReq) ProtoMessage() {}
+
+func (x *GetAuthSessionReq) ProtoReflect() protoreflect.Message {
+	mi := &file_api_v2_api_proto_msgTypes[44]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use GetAuthSessionReq.ProtoReflect.Descriptor instead.
+func (*GetAuthSessionReq) Descriptor() ([]byte, []int) {
+	return file_api_v2_api_proto_rawDescGZIP(), []int{44}
+}
+
+func (x *GetAuthSessionReq) GetId() string {
+	if x != nil {
+		return x.Id
+	}
+	return ""
+}
+
+// GetAuthSessionResp returns the auth session details.
+type GetAuthSessionResp struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Session       *AuthSession           `protobuf:"bytes,1,opt,name=session,proto3" json:"session,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *GetAuthSessionResp) Reset() {
+	*x = GetAuthSessionResp{}
+	mi := &file_api_v2_api_proto_msgTypes[45]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *GetAuthSessionResp) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*GetAuthSessionResp) ProtoMessage() {}
+
+func (x *GetAuthSessionResp) ProtoReflect() protoreflect.Message {
+	mi := &file_api_v2_api_proto_msgTypes[45]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use GetAuthSessionResp.ProtoReflect.Descriptor instead.
+func (*GetAuthSessionResp) Descriptor() ([]byte, []int) {
+	return file_api_v2_api_proto_rawDescGZIP(), []int{45}
+}
+
+func (x *GetAuthSessionResp) GetSession() *AuthSession {
+	if x != nil {
+		return x.Session
+	}
+	return nil
+}
+
+// ListAuthSessionsReq is a request to list auth sessions.
+type ListAuthSessionsReq struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Optional filter: if set, only sessions for this user are returned.
+	UserId string `protobuf:"bytes,1,opt,name=user_id,json=userId,proto3" json:"user_id,omitempty"`
+	// Optional filter: if set, only sessions from this connector are returned.
+	ConnectorId   string `protobuf:"bytes,2,opt,name=connector_id,json=connectorId,proto3" json:"connector_id,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *ListAuthSessionsReq) Reset() {
+	*x = ListAuthSessionsReq{}
+	mi := &file_api_v2_api_proto_msgTypes[46]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *ListAuthSessionsReq) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ListAuthSessionsReq) ProtoMessage() {}
+
+func (x *ListAuthSessionsReq) ProtoReflect() protoreflect.Message {
+	mi := &file_api_v2_api_proto_msgTypes[46]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ListAuthSessionsReq.ProtoReflect.Descriptor instead.
+func (*ListAuthSessionsReq) Descriptor() ([]byte, []int) {
+	return file_api_v2_api_proto_rawDescGZIP(), []int{46}
+}
+
+func (x *ListAuthSessionsReq) GetUserId() string {
+	if x != nil {
+		return x.UserId
+	}
+	return ""
+}
+
+func (x *ListAuthSessionsReq) GetConnectorId() string {
+	if x != nil {
+		return x.ConnectorId
+	}
+	return ""
+}
+
+// ListAuthSessionsResp returns a list of auth sessions.
+type ListAuthSessionsResp struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Sessions      []*AuthSession         `protobuf:"bytes,1,rep,name=sessions,proto3" json:"sessions,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *ListAuthSessionsResp) Reset() {
+	*x = ListAuthSessionsResp{}
+	mi := &file_api_v2_api_proto_msgTypes[47]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *ListAuthSessionsResp) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ListAuthSessionsResp) ProtoMessage() {}
+
+func (x *ListAuthSessionsResp) ProtoReflect() protoreflect.Message {
+	mi := &file_api_v2_api_proto_msgTypes[47]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ListAuthSessionsResp.ProtoReflect.Descriptor instead.
+func (*ListAuthSessionsResp) Descriptor() ([]byte, []int) {
+	return file_api_v2_api_proto_rawDescGZIP(), []int{47}
+}
+
+func (x *ListAuthSessionsResp) GetSessions() []*AuthSession {
+	if x != nil {
+		return x.Sessions
+	}
+	return nil
+}
+
+// DeleteAuthSessionReq is a request to delete an auth session.
+// Deleting a session also revokes all associated refresh tokens (consistent with logout behavior).
+type DeleteAuthSessionReq struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Id            string                 `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *DeleteAuthSessionReq) Reset() {
+	*x = DeleteAuthSessionReq{}
+	mi := &file_api_v2_api_proto_msgTypes[48]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *DeleteAuthSessionReq) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*DeleteAuthSessionReq) ProtoMessage() {}
+
+func (x *DeleteAuthSessionReq) ProtoReflect() protoreflect.Message {
+	mi := &file_api_v2_api_proto_msgTypes[48]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use DeleteAuthSessionReq.ProtoReflect.Descriptor instead.
+func (*DeleteAuthSessionReq) Descriptor() ([]byte, []int) {
+	return file_api_v2_api_proto_rawDescGZIP(), []int{48}
+}
+
+func (x *DeleteAuthSessionReq) GetId() string {
+	if x != nil {
+		return x.Id
+	}
+	return ""
+}
+
+// DeleteAuthSessionResp returns the result of deleting an auth session.
+type DeleteAuthSessionResp struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	NotFound      bool                   `protobuf:"varint,1,opt,name=not_found,json=notFound,proto3" json:"not_found,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *DeleteAuthSessionResp) Reset() {
+	*x = DeleteAuthSessionResp{}
+	mi := &file_api_v2_api_proto_msgTypes[49]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *DeleteAuthSessionResp) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*DeleteAuthSessionResp) ProtoMessage() {}
+
+func (x *DeleteAuthSessionResp) ProtoReflect() protoreflect.Message {
+	mi := &file_api_v2_api_proto_msgTypes[49]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use DeleteAuthSessionResp.ProtoReflect.Descriptor instead.
+func (*DeleteAuthSessionResp) Descriptor() ([]byte, []int) {
+	return file_api_v2_api_proto_rawDescGZIP(), []int{49}
+}
+
+func (x *DeleteAuthSessionResp) GetNotFound() bool {
+	if x != nil {
+		return x.NotFound
+	}
+	return false
+}
+
+// TerminateSessionsByConnectorReq is a request to terminate all sessions for a connector.
+// Use when connector configuration changes or is removed. Also revokes associated refresh tokens.
+type TerminateSessionsByConnectorReq struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	ConnectorId   string                 `protobuf:"bytes,1,opt,name=connector_id,json=connectorId,proto3" json:"connector_id,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *TerminateSessionsByConnectorReq) Reset() {
+	*x = TerminateSessionsByConnectorReq{}
+	mi := &file_api_v2_api_proto_msgTypes[50]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *TerminateSessionsByConnectorReq) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*TerminateSessionsByConnectorReq) ProtoMessage() {}
+
+func (x *TerminateSessionsByConnectorReq) ProtoReflect() protoreflect.Message {
+	mi := &file_api_v2_api_proto_msgTypes[50]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use TerminateSessionsByConnectorReq.ProtoReflect.Descriptor instead.
+func (*TerminateSessionsByConnectorReq) Descriptor() ([]byte, []int) {
+	return file_api_v2_api_proto_rawDescGZIP(), []int{50}
+}
+
+func (x *TerminateSessionsByConnectorReq) GetConnectorId() string {
+	if x != nil {
+		return x.ConnectorId
+	}
+	return ""
+}
+
+// TerminateSessionsByConnectorResp returns the count of terminated sessions.
+type TerminateSessionsByConnectorResp struct {
+	state              protoimpl.MessageState `protogen:"open.v1"`
+	SessionsTerminated int64                  `protobuf:"varint,1,opt,name=sessions_terminated,json=sessionsTerminated,proto3" json:"sessions_terminated,omitempty"`
+	unknownFields      protoimpl.UnknownFields
+	sizeCache          protoimpl.SizeCache
+}
+
+func (x *TerminateSessionsByConnectorResp) Reset() {
+	*x = TerminateSessionsByConnectorResp{}
+	mi := &file_api_v2_api_proto_msgTypes[51]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *TerminateSessionsByConnectorResp) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*TerminateSessionsByConnectorResp) ProtoMessage() {}
+
+func (x *TerminateSessionsByConnectorResp) ProtoReflect() protoreflect.Message {
+	mi := &file_api_v2_api_proto_msgTypes[51]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use TerminateSessionsByConnectorResp.ProtoReflect.Descriptor instead.
+func (*TerminateSessionsByConnectorResp) Descriptor() ([]byte, []int) {
+	return file_api_v2_api_proto_rawDescGZIP(), []int{51}
+}
+
+func (x *TerminateSessionsByConnectorResp) GetSessionsTerminated() int64 {
+	if x != nil {
+		return x.SessionsTerminated
+	}
+	return 0
+}
+
+// TerminateSessionsByUserReq is a request to terminate all sessions for a user.
+// Use for account compromise scenarios. Also revokes associated refresh tokens.
+type TerminateSessionsByUserReq struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	UserId        string                 `protobuf:"bytes,1,opt,name=user_id,json=userId,proto3" json:"user_id,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *TerminateSessionsByUserReq) Reset() {
+	*x = TerminateSessionsByUserReq{}
+	mi := &file_api_v2_api_proto_msgTypes[52]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *TerminateSessionsByUserReq) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*TerminateSessionsByUserReq) ProtoMessage() {}
+
+func (x *TerminateSessionsByUserReq) ProtoReflect() protoreflect.Message {
+	mi := &file_api_v2_api_proto_msgTypes[52]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use TerminateSessionsByUserReq.ProtoReflect.Descriptor instead.
+func (*TerminateSessionsByUserReq) Descriptor() ([]byte, []int) {
+	return file_api_v2_api_proto_rawDescGZIP(), []int{52}
+}
+
+func (x *TerminateSessionsByUserReq) GetUserId() string {
+	if x != nil {
+		return x.UserId
+	}
+	return ""
+}
+
+// TerminateSessionsByUserResp returns the count of terminated sessions.
+type TerminateSessionsByUserResp struct {
+	state              protoimpl.MessageState `protogen:"open.v1"`
+	SessionsTerminated int64                  `protobuf:"varint,1,opt,name=sessions_terminated,json=sessionsTerminated,proto3" json:"sessions_terminated,omitempty"`
+	unknownFields      protoimpl.UnknownFields
+	sizeCache          protoimpl.SizeCache
+}
+
+func (x *TerminateSessionsByUserResp) Reset() {
+	*x = TerminateSessionsByUserResp{}
+	mi := &file_api_v2_api_proto_msgTypes[53]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *TerminateSessionsByUserResp) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*TerminateSessionsByUserResp) ProtoMessage() {}
+
+func (x *TerminateSessionsByUserResp) ProtoReflect() protoreflect.Message {
+	mi := &file_api_v2_api_proto_msgTypes[53]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use TerminateSessionsByUserResp.ProtoReflect.Descriptor instead.
+func (*TerminateSessionsByUserResp) Descriptor() ([]byte, []int) {
+	return file_api_v2_api_proto_rawDescGZIP(), []int{53}
+}
+
+func (x *TerminateSessionsByUserResp) GetSessionsTerminated() int64 {
+	if x != nil {
+		return x.SessionsTerminated
+	}
+	return 0
+}
+
+// ConsentEntry represents approved scopes for a single client.
+type ConsentEntry struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	ClientId      string                 `protobuf:"bytes,1,opt,name=client_id,json=clientId,proto3" json:"client_id,omitempty"`
+	Scopes        []string               `protobuf:"bytes,2,rep,name=scopes,proto3" json:"scopes,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *ConsentEntry) Reset() {
+	*x = ConsentEntry{}
+	mi := &file_api_v2_api_proto_msgTypes[54]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *ConsentEntry) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ConsentEntry) ProtoMessage() {}
+
+func (x *ConsentEntry) ProtoReflect() protoreflect.Message {
+	mi := &file_api_v2_api_proto_msgTypes[54]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ConsentEntry.ProtoReflect.Descriptor instead.
+func (*ConsentEntry) Descriptor() ([]byte, []int) {
+	return file_api_v2_api_proto_rawDescGZIP(), []int{54}
+}
+
+func (x *ConsentEntry) GetClientId() string {
+	if x != nil {
+		return x.ClientId
+	}
+	return ""
+}
+
+func (x *ConsentEntry) GetScopes() []string {
+	if x != nil {
+		return x.Scopes
+	}
+	return nil
+}
+
+// MFASecret represents metadata of an enrolled MFA authenticator.
+// The actual secret value is never exposed through the admin API.
+type MFASecret struct {
+	state           protoimpl.MessageState `protogen:"open.v1"`
+	AuthenticatorId string                 `protobuf:"bytes,1,opt,name=authenticator_id,json=authenticatorId,proto3" json:"authenticator_id,omitempty"`
+	Type            string                 `protobuf:"bytes,2,opt,name=type,proto3" json:"type,omitempty"`
+	Confirmed       bool                   `protobuf:"varint,3,opt,name=confirmed,proto3" json:"confirmed,omitempty"`
+	CreatedAt       int64                  `protobuf:"varint,4,opt,name=created_at,json=createdAt,proto3" json:"created_at,omitempty"`
+	unknownFields   protoimpl.UnknownFields
+	sizeCache       protoimpl.SizeCache
+}
+
+func (x *MFASecret) Reset() {
+	*x = MFASecret{}
+	mi := &file_api_v2_api_proto_msgTypes[55]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *MFASecret) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*MFASecret) ProtoMessage() {}
+
+func (x *MFASecret) ProtoReflect() protoreflect.Message {
+	mi := &file_api_v2_api_proto_msgTypes[55]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use MFASecret.ProtoReflect.Descriptor instead.
+func (*MFASecret) Descriptor() ([]byte, []int) {
+	return file_api_v2_api_proto_rawDescGZIP(), []int{55}
+}
+
+func (x *MFASecret) GetAuthenticatorId() string {
+	if x != nil {
+		return x.AuthenticatorId
+	}
+	return ""
+}
+
+func (x *MFASecret) GetType() string {
+	if x != nil {
+		return x.Type
+	}
+	return ""
+}
+
+func (x *MFASecret) GetConfirmed() bool {
+	if x != nil {
+		return x.Confirmed
+	}
+	return false
+}
+
+func (x *MFASecret) GetCreatedAt() int64 {
+	if x != nil {
+		return x.CreatedAt
+	}
+	return 0
+}
+
+// WebAuthnCredential represents metadata of a registered WebAuthn credential.
+// The public key is never exposed through the admin API.
+type WebAuthnCredential struct {
+	state           protoimpl.MessageState `protogen:"open.v1"`
+	CredentialId    []byte                 `protobuf:"bytes,1,opt,name=credential_id,json=credentialId,proto3" json:"credential_id,omitempty"`
+	AttestationType string                 `protobuf:"bytes,2,opt,name=attestation_type,json=attestationType,proto3" json:"attestation_type,omitempty"`
+	Aaguid          []byte                 `protobuf:"bytes,3,opt,name=aaguid,proto3" json:"aaguid,omitempty"`
+	SignCount       uint32                 `protobuf:"varint,4,opt,name=sign_count,json=signCount,proto3" json:"sign_count,omitempty"`
+	CloneWarning    bool                   `protobuf:"varint,5,opt,name=clone_warning,json=cloneWarning,proto3" json:"clone_warning,omitempty"`
+	Transport       []string               `protobuf:"bytes,6,rep,name=transport,proto3" json:"transport,omitempty"`
+	BackupEligible  bool                   `protobuf:"varint,7,opt,name=backup_eligible,json=backupEligible,proto3" json:"backup_eligible,omitempty"`
+	BackupState     bool                   `protobuf:"varint,8,opt,name=backup_state,json=backupState,proto3" json:"backup_state,omitempty"`
+	DisplayName     string                 `protobuf:"bytes,9,opt,name=display_name,json=displayName,proto3" json:"display_name,omitempty"`
+	CreatedAt       int64                  `protobuf:"varint,10,opt,name=created_at,json=createdAt,proto3" json:"created_at,omitempty"`
+	unknownFields   protoimpl.UnknownFields
+	sizeCache       protoimpl.SizeCache
+}
+
+func (x *WebAuthnCredential) Reset() {
+	*x = WebAuthnCredential{}
+	mi := &file_api_v2_api_proto_msgTypes[56]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *WebAuthnCredential) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*WebAuthnCredential) ProtoMessage() {}
+
+func (x *WebAuthnCredential) ProtoReflect() protoreflect.Message {
+	mi := &file_api_v2_api_proto_msgTypes[56]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use WebAuthnCredential.ProtoReflect.Descriptor instead.
+func (*WebAuthnCredential) Descriptor() ([]byte, []int) {
+	return file_api_v2_api_proto_rawDescGZIP(), []int{56}
+}
+
+func (x *WebAuthnCredential) GetCredentialId() []byte {
+	if x != nil {
+		return x.CredentialId
+	}
+	return nil
+}
+
+func (x *WebAuthnCredential) GetAttestationType() string {
+	if x != nil {
+		return x.AttestationType
+	}
+	return ""
+}
+
+func (x *WebAuthnCredential) GetAaguid() []byte {
+	if x != nil {
+		return x.Aaguid
+	}
+	return nil
+}
+
+func (x *WebAuthnCredential) GetSignCount() uint32 {
+	if x != nil {
+		return x.SignCount
+	}
+	return 0
+}
+
+func (x *WebAuthnCredential) GetCloneWarning() bool {
+	if x != nil {
+		return x.CloneWarning
+	}
+	return false
+}
+
+func (x *WebAuthnCredential) GetTransport() []string {
+	if x != nil {
+		return x.Transport
+	}
+	return nil
+}
+
+func (x *WebAuthnCredential) GetBackupEligible() bool {
+	if x != nil {
+		return x.BackupEligible
+	}
+	return false
+}
+
+func (x *WebAuthnCredential) GetBackupState() bool {
+	if x != nil {
+		return x.BackupState
+	}
+	return false
+}
+
+func (x *WebAuthnCredential) GetDisplayName() string {
+	if x != nil {
+		return x.DisplayName
+	}
+	return ""
+}
+
+func (x *WebAuthnCredential) GetCreatedAt() int64 {
+	if x != nil {
+		return x.CreatedAt
+	}
+	return 0
+}
+
+// MFADeviceInfo groups MFA secret and WebAuthn credentials for one authenticator.
+type MFADeviceInfo struct {
+	state               protoimpl.MessageState `protogen:"open.v1"`
+	AuthenticatorId     string                 `protobuf:"bytes,1,opt,name=authenticator_id,json=authenticatorId,proto3" json:"authenticator_id,omitempty"`
+	MfaSecret           *MFASecret             `protobuf:"bytes,2,opt,name=mfa_secret,json=mfaSecret,proto3" json:"mfa_secret,omitempty"`
+	WebauthnCredentials []*WebAuthnCredential  `protobuf:"bytes,3,rep,name=webauthn_credentials,json=webauthnCredentials,proto3" json:"webauthn_credentials,omitempty"`
+	unknownFields       protoimpl.UnknownFields
+	sizeCache           protoimpl.SizeCache
+}
+
+func (x *MFADeviceInfo) Reset() {
+	*x = MFADeviceInfo{}
+	mi := &file_api_v2_api_proto_msgTypes[57]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *MFADeviceInfo) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*MFADeviceInfo) ProtoMessage() {}
+
+func (x *MFADeviceInfo) ProtoReflect() protoreflect.Message {
+	mi := &file_api_v2_api_proto_msgTypes[57]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use MFADeviceInfo.ProtoReflect.Descriptor instead.
+func (*MFADeviceInfo) Descriptor() ([]byte, []int) {
+	return file_api_v2_api_proto_rawDescGZIP(), []int{57}
+}
+
+func (x *MFADeviceInfo) GetAuthenticatorId() string {
+	if x != nil {
+		return x.AuthenticatorId
+	}
+	return ""
+}
+
+func (x *MFADeviceInfo) GetMfaSecret() *MFASecret {
+	if x != nil {
+		return x.MfaSecret
+	}
+	return nil
+}
+
+func (x *MFADeviceInfo) GetWebauthnCredentials() []*WebAuthnCredential {
+	if x != nil {
+		return x.WebauthnCredentials
+	}
+	return nil
+}
+
+// UserIdentity represents persistent per-user identity data.
+type UserIdentity struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	UserId        string                 `protobuf:"bytes,1,opt,name=user_id,json=userId,proto3" json:"user_id,omitempty"`
+	ConnectorId   string                 `protobuf:"bytes,2,opt,name=connector_id,json=connectorId,proto3" json:"connector_id,omitempty"`
+	Email         string                 `protobuf:"bytes,3,opt,name=email,proto3" json:"email,omitempty"`
+	EmailVerified bool                   `protobuf:"varint,4,opt,name=email_verified,json=emailVerified,proto3" json:"email_verified,omitempty"`
+	Username      string                 `protobuf:"bytes,5,opt,name=username,proto3" json:"username,omitempty"`
+	Groups        []string               `protobuf:"bytes,6,rep,name=groups,proto3" json:"groups,omitempty"`
+	Consents      []*ConsentEntry        `protobuf:"bytes,7,rep,name=consents,proto3" json:"consents,omitempty"`
+	MfaDevices    []*MFADeviceInfo       `protobuf:"bytes,8,rep,name=mfa_devices,json=mfaDevices,proto3" json:"mfa_devices,omitempty"`
+	CreatedAt     int64                  `protobuf:"varint,9,opt,name=created_at,json=createdAt,proto3" json:"created_at,omitempty"`
+	LastLogin     int64                  `protobuf:"varint,10,opt,name=last_login,json=lastLogin,proto3" json:"last_login,omitempty"`
+	BlockedUntil  int64                  `protobuf:"varint,11,opt,name=blocked_until,json=blockedUntil,proto3" json:"blocked_until,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *UserIdentity) Reset() {
+	*x = UserIdentity{}
+	mi := &file_api_v2_api_proto_msgTypes[58]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *UserIdentity) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*UserIdentity) ProtoMessage() {}
+
+func (x *UserIdentity) ProtoReflect() protoreflect.Message {
+	mi := &file_api_v2_api_proto_msgTypes[58]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use UserIdentity.ProtoReflect.Descriptor instead.
+func (*UserIdentity) Descriptor() ([]byte, []int) {
+	return file_api_v2_api_proto_rawDescGZIP(), []int{58}
+}
+
+func (x *UserIdentity) GetUserId() string {
+	if x != nil {
+		return x.UserId
+	}
+	return ""
+}
+
+func (x *UserIdentity) GetConnectorId() string {
+	if x != nil {
+		return x.ConnectorId
+	}
+	return ""
+}
+
+func (x *UserIdentity) GetEmail() string {
+	if x != nil {
+		return x.Email
+	}
+	return ""
+}
+
+func (x *UserIdentity) GetEmailVerified() bool {
+	if x != nil {
+		return x.EmailVerified
+	}
+	return false
+}
+
+func (x *UserIdentity) GetUsername() string {
+	if x != nil {
+		return x.Username
+	}
+	return ""
+}
+
+func (x *UserIdentity) GetGroups() []string {
+	if x != nil {
+		return x.Groups
+	}
+	return nil
+}
+
+func (x *UserIdentity) GetConsents() []*ConsentEntry {
+	if x != nil {
+		return x.Consents
+	}
+	return nil
+}
+
+func (x *UserIdentity) GetMfaDevices() []*MFADeviceInfo {
+	if x != nil {
+		return x.MfaDevices
+	}
+	return nil
+}
+
+func (x *UserIdentity) GetCreatedAt() int64 {
+	if x != nil {
+		return x.CreatedAt
+	}
+	return 0
+}
+
+func (x *UserIdentity) GetLastLogin() int64 {
+	if x != nil {
+		return x.LastLogin
+	}
 	return 0
 }
 
-// RefreshTokenRef contains the metadata for a refresh token that is managed by the storage.
-type RefreshTokenRef struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
+func (x *UserIdentity) GetBlockedUntil() int64 {
+	if x != nil {
+		return x.BlockedUntil
+	}
+	return 0
+}
+
+// GetUserIdentityReq is a request to retrieve a user identity.
+type GetUserIdentityReq struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	UserId        string                 `protobuf:"bytes,1,opt,name=user_id,json=userId,proto3" json:"user_id,omitempty"`
+	ConnectorId   string                 `protobuf:"bytes,2,opt,name=connector_id,json=connectorId,proto3" json:"connector_id,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *GetUserIdentityReq) Reset() {
+	*x = GetUserIdentityReq{}
+	mi := &file_api_v2_api_proto_msgTypes[59]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *GetUserIdentityReq) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*GetUserIdentityReq) ProtoMessage() {}
+
+func (x *GetUserIdentityReq) ProtoReflect() protoreflect.Message {
+	mi := &file_api_v2_api_proto_msgTypes[59]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use GetUserIdentityReq.ProtoReflect.Descriptor instead.
+func (*GetUserIdentityReq) Descriptor() ([]byte, []int) {
+	return file_api_v2_api_proto_rawDescGZIP(), []int{59}
+}
+
+func (x *GetUserIdentityReq) GetUserId() string {
+	if x != nil {
+		return x.UserId
+	}
+	return ""
+}
+
+func (x *GetUserIdentityReq) GetConnectorId() string {
+	if x != nil {
+		return x.ConnectorId
+	}
+	return ""
+}
+
+// GetUserIdentityResp returns the user identity details.
+type GetUserIdentityResp struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Identity      *UserIdentity          `protobuf:"bytes,1,opt,name=identity,proto3" json:"identity,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *GetUserIdentityResp) Reset() {
+	*x = GetUserIdentityResp{}
+	mi := &file_api_v2_api_proto_msgTypes[60]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *GetUserIdentityResp) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*GetUserIdentityResp) ProtoMessage() {}
+
+func (x *GetUserIdentityResp) ProtoReflect() protoreflect.Message {
+	mi := &file_api_v2_api_proto_msgTypes[60]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use GetUserIdentityResp.ProtoReflect.Descriptor instead.
+func (*GetUserIdentityResp) Descriptor() ([]byte, []int) {
+	return file_api_v2_api_proto_rawDescGZIP(), []int{60}
+}
+
+func (x *GetUserIdentityResp) GetIdentity() *UserIdentity {
+	if x != nil {
+		return x.Identity
+	}
+	return nil
+}
+
+// ListUserIdentitiesReq is a request to list user identities.
+type ListUserIdentitiesReq struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *ListUserIdentitiesReq) Reset() {
+	*x = ListUserIdentitiesReq{}
+	mi := &file_api_v2_api_proto_msgTypes[61]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *ListUserIdentitiesReq) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ListUserIdentitiesReq) ProtoMessage() {}
+
+func (x *ListUserIdentitiesReq) ProtoReflect() protoreflect.Message {
+	mi := &file_api_v2_api_proto_msgTypes[61]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ListUserIdentitiesReq.ProtoReflect.Descriptor instead.
+func (*ListUserIdentitiesReq) Descriptor() ([]byte, []int) {
+	return file_api_v2_api_proto_rawDescGZIP(), []int{61}
+}
+
+// ListUserIdentitiesResp returns a list of user identities.
+type ListUserIdentitiesResp struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Identities    []*UserIdentity        `protobuf:"bytes,1,rep,name=identities,proto3" json:"identities,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *ListUserIdentitiesResp) Reset() {
+	*x = ListUserIdentitiesResp{}
+	mi := &file_api_v2_api_proto_msgTypes[62]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *ListUserIdentitiesResp) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ListUserIdentitiesResp) ProtoMessage() {}
+
+func (x *ListUserIdentitiesResp) ProtoReflect() protoreflect.Message {
+	mi := &file_api_v2_api_proto_msgTypes[62]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ListUserIdentitiesResp.ProtoReflect.Descriptor instead.
+func (*ListUserIdentitiesResp) Descriptor() ([]byte, []int) {
+	return file_api_v2_api_proto_rawDescGZIP(), []int{62}
+}
+
+func (x *ListUserIdentitiesResp) GetIdentities() []*UserIdentity {
+	if x != nil {
+		return x.Identities
+	}
+	return nil
+}
+
+// DeleteUserIdentityReq is a request to delete a user identity.
+// This is a full data purge for GDPR compliance and account deletion.
+// It cascades to: auth session, all refresh tokens, offline sessions, the
+// password record (matched by the identity's email), and the identity itself.
+type DeleteUserIdentityReq struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	UserId        string                 `protobuf:"bytes,1,opt,name=user_id,json=userId,proto3" json:"user_id,omitempty"`
+	ConnectorId   string                 `protobuf:"bytes,2,opt,name=connector_id,json=connectorId,proto3" json:"connector_id,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *DeleteUserIdentityReq) Reset() {
+	*x = DeleteUserIdentityReq{}
+	mi := &file_api_v2_api_proto_msgTypes[63]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *DeleteUserIdentityReq) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*DeleteUserIdentityReq) ProtoMessage() {}
+
+func (x *DeleteUserIdentityReq) ProtoReflect() protoreflect.Message {
+	mi := &file_api_v2_api_proto_msgTypes[63]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use DeleteUserIdentityReq.ProtoReflect.Descriptor instead.
+func (*DeleteUserIdentityReq) Descriptor() ([]byte, []int) {
+	return file_api_v2_api_proto_rawDescGZIP(), []int{63}
+}
+
+func (x *DeleteUserIdentityReq) GetUserId() string {
+	if x != nil {
+		return x.UserId
+	}
+	return ""
+}
+
+func (x *DeleteUserIdentityReq) GetConnectorId() string {
+	if x != nil {
+		return x.ConnectorId
+	}
+	return ""
+}
+
+// DeleteUserIdentityResp returns the result of deleting a user identity.
+type DeleteUserIdentityResp struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	NotFound      bool                   `protobuf:"varint,1,opt,name=not_found,json=notFound,proto3" json:"not_found,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *DeleteUserIdentityResp) Reset() {
+	*x = DeleteUserIdentityResp{}
+	mi := &file_api_v2_api_proto_msgTypes[64]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *DeleteUserIdentityResp) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*DeleteUserIdentityResp) ProtoMessage() {}
+
+func (x *DeleteUserIdentityResp) ProtoReflect() protoreflect.Message {
+	mi := &file_api_v2_api_proto_msgTypes[64]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use DeleteUserIdentityResp.ProtoReflect.Descriptor instead.
+func (*DeleteUserIdentityResp) Descriptor() ([]byte, []int) {
+	return file_api_v2_api_proto_rawDescGZIP(), []int{64}
+}
+
+func (x *DeleteUserIdentityResp) GetNotFound() bool {
+	if x != nil {
+		return x.NotFound
+	}
+	return false
+}
 
-	// ID of the refresh token.
-	Id        string `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
-	ClientId  string `protobuf:"bytes,2,opt,name=client_id,json=clientId,proto3" json:"client_id,omitempty"`
-	CreatedAt int64  `protobuf:"varint,5,opt,name=created_at,json=createdAt,proto3" json:"created_at,omitempty"`
-	LastUsed  int64  `protobuf:"varint,6,opt,name=last_used,json=lastUsed,proto3" json:"last_used,omitempty"`
+// ResetMFAReq is a request to clear all MFA secrets and WebAuthn credentials for a user.
+// Use when a user has lost access to all their MFA devices.
+type ResetMFAReq struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	UserId        string                 `protobuf:"bytes,1,opt,name=user_id,json=userId,proto3" json:"user_id,omitempty"`
+	ConnectorId   string                 `protobuf:"bytes,2,opt,name=connector_id,json=connectorId,proto3" json:"connector_id,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
 }
 
-func (x *RefreshTokenRef) Reset() {
-	*x = RefreshTokenRef{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_api_v2_api_proto_msgTypes[18]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+func (x *ResetMFAReq) Reset() {
+	*x = ResetMFAReq{}
+	mi := &file_api_v2_api_proto_msgTypes[65]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
-func (x *RefreshTokenRef) String() string {
+func (x *ResetMFAReq) String() string {
 	return protoimpl.X.MessageStringOf(x)
 }
 
-func (*RefreshTokenRef) ProtoMessage() {}
+func (*ResetMFAReq) ProtoMessage() {}
 
-func (x *RefreshTokenRef) ProtoReflect() protoreflect.Message {
-	mi := &file_api_v2_api_proto_msgTypes[18]
-	if protoimpl.UnsafeEnabled && x != nil {
+func (x *ResetMFAReq) ProtoReflect() protoreflect.Message {
+	mi := &file_api_v2_api_proto_msgTypes[65]
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -1048,67 +3823,95 @@ func (x *RefreshTokenRef) ProtoReflect() protoreflect.Message {
 	return mi.MessageOf(x)
 }
 
-// Deprecated: Use RefreshTokenRef.ProtoReflect.Descriptor instead.
-func (*RefreshTokenRef) Descriptor() ([]byte, []int) {
-	return file_api_v2_api_proto_rawDescGZIP(), []int{18}
+// Deprecated: Use ResetMFAReq.ProtoReflect.Descriptor instead.
+func (*ResetMFAReq) Descriptor() ([]byte, []int) {
+	return file_api_v2_api_proto_rawDescGZIP(), []int{65}
 }
 
-func (x *RefreshTokenRef) GetId() string {
+func (x *ResetMFAReq) GetUserId() string {
 	if x != nil {
-		return x.Id
+		return x.UserId
 	}
 	return ""
 }
 
-func (x *RefreshTokenRef) GetClientId() string {
+func (x *ResetMFAReq) GetConnectorId() string {
 	if x != nil {
-		return x.ClientId
+		return x.ConnectorId
 	}
 	return ""
 }
 
-func (x *RefreshTokenRef) GetCreatedAt() int64 {
+// ResetMFAResp returns the result of resetting MFA.
+type ResetMFAResp struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	NotFound      bool                   `protobuf:"varint,1,opt,name=not_found,json=notFound,proto3" json:"not_found,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *ResetMFAResp) Reset() {
+	*x = ResetMFAResp{}
+	mi := &file_api_v2_api_proto_msgTypes[66]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *ResetMFAResp) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ResetMFAResp) ProtoMessage() {}
+
+func (x *ResetMFAResp) ProtoReflect() protoreflect.Message {
+	mi := &file_api_v2_api_proto_msgTypes[66]
 	if x != nil {
-		return x.CreatedAt
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
 	}
-	return 0
+	return mi.MessageOf(x)
 }
 
-func (x *RefreshTokenRef) GetLastUsed() int64 {
+// Deprecated: Use ResetMFAResp.ProtoReflect.Descriptor instead.
+func (*ResetMFAResp) Descriptor() ([]byte, []int) {
+	return file_api_v2_api_proto_rawDescGZIP(), []int{66}
+}
+
+func (x *ResetMFAResp) GetNotFound() bool {
 	if x != nil {
-		return x.LastUsed
+		return x.NotFound
 	}
-	return 0
+	return false
 }
 
-// ListRefreshReq is a request to enumerate the refresh tokens of a user.
-type ListRefreshReq struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
+// ListMFADevicesReq is a request to list registered MFA authenticators for a user.
+type ListMFADevicesReq struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	UserId        string                 `protobuf:"bytes,1,opt,name=user_id,json=userId,proto3" json:"user_id,omitempty"`
+	ConnectorId   string                 `protobuf:"bytes,2,opt,name=connector_id,json=connectorId,proto3" json:"connector_id,omitempty"`
 	unknownFields protoimpl.UnknownFields
-
-	// The "sub" claim returned in the ID Token.
-	UserId string `protobuf:"bytes,1,opt,name=user_id,json=userId,proto3" json:"user_id,omitempty"`
+	sizeCache     protoimpl.SizeCache
 }
 
-func (x *ListRefreshReq) Reset() {
-	*x = ListRefreshReq{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_api_v2_api_proto_msgTypes[19]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+func (x *ListMFADevicesReq) Reset() {
+	*x = ListMFADevicesReq{}
+	mi := &file_api_v2_api_proto_msgTypes[67]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
-func (x *ListRefreshReq) String() string {
+func (x *ListMFADevicesReq) String() string {
 	return protoimpl.X.MessageStringOf(x)
 }
 
-func (*ListRefreshReq) ProtoMessage() {}
+func (*ListMFADevicesReq) ProtoMessage() {}
 
-func (x *ListRefreshReq) ProtoReflect() protoreflect.Message {
-	mi := &file_api_v2_api_proto_msgTypes[19]
-	if protoimpl.UnsafeEnabled && x != nil {
+func (x *ListMFADevicesReq) ProtoReflect() protoreflect.Message {
+	mi := &file_api_v2_api_proto_msgTypes[67]
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -1118,45 +3921,50 @@ func (x *ListRefreshReq) ProtoReflect() protoreflect.Message {
 	return mi.MessageOf(x)
 }
 
-// Deprecated: Use ListRefreshReq.ProtoReflect.Descriptor instead.
-func (*ListRefreshReq) Descriptor() ([]byte, []int) {
-	return file_api_v2_api_proto_rawDescGZIP(), []int{19}
+// Deprecated: Use ListMFADevicesReq.ProtoReflect.Descriptor instead.
+func (*ListMFADevicesReq) Descriptor() ([]byte, []int) {
+	return file_api_v2_api_proto_rawDescGZIP(), []int{67}
 }
 
-func (x *ListRefreshReq) GetUserId() string {
+func (x *ListMFADevicesReq) GetUserId() string {
 	if x != nil {
 		return x.UserId
 	}
 	return ""
 }
 
-// ListRefreshResp returns a list of refresh tokens for a user.
-type ListRefreshResp struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
+func (x *ListMFADevicesReq) GetConnectorId() string {
+	if x != nil {
+		return x.ConnectorId
+	}
+	return ""
+}
 
-	RefreshTokens []*RefreshTokenRef `protobuf:"bytes,1,rep,name=refresh_tokens,json=refreshTokens,proto3" json:"refresh_tokens,omitempty"`
+// ListMFADevicesResp returns MFA device information.
+// Secret values and public keys are never included in the response.
+type ListMFADevicesResp struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Devices       []*MFADeviceInfo       `protobuf:"bytes,1,rep,name=devices,proto3" json:"devices,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
 }
 
-func (x *ListRefreshResp) Reset() {
-	*x = ListRefreshResp{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_api_v2_api_proto_msgTypes[20]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+func (x *ListMFADevicesResp) Reset() {
+	*x = ListMFADevicesResp{}
+	mi := &file_api_v2_api_proto_msgTypes[68]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
-func (x *ListRefreshResp) String() string {
+func (x *ListMFADevicesResp) String() string {
 	return protoimpl.X.MessageStringOf(x)
 }
 
-func (*ListRefreshResp) ProtoMessage() {}
+func (*ListMFADevicesResp) ProtoMessage() {}
 
-func (x *ListRefreshResp) ProtoReflect() protoreflect.Message {
-	mi := &file_api_v2_api_proto_msgTypes[20]
-	if protoimpl.UnsafeEnabled && x != nil {
+func (x *ListMFADevicesResp) ProtoReflect() protoreflect.Message {
+	mi := &file_api_v2_api_proto_msgTypes[68]
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -1166,47 +3974,45 @@ func (x *ListRefreshResp) ProtoReflect() protoreflect.Message {
 	return mi.MessageOf(x)
 }
 
-// Deprecated: Use ListRefreshResp.ProtoReflect.Descriptor instead.
-func (*ListRefreshResp) Descriptor() ([]byte, []int) {
-	return file_api_v2_api_proto_rawDescGZIP(), []int{20}
+// Deprecated: Use ListMFADevicesResp.ProtoReflect.Descriptor instead.
+func (*ListMFADevicesResp) Descriptor() ([]byte, []int) {
+	return file_api_v2_api_proto_rawDescGZIP(), []int{68}
 }
 
-func (x *ListRefreshResp) GetRefreshTokens() []*RefreshTokenRef {
+func (x *ListMFADevicesResp) GetDevices() []*MFADeviceInfo {
 	if x != nil {
-		return x.RefreshTokens
+		return x.Devices
 	}
 	return nil
 }
 
-// RevokeRefreshReq is a request to revoke the refresh token of the user-client pair.
-type RevokeRefreshReq struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
+// DeleteWebAuthnCredentialReq is a request to delete a specific WebAuthn credential.
+// Use when a user has lost or wants to deregister a specific security key.
+type DeleteWebAuthnCredentialReq struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	UserId        string                 `protobuf:"bytes,1,opt,name=user_id,json=userId,proto3" json:"user_id,omitempty"`
+	ConnectorId   string                 `protobuf:"bytes,2,opt,name=connector_id,json=connectorId,proto3" json:"connector_id,omitempty"`
+	CredentialId  []byte                 `protobuf:"bytes,3,opt,name=credential_id,json=credentialId,proto3" json:"credential_id,omitempty"`
 	unknownFields protoimpl.UnknownFields
-
-	// The "sub" claim returned in the ID Token.
-	UserId   string `protobuf:"bytes,1,opt,name=user_id,json=userId,proto3" json:"user_id,omitempty"`
-	ClientId string `protobuf:"bytes,2,opt,name=client_id,json=clientId,proto3" json:"client_id,omitempty"`
+	sizeCache     protoimpl.SizeCache
 }
 
-func (x *RevokeRefreshReq) Reset() {
-	*x = RevokeRefreshReq{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_api_v2_api_proto_msgTypes[21]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+func (x *DeleteWebAuthnCredentialReq) Reset() {
+	*x = DeleteWebAuthnCredentialReq{}
+	mi := &file_api_v2_api_proto_msgTypes[69]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
-func (x *RevokeRefreshReq) String() string {
+func (x *DeleteWebAuthnCredentialReq) String() string {
 	return protoimpl.X.MessageStringOf(x)
 }
 
-func (*RevokeRefreshReq) ProtoMessage() {}
+func (*DeleteWebAuthnCredentialReq) ProtoMessage() {}
 
-func (x *RevokeRefreshReq) ProtoReflect() protoreflect.Message {
-	mi := &file_api_v2_api_proto_msgTypes[21]
-	if protoimpl.UnsafeEnabled && x != nil {
+func (x *DeleteWebAuthnCredentialReq) ProtoReflect() protoreflect.Message {
+	mi := &file_api_v2_api_proto_msgTypes[69]
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -1216,53 +4022,56 @@ func (x *RevokeRefreshReq) ProtoReflect() protoreflect.Message {
 	return mi.MessageOf(x)
 }
 
-// Deprecated: Use RevokeRefreshReq.ProtoReflect.Descriptor instead.
-func (*RevokeRefreshReq) Descriptor() ([]byte, []int) {
-	return file_api_v2_api_proto_rawDescGZIP(), []int{21}
+// Deprecated: Use DeleteWebAuthnCredentialReq.ProtoReflect.Descriptor instead.
+func (*DeleteWebAuthnCredentialReq) Descriptor() ([]byte, []int) {
+	return file_api_v2_api_proto_rawDescGZIP(), []int{69}
 }
 
-func (x *RevokeRefreshReq) GetUserId() string {
+func (x *DeleteWebAuthnCredentialReq) GetUserId() string {
 	if x != nil {
 		return x.UserId
 	}
 	return ""
 }
 
-func (x *RevokeRefreshReq) GetClientId() string {
+func (x *DeleteWebAuthnCredentialReq) GetConnectorId() string {
 	if x != nil {
-		return x.ClientId
+		return x.ConnectorId
 	}
 	return ""
 }
 
-// RevokeRefreshResp determines if the refresh token is revoked successfully.
-type RevokeRefreshResp struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
+func (x *DeleteWebAuthnCredentialReq) GetCredentialId() []byte {
+	if x != nil {
+		return x.CredentialId
+	}
+	return nil
+}
 
-	// Set to true is refresh token was not found and token could not be revoked.
-	NotFound bool `protobuf:"varint,1,opt,name=not_found,json=notFound,proto3" json:"not_found,omitempty"`
+// DeleteWebAuthnCredentialResp returns the result of deleting a WebAuthn credential.
+type DeleteWebAuthnCredentialResp struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	NotFound      bool                   `protobuf:"varint,1,opt,name=not_found,json=notFound,proto3" json:"not_found,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
 }
 
-func (x *RevokeRefreshResp) Reset() {
-	*x = RevokeRefreshResp{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_api_v2_api_proto_msgTypes[22]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+func (x *DeleteWebAuthnCredentialResp) Reset() {
+	*x = DeleteWebAuthnCredentialResp{}
+	mi := &file_api_v2_api_proto_msgTypes[70]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
-func (x *RevokeRefreshResp) String() string {
+func (x *DeleteWebAuthnCredentialResp) String() string {
 	return protoimpl.X.MessageStringOf(x)
 }
 
-func (*RevokeRefreshResp) ProtoMessage() {}
+func (*DeleteWebAuthnCredentialResp) ProtoMessage() {}
 
-func (x *RevokeRefreshResp) ProtoReflect() protoreflect.Message {
-	mi := &file_api_v2_api_proto_msgTypes[22]
-	if protoimpl.UnsafeEnabled && x != nil {
+func (x *DeleteWebAuthnCredentialResp) ProtoReflect() protoreflect.Message {
+	mi := &file_api_v2_api_proto_msgTypes[70]
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -1272,45 +4081,45 @@ func (x *RevokeRefreshResp) ProtoReflect() protoreflect.Message {
 	return mi.MessageOf(x)
 }
 
-// Deprecated: Use RevokeRefreshResp.ProtoReflect.Descriptor instead.
-func (*RevokeRefreshResp) Descriptor() ([]byte, []int) {
-	return file_api_v2_api_proto_rawDescGZIP(), []int{22}
+// Deprecated: Use DeleteWebAuthnCredentialResp.ProtoReflect.Descriptor instead.
+func (*DeleteWebAuthnCredentialResp) Descriptor() ([]byte, []int) {
+	return file_api_v2_api_proto_rawDescGZIP(), []int{70}
 }
 
-func (x *RevokeRefreshResp) GetNotFound() bool {
+func (x *DeleteWebAuthnCredentialResp) GetNotFound() bool {
 	if x != nil {
 		return x.NotFound
 	}
 	return false
 }
 
-type VerifyPasswordReq struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-
-	Email    string `protobuf:"bytes,1,opt,name=email,proto3" json:"email,omitempty"`
-	Password string `protobuf:"bytes,2,opt,name=password,proto3" json:"password,omitempty"`
+// DeleteMFASecretReq is a request to delete a specific MFA authenticator secret.
+// Also removes any associated WebAuthn credentials for the same authenticator.
+type DeleteMFASecretReq struct {
+	state           protoimpl.MessageState `protogen:"open.v1"`
+	UserId          string                 `protobuf:"bytes,1,opt,name=user_id,json=userId,proto3" json:"user_id,omitempty"`
+	ConnectorId     string                 `protobuf:"bytes,2,opt,name=connector_id,json=connectorId,proto3" json:"connector_id,omitempty"`
+	AuthenticatorId string                 `protobuf:"bytes,3,opt,name=authenticator_id,json=authenticatorId,proto3" json:"authenticator_id,omitempty"`
+	unknownFields   protoimpl.UnknownFields
+	sizeCache       protoimpl.SizeCache
 }
 
-func (x *VerifyPasswordReq) Reset() {
-	*x = VerifyPasswordReq{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_api_v2_api_proto_msgTypes[23]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+func (x *DeleteMFASecretReq) Reset() {
+	*x = DeleteMFASecretReq{}
+	mi := &file_api_v2_api_proto_msgTypes[71]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
-func (x *VerifyPasswordReq) String() string {
+func (x *DeleteMFASecretReq) String() string {
 	return protoimpl.X.MessageStringOf(x)
 }
 
-func (*VerifyPasswordReq) ProtoMessage() {}
+func (*DeleteMFASecretReq) ProtoMessage() {}
 
-func (x *VerifyPasswordReq) ProtoReflect() protoreflect.Message {
-	mi := &file_api_v2_api_proto_msgTypes[23]
-	if protoimpl.UnsafeEnabled && x != nil {
+func (x *DeleteMFASecretReq) ProtoReflect() protoreflect.Message {
+	mi := &file_api_v2_api_proto_msgTypes[71]
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -1320,52 +4129,104 @@ func (x *VerifyPasswordReq) ProtoReflect() protoreflect.Message {
 	return mi.MessageOf(x)
 }
 
-// Deprecated: Use VerifyPasswordReq.ProtoReflect.Descriptor instead.
-func (*VerifyPasswordReq) Descriptor() ([]byte, []int) {
-	return file_api_v2_api_proto_rawDescGZIP(), []int{23}
+// Deprecated: Use DeleteMFASecretReq.ProtoReflect.Descriptor instead.
+func (*DeleteMFASecretReq) Descriptor() ([]byte, []int) {
+	return file_api_v2_api_proto_rawDescGZIP(), []int{71}
 }
 
-func (x *VerifyPasswordReq) GetEmail() string {
+func (x *DeleteMFASecretReq) GetUserId() string {
 	if x != nil {
-		return x.Email
+		return x.UserId
 	}
 	return ""
 }
 
-func (x *VerifyPasswordReq) GetPassword() string {
+func (x *DeleteMFASecretReq) GetConnectorId() string {
 	if x != nil {
-		return x.Password
+		return x.ConnectorId
 	}
 	return ""
 }
 
-type VerifyPasswordResp struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
+func (x *DeleteMFASecretReq) GetAuthenticatorId() string {
+	if x != nil {
+		return x.AuthenticatorId
+	}
+	return ""
+}
+
+// DeleteMFASecretResp returns the result of deleting an MFA secret.
+type DeleteMFASecretResp struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	NotFound      bool                   `protobuf:"varint,1,opt,name=not_found,json=notFound,proto3" json:"not_found,omitempty"`
 	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
 
-	Verified bool `protobuf:"varint,1,opt,name=verified,proto3" json:"verified,omitempty"`
-	NotFound bool `protobuf:"varint,2,opt,name=not_found,json=notFound,proto3" json:"not_found,omitempty"`
+func (x *DeleteMFASecretResp) Reset() {
+	*x = DeleteMFASecretResp{}
+	mi := &file_api_v2_api_proto_msgTypes[72]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
-func (x *VerifyPasswordResp) Reset() {
-	*x = VerifyPasswordResp{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_api_v2_api_proto_msgTypes[24]
+func (x *DeleteMFASecretResp) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*DeleteMFASecretResp) ProtoMessage() {}
+
+func (x *DeleteMFASecretResp) ProtoReflect() protoreflect.Message {
+	mi := &file_api_v2_api_proto_msgTypes[72]
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
 	}
+	return mi.MessageOf(x)
 }
 
-func (x *VerifyPasswordResp) String() string {
+// Deprecated: Use DeleteMFASecretResp.ProtoReflect.Descriptor instead.
+func (*DeleteMFASecretResp) Descriptor() ([]byte, []int) {
+	return file_api_v2_api_proto_rawDescGZIP(), []int{72}
+}
+
+func (x *DeleteMFASecretResp) GetNotFound() bool {
+	if x != nil {
+		return x.NotFound
+	}
+	return false
+}
+
+// RevokeConsentReq is a request to revoke consent for a specific client.
+// The user will see the consent screen again on next authorization.
+type RevokeConsentReq struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	UserId        string                 `protobuf:"bytes,1,opt,name=user_id,json=userId,proto3" json:"user_id,omitempty"`
+	ConnectorId   string                 `protobuf:"bytes,2,opt,name=connector_id,json=connectorId,proto3" json:"connector_id,omitempty"`
+	ClientId      string                 `protobuf:"bytes,3,opt,name=client_id,json=clientId,proto3" json:"client_id,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *RevokeConsentReq) Reset() {
+	*x = RevokeConsentReq{}
+	mi := &file_api_v2_api_proto_msgTypes[73]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *RevokeConsentReq) String() string {
 	return protoimpl.X.MessageStringOf(x)
 }
 
-func (*VerifyPasswordResp) ProtoMessage() {}
+func (*RevokeConsentReq) ProtoMessage() {}
 
-func (x *VerifyPasswordResp) ProtoReflect() protoreflect.Message {
-	mi := &file_api_v2_api_proto_msgTypes[24]
-	if protoimpl.UnsafeEnabled && x != nil {
+func (x *RevokeConsentReq) ProtoReflect() protoreflect.Message {
+	mi := &file_api_v2_api_proto_msgTypes[73]
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -1375,19 +4236,71 @@ func (x *VerifyPasswordResp) ProtoReflect() protoreflect.Message {
 	return mi.MessageOf(x)
 }
 
-// Deprecated: Use VerifyPasswordResp.ProtoReflect.Descriptor instead.
-func (*VerifyPasswordResp) Descriptor() ([]byte, []int) {
-	return file_api_v2_api_proto_rawDescGZIP(), []int{24}
+// Deprecated: Use RevokeConsentReq.ProtoReflect.Descriptor instead.
+func (*RevokeConsentReq) Descriptor() ([]byte, []int) {
+	return file_api_v2_api_proto_rawDescGZIP(), []int{73}
 }
 
-func (x *VerifyPasswordResp) GetVerified() bool {
+func (x *RevokeConsentReq) GetUserId() string {
 	if x != nil {
-		return x.Verified
+		return x.UserId
 	}
-	return false
+	return ""
 }
 
-func (x *VerifyPasswordResp) GetNotFound() bool {
+func (x *RevokeConsentReq) GetConnectorId() string {
+	if x != nil {
+		return x.ConnectorId
+	}
+	return ""
+}
+
+func (x *RevokeConsentReq) GetClientId() string {
+	if x != nil {
+		return x.ClientId
+	}
+	return ""
+}
+
+// RevokeConsentResp returns the result of revoking consent.
+type RevokeConsentResp struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	NotFound      bool                   `protobuf:"varint,1,opt,name=not_found,json=notFound,proto3" json:"not_found,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *RevokeConsentResp) Reset() {
+	*x = RevokeConsentResp{}
+	mi := &file_api_v2_api_proto_msgTypes[74]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *RevokeConsentResp) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*RevokeConsentResp) ProtoMessage() {}
+
+func (x *RevokeConsentResp) ProtoReflect() protoreflect.Message {
+	mi := &file_api_v2_api_proto_msgTypes[74]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use RevokeConsentResp.ProtoReflect.Descriptor instead.
+func (*RevokeConsentResp) Descriptor() ([]byte, []int) {
+	return file_api_v2_api_proto_rawDescGZIP(), []int{74}
+}
+
+func (x *RevokeConsentResp) GetNotFound() bool {
 	if x != nil {
 		return x.NotFound
 	}
@@ -1396,9 +4309,9 @@ func (x *VerifyPasswordResp) GetNotFound() bool {
 
 var File_api_v2_api_proto protoreflect.FileDescriptor
 
-var file_api_v2_api_proto_rawDesc = []byte{
+var file_api_v2_api_proto_rawDesc = string([]byte{
 	0x0a, 0x10, 0x61, 0x70, 0x69, 0x2f, 0x76, 0x32, 0x2f, 0x61, 0x70, 0x69, 0x2e, 0x70, 0x72, 0x6f,
-	0x74, 0x6f, 0x12, 0x03, 0x61, 0x70, 0x69, 0x22, 0xc1, 0x01, 0x0a, 0x06, 0x43, 0x6c, 0x69, 0x65,
+	0x74, 0x6f, 0x12, 0x03, 0x61, 0x70, 0x69, 0x22, 0xbf, 0x03, 0x0a, 0x06, 0x43, 0x6c, 0x69, 0x65,
 	0x6e, 0x74, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02,
 	0x69, 0x64, 0x12, 0x16, 0x0a, 0x06, 0x73, 0x65, 0x63, 0x72, 0x65, 0x74, 0x18, 0x02, 0x20, 0x01,
 	0x28, 0x09, 0x52, 0x06, 0x73, 0x65, 0x63, 0x72, 0x65, 0x74, 0x12, 0x23, 0x0a, 0x0d, 0x72, 0x65,
@@ -1410,231 +4323,818 @@ var file_api_v2_api_proto_rawDesc = []byte{
 	0x20, 0x01, 0x28, 0x08, 0x52, 0x06, 0x70, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x12, 0x12, 0x0a, 0x04,
 	0x6e, 0x61, 0x6d, 0x65, 0x18, 0x06, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x6e, 0x61, 0x6d, 0x65,
 	0x12, 0x19, 0x0a, 0x08, 0x6c, 0x6f, 0x67, 0x6f, 0x5f, 0x75, 0x72, 0x6c, 0x18, 0x07, 0x20, 0x01,
-	0x28, 0x09, 0x52, 0x07, 0x6c, 0x6f, 0x67, 0x6f, 0x55, 0x72, 0x6c, 0x22, 0x36, 0x0a, 0x0f, 0x43,
-	0x72, 0x65, 0x61, 0x74, 0x65, 0x43, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x52, 0x65, 0x71, 0x12, 0x23,
-	0x0a, 0x06, 0x63, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x0b,
-	0x2e, 0x61, 0x70, 0x69, 0x2e, 0x43, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x52, 0x06, 0x63, 0x6c, 0x69,
-	0x65, 0x6e, 0x74, 0x22, 0x5e, 0x0a, 0x10, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x43, 0x6c, 0x69,
-	0x65, 0x6e, 0x74, 0x52, 0x65, 0x73, 0x70, 0x12, 0x25, 0x0a, 0x0e, 0x61, 0x6c, 0x72, 0x65, 0x61,
-	0x64, 0x79, 0x5f, 0x65, 0x78, 0x69, 0x73, 0x74, 0x73, 0x18, 0x01, 0x20, 0x01, 0x28, 0x08, 0x52,
-	0x0d, 0x61, 0x6c, 0x72, 0x65, 0x61, 0x64, 0x79, 0x45, 0x78, 0x69, 0x73, 0x74, 0x73, 0x12, 0x23,
-	0x0a, 0x06, 0x63, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x0b,
-	0x2e, 0x61, 0x70, 0x69, 0x2e, 0x43, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x52, 0x06, 0x63, 0x6c, 0x69,
-	0x65, 0x6e, 0x74, 0x22, 0x21, 0x0a, 0x0f, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x43, 0x6c, 0x69,
-	0x65, 0x6e, 0x74, 0x52, 0x65, 0x71, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01,
-	0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x22, 0x2f, 0x0a, 0x10, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65,
-	0x43, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x52, 0x65, 0x73, 0x70, 0x12, 0x1b, 0x0a, 0x09, 0x6e, 0x6f,
-	0x74, 0x5f, 0x66, 0x6f, 0x75, 0x6e, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x08, 0x52, 0x08, 0x6e,
-	0x6f, 0x74, 0x46, 0x6f, 0x75, 0x6e, 0x64, 0x22, 0x9a, 0x01, 0x0a, 0x0f, 0x55, 0x70, 0x64, 0x61,
-	0x74, 0x65, 0x43, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x52, 0x65, 0x71, 0x12, 0x0e, 0x0a, 0x02, 0x69,
-	0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x12, 0x23, 0x0a, 0x0d, 0x72,
-	0x65, 0x64, 0x69, 0x72, 0x65, 0x63, 0x74, 0x5f, 0x75, 0x72, 0x69, 0x73, 0x18, 0x02, 0x20, 0x03,
-	0x28, 0x09, 0x52, 0x0c, 0x72, 0x65, 0x64, 0x69, 0x72, 0x65, 0x63, 0x74, 0x55, 0x72, 0x69, 0x73,
-	0x12, 0x23, 0x0a, 0x0d, 0x74, 0x72, 0x75, 0x73, 0x74, 0x65, 0x64, 0x5f, 0x70, 0x65, 0x65, 0x72,
-	0x73, 0x18, 0x03, 0x20, 0x03, 0x28, 0x09, 0x52, 0x0c, 0x74, 0x72, 0x75, 0x73, 0x74, 0x65, 0x64,
-	0x50, 0x65, 0x65, 0x72, 0x73, 0x12, 0x12, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x04, 0x20,
-	0x01, 0x28, 0x09, 0x52, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x19, 0x0a, 0x08, 0x6c, 0x6f, 0x67,
-	0x6f, 0x5f, 0x75, 0x72, 0x6c, 0x18, 0x05, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x6c, 0x6f, 0x67,
-	0x6f, 0x55, 0x72, 0x6c, 0x22, 0x2f, 0x0a, 0x10, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x43, 0x6c,
+	0x28, 0x09, 0x52, 0x07, 0x6c, 0x6f, 0x67, 0x6f, 0x55, 0x72, 0x6c, 0x12, 0x2d, 0x0a, 0x12, 0x61,
+	0x6c, 0x6c, 0x6f, 0x77, 0x65, 0x64, 0x5f, 0x63, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x6f, 0x72,
+	0x73, 0x18, 0x08, 0x20, 0x03, 0x28, 0x09, 0x52, 0x11, 0x61, 0x6c, 0x6c, 0x6f, 0x77, 0x65, 0x64,
+	0x43, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x6f, 0x72, 0x73, 0x12, 0x26, 0x0a, 0x0f, 0x73, 0x73,
+	0x6f, 0x5f, 0x73, 0x68, 0x61, 0x72, 0x65, 0x64, 0x5f, 0x77, 0x69, 0x74, 0x68, 0x18, 0x09, 0x20,
+	0x03, 0x28, 0x09, 0x52, 0x0d, 0x73, 0x73, 0x6f, 0x53, 0x68, 0x61, 0x72, 0x65, 0x64, 0x57, 0x69,
+	0x74, 0x68, 0x12, 0x34, 0x0a, 0x16, 0x62, 0x61, 0x63, 0x6b, 0x63, 0x68, 0x61, 0x6e, 0x6e, 0x65,
+	0x6c, 0x5f, 0x6c, 0x6f, 0x67, 0x6f, 0x75, 0x74, 0x5f, 0x75, 0x72, 0x69, 0x18, 0x0a, 0x20, 0x01,
+	0x28, 0x09, 0x52, 0x14, 0x62, 0x61, 0x63, 0x6b, 0x63, 0x68, 0x61, 0x6e, 0x6e, 0x65, 0x6c, 0x4c,
+	0x6f, 0x67, 0x6f, 0x75, 0x74, 0x55, 0x72, 0x69, 0x12, 0x39, 0x0a, 0x19, 0x70, 0x6f, 0x73, 0x74,
+	0x5f, 0x6c, 0x6f, 0x67, 0x6f, 0x75, 0x74, 0x5f, 0x72, 0x65, 0x64, 0x69, 0x72, 0x65, 0x63, 0x74,
+	0x5f, 0x75, 0x72, 0x69, 0x73, 0x18, 0x0b, 0x20, 0x03, 0x28, 0x09, 0x52, 0x16, 0x70, 0x6f, 0x73,
+	0x74, 0x4c, 0x6f, 0x67, 0x6f, 0x75, 0x74, 0x52, 0x65, 0x64, 0x69, 0x72, 0x65, 0x63, 0x74, 0x55,
+	0x72, 0x69, 0x73, 0x12, 0x34, 0x0a, 0x16, 0x72, 0x65, 0x66, 0x72, 0x65, 0x73, 0x68, 0x5f, 0x74,
+	0x6f, 0x6b, 0x65, 0x6e, 0x5f, 0x6c, 0x69, 0x66, 0x65, 0x74, 0x69, 0x6d, 0x65, 0x18, 0x0c, 0x20,
+	0x01, 0x28, 0x09, 0x52, 0x14, 0x72, 0x65, 0x66, 0x72, 0x65, 0x73, 0x68, 0x54, 0x6f, 0x6b, 0x65,
+	0x6e, 0x4c, 0x69, 0x66, 0x65, 0x74, 0x69, 0x6d, 0x65, 0x22, 0xab, 0x03, 0x0a, 0x0a, 0x43, 0x6c,
+	0x69, 0x65, 0x6e, 0x74, 0x49, 0x6e, 0x66, 0x6f, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01,
+	0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x12, 0x23, 0x0a, 0x0d, 0x72, 0x65, 0x64, 0x69,
+	0x72, 0x65, 0x63, 0x74, 0x5f, 0x75, 0x72, 0x69, 0x73, 0x18, 0x02, 0x20, 0x03, 0x28, 0x09, 0x52,
+	0x0c, 0x72, 0x65, 0x64, 0x69, 0x72, 0x65, 0x63, 0x74, 0x55, 0x72, 0x69, 0x73, 0x12, 0x23, 0x0a,
+	0x0d, 0x74, 0x72, 0x75, 0x73, 0x74, 0x65, 0x64, 0x5f, 0x70, 0x65, 0x65, 0x72, 0x73, 0x18, 0x03,
+	0x20, 0x03, 0x28, 0x09, 0x52, 0x0c, 0x74, 0x72, 0x75, 0x73, 0x74, 0x65, 0x64, 0x50, 0x65, 0x65,
+	0x72, 0x73, 0x12, 0x16, 0x0a, 0x06, 0x70, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x18, 0x04, 0x20, 0x01,
+	0x28, 0x08, 0x52, 0x06, 0x70, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x12, 0x12, 0x0a, 0x04, 0x6e, 0x61,
+	0x6d, 0x65, 0x18, 0x05, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x19,
+	0x0a, 0x08, 0x6c, 0x6f, 0x67, 0x6f, 0x5f, 0x75, 0x72, 0x6c, 0x18, 0x06, 0x20, 0x01, 0x28, 0x09,
+	0x52, 0x07, 0x6c, 0x6f, 0x67, 0x6f, 0x55, 0x72, 0x6c, 0x12, 0x2d, 0x0a, 0x12, 0x61, 0x6c, 0x6c,
+	0x6f, 0x77, 0x65, 0x64, 0x5f, 0x63, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x6f, 0x72, 0x73, 0x18,
+	0x07, 0x20, 0x03, 0x28, 0x09, 0x52, 0x11, 0x61, 0x6c, 0x6c, 0x6f, 0x77, 0x65, 0x64, 0x43, 0x6f,
+	0x6e, 0x6e, 0x65, 0x63, 0x74, 0x6f, 0x72, 0x73, 0x12, 0x26, 0x0a, 0x0f, 0x73, 0x73, 0x6f, 0x5f,
+	0x73, 0x68, 0x61, 0x72, 0x65, 0x64, 0x5f, 0x77, 0x69, 0x74, 0x68, 0x18, 0x08, 0x20, 0x03, 0x28,
+	0x09, 0x52, 0x0d, 0x73, 0x73, 0x6f, 0x53, 0x68, 0x61, 0x72, 0x65, 0x64, 0x57, 0x69, 0x74, 0x68,
+	0x12, 0x34, 0x0a, 0x16, 0x62, 0x61, 0x63, 0x6b, 0x63, 0x68, 0x61, 0x6e, 0x6e, 0x65, 0x6c, 0x5f,
+	0x6c, 0x6f, 0x67, 0x6f, 0x75, 0x74, 0x5f, 0x75, 0x72, 0x69, 0x18, 0x09, 0x20, 0x01, 0x28, 0x09,
+	0x52, 0x14, 0x62, 0x61, 0x63, 0x6b, 0x63, 0x68, 0x61, 0x6e, 0x6e, 0x65, 0x6c, 0x4c, 0x6f, 0x67,
+	0x6f, 0x75, 0x74, 0x55, 0x72, 0x69, 0x12, 0x39, 0x0a, 0x19, 0x70, 0x6f, 0x73, 0x74, 0x5f, 0x6c,
+	0x6f, 0x67, 0x6f, 0x75, 0x74, 0x5f, 0x72, 0x65, 0x64, 0x69, 0x72, 0x65, 0x63, 0x74, 0x5f, 0x75,
+	0x72, 0x69, 0x73, 0x18, 0x0a, 0x20, 0x03, 0x28, 0x09, 0x52, 0x16, 0x70, 0x6f, 0x73, 0x74, 0x4c,
+	0x6f, 0x67, 0x6f, 0x75, 0x74, 0x52, 0x65, 0x64, 0x69, 0x72, 0x65, 0x63, 0x74, 0x55, 0x72, 0x69,
+	0x73, 0x12, 0x34, 0x0a, 0x16, 0x72, 0x65, 0x66, 0x72, 0x65, 0x73, 0x68, 0x5f, 0x74, 0x6f, 0x6b,
+	0x65, 0x6e, 0x5f, 0x6c, 0x69, 0x66, 0x65, 0x74, 0x69, 0x6d, 0x65, 0x18, 0x0b, 0x20, 0x01, 0x28,
+	0x09, 0x52, 0x14, 0x72, 0x65, 0x66, 0x72, 0x65, 0x73, 0x68, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x4c,
+	0x69, 0x66, 0x65, 0x74, 0x69, 0x6d, 0x65, 0x22, 0x1e, 0x0a, 0x0c, 0x47, 0x65, 0x74, 0x43, 0x6c,
+	0x69, 0x65, 0x6e, 0x74, 0x52, 0x65, 0x71, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20,
+	0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x22, 0x34, 0x0a, 0x0d, 0x47, 0x65, 0x74, 0x43, 0x6c,
+	0x69, 0x65, 0x6e, 0x74, 0x52, 0x65, 0x73, 0x70, 0x12, 0x23, 0x0a, 0x06, 0x63, 0x6c, 0x69, 0x65,
+	0x6e, 0x74, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x0b, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x43,
+	0x6c, 0x69, 0x65, 0x6e, 0x74, 0x52, 0x06, 0x63, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x22, 0x36, 0x0a,
+	0x0f, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x43, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x52, 0x65, 0x71,
+	0x12, 0x23, 0x0a, 0x06, 0x63, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b,
+	0x32, 0x0b, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x43, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x52, 0x06, 0x63,
+	0x6c, 0x69, 0x65, 0x6e, 0x74, 0x22, 0x5e, 0x0a, 0x10, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x43,
+	0x6c, 0x69, 0x65, 0x6e, 0x74, 0x52, 0x65, 0x73, 0x70, 0x12, 0x25, 0x0a, 0x0e, 0x61, 0x6c, 0x72,
+	0x65, 0x61, 0x64, 0x79, 0x5f, 0x65, 0x78, 0x69, 0x73, 0x74, 0x73, 0x18, 0x01, 0x20, 0x01, 0x28,
+	0x08, 0x52, 0x0d, 0x61, 0x6c, 0x72, 0x65, 0x61, 0x64, 0x79, 0x45, 0x78, 0x69, 0x73, 0x74, 0x73,
+	0x12, 0x23, 0x0a, 0x06, 0x63, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b,
+	0x32, 0x0b, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x43, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x52, 0x06, 0x63,
+	0x6c, 0x69, 0x65, 0x6e, 0x74, 0x22, 0x21, 0x0a, 0x0f, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x43,
+	0x6c, 0x69, 0x65, 0x6e, 0x74, 0x52, 0x65, 0x71, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01,
+	0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x22, 0x2f, 0x0a, 0x10, 0x44, 0x65, 0x6c, 0x65,
+	0x74, 0x65, 0x43, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x52, 0x65, 0x73, 0x70, 0x12, 0x1b, 0x0a, 0x09,
+	0x6e, 0x6f, 0x74, 0x5f, 0x66, 0x6f, 0x75, 0x6e, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x08, 0x52,
+	0x08, 0x6e, 0x6f, 0x74, 0x46, 0x6f, 0x75, 0x6e, 0x64, 0x22, 0xd8, 0x03, 0x0a, 0x0f, 0x55, 0x70,
+	0x64, 0x61, 0x74, 0x65, 0x43, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x52, 0x65, 0x71, 0x12, 0x0e, 0x0a,
+	0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x12, 0x23, 0x0a,
+	0x0d, 0x72, 0x65, 0x64, 0x69, 0x72, 0x65, 0x63, 0x74, 0x5f, 0x75, 0x72, 0x69, 0x73, 0x18, 0x02,
+	0x20, 0x03, 0x28, 0x09, 0x52, 0x0c, 0x72, 0x65, 0x64, 0x69, 0x72, 0x65, 0x63, 0x74, 0x55, 0x72,
+	0x69, 0x73, 0x12, 0x23, 0x0a, 0x0d, 0x74, 0x72, 0x75, 0x73, 0x74, 0x65, 0x64, 0x5f, 0x70, 0x65,
+	0x65, 0x72, 0x73, 0x18, 0x03, 0x20, 0x03, 0x28, 0x09, 0x52, 0x0c, 0x74, 0x72, 0x75, 0x73, 0x74,
+	0x65, 0x64, 0x50, 0x65, 0x65, 0x72, 0x73, 0x12, 0x12, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18,
+	0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x19, 0x0a, 0x08, 0x6c,
+	0x6f, 0x67, 0x6f, 0x5f, 0x75, 0x72, 0x6c, 0x18, 0x05, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x6c,
+	0x6f, 0x67, 0x6f, 0x55, 0x72, 0x6c, 0x12, 0x2d, 0x0a, 0x12, 0x61, 0x6c, 0x6c, 0x6f, 0x77, 0x65,
+	0x64, 0x5f, 0x63, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x6f, 0x72, 0x73, 0x18, 0x06, 0x20, 0x03,
+	0x28, 0x09, 0x52, 0x11, 0x61, 0x6c, 0x6c, 0x6f, 0x77, 0x65, 0x64, 0x43, 0x6f, 0x6e, 0x6e, 0x65,
+	0x63, 0x74, 0x6f, 0x72, 0x73, 0x12, 0x26, 0x0a, 0x0f, 0x73, 0x73, 0x6f, 0x5f, 0x73, 0x68, 0x61,
+	0x72, 0x65, 0x64, 0x5f, 0x77, 0x69, 0x74, 0x68, 0x18, 0x07, 0x20, 0x03, 0x28, 0x09, 0x52, 0x0d,
+	0x73, 0x73, 0x6f, 0x53, 0x68, 0x61, 0x72, 0x65, 0x64, 0x57, 0x69, 0x74, 0x68, 0x12, 0x39, 0x0a,
+	0x16, 0x62, 0x61, 0x63, 0x6b, 0x63, 0x68, 0x61, 0x6e, 0x6e, 0x65, 0x6c, 0x5f, 0x6c, 0x6f, 0x67,
+	0x6f, 0x75, 0x74, 0x5f, 0x75, 0x72, 0x69, 0x18, 0x08, 0x20, 0x01, 0x28, 0x09, 0x48, 0x00, 0x52,
+	0x14, 0x62, 0x61, 0x63, 0x6b, 0x63, 0x68, 0x61, 0x6e, 0x6e, 0x65, 0x6c, 0x4c, 0x6f, 0x67, 0x6f,
+	0x75, 0x74, 0x55, 0x72, 0x69, 0x88, 0x01, 0x01, 0x12, 0x39, 0x0a, 0x19, 0x70, 0x6f, 0x73, 0x74,
+	0x5f, 0x6c, 0x6f, 0x67, 0x6f, 0x75, 0x74, 0x5f, 0x72, 0x65, 0x64, 0x69, 0x72, 0x65, 0x63, 0x74,
+	0x5f, 0x75, 0x72, 0x69, 0x73, 0x18, 0x09, 0x20, 0x03, 0x28, 0x09, 0x52, 0x16, 0x70, 0x6f, 0x73,
+	0x74, 0x4c, 0x6f, 0x67, 0x6f, 0x75, 0x74, 0x52, 0x65, 0x64, 0x69, 0x72, 0x65, 0x63, 0x74, 0x55,
+	0x72, 0x69, 0x73, 0x12, 0x39, 0x0a, 0x16, 0x72, 0x65, 0x66, 0x72, 0x65, 0x73, 0x68, 0x5f, 0x74,
+	0x6f, 0x6b, 0x65, 0x6e, 0x5f, 0x6c, 0x69, 0x66, 0x65, 0x74, 0x69, 0x6d, 0x65, 0x18, 0x0a, 0x20,
+	0x01, 0x28, 0x09, 0x48, 0x01, 0x52, 0x14, 0x72, 0x65, 0x66, 0x72, 0x65, 0x73, 0x68, 0x54, 0x6f,
+	0x6b, 0x65, 0x6e, 0x4c, 0x69, 0x66, 0x65, 0x74, 0x69, 0x6d, 0x65, 0x88, 0x01, 0x01, 0x42, 0x19,
+	0x0a, 0x17, 0x5f, 0x62, 0x61, 0x63, 0x6b, 0x63, 0x68, 0x61, 0x6e, 0x6e, 0x65, 0x6c, 0x5f, 0x6c,
+	0x6f, 0x67, 0x6f, 0x75, 0x74, 0x5f, 0x75, 0x72, 0x69, 0x42, 0x19, 0x0a, 0x17, 0x5f, 0x72, 0x65,
+	0x66, 0x72, 0x65, 0x73, 0x68, 0x5f, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x5f, 0x6c, 0x69, 0x66, 0x65,
+	0x74, 0x69, 0x6d, 0x65, 0x22, 0x2f, 0x0a, 0x10, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x43, 0x6c,
 	0x69, 0x65, 0x6e, 0x74, 0x52, 0x65, 0x73, 0x70, 0x12, 0x1b, 0x0a, 0x09, 0x6e, 0x6f, 0x74, 0x5f,
 	0x66, 0x6f, 0x75, 0x6e, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x08, 0x52, 0x08, 0x6e, 0x6f, 0x74,
-	0x46, 0x6f, 0x75, 0x6e, 0x64, 0x22, 0x69, 0x0a, 0x08, 0x50, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72,
-	0x64, 0x12, 0x14, 0x0a, 0x05, 0x65, 0x6d, 0x61, 0x69, 0x6c, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09,
-	0x52, 0x05, 0x65, 0x6d, 0x61, 0x69, 0x6c, 0x12, 0x12, 0x0a, 0x04, 0x68, 0x61, 0x73, 0x68, 0x18,
-	0x02, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x04, 0x68, 0x61, 0x73, 0x68, 0x12, 0x1a, 0x0a, 0x08, 0x75,
-	0x73, 0x65, 0x72, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x75,
-	0x73, 0x65, 0x72, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x17, 0x0a, 0x07, 0x75, 0x73, 0x65, 0x72, 0x5f,
-	0x69, 0x64, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x75, 0x73, 0x65, 0x72, 0x49, 0x64,
-	0x22, 0x3e, 0x0a, 0x11, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x50, 0x61, 0x73, 0x73, 0x77, 0x6f,
-	0x72, 0x64, 0x52, 0x65, 0x71, 0x12, 0x29, 0x0a, 0x08, 0x70, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72,
-	0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x0d, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x50, 0x61,
-	0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x52, 0x08, 0x70, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64,
-	0x22, 0x3b, 0x0a, 0x12, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x50, 0x61, 0x73, 0x73, 0x77, 0x6f,
-	0x72, 0x64, 0x52, 0x65, 0x73, 0x70, 0x12, 0x25, 0x0a, 0x0e, 0x61, 0x6c, 0x72, 0x65, 0x61, 0x64,
-	0x79, 0x5f, 0x65, 0x78, 0x69, 0x73, 0x74, 0x73, 0x18, 0x01, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0d,
-	0x61, 0x6c, 0x72, 0x65, 0x61, 0x64, 0x79, 0x45, 0x78, 0x69, 0x73, 0x74, 0x73, 0x22, 0x67, 0x0a,
-	0x11, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x50, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x52,
-	0x65, 0x71, 0x12, 0x14, 0x0a, 0x05, 0x65, 0x6d, 0x61, 0x69, 0x6c, 0x18, 0x01, 0x20, 0x01, 0x28,
-	0x09, 0x52, 0x05, 0x65, 0x6d, 0x61, 0x69, 0x6c, 0x12, 0x19, 0x0a, 0x08, 0x6e, 0x65, 0x77, 0x5f,
-	0x68, 0x61, 0x73, 0x68, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x07, 0x6e, 0x65, 0x77, 0x48,
-	0x61, 0x73, 0x68, 0x12, 0x21, 0x0a, 0x0c, 0x6e, 0x65, 0x77, 0x5f, 0x75, 0x73, 0x65, 0x72, 0x6e,
-	0x61, 0x6d, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x6e, 0x65, 0x77, 0x55, 0x73,
-	0x65, 0x72, 0x6e, 0x61, 0x6d, 0x65, 0x22, 0x31, 0x0a, 0x12, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65,
-	0x50, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x52, 0x65, 0x73, 0x70, 0x12, 0x1b, 0x0a, 0x09,
-	0x6e, 0x6f, 0x74, 0x5f, 0x66, 0x6f, 0x75, 0x6e, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x08, 0x52,
-	0x08, 0x6e, 0x6f, 0x74, 0x46, 0x6f, 0x75, 0x6e, 0x64, 0x22, 0x29, 0x0a, 0x11, 0x44, 0x65, 0x6c,
-	0x65, 0x74, 0x65, 0x50, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x52, 0x65, 0x71, 0x12, 0x14,
-	0x0a, 0x05, 0x65, 0x6d, 0x61, 0x69, 0x6c, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x65,
-	0x6d, 0x61, 0x69, 0x6c, 0x22, 0x31, 0x0a, 0x12, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x50, 0x61,
+	0x46, 0x6f, 0x75, 0x6e, 0x64, 0x22, 0x0f, 0x0a, 0x0d, 0x4c, 0x69, 0x73, 0x74, 0x43, 0x6c, 0x69,
+	0x65, 0x6e, 0x74, 0x52, 0x65, 0x71, 0x22, 0x3b, 0x0a, 0x0e, 0x4c, 0x69, 0x73, 0x74, 0x43, 0x6c,
+	0x69, 0x65, 0x6e, 0x74, 0x52, 0x65, 0x73, 0x70, 0x12, 0x29, 0x0a, 0x07, 0x63, 0x6c, 0x69, 0x65,
+	0x6e, 0x74, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x0f, 0x2e, 0x61, 0x70, 0x69, 0x2e,
+	0x43, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x49, 0x6e, 0x66, 0x6f, 0x52, 0x07, 0x63, 0x6c, 0x69, 0x65,
+	0x6e, 0x74, 0x73, 0x22, 0x69, 0x0a, 0x08, 0x50, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x12,
+	0x14, 0x0a, 0x05, 0x65, 0x6d, 0x61, 0x69, 0x6c, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05,
+	0x65, 0x6d, 0x61, 0x69, 0x6c, 0x12, 0x12, 0x0a, 0x04, 0x68, 0x61, 0x73, 0x68, 0x18, 0x02, 0x20,
+	0x01, 0x28, 0x0c, 0x52, 0x04, 0x68, 0x61, 0x73, 0x68, 0x12, 0x1a, 0x0a, 0x08, 0x75, 0x73, 0x65,
+	0x72, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x75, 0x73, 0x65,
+	0x72, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x17, 0x0a, 0x07, 0x75, 0x73, 0x65, 0x72, 0x5f, 0x69, 0x64,
+	0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x75, 0x73, 0x65, 0x72, 0x49, 0x64, 0x22, 0x3e,
+	0x0a, 0x11, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x50, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64,
+	0x52, 0x65, 0x71, 0x12, 0x29, 0x0a, 0x08, 0x70, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x18,
+	0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x0d, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x50, 0x61, 0x73, 0x73,
+	0x77, 0x6f, 0x72, 0x64, 0x52, 0x08, 0x70, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x22, 0x3b,
+	0x0a, 0x12, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x50, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64,
+	0x52, 0x65, 0x73, 0x70, 0x12, 0x25, 0x0a, 0x0e, 0x61, 0x6c, 0x72, 0x65, 0x61, 0x64, 0x79, 0x5f,
+	0x65, 0x78, 0x69, 0x73, 0x74, 0x73, 0x18, 0x01, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0d, 0x61, 0x6c,
+	0x72, 0x65, 0x61, 0x64, 0x79, 0x45, 0x78, 0x69, 0x73, 0x74, 0x73, 0x22, 0x67, 0x0a, 0x11, 0x55,
+	0x70, 0x64, 0x61, 0x74, 0x65, 0x50, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x52, 0x65, 0x71,
+	0x12, 0x14, 0x0a, 0x05, 0x65, 0x6d, 0x61, 0x69, 0x6c, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52,
+	0x05, 0x65, 0x6d, 0x61, 0x69, 0x6c, 0x12, 0x19, 0x0a, 0x08, 0x6e, 0x65, 0x77, 0x5f, 0x68, 0x61,
+	0x73, 0x68, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x07, 0x6e, 0x65, 0x77, 0x48, 0x61, 0x73,
+	0x68, 0x12, 0x21, 0x0a, 0x0c, 0x6e, 0x65, 0x77, 0x5f, 0x75, 0x73, 0x65, 0x72, 0x6e, 0x61, 0x6d,
+	0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x6e, 0x65, 0x77, 0x55, 0x73, 0x65, 0x72,
+	0x6e, 0x61, 0x6d, 0x65, 0x22, 0x31, 0x0a, 0x12, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x50, 0x61,
 	0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x52, 0x65, 0x73, 0x70, 0x12, 0x1b, 0x0a, 0x09, 0x6e, 0x6f,
 	0x74, 0x5f, 0x66, 0x6f, 0x75, 0x6e, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x08, 0x52, 0x08, 0x6e,
-	0x6f, 0x74, 0x46, 0x6f, 0x75, 0x6e, 0x64, 0x22, 0x11, 0x0a, 0x0f, 0x4c, 0x69, 0x73, 0x74, 0x50,
-	0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x52, 0x65, 0x71, 0x22, 0x3f, 0x0a, 0x10, 0x4c, 0x69,
-	0x73, 0x74, 0x50, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x52, 0x65, 0x73, 0x70, 0x12, 0x2b,
-	0x0a, 0x09, 0x70, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28,
-	0x0b, 0x32, 0x0d, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x50, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64,
-	0x52, 0x09, 0x70, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x73, 0x22, 0x0c, 0x0a, 0x0a, 0x56,
-	0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x71, 0x22, 0x37, 0x0a, 0x0b, 0x56, 0x65, 0x72,
-	0x73, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x73, 0x70, 0x12, 0x16, 0x0a, 0x06, 0x73, 0x65, 0x72, 0x76,
-	0x65, 0x72, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72,
-	0x12, 0x10, 0x0a, 0x03, 0x61, 0x70, 0x69, 0x18, 0x02, 0x20, 0x01, 0x28, 0x05, 0x52, 0x03, 0x61,
-	0x70, 0x69, 0x22, 0x7a, 0x0a, 0x0f, 0x52, 0x65, 0x66, 0x72, 0x65, 0x73, 0x68, 0x54, 0x6f, 0x6b,
-	0x65, 0x6e, 0x52, 0x65, 0x66, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28,
-	0x09, 0x52, 0x02, 0x69, 0x64, 0x12, 0x1b, 0x0a, 0x09, 0x63, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x5f,
-	0x69, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x63, 0x6c, 0x69, 0x65, 0x6e, 0x74,
-	0x49, 0x64, 0x12, 0x1d, 0x0a, 0x0a, 0x63, 0x72, 0x65, 0x61, 0x74, 0x65, 0x64, 0x5f, 0x61, 0x74,
-	0x18, 0x05, 0x20, 0x01, 0x28, 0x03, 0x52, 0x09, 0x63, 0x72, 0x65, 0x61, 0x74, 0x65, 0x64, 0x41,
-	0x74, 0x12, 0x1b, 0x0a, 0x09, 0x6c, 0x61, 0x73, 0x74, 0x5f, 0x75, 0x73, 0x65, 0x64, 0x18, 0x06,
-	0x20, 0x01, 0x28, 0x03, 0x52, 0x08, 0x6c, 0x61, 0x73, 0x74, 0x55, 0x73, 0x65, 0x64, 0x22, 0x29,
-	0x0a, 0x0e, 0x4c, 0x69, 0x73, 0x74, 0x52, 0x65, 0x66, 0x72, 0x65, 0x73, 0x68, 0x52, 0x65, 0x71,
-	0x12, 0x17, 0x0a, 0x07, 0x75, 0x73, 0x65, 0x72, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28,
-	0x09, 0x52, 0x06, 0x75, 0x73, 0x65, 0x72, 0x49, 0x64, 0x22, 0x4e, 0x0a, 0x0f, 0x4c, 0x69, 0x73,
-	0x74, 0x52, 0x65, 0x66, 0x72, 0x65, 0x73, 0x68, 0x52, 0x65, 0x73, 0x70, 0x12, 0x3b, 0x0a, 0x0e,
-	0x72, 0x65, 0x66, 0x72, 0x65, 0x73, 0x68, 0x5f, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x73, 0x18, 0x01,
-	0x20, 0x03, 0x28, 0x0b, 0x32, 0x14, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x52, 0x65, 0x66, 0x72, 0x65,
-	0x73, 0x68, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x52, 0x65, 0x66, 0x52, 0x0d, 0x72, 0x65, 0x66, 0x72,
-	0x65, 0x73, 0x68, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x73, 0x22, 0x48, 0x0a, 0x10, 0x52, 0x65, 0x76,
-	0x6f, 0x6b, 0x65, 0x52, 0x65, 0x66, 0x72, 0x65, 0x73, 0x68, 0x52, 0x65, 0x71, 0x12, 0x17, 0x0a,
-	0x07, 0x75, 0x73, 0x65, 0x72, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06,
-	0x75, 0x73, 0x65, 0x72, 0x49, 0x64, 0x12, 0x1b, 0x0a, 0x09, 0x63, 0x6c, 0x69, 0x65, 0x6e, 0x74,
-	0x5f, 0x69, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x63, 0x6c, 0x69, 0x65, 0x6e,
-	0x74, 0x49, 0x64, 0x22, 0x30, 0x0a, 0x11, 0x52, 0x65, 0x76, 0x6f, 0x6b, 0x65, 0x52, 0x65, 0x66,
-	0x72, 0x65, 0x73, 0x68, 0x52, 0x65, 0x73, 0x70, 0x12, 0x1b, 0x0a, 0x09, 0x6e, 0x6f, 0x74, 0x5f,
+	0x6f, 0x74, 0x46, 0x6f, 0x75, 0x6e, 0x64, 0x22, 0x29, 0x0a, 0x11, 0x44, 0x65, 0x6c, 0x65, 0x74,
+	0x65, 0x50, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x52, 0x65, 0x71, 0x12, 0x14, 0x0a, 0x05,
+	0x65, 0x6d, 0x61, 0x69, 0x6c, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x65, 0x6d, 0x61,
+	0x69, 0x6c, 0x22, 0x31, 0x0a, 0x12, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x50, 0x61, 0x73, 0x73,
+	0x77, 0x6f, 0x72, 0x64, 0x52, 0x65, 0x73, 0x70, 0x12, 0x1b, 0x0a, 0x09, 0x6e, 0x6f, 0x74, 0x5f,
 	0x66, 0x6f, 0x75, 0x6e, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x08, 0x52, 0x08, 0x6e, 0x6f, 0x74,
-	0x46, 0x6f, 0x75, 0x6e, 0x64, 0x22, 0x45, 0x0a, 0x11, 0x56, 0x65, 0x72, 0x69, 0x66, 0x79, 0x50,
-	0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x52, 0x65, 0x71, 0x12, 0x14, 0x0a, 0x05, 0x65, 0x6d,
-	0x61, 0x69, 0x6c, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x65, 0x6d, 0x61, 0x69, 0x6c,
-	0x12, 0x1a, 0x0a, 0x08, 0x70, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x18, 0x02, 0x20, 0x01,
-	0x28, 0x09, 0x52, 0x08, 0x70, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x22, 0x4d, 0x0a, 0x12,
-	0x56, 0x65, 0x72, 0x69, 0x66, 0x79, 0x50, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x52, 0x65,
-	0x73, 0x70, 0x12, 0x1a, 0x0a, 0x08, 0x76, 0x65, 0x72, 0x69, 0x66, 0x69, 0x65, 0x64, 0x18, 0x01,
-	0x20, 0x01, 0x28, 0x08, 0x52, 0x08, 0x76, 0x65, 0x72, 0x69, 0x66, 0x69, 0x65, 0x64, 0x12, 0x1b,
-	0x0a, 0x09, 0x6e, 0x6f, 0x74, 0x5f, 0x66, 0x6f, 0x75, 0x6e, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28,
-	0x08, 0x52, 0x08, 0x6e, 0x6f, 0x74, 0x46, 0x6f, 0x75, 0x6e, 0x64, 0x32, 0xc7, 0x05, 0x0a, 0x03,
-	0x44, 0x65, 0x78, 0x12, 0x3d, 0x0a, 0x0c, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x43, 0x6c, 0x69,
-	0x65, 0x6e, 0x74, 0x12, 0x14, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65,
-	0x43, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x52, 0x65, 0x71, 0x1a, 0x15, 0x2e, 0x61, 0x70, 0x69, 0x2e,
-	0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x43, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x52, 0x65, 0x73, 0x70,
-	0x22, 0x00, 0x12, 0x3d, 0x0a, 0x0c, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x43, 0x6c, 0x69, 0x65,
-	0x6e, 0x74, 0x12, 0x14, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x43,
-	0x6c, 0x69, 0x65, 0x6e, 0x74, 0x52, 0x65, 0x71, 0x1a, 0x15, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x55,
-	0x70, 0x64, 0x61, 0x74, 0x65, 0x43, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x52, 0x65, 0x73, 0x70, 0x22,
-	0x00, 0x12, 0x3d, 0x0a, 0x0c, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x43, 0x6c, 0x69, 0x65, 0x6e,
-	0x74, 0x12, 0x14, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x43, 0x6c,
-	0x69, 0x65, 0x6e, 0x74, 0x52, 0x65, 0x71, 0x1a, 0x15, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x44, 0x65,
-	0x6c, 0x65, 0x74, 0x65, 0x43, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x52, 0x65, 0x73, 0x70, 0x22, 0x00,
-	0x12, 0x43, 0x0a, 0x0e, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x50, 0x61, 0x73, 0x73, 0x77, 0x6f,
-	0x72, 0x64, 0x12, 0x16, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x50,
-	0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x52, 0x65, 0x71, 0x1a, 0x17, 0x2e, 0x61, 0x70, 0x69,
-	0x2e, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x50, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x52,
-	0x65, 0x73, 0x70, 0x22, 0x00, 0x12, 0x43, 0x0a, 0x0e, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x50,
-	0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x12, 0x16, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x55, 0x70,
-	0x64, 0x61, 0x74, 0x65, 0x50, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x52, 0x65, 0x71, 0x1a,
-	0x17, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x50, 0x61, 0x73, 0x73,
-	0x77, 0x6f, 0x72, 0x64, 0x52, 0x65, 0x73, 0x70, 0x22, 0x00, 0x12, 0x43, 0x0a, 0x0e, 0x44, 0x65,
-	0x6c, 0x65, 0x74, 0x65, 0x50, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x12, 0x16, 0x2e, 0x61,
-	0x70, 0x69, 0x2e, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x50, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72,
-	0x64, 0x52, 0x65, 0x71, 0x1a, 0x17, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x44, 0x65, 0x6c, 0x65, 0x74,
-	0x65, 0x50, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x52, 0x65, 0x73, 0x70, 0x22, 0x00, 0x12,
-	0x3e, 0x0a, 0x0d, 0x4c, 0x69, 0x73, 0x74, 0x50, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x73,
-	0x12, 0x14, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x4c, 0x69, 0x73, 0x74, 0x50, 0x61, 0x73, 0x73, 0x77,
-	0x6f, 0x72, 0x64, 0x52, 0x65, 0x71, 0x1a, 0x15, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x4c, 0x69, 0x73,
-	0x74, 0x50, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x52, 0x65, 0x73, 0x70, 0x22, 0x00, 0x12,
-	0x31, 0x0a, 0x0a, 0x47, 0x65, 0x74, 0x56, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x12, 0x0f, 0x2e,
-	0x61, 0x70, 0x69, 0x2e, 0x56, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x71, 0x1a, 0x10,
-	0x2e, 0x61, 0x70, 0x69, 0x2e, 0x56, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x73, 0x70,
-	0x22, 0x00, 0x12, 0x3a, 0x0a, 0x0b, 0x4c, 0x69, 0x73, 0x74, 0x52, 0x65, 0x66, 0x72, 0x65, 0x73,
-	0x68, 0x12, 0x13, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x4c, 0x69, 0x73, 0x74, 0x52, 0x65, 0x66, 0x72,
-	0x65, 0x73, 0x68, 0x52, 0x65, 0x71, 0x1a, 0x14, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x4c, 0x69, 0x73,
-	0x74, 0x52, 0x65, 0x66, 0x72, 0x65, 0x73, 0x68, 0x52, 0x65, 0x73, 0x70, 0x22, 0x00, 0x12, 0x40,
-	0x0a, 0x0d, 0x52, 0x65, 0x76, 0x6f, 0x6b, 0x65, 0x52, 0x65, 0x66, 0x72, 0x65, 0x73, 0x68, 0x12,
-	0x15, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x52, 0x65, 0x76, 0x6f, 0x6b, 0x65, 0x52, 0x65, 0x66, 0x72,
-	0x65, 0x73, 0x68, 0x52, 0x65, 0x71, 0x1a, 0x16, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x52, 0x65, 0x76,
-	0x6f, 0x6b, 0x65, 0x52, 0x65, 0x66, 0x72, 0x65, 0x73, 0x68, 0x52, 0x65, 0x73, 0x70, 0x22, 0x00,
-	0x12, 0x43, 0x0a, 0x0e, 0x56, 0x65, 0x72, 0x69, 0x66, 0x79, 0x50, 0x61, 0x73, 0x73, 0x77, 0x6f,
-	0x72, 0x64, 0x12, 0x16, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x56, 0x65, 0x72, 0x69, 0x66, 0x79, 0x50,
-	0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x52, 0x65, 0x71, 0x1a, 0x17, 0x2e, 0x61, 0x70, 0x69,
-	0x2e, 0x56, 0x65, 0x72, 0x69, 0x66, 0x79, 0x50, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x52,
-	0x65, 0x73, 0x70, 0x22, 0x00, 0x42, 0x36, 0x0a, 0x12, 0x63, 0x6f, 0x6d, 0x2e, 0x63, 0x6f, 0x72,
-	0x65, 0x6f, 0x73, 0x2e, 0x64, 0x65, 0x78, 0x2e, 0x61, 0x70, 0x69, 0x5a, 0x20, 0x67, 0x69, 0x74,
-	0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x64, 0x65, 0x78, 0x69, 0x64, 0x70, 0x2f, 0x64,
-	0x65, 0x78, 0x2f, 0x61, 0x70, 0x69, 0x2f, 0x76, 0x32, 0x3b, 0x61, 0x70, 0x69, 0x62, 0x06, 0x70,
-	0x72, 0x6f, 0x74, 0x6f, 0x33,
-}
+	0x46, 0x6f, 0x75, 0x6e, 0x64, 0x22, 0x11, 0x0a, 0x0f, 0x4c, 0x69, 0x73, 0x74, 0x50, 0x61, 0x73,
+	0x73, 0x77, 0x6f, 0x72, 0x64, 0x52, 0x65, 0x71, 0x22, 0x3f, 0x0a, 0x10, 0x4c, 0x69, 0x73, 0x74,
+	0x50, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x52, 0x65, 0x73, 0x70, 0x12, 0x2b, 0x0a, 0x09,
+	0x70, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32,
+	0x0d, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x50, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x52, 0x09,
+	0x70, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x73, 0x22, 0x7c, 0x0a, 0x09, 0x43, 0x6f, 0x6e,
+	0x6e, 0x65, 0x63, 0x74, 0x6f, 0x72, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01,
+	0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x12, 0x12, 0x0a, 0x04, 0x74, 0x79, 0x70, 0x65, 0x18, 0x02,
+	0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x74, 0x79, 0x70, 0x65, 0x12, 0x12, 0x0a, 0x04, 0x6e, 0x61,
+	0x6d, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x16,
+	0x0a, 0x06, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x06,
+	0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x1f, 0x0a, 0x0b, 0x67, 0x72, 0x61, 0x6e, 0x74, 0x5f,
+	0x74, 0x79, 0x70, 0x65, 0x73, 0x18, 0x05, 0x20, 0x03, 0x28, 0x09, 0x52, 0x0a, 0x67, 0x72, 0x61,
+	0x6e, 0x74, 0x54, 0x79, 0x70, 0x65, 0x73, 0x22, 0x42, 0x0a, 0x12, 0x43, 0x72, 0x65, 0x61, 0x74,
+	0x65, 0x43, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x6f, 0x72, 0x52, 0x65, 0x71, 0x12, 0x2c, 0x0a,
+	0x09, 0x63, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x6f, 0x72, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b,
+	0x32, 0x0e, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x43, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x6f, 0x72,
+	0x52, 0x09, 0x63, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x6f, 0x72, 0x22, 0x3c, 0x0a, 0x13, 0x43,
+	0x72, 0x65, 0x61, 0x74, 0x65, 0x43, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x6f, 0x72, 0x52, 0x65,
+	0x73, 0x70, 0x12, 0x25, 0x0a, 0x0e, 0x61, 0x6c, 0x72, 0x65, 0x61, 0x64, 0x79, 0x5f, 0x65, 0x78,
+	0x69, 0x73, 0x74, 0x73, 0x18, 0x01, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0d, 0x61, 0x6c, 0x72, 0x65,
+	0x61, 0x64, 0x79, 0x45, 0x78, 0x69, 0x73, 0x74, 0x73, 0x22, 0x2d, 0x0a, 0x0a, 0x47, 0x72, 0x61,
+	0x6e, 0x74, 0x54, 0x79, 0x70, 0x65, 0x73, 0x12, 0x1f, 0x0a, 0x0b, 0x67, 0x72, 0x61, 0x6e, 0x74,
+	0x5f, 0x74, 0x79, 0x70, 0x65, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x09, 0x52, 0x0a, 0x67, 0x72,
+	0x61, 0x6e, 0x74, 0x54, 0x79, 0x70, 0x65, 0x73, 0x22, 0xb2, 0x01, 0x0a, 0x12, 0x55, 0x70, 0x64,
+	0x61, 0x74, 0x65, 0x43, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x6f, 0x72, 0x52, 0x65, 0x71, 0x12,
+	0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x12,
+	0x19, 0x0a, 0x08, 0x6e, 0x65, 0x77, 0x5f, 0x74, 0x79, 0x70, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28,
+	0x09, 0x52, 0x07, 0x6e, 0x65, 0x77, 0x54, 0x79, 0x70, 0x65, 0x12, 0x19, 0x0a, 0x08, 0x6e, 0x65,
+	0x77, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x6e, 0x65,
+	0x77, 0x4e, 0x61, 0x6d, 0x65, 0x12, 0x1d, 0x0a, 0x0a, 0x6e, 0x65, 0x77, 0x5f, 0x63, 0x6f, 0x6e,
+	0x66, 0x69, 0x67, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x09, 0x6e, 0x65, 0x77, 0x43, 0x6f,
+	0x6e, 0x66, 0x69, 0x67, 0x12, 0x37, 0x0a, 0x0f, 0x6e, 0x65, 0x77, 0x5f, 0x67, 0x72, 0x61, 0x6e,
+	0x74, 0x5f, 0x74, 0x79, 0x70, 0x65, 0x73, 0x18, 0x05, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x0f, 0x2e,
+	0x61, 0x70, 0x69, 0x2e, 0x47, 0x72, 0x61, 0x6e, 0x74, 0x54, 0x79, 0x70, 0x65, 0x73, 0x52, 0x0d,
+	0x6e, 0x65, 0x77, 0x47, 0x72, 0x61, 0x6e, 0x74, 0x54, 0x79, 0x70, 0x65, 0x73, 0x22, 0x32, 0x0a,
+	0x13, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x43, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x6f, 0x72,
+	0x52, 0x65, 0x73, 0x70, 0x12, 0x1b, 0x0a, 0x09, 0x6e, 0x6f, 0x74, 0x5f, 0x66, 0x6f, 0x75, 0x6e,
+	0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x08, 0x52, 0x08, 0x6e, 0x6f, 0x74, 0x46, 0x6f, 0x75, 0x6e,
+	0x64, 0x22, 0x24, 0x0a, 0x12, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x43, 0x6f, 0x6e, 0x6e, 0x65,
+	0x63, 0x74, 0x6f, 0x72, 0x52, 0x65, 0x71, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20,
+	0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x22, 0x32, 0x0a, 0x13, 0x44, 0x65, 0x6c, 0x65, 0x74,
+	0x65, 0x43, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x6f, 0x72, 0x52, 0x65, 0x73, 0x70, 0x12, 0x1b,
+	0x0a, 0x09, 0x6e, 0x6f, 0x74, 0x5f, 0x66, 0x6f, 0x75, 0x6e, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28,
+	0x08, 0x52, 0x08, 0x6e, 0x6f, 0x74, 0x46, 0x6f, 0x75, 0x6e, 0x64, 0x22, 0x12, 0x0a, 0x10, 0x4c,
+	0x69, 0x73, 0x74, 0x43, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x6f, 0x72, 0x52, 0x65, 0x71, 0x22,
+	0x43, 0x0a, 0x11, 0x4c, 0x69, 0x73, 0x74, 0x43, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x6f, 0x72,
+	0x52, 0x65, 0x73, 0x70, 0x12, 0x2e, 0x0a, 0x0a, 0x63, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x6f,
+	0x72, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x0e, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x43,
+	0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x6f, 0x72, 0x52, 0x0a, 0x63, 0x6f, 0x6e, 0x6e, 0x65, 0x63,
+	0x74, 0x6f, 0x72, 0x73, 0x22, 0x0c, 0x0a, 0x0a, 0x56, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x52,
+	0x65, 0x71, 0x22, 0x37, 0x0a, 0x0b, 0x56, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x73,
+	0x70, 0x12, 0x16, 0x0a, 0x06, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x18, 0x01, 0x20, 0x01, 0x28,
+	0x09, 0x52, 0x06, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x12, 0x10, 0x0a, 0x03, 0x61, 0x70, 0x69,
+	0x18, 0x02, 0x20, 0x01, 0x28, 0x05, 0x52, 0x03, 0x61, 0x70, 0x69, 0x22, 0x0e, 0x0a, 0x0c, 0x44,
+	0x69, 0x73, 0x63, 0x6f, 0x76, 0x65, 0x72, 0x79, 0x52, 0x65, 0x71, 0x22, 0xb0, 0x06, 0x0a, 0x0d,
+	0x44, 0x69, 0x73, 0x63, 0x6f, 0x76, 0x65, 0x72, 0x79, 0x52, 0x65, 0x73, 0x70, 0x12, 0x16, 0x0a,
+	0x06, 0x69, 0x73, 0x73, 0x75, 0x65, 0x72, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x69,
+	0x73, 0x73, 0x75, 0x65, 0x72, 0x12, 0x35, 0x0a, 0x16, 0x61, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69,
+	0x7a, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x65, 0x6e, 0x64, 0x70, 0x6f, 0x69, 0x6e, 0x74, 0x18,
+	0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x15, 0x61, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x61,
+	0x74, 0x69, 0x6f, 0x6e, 0x45, 0x6e, 0x64, 0x70, 0x6f, 0x69, 0x6e, 0x74, 0x12, 0x25, 0x0a, 0x0e,
+	0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x5f, 0x65, 0x6e, 0x64, 0x70, 0x6f, 0x69, 0x6e, 0x74, 0x18, 0x03,
+	0x20, 0x01, 0x28, 0x09, 0x52, 0x0d, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x45, 0x6e, 0x64, 0x70, 0x6f,
+	0x69, 0x6e, 0x74, 0x12, 0x19, 0x0a, 0x08, 0x6a, 0x77, 0x6b, 0x73, 0x5f, 0x75, 0x72, 0x69, 0x18,
+	0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x6a, 0x77, 0x6b, 0x73, 0x55, 0x72, 0x69, 0x12, 0x2b,
+	0x0a, 0x11, 0x75, 0x73, 0x65, 0x72, 0x69, 0x6e, 0x66, 0x6f, 0x5f, 0x65, 0x6e, 0x64, 0x70, 0x6f,
+	0x69, 0x6e, 0x74, 0x18, 0x05, 0x20, 0x01, 0x28, 0x09, 0x52, 0x10, 0x75, 0x73, 0x65, 0x72, 0x69,
+	0x6e, 0x66, 0x6f, 0x45, 0x6e, 0x64, 0x70, 0x6f, 0x69, 0x6e, 0x74, 0x12, 0x42, 0x0a, 0x1d, 0x64,
+	0x65, 0x76, 0x69, 0x63, 0x65, 0x5f, 0x61, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x61, 0x74,
+	0x69, 0x6f, 0x6e, 0x5f, 0x65, 0x6e, 0x64, 0x70, 0x6f, 0x69, 0x6e, 0x74, 0x18, 0x06, 0x20, 0x01,
+	0x28, 0x09, 0x52, 0x1b, 0x64, 0x65, 0x76, 0x69, 0x63, 0x65, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72,
+	0x69, 0x7a, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x45, 0x6e, 0x64, 0x70, 0x6f, 0x69, 0x6e, 0x74, 0x12,
+	0x35, 0x0a, 0x16, 0x69, 0x6e, 0x74, 0x72, 0x6f, 0x73, 0x70, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e,
+	0x5f, 0x65, 0x6e, 0x64, 0x70, 0x6f, 0x69, 0x6e, 0x74, 0x18, 0x07, 0x20, 0x01, 0x28, 0x09, 0x52,
+	0x15, 0x69, 0x6e, 0x74, 0x72, 0x6f, 0x73, 0x70, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x45, 0x6e,
+	0x64, 0x70, 0x6f, 0x69, 0x6e, 0x74, 0x12, 0x32, 0x0a, 0x15, 0x67, 0x72, 0x61, 0x6e, 0x74, 0x5f,
+	0x74, 0x79, 0x70, 0x65, 0x73, 0x5f, 0x73, 0x75, 0x70, 0x70, 0x6f, 0x72, 0x74, 0x65, 0x64, 0x18,
+	0x08, 0x20, 0x03, 0x28, 0x09, 0x52, 0x13, 0x67, 0x72, 0x61, 0x6e, 0x74, 0x54, 0x79, 0x70, 0x65,
+	0x73, 0x53, 0x75, 0x70, 0x70, 0x6f, 0x72, 0x74, 0x65, 0x64, 0x12, 0x38, 0x0a, 0x18, 0x72, 0x65,
+	0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x5f, 0x74, 0x79, 0x70, 0x65, 0x73, 0x5f, 0x73, 0x75, 0x70,
+	0x70, 0x6f, 0x72, 0x74, 0x65, 0x64, 0x18, 0x09, 0x20, 0x03, 0x28, 0x09, 0x52, 0x16, 0x72, 0x65,
+	0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x54, 0x79, 0x70, 0x65, 0x73, 0x53, 0x75, 0x70, 0x70, 0x6f,
+	0x72, 0x74, 0x65, 0x64, 0x12, 0x36, 0x0a, 0x17, 0x73, 0x75, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x5f,
+	0x74, 0x79, 0x70, 0x65, 0x73, 0x5f, 0x73, 0x75, 0x70, 0x70, 0x6f, 0x72, 0x74, 0x65, 0x64, 0x18,
+	0x0a, 0x20, 0x03, 0x28, 0x09, 0x52, 0x15, 0x73, 0x75, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x54, 0x79,
+	0x70, 0x65, 0x73, 0x53, 0x75, 0x70, 0x70, 0x6f, 0x72, 0x74, 0x65, 0x64, 0x12, 0x4f, 0x0a, 0x25,
+	0x69, 0x64, 0x5f, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x5f, 0x73, 0x69, 0x67, 0x6e, 0x69, 0x6e, 0x67,
+	0x5f, 0x61, 0x6c, 0x67, 0x5f, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x73, 0x5f, 0x73, 0x75, 0x70, 0x70,
+	0x6f, 0x72, 0x74, 0x65, 0x64, 0x18, 0x0b, 0x20, 0x03, 0x28, 0x09, 0x52, 0x20, 0x69, 0x64, 0x54,
+	0x6f, 0x6b, 0x65, 0x6e, 0x53, 0x69, 0x67, 0x6e, 0x69, 0x6e, 0x67, 0x41, 0x6c, 0x67, 0x56, 0x61,
+	0x6c, 0x75, 0x65, 0x73, 0x53, 0x75, 0x70, 0x70, 0x6f, 0x72, 0x74, 0x65, 0x64, 0x12, 0x47, 0x0a,
+	0x20, 0x63, 0x6f, 0x64, 0x65, 0x5f, 0x63, 0x68, 0x61, 0x6c, 0x6c, 0x65, 0x6e, 0x67, 0x65, 0x5f,
+	0x6d, 0x65, 0x74, 0x68, 0x6f, 0x64, 0x73, 0x5f, 0x73, 0x75, 0x70, 0x70, 0x6f, 0x72, 0x74, 0x65,
+	0x64, 0x18, 0x0c, 0x20, 0x03, 0x28, 0x09, 0x52, 0x1d, 0x63, 0x6f, 0x64, 0x65, 0x43, 0x68, 0x61,
+	0x6c, 0x6c, 0x65, 0x6e, 0x67, 0x65, 0x4d, 0x65, 0x74, 0x68, 0x6f, 0x64, 0x73, 0x53, 0x75, 0x70,
+	0x70, 0x6f, 0x72, 0x74, 0x65, 0x64, 0x12, 0x29, 0x0a, 0x10, 0x73, 0x63, 0x6f, 0x70, 0x65, 0x73,
+	0x5f, 0x73, 0x75, 0x70, 0x70, 0x6f, 0x72, 0x74, 0x65, 0x64, 0x18, 0x0d, 0x20, 0x03, 0x28, 0x09,
+	0x52, 0x0f, 0x73, 0x63, 0x6f, 0x70, 0x65, 0x73, 0x53, 0x75, 0x70, 0x70, 0x6f, 0x72, 0x74, 0x65,
+	0x64, 0x12, 0x50, 0x0a, 0x25, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x5f, 0x65, 0x6e, 0x64, 0x70, 0x6f,
+	0x69, 0x6e, 0x74, 0x5f, 0x61, 0x75, 0x74, 0x68, 0x5f, 0x6d, 0x65, 0x74, 0x68, 0x6f, 0x64, 0x73,
+	0x5f, 0x73, 0x75, 0x70, 0x70, 0x6f, 0x72, 0x74, 0x65, 0x64, 0x18, 0x0e, 0x20, 0x03, 0x28, 0x09,
+	0x52, 0x21, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x45, 0x6e, 0x64, 0x70, 0x6f, 0x69, 0x6e, 0x74, 0x41,
+	0x75, 0x74, 0x68, 0x4d, 0x65, 0x74, 0x68, 0x6f, 0x64, 0x73, 0x53, 0x75, 0x70, 0x70, 0x6f, 0x72,
+	0x74, 0x65, 0x64, 0x12, 0x29, 0x0a, 0x10, 0x63, 0x6c, 0x61, 0x69, 0x6d, 0x73, 0x5f, 0x73, 0x75,
+	0x70, 0x70, 0x6f, 0x72, 0x74, 0x65, 0x64, 0x18, 0x0f, 0x20, 0x03, 0x28, 0x09, 0x52, 0x0f, 0x63,
+	0x6c, 0x61, 0x69, 0x6d, 0x73, 0x53, 0x75, 0x70, 0x70, 0x6f, 0x72, 0x74, 0x65, 0x64, 0x22, 0x7a,
+	0x0a, 0x0f, 0x52, 0x65, 0x66, 0x72, 0x65, 0x73, 0x68, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x52, 0x65,
+	0x66, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69,
+	0x64, 0x12, 0x1b, 0x0a, 0x09, 0x63, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x5f, 0x69, 0x64, 0x18, 0x02,
+	0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x63, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x49, 0x64, 0x12, 0x1d,
+	0x0a, 0x0a, 0x63, 0x72, 0x65, 0x61, 0x74, 0x65, 0x64, 0x5f, 0x61, 0x74, 0x18, 0x05, 0x20, 0x01,
+	0x28, 0x03, 0x52, 0x09, 0x63, 0x72, 0x65, 0x61, 0x74, 0x65, 0x64, 0x41, 0x74, 0x12, 0x1b, 0x0a,
+	0x09, 0x6c, 0x61, 0x73, 0x74, 0x5f, 0x75, 0x73, 0x65, 0x64, 0x18, 0x06, 0x20, 0x01, 0x28, 0x03,
+	0x52, 0x08, 0x6c, 0x61, 0x73, 0x74, 0x55, 0x73, 0x65, 0x64, 0x22, 0x29, 0x0a, 0x0e, 0x4c, 0x69,
+	0x73, 0x74, 0x52, 0x65, 0x66, 0x72, 0x65, 0x73, 0x68, 0x52, 0x65, 0x71, 0x12, 0x17, 0x0a, 0x07,
+	0x75, 0x73, 0x65, 0x72, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x75,
+	0x73, 0x65, 0x72, 0x49, 0x64, 0x22, 0x4e, 0x0a, 0x0f, 0x4c, 0x69, 0x73, 0x74, 0x52, 0x65, 0x66,
+	0x72, 0x65, 0x73, 0x68, 0x52, 0x65, 0x73, 0x70, 0x12, 0x3b, 0x0a, 0x0e, 0x72, 0x65, 0x66, 0x72,
+	0x65, 0x73, 0x68, 0x5f, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b,
+	0x32, 0x14, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x52, 0x65, 0x66, 0x72, 0x65, 0x73, 0x68, 0x54, 0x6f,
+	0x6b, 0x65, 0x6e, 0x52, 0x65, 0x66, 0x52, 0x0d, 0x72, 0x65, 0x66, 0x72, 0x65, 0x73, 0x68, 0x54,
+	0x6f, 0x6b, 0x65, 0x6e, 0x73, 0x22, 0x48, 0x0a, 0x10, 0x52, 0x65, 0x76, 0x6f, 0x6b, 0x65, 0x52,
+	0x65, 0x66, 0x72, 0x65, 0x73, 0x68, 0x52, 0x65, 0x71, 0x12, 0x17, 0x0a, 0x07, 0x75, 0x73, 0x65,
+	0x72, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x75, 0x73, 0x65, 0x72,
+	0x49, 0x64, 0x12, 0x1b, 0x0a, 0x09, 0x63, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x5f, 0x69, 0x64, 0x18,
+	0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x63, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x49, 0x64, 0x22,
+	0x30, 0x0a, 0x11, 0x52, 0x65, 0x76, 0x6f, 0x6b, 0x65, 0x52, 0x65, 0x66, 0x72, 0x65, 0x73, 0x68,
+	0x52, 0x65, 0x73, 0x70, 0x12, 0x1b, 0x0a, 0x09, 0x6e, 0x6f, 0x74, 0x5f, 0x66, 0x6f, 0x75, 0x6e,
+	0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x08, 0x52, 0x08, 0x6e, 0x6f, 0x74, 0x46, 0x6f, 0x75, 0x6e,
+	0x64, 0x22, 0x45, 0x0a, 0x11, 0x56, 0x65, 0x72, 0x69, 0x66, 0x79, 0x50, 0x61, 0x73, 0x73, 0x77,
+	0x6f, 0x72, 0x64, 0x52, 0x65, 0x71, 0x12, 0x14, 0x0a, 0x05, 0x65, 0x6d, 0x61, 0x69, 0x6c, 0x18,
+	0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x65, 0x6d, 0x61, 0x69, 0x6c, 0x12, 0x1a, 0x0a, 0x08,
+	0x70, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08,
+	0x70, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x22, 0x4d, 0x0a, 0x12, 0x56, 0x65, 0x72, 0x69,
+	0x66, 0x79, 0x50, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x52, 0x65, 0x73, 0x70, 0x12, 0x1a,
+	0x0a, 0x08, 0x76, 0x65, 0x72, 0x69, 0x66, 0x69, 0x65, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x08,
+	0x52, 0x08, 0x76, 0x65, 0x72, 0x69, 0x66, 0x69, 0x65, 0x64, 0x12, 0x1b, 0x0a, 0x09, 0x6e, 0x6f,
+	0x74, 0x5f, 0x66, 0x6f, 0x75, 0x6e, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x08, 0x52, 0x08, 0x6e,
+	0x6f, 0x74, 0x46, 0x6f, 0x75, 0x6e, 0x64, 0x22, 0xc8, 0x01, 0x0a, 0x0f, 0x43, 0x6c, 0x69, 0x65,
+	0x6e, 0x74, 0x41, 0x75, 0x74, 0x68, 0x53, 0x74, 0x61, 0x74, 0x65, 0x12, 0x1b, 0x0a, 0x09, 0x63,
+	0x6c, 0x69, 0x65, 0x6e, 0x74, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08,
+	0x63, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x49, 0x64, 0x12, 0x29, 0x0a, 0x10, 0x61, 0x75, 0x74, 0x68,
+	0x65, 0x6e, 0x74, 0x69, 0x63, 0x61, 0x74, 0x65, 0x64, 0x5f, 0x61, 0x74, 0x18, 0x02, 0x20, 0x01,
+	0x28, 0x03, 0x52, 0x0f, 0x61, 0x75, 0x74, 0x68, 0x65, 0x6e, 0x74, 0x69, 0x63, 0x61, 0x74, 0x65,
+	0x64, 0x41, 0x74, 0x12, 0x23, 0x0a, 0x0d, 0x6c, 0x61, 0x73, 0x74, 0x5f, 0x61, 0x63, 0x74, 0x69,
+	0x76, 0x69, 0x74, 0x79, 0x18, 0x03, 0x20, 0x01, 0x28, 0x03, 0x52, 0x0c, 0x6c, 0x61, 0x73, 0x74,
+	0x41, 0x63, 0x74, 0x69, 0x76, 0x69, 0x74, 0x79, 0x12, 0x2f, 0x0a, 0x14, 0x6c, 0x61, 0x73, 0x74,
+	0x5f, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x5f, 0x69, 0x73, 0x73, 0x75, 0x65, 0x64, 0x5f, 0x61, 0x74,
+	0x18, 0x04, 0x20, 0x01, 0x28, 0x03, 0x52, 0x11, 0x6c, 0x61, 0x73, 0x74, 0x54, 0x6f, 0x6b, 0x65,
+	0x6e, 0x49, 0x73, 0x73, 0x75, 0x65, 0x64, 0x41, 0x74, 0x12, 0x17, 0x0a, 0x07, 0x76, 0x69, 0x61,
+	0x5f, 0x73, 0x73, 0x6f, 0x18, 0x05, 0x20, 0x01, 0x28, 0x08, 0x52, 0x06, 0x76, 0x69, 0x61, 0x53,
+	0x73, 0x6f, 0x22, 0xe0, 0x02, 0x0a, 0x0b, 0x41, 0x75, 0x74, 0x68, 0x53, 0x65, 0x73, 0x73, 0x69,
+	0x6f, 0x6e, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x0a, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02,
+	0x69, 0x64, 0x12, 0x17, 0x0a, 0x07, 0x75, 0x73, 0x65, 0x72, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20,
+	0x01, 0x28, 0x09, 0x52, 0x06, 0x75, 0x73, 0x65, 0x72, 0x49, 0x64, 0x12, 0x21, 0x0a, 0x0c, 0x63,
+	0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x6f, 0x72, 0x5f, 0x69, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28,
+	0x09, 0x52, 0x0b, 0x63, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x6f, 0x72, 0x49, 0x64, 0x12, 0x39,
+	0x0a, 0x0d, 0x63, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x5f, 0x73, 0x74, 0x61, 0x74, 0x65, 0x73, 0x18,
+	0x03, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x14, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x43, 0x6c, 0x69, 0x65,
+	0x6e, 0x74, 0x41, 0x75, 0x74, 0x68, 0x53, 0x74, 0x61, 0x74, 0x65, 0x52, 0x0c, 0x63, 0x6c, 0x69,
+	0x65, 0x6e, 0x74, 0x53, 0x74, 0x61, 0x74, 0x65, 0x73, 0x12, 0x1d, 0x0a, 0x0a, 0x63, 0x72, 0x65,
+	0x61, 0x74, 0x65, 0x64, 0x5f, 0x61, 0x74, 0x18, 0x04, 0x20, 0x01, 0x28, 0x03, 0x52, 0x09, 0x63,
+	0x72, 0x65, 0x61, 0x74, 0x65, 0x64, 0x41, 0x74, 0x12, 0x23, 0x0a, 0x0d, 0x6c, 0x61, 0x73, 0x74,
+	0x5f, 0x61, 0x63, 0x74, 0x69, 0x76, 0x69, 0x74, 0x79, 0x18, 0x05, 0x20, 0x01, 0x28, 0x03, 0x52,
+	0x0c, 0x6c, 0x61, 0x73, 0x74, 0x41, 0x63, 0x74, 0x69, 0x76, 0x69, 0x74, 0x79, 0x12, 0x1d, 0x0a,
+	0x0a, 0x69, 0x70, 0x5f, 0x61, 0x64, 0x64, 0x72, 0x65, 0x73, 0x73, 0x18, 0x06, 0x20, 0x01, 0x28,
+	0x09, 0x52, 0x09, 0x69, 0x70, 0x41, 0x64, 0x64, 0x72, 0x65, 0x73, 0x73, 0x12, 0x1d, 0x0a, 0x0a,
+	0x75, 0x73, 0x65, 0x72, 0x5f, 0x61, 0x67, 0x65, 0x6e, 0x74, 0x18, 0x07, 0x20, 0x01, 0x28, 0x09,
+	0x52, 0x09, 0x75, 0x73, 0x65, 0x72, 0x41, 0x67, 0x65, 0x6e, 0x74, 0x12, 0x27, 0x0a, 0x0f, 0x61,
+	0x62, 0x73, 0x6f, 0x6c, 0x75, 0x74, 0x65, 0x5f, 0x65, 0x78, 0x70, 0x69, 0x72, 0x79, 0x18, 0x08,
+	0x20, 0x01, 0x28, 0x03, 0x52, 0x0e, 0x61, 0x62, 0x73, 0x6f, 0x6c, 0x75, 0x74, 0x65, 0x45, 0x78,
+	0x70, 0x69, 0x72, 0x79, 0x12, 0x1f, 0x0a, 0x0b, 0x69, 0x64, 0x6c, 0x65, 0x5f, 0x65, 0x78, 0x70,
+	0x69, 0x72, 0x79, 0x18, 0x09, 0x20, 0x01, 0x28, 0x03, 0x52, 0x0a, 0x69, 0x64, 0x6c, 0x65, 0x45,
+	0x78, 0x70, 0x69, 0x72, 0x79, 0x22, 0x23, 0x0a, 0x11, 0x47, 0x65, 0x74, 0x41, 0x75, 0x74, 0x68,
+	0x53, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x71, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64,
+	0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x22, 0x40, 0x0a, 0x12, 0x47, 0x65,
+	0x74, 0x41, 0x75, 0x74, 0x68, 0x53, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x73, 0x70,
+	0x12, 0x2a, 0x0a, 0x07, 0x73, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x18, 0x01, 0x20, 0x01, 0x28,
+	0x0b, 0x32, 0x10, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x41, 0x75, 0x74, 0x68, 0x53, 0x65, 0x73, 0x73,
+	0x69, 0x6f, 0x6e, 0x52, 0x07, 0x73, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x22, 0x51, 0x0a, 0x13,
+	0x4c, 0x69, 0x73, 0x74, 0x41, 0x75, 0x74, 0x68, 0x53, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x73,
+	0x52, 0x65, 0x71, 0x12, 0x17, 0x0a, 0x07, 0x75, 0x73, 0x65, 0x72, 0x5f, 0x69, 0x64, 0x18, 0x01,
+	0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x75, 0x73, 0x65, 0x72, 0x49, 0x64, 0x12, 0x21, 0x0a, 0x0c,
+	0x63, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x6f, 0x72, 0x5f, 0x69, 0x64, 0x18, 0x02, 0x20, 0x01,
+	0x28, 0x09, 0x52, 0x0b, 0x63, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x6f, 0x72, 0x49, 0x64, 0x22,
+	0x44, 0x0a, 0x14, 0x4c, 0x69, 0x73, 0x74, 0x41, 0x75, 0x74, 0x68, 0x53, 0x65, 0x73, 0x73, 0x69,
+	0x6f, 0x6e, 0x73, 0x52, 0x65, 0x73, 0x70, 0x12, 0x2c, 0x0a, 0x08, 0x73, 0x65, 0x73, 0x73, 0x69,
+	0x6f, 0x6e, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x10, 0x2e, 0x61, 0x70, 0x69, 0x2e,
+	0x41, 0x75, 0x74, 0x68, 0x53, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x52, 0x08, 0x73, 0x65, 0x73,
+	0x73, 0x69, 0x6f, 0x6e, 0x73, 0x22, 0x26, 0x0a, 0x14, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x41,
+	0x75, 0x74, 0x68, 0x53, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x71, 0x12, 0x0e, 0x0a,
+	0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x22, 0x34, 0x0a,
+	0x15, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x41, 0x75, 0x74, 0x68, 0x53, 0x65, 0x73, 0x73, 0x69,
+	0x6f, 0x6e, 0x52, 0x65, 0x73, 0x70, 0x12, 0x1b, 0x0a, 0x09, 0x6e, 0x6f, 0x74, 0x5f, 0x66, 0x6f,
+	0x75, 0x6e, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x08, 0x52, 0x08, 0x6e, 0x6f, 0x74, 0x46, 0x6f,
+	0x75, 0x6e, 0x64, 0x22, 0x44, 0x0a, 0x1f, 0x54, 0x65, 0x72, 0x6d, 0x69, 0x6e, 0x61, 0x74, 0x65,
+	0x53, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x73, 0x42, 0x79, 0x43, 0x6f, 0x6e, 0x6e, 0x65, 0x63,
+	0x74, 0x6f, 0x72, 0x52, 0x65, 0x71, 0x12, 0x21, 0x0a, 0x0c, 0x63, 0x6f, 0x6e, 0x6e, 0x65, 0x63,
+	0x74, 0x6f, 0x72, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x63, 0x6f,
+	0x6e, 0x6e, 0x65, 0x63, 0x74, 0x6f, 0x72, 0x49, 0x64, 0x22, 0x53, 0x0a, 0x20, 0x54, 0x65, 0x72,
+	0x6d, 0x69, 0x6e, 0x61, 0x74, 0x65, 0x53, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x73, 0x42, 0x79,
+	0x43, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x6f, 0x72, 0x52, 0x65, 0x73, 0x70, 0x12, 0x2f, 0x0a,
+	0x13, 0x73, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x73, 0x5f, 0x74, 0x65, 0x72, 0x6d, 0x69, 0x6e,
+	0x61, 0x74, 0x65, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x03, 0x52, 0x12, 0x73, 0x65, 0x73, 0x73,
+	0x69, 0x6f, 0x6e, 0x73, 0x54, 0x65, 0x72, 0x6d, 0x69, 0x6e, 0x61, 0x74, 0x65, 0x64, 0x22, 0x35,
+	0x0a, 0x1a, 0x54, 0x65, 0x72, 0x6d, 0x69, 0x6e, 0x61, 0x74, 0x65, 0x53, 0x65, 0x73, 0x73, 0x69,
+	0x6f, 0x6e, 0x73, 0x42, 0x79, 0x55, 0x73, 0x65, 0x72, 0x52, 0x65, 0x71, 0x12, 0x17, 0x0a, 0x07,
+	0x75, 0x73, 0x65, 0x72, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x75,
+	0x73, 0x65, 0x72, 0x49, 0x64, 0x22, 0x4e, 0x0a, 0x1b, 0x54, 0x65, 0x72, 0x6d, 0x69, 0x6e, 0x61,
+	0x74, 0x65, 0x53, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x73, 0x42, 0x79, 0x55, 0x73, 0x65, 0x72,
+	0x52, 0x65, 0x73, 0x70, 0x12, 0x2f, 0x0a, 0x13, 0x73, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x73,
+	0x5f, 0x74, 0x65, 0x72, 0x6d, 0x69, 0x6e, 0x61, 0x74, 0x65, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28,
+	0x03, 0x52, 0x12, 0x73, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x73, 0x54, 0x65, 0x72, 0x6d, 0x69,
+	0x6e, 0x61, 0x74, 0x65, 0x64, 0x22, 0x43, 0x0a, 0x0c, 0x43, 0x6f, 0x6e, 0x73, 0x65, 0x6e, 0x74,
+	0x45, 0x6e, 0x74, 0x72, 0x79, 0x12, 0x1b, 0x0a, 0x09, 0x63, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x5f,
+	0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x63, 0x6c, 0x69, 0x65, 0x6e, 0x74,
+	0x49, 0x64, 0x12, 0x16, 0x0a, 0x06, 0x73, 0x63, 0x6f, 0x70, 0x65, 0x73, 0x18, 0x02, 0x20, 0x03,
+	0x28, 0x09, 0x52, 0x06, 0x73, 0x63, 0x6f, 0x70, 0x65, 0x73, 0x22, 0x87, 0x01, 0x0a, 0x09, 0x4d,
+	0x46, 0x41, 0x53, 0x65, 0x63, 0x72, 0x65, 0x74, 0x12, 0x29, 0x0a, 0x10, 0x61, 0x75, 0x74, 0x68,
+	0x65, 0x6e, 0x74, 0x69, 0x63, 0x61, 0x74, 0x6f, 0x72, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01,
+	0x28, 0x09, 0x52, 0x0f, 0x61, 0x75, 0x74, 0x68, 0x65, 0x6e, 0x74, 0x69, 0x63, 0x61, 0x74, 0x6f,
+	0x72, 0x49, 0x64, 0x12, 0x12, 0x0a, 0x04, 0x74, 0x79, 0x70, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28,
+	0x09, 0x52, 0x04, 0x74, 0x79, 0x70, 0x65, 0x12, 0x1c, 0x0a, 0x09, 0x63, 0x6f, 0x6e, 0x66, 0x69,
+	0x72, 0x6d, 0x65, 0x64, 0x18, 0x03, 0x20, 0x01, 0x28, 0x08, 0x52, 0x09, 0x63, 0x6f, 0x6e, 0x66,
+	0x69, 0x72, 0x6d, 0x65, 0x64, 0x12, 0x1d, 0x0a, 0x0a, 0x63, 0x72, 0x65, 0x61, 0x74, 0x65, 0x64,
+	0x5f, 0x61, 0x74, 0x18, 0x04, 0x20, 0x01, 0x28, 0x03, 0x52, 0x09, 0x63, 0x72, 0x65, 0x61, 0x74,
+	0x65, 0x64, 0x41, 0x74, 0x22, 0xec, 0x02, 0x0a, 0x12, 0x57, 0x65, 0x62, 0x41, 0x75, 0x74, 0x68,
+	0x6e, 0x43, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x12, 0x23, 0x0a, 0x0d, 0x63,
+	0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01,
+	0x28, 0x0c, 0x52, 0x0c, 0x63, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x49, 0x64,
+	0x12, 0x29, 0x0a, 0x10, 0x61, 0x74, 0x74, 0x65, 0x73, 0x74, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x5f,
+	0x74, 0x79, 0x70, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0f, 0x61, 0x74, 0x74, 0x65,
+	0x73, 0x74, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x54, 0x79, 0x70, 0x65, 0x12, 0x16, 0x0a, 0x06, 0x61,
+	0x61, 0x67, 0x75, 0x69, 0x64, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x06, 0x61, 0x61, 0x67,
+	0x75, 0x69, 0x64, 0x12, 0x1d, 0x0a, 0x0a, 0x73, 0x69, 0x67, 0x6e, 0x5f, 0x63, 0x6f, 0x75, 0x6e,
+	0x74, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x09, 0x73, 0x69, 0x67, 0x6e, 0x43, 0x6f, 0x75,
+	0x6e, 0x74, 0x12, 0x23, 0x0a, 0x0d, 0x63, 0x6c, 0x6f, 0x6e, 0x65, 0x5f, 0x77, 0x61, 0x72, 0x6e,
+	0x69, 0x6e, 0x67, 0x18, 0x05, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0c, 0x63, 0x6c, 0x6f, 0x6e, 0x65,
+	0x57, 0x61, 0x72, 0x6e, 0x69, 0x6e, 0x67, 0x12, 0x1c, 0x0a, 0x09, 0x74, 0x72, 0x61, 0x6e, 0x73,
+	0x70, 0x6f, 0x72, 0x74, 0x18, 0x06, 0x20, 0x03, 0x28, 0x09, 0x52, 0x09, 0x74, 0x72, 0x61, 0x6e,
+	0x73, 0x70, 0x6f, 0x72, 0x74, 0x12, 0x27, 0x0a, 0x0f, 0x62, 0x61, 0x63, 0x6b, 0x75, 0x70, 0x5f,
+	0x65, 0x6c, 0x69, 0x67, 0x69, 0x62, 0x6c, 0x65, 0x18, 0x07, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0e,
+	0x62, 0x61, 0x63, 0x6b, 0x75, 0x70, 0x45, 0x6c, 0x69, 0x67, 0x69, 0x62, 0x6c, 0x65, 0x12, 0x21,
+	0x0a, 0x0c, 0x62, 0x61, 0x63, 0x6b, 0x75, 0x70, 0x5f, 0x73, 0x74, 0x61, 0x74, 0x65, 0x18, 0x08,
+	0x20, 0x01, 0x28, 0x08, 0x52, 0x0b, 0x62, 0x61, 0x63, 0x6b, 0x75, 0x70, 0x53, 0x74, 0x61, 0x74,
+	0x65, 0x12, 0x21, 0x0a, 0x0c, 0x64, 0x69, 0x73, 0x70, 0x6c, 0x61, 0x79, 0x5f, 0x6e, 0x61, 0x6d,
+	0x65, 0x18, 0x09, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x64, 0x69, 0x73, 0x70, 0x6c, 0x61, 0x79,
+	0x4e, 0x61, 0x6d, 0x65, 0x12, 0x1d, 0x0a, 0x0a, 0x63, 0x72, 0x65, 0x61, 0x74, 0x65, 0x64, 0x5f,
+	0x61, 0x74, 0x18, 0x0a, 0x20, 0x01, 0x28, 0x03, 0x52, 0x09, 0x63, 0x72, 0x65, 0x61, 0x74, 0x65,
+	0x64, 0x41, 0x74, 0x22, 0xb5, 0x01, 0x0a, 0x0d, 0x4d, 0x46, 0x41, 0x44, 0x65, 0x76, 0x69, 0x63,
+	0x65, 0x49, 0x6e, 0x66, 0x6f, 0x12, 0x29, 0x0a, 0x10, 0x61, 0x75, 0x74, 0x68, 0x65, 0x6e, 0x74,
+	0x69, 0x63, 0x61, 0x74, 0x6f, 0x72, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52,
+	0x0f, 0x61, 0x75, 0x74, 0x68, 0x65, 0x6e, 0x74, 0x69, 0x63, 0x61, 0x74, 0x6f, 0x72, 0x49, 0x64,
+	0x12, 0x2d, 0x0a, 0x0a, 0x6d, 0x66, 0x61, 0x5f, 0x73, 0x65, 0x63, 0x72, 0x65, 0x74, 0x18, 0x02,
+	0x20, 0x01, 0x28, 0x0b, 0x32, 0x0e, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x4d, 0x46, 0x41, 0x53, 0x65,
+	0x63, 0x72, 0x65, 0x74, 0x52, 0x09, 0x6d, 0x66, 0x61, 0x53, 0x65, 0x63, 0x72, 0x65, 0x74, 0x12,
+	0x4a, 0x0a, 0x14, 0x77, 0x65, 0x62, 0x61, 0x75, 0x74, 0x68, 0x6e, 0x5f, 0x63, 0x72, 0x65, 0x64,
+	0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x73, 0x18, 0x03, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x17, 0x2e,
+	0x61, 0x70, 0x69, 0x2e, 0x57, 0x65, 0x62, 0x41, 0x75, 0x74, 0x68, 0x6e, 0x43, 0x72, 0x65, 0x64,
+	0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x52, 0x13, 0x77, 0x65, 0x62, 0x61, 0x75, 0x74, 0x68, 0x6e,
+	0x43, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x73, 0x22, 0x82, 0x03, 0x0a, 0x0c,
+	0x55, 0x73, 0x65, 0x72, 0x49, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x74, 0x79, 0x12, 0x17, 0x0a, 0x07,
+	0x75, 0x73, 0x65, 0x72, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x75,
+	0x73, 0x65, 0x72, 0x49, 0x64, 0x12, 0x21, 0x0a, 0x0c, 0x63, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74,
+	0x6f, 0x72, 0x5f, 0x69, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x63, 0x6f, 0x6e,
+	0x6e, 0x65, 0x63, 0x74, 0x6f, 0x72, 0x49, 0x64, 0x12, 0x14, 0x0a, 0x05, 0x65, 0x6d, 0x61, 0x69,
+	0x6c, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x65, 0x6d, 0x61, 0x69, 0x6c, 0x12, 0x25,
+	0x0a, 0x0e, 0x65, 0x6d, 0x61, 0x69, 0x6c, 0x5f, 0x76, 0x65, 0x72, 0x69, 0x66, 0x69, 0x65, 0x64,
+	0x18, 0x04, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0d, 0x65, 0x6d, 0x61, 0x69, 0x6c, 0x56, 0x65, 0x72,
+	0x69, 0x66, 0x69, 0x65, 0x64, 0x12, 0x1a, 0x0a, 0x08, 0x75, 0x73, 0x65, 0x72, 0x6e, 0x61, 0x6d,
+	0x65, 0x18, 0x05, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x75, 0x73, 0x65, 0x72, 0x6e, 0x61, 0x6d,
+	0x65, 0x12, 0x16, 0x0a, 0x06, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x73, 0x18, 0x06, 0x20, 0x03, 0x28,
+	0x09, 0x52, 0x06, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x73, 0x12, 0x2d, 0x0a, 0x08, 0x63, 0x6f, 0x6e,
+	0x73, 0x65, 0x6e, 0x74, 0x73, 0x18, 0x07, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x11, 0x2e, 0x61, 0x70,
+	0x69, 0x2e, 0x43, 0x6f, 0x6e, 0x73, 0x65, 0x6e, 0x74, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x52, 0x08,
+	0x63, 0x6f, 0x6e, 0x73, 0x65, 0x6e, 0x74, 0x73, 0x12, 0x33, 0x0a, 0x0b, 0x6d, 0x66, 0x61, 0x5f,
+	0x64, 0x65, 0x76, 0x69, 0x63, 0x65, 0x73, 0x18, 0x08, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x12, 0x2e,
+	0x61, 0x70, 0x69, 0x2e, 0x4d, 0x46, 0x41, 0x44, 0x65, 0x76, 0x69, 0x63, 0x65, 0x49, 0x6e, 0x66,
+	0x6f, 0x52, 0x0a, 0x6d, 0x66, 0x61, 0x44, 0x65, 0x76, 0x69, 0x63, 0x65, 0x73, 0x12, 0x1d, 0x0a,
+	0x0a, 0x63, 0x72, 0x65, 0x61, 0x74, 0x65, 0x64, 0x5f, 0x61, 0x74, 0x18, 0x09, 0x20, 0x01, 0x28,
+	0x03, 0x52, 0x09, 0x63, 0x72, 0x65, 0x61, 0x74, 0x65, 0x64, 0x41, 0x74, 0x12, 0x1d, 0x0a, 0x0a,
+	0x6c, 0x61, 0x73, 0x74, 0x5f, 0x6c, 0x6f, 0x67, 0x69, 0x6e, 0x18, 0x0a, 0x20, 0x01, 0x28, 0x03,
+	0x52, 0x09, 0x6c, 0x61, 0x73, 0x74, 0x4c, 0x6f, 0x67, 0x69, 0x6e, 0x12, 0x23, 0x0a, 0x0d, 0x62,
+	0x6c, 0x6f, 0x63, 0x6b, 0x65, 0x64, 0x5f, 0x75, 0x6e, 0x74, 0x69, 0x6c, 0x18, 0x0b, 0x20, 0x01,
+	0x28, 0x03, 0x52, 0x0c, 0x62, 0x6c, 0x6f, 0x63, 0x6b, 0x65, 0x64, 0x55, 0x6e, 0x74, 0x69, 0x6c,
+	0x22, 0x50, 0x0a, 0x12, 0x47, 0x65, 0x74, 0x55, 0x73, 0x65, 0x72, 0x49, 0x64, 0x65, 0x6e, 0x74,
+	0x69, 0x74, 0x79, 0x52, 0x65, 0x71, 0x12, 0x17, 0x0a, 0x07, 0x75, 0x73, 0x65, 0x72, 0x5f, 0x69,
+	0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x75, 0x73, 0x65, 0x72, 0x49, 0x64, 0x12,
+	0x21, 0x0a, 0x0c, 0x63, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x6f, 0x72, 0x5f, 0x69, 0x64, 0x18,
+	0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x63, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x6f, 0x72,
+	0x49, 0x64, 0x22, 0x44, 0x0a, 0x13, 0x47, 0x65, 0x74, 0x55, 0x73, 0x65, 0x72, 0x49, 0x64, 0x65,
+	0x6e, 0x74, 0x69, 0x74, 0x79, 0x52, 0x65, 0x73, 0x70, 0x12, 0x2d, 0x0a, 0x08, 0x69, 0x64, 0x65,
+	0x6e, 0x74, 0x69, 0x74, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x11, 0x2e, 0x61, 0x70,
+	0x69, 0x2e, 0x55, 0x73, 0x65, 0x72, 0x49, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x74, 0x79, 0x52, 0x08,
+	0x69, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x74, 0x79, 0x22, 0x17, 0x0a, 0x15, 0x4c, 0x69, 0x73, 0x74,
+	0x55, 0x73, 0x65, 0x72, 0x49, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x74, 0x69, 0x65, 0x73, 0x52, 0x65,
+	0x71, 0x22, 0x4b, 0x0a, 0x16, 0x4c, 0x69, 0x73, 0x74, 0x55, 0x73, 0x65, 0x72, 0x49, 0x64, 0x65,
+	0x6e, 0x74, 0x69, 0x74, 0x69, 0x65, 0x73, 0x52, 0x65, 0x73, 0x70, 0x12, 0x31, 0x0a, 0x0a, 0x69,
+	0x64, 0x65, 0x6e, 0x74, 0x69, 0x74, 0x69, 0x65, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32,
+	0x11, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x55, 0x73, 0x65, 0x72, 0x49, 0x64, 0x65, 0x6e, 0x74, 0x69,
+	0x74, 0x79, 0x52, 0x0a, 0x69, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x74, 0x69, 0x65, 0x73, 0x22, 0x53,
+	0x0a, 0x15, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x55, 0x73, 0x65, 0x72, 0x49, 0x64, 0x65, 0x6e,
+	0x74, 0x69, 0x74, 0x79, 0x52, 0x65, 0x71, 0x12, 0x17, 0x0a, 0x07, 0x75, 0x73, 0x65, 0x72, 0x5f,
+	0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x75, 0x73, 0x65, 0x72, 0x49, 0x64,
+	0x12, 0x21, 0x0a, 0x0c, 0x63, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x6f, 0x72, 0x5f, 0x69, 0x64,
+	0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x63, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x6f,
+	0x72, 0x49, 0x64, 0x22, 0x35, 0x0a, 0x16, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x55, 0x73, 0x65,
+	0x72, 0x49, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x74, 0x79, 0x52, 0x65, 0x73, 0x70, 0x12, 0x1b, 0x0a,
+	0x09, 0x6e, 0x6f, 0x74, 0x5f, 0x66, 0x6f, 0x75, 0x6e, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x08,
+	0x52, 0x08, 0x6e, 0x6f, 0x74, 0x46, 0x6f, 0x75, 0x6e, 0x64, 0x22, 0x49, 0x0a, 0x0b, 0x52, 0x65,
+	0x73, 0x65, 0x74, 0x4d, 0x46, 0x41, 0x52, 0x65, 0x71, 0x12, 0x17, 0x0a, 0x07, 0x75, 0x73, 0x65,
+	0x72, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x75, 0x73, 0x65, 0x72,
+	0x49, 0x64, 0x12, 0x21, 0x0a, 0x0c, 0x63, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x6f, 0x72, 0x5f,
+	0x69, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x63, 0x6f, 0x6e, 0x6e, 0x65, 0x63,
+	0x74, 0x6f, 0x72, 0x49, 0x64, 0x22, 0x2b, 0x0a, 0x0c, 0x52, 0x65, 0x73, 0x65, 0x74, 0x4d, 0x46,
+	0x41, 0x52, 0x65, 0x73, 0x70, 0x12, 0x1b, 0x0a, 0x09, 0x6e, 0x6f, 0x74, 0x5f, 0x66, 0x6f, 0x75,
+	0x6e, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x08, 0x52, 0x08, 0x6e, 0x6f, 0x74, 0x46, 0x6f, 0x75,
+	0x6e, 0x64, 0x22, 0x4f, 0x0a, 0x11, 0x4c, 0x69, 0x73, 0x74, 0x4d, 0x46, 0x41, 0x44, 0x65, 0x76,
+	0x69, 0x63, 0x65, 0x73, 0x52, 0x65, 0x71, 0x12, 0x17, 0x0a, 0x07, 0x75, 0x73, 0x65, 0x72, 0x5f,
+	0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x75, 0x73, 0x65, 0x72, 0x49, 0x64,
+	0x12, 0x21, 0x0a, 0x0c, 0x63, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x6f, 0x72, 0x5f, 0x69, 0x64,
+	0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x63, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x6f,
+	0x72, 0x49, 0x64, 0x22, 0x42, 0x0a, 0x12, 0x4c, 0x69, 0x73, 0x74, 0x4d, 0x46, 0x41, 0x44, 0x65,
+	0x76, 0x69, 0x63, 0x65, 0x73, 0x52, 0x65, 0x73, 0x70, 0x12, 0x2c, 0x0a, 0x07, 0x64, 0x65, 0x76,
+	0x69, 0x63, 0x65, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x12, 0x2e, 0x61, 0x70, 0x69,
+	0x2e, 0x4d, 0x46, 0x41, 0x44, 0x65, 0x76, 0x69, 0x63, 0x65, 0x49, 0x6e, 0x66, 0x6f, 0x52, 0x07,
+	0x64, 0x65, 0x76, 0x69, 0x63, 0x65, 0x73, 0x22, 0x7e, 0x0a, 0x1b, 0x44, 0x65, 0x6c, 0x65, 0x74,
+	0x65, 0x57, 0x65, 0x62, 0x41, 0x75, 0x74, 0x68, 0x6e, 0x43, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74,
+	0x69, 0x61, 0x6c, 0x52, 0x65, 0x71, 0x12, 0x17, 0x0a, 0x07, 0x75, 0x73, 0x65, 0x72, 0x5f, 0x69,
+	0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x75, 0x73, 0x65, 0x72, 0x49, 0x64, 0x12,
+	0x21, 0x0a, 0x0c, 0x63, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x6f, 0x72, 0x5f, 0x69, 0x64, 0x18,
+	0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x63, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x6f, 0x72,
+	0x49, 0x64, 0x12, 0x23, 0x0a, 0x0d, 0x63, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c,
+	0x5f, 0x69, 0x64, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x0c, 0x63, 0x72, 0x65, 0x64, 0x65,
+	0x6e, 0x74, 0x69, 0x61, 0x6c, 0x49, 0x64, 0x22, 0x3b, 0x0a, 0x1c, 0x44, 0x65, 0x6c, 0x65, 0x74,
+	0x65, 0x57, 0x65, 0x62, 0x41, 0x75, 0x74, 0x68, 0x6e, 0x43, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74,
+	0x69, 0x61, 0x6c, 0x52, 0x65, 0x73, 0x70, 0x12, 0x1b, 0x0a, 0x09, 0x6e, 0x6f, 0x74, 0x5f, 0x66,
+	0x6f, 0x75, 0x6e, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x08, 0x52, 0x08, 0x6e, 0x6f, 0x74, 0x46,
+	0x6f, 0x75, 0x6e, 0x64, 0x22, 0x7b, 0x0a, 0x12, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x4d, 0x46,
+	0x41, 0x53, 0x65, 0x63, 0x72, 0x65, 0x74, 0x52, 0x65, 0x71, 0x12, 0x17, 0x0a, 0x07, 0x75, 0x73,
+	0x65, 0x72, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x75, 0x73, 0x65,
+	0x72, 0x49, 0x64, 0x12, 0x21, 0x0a, 0x0c, 0x63, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x6f, 0x72,
+	0x5f, 0x69, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x63, 0x6f, 0x6e, 0x6e, 0x65,
+	0x63, 0x74, 0x6f, 0x72, 0x49, 0x64, 0x12, 0x29, 0x0a, 0x10, 0x61, 0x75, 0x74, 0x68, 0x65, 0x6e,
+	0x74, 0x69, 0x63, 0x61, 0x74, 0x6f, 0x72, 0x5f, 0x69, 0x64, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09,
+	0x52, 0x0f, 0x61, 0x75, 0x74, 0x68, 0x65, 0x6e, 0x74, 0x69, 0x63, 0x61, 0x74, 0x6f, 0x72, 0x49,
+	0x64, 0x22, 0x32, 0x0a, 0x13, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x4d, 0x46, 0x41, 0x53, 0x65,
+	0x63, 0x72, 0x65, 0x74, 0x52, 0x65, 0x73, 0x70, 0x12, 0x1b, 0x0a, 0x09, 0x6e, 0x6f, 0x74, 0x5f,
+	0x66, 0x6f, 0x75, 0x6e, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x08, 0x52, 0x08, 0x6e, 0x6f, 0x74,
+	0x46, 0x6f, 0x75, 0x6e, 0x64, 0x22, 0x6b, 0x0a, 0x10, 0x52, 0x65, 0x76, 0x6f, 0x6b, 0x65, 0x43,
+	0x6f, 0x6e, 0x73, 0x65, 0x6e, 0x74, 0x52, 0x65, 0x71, 0x12, 0x17, 0x0a, 0x07, 0x75, 0x73, 0x65,
+	0x72, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x75, 0x73, 0x65, 0x72,
+	0x49, 0x64, 0x12, 0x21, 0x0a, 0x0c, 0x63, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x6f, 0x72, 0x5f,
+	0x69, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x63, 0x6f, 0x6e, 0x6e, 0x65, 0x63,
+	0x74, 0x6f, 0x72, 0x49, 0x64, 0x12, 0x1b, 0x0a, 0x09, 0x63, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x5f,
+	0x69, 0x64, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x63, 0x6c, 0x69, 0x65, 0x6e, 0x74,
+	0x49, 0x64, 0x22, 0x30, 0x0a, 0x11, 0x52, 0x65, 0x76, 0x6f, 0x6b, 0x65, 0x43, 0x6f, 0x6e, 0x73,
+	0x65, 0x6e, 0x74, 0x52, 0x65, 0x73, 0x70, 0x12, 0x1b, 0x0a, 0x09, 0x6e, 0x6f, 0x74, 0x5f, 0x66,
+	0x6f, 0x75, 0x6e, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x08, 0x52, 0x08, 0x6e, 0x6f, 0x74, 0x46,
+	0x6f, 0x75, 0x6e, 0x64, 0x32, 0x87, 0x11, 0x0a, 0x03, 0x44, 0x65, 0x78, 0x12, 0x34, 0x0a, 0x09,
+	0x47, 0x65, 0x74, 0x43, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x12, 0x11, 0x2e, 0x61, 0x70, 0x69, 0x2e,
+	0x47, 0x65, 0x74, 0x43, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x52, 0x65, 0x71, 0x1a, 0x12, 0x2e, 0x61,
+	0x70, 0x69, 0x2e, 0x47, 0x65, 0x74, 0x43, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x52, 0x65, 0x73, 0x70,
+	0x22, 0x00, 0x12, 0x3d, 0x0a, 0x0c, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x43, 0x6c, 0x69, 0x65,
+	0x6e, 0x74, 0x12, 0x14, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x43,
+	0x6c, 0x69, 0x65, 0x6e, 0x74, 0x52, 0x65, 0x71, 0x1a, 0x15, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x43,
+	0x72, 0x65, 0x61, 0x74, 0x65, 0x43, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x52, 0x65, 0x73, 0x70, 0x22,
+	0x00, 0x12, 0x3d, 0x0a, 0x0c, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x43, 0x6c, 0x69, 0x65, 0x6e,
+	0x74, 0x12, 0x14, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x43, 0x6c,
+	0x69, 0x65, 0x6e, 0x74, 0x52, 0x65, 0x71, 0x1a, 0x15, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x55, 0x70,
+	0x64, 0x61, 0x74, 0x65, 0x43, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x52, 0x65, 0x73, 0x70, 0x22, 0x00,
+	0x12, 0x3d, 0x0a, 0x0c, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x43, 0x6c, 0x69, 0x65, 0x6e, 0x74,
+	0x12, 0x14, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x43, 0x6c, 0x69,
+	0x65, 0x6e, 0x74, 0x52, 0x65, 0x71, 0x1a, 0x15, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x44, 0x65, 0x6c,
+	0x65, 0x74, 0x65, 0x43, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x52, 0x65, 0x73, 0x70, 0x22, 0x00, 0x12,
+	0x38, 0x0a, 0x0b, 0x4c, 0x69, 0x73, 0x74, 0x43, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x73, 0x12, 0x12,
+	0x2e, 0x61, 0x70, 0x69, 0x2e, 0x4c, 0x69, 0x73, 0x74, 0x43, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x52,
+	0x65, 0x71, 0x1a, 0x13, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x4c, 0x69, 0x73, 0x74, 0x43, 0x6c, 0x69,
+	0x65, 0x6e, 0x74, 0x52, 0x65, 0x73, 0x70, 0x22, 0x00, 0x12, 0x43, 0x0a, 0x0e, 0x43, 0x72, 0x65,
+	0x61, 0x74, 0x65, 0x50, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x12, 0x16, 0x2e, 0x61, 0x70,
+	0x69, 0x2e, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x50, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64,
+	0x52, 0x65, 0x71, 0x1a, 0x17, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65,
+	0x50, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x52, 0x65, 0x73, 0x70, 0x22, 0x00, 0x12, 0x43,
+	0x0a, 0x0e, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x50, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64,
+	0x12, 0x16, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x50, 0x61, 0x73,
+	0x73, 0x77, 0x6f, 0x72, 0x64, 0x52, 0x65, 0x71, 0x1a, 0x17, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x55,
+	0x70, 0x64, 0x61, 0x74, 0x65, 0x50, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x52, 0x65, 0x73,
+	0x70, 0x22, 0x00, 0x12, 0x43, 0x0a, 0x0e, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x50, 0x61, 0x73,
+	0x73, 0x77, 0x6f, 0x72, 0x64, 0x12, 0x16, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x44, 0x65, 0x6c, 0x65,
+	0x74, 0x65, 0x50, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x52, 0x65, 0x71, 0x1a, 0x17, 0x2e,
+	0x61, 0x70, 0x69, 0x2e, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x50, 0x61, 0x73, 0x73, 0x77, 0x6f,
+	0x72, 0x64, 0x52, 0x65, 0x73, 0x70, 0x22, 0x00, 0x12, 0x3e, 0x0a, 0x0d, 0x4c, 0x69, 0x73, 0x74,
+	0x50, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x73, 0x12, 0x14, 0x2e, 0x61, 0x70, 0x69, 0x2e,
+	0x4c, 0x69, 0x73, 0x74, 0x50, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x52, 0x65, 0x71, 0x1a,
+	0x15, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x4c, 0x69, 0x73, 0x74, 0x50, 0x61, 0x73, 0x73, 0x77, 0x6f,
+	0x72, 0x64, 0x52, 0x65, 0x73, 0x70, 0x22, 0x00, 0x12, 0x46, 0x0a, 0x0f, 0x43, 0x72, 0x65, 0x61,
+	0x74, 0x65, 0x43, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x6f, 0x72, 0x12, 0x17, 0x2e, 0x61, 0x70,
+	0x69, 0x2e, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x43, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x6f,
+	0x72, 0x52, 0x65, 0x71, 0x1a, 0x18, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x43, 0x72, 0x65, 0x61, 0x74,
+	0x65, 0x43, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x6f, 0x72, 0x52, 0x65, 0x73, 0x70, 0x22, 0x00,
+	0x12, 0x46, 0x0a, 0x0f, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x43, 0x6f, 0x6e, 0x6e, 0x65, 0x63,
+	0x74, 0x6f, 0x72, 0x12, 0x17, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65,
+	0x43, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x6f, 0x72, 0x52, 0x65, 0x71, 0x1a, 0x18, 0x2e, 0x61,
+	0x70, 0x69, 0x2e, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x43, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74,
+	0x6f, 0x72, 0x52, 0x65, 0x73, 0x70, 0x22, 0x00, 0x12, 0x46, 0x0a, 0x0f, 0x44, 0x65, 0x6c, 0x65,
+	0x74, 0x65, 0x43, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x6f, 0x72, 0x12, 0x17, 0x2e, 0x61, 0x70,
+	0x69, 0x2e, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x43, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x6f,
+	0x72, 0x52, 0x65, 0x71, 0x1a, 0x18, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x44, 0x65, 0x6c, 0x65, 0x74,
+	0x65, 0x43, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x6f, 0x72, 0x52, 0x65, 0x73, 0x70, 0x22, 0x00,
+	0x12, 0x41, 0x0a, 0x0e, 0x4c, 0x69, 0x73, 0x74, 0x43, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x6f,
+	0x72, 0x73, 0x12, 0x15, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x4c, 0x69, 0x73, 0x74, 0x43, 0x6f, 0x6e,
+	0x6e, 0x65, 0x63, 0x74, 0x6f, 0x72, 0x52, 0x65, 0x71, 0x1a, 0x16, 0x2e, 0x61, 0x70, 0x69, 0x2e,
+	0x4c, 0x69, 0x73, 0x74, 0x43, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x6f, 0x72, 0x52, 0x65, 0x73,
+	0x70, 0x22, 0x00, 0x12, 0x31, 0x0a, 0x0a, 0x47, 0x65, 0x74, 0x56, 0x65, 0x72, 0x73, 0x69, 0x6f,
+	0x6e, 0x12, 0x0f, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x56, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x52,
+	0x65, 0x71, 0x1a, 0x10, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x56, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e,
+	0x52, 0x65, 0x73, 0x70, 0x22, 0x00, 0x12, 0x37, 0x0a, 0x0c, 0x47, 0x65, 0x74, 0x44, 0x69, 0x73,
+	0x63, 0x6f, 0x76, 0x65, 0x72, 0x79, 0x12, 0x11, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x44, 0x69, 0x73,
+	0x63, 0x6f, 0x76, 0x65, 0x72, 0x79, 0x52, 0x65, 0x71, 0x1a, 0x12, 0x2e, 0x61, 0x70, 0x69, 0x2e,
+	0x44, 0x69, 0x73, 0x63, 0x6f, 0x76, 0x65, 0x72, 0x79, 0x52, 0x65, 0x73, 0x70, 0x22, 0x00, 0x12,
+	0x3a, 0x0a, 0x0b, 0x4c, 0x69, 0x73, 0x74, 0x52, 0x65, 0x66, 0x72, 0x65, 0x73, 0x68, 0x12, 0x13,
+	0x2e, 0x61, 0x70, 0x69, 0x2e, 0x4c, 0x69, 0x73, 0x74, 0x52, 0x65, 0x66, 0x72, 0x65, 0x73, 0x68,
+	0x52, 0x65, 0x71, 0x1a, 0x14, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x4c, 0x69, 0x73, 0x74, 0x52, 0x65,
+	0x66, 0x72, 0x65, 0x73, 0x68, 0x52, 0x65, 0x73, 0x70, 0x22, 0x00, 0x12, 0x40, 0x0a, 0x0d, 0x52,
+	0x65, 0x76, 0x6f, 0x6b, 0x65, 0x52, 0x65, 0x66, 0x72, 0x65, 0x73, 0x68, 0x12, 0x15, 0x2e, 0x61,
+	0x70, 0x69, 0x2e, 0x52, 0x65, 0x76, 0x6f, 0x6b, 0x65, 0x52, 0x65, 0x66, 0x72, 0x65, 0x73, 0x68,
+	0x52, 0x65, 0x71, 0x1a, 0x16, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x52, 0x65, 0x76, 0x6f, 0x6b, 0x65,
+	0x52, 0x65, 0x66, 0x72, 0x65, 0x73, 0x68, 0x52, 0x65, 0x73, 0x70, 0x22, 0x00, 0x12, 0x43, 0x0a,
+	0x0e, 0x56, 0x65, 0x72, 0x69, 0x66, 0x79, 0x50, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x12,
+	0x16, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x56, 0x65, 0x72, 0x69, 0x66, 0x79, 0x50, 0x61, 0x73, 0x73,
+	0x77, 0x6f, 0x72, 0x64, 0x52, 0x65, 0x71, 0x1a, 0x17, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x56, 0x65,
+	0x72, 0x69, 0x66, 0x79, 0x50, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x52, 0x65, 0x73, 0x70,
+	0x22, 0x00, 0x12, 0x43, 0x0a, 0x0e, 0x47, 0x65, 0x74, 0x41, 0x75, 0x74, 0x68, 0x53, 0x65, 0x73,
+	0x73, 0x69, 0x6f, 0x6e, 0x12, 0x16, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x47, 0x65, 0x74, 0x41, 0x75,
+	0x74, 0x68, 0x53, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x71, 0x1a, 0x17, 0x2e, 0x61,
+	0x70, 0x69, 0x2e, 0x47, 0x65, 0x74, 0x41, 0x75, 0x74, 0x68, 0x53, 0x65, 0x73, 0x73, 0x69, 0x6f,
+	0x6e, 0x52, 0x65, 0x73, 0x70, 0x22, 0x00, 0x12, 0x49, 0x0a, 0x10, 0x4c, 0x69, 0x73, 0x74, 0x41,
+	0x75, 0x74, 0x68, 0x53, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x73, 0x12, 0x18, 0x2e, 0x61, 0x70,
+	0x69, 0x2e, 0x4c, 0x69, 0x73, 0x74, 0x41, 0x75, 0x74, 0x68, 0x53, 0x65, 0x73, 0x73, 0x69, 0x6f,
+	0x6e, 0x73, 0x52, 0x65, 0x71, 0x1a, 0x19, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x4c, 0x69, 0x73, 0x74,
+	0x41, 0x75, 0x74, 0x68, 0x53, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x73, 0x52, 0x65, 0x73, 0x70,
+	0x22, 0x00, 0x12, 0x4c, 0x0a, 0x11, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x41, 0x75, 0x74, 0x68,
+	0x53, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x12, 0x19, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x44, 0x65,
+	0x6c, 0x65, 0x74, 0x65, 0x41, 0x75, 0x74, 0x68, 0x53, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x52,
+	0x65, 0x71, 0x1a, 0x1a, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x41,
+	0x75, 0x74, 0x68, 0x53, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x73, 0x70, 0x22, 0x00,
+	0x12, 0x6d, 0x0a, 0x1c, 0x54, 0x65, 0x72, 0x6d, 0x69, 0x6e, 0x61, 0x74, 0x65, 0x53, 0x65, 0x73,
+	0x73, 0x69, 0x6f, 0x6e, 0x73, 0x42, 0x79, 0x43, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x6f, 0x72,
+	0x12, 0x24, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x54, 0x65, 0x72, 0x6d, 0x69, 0x6e, 0x61, 0x74, 0x65,
+	0x53, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x73, 0x42, 0x79, 0x43, 0x6f, 0x6e, 0x6e, 0x65, 0x63,
+	0x74, 0x6f, 0x72, 0x52, 0x65, 0x71, 0x1a, 0x25, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x54, 0x65, 0x72,
+	0x6d, 0x69, 0x6e, 0x61, 0x74, 0x65, 0x53, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x73, 0x42, 0x79,
+	0x43, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x6f, 0x72, 0x52, 0x65, 0x73, 0x70, 0x22, 0x00, 0x12,
+	0x5e, 0x0a, 0x17, 0x54, 0x65, 0x72, 0x6d, 0x69, 0x6e, 0x61, 0x74, 0x65, 0x53, 0x65, 0x73, 0x73,
+	0x69, 0x6f, 0x6e, 0x73, 0x42, 0x79, 0x55, 0x73, 0x65, 0x72, 0x12, 0x1f, 0x2e, 0x61, 0x70, 0x69,
+	0x2e, 0x54, 0x65, 0x72, 0x6d, 0x69, 0x6e, 0x61, 0x74, 0x65, 0x53, 0x65, 0x73, 0x73, 0x69, 0x6f,
+	0x6e, 0x73, 0x42, 0x79, 0x55, 0x73, 0x65, 0x72, 0x52, 0x65, 0x71, 0x1a, 0x20, 0x2e, 0x61, 0x70,
+	0x69, 0x2e, 0x54, 0x65, 0x72, 0x6d, 0x69, 0x6e, 0x61, 0x74, 0x65, 0x53, 0x65, 0x73, 0x73, 0x69,
+	0x6f, 0x6e, 0x73, 0x42, 0x79, 0x55, 0x73, 0x65, 0x72, 0x52, 0x65, 0x73, 0x70, 0x22, 0x00, 0x12,
+	0x46, 0x0a, 0x0f, 0x47, 0x65, 0x74, 0x55, 0x73, 0x65, 0x72, 0x49, 0x64, 0x65, 0x6e, 0x74, 0x69,
+	0x74, 0x79, 0x12, 0x17, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x47, 0x65, 0x74, 0x55, 0x73, 0x65, 0x72,
+	0x49, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x74, 0x79, 0x52, 0x65, 0x71, 0x1a, 0x18, 0x2e, 0x61, 0x70,
+	0x69, 0x2e, 0x47, 0x65, 0x74, 0x55, 0x73, 0x65, 0x72, 0x49, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x74,
+	0x79, 0x52, 0x65, 0x73, 0x70, 0x22, 0x00, 0x12, 0x4f, 0x0a, 0x12, 0x4c, 0x69, 0x73, 0x74, 0x55,
+	0x73, 0x65, 0x72, 0x49, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x74, 0x69, 0x65, 0x73, 0x12, 0x1a, 0x2e,
+	0x61, 0x70, 0x69, 0x2e, 0x4c, 0x69, 0x73, 0x74, 0x55, 0x73, 0x65, 0x72, 0x49, 0x64, 0x65, 0x6e,
+	0x74, 0x69, 0x74, 0x69, 0x65, 0x73, 0x52, 0x65, 0x71, 0x1a, 0x1b, 0x2e, 0x61, 0x70, 0x69, 0x2e,
+	0x4c, 0x69, 0x73, 0x74, 0x55, 0x73, 0x65, 0x72, 0x49, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x74, 0x69,
+	0x65, 0x73, 0x52, 0x65, 0x73, 0x70, 0x22, 0x00, 0x12, 0x4f, 0x0a, 0x12, 0x44, 0x65, 0x6c, 0x65,
+	0x74, 0x65, 0x55, 0x73, 0x65, 0x72, 0x49, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x74, 0x79, 0x12, 0x1a,
+	0x2e, 0x61, 0x70, 0x69, 0x2e, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x55, 0x73, 0x65, 0x72, 0x49,
+	0x64, 0x65, 0x6e, 0x74, 0x69, 0x74, 0x79, 0x52, 0x65, 0x71, 0x1a, 0x1b, 0x2e, 0x61, 0x70, 0x69,
+	0x2e, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x55, 0x73, 0x65, 0x72, 0x49, 0x64, 0x65, 0x6e, 0x74,
+	0x69, 0x74, 0x79, 0x52, 0x65, 0x73, 0x70, 0x22, 0x00, 0x12, 0x31, 0x0a, 0x08, 0x52, 0x65, 0x73,
+	0x65, 0x74, 0x4d, 0x46, 0x41, 0x12, 0x10, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x52, 0x65, 0x73, 0x65,
+	0x74, 0x4d, 0x46, 0x41, 0x52, 0x65, 0x71, 0x1a, 0x11, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x52, 0x65,
+	0x73, 0x65, 0x74, 0x4d, 0x46, 0x41, 0x52, 0x65, 0x73, 0x70, 0x22, 0x00, 0x12, 0x43, 0x0a, 0x0e,
+	0x4c, 0x69, 0x73, 0x74, 0x4d, 0x46, 0x41, 0x44, 0x65, 0x76, 0x69, 0x63, 0x65, 0x73, 0x12, 0x16,
+	0x2e, 0x61, 0x70, 0x69, 0x2e, 0x4c, 0x69, 0x73, 0x74, 0x4d, 0x46, 0x41, 0x44, 0x65, 0x76, 0x69,
+	0x63, 0x65, 0x73, 0x52, 0x65, 0x71, 0x1a, 0x17, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x4c, 0x69, 0x73,
+	0x74, 0x4d, 0x46, 0x41, 0x44, 0x65, 0x76, 0x69, 0x63, 0x65, 0x73, 0x52, 0x65, 0x73, 0x70, 0x22,
+	0x00, 0x12, 0x61, 0x0a, 0x18, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x57, 0x65, 0x62, 0x41, 0x75,
+	0x74, 0x68, 0x6e, 0x43, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x12, 0x20, 0x2e,
+	0x61, 0x70, 0x69, 0x2e, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x57, 0x65, 0x62, 0x41, 0x75, 0x74,
+	0x68, 0x6e, 0x43, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x52, 0x65, 0x71, 0x1a,
+	0x21, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x57, 0x65, 0x62, 0x41,
+	0x75, 0x74, 0x68, 0x6e, 0x43, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x52, 0x65,
+	0x73, 0x70, 0x22, 0x00, 0x12, 0x46, 0x0a, 0x0f, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x4d, 0x46,
+	0x41, 0x53, 0x65, 0x63, 0x72, 0x65, 0x74, 0x12, 0x17, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x44, 0x65,
+	0x6c, 0x65, 0x74, 0x65, 0x4d, 0x46, 0x41, 0x53, 0x65, 0x63, 0x72, 0x65, 0x74, 0x52, 0x65, 0x71,
+	0x1a, 0x18, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x4d, 0x46, 0x41,
+	0x53, 0x65, 0x63, 0x72, 0x65, 0x74, 0x52, 0x65, 0x73, 0x70, 0x22, 0x00, 0x12, 0x40, 0x0a, 0x0d,
+	0x52, 0x65, 0x76, 0x6f, 0x6b, 0x65, 0x43, 0x6f, 0x6e, 0x73, 0x65, 0x6e, 0x74, 0x12, 0x15, 0x2e,
+	0x61, 0x70, 0x69, 0x2e, 0x52, 0x65, 0x76, 0x6f, 0x6b, 0x65, 0x43, 0x6f, 0x6e, 0x73, 0x65, 0x6e,
+	0x74, 0x52, 0x65, 0x71, 0x1a, 0x16, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x52, 0x65, 0x76, 0x6f, 0x6b,
+	0x65, 0x43, 0x6f, 0x6e, 0x73, 0x65, 0x6e, 0x74, 0x52, 0x65, 0x73, 0x70, 0x22, 0x00, 0x42, 0x36,
+	0x0a, 0x12, 0x63, 0x6f, 0x6d, 0x2e, 0x63, 0x6f, 0x72, 0x65, 0x6f, 0x73, 0x2e, 0x64, 0x65, 0x78,
+	0x2e, 0x61, 0x70, 0x69, 0x5a, 0x20, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d,
+	0x2f, 0x64, 0x65, 0x78, 0x69, 0x64, 0x70, 0x2f, 0x64, 0x65, 0x78, 0x2f, 0x61, 0x70, 0x69, 0x2f,
+	0x76, 0x32, 0x3b, 0x61, 0x70, 0x69, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+})
 
 var (
 	file_api_v2_api_proto_rawDescOnce sync.Once
-	file_api_v2_api_proto_rawDescData = file_api_v2_api_proto_rawDesc
+	file_api_v2_api_proto_rawDescData []byte
 )
 
 func file_api_v2_api_proto_rawDescGZIP() []byte {
 	file_api_v2_api_proto_rawDescOnce.Do(func() {
-		file_api_v2_api_proto_rawDescData = protoimpl.X.CompressGZIP(file_api_v2_api_proto_rawDescData)
+		file_api_v2_api_proto_rawDescData = protoimpl.X.CompressGZIP(unsafe.Slice(unsafe.StringData(file_api_v2_api_proto_rawDesc), len(file_api_v2_api_proto_rawDesc)))
 	})
 	return file_api_v2_api_proto_rawDescData
 }
 
-var file_api_v2_api_proto_msgTypes = make([]protoimpl.MessageInfo, 25)
-var file_api_v2_api_proto_goTypes = []interface{}{
-	(*Client)(nil),             // 0: api.Client
-	(*CreateClientReq)(nil),    // 1: api.CreateClientReq
-	(*CreateClientResp)(nil),   // 2: api.CreateClientResp
-	(*DeleteClientReq)(nil),    // 3: api.DeleteClientReq
-	(*DeleteClientResp)(nil),   // 4: api.DeleteClientResp
-	(*UpdateClientReq)(nil),    // 5: api.UpdateClientReq
-	(*UpdateClientResp)(nil),   // 6: api.UpdateClientResp
-	(*Password)(nil),           // 7: api.Password
-	(*CreatePasswordReq)(nil),  // 8: api.CreatePasswordReq
-	(*CreatePasswordResp)(nil), // 9: api.CreatePasswordResp
-	(*UpdatePasswordReq)(nil),  // 10: api.UpdatePasswordReq
-	(*UpdatePasswordResp)(nil), // 11: api.UpdatePasswordResp
-	(*DeletePasswordReq)(nil),  // 12: api.DeletePasswordReq
-	(*DeletePasswordResp)(nil), // 13: api.DeletePasswordResp
-	(*ListPasswordReq)(nil),    // 14: api.ListPasswordReq
-	(*ListPasswordResp)(nil),   // 15: api.ListPasswordResp
-	(*VersionReq)(nil),         // 16: api.VersionReq
-	(*VersionResp)(nil),        // 17: api.VersionResp
-	(*RefreshTokenRef)(nil),    // 18: api.RefreshTokenRef
-	(*ListRefreshReq)(nil),     // 19: api.ListRefreshReq
-	(*ListRefreshResp)(nil),    // 20: api.ListRefreshResp
-	(*RevokeRefreshReq)(nil),   // 21: api.RevokeRefreshReq
-	(*RevokeRefreshResp)(nil),  // 22: api.RevokeRefreshResp
-	(*VerifyPasswordReq)(nil),  // 23: api.VerifyPasswordReq
-	(*VerifyPasswordResp)(nil), // 24: api.VerifyPasswordResp
+var file_api_v2_api_proto_msgTypes = make([]protoimpl.MessageInfo, 75)
+var file_api_v2_api_proto_goTypes = []any{
+	(*Client)(nil),                           // 0: api.Client
+	(*ClientInfo)(nil),                       // 1: api.ClientInfo
+	(*GetClientReq)(nil),                     // 2: api.GetClientReq
+	(*GetClientResp)(nil),                    // 3: api.GetClientResp
+	(*CreateClientReq)(nil),                  // 4: api.CreateClientReq
+	(*CreateClientResp)(nil),                 // 5: api.CreateClientResp
+	(*DeleteClientReq)(nil),                  // 6: api.DeleteClientReq
+	(*DeleteClientResp)(nil),                 // 7: api.DeleteClientResp
+	(*UpdateClientReq)(nil),                  // 8: api.UpdateClientReq
+	(*UpdateClientResp)(nil),                 // 9: api.UpdateClientResp
+	(*ListClientReq)(nil),                    // 10: api.ListClientReq
+	(*ListClientResp)(nil),                   // 11: api.ListClientResp
+	(*Password)(nil),                         // 12: api.Password
+	(*CreatePasswordReq)(nil),                // 13: api.CreatePasswordReq
+	(*CreatePasswordResp)(nil),               // 14: api.CreatePasswordResp
+	(*UpdatePasswordReq)(nil),                // 15: api.UpdatePasswordReq
+	(*UpdatePasswordResp)(nil),               // 16: api.UpdatePasswordResp
+	(*DeletePasswordReq)(nil),                // 17: api.DeletePasswordReq
+	(*DeletePasswordResp)(nil),               // 18: api.DeletePasswordResp
+	(*ListPasswordReq)(nil),                  // 19: api.ListPasswordReq
+	(*ListPasswordResp)(nil),                 // 20: api.ListPasswordResp
+	(*Connector)(nil),                        // 21: api.Connector
+	(*CreateConnectorReq)(nil),               // 22: api.CreateConnectorReq
+	(*CreateConnectorResp)(nil),              // 23: api.CreateConnectorResp
+	(*GrantTypes)(nil),                       // 24: api.GrantTypes
+	(*UpdateConnectorReq)(nil),               // 25: api.UpdateConnectorReq
+	(*UpdateConnectorResp)(nil),              // 26: api.UpdateConnectorResp
+	(*DeleteConnectorReq)(nil),               // 27: api.DeleteConnectorReq
+	(*DeleteConnectorResp)(nil),              // 28: api.DeleteConnectorResp
+	(*ListConnectorReq)(nil),                 // 29: api.ListConnectorReq
+	(*ListConnectorResp)(nil),                // 30: api.ListConnectorResp
+	(*VersionReq)(nil),                       // 31: api.VersionReq
+	(*VersionResp)(nil),                      // 32: api.VersionResp
+	(*DiscoveryReq)(nil),                     // 33: api.DiscoveryReq
+	(*DiscoveryResp)(nil),                    // 34: api.DiscoveryResp
+	(*RefreshTokenRef)(nil),                  // 35: api.RefreshTokenRef
+	(*ListRefreshReq)(nil),                   // 36: api.ListRefreshReq
+	(*ListRefreshResp)(nil),                  // 37: api.ListRefreshResp
+	(*RevokeRefreshReq)(nil),                 // 38: api.RevokeRefreshReq
+	(*RevokeRefreshResp)(nil),                // 39: api.RevokeRefreshResp
+	(*VerifyPasswordReq)(nil),                // 40: api.VerifyPasswordReq
+	(*VerifyPasswordResp)(nil),               // 41: api.VerifyPasswordResp
+	(*ClientAuthState)(nil),                  // 42: api.ClientAuthState
+	(*AuthSession)(nil),                      // 43: api.AuthSession
+	(*GetAuthSessionReq)(nil),                // 44: api.GetAuthSessionReq
+	(*GetAuthSessionResp)(nil),               // 45: api.GetAuthSessionResp
+	(*ListAuthSessionsReq)(nil),              // 46: api.ListAuthSessionsReq
+	(*ListAuthSessionsResp)(nil),             // 47: api.ListAuthSessionsResp
+	(*DeleteAuthSessionReq)(nil),             // 48: api.DeleteAuthSessionReq
+	(*DeleteAuthSessionResp)(nil),            // 49: api.DeleteAuthSessionResp
+	(*TerminateSessionsByConnectorReq)(nil),  // 50: api.TerminateSessionsByConnectorReq
+	(*TerminateSessionsByConnectorResp)(nil), // 51: api.TerminateSessionsByConnectorResp
+	(*TerminateSessionsByUserReq)(nil),       // 52: api.TerminateSessionsByUserReq
+	(*TerminateSessionsByUserResp)(nil),      // 53: api.TerminateSessionsByUserResp
+	(*ConsentEntry)(nil),                     // 54: api.ConsentEntry
+	(*MFASecret)(nil),                        // 55: api.MFASecret
+	(*WebAuthnCredential)(nil),               // 56: api.WebAuthnCredential
+	(*MFADeviceInfo)(nil),                    // 57: api.MFADeviceInfo
+	(*UserIdentity)(nil),                     // 58: api.UserIdentity
+	(*GetUserIdentityReq)(nil),               // 59: api.GetUserIdentityReq
+	(*GetUserIdentityResp)(nil),              // 60: api.GetUserIdentityResp
+	(*ListUserIdentitiesReq)(nil),            // 61: api.ListUserIdentitiesReq
+	(*ListUserIdentitiesResp)(nil),           // 62: api.ListUserIdentitiesResp
+	(*DeleteUserIdentityReq)(nil),            // 63: api.DeleteUserIdentityReq
+	(*DeleteUserIdentityResp)(nil),           // 64: api.DeleteUserIdentityResp
+	(*ResetMFAReq)(nil),                      // 65: api.ResetMFAReq
+	(*ResetMFAResp)(nil),                     // 66: api.ResetMFAResp
+	(*ListMFADevicesReq)(nil),                // 67: api.ListMFADevicesReq
+	(*ListMFADevicesResp)(nil),               // 68: api.ListMFADevicesResp
+	(*DeleteWebAuthnCredentialReq)(nil),      // 69: api.DeleteWebAuthnCredentialReq
+	(*DeleteWebAuthnCredentialResp)(nil),     // 70: api.DeleteWebAuthnCredentialResp
+	(*DeleteMFASecretReq)(nil),               // 71: api.DeleteMFASecretReq
+	(*DeleteMFASecretResp)(nil),              // 72: api.DeleteMFASecretResp
+	(*RevokeConsentReq)(nil),                 // 73: api.RevokeConsentReq
+	(*RevokeConsentResp)(nil),                // 74: api.RevokeConsentResp
 }
 var file_api_v2_api_proto_depIdxs = []int32{
-	0,  // 0: api.CreateClientReq.client:type_name -> api.Client
-	0,  // 1: api.CreateClientResp.client:type_name -> api.Client
-	7,  // 2: api.CreatePasswordReq.password:type_name -> api.Password
-	7,  // 3: api.ListPasswordResp.passwords:type_name -> api.Password
-	18, // 4: api.ListRefreshResp.refresh_tokens:type_name -> api.RefreshTokenRef
-	1,  // 5: api.Dex.CreateClient:input_type -> api.CreateClientReq
-	5,  // 6: api.Dex.UpdateClient:input_type -> api.UpdateClientReq
-	3,  // 7: api.Dex.DeleteClient:input_type -> api.DeleteClientReq
-	8,  // 8: api.Dex.CreatePassword:input_type -> api.CreatePasswordReq
-	10, // 9: api.Dex.UpdatePassword:input_type -> api.UpdatePasswordReq
-	12, // 10: api.Dex.DeletePassword:input_type -> api.DeletePasswordReq
-	14, // 11: api.Dex.ListPasswords:input_type -> api.ListPasswordReq
-	16, // 12: api.Dex.GetVersion:input_type -> api.VersionReq
-	19, // 13: api.Dex.ListRefresh:input_type -> api.ListRefreshReq
-	21, // 14: api.Dex.RevokeRefresh:input_type -> api.RevokeRefreshReq
-	23, // 15: api.Dex.VerifyPassword:input_type -> api.VerifyPasswordReq
-	2,  // 16: api.Dex.CreateClient:output_type -> api.CreateClientResp
-	6,  // 17: api.Dex.UpdateClient:output_type -> api.UpdateClientResp
-	4,  // 18: api.Dex.DeleteClient:output_type -> api.DeleteClientResp
-	9,  // 19: api.Dex.CreatePassword:output_type -> api.CreatePasswordResp
-	11, // 20: api.Dex.UpdatePassword:output_type -> api.UpdatePasswordResp
-	13, // 21: api.Dex.DeletePassword:output_type -> api.DeletePasswordResp
-	15, // 22: api.Dex.ListPasswords:output_type -> api.ListPasswordResp
-	17, // 23: api.Dex.GetVersion:output_type -> api.VersionResp
-	20, // 24: api.Dex.ListRefresh:output_type -> api.ListRefreshResp
-	22, // 25: api.Dex.RevokeRefresh:output_type -> api.RevokeRefreshResp
-	24, // 26: api.Dex.VerifyPassword:output_type -> api.VerifyPasswordResp
-	16, // [16:27] is the sub-list for method output_type
-	5,  // [5:16] is the sub-list for method input_type
-	5,  // [5:5] is the sub-list for extension type_name
-	5,  // [5:5] is the sub-list for extension extendee
-	0,  // [0:5] is the sub-list for field type_name
+	0,  // 0: api.GetClientResp.client:type_name -> api.Client
+	0,  // 1: api.CreateClientReq.client:type_name -> api.Client
+	0,  // 2: api.CreateClientResp.client:type_name -> api.Client
+	1,  // 3: api.ListClientResp.clients:type_name -> api.ClientInfo
+	12, // 4: api.CreatePasswordReq.password:type_name -> api.Password
+	12, // 5: api.ListPasswordResp.passwords:type_name -> api.Password
+	21, // 6: api.CreateConnectorReq.connector:type_name -> api.Connector
+	24, // 7: api.UpdateConnectorReq.new_grant_types:type_name -> api.GrantTypes
+	21, // 8: api.ListConnectorResp.connectors:type_name -> api.Connector
+	35, // 9: api.ListRefreshResp.refresh_tokens:type_name -> api.RefreshTokenRef
+	42, // 10: api.AuthSession.client_states:type_name -> api.ClientAuthState
+	43, // 11: api.GetAuthSessionResp.session:type_name -> api.AuthSession
+	43, // 12: api.ListAuthSessionsResp.sessions:type_name -> api.AuthSession
+	55, // 13: api.MFADeviceInfo.mfa_secret:type_name -> api.MFASecret
+	56, // 14: api.MFADeviceInfo.webauthn_credentials:type_name -> api.WebAuthnCredential
+	54, // 15: api.UserIdentity.consents:type_name -> api.ConsentEntry
+	57, // 16: api.UserIdentity.mfa_devices:type_name -> api.MFADeviceInfo
+	58, // 17: api.GetUserIdentityResp.identity:type_name -> api.UserIdentity
+	58, // 18: api.ListUserIdentitiesResp.identities:type_name -> api.UserIdentity
+	57, // 19: api.ListMFADevicesResp.devices:type_name -> api.MFADeviceInfo
+	2,  // 20: api.Dex.GetClient:input_type -> api.GetClientReq
+	4,  // 21: api.Dex.CreateClient:input_type -> api.CreateClientReq
+	8,  // 22: api.Dex.UpdateClient:input_type -> api.UpdateClientReq
+	6,  // 23: api.Dex.DeleteClient:input_type -> api.DeleteClientReq
+	10, // 24: api.Dex.ListClients:input_type -> api.ListClientReq
+	13, // 25: api.Dex.CreatePassword:input_type -> api.CreatePasswordReq
+	15, // 26: api.Dex.UpdatePassword:input_type -> api.UpdatePasswordReq
+	17, // 27: api.Dex.DeletePassword:input_type -> api.DeletePasswordReq
+	19, // 28: api.Dex.ListPasswords:input_type -> api.ListPasswordReq
+	22, // 29: api.Dex.CreateConnector:input_type -> api.CreateConnectorReq
+	25, // 30: api.Dex.UpdateConnector:input_type -> api.UpdateConnectorReq
+	27, // 31: api.Dex.DeleteConnector:input_type -> api.DeleteConnectorReq
+	29, // 32: api.Dex.ListConnectors:input_type -> api.ListConnectorReq
+	31, // 33: api.Dex.GetVersion:input_type -> api.VersionReq
+	33, // 34: api.Dex.GetDiscovery:input_type -> api.DiscoveryReq
+	36, // 35: api.Dex.ListRefresh:input_type -> api.ListRefreshReq
+	38, // 36: api.Dex.RevokeRefresh:input_type -> api.RevokeRefreshReq
+	40, // 37: api.Dex.VerifyPassword:input_type -> api.VerifyPasswordReq
+	44, // 38: api.Dex.GetAuthSession:input_type -> api.GetAuthSessionReq
+	46, // 39: api.Dex.ListAuthSessions:input_type -> api.ListAuthSessionsReq
+	48, // 40: api.Dex.DeleteAuthSession:input_type -> api.DeleteAuthSessionReq
+	50, // 41: api.Dex.TerminateSessionsByConnector:input_type -> api.TerminateSessionsByConnectorReq
+	52, // 42: api.Dex.TerminateSessionsByUser:input_type -> api.TerminateSessionsByUserReq
+	59, // 43: api.Dex.GetUserIdentity:input_type -> api.GetUserIdentityReq
+	61, // 44: api.Dex.ListUserIdentities:input_type -> api.ListUserIdentitiesReq
+	63, // 45: api.Dex.DeleteUserIdentity:input_type -> api.DeleteUserIdentityReq
+	65, // 46: api.Dex.ResetMFA:input_type -> api.ResetMFAReq
+	67, // 47: api.Dex.ListMFADevices:input_type -> api.ListMFADevicesReq
+	69, // 48: api.Dex.DeleteWebAuthnCredential:input_type -> api.DeleteWebAuthnCredentialReq
+	71, // 49: api.Dex.DeleteMFASecret:input_type -> api.DeleteMFASecretReq
+	73, // 50: api.Dex.RevokeConsent:input_type -> api.RevokeConsentReq
+	3,  // 51: api.Dex.GetClient:output_type -> api.GetClientResp
+	5,  // 52: api.Dex.CreateClient:output_type -> api.CreateClientResp
+	9,  // 53: api.Dex.UpdateClient:output_type -> api.UpdateClientResp
+	7,  // 54: api.Dex.DeleteClient:output_type -> api.DeleteClientResp
+	11, // 55: api.Dex.ListClients:output_type -> api.ListClientResp
+	14, // 56: api.Dex.CreatePassword:output_type -> api.CreatePasswordResp
+	16, // 57: api.Dex.UpdatePassword:output_type -> api.UpdatePasswordResp
+	18, // 58: api.Dex.DeletePassword:output_type -> api.DeletePasswordResp
+	20, // 59: api.Dex.ListPasswords:output_type -> api.ListPasswordResp
+	23, // 60: api.Dex.CreateConnector:output_type -> api.CreateConnectorResp
+	26, // 61: api.Dex.UpdateConnector:output_type -> api.UpdateConnectorResp
+	28, // 62: api.Dex.DeleteConnector:output_type -> api.DeleteConnectorResp
+	30, // 63: api.Dex.ListConnectors:output_type -> api.ListConnectorResp
+	32, // 64: api.Dex.GetVersion:output_type -> api.VersionResp
+	34, // 65: api.Dex.GetDiscovery:output_type -> api.DiscoveryResp
+	37, // 66: api.Dex.ListRefresh:output_type -> api.ListRefreshResp
+	39, // 67: api.Dex.RevokeRefresh:output_type -> api.RevokeRefreshResp
+	41, // 68: api.Dex.VerifyPassword:output_type -> api.VerifyPasswordResp
+	45, // 69: api.Dex.GetAuthSession:output_type -> api.GetAuthSessionResp
+	47, // 70: api.Dex.ListAuthSessions:output_type -> api.ListAuthSessionsResp
+	49, // 71: api.Dex.DeleteAuthSession:output_type -> api.DeleteAuthSessionResp
+	51, // 72: api.Dex.TerminateSessionsByConnector:output_type -> api.TerminateSessionsByConnectorResp
+	53, // 73: api.Dex.TerminateSessionsByUser:output_type -> api.TerminateSessionsByUserResp
+	60, // 74: api.Dex.GetUserIdentity:output_type -> api.GetUserIdentityResp
+	62, // 75: api.Dex.ListUserIdentities:output_type -> api.ListUserIdentitiesResp
+	64, // 76: api.Dex.DeleteUserIdentity:output_type -> api.DeleteUserIdentityResp
+	66, // 77: api.Dex.ResetMFA:output_type -> api.ResetMFAResp
+	68, // 78: api.Dex.ListMFADevices:output_type -> api.ListMFADevicesResp
+	70, // 79: api.Dex.DeleteWebAuthnCredential:output_type -> api.DeleteWebAuthnCredentialResp
+	72, // 80: api.Dex.DeleteMFASecret:output_type -> api.DeleteMFASecretResp
+	74, // 81: api.Dex.RevokeConsent:output_type -> api.RevokeConsentResp
+	51, // [51:82] is the sub-list for method output_type
+	20, // [20:51] is the sub-list for method input_type
+	20, // [20:20] is the sub-list for extension type_name
+	20, // [20:20] is the sub-list for extension extendee
+	0,  // [0:20] is the sub-list for field type_name
 }
 
 func init() { file_api_v2_api_proto_init() }
@@ -1642,315 +5142,14 @@ func file_api_v2_api_proto_init() {
 	if File_api_v2_api_proto != nil {
 		return
 	}
-	if !protoimpl.UnsafeEnabled {
-		file_api_v2_api_proto_msgTypes[0].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*Client); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_api_v2_api_proto_msgTypes[1].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*CreateClientReq); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_api_v2_api_proto_msgTypes[2].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*CreateClientResp); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_api_v2_api_proto_msgTypes[3].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*DeleteClientReq); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_api_v2_api_proto_msgTypes[4].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*DeleteClientResp); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_api_v2_api_proto_msgTypes[5].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*UpdateClientReq); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_api_v2_api_proto_msgTypes[6].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*UpdateClientResp); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_api_v2_api_proto_msgTypes[7].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*Password); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_api_v2_api_proto_msgTypes[8].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*CreatePasswordReq); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_api_v2_api_proto_msgTypes[9].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*CreatePasswordResp); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_api_v2_api_proto_msgTypes[10].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*UpdatePasswordReq); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_api_v2_api_proto_msgTypes[11].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*UpdatePasswordResp); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_api_v2_api_proto_msgTypes[12].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*DeletePasswordReq); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_api_v2_api_proto_msgTypes[13].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*DeletePasswordResp); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_api_v2_api_proto_msgTypes[14].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*ListPasswordReq); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_api_v2_api_proto_msgTypes[15].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*ListPasswordResp); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_api_v2_api_proto_msgTypes[16].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*VersionReq); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_api_v2_api_proto_msgTypes[17].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*VersionResp); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_api_v2_api_proto_msgTypes[18].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*RefreshTokenRef); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_api_v2_api_proto_msgTypes[19].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*ListRefreshReq); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_api_v2_api_proto_msgTypes[20].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*ListRefreshResp); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_api_v2_api_proto_msgTypes[21].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*RevokeRefreshReq); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_api_v2_api_proto_msgTypes[22].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*RevokeRefreshResp); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_api_v2_api_proto_msgTypes[23].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*VerifyPasswordReq); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_api_v2_api_proto_msgTypes[24].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*VerifyPasswordResp); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-	}
+	file_api_v2_api_proto_msgTypes[8].OneofWrappers = []any{}
 	type x struct{}
 	out := protoimpl.TypeBuilder{
 		File: protoimpl.DescBuilder{
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
-			RawDescriptor: file_api_v2_api_proto_rawDesc,
+			RawDescriptor: unsafe.Slice(unsafe.StringData(file_api_v2_api_proto_rawDesc), len(file_api_v2_api_proto_rawDesc)),
 			NumEnums:      0,
-			NumMessages:   25,
+			NumMessages:   75,
 			NumExtensions: 0,
 			NumServices:   1,
 		},
@@ -1959,7 +5158,6 @@ func file_api_v2_api_proto_init() {
 		MessageInfos:      file_api_v2_api_proto_msgTypes,
 	}.Build()
 	File_api_v2_api_proto = out.File
-	file_api_v2_api_proto_rawDesc = nil
 	file_api_v2_api_proto_goTypes = nil
 	file_api_v2_api_proto_depIdxs = nil
 }
diff --git a/api/v2/api.proto b/api/v2/api.proto
index 82a2e2afa1..93c9c54349 100644
--- a/api/v2/api.proto
+++ b/api/v2/api.proto
@@ -14,6 +14,44 @@ message Client {
   bool public = 5;
   string name = 6;
   string logo_url = 7;
+  repeated string allowed_connectors = 8;
+  repeated string sso_shared_with = 9;
+  // Where dex POSTs a logout token when a session this client took part in
+  // ends, per OIDC Back-Channel Logout 1.0. Empty means the client is not
+  // notified.
+  string backchannel_logout_uri = 10;
+  // Where the browser may be sent after an RP-initiated logout. A
+  // post_logout_redirect_uri that is not listed here is refused.
+  repeated string post_logout_redirect_uris = 11;
+  // Whether this client's refresh tokens outlive the browser session that
+  // issued them: "standalone" (the default) or "session".
+  string refresh_token_lifetime = 12;
+}
+
+// ClientInfo represents an OAuth2 client without sensitive information.
+message ClientInfo {
+  string id = 1;
+  repeated string redirect_uris = 2;
+  repeated string trusted_peers = 3;
+  bool public = 4;
+  string name = 5;
+  string logo_url = 6;
+  repeated string allowed_connectors = 7;
+  repeated string sso_shared_with = 8;
+  string backchannel_logout_uri = 9;
+  repeated string post_logout_redirect_uris = 10;
+  string refresh_token_lifetime = 11;
+}
+
+// GetClientReq is a request to retrieve client details.
+message GetClientReq {
+  // The ID of the client.
+  string id = 1;
+}
+
+// GetClientResp returns the client details.
+message GetClientResp {
+  Client client = 1;
 }
 
 // CreateClientReq is a request to make a client.
@@ -45,6 +83,17 @@ message UpdateClientReq {
     repeated string trusted_peers = 3;
     string name = 4;
     string logo_url = 5;
+    repeated string allowed_connectors = 6;
+    repeated string sso_shared_with = 7;
+    // Optional so that an empty value clears the URI. Without explicit presence
+    // a client could be given a back-channel endpoint but never relieved of one,
+    // leaving dex posting logout tokens at something that no longer exists.
+    optional string backchannel_logout_uri = 8;
+    repeated string post_logout_redirect_uris = 9;
+    // Optional for the same reason as backchannel_logout_uri: an empty value has
+    // to be tellable apart from "leave it alone" to put a client back on the
+    // default lifetime.
+    optional string refresh_token_lifetime = 10;
 }
 
 // UpdateClientResp returns the response from updating a client.
@@ -52,6 +101,14 @@ message UpdateClientResp {
     bool not_found = 1;
 }
 
+// ListClientReq is a request to enumerate clients.
+message ListClientReq {}
+
+// ListClientResp returns a list of clients.
+message ListClientResp {
+  repeated ClientInfo clients = 1;
+}
+
 // TODO(ericchiang): expand this.
 
 // Password is an email for password mapping managed by the storage.
@@ -105,6 +162,67 @@ message ListPasswordResp {
   repeated Password passwords = 1;
 }
 
+// Connector is a strategy used by Dex for authenticating a user against another identity provider
+message Connector {
+  string id = 1;
+  string type = 2;
+  string name = 3;
+  bytes config = 4;
+  repeated string grant_types = 5;
+}
+
+// CreateConnectorReq is a request to make a connector.
+message CreateConnectorReq {
+  Connector connector = 1;
+}
+
+// CreateConnectorResp returns the response from creating a connector.
+message CreateConnectorResp {
+  bool already_exists = 1;
+}
+
+// GrantTypes wraps a list of grant types to distinguish between
+// "not specified" (no update) and "empty list" (unrestricted).
+message GrantTypes {
+  repeated string grant_types = 1;
+}
+
+// UpdateConnectorReq is a request to modify an existing connector.
+message UpdateConnectorReq {
+  // The id used to lookup the connector. This field cannot be modified
+  string id = 1;
+  string new_type = 2;
+  string new_name = 3;
+  bytes new_config = 4;
+  // If set, updates the connector's allowed grant types.
+  // An empty grant_types list means unrestricted (all grant types allowed).
+  // If not set (null), grant types are not modified.
+  GrantTypes new_grant_types = 5;
+}
+
+// UpdateConnectorResp returns the response from modifying an existing connector.
+message UpdateConnectorResp {
+  bool not_found = 1;
+}
+
+// DeleteConnectorReq is a request to delete a connector.
+message DeleteConnectorReq {
+  string id = 1;
+}
+
+// DeleteConnectorResp returns the response from deleting a connector.
+message DeleteConnectorResp {
+  bool not_found = 1;
+}
+
+// ListConnectorReq is a request to enumerate connectors.
+message ListConnectorReq {}
+
+// ListConnectorResp returns a list of connectors.
+message ListConnectorResp {
+  repeated Connector connectors = 1;
+}
+
 // VersionReq is a request to fetch version info.
 message VersionReq {}
 
@@ -112,11 +230,33 @@ message VersionReq {}
 message VersionResp {
   // Semantic version of the server.
   string server = 1;
-  // Numeric version of the API. It increases everytime a new call is added to the API.
+  // Numeric version of the API. It increases every time a new call is added to the API.
   // Clients should use this info to determine if the server supports specific features.
   int32 api = 2;
 }
 
+// DiscoveryReq is a request to fetch discover information.
+message DiscoveryReq {}
+
+//DiscoverResp holds the version oidc disovery info.
+message DiscoveryResp {
+  string issuer = 1;
+  string authorization_endpoint = 2;
+  string token_endpoint = 3;
+  string jwks_uri = 4;
+  string userinfo_endpoint = 5;
+  string device_authorization_endpoint = 6;
+  string introspection_endpoint = 7;
+  repeated string grant_types_supported = 8;
+  repeated string response_types_supported = 9;
+  repeated string subject_types_supported = 10;
+  repeated string id_token_signing_alg_values_supported = 11;
+  repeated string code_challenge_methods_supported = 12;
+  repeated string scopes_supported = 13;
+  repeated string token_endpoint_auth_methods_supported = 14;
+  repeated string claims_supported = 15;
+}
+
 // RefreshTokenRef contains the metadata for a refresh token that is managed by the storage.
 message RefreshTokenRef {
   // ID of the refresh token.
@@ -160,14 +300,250 @@ message VerifyPasswordResp {
   bool not_found = 2;
 }
 
+// ClientAuthState represents authentication state for a specific client within a session.
+// The user_id and connector_id are on the parent AuthSession message.
+message ClientAuthState {
+  string client_id = 1;
+  int64 authenticated_at = 2;
+  int64 last_activity = 3;
+  int64 last_token_issued_at = 4;
+  // Whether this client was reached through another client's SSO sharing rather
+  // than by authenticating directly.
+  bool via_sso = 5;
+}
+
+// AuthSession represents a user's authentication session.
+message AuthSession {
+  // Random identifier of the session, published to clients as the "sid" claim. One
+  // signed-in browser is one session, so a user has as many as they have devices.
+  string id = 10;
+  string user_id = 1;
+  string connector_id = 2;
+  repeated ClientAuthState client_states = 3;
+  int64 created_at = 4;
+  int64 last_activity = 5;
+  string ip_address = 6;
+  string user_agent = 7;
+  int64 absolute_expiry = 8;
+  int64 idle_expiry = 9;
+}
+
+// GetAuthSessionReq is a request to retrieve an auth session.
+message GetAuthSessionReq {
+  string id = 1;
+}
+
+// GetAuthSessionResp returns the auth session details.
+message GetAuthSessionResp {
+  AuthSession session = 1;
+}
+
+// ListAuthSessionsReq is a request to list auth sessions.
+message ListAuthSessionsReq {
+  // Optional filter: if set, only sessions for this user are returned.
+  string user_id = 1;
+  // Optional filter: if set, only sessions from this connector are returned.
+  string connector_id = 2;
+}
+
+// ListAuthSessionsResp returns a list of auth sessions.
+message ListAuthSessionsResp {
+  repeated AuthSession sessions = 1;
+}
+
+// DeleteAuthSessionReq is a request to delete an auth session.
+// Deleting a session also revokes all associated refresh tokens (consistent with logout behavior).
+message DeleteAuthSessionReq {
+  string id = 1;
+}
+
+// DeleteAuthSessionResp returns the result of deleting an auth session.
+message DeleteAuthSessionResp {
+  bool not_found = 1;
+}
+
+// TerminateSessionsByConnectorReq is a request to terminate all sessions for a connector.
+// Use when connector configuration changes or is removed. Also revokes associated refresh tokens.
+message TerminateSessionsByConnectorReq {
+  string connector_id = 1;
+}
+
+// TerminateSessionsByConnectorResp returns the count of terminated sessions.
+message TerminateSessionsByConnectorResp {
+  int64 sessions_terminated = 1;
+}
+
+// TerminateSessionsByUserReq is a request to terminate all sessions for a user.
+// Use for account compromise scenarios. Also revokes associated refresh tokens.
+message TerminateSessionsByUserReq {
+  string user_id = 1;
+}
+
+// TerminateSessionsByUserResp returns the count of terminated sessions.
+message TerminateSessionsByUserResp {
+  int64 sessions_terminated = 1;
+}
+
+// ConsentEntry represents approved scopes for a single client.
+message ConsentEntry {
+  string client_id = 1;
+  repeated string scopes = 2;
+}
+
+// MFASecret represents metadata of an enrolled MFA authenticator.
+// The actual secret value is never exposed through the admin API.
+message MFASecret {
+  string authenticator_id = 1;
+  string type = 2;
+  bool confirmed = 3;
+  int64 created_at = 4;
+}
+
+// WebAuthnCredential represents metadata of a registered WebAuthn credential.
+// The public key is never exposed through the admin API.
+message WebAuthnCredential {
+  bytes credential_id = 1;
+  string attestation_type = 2;
+  bytes aaguid = 3;
+  uint32 sign_count = 4;
+  bool clone_warning = 5;
+  repeated string transport = 6;
+  bool backup_eligible = 7;
+  bool backup_state = 8;
+  string display_name = 9;
+  int64 created_at = 10;
+}
+
+// MFADeviceInfo groups MFA secret and WebAuthn credentials for one authenticator.
+message MFADeviceInfo {
+  string authenticator_id = 1;
+  MFASecret mfa_secret = 2;
+  repeated WebAuthnCredential webauthn_credentials = 3;
+}
+
+// UserIdentity represents persistent per-user identity data.
+message UserIdentity {
+  string user_id = 1;
+  string connector_id = 2;
+  string email = 3;
+  bool email_verified = 4;
+  string username = 5;
+  repeated string groups = 6;
+  repeated ConsentEntry consents = 7;
+  repeated MFADeviceInfo mfa_devices = 8;
+  int64 created_at = 9;
+  int64 last_login = 10;
+  int64 blocked_until = 11;
+}
+
+// GetUserIdentityReq is a request to retrieve a user identity.
+message GetUserIdentityReq {
+  string user_id = 1;
+  string connector_id = 2;
+}
+
+// GetUserIdentityResp returns the user identity details.
+message GetUserIdentityResp {
+  UserIdentity identity = 1;
+}
+
+// ListUserIdentitiesReq is a request to list user identities.
+message ListUserIdentitiesReq {}
+
+// ListUserIdentitiesResp returns a list of user identities.
+message ListUserIdentitiesResp {
+  repeated UserIdentity identities = 1;
+}
+
+// DeleteUserIdentityReq is a request to delete a user identity.
+// This is a full data purge for GDPR compliance and account deletion.
+// It cascades to: auth session, all refresh tokens, offline sessions, the
+// password record (matched by the identity's email), and the identity itself.
+message DeleteUserIdentityReq {
+  string user_id = 1;
+  string connector_id = 2;
+}
+
+// DeleteUserIdentityResp returns the result of deleting a user identity.
+message DeleteUserIdentityResp {
+  bool not_found = 1;
+}
+
+// ResetMFAReq is a request to clear all MFA secrets and WebAuthn credentials for a user.
+// Use when a user has lost access to all their MFA devices.
+message ResetMFAReq {
+  string user_id = 1;
+  string connector_id = 2;
+}
+
+// ResetMFAResp returns the result of resetting MFA.
+message ResetMFAResp {
+  bool not_found = 1;
+}
+
+// ListMFADevicesReq is a request to list registered MFA authenticators for a user.
+message ListMFADevicesReq {
+  string user_id = 1;
+  string connector_id = 2;
+}
+
+// ListMFADevicesResp returns MFA device information.
+// Secret values and public keys are never included in the response.
+message ListMFADevicesResp {
+  repeated MFADeviceInfo devices = 1;
+}
+
+// DeleteWebAuthnCredentialReq is a request to delete a specific WebAuthn credential.
+// Use when a user has lost or wants to deregister a specific security key.
+message DeleteWebAuthnCredentialReq {
+  string user_id = 1;
+  string connector_id = 2;
+  bytes credential_id = 3;
+}
+
+// DeleteWebAuthnCredentialResp returns the result of deleting a WebAuthn credential.
+message DeleteWebAuthnCredentialResp {
+  bool not_found = 1;
+}
+
+// DeleteMFASecretReq is a request to delete a specific MFA authenticator secret.
+// Also removes any associated WebAuthn credentials for the same authenticator.
+message DeleteMFASecretReq {
+  string user_id = 1;
+  string connector_id = 2;
+  string authenticator_id = 3;
+}
+
+// DeleteMFASecretResp returns the result of deleting an MFA secret.
+message DeleteMFASecretResp {
+  bool not_found = 1;
+}
+
+// RevokeConsentReq is a request to revoke consent for a specific client.
+// The user will see the consent screen again on next authorization.
+message RevokeConsentReq {
+  string user_id = 1;
+  string connector_id = 2;
+  string client_id = 3;
+}
+
+// RevokeConsentResp returns the result of revoking consent.
+message RevokeConsentResp {
+  bool not_found = 1;
+}
+
 // Dex represents the dex gRPC service.
 service Dex {
+  // GetClient gets a client.
+  rpc GetClient(GetClientReq) returns (GetClientResp) {};
   // CreateClient creates a client.
   rpc CreateClient(CreateClientReq) returns (CreateClientResp) {};
   // UpdateClient updates an existing client
   rpc UpdateClient(UpdateClientReq) returns (UpdateClientResp) {};
   // DeleteClient deletes the provided client.
   rpc DeleteClient(DeleteClientReq) returns (DeleteClientResp) {};
+  // ListClients lists all client entries.
+  rpc ListClients(ListClientReq) returns (ListClientResp) {};
   // CreatePassword creates a password.
   rpc CreatePassword(CreatePasswordReq) returns (CreatePasswordResp) {};
   // UpdatePassword modifies existing password.
@@ -176,8 +552,18 @@ service Dex {
   rpc DeletePassword(DeletePasswordReq) returns (DeletePasswordResp) {};
   // ListPassword lists all password entries.
   rpc ListPasswords(ListPasswordReq) returns (ListPasswordResp) {};
+  // CreateConnector creates a connector.
+  rpc CreateConnector(CreateConnectorReq) returns (CreateConnectorResp) {};
+  // UpdateConnector modifies existing connector.
+  rpc UpdateConnector(UpdateConnectorReq) returns (UpdateConnectorResp) {};
+  // DeleteConnector deletes the connector.
+  rpc DeleteConnector(DeleteConnectorReq) returns (DeleteConnectorResp) {};
+  // ListConnectors lists all connector entries.
+  rpc ListConnectors(ListConnectorReq) returns (ListConnectorResp) {};
   // GetVersion returns version information of the server.
   rpc GetVersion(VersionReq) returns (VersionResp) {};
+  // GetDiscovery returns discovery information of the server.
+  rpc GetDiscovery(DiscoveryReq) returns (DiscoveryResp) {};
   // ListRefresh lists all the refresh token entries for a particular user.
   rpc ListRefresh(ListRefreshReq) returns (ListRefreshResp) {};
   // RevokeRefresh revokes the refresh token for the provided user-client pair.
@@ -186,4 +572,31 @@ service Dex {
   rpc RevokeRefresh(RevokeRefreshReq) returns (RevokeRefreshResp) {};
   // VerifyPassword returns whether a password matches a hash for a specific email or not.
   rpc VerifyPassword(VerifyPasswordReq) returns (VerifyPasswordResp) {};
+  // GetAuthSession returns an auth session by its ID.
+  rpc GetAuthSession(GetAuthSessionReq) returns (GetAuthSessionResp) {};
+  // ListAuthSessions lists auth sessions, optionally filtered by user and connector.
+  rpc ListAuthSessions(ListAuthSessionsReq) returns (ListAuthSessionsResp) {};
+  // DeleteAuthSession deletes an auth session and revokes associated refresh tokens.
+  rpc DeleteAuthSession(DeleteAuthSessionReq) returns (DeleteAuthSessionResp) {};
+  // TerminateSessionsByConnector terminates all sessions for a connector and revokes associated refresh tokens.
+  rpc TerminateSessionsByConnector(TerminateSessionsByConnectorReq) returns (TerminateSessionsByConnectorResp) {};
+  // TerminateSessionsByUser terminates all sessions for a user and revokes associated refresh tokens.
+  rpc TerminateSessionsByUser(TerminateSessionsByUserReq) returns (TerminateSessionsByUserResp) {};
+  // GetUserIdentity returns a user identity by user and connector ID.
+  rpc GetUserIdentity(GetUserIdentityReq) returns (GetUserIdentityResp) {};
+  // ListUserIdentities lists all user identities.
+  rpc ListUserIdentities(ListUserIdentitiesReq) returns (ListUserIdentitiesResp) {};
+  // DeleteUserIdentity performs a full data purge for GDPR compliance: deletes the identity,
+  // auth session, refresh tokens, and offline sessions.
+  rpc DeleteUserIdentity(DeleteUserIdentityReq) returns (DeleteUserIdentityResp) {};
+  // ResetMFA clears all MFA secrets and WebAuthn credentials for a user.
+  rpc ResetMFA(ResetMFAReq) returns (ResetMFAResp) {};
+  // ListMFADevices lists registered MFA authenticators for a user.
+  rpc ListMFADevices(ListMFADevicesReq) returns (ListMFADevicesResp) {};
+  // DeleteWebAuthnCredential deletes a specific WebAuthn credential.
+  rpc DeleteWebAuthnCredential(DeleteWebAuthnCredentialReq) returns (DeleteWebAuthnCredentialResp) {};
+  // DeleteMFASecret deletes a specific MFA authenticator and its associated WebAuthn credentials.
+  rpc DeleteMFASecret(DeleteMFASecretReq) returns (DeleteMFASecretResp) {};
+  // RevokeConsent revokes consent for a specific client.
+  rpc RevokeConsent(RevokeConsentReq) returns (RevokeConsentResp) {};
 }
diff --git a/api/v2/api_grpc.pb.go b/api/v2/api_grpc.pb.go
index 8b3b10bc52..8b7f7f725c 100644
--- a/api/v2/api_grpc.pb.go
+++ b/api/v2/api_grpc.pb.go
@@ -1,4 +1,8 @@
 // Code generated by protoc-gen-go-grpc. DO NOT EDIT.
+// versions:
+// - protoc-gen-go-grpc v1.5.1
+// - protoc             v5.29.3
+// source: api/v2/api.proto
 
 package api
 
@@ -11,19 +15,59 @@ import (
 
 // This is a compile-time assertion to ensure that this generated file
 // is compatible with the grpc package it is being compiled against.
-// Requires gRPC-Go v1.32.0 or later.
-const _ = grpc.SupportPackageIsVersion7
+// Requires gRPC-Go v1.64.0 or later.
+const _ = grpc.SupportPackageIsVersion9
+
+const (
+	Dex_GetClient_FullMethodName                    = "/api.Dex/GetClient"
+	Dex_CreateClient_FullMethodName                 = "/api.Dex/CreateClient"
+	Dex_UpdateClient_FullMethodName                 = "/api.Dex/UpdateClient"
+	Dex_DeleteClient_FullMethodName                 = "/api.Dex/DeleteClient"
+	Dex_ListClients_FullMethodName                  = "/api.Dex/ListClients"
+	Dex_CreatePassword_FullMethodName               = "/api.Dex/CreatePassword"
+	Dex_UpdatePassword_FullMethodName               = "/api.Dex/UpdatePassword"
+	Dex_DeletePassword_FullMethodName               = "/api.Dex/DeletePassword"
+	Dex_ListPasswords_FullMethodName                = "/api.Dex/ListPasswords"
+	Dex_CreateConnector_FullMethodName              = "/api.Dex/CreateConnector"
+	Dex_UpdateConnector_FullMethodName              = "/api.Dex/UpdateConnector"
+	Dex_DeleteConnector_FullMethodName              = "/api.Dex/DeleteConnector"
+	Dex_ListConnectors_FullMethodName               = "/api.Dex/ListConnectors"
+	Dex_GetVersion_FullMethodName                   = "/api.Dex/GetVersion"
+	Dex_GetDiscovery_FullMethodName                 = "/api.Dex/GetDiscovery"
+	Dex_ListRefresh_FullMethodName                  = "/api.Dex/ListRefresh"
+	Dex_RevokeRefresh_FullMethodName                = "/api.Dex/RevokeRefresh"
+	Dex_VerifyPassword_FullMethodName               = "/api.Dex/VerifyPassword"
+	Dex_GetAuthSession_FullMethodName               = "/api.Dex/GetAuthSession"
+	Dex_ListAuthSessions_FullMethodName             = "/api.Dex/ListAuthSessions"
+	Dex_DeleteAuthSession_FullMethodName            = "/api.Dex/DeleteAuthSession"
+	Dex_TerminateSessionsByConnector_FullMethodName = "/api.Dex/TerminateSessionsByConnector"
+	Dex_TerminateSessionsByUser_FullMethodName      = "/api.Dex/TerminateSessionsByUser"
+	Dex_GetUserIdentity_FullMethodName              = "/api.Dex/GetUserIdentity"
+	Dex_ListUserIdentities_FullMethodName           = "/api.Dex/ListUserIdentities"
+	Dex_DeleteUserIdentity_FullMethodName           = "/api.Dex/DeleteUserIdentity"
+	Dex_ResetMFA_FullMethodName                     = "/api.Dex/ResetMFA"
+	Dex_ListMFADevices_FullMethodName               = "/api.Dex/ListMFADevices"
+	Dex_DeleteWebAuthnCredential_FullMethodName     = "/api.Dex/DeleteWebAuthnCredential"
+	Dex_DeleteMFASecret_FullMethodName              = "/api.Dex/DeleteMFASecret"
+	Dex_RevokeConsent_FullMethodName                = "/api.Dex/RevokeConsent"
+)
 
 // DexClient is the client API for Dex service.
 //
 // For semantics around ctx use and closing/ending streaming RPCs, please refer to https://pkg.go.dev/google.golang.org/grpc/?tab=doc#ClientConn.NewStream.
+//
+// Dex represents the dex gRPC service.
 type DexClient interface {
+	// GetClient gets a client.
+	GetClient(ctx context.Context, in *GetClientReq, opts ...grpc.CallOption) (*GetClientResp, error)
 	// CreateClient creates a client.
 	CreateClient(ctx context.Context, in *CreateClientReq, opts ...grpc.CallOption) (*CreateClientResp, error)
 	// UpdateClient updates an existing client
 	UpdateClient(ctx context.Context, in *UpdateClientReq, opts ...grpc.CallOption) (*UpdateClientResp, error)
 	// DeleteClient deletes the provided client.
 	DeleteClient(ctx context.Context, in *DeleteClientReq, opts ...grpc.CallOption) (*DeleteClientResp, error)
+	// ListClients lists all client entries.
+	ListClients(ctx context.Context, in *ListClientReq, opts ...grpc.CallOption) (*ListClientResp, error)
 	// CreatePassword creates a password.
 	CreatePassword(ctx context.Context, in *CreatePasswordReq, opts ...grpc.CallOption) (*CreatePasswordResp, error)
 	// UpdatePassword modifies existing password.
@@ -32,8 +76,18 @@ type DexClient interface {
 	DeletePassword(ctx context.Context, in *DeletePasswordReq, opts ...grpc.CallOption) (*DeletePasswordResp, error)
 	// ListPassword lists all password entries.
 	ListPasswords(ctx context.Context, in *ListPasswordReq, opts ...grpc.CallOption) (*ListPasswordResp, error)
+	// CreateConnector creates a connector.
+	CreateConnector(ctx context.Context, in *CreateConnectorReq, opts ...grpc.CallOption) (*CreateConnectorResp, error)
+	// UpdateConnector modifies existing connector.
+	UpdateConnector(ctx context.Context, in *UpdateConnectorReq, opts ...grpc.CallOption) (*UpdateConnectorResp, error)
+	// DeleteConnector deletes the connector.
+	DeleteConnector(ctx context.Context, in *DeleteConnectorReq, opts ...grpc.CallOption) (*DeleteConnectorResp, error)
+	// ListConnectors lists all connector entries.
+	ListConnectors(ctx context.Context, in *ListConnectorReq, opts ...grpc.CallOption) (*ListConnectorResp, error)
 	// GetVersion returns version information of the server.
 	GetVersion(ctx context.Context, in *VersionReq, opts ...grpc.CallOption) (*VersionResp, error)
+	// GetDiscovery returns discovery information of the server.
+	GetDiscovery(ctx context.Context, in *DiscoveryReq, opts ...grpc.CallOption) (*DiscoveryResp, error)
 	// ListRefresh lists all the refresh token entries for a particular user.
 	ListRefresh(ctx context.Context, in *ListRefreshReq, opts ...grpc.CallOption) (*ListRefreshResp, error)
 	// RevokeRefresh revokes the refresh token for the provided user-client pair.
@@ -42,6 +96,33 @@ type DexClient interface {
 	RevokeRefresh(ctx context.Context, in *RevokeRefreshReq, opts ...grpc.CallOption) (*RevokeRefreshResp, error)
 	// VerifyPassword returns whether a password matches a hash for a specific email or not.
 	VerifyPassword(ctx context.Context, in *VerifyPasswordReq, opts ...grpc.CallOption) (*VerifyPasswordResp, error)
+	// GetAuthSession returns an auth session by its ID.
+	GetAuthSession(ctx context.Context, in *GetAuthSessionReq, opts ...grpc.CallOption) (*GetAuthSessionResp, error)
+	// ListAuthSessions lists auth sessions, optionally filtered by user and connector.
+	ListAuthSessions(ctx context.Context, in *ListAuthSessionsReq, opts ...grpc.CallOption) (*ListAuthSessionsResp, error)
+	// DeleteAuthSession deletes an auth session and revokes associated refresh tokens.
+	DeleteAuthSession(ctx context.Context, in *DeleteAuthSessionReq, opts ...grpc.CallOption) (*DeleteAuthSessionResp, error)
+	// TerminateSessionsByConnector terminates all sessions for a connector and revokes associated refresh tokens.
+	TerminateSessionsByConnector(ctx context.Context, in *TerminateSessionsByConnectorReq, opts ...grpc.CallOption) (*TerminateSessionsByConnectorResp, error)
+	// TerminateSessionsByUser terminates all sessions for a user and revokes associated refresh tokens.
+	TerminateSessionsByUser(ctx context.Context, in *TerminateSessionsByUserReq, opts ...grpc.CallOption) (*TerminateSessionsByUserResp, error)
+	// GetUserIdentity returns a user identity by user and connector ID.
+	GetUserIdentity(ctx context.Context, in *GetUserIdentityReq, opts ...grpc.CallOption) (*GetUserIdentityResp, error)
+	// ListUserIdentities lists all user identities.
+	ListUserIdentities(ctx context.Context, in *ListUserIdentitiesReq, opts ...grpc.CallOption) (*ListUserIdentitiesResp, error)
+	// DeleteUserIdentity performs a full data purge for GDPR compliance: deletes the identity,
+	// auth session, refresh tokens, and offline sessions.
+	DeleteUserIdentity(ctx context.Context, in *DeleteUserIdentityReq, opts ...grpc.CallOption) (*DeleteUserIdentityResp, error)
+	// ResetMFA clears all MFA secrets and WebAuthn credentials for a user.
+	ResetMFA(ctx context.Context, in *ResetMFAReq, opts ...grpc.CallOption) (*ResetMFAResp, error)
+	// ListMFADevices lists registered MFA authenticators for a user.
+	ListMFADevices(ctx context.Context, in *ListMFADevicesReq, opts ...grpc.CallOption) (*ListMFADevicesResp, error)
+	// DeleteWebAuthnCredential deletes a specific WebAuthn credential.
+	DeleteWebAuthnCredential(ctx context.Context, in *DeleteWebAuthnCredentialReq, opts ...grpc.CallOption) (*DeleteWebAuthnCredentialResp, error)
+	// DeleteMFASecret deletes a specific MFA authenticator and its associated WebAuthn credentials.
+	DeleteMFASecret(ctx context.Context, in *DeleteMFASecretReq, opts ...grpc.CallOption) (*DeleteMFASecretResp, error)
+	// RevokeConsent revokes consent for a specific client.
+	RevokeConsent(ctx context.Context, in *RevokeConsentReq, opts ...grpc.CallOption) (*RevokeConsentResp, error)
 }
 
 type dexClient struct {
@@ -52,9 +133,20 @@ func NewDexClient(cc grpc.ClientConnInterface) DexClient {
 	return &dexClient{cc}
 }
 
+func (c *dexClient) GetClient(ctx context.Context, in *GetClientReq, opts ...grpc.CallOption) (*GetClientResp, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(GetClientResp)
+	err := c.cc.Invoke(ctx, Dex_GetClient_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
 func (c *dexClient) CreateClient(ctx context.Context, in *CreateClientReq, opts ...grpc.CallOption) (*CreateClientResp, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(CreateClientResp)
-	err := c.cc.Invoke(ctx, "/api.Dex/CreateClient", in, out, opts...)
+	err := c.cc.Invoke(ctx, Dex_CreateClient_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -62,8 +154,9 @@ func (c *dexClient) CreateClient(ctx context.Context, in *CreateClientReq, opts
 }
 
 func (c *dexClient) UpdateClient(ctx context.Context, in *UpdateClientReq, opts ...grpc.CallOption) (*UpdateClientResp, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(UpdateClientResp)
-	err := c.cc.Invoke(ctx, "/api.Dex/UpdateClient", in, out, opts...)
+	err := c.cc.Invoke(ctx, Dex_UpdateClient_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -71,8 +164,19 @@ func (c *dexClient) UpdateClient(ctx context.Context, in *UpdateClientReq, opts
 }
 
 func (c *dexClient) DeleteClient(ctx context.Context, in *DeleteClientReq, opts ...grpc.CallOption) (*DeleteClientResp, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(DeleteClientResp)
-	err := c.cc.Invoke(ctx, "/api.Dex/DeleteClient", in, out, opts...)
+	err := c.cc.Invoke(ctx, Dex_DeleteClient_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *dexClient) ListClients(ctx context.Context, in *ListClientReq, opts ...grpc.CallOption) (*ListClientResp, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(ListClientResp)
+	err := c.cc.Invoke(ctx, Dex_ListClients_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -80,8 +184,9 @@ func (c *dexClient) DeleteClient(ctx context.Context, in *DeleteClientReq, opts
 }
 
 func (c *dexClient) CreatePassword(ctx context.Context, in *CreatePasswordReq, opts ...grpc.CallOption) (*CreatePasswordResp, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(CreatePasswordResp)
-	err := c.cc.Invoke(ctx, "/api.Dex/CreatePassword", in, out, opts...)
+	err := c.cc.Invoke(ctx, Dex_CreatePassword_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -89,8 +194,9 @@ func (c *dexClient) CreatePassword(ctx context.Context, in *CreatePasswordReq, o
 }
 
 func (c *dexClient) UpdatePassword(ctx context.Context, in *UpdatePasswordReq, opts ...grpc.CallOption) (*UpdatePasswordResp, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(UpdatePasswordResp)
-	err := c.cc.Invoke(ctx, "/api.Dex/UpdatePassword", in, out, opts...)
+	err := c.cc.Invoke(ctx, Dex_UpdatePassword_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -98,8 +204,9 @@ func (c *dexClient) UpdatePassword(ctx context.Context, in *UpdatePasswordReq, o
 }
 
 func (c *dexClient) DeletePassword(ctx context.Context, in *DeletePasswordReq, opts ...grpc.CallOption) (*DeletePasswordResp, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(DeletePasswordResp)
-	err := c.cc.Invoke(ctx, "/api.Dex/DeletePassword", in, out, opts...)
+	err := c.cc.Invoke(ctx, Dex_DeletePassword_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -107,8 +214,49 @@ func (c *dexClient) DeletePassword(ctx context.Context, in *DeletePasswordReq, o
 }
 
 func (c *dexClient) ListPasswords(ctx context.Context, in *ListPasswordReq, opts ...grpc.CallOption) (*ListPasswordResp, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(ListPasswordResp)
-	err := c.cc.Invoke(ctx, "/api.Dex/ListPasswords", in, out, opts...)
+	err := c.cc.Invoke(ctx, Dex_ListPasswords_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *dexClient) CreateConnector(ctx context.Context, in *CreateConnectorReq, opts ...grpc.CallOption) (*CreateConnectorResp, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(CreateConnectorResp)
+	err := c.cc.Invoke(ctx, Dex_CreateConnector_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *dexClient) UpdateConnector(ctx context.Context, in *UpdateConnectorReq, opts ...grpc.CallOption) (*UpdateConnectorResp, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(UpdateConnectorResp)
+	err := c.cc.Invoke(ctx, Dex_UpdateConnector_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *dexClient) DeleteConnector(ctx context.Context, in *DeleteConnectorReq, opts ...grpc.CallOption) (*DeleteConnectorResp, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(DeleteConnectorResp)
+	err := c.cc.Invoke(ctx, Dex_DeleteConnector_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *dexClient) ListConnectors(ctx context.Context, in *ListConnectorReq, opts ...grpc.CallOption) (*ListConnectorResp, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(ListConnectorResp)
+	err := c.cc.Invoke(ctx, Dex_ListConnectors_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -116,8 +264,19 @@ func (c *dexClient) ListPasswords(ctx context.Context, in *ListPasswordReq, opts
 }
 
 func (c *dexClient) GetVersion(ctx context.Context, in *VersionReq, opts ...grpc.CallOption) (*VersionResp, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(VersionResp)
-	err := c.cc.Invoke(ctx, "/api.Dex/GetVersion", in, out, opts...)
+	err := c.cc.Invoke(ctx, Dex_GetVersion_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *dexClient) GetDiscovery(ctx context.Context, in *DiscoveryReq, opts ...grpc.CallOption) (*DiscoveryResp, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(DiscoveryResp)
+	err := c.cc.Invoke(ctx, Dex_GetDiscovery_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -125,8 +284,9 @@ func (c *dexClient) GetVersion(ctx context.Context, in *VersionReq, opts ...grpc
 }
 
 func (c *dexClient) ListRefresh(ctx context.Context, in *ListRefreshReq, opts ...grpc.CallOption) (*ListRefreshResp, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(ListRefreshResp)
-	err := c.cc.Invoke(ctx, "/api.Dex/ListRefresh", in, out, opts...)
+	err := c.cc.Invoke(ctx, Dex_ListRefresh_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -134,8 +294,9 @@ func (c *dexClient) ListRefresh(ctx context.Context, in *ListRefreshReq, opts ..
 }
 
 func (c *dexClient) RevokeRefresh(ctx context.Context, in *RevokeRefreshReq, opts ...grpc.CallOption) (*RevokeRefreshResp, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(RevokeRefreshResp)
-	err := c.cc.Invoke(ctx, "/api.Dex/RevokeRefresh", in, out, opts...)
+	err := c.cc.Invoke(ctx, Dex_RevokeRefresh_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -143,8 +304,139 @@ func (c *dexClient) RevokeRefresh(ctx context.Context, in *RevokeRefreshReq, opt
 }
 
 func (c *dexClient) VerifyPassword(ctx context.Context, in *VerifyPasswordReq, opts ...grpc.CallOption) (*VerifyPasswordResp, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(VerifyPasswordResp)
-	err := c.cc.Invoke(ctx, "/api.Dex/VerifyPassword", in, out, opts...)
+	err := c.cc.Invoke(ctx, Dex_VerifyPassword_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *dexClient) GetAuthSession(ctx context.Context, in *GetAuthSessionReq, opts ...grpc.CallOption) (*GetAuthSessionResp, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(GetAuthSessionResp)
+	err := c.cc.Invoke(ctx, Dex_GetAuthSession_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *dexClient) ListAuthSessions(ctx context.Context, in *ListAuthSessionsReq, opts ...grpc.CallOption) (*ListAuthSessionsResp, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(ListAuthSessionsResp)
+	err := c.cc.Invoke(ctx, Dex_ListAuthSessions_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *dexClient) DeleteAuthSession(ctx context.Context, in *DeleteAuthSessionReq, opts ...grpc.CallOption) (*DeleteAuthSessionResp, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(DeleteAuthSessionResp)
+	err := c.cc.Invoke(ctx, Dex_DeleteAuthSession_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *dexClient) TerminateSessionsByConnector(ctx context.Context, in *TerminateSessionsByConnectorReq, opts ...grpc.CallOption) (*TerminateSessionsByConnectorResp, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(TerminateSessionsByConnectorResp)
+	err := c.cc.Invoke(ctx, Dex_TerminateSessionsByConnector_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *dexClient) TerminateSessionsByUser(ctx context.Context, in *TerminateSessionsByUserReq, opts ...grpc.CallOption) (*TerminateSessionsByUserResp, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(TerminateSessionsByUserResp)
+	err := c.cc.Invoke(ctx, Dex_TerminateSessionsByUser_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *dexClient) GetUserIdentity(ctx context.Context, in *GetUserIdentityReq, opts ...grpc.CallOption) (*GetUserIdentityResp, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(GetUserIdentityResp)
+	err := c.cc.Invoke(ctx, Dex_GetUserIdentity_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *dexClient) ListUserIdentities(ctx context.Context, in *ListUserIdentitiesReq, opts ...grpc.CallOption) (*ListUserIdentitiesResp, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(ListUserIdentitiesResp)
+	err := c.cc.Invoke(ctx, Dex_ListUserIdentities_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *dexClient) DeleteUserIdentity(ctx context.Context, in *DeleteUserIdentityReq, opts ...grpc.CallOption) (*DeleteUserIdentityResp, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(DeleteUserIdentityResp)
+	err := c.cc.Invoke(ctx, Dex_DeleteUserIdentity_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *dexClient) ResetMFA(ctx context.Context, in *ResetMFAReq, opts ...grpc.CallOption) (*ResetMFAResp, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(ResetMFAResp)
+	err := c.cc.Invoke(ctx, Dex_ResetMFA_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *dexClient) ListMFADevices(ctx context.Context, in *ListMFADevicesReq, opts ...grpc.CallOption) (*ListMFADevicesResp, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(ListMFADevicesResp)
+	err := c.cc.Invoke(ctx, Dex_ListMFADevices_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *dexClient) DeleteWebAuthnCredential(ctx context.Context, in *DeleteWebAuthnCredentialReq, opts ...grpc.CallOption) (*DeleteWebAuthnCredentialResp, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(DeleteWebAuthnCredentialResp)
+	err := c.cc.Invoke(ctx, Dex_DeleteWebAuthnCredential_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *dexClient) DeleteMFASecret(ctx context.Context, in *DeleteMFASecretReq, opts ...grpc.CallOption) (*DeleteMFASecretResp, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(DeleteMFASecretResp)
+	err := c.cc.Invoke(ctx, Dex_DeleteMFASecret_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *dexClient) RevokeConsent(ctx context.Context, in *RevokeConsentReq, opts ...grpc.CallOption) (*RevokeConsentResp, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(RevokeConsentResp)
+	err := c.cc.Invoke(ctx, Dex_RevokeConsent_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -153,14 +445,20 @@ func (c *dexClient) VerifyPassword(ctx context.Context, in *VerifyPasswordReq, o
 
 // DexServer is the server API for Dex service.
 // All implementations must embed UnimplementedDexServer
-// for forward compatibility
+// for forward compatibility.
+//
+// Dex represents the dex gRPC service.
 type DexServer interface {
+	// GetClient gets a client.
+	GetClient(context.Context, *GetClientReq) (*GetClientResp, error)
 	// CreateClient creates a client.
 	CreateClient(context.Context, *CreateClientReq) (*CreateClientResp, error)
 	// UpdateClient updates an existing client
 	UpdateClient(context.Context, *UpdateClientReq) (*UpdateClientResp, error)
 	// DeleteClient deletes the provided client.
 	DeleteClient(context.Context, *DeleteClientReq) (*DeleteClientResp, error)
+	// ListClients lists all client entries.
+	ListClients(context.Context, *ListClientReq) (*ListClientResp, error)
 	// CreatePassword creates a password.
 	CreatePassword(context.Context, *CreatePasswordReq) (*CreatePasswordResp, error)
 	// UpdatePassword modifies existing password.
@@ -169,8 +467,18 @@ type DexServer interface {
 	DeletePassword(context.Context, *DeletePasswordReq) (*DeletePasswordResp, error)
 	// ListPassword lists all password entries.
 	ListPasswords(context.Context, *ListPasswordReq) (*ListPasswordResp, error)
+	// CreateConnector creates a connector.
+	CreateConnector(context.Context, *CreateConnectorReq) (*CreateConnectorResp, error)
+	// UpdateConnector modifies existing connector.
+	UpdateConnector(context.Context, *UpdateConnectorReq) (*UpdateConnectorResp, error)
+	// DeleteConnector deletes the connector.
+	DeleteConnector(context.Context, *DeleteConnectorReq) (*DeleteConnectorResp, error)
+	// ListConnectors lists all connector entries.
+	ListConnectors(context.Context, *ListConnectorReq) (*ListConnectorResp, error)
 	// GetVersion returns version information of the server.
 	GetVersion(context.Context, *VersionReq) (*VersionResp, error)
+	// GetDiscovery returns discovery information of the server.
+	GetDiscovery(context.Context, *DiscoveryReq) (*DiscoveryResp, error)
 	// ListRefresh lists all the refresh token entries for a particular user.
 	ListRefresh(context.Context, *ListRefreshReq) (*ListRefreshResp, error)
 	// RevokeRefresh revokes the refresh token for the provided user-client pair.
@@ -179,13 +487,46 @@ type DexServer interface {
 	RevokeRefresh(context.Context, *RevokeRefreshReq) (*RevokeRefreshResp, error)
 	// VerifyPassword returns whether a password matches a hash for a specific email or not.
 	VerifyPassword(context.Context, *VerifyPasswordReq) (*VerifyPasswordResp, error)
+	// GetAuthSession returns an auth session by its ID.
+	GetAuthSession(context.Context, *GetAuthSessionReq) (*GetAuthSessionResp, error)
+	// ListAuthSessions lists auth sessions, optionally filtered by user and connector.
+	ListAuthSessions(context.Context, *ListAuthSessionsReq) (*ListAuthSessionsResp, error)
+	// DeleteAuthSession deletes an auth session and revokes associated refresh tokens.
+	DeleteAuthSession(context.Context, *DeleteAuthSessionReq) (*DeleteAuthSessionResp, error)
+	// TerminateSessionsByConnector terminates all sessions for a connector and revokes associated refresh tokens.
+	TerminateSessionsByConnector(context.Context, *TerminateSessionsByConnectorReq) (*TerminateSessionsByConnectorResp, error)
+	// TerminateSessionsByUser terminates all sessions for a user and revokes associated refresh tokens.
+	TerminateSessionsByUser(context.Context, *TerminateSessionsByUserReq) (*TerminateSessionsByUserResp, error)
+	// GetUserIdentity returns a user identity by user and connector ID.
+	GetUserIdentity(context.Context, *GetUserIdentityReq) (*GetUserIdentityResp, error)
+	// ListUserIdentities lists all user identities.
+	ListUserIdentities(context.Context, *ListUserIdentitiesReq) (*ListUserIdentitiesResp, error)
+	// DeleteUserIdentity performs a full data purge for GDPR compliance: deletes the identity,
+	// auth session, refresh tokens, and offline sessions.
+	DeleteUserIdentity(context.Context, *DeleteUserIdentityReq) (*DeleteUserIdentityResp, error)
+	// ResetMFA clears all MFA secrets and WebAuthn credentials for a user.
+	ResetMFA(context.Context, *ResetMFAReq) (*ResetMFAResp, error)
+	// ListMFADevices lists registered MFA authenticators for a user.
+	ListMFADevices(context.Context, *ListMFADevicesReq) (*ListMFADevicesResp, error)
+	// DeleteWebAuthnCredential deletes a specific WebAuthn credential.
+	DeleteWebAuthnCredential(context.Context, *DeleteWebAuthnCredentialReq) (*DeleteWebAuthnCredentialResp, error)
+	// DeleteMFASecret deletes a specific MFA authenticator and its associated WebAuthn credentials.
+	DeleteMFASecret(context.Context, *DeleteMFASecretReq) (*DeleteMFASecretResp, error)
+	// RevokeConsent revokes consent for a specific client.
+	RevokeConsent(context.Context, *RevokeConsentReq) (*RevokeConsentResp, error)
 	mustEmbedUnimplementedDexServer()
 }
 
-// UnimplementedDexServer must be embedded to have forward compatible implementations.
-type UnimplementedDexServer struct {
-}
+// UnimplementedDexServer must be embedded to have
+// forward compatible implementations.
+//
+// NOTE: this should be embedded by value instead of pointer to avoid a nil
+// pointer dereference when methods are called.
+type UnimplementedDexServer struct{}
 
+func (UnimplementedDexServer) GetClient(context.Context, *GetClientReq) (*GetClientResp, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method GetClient not implemented")
+}
 func (UnimplementedDexServer) CreateClient(context.Context, *CreateClientReq) (*CreateClientResp, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method CreateClient not implemented")
 }
@@ -195,6 +536,9 @@ func (UnimplementedDexServer) UpdateClient(context.Context, *UpdateClientReq) (*
 func (UnimplementedDexServer) DeleteClient(context.Context, *DeleteClientReq) (*DeleteClientResp, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method DeleteClient not implemented")
 }
+func (UnimplementedDexServer) ListClients(context.Context, *ListClientReq) (*ListClientResp, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method ListClients not implemented")
+}
 func (UnimplementedDexServer) CreatePassword(context.Context, *CreatePasswordReq) (*CreatePasswordResp, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method CreatePassword not implemented")
 }
@@ -207,9 +551,24 @@ func (UnimplementedDexServer) DeletePassword(context.Context, *DeletePasswordReq
 func (UnimplementedDexServer) ListPasswords(context.Context, *ListPasswordReq) (*ListPasswordResp, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method ListPasswords not implemented")
 }
+func (UnimplementedDexServer) CreateConnector(context.Context, *CreateConnectorReq) (*CreateConnectorResp, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method CreateConnector not implemented")
+}
+func (UnimplementedDexServer) UpdateConnector(context.Context, *UpdateConnectorReq) (*UpdateConnectorResp, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method UpdateConnector not implemented")
+}
+func (UnimplementedDexServer) DeleteConnector(context.Context, *DeleteConnectorReq) (*DeleteConnectorResp, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method DeleteConnector not implemented")
+}
+func (UnimplementedDexServer) ListConnectors(context.Context, *ListConnectorReq) (*ListConnectorResp, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method ListConnectors not implemented")
+}
 func (UnimplementedDexServer) GetVersion(context.Context, *VersionReq) (*VersionResp, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method GetVersion not implemented")
 }
+func (UnimplementedDexServer) GetDiscovery(context.Context, *DiscoveryReq) (*DiscoveryResp, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method GetDiscovery not implemented")
+}
 func (UnimplementedDexServer) ListRefresh(context.Context, *ListRefreshReq) (*ListRefreshResp, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method ListRefresh not implemented")
 }
@@ -219,7 +578,47 @@ func (UnimplementedDexServer) RevokeRefresh(context.Context, *RevokeRefreshReq)
 func (UnimplementedDexServer) VerifyPassword(context.Context, *VerifyPasswordReq) (*VerifyPasswordResp, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method VerifyPassword not implemented")
 }
+func (UnimplementedDexServer) GetAuthSession(context.Context, *GetAuthSessionReq) (*GetAuthSessionResp, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method GetAuthSession not implemented")
+}
+func (UnimplementedDexServer) ListAuthSessions(context.Context, *ListAuthSessionsReq) (*ListAuthSessionsResp, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method ListAuthSessions not implemented")
+}
+func (UnimplementedDexServer) DeleteAuthSession(context.Context, *DeleteAuthSessionReq) (*DeleteAuthSessionResp, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method DeleteAuthSession not implemented")
+}
+func (UnimplementedDexServer) TerminateSessionsByConnector(context.Context, *TerminateSessionsByConnectorReq) (*TerminateSessionsByConnectorResp, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method TerminateSessionsByConnector not implemented")
+}
+func (UnimplementedDexServer) TerminateSessionsByUser(context.Context, *TerminateSessionsByUserReq) (*TerminateSessionsByUserResp, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method TerminateSessionsByUser not implemented")
+}
+func (UnimplementedDexServer) GetUserIdentity(context.Context, *GetUserIdentityReq) (*GetUserIdentityResp, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method GetUserIdentity not implemented")
+}
+func (UnimplementedDexServer) ListUserIdentities(context.Context, *ListUserIdentitiesReq) (*ListUserIdentitiesResp, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method ListUserIdentities not implemented")
+}
+func (UnimplementedDexServer) DeleteUserIdentity(context.Context, *DeleteUserIdentityReq) (*DeleteUserIdentityResp, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method DeleteUserIdentity not implemented")
+}
+func (UnimplementedDexServer) ResetMFA(context.Context, *ResetMFAReq) (*ResetMFAResp, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method ResetMFA not implemented")
+}
+func (UnimplementedDexServer) ListMFADevices(context.Context, *ListMFADevicesReq) (*ListMFADevicesResp, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method ListMFADevices not implemented")
+}
+func (UnimplementedDexServer) DeleteWebAuthnCredential(context.Context, *DeleteWebAuthnCredentialReq) (*DeleteWebAuthnCredentialResp, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method DeleteWebAuthnCredential not implemented")
+}
+func (UnimplementedDexServer) DeleteMFASecret(context.Context, *DeleteMFASecretReq) (*DeleteMFASecretResp, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method DeleteMFASecret not implemented")
+}
+func (UnimplementedDexServer) RevokeConsent(context.Context, *RevokeConsentReq) (*RevokeConsentResp, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method RevokeConsent not implemented")
+}
 func (UnimplementedDexServer) mustEmbedUnimplementedDexServer() {}
+func (UnimplementedDexServer) testEmbeddedByValue()             {}
 
 // UnsafeDexServer may be embedded to opt out of forward compatibility for this service.
 // Use of this interface is not recommended, as added methods to DexServer will
@@ -229,9 +628,34 @@ type UnsafeDexServer interface {
 }
 
 func RegisterDexServer(s grpc.ServiceRegistrar, srv DexServer) {
+	// If the following call pancis, it indicates UnimplementedDexServer was
+	// embedded by pointer and is nil.  This will cause panics if an
+	// unimplemented method is ever invoked, so we test this at initialization
+	// time to prevent it from happening at runtime later due to I/O.
+	if t, ok := srv.(interface{ testEmbeddedByValue() }); ok {
+		t.testEmbeddedByValue()
+	}
 	s.RegisterService(&Dex_ServiceDesc, srv)
 }
 
+func _Dex_GetClient_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(GetClientReq)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(DexServer).GetClient(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: Dex_GetClient_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(DexServer).GetClient(ctx, req.(*GetClientReq))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
 func _Dex_CreateClient_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
 	in := new(CreateClientReq)
 	if err := dec(in); err != nil {
@@ -242,7 +666,7 @@ func _Dex_CreateClient_Handler(srv interface{}, ctx context.Context, dec func(in
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/api.Dex/CreateClient",
+		FullMethod: Dex_CreateClient_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(DexServer).CreateClient(ctx, req.(*CreateClientReq))
@@ -260,7 +684,7 @@ func _Dex_UpdateClient_Handler(srv interface{}, ctx context.Context, dec func(in
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/api.Dex/UpdateClient",
+		FullMethod: Dex_UpdateClient_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(DexServer).UpdateClient(ctx, req.(*UpdateClientReq))
@@ -278,7 +702,7 @@ func _Dex_DeleteClient_Handler(srv interface{}, ctx context.Context, dec func(in
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/api.Dex/DeleteClient",
+		FullMethod: Dex_DeleteClient_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(DexServer).DeleteClient(ctx, req.(*DeleteClientReq))
@@ -286,6 +710,24 @@ func _Dex_DeleteClient_Handler(srv interface{}, ctx context.Context, dec func(in
 	return interceptor(ctx, in, info, handler)
 }
 
+func _Dex_ListClients_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(ListClientReq)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(DexServer).ListClients(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: Dex_ListClients_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(DexServer).ListClients(ctx, req.(*ListClientReq))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
 func _Dex_CreatePassword_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
 	in := new(CreatePasswordReq)
 	if err := dec(in); err != nil {
@@ -296,7 +738,7 @@ func _Dex_CreatePassword_Handler(srv interface{}, ctx context.Context, dec func(
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/api.Dex/CreatePassword",
+		FullMethod: Dex_CreatePassword_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(DexServer).CreatePassword(ctx, req.(*CreatePasswordReq))
@@ -314,7 +756,7 @@ func _Dex_UpdatePassword_Handler(srv interface{}, ctx context.Context, dec func(
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/api.Dex/UpdatePassword",
+		FullMethod: Dex_UpdatePassword_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(DexServer).UpdatePassword(ctx, req.(*UpdatePasswordReq))
@@ -332,7 +774,7 @@ func _Dex_DeletePassword_Handler(srv interface{}, ctx context.Context, dec func(
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/api.Dex/DeletePassword",
+		FullMethod: Dex_DeletePassword_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(DexServer).DeletePassword(ctx, req.(*DeletePasswordReq))
@@ -350,7 +792,7 @@ func _Dex_ListPasswords_Handler(srv interface{}, ctx context.Context, dec func(i
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/api.Dex/ListPasswords",
+		FullMethod: Dex_ListPasswords_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(DexServer).ListPasswords(ctx, req.(*ListPasswordReq))
@@ -358,6 +800,78 @@ func _Dex_ListPasswords_Handler(srv interface{}, ctx context.Context, dec func(i
 	return interceptor(ctx, in, info, handler)
 }
 
+func _Dex_CreateConnector_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(CreateConnectorReq)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(DexServer).CreateConnector(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: Dex_CreateConnector_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(DexServer).CreateConnector(ctx, req.(*CreateConnectorReq))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _Dex_UpdateConnector_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(UpdateConnectorReq)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(DexServer).UpdateConnector(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: Dex_UpdateConnector_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(DexServer).UpdateConnector(ctx, req.(*UpdateConnectorReq))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _Dex_DeleteConnector_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(DeleteConnectorReq)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(DexServer).DeleteConnector(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: Dex_DeleteConnector_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(DexServer).DeleteConnector(ctx, req.(*DeleteConnectorReq))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _Dex_ListConnectors_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(ListConnectorReq)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(DexServer).ListConnectors(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: Dex_ListConnectors_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(DexServer).ListConnectors(ctx, req.(*ListConnectorReq))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
 func _Dex_GetVersion_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
 	in := new(VersionReq)
 	if err := dec(in); err != nil {
@@ -368,7 +882,7 @@ func _Dex_GetVersion_Handler(srv interface{}, ctx context.Context, dec func(inte
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/api.Dex/GetVersion",
+		FullMethod: Dex_GetVersion_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(DexServer).GetVersion(ctx, req.(*VersionReq))
@@ -376,6 +890,24 @@ func _Dex_GetVersion_Handler(srv interface{}, ctx context.Context, dec func(inte
 	return interceptor(ctx, in, info, handler)
 }
 
+func _Dex_GetDiscovery_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(DiscoveryReq)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(DexServer).GetDiscovery(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: Dex_GetDiscovery_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(DexServer).GetDiscovery(ctx, req.(*DiscoveryReq))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
 func _Dex_ListRefresh_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
 	in := new(ListRefreshReq)
 	if err := dec(in); err != nil {
@@ -386,7 +918,7 @@ func _Dex_ListRefresh_Handler(srv interface{}, ctx context.Context, dec func(int
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/api.Dex/ListRefresh",
+		FullMethod: Dex_ListRefresh_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(DexServer).ListRefresh(ctx, req.(*ListRefreshReq))
@@ -404,7 +936,7 @@ func _Dex_RevokeRefresh_Handler(srv interface{}, ctx context.Context, dec func(i
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/api.Dex/RevokeRefresh",
+		FullMethod: Dex_RevokeRefresh_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(DexServer).RevokeRefresh(ctx, req.(*RevokeRefreshReq))
@@ -422,7 +954,7 @@ func _Dex_VerifyPassword_Handler(srv interface{}, ctx context.Context, dec func(
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/api.Dex/VerifyPassword",
+		FullMethod: Dex_VerifyPassword_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(DexServer).VerifyPassword(ctx, req.(*VerifyPasswordReq))
@@ -430,6 +962,240 @@ func _Dex_VerifyPassword_Handler(srv interface{}, ctx context.Context, dec func(
 	return interceptor(ctx, in, info, handler)
 }
 
+func _Dex_GetAuthSession_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(GetAuthSessionReq)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(DexServer).GetAuthSession(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: Dex_GetAuthSession_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(DexServer).GetAuthSession(ctx, req.(*GetAuthSessionReq))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _Dex_ListAuthSessions_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(ListAuthSessionsReq)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(DexServer).ListAuthSessions(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: Dex_ListAuthSessions_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(DexServer).ListAuthSessions(ctx, req.(*ListAuthSessionsReq))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _Dex_DeleteAuthSession_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(DeleteAuthSessionReq)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(DexServer).DeleteAuthSession(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: Dex_DeleteAuthSession_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(DexServer).DeleteAuthSession(ctx, req.(*DeleteAuthSessionReq))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _Dex_TerminateSessionsByConnector_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(TerminateSessionsByConnectorReq)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(DexServer).TerminateSessionsByConnector(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: Dex_TerminateSessionsByConnector_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(DexServer).TerminateSessionsByConnector(ctx, req.(*TerminateSessionsByConnectorReq))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _Dex_TerminateSessionsByUser_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(TerminateSessionsByUserReq)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(DexServer).TerminateSessionsByUser(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: Dex_TerminateSessionsByUser_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(DexServer).TerminateSessionsByUser(ctx, req.(*TerminateSessionsByUserReq))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _Dex_GetUserIdentity_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(GetUserIdentityReq)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(DexServer).GetUserIdentity(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: Dex_GetUserIdentity_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(DexServer).GetUserIdentity(ctx, req.(*GetUserIdentityReq))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _Dex_ListUserIdentities_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(ListUserIdentitiesReq)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(DexServer).ListUserIdentities(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: Dex_ListUserIdentities_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(DexServer).ListUserIdentities(ctx, req.(*ListUserIdentitiesReq))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _Dex_DeleteUserIdentity_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(DeleteUserIdentityReq)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(DexServer).DeleteUserIdentity(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: Dex_DeleteUserIdentity_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(DexServer).DeleteUserIdentity(ctx, req.(*DeleteUserIdentityReq))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _Dex_ResetMFA_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(ResetMFAReq)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(DexServer).ResetMFA(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: Dex_ResetMFA_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(DexServer).ResetMFA(ctx, req.(*ResetMFAReq))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _Dex_ListMFADevices_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(ListMFADevicesReq)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(DexServer).ListMFADevices(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: Dex_ListMFADevices_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(DexServer).ListMFADevices(ctx, req.(*ListMFADevicesReq))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _Dex_DeleteWebAuthnCredential_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(DeleteWebAuthnCredentialReq)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(DexServer).DeleteWebAuthnCredential(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: Dex_DeleteWebAuthnCredential_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(DexServer).DeleteWebAuthnCredential(ctx, req.(*DeleteWebAuthnCredentialReq))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _Dex_DeleteMFASecret_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(DeleteMFASecretReq)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(DexServer).DeleteMFASecret(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: Dex_DeleteMFASecret_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(DexServer).DeleteMFASecret(ctx, req.(*DeleteMFASecretReq))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _Dex_RevokeConsent_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(RevokeConsentReq)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(DexServer).RevokeConsent(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: Dex_RevokeConsent_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(DexServer).RevokeConsent(ctx, req.(*RevokeConsentReq))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
 // Dex_ServiceDesc is the grpc.ServiceDesc for Dex service.
 // It's only intended for direct use with grpc.RegisterService,
 // and not to be introspected or modified (even as a copy)
@@ -437,6 +1203,10 @@ var Dex_ServiceDesc = grpc.ServiceDesc{
 	ServiceName: "api.Dex",
 	HandlerType: (*DexServer)(nil),
 	Methods: []grpc.MethodDesc{
+		{
+			MethodName: "GetClient",
+			Handler:    _Dex_GetClient_Handler,
+		},
 		{
 			MethodName: "CreateClient",
 			Handler:    _Dex_CreateClient_Handler,
@@ -449,6 +1219,10 @@ var Dex_ServiceDesc = grpc.ServiceDesc{
 			MethodName: "DeleteClient",
 			Handler:    _Dex_DeleteClient_Handler,
 		},
+		{
+			MethodName: "ListClients",
+			Handler:    _Dex_ListClients_Handler,
+		},
 		{
 			MethodName: "CreatePassword",
 			Handler:    _Dex_CreatePassword_Handler,
@@ -465,10 +1239,30 @@ var Dex_ServiceDesc = grpc.ServiceDesc{
 			MethodName: "ListPasswords",
 			Handler:    _Dex_ListPasswords_Handler,
 		},
+		{
+			MethodName: "CreateConnector",
+			Handler:    _Dex_CreateConnector_Handler,
+		},
+		{
+			MethodName: "UpdateConnector",
+			Handler:    _Dex_UpdateConnector_Handler,
+		},
+		{
+			MethodName: "DeleteConnector",
+			Handler:    _Dex_DeleteConnector_Handler,
+		},
+		{
+			MethodName: "ListConnectors",
+			Handler:    _Dex_ListConnectors_Handler,
+		},
 		{
 			MethodName: "GetVersion",
 			Handler:    _Dex_GetVersion_Handler,
 		},
+		{
+			MethodName: "GetDiscovery",
+			Handler:    _Dex_GetDiscovery_Handler,
+		},
 		{
 			MethodName: "ListRefresh",
 			Handler:    _Dex_ListRefresh_Handler,
@@ -481,6 +1275,58 @@ var Dex_ServiceDesc = grpc.ServiceDesc{
 			MethodName: "VerifyPassword",
 			Handler:    _Dex_VerifyPassword_Handler,
 		},
+		{
+			MethodName: "GetAuthSession",
+			Handler:    _Dex_GetAuthSession_Handler,
+		},
+		{
+			MethodName: "ListAuthSessions",
+			Handler:    _Dex_ListAuthSessions_Handler,
+		},
+		{
+			MethodName: "DeleteAuthSession",
+			Handler:    _Dex_DeleteAuthSession_Handler,
+		},
+		{
+			MethodName: "TerminateSessionsByConnector",
+			Handler:    _Dex_TerminateSessionsByConnector_Handler,
+		},
+		{
+			MethodName: "TerminateSessionsByUser",
+			Handler:    _Dex_TerminateSessionsByUser_Handler,
+		},
+		{
+			MethodName: "GetUserIdentity",
+			Handler:    _Dex_GetUserIdentity_Handler,
+		},
+		{
+			MethodName: "ListUserIdentities",
+			Handler:    _Dex_ListUserIdentities_Handler,
+		},
+		{
+			MethodName: "DeleteUserIdentity",
+			Handler:    _Dex_DeleteUserIdentity_Handler,
+		},
+		{
+			MethodName: "ResetMFA",
+			Handler:    _Dex_ResetMFA_Handler,
+		},
+		{
+			MethodName: "ListMFADevices",
+			Handler:    _Dex_ListMFADevices_Handler,
+		},
+		{
+			MethodName: "DeleteWebAuthnCredential",
+			Handler:    _Dex_DeleteWebAuthnCredential_Handler,
+		},
+		{
+			MethodName: "DeleteMFASecret",
+			Handler:    _Dex_DeleteMFASecret_Handler,
+		},
+		{
+			MethodName: "RevokeConsent",
+			Handler:    _Dex_RevokeConsent_Handler,
+		},
 	},
 	Streams:  []grpc.StreamDesc{},
 	Metadata: "api/v2/api.proto",
diff --git a/api/v2/go.mod b/api/v2/go.mod
index dc78ec4d96..7a721647e3 100644
--- a/api/v2/go.mod
+++ b/api/v2/go.mod
@@ -1,16 +1,15 @@
 module github.com/dexidp/dex/api/v2
 
-go 1.17
+go 1.25.0
 
 require (
-	google.golang.org/grpc v1.47.0
-	google.golang.org/protobuf v1.28.1
+	google.golang.org/grpc v1.82.0
+	google.golang.org/protobuf v1.36.11
 )
 
 require (
-	github.com/golang/protobuf v1.5.2 // indirect
-	golang.org/x/net v0.0.0-20220607020251-c690dde0001d // indirect
-	golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a // indirect
-	golang.org/x/text v0.3.7 // indirect
-	google.golang.org/genproto v0.0.0-20220602131408-e326c6e8e9c8 // indirect
+	golang.org/x/net v0.55.0 // indirect
+	golang.org/x/sys v0.45.0 // indirect
+	golang.org/x/text v0.37.0 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20260414002931-afd174a4e478 // indirect
 )
diff --git a/api/v2/go.sum b/api/v2/go.sum
index 59d53d2d63..78b5eb1715 100644
--- a/api/v2/go.sum
+++ b/api/v2/go.sum
@@ -1,142 +1,38 @@
-cloud.google.com/go v0.26.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
-cloud.google.com/go v0.34.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
-github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
-github.com/antihax/optional v1.0.0/go.mod h1:uupD/76wgC+ih3iEmQUL+0Ugr19nfwCT1kdvxnR2qWY=
-github.com/census-instrumentation/opencensus-proto v0.2.1/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU=
-github.com/cespare/xxhash/v2 v2.1.1/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
-github.com/client9/misspell v0.3.4/go.mod h1:qj6jICC3Q7zFZvVWo7KLAzC3yx5G7kyvSDkc90ppPyw=
-github.com/cncf/udpa/go v0.0.0-20191209042840-269d4d468f6f/go.mod h1:M8M6+tZqaGXZJjfX53e64911xZQV5JYwmTeXPW+k8Sc=
-github.com/cncf/udpa/go v0.0.0-20201120205902-5459f2c99403/go.mod h1:WmhPx2Nbnhtbo57+VJT5O0JRkEi1Wbu0z5j0R8u5Hbk=
-github.com/cncf/udpa/go v0.0.0-20210930031921-04548b0d99d4/go.mod h1:6pvJx4me5XPnfI9Z40ddWsdw2W/uZgQLFXToKeRcDiI=
-github.com/cncf/xds/go v0.0.0-20210922020428-25de7278fc84/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
-github.com/cncf/xds/go v0.0.0-20211001041855-01bcc9b48dfe/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
-github.com/cncf/xds/go v0.0.0-20211011173535-cb28da3451f1/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
-github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/envoyproxy/go-control-plane v0.9.0/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4=
-github.com/envoyproxy/go-control-plane v0.9.1-0.20191026205805-5f8ba28d4473/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4=
-github.com/envoyproxy/go-control-plane v0.9.4/go.mod h1:6rpuAdCZL397s3pYoYcLgu1mIlRU8Am5FuJP05cCM98=
-github.com/envoyproxy/go-control-plane v0.9.9-0.20201210154907-fd9021fe5dad/go.mod h1:cXg6YxExXjJnVBQHBLXeUAgxn2UodCpnH306RInaBQk=
-github.com/envoyproxy/go-control-plane v0.10.2-0.20220325020618-49ff273808a1/go.mod h1:KJwIaB5Mv44NWtYuAOFCVOjcI94vtpEz2JU/D2v6IjE=
-github.com/envoyproxy/protoc-gen-validate v0.1.0/go.mod h1:iSmxcyjqTsJpI2R4NaDN7+kN2VEUnK/pcBlmesArF7c=
-github.com/ghodss/yaml v1.0.0/go.mod h1:4dBDuWmgqj2HViK6kFavaiC9ZROes6MMH2rRYeMEF04=
-github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b/go.mod h1:SBH7ygxi8pfUlaOkMMuAQtPIUF8ecWP5IEl/CR7VP2Q=
-github.com/golang/mock v1.1.1/go.mod h1:oTYuIxOrZwtPieC+H1uAHpcLFnEyAGVDL/k47Jfbm0A=
-github.com/golang/protobuf v1.2.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
-github.com/golang/protobuf v1.3.2/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
-github.com/golang/protobuf v1.3.3/go.mod h1:vzj43D7+SQXF/4pzW/hwtAqwc6iTitCiVSaWz5lYuqw=
-github.com/golang/protobuf v1.4.0-rc.1/go.mod h1:ceaxUfeHdC40wWswd/P6IGgMaK3YpKi5j83Wpe3EHw8=
-github.com/golang/protobuf v1.4.0-rc.1.0.20200221234624-67d41d38c208/go.mod h1:xKAWHe0F5eneWXFV3EuXVDTCmh+JuBKY0li0aMyXATA=
-github.com/golang/protobuf v1.4.0-rc.2/go.mod h1:LlEzMj4AhA7rCAGe4KMBDvJI+AwstrUpVNzEA03Pprs=
-github.com/golang/protobuf v1.4.0-rc.4.0.20200313231945-b860323f09d0/go.mod h1:WU3c8KckQ9AFe+yFwt9sWVRKCVIyN9cPHBJSNnbL67w=
-github.com/golang/protobuf v1.4.0/go.mod h1:jodUvKwWbYaEsadDk5Fwe5c77LiNKVO9IDvqG2KuDX0=
-github.com/golang/protobuf v1.4.1/go.mod h1:U8fpvMrcmy5pZrNK1lt4xCsGvpyWQ/VVv6QDs8UjoX8=
-github.com/golang/protobuf v1.4.2/go.mod h1:oDoupMAO8OvCJWAcko0GGGIgR6R6ocIYbsSw735rRwI=
-github.com/golang/protobuf v1.4.3/go.mod h1:oDoupMAO8OvCJWAcko0GGGIgR6R6ocIYbsSw735rRwI=
-github.com/golang/protobuf v1.5.0/go.mod h1:FsONVRAS9T7sI+LIUmWTfcYkHO4aIWwzhcaSAoJOfIk=
-github.com/golang/protobuf v1.5.2 h1:ROPKBNFfQgOUMifHyP+KYbvpjbdoFNs+aK7DXlji0Tw=
-github.com/golang/protobuf v1.5.2/go.mod h1:XVQd3VNwM+JqD3oG2Ue2ip4fOMUkwXdXDdiuN0vRsmY=
-github.com/google/go-cmp v0.2.0/go.mod h1:oXzfMopK8JAjlY9xF4vHSVASa0yLyX7SntLO5aqRK0M=
-github.com/google/go-cmp v0.3.0/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
-github.com/google/go-cmp v0.3.1/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
-github.com/google/go-cmp v0.4.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/go-cmp v0.5.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/go-cmp v0.5.6 h1:BKbKCqvP6I+rmFHt06ZmyQtvB8xAkWdhFyr0ZUNZcxQ=
-github.com/google/go-cmp v0.5.6/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/uuid v1.1.2/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
-github.com/grpc-ecosystem/grpc-gateway v1.16.0/go.mod h1:BDjrQk3hbvj6Nolgz8mAMFbcEtjT1g+wF4CSlocrBnw=
-github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
-github.com/prometheus/client_model v0.0.0-20190812154241-14fe0d1b01d4/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
-github.com/rogpeppe/fastuuid v1.2.0/go.mod h1:jVj6XXZzXRy/MSR5jhDC/2q6DgLz+nrA6LYCDYWNEvQ=
-github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
-github.com/stretchr/testify v1.5.1/go.mod h1:5W2xD1RspED5o8YsWQXVCued0rvSQ+mT+I5cxcmMvtA=
-github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
-go.opentelemetry.io/proto/otlp v0.7.0/go.mod h1:PqfVotwruBrMGOCsRd/89rSnXhoiJIqeYNgFYFoEGnI=
-golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
-golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
-golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
-golang.org/x/lint v0.0.0-20181026193005-c67002cb31c3/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
-golang.org/x/lint v0.0.0-20190227174305-5b3e6a55c961/go.mod h1:wehouNa3lNwaWXcvxsM5YxQ5yQlVC4a0KAMCusXpPoU=
-golang.org/x/lint v0.0.0-20190313153728-d0100b6bd8b3/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
-golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
-golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
-golang.org/x/net v0.0.0-20190108225652-1e06a53dbb7e/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
-golang.org/x/net v0.0.0-20190213061140-3a22650c66bd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
-golang.org/x/net v0.0.0-20190311183353-d8887717615a/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
-golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
-golang.org/x/net v0.0.0-20200822124328-c89045814202/go.mod h1:/O7V0waA8r7cgGh81Ro3o1hOxt32SMVPicZroKQ2sZA=
-golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
-golang.org/x/net v0.0.0-20210405180319-a5a99cb37ef4/go.mod h1:p54w0d4576C0XHj96bSt6lcn1PtDYWL6XObtHCRCNQM=
-golang.org/x/net v0.0.0-20220607020251-c690dde0001d h1:4SFsTMi4UahlKoloni7L4eYzhFRifURQLw+yv0QDCx8=
-golang.org/x/net v0.0.0-20220607020251-c690dde0001d/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
-golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
-golang.org/x/oauth2 v0.0.0-20200107190931-bf48bf16ab8d/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
-golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20181221193216-37e7f081c4d4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
-golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
-golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200323222414-85ca7c5b95cd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210119212857-b64e53b001e4/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210330210617-4fbd30eecc44/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210510120138-977fb7262007/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a h1:dGzPydgVsqGcTRVwiLJ1jVbufYwmzD3LfVPLKsKg+0k=
-golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
-golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
-golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
-golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
-golang.org/x/text v0.3.5/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
-golang.org/x/text v0.3.7 h1:olpwvP2KacW1ZWvsR7uQhoyTYvKAupfQrRGBFM352Gk=
-golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
-golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
-golang.org/x/tools v0.0.0-20190114222345-bf090417da8b/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
-golang.org/x/tools v0.0.0-20190226205152-f727befe758c/go.mod h1:9Yl7xja0Znq3iFh3HoIrodX9oNMXvdceNzlUR8zjMvY=
-golang.org/x/tools v0.0.0-20190311212946-11955173bddd/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
-golang.org/x/tools v0.0.0-20190524140312-2c0ae7006135/go.mod h1:RgjU9mgBXZiqYHBnxXauZ1Gv1EHHAz9KjViQ78xBX0Q=
-golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1 h1:go1bK/D/BFZV2I8cIQd1NKEZ+0owSTG1fDTci4IqFcE=
-golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-google.golang.org/appengine v1.1.0/go.mod h1:EbEs0AVv82hx2wNQdGPgUI5lhzA/G0D9YwlJXL52JkM=
-google.golang.org/appengine v1.4.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
-google.golang.org/genproto v0.0.0-20180817151627-c66870c02cf8/go.mod h1:JiN7NxoALGmiZfu7CAH4rXhgtRTLTxftemlI0sWmxmc=
-google.golang.org/genproto v0.0.0-20190819201941-24fa4b261c55/go.mod h1:DMBHOl98Agz4BDEuKkezgsaosCRResVns1a3J2ZsMNc=
-google.golang.org/genproto v0.0.0-20200513103714-09dca8ec2884/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
-google.golang.org/genproto v0.0.0-20200526211855-cb27e3aa2013/go.mod h1:NbSheEEYHJ7i3ixzK3sjbqSGDJWnxyFXZblF3eUsNvo=
-google.golang.org/genproto v0.0.0-20220602131408-e326c6e8e9c8 h1:qRu95HZ148xXw+XeZ3dvqe85PxH4X8+jIo0iRPKcEnM=
-google.golang.org/genproto v0.0.0-20220602131408-e326c6e8e9c8/go.mod h1:yKyY4AMRwFiC8yMMNaMi+RkCnjZJt9LoWuvhXjMs+To=
-google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c=
-google.golang.org/grpc v1.23.0/go.mod h1:Y5yQAOtifL1yxbo5wqy6BxZv8vAUGQwXBOALyacEbxg=
-google.golang.org/grpc v1.25.1/go.mod h1:c3i+UQWmh7LiEpx4sFZnkU36qjEYZ0imhYfXVyQciAY=
-google.golang.org/grpc v1.27.0/go.mod h1:qbnxyOmOxrQa7FizSgH+ReBfzJrCY1pSN7KXBS8abTk=
-google.golang.org/grpc v1.33.1/go.mod h1:fr5YgcSWrqhRRxogOsw7RzIpsmvOZ6IcH4kBYTpR3n0=
-google.golang.org/grpc v1.36.0/go.mod h1:qjiiYl8FncCW8feJPdyg3v6XW24KsRHe+dy9BAGRRjU=
-google.golang.org/grpc v1.46.2/go.mod h1:vN9eftEi1UMyUsIF80+uQXhHjbXYbm0uXoFCACuMGWk=
-google.golang.org/grpc v1.47.0 h1:9n77onPX5F3qfFCqjy9dhn8PbNQsIKeVU04J9G7umt8=
-google.golang.org/grpc v1.47.0/go.mod h1:vN9eftEi1UMyUsIF80+uQXhHjbXYbm0uXoFCACuMGWk=
-google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8=
-google.golang.org/protobuf v0.0.0-20200221191635-4d8936d0db64/go.mod h1:kwYJMbMJ01Woi6D6+Kah6886xMZcty6N08ah7+eCXa0=
-google.golang.org/protobuf v0.0.0-20200228230310-ab0ca4ff8a60/go.mod h1:cfTl7dwQJ+fmap5saPgwCLgHXTUD7jkjRqWcaiX5VyM=
-google.golang.org/protobuf v1.20.1-0.20200309200217-e05f789c0967/go.mod h1:A+miEFZTKqfCUM6K7xSMQL9OKL/b6hQv+e19PK+JZNE=
-google.golang.org/protobuf v1.21.0/go.mod h1:47Nbq4nVaFHyn7ilMalzfO3qCViNmqZ2kzikPIcrTAo=
-google.golang.org/protobuf v1.22.0/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
-google.golang.org/protobuf v1.23.0/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
-google.golang.org/protobuf v1.23.1-0.20200526195155-81db48ad09cc/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
-google.golang.org/protobuf v1.25.0/go.mod h1:9JNX74DMeImyA3h4bdi1ymwjUzf21/xIlbajtzgsN7c=
-google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw=
-google.golang.org/protobuf v1.26.0/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
-google.golang.org/protobuf v1.27.1/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
-google.golang.org/protobuf v1.28.0/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I=
-google.golang.org/protobuf v1.28.1 h1:d0NfwRgPtno5B1Wa6L2DAG+KivqkdutMf1UhdNx175w=
-google.golang.org/protobuf v1.28.1/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I=
-gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
-gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
-gopkg.in/yaml.v2 v2.2.3/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
-gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
-honnef.co/go/tools v0.0.0-20190102054323-c2f93a96b099/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
-honnef.co/go/tools v0.0.0-20190523083050-ea95bdfd59fc/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
+github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=
+github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
+github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI=
+github.com/go-logr/logr v1.4.3/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
+github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=
+github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE=
+github.com/golang/protobuf v1.5.4 h1:i7eJL8qZTpSEXOPTxNKhASYpMn+8e5Q6AdndVa1dWek=
+github.com/golang/protobuf v1.5.4/go.mod h1:lnTiLA8Wa4RWRcIUkrtSVa5nRhsEGBg48fD6rSs7xps=
+github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
+github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
+github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
+github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
+go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ64=
+go.opentelemetry.io/auto/sdk v1.2.1/go.mod h1:KRTj+aOaElaLi+wW1kO/DZRXwkF4C5xPbEe3ZiIhN7Y=
+go.opentelemetry.io/otel v1.43.0 h1:mYIM03dnh5zfN7HautFE4ieIig9amkNANT+xcVxAj9I=
+go.opentelemetry.io/otel v1.43.0/go.mod h1:JuG+u74mvjvcm8vj8pI5XiHy1zDeoCS2LB1spIq7Ay0=
+go.opentelemetry.io/otel/metric v1.43.0 h1:d7638QeInOnuwOONPp4JAOGfbCEpYb+K6DVWvdxGzgM=
+go.opentelemetry.io/otel/metric v1.43.0/go.mod h1:RDnPtIxvqlgO8GRW18W6Z/4P462ldprJtfxHxyKd2PY=
+go.opentelemetry.io/otel/sdk v1.43.0 h1:pi5mE86i5rTeLXqoF/hhiBtUNcrAGHLKQdhg4h4V9Dg=
+go.opentelemetry.io/otel/sdk v1.43.0/go.mod h1:P+IkVU3iWukmiit/Yf9AWvpyRDlUeBaRg6Y+C58QHzg=
+go.opentelemetry.io/otel/sdk/metric v1.43.0 h1:S88dyqXjJkuBNLeMcVPRFXpRw2fuwdvfCGLEo89fDkw=
+go.opentelemetry.io/otel/sdk/metric v1.43.0/go.mod h1:C/RJtwSEJ5hzTiUz5pXF1kILHStzb9zFlIEe85bhj6A=
+go.opentelemetry.io/otel/trace v1.43.0 h1:BkNrHpup+4k4w+ZZ86CZoHHEkohws8AY+WTX09nk+3A=
+go.opentelemetry.io/otel/trace v1.43.0/go.mod h1:/QJhyVBUUswCphDVxq+8mld+AvhXZLhe+8WVFxiFff0=
+golang.org/x/net v0.55.0 h1:bcvxaJn3e1U6InsFWt1JUq1aSjnRxLzT2rtD2KfkDF8=
+golang.org/x/net v0.55.0/go.mod h1:L5U2KuzuOe1lY7Z+aWVIKK6qEeJXnXV9yzGA+WCHJww=
+golang.org/x/sys v0.45.0 h1:dO4czNzziLiiXplLQgBCEpCvXQ3dnkn0SdaZSYdQ+FY=
+golang.org/x/sys v0.45.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
+golang.org/x/text v0.37.0 h1:Cqjiwd9eSg8e0QAkyCaQTNHFIIzWtidPahFWR83rTrc=
+golang.org/x/text v0.37.0/go.mod h1:a5sjxXGs9hsn/AJVwuElvCAo9v8QYLzvavO5z2PiM38=
+gonum.org/v1/gonum v0.17.0 h1:VbpOemQlsSMrYmn7T2OUvQ4dqxQXU+ouZFQsZOx50z4=
+gonum.org/v1/gonum v0.17.0/go.mod h1:El3tOrEuMpv2UdMrbNlKEh9vd86bmQ6vqIcDwxEOc1E=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20260414002931-afd174a4e478 h1:RmoJA1ujG+/lRGNfUnOMfhCy5EipVMyvUE+KNbPbTlw=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20260414002931-afd174a4e478/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8=
+google.golang.org/grpc v1.82.0 h1:vguDnZUPjE26w09A63VoxZPnvPjB5Riyc0mkXPFmAIU=
+google.golang.org/grpc v1.82.0/go.mod h1:yzTZ1TB1Z3SG+LIYaI+WiE8D5+PZ3ArnrSp8zF3+/ZA=
+google.golang.org/protobuf v1.36.11 h1:fV6ZwhNocDyBLK0dj+fg8ektcVegBBuEolpbTQyBNVE=
+google.golang.org/protobuf v1.36.11/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
diff --git a/cmd/dex/config.go b/cmd/dex/config.go
index 7bb7fbb780..c9ac6c8888 100644
--- a/cmd/dex/config.go
+++ b/cmd/dex/config.go
@@ -1,17 +1,23 @@
 package main
 
 import (
+	"bytes"
 	"encoding/base64"
 	"encoding/json"
 	"fmt"
+	"log/slog"
+	"net/http"
+	"net/netip"
 	"os"
-	"strconv"
 	"strings"
 
+	"github.com/go-jose/go-jose/v4"
 	"golang.org/x/crypto/bcrypt"
 
-	"github.com/dexidp/dex/pkg/log"
+	"github.com/dexidp/dex/pkg/featureflags"
 	"github.com/dexidp/dex/server"
+	"github.com/dexidp/dex/server/connectors"
+	"github.com/dexidp/dex/server/signer"
 	"github.com/dexidp/dex/storage"
 	"github.com/dexidp/dex/storage/ent"
 	"github.com/dexidp/dex/storage/etcd"
@@ -20,6 +26,15 @@ import (
 	"github.com/dexidp/dex/storage/sql"
 )
 
+func configUnmarshaller(b []byte, v interface{}) error {
+	if !featureflags.ConfigDisallowUnknownFields.Enabled() {
+		return json.Unmarshal(b, v)
+	}
+	dec := json.NewDecoder(bytes.NewReader(b))
+	dec.DisallowUnknownFields()
+	return dec.Decode(v)
+}
+
 // Config is the config format for the main application.
 type Config struct {
 	Issuer    string    `json:"issuer"`
@@ -33,6 +48,9 @@ type Config struct {
 
 	Frontend server.WebConfig `json:"frontend"`
 
+	// Signer configuration controls signing of JWT tokens issued by Dex.
+	Signer Signer `json:"signer"`
+
 	// StaticConnectors are user defined connectors specified in the ConfigMap
 	// Write operations, like updating a connector, will fail.
 	StaticConnectors []Connector `json:"connectors"`
@@ -49,6 +67,23 @@ type Config struct {
 	// querying the storage. Cannot be specified without enabling a passwords
 	// database.
 	StaticPasswords []password `json:"staticPasswords"`
+
+	// Sessions holds authentication session configuration.
+	// Requires DEX_SESSIONS_ENABLED=true feature flag.
+	Sessions *Sessions `json:"sessions"`
+
+	// MFA holds multi-factor authentication configuration.
+	MFA MFAConfig `json:"mfa"`
+}
+
+// MFAConfig holds multi-factor authentication settings.
+type MFAConfig struct {
+	// Authenticators defines MFA providers available for clients to reference.
+	Authenticators []MFAAuthenticator `json:"authenticators"`
+
+	// DefaultMFAChain is the default ordered list of authenticator IDs applied
+	// to clients that don't specify their own mfaChain. Empty means no MFA by default.
+	DefaultMFAChain []string `json:"defaultMFAChain"`
 }
 
 // Validate the configuration
@@ -64,10 +99,16 @@ func (c Config) Validate() error {
 		{c.Web.HTTP == "" && c.Web.HTTPS == "", "must supply a HTTP/HTTPS  address to listen on"},
 		{c.Web.HTTPS != "" && c.Web.TLSCert == "", "no cert specified for HTTPS"},
 		{c.Web.HTTPS != "" && c.Web.TLSKey == "", "no private key specified for HTTPS"},
+		{c.Web.TLSMinVersion != "" && c.Web.TLSMinVersion != "1.2" && c.Web.TLSMinVersion != "1.3", "supported TLS versions are: 1.2, 1.3"},
+		{c.Web.TLSMaxVersion != "" && c.Web.TLSMaxVersion != "1.2" && c.Web.TLSMaxVersion != "1.3", "supported TLS versions are: 1.2, 1.3"},
+		{c.Web.TLSMaxVersion != "" && c.Web.TLSMinVersion != "" && c.Web.TLSMinVersion > c.Web.TLSMaxVersion, "TLSMinVersion greater than TLSMaxVersion"},
 		{c.GRPC.TLSCert != "" && c.GRPC.Addr == "", "no address specified for gRPC"},
 		{c.GRPC.TLSKey != "" && c.GRPC.Addr == "", "no address specified for gRPC"},
 		{(c.GRPC.TLSCert == "") != (c.GRPC.TLSKey == ""), "must specific both a gRPC TLS cert and key"},
 		{c.GRPC.TLSCert == "" && c.GRPC.TLSClientCA != "", "cannot specify gRPC TLS client CA without a gRPC TLS cert"},
+		{c.GRPC.TLSMinVersion != "" && c.GRPC.TLSMinVersion != "1.2" && c.GRPC.TLSMinVersion != "1.3", "supported TLS versions are: 1.2, 1.3"},
+		{c.GRPC.TLSMaxVersion != "" && c.GRPC.TLSMaxVersion != "1.2" && c.GRPC.TLSMaxVersion != "1.3", "supported TLS versions are: 1.2, 1.3"},
+		{c.GRPC.TLSMaxVersion != "" && c.GRPC.TLSMinVersion != "" && c.GRPC.TLSMinVersion > c.GRPC.TLSMaxVersion, "TLSMinVersion greater than TLSMaxVersion"},
 	}
 
 	var checkErrors []string
@@ -77,9 +118,69 @@ func (c Config) Validate() error {
 			checkErrors = append(checkErrors, check.errMsg)
 		}
 	}
+
 	if len(checkErrors) != 0 {
 		return fmt.Errorf("invalid Config:\n\t-\t%s", strings.Join(checkErrors, "\n\t-\t"))
 	}
+
+	if c.Sessions != nil && !featureflags.SessionsEnabled.Enabled() {
+		return fmt.Errorf("sessions config requires sessions to be enabled (DEX_SESSIONS_ENABLED=true)")
+	}
+
+	if err := c.validateMFA(); err != nil {
+		return err
+	}
+
+	for _, client := range c.StaticClients {
+		if err := storage.ValidateRefreshTokenLifetime(client.RefreshTokenLifetime); err != nil {
+			return fmt.Errorf("staticClients: client %q: %w", client.ID, err)
+		}
+	}
+
+	return nil
+}
+
+func (c Config) validateMFA() error {
+	mfa := c.MFA
+	if len(mfa.Authenticators) == 0 && len(mfa.DefaultMFAChain) == 0 {
+		return nil
+	}
+
+	if !featureflags.SessionsEnabled.Enabled() {
+		return fmt.Errorf("mfa requires sessions to be enabled (DEX_SESSIONS_ENABLED=true)")
+	}
+
+	knownTypes := map[string]bool{"TOTP": true, "WebAuthn": true}
+	ids := make(map[string]bool, len(mfa.Authenticators))
+
+	for _, auth := range mfa.Authenticators {
+		if auth.ID == "" {
+			return fmt.Errorf("mfa.authenticators: authenticator must have an id")
+		}
+		if ids[auth.ID] {
+			return fmt.Errorf("mfa.authenticators: duplicate authenticator id %q", auth.ID)
+		}
+		ids[auth.ID] = true
+
+		if !knownTypes[auth.Type] {
+			return fmt.Errorf("mfa.authenticators: unknown type %q for authenticator %q", auth.Type, auth.ID)
+		}
+	}
+
+	for _, authID := range mfa.DefaultMFAChain {
+		if !ids[authID] {
+			return fmt.Errorf("mfa.defaultMFAChain: references unknown authenticator %q", authID)
+		}
+	}
+
+	for _, client := range c.StaticClients {
+		for _, authID := range client.MFAChain {
+			if !ids[authID] {
+				return fmt.Errorf("staticClients: client %q references unknown MFA authenticator %q", client.ID, authID)
+			}
+		}
+	}
+
 	return nil
 }
 
@@ -87,19 +188,27 @@ type password storage.Password
 
 func (p *password) UnmarshalJSON(b []byte) error {
 	var data struct {
-		Email       string `json:"email"`
-		Username    string `json:"username"`
-		UserID      string `json:"userID"`
-		Hash        string `json:"hash"`
-		HashFromEnv string `json:"hashFromEnv"`
+		Email             string   `json:"email"`
+		Username          string   `json:"username"`
+		Name              string   `json:"name"`
+		PreferredUsername string   `json:"preferredUsername"`
+		EmailVerified     *bool    `json:"emailVerified"`
+		UserID            string   `json:"userID"`
+		Hash              string   `json:"hash"`
+		HashFromEnv       string   `json:"hashFromEnv"`
+		Groups            []string `json:"groups"`
 	}
-	if err := json.Unmarshal(b, &data); err != nil {
+	if err := configUnmarshaller(b, &data); err != nil {
 		return err
 	}
 	*p = password(storage.Password{
-		Email:    data.Email,
-		Username: data.Username,
-		UserID:   data.UserID,
+		Email:             data.Email,
+		Username:          data.Username,
+		Name:              data.Name,
+		PreferredUsername: data.PreferredUsername,
+		EmailVerified:     data.EmailVerified,
+		UserID:            data.UserID,
+		Groups:            data.Groups,
 	})
 	if len(data.Hash) == 0 && len(data.HashFromEnv) > 0 {
 		data.Hash = os.Getenv(data.HashFromEnv)
@@ -129,6 +238,10 @@ func (p *password) UnmarshalJSON(b []byte) error {
 
 // OAuth2 describes enabled OAuth2 extensions.
 type OAuth2 struct {
+	// list of allowed grant types,
+	// defaults to all supported types
+	GrantTypes []string `json:"grantTypes"`
+
 	ResponseTypes []string `json:"responseTypes"`
 	// If specified, do not prompt the user to approve client authorization. The
 	// act of logging in implies authorization.
@@ -137,15 +250,98 @@ type OAuth2 struct {
 	AlwaysShowLoginScreen bool `json:"alwaysShowLoginScreen"`
 	// This is the connector that can be used for password grant
 	PasswordConnector string `json:"passwordConnector"`
+	// PKCE configuration
+	PKCE PKCE `json:"pkce"`
+}
+
+// PKCE holds the PKCE (Proof Key for Code Exchange) configuration.
+type PKCE struct {
+	// If true, PKCE is required for all authorization code flows.
+	Enforce bool `json:"enforce"`
+	// Supported code challenge methods. Defaults to ["S256", "plain"].
+	CodeChallengeMethodsSupported []string `json:"codeChallengeMethodsSupported"`
 }
 
 // Web is the config format for the HTTP server.
 type Web struct {
-	HTTP           string   `json:"http"`
-	HTTPS          string   `json:"https"`
-	TLSCert        string   `json:"tlsCert"`
-	TLSKey         string   `json:"tlsKey"`
-	AllowedOrigins []string `json:"allowedOrigins"`
+	HTTP           string         `json:"http"`
+	HTTPS          string         `json:"https"`
+	Headers        Headers        `json:"headers"`
+	TLSCert        string         `json:"tlsCert"`
+	TLSKey         string         `json:"tlsKey"`
+	TLSMinVersion  string         `json:"tlsMinVersion"`
+	TLSMaxVersion  string         `json:"tlsMaxVersion"`
+	AllowedOrigins []string       `json:"allowedOrigins"`
+	AllowedHeaders []string       `json:"allowedHeaders"`
+	ClientRemoteIP ClientRemoteIP `json:"clientRemoteIP"`
+}
+
+type ClientRemoteIP struct {
+	Header         string   `json:"header"`
+	TrustedProxies []string `json:"trustedProxies"`
+}
+
+func (cr *ClientRemoteIP) ParseTrustedProxies() ([]netip.Prefix, error) {
+	if cr == nil {
+		return nil, nil
+	}
+
+	trusted := make([]netip.Prefix, 0, len(cr.TrustedProxies))
+	for _, cidr := range cr.TrustedProxies {
+		ipNet, err := netip.ParsePrefix(cidr)
+		if err != nil {
+			return nil, fmt.Errorf("failed to parse CIDR %q: %v", cidr, err)
+		}
+		trusted = append(trusted, ipNet)
+	}
+
+	return trusted, nil
+}
+
+type Headers struct {
+	// Set the Content-Security-Policy header to HTTP responses.
+	// Unset if blank.
+	// https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy
+	ContentSecurityPolicy string `json:"Content-Security-Policy"`
+	// Set the X-Frame-Options header to HTTP responses.
+	// Unset if blank. Accepted values are deny and sameorigin.
+	// https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options
+	XFrameOptions string `json:"X-Frame-Options"`
+	// Set the X-Content-Type-Options header to HTTP responses.
+	// Unset if blank. Accepted value is nosniff.
+	// https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Content-Type-Options
+	XContentTypeOptions string `json:"X-Content-Type-Options"`
+	// Set the X-XSS-Protection header to all responses.
+	// Unset if blank.
+	// https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-XSS-Protection
+	XXSSProtection string `json:"X-XSS-Protection"`
+	// Set the Strict-Transport-Security header to HTTP responses.
+	// Unset if blank.
+	// https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Strict-Transport-Security
+	StrictTransportSecurity string `json:"Strict-Transport-Security"`
+}
+
+func (h *Headers) ToHTTPHeader() http.Header {
+	if h == nil {
+		return make(map[string][]string)
+	}
+	header := make(map[string][]string)
+	if h.ContentSecurityPolicy != "" {
+		header["Content-Security-Policy"] = []string{h.ContentSecurityPolicy}
+	}
+	if h.XFrameOptions != "" {
+		header["X-Frame-Options"] = []string{h.XFrameOptions}
+	}
+	if h.XContentTypeOptions != "" {
+		header["X-Content-Type-Options"] = []string{h.XContentTypeOptions}
+	}
+	if h.XXSSProtection != "" {
+		header["X-XSS-Protection"] = []string{h.XXSSProtection}
+	}
+	if h.StrictTransportSecurity != "" {
+		header["Strict-Transport-Security"] = []string{h.StrictTransportSecurity}
+	}
+	return header
 }
 
 // Telemetry is the config format for telemetry including the HTTP server config.
@@ -158,11 +354,13 @@ type Telemetry struct {
 // GRPC is the config for the gRPC API.
 type GRPC struct {
 	// The port to listen on.
-	Addr        string `json:"addr"`
-	TLSCert     string `json:"tlsCert"`
-	TLSKey      string `json:"tlsKey"`
-	TLSClientCA string `json:"tlsClientCA"`
-	Reflection  bool   `json:"reflection"`
+	Addr          string `json:"addr"`
+	TLSCert       string `json:"tlsCert"`
+	TLSKey        string `json:"tlsKey"`
+	TLSClientCA   string `json:"tlsClientCA"`
+	TLSMinVersion string `json:"tlsMinVersion"`
+	TLSMaxVersion string `json:"tlsMaxVersion"`
+	Reflection    bool   `json:"reflection"`
 }
 
 // Storage holds app's storage configuration.
@@ -173,7 +371,7 @@ type Storage struct {
 
 // StorageConfig is a configuration that can create a storage.
 type StorageConfig interface {
-	Open(logger log.Logger) (storage.Storage, error)
+	Open(logger *slog.Logger) (storage.Storage, error)
 }
 
 var (
@@ -188,13 +386,32 @@ var (
 	_ StorageConfig = (*ent.MySQL)(nil)
 )
 
-func getORMBasedSQLStorage(normal, entBased StorageConfig) func() StorageConfig {
+func getORMBasedSQLStorage(normal, entBased func() StorageConfig) func() StorageConfig {
 	return func() StorageConfig {
-		switch os.Getenv("DEX_ENT_ENABLED") {
-		case "true", "yes":
-			return entBased
-		default:
-			return normal
+		if featureflags.EntEnabled.Enabled() {
+			return entBased()
+		}
+		return normal()
+	}
+}
+
+// Recursively expand environment variables in the map to avoid
+// issues with JSON special characters and escapes
+func expandEnvInMap(m map[string]interface{}) {
+	for k, v := range m {
+		switch vt := v.(type) {
+		case string:
+			m[k] = os.ExpandEnv(vt)
+		case map[string]interface{}:
+			expandEnvInMap(vt)
+		case []interface{}:
+			for i, item := range vt {
+				if itemMap, ok := item.(map[string]interface{}); ok {
+					expandEnvInMap(itemMap)
+				} else if itemString, ok := item.(string); ok {
+					vt[i] = os.ExpandEnv(itemString)
+				}
+			}
 		}
 	}
 }
@@ -203,22 +420,9 @@ var storages = map[string]func() StorageConfig{
 	"etcd":       func() StorageConfig { return new(etcd.Etcd) },
 	"kubernetes": func() StorageConfig { return new(kubernetes.Config) },
 	"memory":     func() StorageConfig { return new(memory.Config) },
-	"sqlite3":    getORMBasedSQLStorage(&sql.SQLite3{}, &ent.SQLite3{}),
-	"postgres":   getORMBasedSQLStorage(&sql.Postgres{}, &ent.Postgres{}),
-	"mysql":      getORMBasedSQLStorage(&sql.MySQL{}, &ent.MySQL{}),
-}
-
-// isExpandEnvEnabled returns if os.ExpandEnv should be used for each storage and connector config.
-// Disabling this feature avoids surprises e.g. if the LDAP bind password contains a dollar character.
-// Returns false if the env variable "DEX_EXPAND_ENV" is a falsy string, e.g. "false".
-// Returns true if the env variable is unset or a truthy string, e.g. "true", or can't be parsed as bool.
-func isExpandEnvEnabled() bool {
-	enabled, err := strconv.ParseBool(os.Getenv("DEX_EXPAND_ENV"))
-	if err != nil {
-		// Unset, empty string or can't be parsed as bool: Default = true.
-		return true
-	}
-	return enabled
+	"sqlite3":    getORMBasedSQLStorage(func() StorageConfig { return new(sql.SQLite3) }, func() StorageConfig { return new(ent.SQLite3) }),
+	"postgres":   getORMBasedSQLStorage(func() StorageConfig { return new(sql.Postgres) }, func() StorageConfig { return new(ent.Postgres) }),
+	"mysql":      getORMBasedSQLStorage(func() StorageConfig { return new(sql.MySQL) }, func() StorageConfig { return new(ent.MySQL) }),
 }
 
 // UnmarshalJSON allows Storage to implement the unmarshaler interface to
@@ -228,7 +432,7 @@ func (s *Storage) UnmarshalJSON(b []byte) error {
 		Type   string          `json:"type"`
 		Config json.RawMessage `json:"config"`
 	}
-	if err := json.Unmarshal(b, &store); err != nil {
+	if err := configUnmarshaller(b, &store); err != nil {
 		return fmt.Errorf("parse storage: %v", err)
 	}
 	f, ok := storages[store.Type]
@@ -239,11 +443,26 @@ func (s *Storage) UnmarshalJSON(b []byte) error {
 	storageConfig := f()
 	if len(store.Config) != 0 {
 		data := []byte(store.Config)
-		if isExpandEnvEnabled() {
-			// Caution, we're expanding in the raw JSON/YAML source. This may not be what the admin expects.
-			data = []byte(os.ExpandEnv(string(store.Config)))
+		if featureflags.ExpandEnv.Enabled() {
+			var rawMap map[string]interface{}
+			if err := configUnmarshaller(store.Config, &rawMap); err != nil {
+				return fmt.Errorf("unmarshal config for env expansion: %v", err)
+			}
+
+			// Recursively expand environment variables in the map to avoid
+			// issues with JSON special characters and escapes
+			expandEnvInMap(rawMap)
+
+			// Marshal the expanded map back to JSON
+			expandedData, err := json.Marshal(rawMap)
+			if err != nil {
+				return fmt.Errorf("marshal expanded config: %v", err)
+			}
+
+			data = expandedData
 		}
-		if err := json.Unmarshal(data, storageConfig); err != nil {
+
+		if err := configUnmarshaller(data, storageConfig); err != nil {
 			return fmt.Errorf("parse storage config: %v", err)
 		}
 	}
@@ -254,6 +473,90 @@ func (s *Storage) UnmarshalJSON(b []byte) error {
 	return nil
 }
 
+// Signer holds app's signer configuration.
+type Signer struct {
+	Type   string       `json:"type"`
+	Config SignerConfig `json:"config"`
+}
+
+// SignerConfig is a configuration that can create a signer.
+type SignerConfig interface{}
+
+var (
+	_ SignerConfig = (*signer.LocalConfig)(nil)
+	_ SignerConfig = (*signer.VaultConfig)(nil)
+)
+
+var signerConfigs = map[string]func() SignerConfig{
+	"local": func() SignerConfig { return new(signer.LocalConfig) },
+	"vault": func() SignerConfig { return new(signer.VaultConfig) },
+}
+
+// UnmarshalJSON allows Signer to implement the unmarshaler interface to
+// dynamically determine the type of the signer config.
+func (s *Signer) UnmarshalJSON(b []byte) error {
+	var signerData struct {
+		Type   string          `json:"type"`
+		Config json.RawMessage `json:"config"`
+	}
+	if err := json.Unmarshal(b, &signerData); err != nil {
+		return fmt.Errorf("parse signer: %v", err)
+	}
+
+	f, ok := signerConfigs[signerData.Type]
+	if !ok {
+		return fmt.Errorf("unknown signer type %q", signerData.Type)
+	}
+
+	signerConfig := f()
+	if len(signerData.Config) != 0 {
+		data := []byte(signerData.Config)
+		if featureflags.ExpandEnv.Enabled() {
+			var rawMap map[string]interface{}
+			if err := json.Unmarshal(signerData.Config, &rawMap); err != nil {
+				return fmt.Errorf("unmarshal config for env expansion: %v", err)
+			}
+
+			// Recursively expand environment variables in the map
+			expandEnvInMap(rawMap)
+
+			// Marshal the expanded map back to JSON
+			expandedData, err := json.Marshal(rawMap)
+			if err != nil {
+				return fmt.Errorf("marshal expanded config: %v", err)
+			}
+
+			data = expandedData
+		}
+
+		if err := json.Unmarshal(data, signerConfig); err != nil {
+			return fmt.Errorf("parse signer config: %v", err)
+		}
+	}
+	if localConfig, ok := signerConfig.(*signer.LocalConfig); ok {
+		if err := normalizeLocalSignerConfig(localConfig); err != nil {
+			return fmt.Errorf("parse signer config: %v", err)
+		}
+	}
+
+	*s = Signer{
+		Type:   signerData.Type,
+		Config: signerConfig,
+	}
+	return nil
+}
+
+func normalizeLocalSignerConfig(c *signer.LocalConfig) error {
+	if c.Algorithm == "" {
+		c.Algorithm = jose.RS256
+		return nil
+	}
+	if c.Algorithm == jose.RS256 || c.Algorithm == jose.ES256 {
+		return nil
+	}
+	return fmt.Errorf("unsupported local signer algorithm %q", c.Algorithm)
+}
+
 // Connector is a magical type that can unmarshal YAML dynamically. The
 // Type field determines the connector type, which is then customized for Config.
 type Connector struct {
@@ -261,7 +564,8 @@ type Connector struct {
 	Name string `json:"name"`
 	ID   string `json:"id"`
 
-	Config server.ConnectorConfig `json:"config"`
+	Config     connectors.ConnectorConfig `json:"config"`
+	GrantTypes []string                   `json:"grantTypes"`
 }
 
 // UnmarshalJSON allows Connector to implement the unmarshaler interface to
@@ -272,9 +576,10 @@ func (c *Connector) UnmarshalJSON(b []byte) error {
 		Name string `json:"name"`
 		ID   string `json:"id"`
 
-		Config json.RawMessage `json:"config"`
+		Config     json.RawMessage `json:"config"`
+		GrantTypes []string        `json:"grantTypes"`
 	}
-	if err := json.Unmarshal(b, &conn); err != nil {
+	if err := configUnmarshaller(b, &conn); err != nil {
 		return fmt.Errorf("parse connector: %v", err)
 	}
 	f, ok := server.ConnectorsConfig[conn.Type]
@@ -285,19 +590,36 @@ func (c *Connector) UnmarshalJSON(b []byte) error {
 	connConfig := f()
 	if len(conn.Config) != 0 {
 		data := []byte(conn.Config)
-		if isExpandEnvEnabled() {
-			// Caution, we're expanding in the raw JSON/YAML source. This may not be what the admin expects.
-			data = []byte(os.ExpandEnv(string(conn.Config)))
+		if featureflags.ExpandEnv.Enabled() {
+			var rawMap map[string]interface{}
+			if err := configUnmarshaller(conn.Config, &rawMap); err != nil {
+				return fmt.Errorf("unmarshal config for env expansion: %v", err)
+			}
+
+			// Recursively expand environment variables in the map to avoid
+			// issues with JSON special characters and escapes
+			expandEnvInMap(rawMap)
+
+			// Marshal the expanded map back to JSON
+			expandedData, err := json.Marshal(rawMap)
+			if err != nil {
+				return fmt.Errorf("marshal expanded config: %v", err)
+			}
+
+			data = expandedData
 		}
-		if err := json.Unmarshal(data, connConfig); err != nil {
+
+		if err := configUnmarshaller(data, connConfig); err != nil {
 			return fmt.Errorf("parse connector config: %v", err)
 		}
 	}
+
 	*c = Connector{
-		Type:   conn.Type,
-		Name:   conn.Name,
-		ID:     conn.ID,
-		Config: connConfig,
+		Type:       conn.Type,
+		Name:       conn.Name,
+		ID:         conn.ID,
+		Config:     connConfig,
+		GrantTypes: conn.GrantTypes,
 	}
 	return nil
 }
@@ -310,10 +632,11 @@ func ToStorageConnector(c Connector) (storage.Connector, error) {
 	}
 
 	return storage.Connector{
-		ID:     c.ID,
-		Type:   c.Type,
-		Name:   c.Name,
-		Config: data,
+		ID:         c.ID,
+		Type:       c.Type,
+		Name:       c.Name,
+		Config:     data,
+		GrantTypes: c.GrantTypes,
 	}, nil
 }
 
@@ -338,10 +661,16 @@ type Expiry struct {
 // Logger holds configuration required to customize logging for dex.
 type Logger struct {
 	// Level sets logging level severity.
-	Level string `json:"level"`
+	Level slog.Level `json:"level"`
 
 	// Format specifies the format to be used for logging.
 	Format string `json:"format"`
+
+	// ExcludeFields specifies log attribute keys that should be dropped from all
+	// log output. This is useful for suppressing PII fields like email, username,
+	// preferred_username, or groups in environments subject to GDPR or similar
+	// data-handling constraints.
+	ExcludeFields []string `json:"excludeFields"`
 }
 
 type RefreshToken struct {
@@ -350,3 +679,72 @@ type RefreshToken struct {
 	AbsoluteLifetime  string `json:"absoluteLifetime"`
 	ValidIfNotUsedFor string `json:"validIfNotUsedFor"`
 }
+
+// Sessions holds authentication session configuration.
+type Sessions struct {
+	// CookieName is the name of the session cookie. Defaults to "dex_session".
+	CookieName string `json:"cookieName"`
+	// AbsoluteLifetime is the maximum session lifetime from creation. Defaults to "24h".
+	AbsoluteLifetime string `json:"absoluteLifetime"`
+	// ValidIfNotUsedFor is the idle timeout. Defaults to "1h".
+	ValidIfNotUsedFor string `json:"validIfNotUsedFor"`
+	// RememberMeCheckedByDefault controls the default state of the "remember me" checkbox.
+	RememberMeCheckedByDefault *bool `json:"rememberMeCheckedByDefault"`
+	// CookieEncryptionKey is the AES key for encrypting session cookies.
+	// Must be 16, 24, or 32 bytes for AES-128, AES-192, or AES-256.
+	// If empty, cookies are not encrypted.
+	CookieEncryptionKey string `json:"cookieEncryptionKey"`
+	// SSOSharedWithDefault is the default SSO sharing policy for clients without explicit ssoSharedWith.
+	// "all" = share with all clients, "none" = share with no one (default: "none").
+	SSOSharedWithDefault string `json:"ssoSharedWithDefault"`
+}
+
+// MFAAuthenticator defines a multi-factor authentication provider.
+type MFAAuthenticator struct {
+	ID     string          `json:"id"`
+	Type   string          `json:"type"`
+	Config json.RawMessage `json:"config"`
+
+	// ConnectorTypes limits this authenticator to specific connector types (e.g., "ldap", "oidc", "saml").
+	// If empty, the authenticator applies to all connector types.
+	ConnectorTypes []string `json:"connectorTypes"`
+}
+
+// TOTPConfig holds configuration for a TOTP authenticator.
+type TOTPConfig struct {
+	// Issuer is the name of the service shown in the authenticator app.
+	Issuer string `json:"issuer"`
+}
+
+// WebAuthnConfig holds configuration for a WebAuthn authenticator.
+type WebAuthnConfig struct {
+	// RPDisplayName is the human-readable relying party name shown in the browser
+	// dialog during key registration and authentication (e.g., "My Company SSO").
+	RPDisplayName string `json:"rpDisplayName"`
+	// RPID is the relying party identifier — must match the domain in the browser
+	// address bar. If empty, derived from the issuer URL hostname.
+	// Example: "auth.example.com"
+	RPID string `json:"rpID"`
+	// RPOrigins is the list of allowed origins for WebAuthn ceremonies.
+	// If empty, derived from the issuer URL (scheme + host).
+	// Example: ["https://auth.example.com"]
+	RPOrigins []string `json:"rpOrigins"`
+	// AttestationPreference controls what attestation data the authenticator should provide:
+	//   "none"     — don't request attestation (simpler, more private)
+	//   "indirect" — authenticator may anonymize attestation (default)
+	//   "direct"   — request full attestation (for enterprise key model verification)
+	AttestationPreference string `json:"attestationPreference"`
+	// UserVerification controls whether PIN or biometric verification is required:
+	//   "required"    — always require (PIN, fingerprint, etc.)
+	//   "preferred"   — request if the authenticator supports it (default)
+	//   "discouraged" — skip verification, presence check only
+	UserVerification string `json:"userVerification"`
+	// AuthenticatorAttachment restricts which authenticator types are allowed:
+	//   "platform"      — built-in only (Touch ID, Windows Hello)
+	//   "cross-platform" — external only (YubiKey, USB security keys)
+	//   ""              — any authenticator (default)
+	AuthenticatorAttachment string `json:"authenticatorAttachment"`
+	// Timeout is the duration allowed for the browser WebAuthn ceremony
+	// (registration or login). Defaults to "60s".
+	Timeout string `json:"timeout"`
+}
diff --git a/cmd/dex/config_test.go b/cmd/dex/config_test.go
index 8ee02d5aa2..27f5d6ff44 100644
--- a/cmd/dex/config_test.go
+++ b/cmd/dex/config_test.go
@@ -1,21 +1,31 @@
 package main
 
 import (
+	"encoding/json"
+	"log/slog"
 	"os"
+	"strings"
 	"testing"
 
 	"github.com/ghodss/yaml"
+	"github.com/go-jose/go-jose/v4"
 	"github.com/kylelemons/godebug/pretty"
+	"github.com/stretchr/testify/require"
 
 	"github.com/dexidp/dex/connector/mock"
 	"github.com/dexidp/dex/connector/oidc"
 	"github.com/dexidp/dex/server"
+	"github.com/dexidp/dex/server/signer"
 	"github.com/dexidp/dex/storage"
 	"github.com/dexidp/dex/storage/sql"
 )
 
 var _ = yaml.YAMLToJSON
 
+func boolPtr(v bool) *bool {
+	return &v
+}
+
 func TestValidConfiguration(t *testing.T) {
 	configuration := Config{
 		Issuer: "http://127.0.0.1:5556/dex",
@@ -37,6 +47,7 @@ func TestValidConfiguration(t *testing.T) {
 			},
 		},
 	}
+
 	if err := configuration.Validate(); err != nil {
 		t.Fatalf("this configuration should have been valid: %v", err)
 	}
@@ -58,6 +69,23 @@ func TestInvalidConfiguration(t *testing.T) {
 	}
 }
 
+// TestInvalidRefreshTokenLifetime: a misspelled lifetime must not read as the
+// default, leaving tokens the client wanted bound outliving the session.
+func TestInvalidRefreshTokenLifetime(t *testing.T) {
+	configuration := Config{
+		Issuer:  "http://127.0.0.1:5556/dex",
+		Storage: Storage{Type: "sqlite3", Config: &sql.SQLite3{File: "examples/dex.db"}},
+		Web:     Web{HTTP: "127.0.0.1:5556"},
+		StaticClients: []storage.Client{
+			{ID: "proxy", RefreshTokenLifetime: "sessions"},
+		},
+	}
+
+	err := configuration.Validate()
+	require.Error(t, err)
+	require.Contains(t, err.Error(), `client "proxy"`)
+}
+
 func TestUnmarshalConfig(t *testing.T) {
 	rawConfig := []byte(`
 issuer: http://127.0.0.1:5556/dex
@@ -71,7 +99,11 @@ storage:
     connMaxLifetime: 30
     connectionTimeout: 3
 web:
-  http: 127.0.0.1:5556
+  https: 127.0.0.1:5556
+  tlsMinVersion: 1.3
+  tlsMaxVersion: 1.2
+  headers:
+    Strict-Transport-Security: "max-age=31536000; includeSubDomains"
 
 frontend:
   dir: ./web
@@ -87,11 +119,17 @@ staticClients:
 
 oauth2:
   alwaysShowLoginScreen: true
+  grantTypes:
+  - refresh_token
+  - "urn:ietf:params:oauth:grant-type:token-exchange"
 
 connectors:
 - type: mockCallback
   id: mock
   name: Example
+  grantTypes:
+  - authorization_code
+  - "urn:ietf:params:oauth:grant-type:token-exchange"
 - type: oidc
   id: google
   name: Google
@@ -107,6 +145,12 @@ staticPasswords:
   # bcrypt hash of the string "password"
   hash: "$2a$10$33EMT0cVYVlPy6WAMCLsceLYjWhuHpbz5yuZxu/GAFj03J9Lytjuy"
   username: "admin"
+  name: "Admin User"
+  emailVerified: false
+  preferredUsername: "admin-public"
+  groups:
+  - "team-a"
+  - "team-a/admins"
   userID: "08a8684b-db88-4b73-90a9-3cd1661f5466"
 - email: "foo@example.com"
   # base64'd value of the same bcrypt hash above. We want to be able to parse both of these
@@ -123,6 +167,10 @@ expiry:
 logger:
   level: "debug"
   format: "json"
+
+additionalFeatures: [
+	"ConnectorsCRUD"
+]
 `)
 
 	want := Config{
@@ -141,7 +189,12 @@ logger:
 			},
 		},
 		Web: Web{
-			HTTP: "127.0.0.1:5556",
+			HTTPS:         "127.0.0.1:5556",
+			TLSMinVersion: "1.3",
+			TLSMaxVersion: "1.2",
+			Headers: Headers{
+				StrictTransportSecurity: "max-age=31536000; includeSubDomains",
+			},
 		},
 		Frontend: server.WebConfig{
 			Dir: "./web",
@@ -161,6 +214,10 @@ logger:
 		},
 		OAuth2: OAuth2{
 			AlwaysShowLoginScreen: true,
+			GrantTypes: []string{
+				"refresh_token",
+				"urn:ietf:params:oauth:grant-type:token-exchange",
+			},
 		},
 		StaticConnectors: []Connector{
 			{
@@ -168,6 +225,10 @@ logger:
 				ID:     "mock",
 				Name:   "Example",
 				Config: &mock.CallbackConfig{},
+				GrantTypes: []string{
+					"authorization_code",
+					"urn:ietf:params:oauth:grant-type:token-exchange",
+				},
 			},
 			{
 				Type: "oidc",
@@ -184,10 +245,17 @@ logger:
 		EnablePasswordDB: true,
 		StaticPasswords: []password{
 			{
-				Email:    "admin@example.com",
-				Hash:     []byte("$2a$10$33EMT0cVYVlPy6WAMCLsceLYjWhuHpbz5yuZxu/GAFj03J9Lytjuy"),
-				Username: "admin",
-				UserID:   "08a8684b-db88-4b73-90a9-3cd1661f5466",
+				Email:             "admin@example.com",
+				Hash:              []byte("$2a$10$33EMT0cVYVlPy6WAMCLsceLYjWhuHpbz5yuZxu/GAFj03J9Lytjuy"),
+				Username:          "admin",
+				Name:              "Admin User",
+				EmailVerified:     boolPtr(false),
+				PreferredUsername: "admin-public",
+				UserID:            "08a8684b-db88-4b73-90a9-3cd1661f5466",
+				Groups: []string{
+					"team-a",
+					"team-a/admins",
+				},
 			},
 			{
 				Email:    "foo@example.com",
@@ -203,7 +271,7 @@ logger:
 			DeviceRequests: "10m",
 		},
 		Logger: Logger{
-			Level:  "debug",
+			Level:  slog.LevelDebug,
 			Format: "json",
 		},
 	}
@@ -212,6 +280,7 @@ logger:
 	if err := yaml.Unmarshal(rawConfig, &c); err != nil {
 		t.Fatalf("failed to decode config: %v", err)
 	}
+
 	if diff := pretty.Compare(c, want); diff != "" {
 		t.Errorf("got!=want: %s", diff)
 	}
@@ -250,7 +319,8 @@ func checkUnmarshalConfigWithEnv(t *testing.T, dexExpandEnv string, wantExpandEn
 	os.Setenv("DEX_FOO_USER_PASSWORD", "$2a$10$33EMT0cVYVlPy6WAMCLsceLYjWhuHpbz5yuZxu/GAFj03J9Lytjuy")
 	// For os.ExpandEnv ($VAR -> value_of_VAR):
 	os.Setenv("DEX_FOO_POSTGRES_HOST", "10.0.0.1")
-	os.Setenv("DEX_FOO_OIDC_CLIENT_SECRET", "bar")
+	os.Setenv("DEX_FOO_POSTGRES_PASSWORD", `psql"test\pass`)
+	os.Setenv("DEX_FOO_OIDC_CLIENT_SECRET", `abc"def\ghi`)
 	if dexExpandEnv != "UNSET" {
 		os.Setenv("DEX_EXPAND_ENV", dexExpandEnv)
 	} else {
@@ -265,6 +335,7 @@ storage:
     # Env variables are expanded in raw YAML source.
     # Single quotes work fine, as long as the env variable doesn't contain any.
     host: '$DEX_FOO_POSTGRES_HOST'
+    password: '$DEX_FOO_POSTGRES_PASSWORD'
     port: 65432
     maxOpenConns: 5
     maxIdleConns: 3
@@ -327,10 +398,12 @@ logger:
 
 	// This is not a valid hostname. It's only used to check whether os.ExpandEnv was applied or not.
 	wantPostgresHost := "$DEX_FOO_POSTGRES_HOST"
+	wantPostgresPassword := "$DEX_FOO_POSTGRES_PASSWORD"
 	wantOidcClientSecret := "$DEX_FOO_OIDC_CLIENT_SECRET"
 	if wantExpandEnv {
 		wantPostgresHost = "10.0.0.1"
-		wantOidcClientSecret = "bar"
+		wantPostgresPassword = `psql"test\pass`
+		wantOidcClientSecret = `abc"def\ghi`
 	}
 
 	want := Config{
@@ -340,6 +413,7 @@ logger:
 			Config: &sql.Postgres{
 				NetworkDB: sql.NetworkDB{
 					Host:              wantPostgresHost,
+					Password:          wantPostgresPassword,
 					Port:              65432,
 					MaxOpenConns:      5,
 					MaxIdleConns:      3,
@@ -410,7 +484,7 @@ logger:
 			AuthRequests: "25h",
 		},
 		Logger: Logger{
-			Level:  "debug",
+			Level:  slog.LevelDebug,
 			Format: "json",
 		},
 	}
@@ -419,7 +493,203 @@ logger:
 	if err := yaml.Unmarshal(rawConfig, &c); err != nil {
 		t.Fatalf("failed to decode config: %v", err)
 	}
+
 	if diff := pretty.Compare(c, want); diff != "" {
 		t.Errorf("got!=want: %s", diff)
 	}
 }
+
+func TestSignerConfigUnmarshal(t *testing.T) {
+	tests := []struct {
+		name        string
+		config      string
+		wantErr     bool
+		errContains string
+		check       func(*Config) error
+	}{
+		{
+			name: "local signer with rotation period",
+			config: `
+issuer: http://127.0.0.1:5556/dex
+storage:
+  type: memory
+web:
+  http: 0.0.0.0:5556
+signer:
+  type: local
+  config:
+    keysRotationPeriod: 6h
+enablePasswordDB: true
+`,
+			wantErr: false,
+			check: func(c *Config) error {
+				if c.Signer.Type != "local" {
+					t.Errorf("expected signer type 'local', got %q", c.Signer.Type)
+				}
+				if localConfig, ok := c.Signer.Config.(*signer.LocalConfig); !ok {
+					t.Error("expected LocalConfig")
+				} else {
+					if localConfig.KeysRotationPeriod != "6h" {
+						t.Errorf("expected keys rotation period '6h', got %q", localConfig.KeysRotationPeriod)
+					}
+					if localConfig.Algorithm != jose.RS256 {
+						t.Errorf("expected default algorithm 'RS256', got %q", localConfig.Algorithm)
+					}
+				}
+				return nil
+			},
+		},
+		{
+			name: "local signer with ES256 algorithm",
+			config: `
+issuer: http://127.0.0.1:5556/dex
+storage:
+  type: memory
+web:
+  http: 0.0.0.0:5556
+signer:
+  type: local
+  config:
+    keysRotationPeriod: 6h
+    algorithm: ES256
+enablePasswordDB: true
+`,
+			wantErr: false,
+			check: func(c *Config) error {
+				localConfig, ok := c.Signer.Config.(*signer.LocalConfig)
+				if !ok {
+					t.Error("expected LocalConfig")
+					return nil
+				}
+				if localConfig.Algorithm != jose.ES256 {
+					t.Errorf("expected algorithm 'ES256', got %q", localConfig.Algorithm)
+				}
+				return nil
+			},
+		},
+		{
+			name: "local signer with invalid algorithm",
+			config: `
+issuer: http://127.0.0.1:5556/dex
+storage:
+  type: memory
+web:
+  http: 0.0.0.0:5556
+signer:
+  type: local
+  config:
+    keysRotationPeriod: 6h
+    algorithm: ES512
+enablePasswordDB: true
+`,
+			wantErr:     true,
+			errContains: `parse signer config: unsupported local signer algorithm "ES512"`,
+		},
+		{
+			name: "local signer without config",
+			config: `
+issuer: http://127.0.0.1:5556/dex
+storage:
+  type: memory
+web:
+  http: 0.0.0.0:5556
+signer:
+  type: local
+enablePasswordDB: true
+`,
+			wantErr: false,
+			check: func(c *Config) error {
+				localConfig, ok := c.Signer.Config.(*signer.LocalConfig)
+				if !ok {
+					t.Error("expected LocalConfig")
+					return nil
+				}
+				if localConfig.Algorithm != jose.RS256 {
+					t.Errorf("expected default algorithm 'RS256', got %q", localConfig.Algorithm)
+				}
+				return nil
+			},
+		},
+		{
+			name: "vault signer",
+			config: `
+issuer: http://127.0.0.1:5556/dex
+storage:
+  type: memory
+web:
+  http: 0.0.0.0:5556
+signer:
+  type: vault
+  config:
+    addr: http://localhost:8200
+    token: test-token
+    keyName: test-key
+enablePasswordDB: true
+`,
+			wantErr: false,
+			check: func(c *Config) error {
+				if c.Signer.Type != "vault" {
+					t.Errorf("expected signer type 'vault', got %q", c.Signer.Type)
+				}
+				if vaultConfig, ok := c.Signer.Config.(*signer.VaultConfig); !ok {
+					t.Error("expected VaultConfig")
+				} else {
+					if vaultConfig.Addr != "http://localhost:8200" {
+						t.Errorf("expected addr 'http://localhost:8200', got %q", vaultConfig.Addr)
+					}
+					if vaultConfig.Token != "test-token" {
+						t.Errorf("expected token 'test-token', got %q", vaultConfig.Token)
+					}
+					if vaultConfig.KeyName != "test-key" {
+						t.Errorf("expected keyName 'test-key', got %q", vaultConfig.KeyName)
+					}
+				}
+				return nil
+			},
+		},
+		{
+			name: "default to local when no signer specified",
+			config: `
+issuer: http://127.0.0.1:5556/dex
+storage:
+  type: memory
+web:
+  http: 0.0.0.0:5556
+enablePasswordDB: true
+`,
+			wantErr: false,
+			check: func(c *Config) error {
+				if c.Signer.Type != "" {
+					t.Errorf("expected signer type '', got %q", c.Signer.Type)
+				}
+				return nil
+			},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			var c Config
+			data, err := yaml.YAMLToJSON([]byte(tt.config))
+			if err != nil {
+				t.Fatalf("failed to convert yaml to json: %v", err)
+			}
+
+			err = json.Unmarshal(data, &c)
+			if (err != nil) != tt.wantErr {
+				t.Errorf("Unmarshal() error = %v, wantErr %v", err, tt.wantErr)
+				return
+			}
+			if tt.errContains != "" && (err == nil || !strings.Contains(err.Error(), tt.errContains)) {
+				t.Errorf("Unmarshal() error = %v, want substring %q", err, tt.errContains)
+				return
+			}
+
+			if err == nil && tt.check != nil {
+				if err := tt.check(&c); err != nil {
+					t.Errorf("check failed: %v", err)
+				}
+			}
+		})
+	}
+}
diff --git a/cmd/dex/excluding_handler.go b/cmd/dex/excluding_handler.go
new file mode 100644
index 0000000000..c5d03e44e5
--- /dev/null
+++ b/cmd/dex/excluding_handler.go
@@ -0,0 +1,56 @@
+package main
+
+import (
+	"context"
+	"log/slog"
+)
+
+// excludingHandler is an slog.Handler wrapper that drops log attributes
+// whose keys match a configured set. This allows PII fields like email,
+// username, or groups to be redacted at the logger level rather than
+// requiring per-callsite suppression logic.
+type excludingHandler struct {
+	inner   slog.Handler
+	exclude map[string]bool
+}
+
+func newExcludingHandler(inner slog.Handler, fields []string) slog.Handler {
+	if len(fields) == 0 {
+		return inner
+	}
+	m := make(map[string]bool, len(fields))
+	for _, f := range fields {
+		m[f] = true
+	}
+	return &excludingHandler{inner: inner, exclude: m}
+}
+
+func (h *excludingHandler) Enabled(ctx context.Context, level slog.Level) bool {
+	return h.inner.Enabled(ctx, level)
+}
+
+func (h *excludingHandler) Handle(ctx context.Context, record slog.Record) error {
+	// Rebuild the record without excluded attributes.
+	filtered := slog.NewRecord(record.Time, record.Level, record.Message, record.PC)
+	record.Attrs(func(a slog.Attr) bool {
+		if !h.exclude[a.Key] {
+			filtered.AddAttrs(a)
+		}
+		return true
+	})
+	return h.inner.Handle(ctx, filtered)
+}
+
+func (h *excludingHandler) WithAttrs(attrs []slog.Attr) slog.Handler {
+	var kept []slog.Attr
+	for _, a := range attrs {
+		if !h.exclude[a.Key] {
+			kept = append(kept, a)
+		}
+	}
+	return &excludingHandler{inner: h.inner.WithAttrs(kept), exclude: h.exclude}
+}
+
+func (h *excludingHandler) WithGroup(name string) slog.Handler {
+	return &excludingHandler{inner: h.inner.WithGroup(name), exclude: h.exclude}
+}
diff --git a/cmd/dex/excluding_handler_test.go b/cmd/dex/excluding_handler_test.go
new file mode 100644
index 0000000000..e0306d6034
--- /dev/null
+++ b/cmd/dex/excluding_handler_test.go
@@ -0,0 +1,141 @@
+package main
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"log/slog"
+	"testing"
+)
+
+func TestExcludingHandler(t *testing.T) {
+	tests := []struct {
+		name       string
+		exclude    []string
+		logAttrs   []slog.Attr
+		wantKeys   []string
+		absentKeys []string
+	}{
+		{
+			name:    "no exclusions",
+			exclude: nil,
+			logAttrs: []slog.Attr{
+				slog.String("email", "user@example.com"),
+				slog.String("connector_id", "github"),
+			},
+			wantKeys: []string{"email", "connector_id"},
+		},
+		{
+			name:    "exclude email",
+			exclude: []string{"email"},
+			logAttrs: []slog.Attr{
+				slog.String("email", "user@example.com"),
+				slog.String("connector_id", "github"),
+			},
+			wantKeys:   []string{"connector_id"},
+			absentKeys: []string{"email"},
+		},
+		{
+			name:    "exclude multiple fields",
+			exclude: []string{"email", "username", "groups"},
+			logAttrs: []slog.Attr{
+				slog.String("email", "user@example.com"),
+				slog.String("username", "johndoe"),
+				slog.String("connector_id", "github"),
+				slog.Any("groups", []string{"admin"}),
+			},
+			wantKeys:   []string{"connector_id"},
+			absentKeys: []string{"email", "username", "groups"},
+		},
+		{
+			name:    "exclude non-existent field is harmless",
+			exclude: []string{"nonexistent"},
+			logAttrs: []slog.Attr{
+				slog.String("email", "user@example.com"),
+			},
+			wantKeys: []string{"email"},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			var buf bytes.Buffer
+			inner := slog.NewJSONHandler(&buf, &slog.HandlerOptions{Level: slog.LevelInfo})
+			handler := newExcludingHandler(inner, tt.exclude)
+			logger := slog.New(handler)
+
+			attrs := make([]any, 0, len(tt.logAttrs)*2)
+			for _, a := range tt.logAttrs {
+				attrs = append(attrs, a)
+			}
+			logger.Info("test message", attrs...)
+
+			var result map[string]any
+			if err := json.Unmarshal(buf.Bytes(), &result); err != nil {
+				t.Fatalf("failed to parse log output: %v", err)
+			}
+
+			for _, key := range tt.wantKeys {
+				if _, ok := result[key]; !ok {
+					t.Errorf("expected key %q in log output", key)
+				}
+			}
+			for _, key := range tt.absentKeys {
+				if _, ok := result[key]; ok {
+					t.Errorf("expected key %q to be absent from log output", key)
+				}
+			}
+		})
+	}
+}
+
+func TestExcludingHandlerWithAttrs(t *testing.T) {
+	var buf bytes.Buffer
+	inner := slog.NewJSONHandler(&buf, &slog.HandlerOptions{Level: slog.LevelInfo})
+	handler := newExcludingHandler(inner, []string{"email"})
+	logger := slog.New(handler)
+
+	// Pre-bind an excluded attr via With
+	child := logger.With("email", "user@example.com", "connector_id", "github")
+	child.Info("login successful")
+
+	var result map[string]any
+	if err := json.Unmarshal(buf.Bytes(), &result); err != nil {
+		t.Fatalf("failed to parse log output: %v", err)
+	}
+
+	if _, ok := result["email"]; ok {
+		t.Error("expected email to be excluded from WithAttrs output")
+	}
+	if _, ok := result["connector_id"]; !ok {
+		t.Error("expected connector_id to be present")
+	}
+}
+
+func TestExcludingHandlerEnabled(t *testing.T) {
+	inner := slog.NewJSONHandler(&bytes.Buffer{}, &slog.HandlerOptions{Level: slog.LevelWarn})
+	handler := newExcludingHandler(inner, []string{"email"})
+
+	if handler.Enabled(context.Background(), slog.LevelInfo) {
+		t.Error("expected Info to be disabled when handler level is Warn")
+	}
+	if !handler.Enabled(context.Background(), slog.LevelWarn) {
+		t.Error("expected Warn to be enabled")
+	}
+}
+
+func TestExcludingHandlerNilFields(t *testing.T) {
+	var buf bytes.Buffer
+	inner := slog.NewJSONHandler(&buf, &slog.HandlerOptions{Level: slog.LevelInfo})
+
+	// With nil/empty fields, should return the inner handler directly
+	handler := newExcludingHandler(inner, nil)
+	if _, ok := handler.(*excludingHandler); ok {
+		t.Error("expected nil fields to return inner handler directly, not wrap it")
+	}
+
+	handler = newExcludingHandler(inner, []string{})
+	if _, ok := handler.(*excludingHandler); ok {
+		t.Error("expected empty fields to return inner handler directly, not wrap it")
+	}
+}
diff --git a/cmd/dex/logger.go b/cmd/dex/logger.go
new file mode 100644
index 0000000000..980bf55c23
--- /dev/null
+++ b/cmd/dex/logger.go
@@ -0,0 +1,69 @@
+package main
+
+import (
+	"context"
+	"fmt"
+	"log/slog"
+	"os"
+	"strings"
+
+	"github.com/dexidp/dex/server/reqctx"
+)
+
+var logFormats = []string{"json", "text"}
+
+func newLogger(level slog.Level, format string, excludeFields []string) (*slog.Logger, error) {
+	var handler slog.Handler
+	switch strings.ToLower(format) {
+	case "", "text":
+		handler = slog.NewTextHandler(os.Stderr, &slog.HandlerOptions{
+			Level: level,
+		})
+	case "json":
+		handler = slog.NewJSONHandler(os.Stderr, &slog.HandlerOptions{
+			Level: level,
+		})
+	default:
+		return nil, fmt.Errorf("log format is not one of the supported values (%s): %s", strings.Join(logFormats, ", "), format)
+	}
+
+	handler = newExcludingHandler(handler, excludeFields)
+
+	return slog.New(newRequestContextHandler(handler)), nil
+}
+
+var _ slog.Handler = requestContextHandler{}
+
+type requestContextHandler struct {
+	handler slog.Handler
+}
+
+func newRequestContextHandler(handler slog.Handler) slog.Handler {
+	return requestContextHandler{
+		handler: handler,
+	}
+}
+
+func (h requestContextHandler) Enabled(ctx context.Context, level slog.Level) bool {
+	return h.handler.Enabled(ctx, level)
+}
+
+func (h requestContextHandler) Handle(ctx context.Context, record slog.Record) error {
+	if v, ok := ctx.Value(reqctx.RequestKeyRemoteIP).(string); ok {
+		record.AddAttrs(slog.String(string(reqctx.RequestKeyRemoteIP), v))
+	}
+
+	if v, ok := ctx.Value(reqctx.RequestKeyRequestID).(string); ok {
+		record.AddAttrs(slog.String(string(reqctx.RequestKeyRequestID), v))
+	}
+
+	return h.handler.Handle(ctx, record)
+}
+
+func (h requestContextHandler) WithAttrs(attrs []slog.Attr) slog.Handler {
+	return requestContextHandler{h.handler.WithAttrs(attrs)}
+}
+
+func (h requestContextHandler) WithGroup(name string) slog.Handler {
+	return requestContextHandler{h.handler.WithGroup(name)}
+}
diff --git a/cmd/dex/serve.go b/cmd/dex/serve.go
index c8fb95eb16..3cfa8980f7 100644
--- a/cmd/dex/serve.go
+++ b/cmd/dex/serve.go
@@ -4,35 +4,47 @@ import (
 	"context"
 	"crypto/tls"
 	"crypto/x509"
+	"encoding/json"
 	"errors"
 	"fmt"
+	"log/slog"
 	"net"
 	"net/http"
 	"net/http/pprof"
 	"os"
+	"os/signal"
+	"path/filepath"
 	"runtime"
 	"strings"
+	"sync/atomic"
 	"syscall"
 	"time"
 
 	gosundheit "github.com/AppsFlyer/go-sundheit"
 	"github.com/AppsFlyer/go-sundheit/checks"
 	gosundheithttp "github.com/AppsFlyer/go-sundheit/http"
+	"github.com/fsnotify/fsnotify"
 	"github.com/ghodss/yaml"
 	grpcprometheus "github.com/grpc-ecosystem/go-grpc-prometheus"
 	"github.com/oklog/run"
 	"github.com/prometheus/client_golang/prometheus"
 	"github.com/prometheus/client_golang/prometheus/collectors"
 	"github.com/prometheus/client_golang/prometheus/promhttp"
-	"github.com/sirupsen/logrus"
 	"github.com/spf13/cobra"
 	"google.golang.org/grpc"
 	"google.golang.org/grpc/credentials"
 	"google.golang.org/grpc/reflection"
 
 	"github.com/dexidp/dex/api/v2"
-	"github.com/dexidp/dex/pkg/log"
+	"github.com/dexidp/dex/pkg/featureflags"
 	"github.com/dexidp/dex/server"
+	"github.com/dexidp/dex/server/apiserver"
+	"github.com/dexidp/dex/server/authflow"
+	"github.com/dexidp/dex/server/connectors"
+	"github.com/dexidp/dex/server/mfa"
+	"github.com/dexidp/dex/server/session"
+	"github.com/dexidp/dex/server/signer"
+	"github.com/dexidp/dex/server/tokens"
 	"github.com/dexidp/dex/storage"
 )
 
@@ -47,6 +59,15 @@ type serveOptions struct {
 	grpcAddr      string
 }
 
+var buildInfo = prometheus.NewGaugeVec(
+	prometheus.GaugeOpts{
+		Name:      "build_info",
+		Namespace: "dex",
+		Help:      "A metric with a constant '1' value labeled by version from which Dex was built.",
+	},
+	[]string{"version", "go_version", "platform"},
+)
+
 func commandServe() *cobra.Command {
 	options := serveOptions{}
 
@@ -83,35 +104,47 @@ func runServe(options serveOptions) error {
 	}
 
 	var c Config
-	if err := yaml.Unmarshal(configData, &c); err != nil {
+
+	jsonConfigData, err := yaml.YAMLToJSON(configData)
+	if err != nil {
 		return fmt.Errorf("error parse config file %s: %v", configFile, err)
 	}
 
+	if err := configUnmarshaller(jsonConfigData, &c); err != nil {
+		return fmt.Errorf("error unmarshalling config file %s: %v", configFile, err)
+	}
+
 	applyConfigOverrides(options, &c)
 
-	logger, err := newLogger(c.Logger.Level, c.Logger.Format)
+	logger, err := newLogger(c.Logger.Level, c.Logger.Format, c.Logger.ExcludeFields)
 	if err != nil {
 		return fmt.Errorf("invalid config: %v", err)
 	}
 
-	logger.Infof(
-		"Dex Version: %s, Go Version: %s, Go OS/ARCH: %s %s",
-		version,
-		runtime.Version(),
-		runtime.GOOS,
-		runtime.GOARCH,
+	logger.Info(
+		"Version info",
+		"dex_version", version,
+		slog.Group("go",
+			"version", runtime.Version(),
+			"os", runtime.GOOS,
+			"arch", runtime.GOARCH,
+		),
 	)
 
-	if c.Logger.Level != "" {
-		logger.Infof("config using log level: %s", c.Logger.Level)
+	if c.Logger.Level != slog.LevelInfo {
+		logger.Info("config using log level", "level", c.Logger.Level)
 	}
 	if err := c.Validate(); err != nil {
 		return err
 	}
 
-	logger.Infof("config issuer: %s", c.Issuer)
+	logger.Info("config issuer", "issuer", c.Issuer)
 
 	prometheusRegistry := prometheus.NewRegistry()
+
+	prometheusRegistry.MustRegister(buildInfo)
+	recordBuildInfo()
+
 	err = prometheusRegistry.Register(collectors.NewGoCollector())
 	if err != nil {
 		return fmt.Errorf("failed to register Go runtime metrics: %v", err)
@@ -141,34 +174,33 @@ func runServe(options serveOptions) error {
 		tls.TLS_RSA_WITH_AES_256_GCM_SHA384,
 	}
 
+	allowedTLSVersions := map[string]int{
+		"1.2": tls.VersionTLS12,
+		"1.3": tls.VersionTLS13,
+	}
+
 	if c.GRPC.TLSCert != "" {
-		// Parse certificates from certificate file and key file for server.
-		cert, err := tls.LoadX509KeyPair(c.GRPC.TLSCert, c.GRPC.TLSKey)
-		if err != nil {
-			return fmt.Errorf("invalid config: error parsing gRPC certificate file: %v", err)
+		tlsMinVersion := tls.VersionTLS12
+		if c.GRPC.TLSMinVersion != "" {
+			tlsMinVersion = allowedTLSVersions[c.GRPC.TLSMinVersion]
 		}
-
-		tlsConfig := tls.Config{
-			Certificates:             []tls.Certificate{cert},
-			MinVersion:               tls.VersionTLS12,
+		tlsMaxVersion := 0 // default for max is whatever Go defaults to
+		if c.GRPC.TLSMaxVersion != "" {
+			tlsMaxVersion = allowedTLSVersions[c.GRPC.TLSMaxVersion]
+		}
+		baseTLSConfig := &tls.Config{
+			MinVersion:               uint16(tlsMinVersion),
+			MaxVersion:               uint16(tlsMaxVersion),
 			CipherSuites:             allowedTLSCiphers,
 			PreferServerCipherSuites: true,
 		}
 
-		if c.GRPC.TLSClientCA != "" {
-			// Parse certificates from client CA file to a new CertPool.
-			cPool := x509.NewCertPool()
-			clientCert, err := os.ReadFile(c.GRPC.TLSClientCA)
-			if err != nil {
-				return fmt.Errorf("invalid config: reading from client CA file: %v", err)
-			}
-			if !cPool.AppendCertsFromPEM(clientCert) {
-				return errors.New("invalid config: failed to parse client CA")
-			}
-
-			tlsConfig.ClientAuth = tls.RequireAndVerifyClientCert
-			tlsConfig.ClientCAs = cPool
+		tlsConfig, err := newTLSReloader(logger, c.GRPC.TLSCert, c.GRPC.TLSKey, c.GRPC.TLSClientCA, baseTLSConfig)
+		if err != nil {
+			return fmt.Errorf("invalid config: get gRPC TLS: %v", err)
+		}
 
+		if c.GRPC.TLSClientCA != "" {
 			// Only add metrics if client auth is enabled
 			grpcOptions = append(grpcOptions,
 				grpc.StreamInterceptor(grpcMetrics.StreamServerInterceptor()),
@@ -176,7 +208,7 @@ func runServe(options serveOptions) error {
 			)
 		}
 
-		grpcOptions = append(grpcOptions, grpc.Creds(credentials.NewTLS(&tlsConfig)))
+		grpcOptions = append(grpcOptions, grpc.Creds(credentials.NewTLS(tlsConfig)))
 	}
 
 	s, err := c.Storage.Config.Open(logger)
@@ -185,7 +217,7 @@ func runServe(options serveOptions) error {
 	}
 	defer s.Close()
 
-	logger.Infof("config storage: %s", c.Storage.Type)
+	logger.Info("config storage", "storage_type", c.Storage.Type)
 
 	if len(c.StaticClients) > 0 {
 		for i, client := range c.StaticClients {
@@ -210,7 +242,7 @@ func runServe(options serveOptions) error {
 				}
 				c.StaticClients[i].Secret = os.Getenv(client.SecretEnv)
 			}
-			logger.Infof("config static client: %s", client.Name)
+			logger.Info("config static client", "client_name", client.Name)
 		}
 		s = storage.WithStaticClients(s, c.StaticClients)
 	}
@@ -230,7 +262,12 @@ func runServe(options serveOptions) error {
 		if c.Config == nil {
 			return fmt.Errorf("invalid config: no config field for connector %q", c.ID)
 		}
-		logger.Infof("config connector: %s", c.ID)
+		for _, gt := range c.GrantTypes {
+			if !connectors.ConnectorGrantTypes[gt] {
+				return fmt.Errorf("invalid config: unknown grant type %q for connector %q", gt, c.ID)
+			}
+		}
+		logger.Info("config connector", "connector_id", c.ID)
 
 		// convert to a storage connector object
 		conn, err := ToStorageConnector(c)
@@ -242,26 +279,29 @@ func runServe(options serveOptions) error {
 
 	if c.EnablePasswordDB {
 		storageConnectors = append(storageConnectors, storage.Connector{
-			ID:   server.LocalConnector,
+			ID:   connectors.LocalConnector,
 			Name: "Email",
-			Type: server.LocalConnector,
+			Type: connectors.LocalConnector,
 		})
-		logger.Infof("config connector: local passwords enabled")
+		logger.Info("config connector: local passwords enabled")
 	}
 
 	s = storage.WithStaticConnectors(s, storageConnectors)
 
 	if len(c.OAuth2.ResponseTypes) > 0 {
-		logger.Infof("config response types accepted: %s", c.OAuth2.ResponseTypes)
+		logger.Info("config response types accepted", "response_types", c.OAuth2.ResponseTypes)
 	}
 	if c.OAuth2.SkipApprovalScreen {
-		logger.Infof("config skipping approval screen")
+		logger.Info("config skipping approval screen")
 	}
 	if c.OAuth2.PasswordConnector != "" {
-		logger.Infof("config using password grant connector: %s", c.OAuth2.PasswordConnector)
+		logger.Info("config using password grant connector", "password_connector", c.OAuth2.PasswordConnector)
 	}
 	if len(c.Web.AllowedOrigins) > 0 {
-		logger.Infof("config allowed origins: %s", c.Web.AllowedOrigins)
+		logger.Info("config allowed origins", "origins", c.Web.AllowedOrigins)
+	}
+	if featureflags.ContinueOnConnectorFailure.Enabled() {
+		logger.Info("continue on connector failure feature flag enabled")
 	}
 
 	// explicitly convert to UTC.
@@ -269,53 +309,109 @@ func runServe(options serveOptions) error {
 
 	healthChecker := gosundheit.New()
 
-	serverConfig := server.Config{
-		SupportedResponseTypes: c.OAuth2.ResponseTypes,
-		SkipApprovalScreen:     c.OAuth2.SkipApprovalScreen,
-		AlwaysShowLoginScreen:  c.OAuth2.AlwaysShowLoginScreen,
-		PasswordConnector:      c.OAuth2.PasswordConnector,
-		AllowedOrigins:         c.Web.AllowedOrigins,
-		Issuer:                 c.Issuer,
-		Storage:                s,
-		Web:                    c.Frontend,
-		Logger:                 logger,
-		Now:                    now,
-		PrometheusRegistry:     prometheusRegistry,
-		HealthChecker:          healthChecker,
-	}
-	if c.Expiry.SigningKeys != "" {
-		signingKeys, err := time.ParseDuration(c.Expiry.SigningKeys)
+	// Parse expiry durations
+	idTokensValidFor := 24 * time.Hour // default
+	if c.Expiry.IDTokens != "" {
+		var err error
+		idTokensValidFor, err = time.ParseDuration(c.Expiry.IDTokens)
 		if err != nil {
-			return fmt.Errorf("invalid config value %q for signing keys expiry: %v", c.Expiry.SigningKeys, err)
+			return fmt.Errorf("invalid config value %q for id token expiry: %v", c.Expiry.IDTokens, err)
 		}
-		logger.Infof("config signing keys expire after: %v", signingKeys)
-		serverConfig.RotateKeysAfter = signingKeys
+		logger.Info("config id tokens", "valid_for", idTokensValidFor)
 	}
-	if c.Expiry.IDTokens != "" {
-		idTokens, err := time.ParseDuration(c.Expiry.IDTokens)
+
+	// Create signer
+	var signerInstance signer.Signer
+	switch c.Signer.Type {
+	case "vault":
+		vaultConfig, ok := c.Signer.Config.(*signer.VaultConfig)
+		if !ok {
+			return fmt.Errorf("invalid vault signer config")
+		}
+		signerInstance, err = vaultConfig.Open(context.Background())
 		if err != nil {
-			return fmt.Errorf("invalid config value %q for id token expiry: %v", c.Expiry.IDTokens, err)
+			return fmt.Errorf("failed to open vault signer: %v", err)
+		}
+		logger.Info("signer configured", "type", "vault")
+	case "local":
+		localConfig, ok := c.Signer.Config.(*signer.LocalConfig)
+		if !ok {
+			return fmt.Errorf("invalid local signer config")
+		}
+		if localConfig.KeysRotationPeriod == "" {
+			return fmt.Errorf("failed to open local signer: signer.config.keysRotationPeriod must be specified")
+		}
+		if c.Expiry.SigningKeys != "" {
+			logger.Warn("both expiry.signingKeys and signer.config.keysRotationPeriod specified, using signer.config.keysRotationPeriod")
 		}
-		logger.Infof("config id tokens valid for: %v", idTokens)
-		serverConfig.IDTokensValidFor = idTokens
+		signerInstance, err = localConfig.Open(context.Background(), s, idTokensValidFor, now, logger)
+		if err != nil {
+			return fmt.Errorf("failed to open local signer: %v", err)
+		}
+		logger.Info("signer configured", "type", "local", "keys_rotation_period", localConfig.KeysRotationPeriod)
+	case "": // Default to local signer
+		// Handle deprecated expiry.signingKeys configuration
+		if c.Expiry.SigningKeys != "" {
+			logger.Warn("config expiry.signingKeys will be removed in a future release",
+				"use_instead", "signer.config.keysRotationPeriod",
+				"current_value", c.Expiry.SigningKeys, "deprecated", true)
+		} else {
+			c.Expiry.SigningKeys = "6h"
+		}
+		localConfig := signer.LocalConfig{KeysRotationPeriod: c.Expiry.SigningKeys}
+		signerInstance, err = localConfig.Open(context.Background(), s, idTokensValidFor, now, logger)
+		if err != nil {
+			return fmt.Errorf("failed to open local signer: %v", err)
+		}
+		logger.Info("signer configured", "type", "local", "keys_rotation_period", localConfig.KeysRotationPeriod)
+	default:
+		return fmt.Errorf("unknown signer type %q", c.Signer.Type)
 	}
+
+	serverConfig := server.Config{
+		AllowedGrantTypes:      c.OAuth2.GrantTypes,
+		SupportedResponseTypes: c.OAuth2.ResponseTypes,
+		SkipApprovalScreen:     c.OAuth2.SkipApprovalScreen,
+		AlwaysShowLoginScreen:  c.OAuth2.AlwaysShowLoginScreen,
+		PasswordConnector:      c.OAuth2.PasswordConnector,
+		PKCE: authflow.PKCEConfig{
+			Enforce:                       c.OAuth2.PKCE.Enforce,
+			CodeChallengeMethodsSupported: c.OAuth2.PKCE.CodeChallengeMethodsSupported,
+		},
+		Headers:                    c.Web.Headers.ToHTTPHeader(),
+		AllowedOrigins:             c.Web.AllowedOrigins,
+		AllowedHeaders:             c.Web.AllowedHeaders,
+		Issuer:                     c.Issuer,
+		Storage:                    s,
+		Web:                        c.Frontend,
+		Logger:                     logger,
+		Now:                        now,
+		PrometheusRegistry:         prometheusRegistry,
+		HealthChecker:              healthChecker,
+		ContinueOnConnectorFailure: featureflags.ContinueOnConnectorFailure.Enabled(),
+		Signer:                     signerInstance,
+		IDTokensValidFor:           idTokensValidFor,
+		MFAProviders:               buildMFAProviders(c.MFA.Authenticators, c.Issuer, logger),
+		DefaultMFAChain:            c.MFA.DefaultMFAChain,
+	}
+
 	if c.Expiry.AuthRequests != "" {
 		authRequests, err := time.ParseDuration(c.Expiry.AuthRequests)
 		if err != nil {
 			return fmt.Errorf("invalid config value %q for auth request expiry: %v", c.Expiry.AuthRequests, err)
 		}
-		logger.Infof("config auth requests valid for: %v", authRequests)
+		logger.Info("config auth requests", "valid_for", authRequests)
 		serverConfig.AuthRequestsValidFor = authRequests
 	}
 	if c.Expiry.DeviceRequests != "" {
 		deviceRequests, err := time.ParseDuration(c.Expiry.DeviceRequests)
 		if err != nil {
-			return fmt.Errorf("invalid config value %q for device request expiry: %v", c.Expiry.AuthRequests, err)
+			return fmt.Errorf("invalid config value %q for device request expiry: %v", c.Expiry.DeviceRequests, err)
 		}
-		logger.Infof("config device requests valid for: %v", deviceRequests)
+		logger.Info("config device requests", "valid_for", deviceRequests)
 		serverConfig.DeviceRequestsValidFor = deviceRequests
 	}
-	refreshTokenPolicy, err := server.NewRefreshTokenPolicy(
+	refreshTokenPolicy, err := tokens.NewRefreshTokenPolicy(
 		logger,
 		c.Expiry.RefreshTokens.DisableRotation,
 		c.Expiry.RefreshTokens.ValidIfNotUsedFor,
@@ -327,6 +423,31 @@ func runServe(options serveOptions) error {
 	}
 
 	serverConfig.RefreshTokenPolicy = refreshTokenPolicy
+
+	if featureflags.SessionsEnabled.Enabled() {
+		sessionConfig, err := parseSessionConfig(c.Sessions)
+		if err != nil {
+			return fmt.Errorf("invalid session config: %v", err)
+		}
+		serverConfig.SessionConfig = sessionConfig
+		logger.Info("config sessions",
+			"cookie_name", sessionConfig.CookieName,
+			"absolute_lifetime", sessionConfig.AbsoluteLifetime,
+			"valid_if_not_used_for", sessionConfig.ValidIfNotUsedFor,
+		)
+	}
+
+	serverConfig.RealIPHeader = c.Web.ClientRemoteIP.Header
+	serverConfig.TrustedRealIPCIDRs, err = c.Web.ClientRemoteIP.ParseTrustedProxies()
+	if err != nil {
+		return fmt.Errorf("failed to parse client remote IP settings: %v", err)
+	}
+	if serverConfig.RealIPHeader != "" && len(serverConfig.TrustedRealIPCIDRs) == 0 {
+		logger.Warn("web.clientRemoteIP.header is set without web.clientRemoteIP.trustedProxies; "+
+			"the header is ignored because any client could spoof it",
+			"header", serverConfig.RealIPHeader)
+	}
+
 	serv, err := server.NewServer(context.Background(), serverConfig)
 	if err != nil {
 		return fmt.Errorf("failed to initialize server: %v", err)
@@ -362,7 +483,7 @@ func runServe(options serveOptions) error {
 	if c.Telemetry.HTTP != "" {
 		const name = "telemetry"
 
-		logger.Infof("listening (%s) on %s", name, c.Telemetry.HTTP)
+		logger.Info("listening on", "server", name, "address", c.Telemetry.HTTP)
 
 		l, err := net.Listen("tcp", c.Telemetry.HTTP)
 		if err != nil {
@@ -384,9 +505,9 @@ func runServe(options serveOptions) error {
 			ctx, cancel := context.WithTimeout(context.Background(), time.Minute)
 			defer cancel()
 
-			logger.Debugf("starting graceful shutdown (%s)", name)
+			logger.Debug("starting graceful shutdown", "server", name)
 			if err := server.Shutdown(ctx); err != nil {
-				logger.Errorf("graceful shutdown (%s): %v", name, err)
+				logger.Error("graceful shutdown", "server", name, "err", err)
 			}
 		})
 	}
@@ -395,7 +516,7 @@ func runServe(options serveOptions) error {
 	if c.Web.HTTP != "" {
 		const name = "http"
 
-		logger.Infof("listening (%s) on %s", name, c.Web.HTTP)
+		logger.Info("listening on", "server", name, "address", c.Web.HTTP)
 
 		l, err := net.Listen("tcp", c.Web.HTTP)
 		if err != nil {
@@ -413,9 +534,9 @@ func runServe(options serveOptions) error {
 			ctx, cancel := context.WithTimeout(context.Background(), time.Minute)
 			defer cancel()
 
-			logger.Debugf("starting graceful shutdown (%s)", name)
+			logger.Debug("starting graceful shutdown", "server", name)
 			if err := server.Shutdown(ctx); err != nil {
-				logger.Errorf("graceful shutdown (%s): %v", name, err)
+				logger.Error("graceful shutdown", "server", name, "err", err)
 			}
 		})
 	}
@@ -424,47 +545,76 @@ func runServe(options serveOptions) error {
 	if c.Web.HTTPS != "" {
 		const name = "https"
 
-		logger.Infof("listening (%s) on %s", name, c.Web.HTTPS)
+		logger.Info("listening on", "server", name, "address", c.Web.HTTPS)
 
 		l, err := net.Listen("tcp", c.Web.HTTPS)
 		if err != nil {
 			return fmt.Errorf("listening (%s) on %s: %v", name, c.Web.HTTPS, err)
 		}
 
+		tlsMinVersion := tls.VersionTLS12
+		if c.Web.TLSMinVersion != "" {
+			tlsMinVersion = allowedTLSVersions[c.Web.TLSMinVersion]
+		}
+		tlsMaxVersion := 0 // default for max is whatever Go defaults to
+		if c.Web.TLSMaxVersion != "" {
+			tlsMaxVersion = allowedTLSVersions[c.Web.TLSMaxVersion]
+		}
+
+		baseTLSConfig := &tls.Config{
+			MinVersion:               uint16(tlsMinVersion),
+			MaxVersion:               uint16(tlsMaxVersion),
+			CipherSuites:             allowedTLSCiphers,
+			PreferServerCipherSuites: true,
+		}
+
+		tlsConfig, err := newTLSReloader(logger, c.Web.TLSCert, c.Web.TLSKey, "", baseTLSConfig)
+		if err != nil {
+			return fmt.Errorf("invalid config: get HTTP TLS: %v", err)
+		}
+
 		server := &http.Server{
-			Handler: serv,
-			TLSConfig: &tls.Config{
-				CipherSuites:             allowedTLSCiphers,
-				PreferServerCipherSuites: true,
-				MinVersion:               tls.VersionTLS12,
-			},
+			Handler:   serv,
+			TLSConfig: tlsConfig,
 		}
 		defer server.Close()
 
 		group.Add(func() error {
-			return server.ServeTLS(l, c.Web.TLSCert, c.Web.TLSKey)
+			return server.ServeTLS(l, "", "")
 		}, func(err error) {
 			ctx, cancel := context.WithTimeout(context.Background(), time.Minute)
 			defer cancel()
 
-			logger.Debugf("starting graceful shutdown (%s)", name)
+			logger.Debug("starting graceful shutdown", "server", name)
 			if err := server.Shutdown(ctx); err != nil {
-				logger.Errorf("graceful shutdown (%s): %v", name, err)
+				logger.Error("graceful shutdown", "server", name, "err", err)
 			}
 		})
 	}
 
 	// Set up grpc server
 	if c.GRPC.Addr != "" {
-		logger.Infof("listening (grpc) on %s", c.GRPC.Addr)
+		logger.Info("listening on", "server", "grpc", "address", c.GRPC.Addr)
+
+		if c.GRPC.TLSClientCA == "" {
+			// The gRPC API grants full administrative access (client secret reads,
+			// password/connector/identity CRUD). Its only built-in caller
+			// authentication is mutual TLS via grpc.tlsClientCA; without it, anyone
+			// who can reach the port controls the identity provider. This is a valid
+			// setup only when a trusted front-facing service authenticates callers.
+			logger.Warn("grpc: API server has no client certificate authentication (grpc.tlsClientCA is unset); "+
+				"it exposes full administrative access. Ensure the port is only reachable by an authenticated, trusted service, "+
+				"or set grpc.tlsClientCA to require mutual TLS.",
+				"tls", c.GRPC.TLSCert != "")
+		}
 
 		grpcListener, err := net.Listen("tcp", c.GRPC.Addr)
 		if err != nil {
-			return fmt.Errorf("listening (grcp) on %s: %w", c.GRPC.Addr, err)
+			return fmt.Errorf("listening (grpc) on %s: %w", c.GRPC.Addr, err)
 		}
 
 		grpcSrv := grpc.NewServer(grpcOptions...)
-		api.RegisterDexServer(grpcSrv, server.NewAPI(serverConfig.Storage, logger, version))
+		api.RegisterDexServer(grpcSrv, apiserver.NewAPI(serverConfig.Storage, logger, version, serv.Connectors(), serv.Discovery(), serv.Backchannel()))
 
 		grpcMetrics.InitializeMetrics(grpcSrv)
 		if c.GRPC.Reflection {
@@ -475,7 +625,7 @@ func runServe(options serveOptions) error {
 		group.Add(func() error {
 			return grpcSrv.Serve(grpcListener)
 		}, func(err error) {
-			logger.Debugf("starting graceful shutdown (grpc)")
+			logger.Debug("starting graceful shutdown", "server", "grpc")
 			grpcSrv.GracefulStop()
 		})
 	}
@@ -485,55 +635,11 @@ func runServe(options serveOptions) error {
 		if _, ok := err.(run.SignalError); !ok {
 			return fmt.Errorf("run groups: %w", err)
 		}
-		logger.Infof("%v, shutdown now", err)
+		logger.Info("shutdown now", "err", err)
 	}
 	return nil
 }
 
-var (
-	logLevels  = []string{"debug", "info", "error"}
-	logFormats = []string{"json", "text"}
-)
-
-type utcFormatter struct {
-	f logrus.Formatter
-}
-
-func (f *utcFormatter) Format(e *logrus.Entry) ([]byte, error) {
-	e.Time = e.Time.UTC()
-	return f.f.Format(e)
-}
-
-func newLogger(level string, format string) (log.Logger, error) {
-	var logLevel logrus.Level
-	switch strings.ToLower(level) {
-	case "debug":
-		logLevel = logrus.DebugLevel
-	case "", "info":
-		logLevel = logrus.InfoLevel
-	case "error":
-		logLevel = logrus.ErrorLevel
-	default:
-		return nil, fmt.Errorf("log level is not one of the supported values (%s): %s", strings.Join(logLevels, ", "), level)
-	}
-
-	var formatter utcFormatter
-	switch strings.ToLower(format) {
-	case "", "text":
-		formatter.f = &logrus.TextFormatter{DisableColors: true}
-	case "json":
-		formatter.f = &logrus.JSONFormatter{}
-	default:
-		return nil, fmt.Errorf("log format is not one of the supported values (%s): %s", strings.Join(logFormats, ", "), format)
-	}
-
-	return &logrus.Logger{
-		Out:       os.Stderr,
-		Formatter: &formatter,
-		Level:     logLevel,
-	}, nil
-}
-
 func applyConfigOverrides(options serveOptions, config *Config) {
 	if options.webHTTPAddr != "" {
 		config.Web.HTTP = options.webHTTPAddr
@@ -554,6 +660,20 @@ func applyConfigOverrides(options serveOptions, config *Config) {
 	if config.Frontend.Dir == "" {
 		config.Frontend.Dir = os.Getenv("DEX_FRONTEND_DIR")
 	}
+
+	if len(config.OAuth2.GrantTypes) == 0 {
+		config.OAuth2.GrantTypes = []string{
+			"authorization_code",
+			"implicit",
+			"password",
+			"refresh_token",
+			"urn:ietf:params:oauth:grant-type:device_code",
+			"urn:ietf:params:oauth:grant-type:token-exchange",
+		}
+		if featureflags.ClientCredentialGrantEnabledByDefault.Enabled() {
+			config.OAuth2.GrantTypes = append(config.OAuth2.GrantTypes, "client_credentials")
+		}
+	}
 }
 
 func pprofHandler(router *http.ServeMux) {
@@ -563,3 +683,211 @@ func pprofHandler(router *http.ServeMux) {
 	router.HandleFunc("/debug/pprof/symbol", pprof.Symbol)
 	router.HandleFunc("/debug/pprof/trace", pprof.Trace)
 }
+
+// newTLSReloader returns a [tls.Config] with GetCertificate or GetConfigForClient set
+// to reload certificates from the given paths on SIGHUP or on file creates (atomic update via rename).
+func newTLSReloader(logger *slog.Logger, certFile, keyFile, caFile string, baseConfig *tls.Config) (*tls.Config, error) {
+	// trigger reload on channel
+	sigc := make(chan os.Signal, 1)
+	signal.Notify(sigc, syscall.SIGHUP)
+
+	// files to watch
+	watchFiles := map[string]struct{}{
+		certFile: {},
+		keyFile:  {},
+	}
+	if caFile != "" {
+		watchFiles[caFile] = struct{}{}
+	}
+	watchDirs := make(map[string]struct{}) // dedupe dirs
+	for f := range watchFiles {
+		dir := filepath.Dir(f)
+		if !strings.HasPrefix(f, dir) {
+			// normalize name to have ./ prefix if only a local path was provided
+			// can't pass "" to watcher.Add
+			watchFiles[dir+string(filepath.Separator)+f] = struct{}{}
+		}
+		watchDirs[dir] = struct{}{}
+	}
+	// trigger reload on file change
+	watcher, err := fsnotify.NewWatcher()
+	if err != nil {
+		return nil, fmt.Errorf("create watcher for TLS reloader: %v", err)
+	}
+	// recommended by fsnotify: watch the dir to handle renames
+	// https://pkg.go.dev/github.com/fsnotify/fsnotify#hdr-Watching_files
+	for dir := range watchDirs {
+		logger.Debug("watching dir", "dir", dir)
+		err := watcher.Add(dir)
+		if err != nil {
+			return nil, fmt.Errorf("watch dir for TLS reloader: %v", err)
+		}
+	}
+
+	// load once outside the goroutine so we can return an error on misconfig
+	initialConfig, err := loadTLSConfig(certFile, keyFile, caFile, baseConfig)
+	if err != nil {
+		return nil, fmt.Errorf("load TLS config: %v", err)
+	}
+
+	// stored version of current tls config
+	ptr := &atomic.Pointer[tls.Config]{}
+	ptr.Store(initialConfig)
+
+	// start background worker to reload certs
+	go func() {
+	loop:
+		for {
+			select {
+			case sig := <-sigc:
+				logger.Debug("reloading cert from signal", "signal", sig)
+			case evt := <-watcher.Events:
+				if _, ok := watchFiles[evt.Name]; !ok || !evt.Has(fsnotify.Create) {
+					continue loop
+				}
+				logger.Debug("reloading cert from fsnotify", "event", evt.Name, "operation", evt.Op.String())
+			case err := <-watcher.Errors:
+				logger.Error("TLS reloader watch", "err", err)
+			}
+
+			loaded, err := loadTLSConfig(certFile, keyFile, caFile, baseConfig)
+			if err != nil {
+				logger.Error("reload TLS config", "err", err)
+			}
+			ptr.Store(loaded)
+		}
+	}()
+
+	// https://pkg.go.dev/crypto/tls#baseConfig
+	// Server configurations must set one of Certificates, GetCertificate or GetConfigForClient.
+	if caFile != "" {
+		// grpc will use this via tls.Server for mTLS
+		initialConfig.GetConfigForClient = func(chi *tls.ClientHelloInfo) (*tls.Config, error) { return ptr.Load(), nil }
+	} else {
+		// net/http only uses Certificates or GetCertificate
+		initialConfig.GetCertificate = func(chi *tls.ClientHelloInfo) (*tls.Certificate, error) { return &ptr.Load().Certificates[0], nil }
+	}
+	return initialConfig, nil
+}
+
+// loadTLSConfig loads the given file paths into a [tls.Config]
+func loadTLSConfig(certFile, keyFile, caFile string, baseConfig *tls.Config) (*tls.Config, error) {
+	cert, err := tls.LoadX509KeyPair(certFile, keyFile)
+	if err != nil {
+		return nil, fmt.Errorf("loading TLS keypair: %v", err)
+	}
+	loadedConfig := baseConfig.Clone() // copy
+	loadedConfig.Certificates = []tls.Certificate{cert}
+	if caFile != "" {
+		cPool := x509.NewCertPool()
+		clientCert, err := os.ReadFile(caFile)
+		if err != nil {
+			return nil, fmt.Errorf("reading from client CA file: %v", err)
+		}
+		if !cPool.AppendCertsFromPEM(clientCert) {
+			return nil, errors.New("failed to parse client CA")
+		}
+
+		loadedConfig.ClientAuth = tls.RequireAndVerifyClientCert
+		loadedConfig.ClientCAs = cPool
+	}
+	return loadedConfig, nil
+}
+
+// recordBuildInfo publishes information about Dex version and runtime info through an info metric (gauge).
+func recordBuildInfo() {
+	buildInfo.WithLabelValues(version, runtime.Version(), fmt.Sprintf("%s/%s", runtime.GOOS, runtime.GOARCH)).Set(1)
+}
+
+func parseSessionConfig(s *Sessions) (*session.Config, error) {
+	sc := &session.Config{
+		CookieName:                 "dex_session",
+		AbsoluteLifetime:           24 * time.Hour,
+		ValidIfNotUsedFor:          1 * time.Hour,
+		RememberMeCheckedByDefault: true,
+	}
+	if s != nil {
+		if s.CookieName != "" {
+			sc.CookieName = s.CookieName
+		}
+		if s.AbsoluteLifetime != "" {
+			d, err := time.ParseDuration(s.AbsoluteLifetime)
+			if err != nil {
+				return nil, fmt.Errorf("invalid absoluteLifetime %q: %v", s.AbsoluteLifetime, err)
+			}
+			sc.AbsoluteLifetime = d
+		}
+		if s.ValidIfNotUsedFor != "" {
+			d, err := time.ParseDuration(s.ValidIfNotUsedFor)
+			if err != nil {
+				return nil, fmt.Errorf("invalid validIfNotUsedFor %q: %v", s.ValidIfNotUsedFor, err)
+			}
+			sc.ValidIfNotUsedFor = d
+		}
+		if s.RememberMeCheckedByDefault != nil {
+			sc.RememberMeCheckedByDefault = *s.RememberMeCheckedByDefault
+		}
+		if s.CookieEncryptionKey != "" {
+			sc.CookieEncryptionKey = []byte(s.CookieEncryptionKey)
+		}
+		if s.SSOSharedWithDefault != "" {
+			sc.SSOSharedWithDefault = s.SSOSharedWithDefault
+		}
+	}
+	if sc.AbsoluteLifetime <= 0 {
+		return nil, fmt.Errorf("absoluteLifetime must be positive, got %v", sc.AbsoluteLifetime)
+	}
+	if sc.ValidIfNotUsedFor <= 0 {
+		return nil, fmt.Errorf("validIfNotUsedFor must be positive, got %v", sc.ValidIfNotUsedFor)
+	}
+	if sc.ValidIfNotUsedFor > sc.AbsoluteLifetime {
+		return nil, fmt.Errorf("validIfNotUsedFor (%v) must not exceed absoluteLifetime (%v)", sc.ValidIfNotUsedFor, sc.AbsoluteLifetime)
+	}
+	if k := len(sc.CookieEncryptionKey); k > 0 && k != 16 && k != 24 && k != 32 {
+		return nil, fmt.Errorf("cookieEncryptionKey must be 16, 24, or 32 bytes (AES-128/192/256), got %d", k)
+	}
+	switch sc.SSOSharedWithDefault {
+	case "", "none", "all":
+		// valid
+	default:
+		return nil, fmt.Errorf("ssoSharedWithDefault must be \"none\" or \"all\", got %q", sc.SSOSharedWithDefault)
+	}
+	return sc, nil
+}
+
+func buildMFAProviders(authenticators []MFAAuthenticator, issuerURL string, logger *slog.Logger) map[string]mfa.Provider {
+	if len(authenticators) == 0 {
+		return nil
+	}
+
+	providers := make(map[string]mfa.Provider, len(authenticators))
+	for _, auth := range authenticators {
+		switch auth.Type {
+		case "TOTP":
+			var cfg TOTPConfig
+			if err := json.Unmarshal(auth.Config, &cfg); err != nil {
+				logger.Error("failed to parse TOTP config", "id", auth.ID, "err", err)
+				continue
+			}
+			providers[auth.ID] = mfa.NewTOTPProvider(cfg.Issuer, auth.ConnectorTypes)
+			logger.Info("MFA authenticator configured", "id", auth.ID, "type", auth.Type)
+		case "WebAuthn":
+			var cfg WebAuthnConfig
+			if err := json.Unmarshal(auth.Config, &cfg); err != nil {
+				logger.Error("failed to parse WebAuthn config", "id", auth.ID, "err", err)
+				continue
+			}
+			provider, err := mfa.NewWebAuthnProvider(cfg.RPDisplayName, cfg.RPID, cfg.RPOrigins,
+				cfg.AttestationPreference, cfg.Timeout, issuerURL, auth.ConnectorTypes)
+			if err != nil {
+				logger.Error("failed to create WebAuthn provider", "id", auth.ID, "err", err)
+				continue
+			}
+			providers[auth.ID] = provider
+			logger.Info("MFA authenticator configured", "id", auth.ID, "type", auth.Type)
+		default:
+			logger.Error("unknown MFA authenticator type, skipping", "id", auth.ID, "type", auth.Type)
+		}
+	}
+	return providers
+}
diff --git a/cmd/dex/serve_test.go b/cmd/dex/serve_test.go
new file mode 100644
index 0000000000..12d0c0fff4
--- /dev/null
+++ b/cmd/dex/serve_test.go
@@ -0,0 +1,29 @@
+package main
+
+import (
+	"log/slog"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestNewLogger(t *testing.T) {
+	t.Run("JSON", func(t *testing.T) {
+		logger, err := newLogger(slog.LevelInfo, "json", nil)
+		require.NoError(t, err)
+		require.NotEqual(t, (*slog.Logger)(nil), logger)
+	})
+
+	t.Run("Text", func(t *testing.T) {
+		logger, err := newLogger(slog.LevelError, "text", nil)
+		require.NoError(t, err)
+		require.NotEqual(t, (*slog.Logger)(nil), logger)
+	})
+
+	t.Run("Unknown", func(t *testing.T) {
+		logger, err := newLogger(slog.LevelError, "gofmt", nil)
+		require.Error(t, err)
+		require.Equal(t, "log format is not one of the supported values (json, text): gofmt", err.Error())
+		require.Equal(t, (*slog.Logger)(nil), logger)
+	})
+}
diff --git a/cmd/docker-entrypoint/main.go b/cmd/docker-entrypoint/main.go
index 0c507d1712..14d837e5ee 100644
--- a/cmd/docker-entrypoint/main.go
+++ b/cmd/docker-entrypoint/main.go
@@ -17,21 +17,18 @@ func main() {
 	// Note that this docker-entrypoint program is args[0], and it is provided with the true process
 	// args.
 	args := os.Args[1:]
+	if len(args) == 0 {
+		fmt.Println("error: no args passed to entrypoint")
+		os.Exit(1)
+	}
 
-	if err := run(args, realExec, realWhich); err != nil {
+	if err := run(args, realExec, realWhich, realGomplate); err != nil {
 		fmt.Println("error:", err.Error())
 		os.Exit(1)
 	}
 }
 
-func realExec(fork bool, args ...string) error {
-	if fork {
-		if output, err := exec.Command(args[0], args[1:]...).CombinedOutput(); err != nil {
-			return fmt.Errorf("cannot fork/exec command %s: %w (output: %q)", args, err, string(output))
-		}
-		return nil
-	}
-
+func realExec(args ...string) error {
 	argv0, err := exec.LookPath(args[0])
 	if err != nil {
 		return fmt.Errorf("cannot lookup path for command %s: %w", args[0], err)
@@ -52,34 +49,49 @@ func realWhich(path string) string {
 	return fullPath
 }
 
-func run(args []string, execFunc func(bool, ...string) error, whichFunc func(string) string) error {
+func realGomplate(path string) (string, error) {
+	tmpFile, err := os.CreateTemp("/tmp", "dex.config.yaml-*")
+	if err != nil {
+		return "", fmt.Errorf("cannot create temp file: %w", err)
+	}
+
+	cmd := exec.Command("gomplate", "-f", path, "-o", tmpFile.Name())
+	// TODO(nabokihms): Workaround to run gomplate from a non-root directory in distroless images
+	//   gomplate tries to access CWD on start, see: https://github.com/hairyhenderson/gomplate/pull/2202
+	cmd.Dir = "/etc/dex"
+
+	output, err := cmd.CombinedOutput()
+	if err != nil {
+		return "", fmt.Errorf("error executing gomplate: %w, (output: %q)", err, string(output))
+	}
+
+	return tmpFile.Name(), nil
+}
+
+func run(args []string, execFunc func(...string) error, whichFunc func(string) string, gomplateFunc func(string) (string, error)) error {
 	if args[0] != "dex" && args[0] != whichFunc("dex") {
-		return execFunc(false, args...)
+		return execFunc(args...)
 	}
 
 	if args[1] != "serve" {
-		return execFunc(false, args...)
+		return execFunc(args...)
 	}
 
 	newArgs := []string{}
 	for _, tplCandidate := range args {
 		if hasSuffixes(tplCandidate, ".tpl", ".tmpl", ".yaml") {
-			tmpFile, err := os.CreateTemp("/tmp", "dex.config.yaml-*")
+			fileName, err := gomplateFunc(tplCandidate)
 			if err != nil {
-				return fmt.Errorf("cannot create temp file: %w", err)
-			}
-
-			if err := execFunc(true, "gomplate", "-f", tplCandidate, "-o", tmpFile.Name()); err != nil {
 				return err
 			}
 
-			newArgs = append(newArgs, tmpFile.Name())
+			newArgs = append(newArgs, fileName)
 		} else {
 			newArgs = append(newArgs, tplCandidate)
 		}
 	}
 
-	return execFunc(false, newArgs...)
+	return execFunc(newArgs...)
 }
 
 func hasSuffixes(s string, suffixes ...string) bool {
diff --git a/cmd/docker-entrypoint/main_test.go b/cmd/docker-entrypoint/main_test.go
index c8aef16979..49da3b5f02 100644
--- a/cmd/docker-entrypoint/main_test.go
+++ b/cmd/docker-entrypoint/main_test.go
@@ -6,7 +6,7 @@ import (
 )
 
 type execArgs struct {
-	fork        bool
+	gomplate    bool
 	argPrefixes []string
 }
 
@@ -16,98 +16,89 @@ func TestRun(t *testing.T) {
 		args         []string
 		execReturns  error
 		whichReturns string
-		wantExecArgs []execArgs
+		wantExecArgs execArgs
 		wantErr      error
 	}{
 		{
 			name:         "executable not dex",
 			args:         []string{"tuna", "fish"},
-			wantExecArgs: []execArgs{{fork: false, argPrefixes: []string{"tuna", "fish"}}},
+			wantExecArgs: execArgs{gomplate: false, argPrefixes: []string{"tuna", "fish"}},
 		},
 		{
 			name:         "executable is full path to dex",
 			args:         []string{"/usr/local/bin/dex", "marshmallow", "zelda"},
 			whichReturns: "/usr/local/bin/dex",
-			wantExecArgs: []execArgs{{fork: false, argPrefixes: []string{"/usr/local/bin/dex", "marshmallow", "zelda"}}},
+			wantExecArgs: execArgs{gomplate: false, argPrefixes: []string{"/usr/local/bin/dex", "marshmallow", "zelda"}},
 		},
 		{
 			name:         "command is not serve",
 			args:         []string{"dex", "marshmallow", "zelda"},
-			wantExecArgs: []execArgs{{fork: false, argPrefixes: []string{"dex", "marshmallow", "zelda"}}},
+			wantExecArgs: execArgs{gomplate: false, argPrefixes: []string{"dex", "marshmallow", "zelda"}},
 		},
 		{
 			name:         "no templates",
 			args:         []string{"dex", "serve", "config.yaml.not-a-template"},
-			wantExecArgs: []execArgs{{fork: false, argPrefixes: []string{"dex", "serve", "config.yaml.not-a-template"}}},
+			wantExecArgs: execArgs{gomplate: false, argPrefixes: []string{"dex", "serve", "config.yaml.not-a-template"}},
 		},
 		{
 			name:         "no templates",
 			args:         []string{"dex", "serve", "config.yaml.not-a-template"},
-			wantExecArgs: []execArgs{{fork: false, argPrefixes: []string{"dex", "serve", "config.yaml.not-a-template"}}},
+			wantExecArgs: execArgs{gomplate: false, argPrefixes: []string{"dex", "serve", "config.yaml.not-a-template"}},
 		},
 		{
-			name: ".tpl template",
-			args: []string{"dex", "serve", "config.tpl"},
-			wantExecArgs: []execArgs{
-				{fork: true, argPrefixes: []string{"gomplate", "-f", "config.tpl", "-o", "/tmp/dex.config.yaml-"}},
-				{fork: false, argPrefixes: []string{"dex", "serve", "/tmp/dex.config.yaml-"}},
-			},
+			name:         ".tpl template",
+			args:         []string{"dex", "serve", "config.tpl"},
+			wantExecArgs: execArgs{gomplate: true, argPrefixes: []string{"dex", "serve", "/tmp/dex.config.yaml-"}},
 		},
 		{
-			name: ".tmpl template",
-			args: []string{"dex", "serve", "config.tmpl"},
-			wantExecArgs: []execArgs{
-				{fork: true, argPrefixes: []string{"gomplate", "-f", "config.tmpl", "-o", "/tmp/dex.config.yaml-"}},
-				{fork: false, argPrefixes: []string{"dex", "serve", "/tmp/dex.config.yaml-"}},
-			},
+			name:         ".tmpl template",
+			args:         []string{"dex", "serve", "config.tmpl"},
+			wantExecArgs: execArgs{gomplate: true, argPrefixes: []string{"dex", "serve", "/tmp/dex.config.yaml-"}},
 		},
 		{
-			name: ".yaml template",
-			args: []string{"dex", "serve", "some/path/config.yaml"},
-			wantExecArgs: []execArgs{
-				{fork: true, argPrefixes: []string{"gomplate", "-f", "some/path/config.yaml", "-o", "/tmp/dex.config.yaml-"}},
-				{fork: false, argPrefixes: []string{"dex", "serve", "/tmp/dex.config.yaml-"}},
-			},
+			name:         ".yaml template",
+			args:         []string{"dex", "serve", "some/path/config.yaml"},
+			wantExecArgs: execArgs{gomplate: true, argPrefixes: []string{"dex", "serve", "/tmp/dex.config.yaml-"}},
 		},
 	}
 	for _, test := range tests {
 		t.Run(test.name, func(t *testing.T) {
-			var gotExecForks []bool
-			var gotExecArgs [][]string
-			fakeExec := func(fork bool, args ...string) error {
-				gotExecForks = append(gotExecForks, fork)
-				gotExecArgs = append(gotExecArgs, args)
+			var gotExecArgs []string
+			var runsGomplate bool
+
+			fakeExec := func(args ...string) error {
+				gotExecArgs = append(args, gotExecArgs...)
 				return test.execReturns
 			}
 
 			fakeWhich := func(_ string) string { return test.whichReturns }
 
-			gotErr := run(test.args, fakeExec, fakeWhich)
+			fakeGomplate := func(file string) (string, error) {
+				runsGomplate = true
+				return "/tmp/dex.config.yaml-", nil
+			}
+
+			gotErr := run(test.args, fakeExec, fakeWhich, fakeGomplate)
 			if (test.wantErr == nil) != (gotErr == nil) {
 				t.Errorf("wanted error %s, got %s", test.wantErr, gotErr)
 			}
-			if !execArgsMatch(test.wantExecArgs, gotExecForks, gotExecArgs) {
-				t.Errorf("wanted exec args %+v, got %+v %+v", test.wantExecArgs, gotExecForks, gotExecArgs)
+
+			if !execArgsMatch(test.wantExecArgs, runsGomplate, gotExecArgs) {
+				t.Errorf("wanted exec args %+v (running gomplate: %+v), got %+v (running gomplate: %+v)",
+					test.wantExecArgs.argPrefixes, test.wantExecArgs.gomplate, gotExecArgs, runsGomplate)
 			}
 		})
 	}
 }
 
-func execArgsMatch(wantExecArgs []execArgs, gotForks []bool, gotExecArgs [][]string) bool {
-	if len(wantExecArgs) != len(gotForks) {
+func execArgsMatch(wantExecArgs execArgs, gomplate bool, gotExecArgs []string) bool {
+	if wantExecArgs.gomplate != gomplate {
 		return false
 	}
-
-	for i := range wantExecArgs {
-		if wantExecArgs[i].fork != gotForks[i] {
+	for i := range wantExecArgs.argPrefixes {
+		if !strings.HasPrefix(gotExecArgs[i], wantExecArgs.argPrefixes[i]) {
 			return false
 		}
-		for j := range wantExecArgs[i].argPrefixes {
-			if !strings.HasPrefix(gotExecArgs[i][j], wantExecArgs[i].argPrefixes[j]) {
-				return false
-			}
-		}
 	}
-
 	return true
 }
diff --git a/config.dev.yaml b/config.dev.yaml
index dda65e08f7..bdbc2718d3 100644
--- a/config.dev.yaml
+++ b/config.dev.yaml
@@ -32,4 +32,10 @@ staticPasswords:
   - email: "admin@example.com"
     hash: "$2a$10$2b2cU8CPhOTaGrs1HRQuAueS7JTT5ZHsHSzYiFPm1leZck7Mc8T4W"
     username: "admin"
+    name: "Admin User"
+    emailVerified: true
+    preferredUsername: "admin"
+    groups:
+      - "team-a"
+      - "team-a/admins"
     userID: "08a8684b-db88-4b73-90a9-3cd1661f5466"
diff --git a/config.docker.yaml b/config.docker.yaml
index c5d2a47bfd..cc3a99ed39 100644
--- a/config.docker.yaml
+++ b/config.docker.yaml
@@ -22,10 +22,15 @@ telemetry:
 
 expiry:
   deviceRequests: {{ getenv "DEX_EXPIRY_DEVICE_REQUESTS" "5m" }}
-  signingKeys: {{ getenv "DEX_EXPIRY_SIGNING_KEYS" "6h" }}
   idTokens: {{ getenv "DEX_EXPIRY_ID_TOKENS" "24h" }}
   authRequests: {{ getenv "DEX_EXPIRY_AUTH_REQUESTS" "24h" }}
 
+signer:
+  type: local
+  config:
+    keysRotationPeriod: {{ getenv "DEX_EXPIRY_SIGNING_KEYS" "6h" }}
+    algorithm: {{ getenv "DEX_SIGNER_LOCAL_ALGORITHM" "RS256" }}
+
 logger:
   level: {{ getenv "DEX_LOG_LEVEL" "info" }}
   format: {{ getenv "DEX_LOG_FORMAT" "text" }}
diff --git a/config.yaml.dist b/config.yaml.dist
index ba7bad68e0..d2d31c80a9 100644
--- a/config.yaml.dist
+++ b/config.yaml.dist
@@ -55,6 +55,8 @@ web:
   # https: 127.0.0.1:5554
   # tlsCert: /etc/dex/tls.crt
   # tlsKey: /etc/dex/tls.key
+  # tlsMinVersion: 1.2
+  # tlsMaxVersion: 1.3
 
 # Dex UI configuration
 # frontend:
@@ -70,6 +72,8 @@ web:
 # logger:
 #   level: "debug"
 #   format: "text" # can also be "json"
+#   # Drop these attribute keys from all log output (useful for GDPR/PII suppression).
+#   # excludeFields: [email, username, preferred_username, groups]
 
 # gRPC API configuration
 # Uncomment this block to enable the gRPC API.
@@ -83,13 +87,33 @@ web:
 # Expiration configuration for tokens, signing keys, etc.
 # expiry:
 #   deviceRequests: "5m"
-#   signingKeys: "6h"
+#   signingKeys: "6h" # deprecated, use signer.config.keysRotationPeriod
 #   idTokens: "24h"
 #   refreshTokens:
 #     disableRotation: false
 #     reuseInterval: "3s"
 #     validIfNotUsedFor: "2160h" # 90 days
 #     absoluteLifetime: "3960h" # 165 days
+#
+# signer:
+#   type: local
+#   config:
+#     keysRotationPeriod: "6h"
+#     algorithm: "RS256" # supported values: "RS256" (default) and "ES256"; changes apply on the next key rotation
+
+# Authentication sessions configuration.
+# Requires DEX_SESSIONS_ENABLED=true feature flag.
+# sessions:
+#   cookieName: "dex_session"
+#   absoluteLifetime: "24h"
+#   validIfNotUsedFor: "1h"
+#   rememberMeCheckedByDefault: false
+#   # AES key for encrypting session cookies. Must be 16, 24, or 32 bytes.
+#   # If empty, cookies are not encrypted.
+#   cookieEncryptionKey: ""
+#   # Default SSO sharing policy for clients without explicit ssoSharedWith.
+#   # "all" = share with all clients (Keycloak-like), "none" = no sharing (default).
+#   ssoSharedWithDefault: "none"
 
 # OAuth2 configuration
 # oauth2:
@@ -107,6 +131,13 @@ web:
 #
 #   # Uncomment to use a specific connector for password grants
 #   passwordConnector: local
+#
+#   # PKCE (Proof Key for Code Exchange) configuration
+#   pkce:
+#     # If true, PKCE is required for all authorization code flows (OAuth 2.1).
+#     enforce: false
+#     # Supported code challenge methods. Defaults to ["S256", "plain"].
+#     codeChallengeMethodsSupported: ["S256", "plain"]
 
 # Static clients registered in Dex by default.
 #
@@ -117,10 +148,51 @@ web:
 #       - 'http://127.0.0.1:5555/callback'
 #     name: 'Example App'
 #     secret: ZXhhbXBsZS1hcHAtc2VjcmV0
+#
+#   # Example using environment variables
+#   # These fields are mutually exclusive with id and secret respectively.
+#   - idEnv: DEX_CLIENT_ID
+#     secretEnv: DEX_CLIENT_SECRET
+#     redirectURIs:
+#       - 'https://app.example.com/callback'
+#     name: 'Production App'
+#
+#   # Example of a public client (no secret required)
+#   - id: example-device-client
+#     redirectURIs:
+#       - /device/callback
+#     name: 'Static Client for Device Flow'
+#     public: true
+#
+#   # Example of a client restricted to specific connectors
+#   - id: restricted-client
+#     secret: restricted-client-secret
+#     redirectURIs:
+#       - 'https://app.example.com/callback'
+#     name: 'Restricted Client'
+#     allowedConnectors:
+#       - github
+#       - google
+#
+#   # Example of SSO sharing between clients.
+#   # ssoSharedWith defines which other clients can reuse this client's session.
+#   # ["*"] = share with all, [] = share with no one.
+#   # If omitted, ssoSharedWithDefault from sessions config is used.
+#   - id: portal-app
+#     secret: portal-secret
+#     redirectURIs:
+#       - 'https://portal.example.com/callback'
+#     name: 'Portal'
+#     ssoSharedWith:
+#       - "dashboard-app"
+#       - "admin-app"
 
-# Connectors are used to authenticate users agains upstream identity providers.
+# Connectors are used to authenticate users against upstream identity providers.
 #
 # See the documentation (https://dexidp.io/docs/connectors/) for further information.
+#
+# For LDAP nested group resolution, set groupSearch.userMatchers[].recursionGroupAttr
+# in the connector config. See: https://dexidp.io/docs/connectors/ldap/
 # connectors: []
 
 # Enable the password database.
@@ -133,4 +205,19 @@ enablePasswordDB: true
 # A static list of passwords for the password connector.
 #
 # Alternatively, passwords my be added/updated through the gRPC API.
-# staticPasswords: []
+# staticPasswords:
+#  - email: "user@example.com"
+#    # bcrypt hash of the string "password"
+#    hash: "$2a$10$examplehash..."
+#    username: "user-login"
+#    # Optional. Maps to OIDC "name" claim. Defaults to username.
+#    name: "User Full Name"
+#    # Optional. Maps to OIDC "email_verified" claim. Defaults to true.
+#    emailVerified: true
+#    # Optional. Maps to OIDC "preferred_username" claim.
+#    preferredUsername: "user-public"
+#    # Optional. Maps to OIDC "groups" claim (when 'groups' scope is requested).
+#    groups:
+#      - "team-a"
+#      - "team-a/admins"
+#    userID: "08a8684b-db88-4b73-90a9-3cd1661f5466"
diff --git a/connector/atlassiancrowd/atlassiancrowd.go b/connector/atlassiancrowd/atlassiancrowd.go
index e2ca94b0de..ca92214785 100644
--- a/connector/atlassiancrowd/atlassiancrowd.go
+++ b/connector/atlassiancrowd/atlassiancrowd.go
@@ -7,6 +7,7 @@ import (
 	"encoding/json"
 	"fmt"
 	"io"
+	"log/slog"
 	"net"
 	"net/http"
 	"strings"
@@ -14,7 +15,6 @@ import (
 
 	"github.com/dexidp/dex/connector"
 	"github.com/dexidp/dex/pkg/groups"
-	"github.com/dexidp/dex/pkg/log"
 )
 
 // Config holds configuration options for Atlassian Crowd connector.
@@ -24,18 +24,17 @@ import (
 //
 // An example config:
 //
-//     type: atlassian-crowd
-//     config:
-//       baseURL: https://crowd.example.com/context
-//       clientID: applogin
-//       clientSecret: appP4$$w0rd
-//       # users can be restricted by a list of groups
-//       groups:
-//       - admin
-//       # Prompt for username field
-//       usernamePrompt: Login
-//		 preferredUsernameField: name
-//
+//	    type: atlassian-crowd
+//	    config:
+//	      baseURL: https://crowd.example.com/context
+//	      clientID: applogin
+//	      clientSecret: appP4$$w0rd
+//	      # users can be restricted by a list of groups
+//	      groups:
+//	      - admin
+//	      # Prompt for username field
+//	      usernamePrompt: Login
+//			 preferredUsernameField: name
 type Config struct {
 	BaseURL      string   `json:"baseURL"`
 	ClientID     string   `json:"clientID"`
@@ -81,16 +80,11 @@ type crowdAuthenticationError struct {
 }
 
 // Open returns a strategy for logging in through Atlassian Crowd
-func (c *Config) Open(_ string, logger log.Logger) (connector.Connector, error) {
+func (c *Config) Open(id string, logger *slog.Logger) (connector.Connector, error) {
 	if c.BaseURL == "" {
 		return nil, fmt.Errorf("crowd: no baseURL provided for crowd connector")
 	}
-	return &crowdConnector{Config: *c, logger: logger}, nil
-}
-
-type crowdConnector struct {
-	Config
-	logger log.Logger
+	return &crowdConnector{Config: *c, logger: logger.With(slog.Group("connector", "type", "atlassiancrowd", "id", id))}, nil
 }
 
 var (
@@ -98,6 +92,11 @@ var (
 	_ connector.RefreshConnector  = (*crowdConnector)(nil)
 )
 
+type crowdConnector struct {
+	Config
+	logger *slog.Logger
+}
+
 type refreshData struct {
 	Username string `json:"username"`
 }
@@ -376,7 +375,7 @@ func (c *crowdConnector) identityFromCrowdUser(user crowdUser) connector.Identit
 		identity.PreferredUsername = user.Email
 	default:
 		if c.PreferredUsernameField != "" {
-			c.logger.Warnf("preferred_username left empty. Invalid crowd field mapped to preferred_username: %s", c.PreferredUsernameField)
+			c.logger.Warn("preferred_username left empty. Invalid crowd field mapped to preferred_username", "field", c.PreferredUsernameField)
 		}
 	}
 
@@ -437,12 +436,12 @@ func (c *crowdConnector) validateCrowdResponse(resp *http.Response) ([]byte, err
 	}
 
 	if resp.StatusCode == http.StatusForbidden && strings.Contains(string(body), "The server understood the request but refuses to authorize it.") {
-		c.logger.Debugf("crowd response validation failed: %s", string(body))
+		c.logger.Debug("crowd response validation failed", "response", string(body))
 		return nil, fmt.Errorf("dex is forbidden from making requests to the Atlassian Crowd application by URL %q", c.BaseURL)
 	}
 
 	if resp.StatusCode == http.StatusUnauthorized && string(body) == "Application failed to authenticate" {
-		c.logger.Debugf("crowd response validation failed: %s", string(body))
+		c.logger.Debug("crowd response validation failed", "response", string(body))
 		return nil, fmt.Errorf("dex failed to authenticate Crowd Application with ID %q", c.ClientID)
 	}
 	return body, nil
diff --git a/connector/atlassiancrowd/atlassiancrowd_test.go b/connector/atlassiancrowd/atlassiancrowd_test.go
index 36789a3919..17d0422ac8 100644
--- a/connector/atlassiancrowd/atlassiancrowd_test.go
+++ b/connector/atlassiancrowd/atlassiancrowd_test.go
@@ -6,13 +6,11 @@ import (
 	"crypto/tls"
 	"encoding/json"
 	"fmt"
-	"io"
+	"log/slog"
 	"net/http"
 	"net/http/httptest"
 	"reflect"
 	"testing"
-
-	"github.com/sirupsen/logrus"
 )
 
 func TestUserGroups(t *testing.T) {
@@ -115,7 +113,7 @@ func TestIdentityFromCrowdUser(t *testing.T) {
 	expectEquals(t, user.Name, "testuser")
 	expectEquals(t, user.Email, "testuser@example.com")
 
-	// Test unconfigured behaviour
+	// Test unconfigured behavior
 	i := c.identityFromCrowdUser(user)
 	expectEquals(t, i.UserID, "12345")
 	expectEquals(t, i.Username, "testuser")
@@ -151,11 +149,7 @@ type TestServerResponse struct {
 func newTestCrowdConnector(baseURL string) crowdConnector {
 	connector := crowdConnector{}
 	connector.BaseURL = baseURL
-	connector.logger = &logrus.Logger{
-		Out:       io.Discard,
-		Level:     logrus.DebugLevel,
-		Formatter: &logrus.TextFormatter{DisableColors: true},
-	}
+	connector.logger = slog.New(slog.DiscardHandler)
 	return connector
 }
 
diff --git a/connector/authproxy/authproxy.go b/connector/authproxy/authproxy.go
index 8715412146..5756a0d401 100644
--- a/connector/authproxy/authproxy.go
+++ b/connector/authproxy/authproxy.go
@@ -5,12 +5,12 @@ package authproxy
 
 import (
 	"fmt"
+	"log/slog"
 	"net/http"
 	"net/url"
 	"strings"
 
 	"github.com/dexidp/dex/connector"
-	"github.com/dexidp/dex/pkg/log"
 )
 
 // Config holds the configuration parameters for a connector which returns an
@@ -19,67 +19,117 @@ import (
 // Headers retrieved to fetch user's email and group can be configured
 // with userHeader and groupHeader.
 type Config struct {
-	UserHeader  string   `json:"userHeader"`
-	GroupHeader string   `json:"groupHeader"`
-	Groups      []string `json:"staticGroups"`
+	UserIDHeader         string   `json:"userIDHeader"`
+	UserHeader           string   `json:"userHeader"`
+	UserNameHeader       string   `json:"userNameHeader"`
+	EmailHeader          string   `json:"emailHeader"`
+	GroupHeader          string   `json:"groupHeader"`
+	GroupHeaderSeparator string   `json:"groupHeaderSeparator"`
+	Groups               []string `json:"staticGroups"`
 }
 
 // Open returns an authentication strategy which requires no user interaction.
-func (c *Config) Open(id string, logger log.Logger) (connector.Connector, error) {
+func (c *Config) Open(id string, logger *slog.Logger) (connector.Connector, error) {
+	userIDHeader := c.UserIDHeader
+	if userIDHeader == "" {
+		userIDHeader = "X-Remote-User-Id"
+	}
 	userHeader := c.UserHeader
 	if userHeader == "" {
 		userHeader = "X-Remote-User"
 	}
+	userNameHeader := c.UserNameHeader
+	if userNameHeader == "" {
+		userNameHeader = "X-Remote-User-Name"
+	}
+	emailHeader := c.EmailHeader
+	if emailHeader == "" {
+		emailHeader = "X-Remote-User-Email"
+	}
 	groupHeader := c.GroupHeader
 	if groupHeader == "" {
 		groupHeader = "X-Remote-Group"
 	}
+	groupHeaderSeparator := c.GroupHeaderSeparator
+	if groupHeaderSeparator == "" {
+		groupHeaderSeparator = ","
+	}
 
-	return &callback{userHeader: userHeader, groupHeader: groupHeader, logger: logger, pathSuffix: "/" + id, groups: c.Groups}, nil
+	return &callback{
+		userIDHeader:         userIDHeader,
+		userHeader:           userHeader,
+		userNameHeader:       userNameHeader,
+		emailHeader:          emailHeader,
+		groupHeader:          groupHeader,
+		groupHeaderSeparator: groupHeaderSeparator,
+		groups:               c.Groups,
+		logger:               logger.With(slog.Group("connector", "type", "authproxy", "id", id)),
+		pathSuffix:           "/" + id,
+	}, nil
 }
 
+var _ connector.CallbackConnector = (*callback)(nil)
+
 // Callback is a connector which returns an identity with the HTTP header
 // X-Remote-User as verified email.
 type callback struct {
-	userHeader  string
-	groupHeader string
-	groups      []string
-	logger      log.Logger
-	pathSuffix  string
+	userIDHeader         string
+	userNameHeader       string
+	userHeader           string
+	emailHeader          string
+	groupHeader          string
+	groupHeaderSeparator string
+	groups               []string
+	logger               *slog.Logger
+	pathSuffix           string
 }
 
 // LoginURL returns the URL to redirect the user to login with.
-func (m *callback) LoginURL(s connector.Scopes, callbackURL, state string) (string, error) {
+func (m *callback) LoginURL(s connector.Scopes, callbackURL, state string) (string, []byte, error) {
 	u, err := url.Parse(callbackURL)
 	if err != nil {
-		return "", fmt.Errorf("failed to parse callbackURL %q: %v", callbackURL, err)
+		return "", nil, fmt.Errorf("failed to parse callbackURL %q: %v", callbackURL, err)
 	}
 	u.Path += m.pathSuffix
 	v := u.Query()
 	v.Set("state", state)
 	u.RawQuery = v.Encode()
-	return u.String(), nil
+	return u.String(), nil, nil
 }
 
 // HandleCallback parses the request and returns the user's identity
-func (m *callback) HandleCallback(s connector.Scopes, r *http.Request) (connector.Identity, error) {
+func (m *callback) HandleCallback(s connector.Scopes, _ []byte, r *http.Request) (connector.Identity, error) {
 	remoteUser := r.Header.Get(m.userHeader)
 	if remoteUser == "" {
 		return connector.Identity{}, fmt.Errorf("required HTTP header %s is not set", m.userHeader)
 	}
+	remoteUserName := r.Header.Get(m.userNameHeader)
+	if remoteUserName == "" {
+		remoteUserName = remoteUser
+	}
+	remoteUserID := r.Header.Get(m.userIDHeader)
+	if remoteUserID == "" {
+		remoteUserID = remoteUser
+	}
+	remoteUserEmail := r.Header.Get(m.emailHeader)
+	if remoteUserEmail == "" {
+		remoteUserEmail = remoteUser
+	}
 	groups := m.groups
 	headerGroup := r.Header.Get(m.groupHeader)
 	if headerGroup != "" {
-		splitheaderGroup := strings.Split(headerGroup, ",")
+		splitheaderGroup := strings.Split(headerGroup, m.groupHeaderSeparator)
 		for i, v := range splitheaderGroup {
 			splitheaderGroup[i] = strings.TrimSpace(v)
 		}
 		groups = append(splitheaderGroup, groups...)
 	}
 	return connector.Identity{
-		UserID:        remoteUser, // TODO: figure out if this is a bad ID value.
-		Email:         remoteUser,
-		EmailVerified: true,
-		Groups:        groups,
+		UserID:            remoteUserID,
+		Username:          remoteUser,
+		PreferredUsername: remoteUserName,
+		Email:             remoteUserEmail,
+		EmailVerified:     true,
+		Groups:            groups,
 	}, nil
 }
diff --git a/connector/authproxy/authproxy_test.go b/connector/authproxy/authproxy_test.go
index 5d42530e07..bd8b4f3671 100644
--- a/connector/authproxy/authproxy_test.go
+++ b/connector/authproxy/authproxy_test.go
@@ -1,55 +1,82 @@
 package authproxy
 
 import (
-	"io"
+	"log/slog"
 	"net/http"
 	"reflect"
 	"testing"
 
-	"github.com/sirupsen/logrus"
-
 	"github.com/dexidp/dex/connector"
 )
 
 const (
-	testEmail        = "testuser@example.com"
-	testGroup1       = "group1"
-	testGroup2       = "group2"
-	testGroup3       = "group 3"
-	testGroup4       = "group 4"
-	testStaticGroup1 = "static1"
-	testStaticGroup2 = "static 2"
+	testEmail             = "testuser@example.com"
+	testGroup1            = "group1"
+	testGroup2            = "group2"
+	testGroup3            = "group 3"
+	testGroup4            = "group 4"
+	testStaticGroup1      = "static1"
+	testStaticGroup2      = "static 2"
+	testUsername          = "Test User"
+	testPreferredUsername = "testuser"
+	testUserID            = "1234567890"
 )
 
-var logger = &logrus.Logger{Out: io.Discard, Formatter: &logrus.TextFormatter{}}
+var logger = slog.New(slog.DiscardHandler)
 
 func TestUser(t *testing.T) {
-	config := Config{
-		UserHeader: "X-Remote-User",
+	config := Config{}
+
+	conn, _ := config.Open("test", logger)
+	callback := conn.(*callback)
+
+	req, err := http.NewRequest("GET", "/", nil)
+	expectNil(t, err)
+	req.Header = map[string][]string{
+		"X-Remote-User": {testUsername},
 	}
-	conn := callback{userHeader: config.UserHeader, logger: logger, pathSuffix: "/test"}
+
+	ident, err := callback.HandleCallback(connector.Scopes{OfflineAccess: true, Groups: true}, nil, req)
+	expectNil(t, err)
+
+	// If not specified, the userID and email should fall back to the remote user
+	expectEquals(t, ident.UserID, testUsername)
+	expectEquals(t, ident.PreferredUsername, testUsername)
+	expectEquals(t, ident.Username, testUsername)
+	expectEquals(t, ident.Email, testUsername)
+	expectEquals(t, len(ident.Groups), 0)
+}
+
+func TestExtraHeaders(t *testing.T) {
+	config := Config{}
+
+	conn, _ := config.Open("test", logger)
+	callback := conn.(*callback)
 
 	req, err := http.NewRequest("GET", "/", nil)
 	expectNil(t, err)
 	req.Header = map[string][]string{
-		"X-Remote-User": {testEmail},
+		"X-Remote-User-Id":    {testUserID},
+		"X-Remote-User":       {testUsername},
+		"X-Remote-User-Name":  {testPreferredUsername},
+		"X-Remote-User-Email": {testEmail},
 	}
 
-	ident, err := conn.HandleCallback(connector.Scopes{OfflineAccess: true, Groups: true}, req)
+	ident, err := callback.HandleCallback(connector.Scopes{OfflineAccess: true, Groups: true}, nil, req)
 	expectNil(t, err)
 
-	expectEquals(t, ident.UserID, testEmail)
+	expectEquals(t, ident.UserID, testUserID)
+	expectEquals(t, ident.PreferredUsername, testPreferredUsername)
+	expectEquals(t, ident.Username, testUsername)
 	expectEquals(t, ident.Email, testEmail)
 	expectEquals(t, len(ident.Groups), 0)
 }
 
 func TestSingleGroup(t *testing.T) {
-	config := Config{
-		UserHeader:  "X-Remote-User",
-		GroupHeader: "X-Remote-Group",
-	}
+	config := Config{}
 
-	conn := callback{userHeader: config.UserHeader, groupHeader: config.GroupHeader, logger: logger, pathSuffix: "/test"}
+	conn, _ := config.Open("test", logger)
+	callback := conn.(*callback)
 
 	req, err := http.NewRequest("GET", "/", nil)
 	expectNil(t, err)
@@ -58,7 +85,7 @@ func TestSingleGroup(t *testing.T) {
 		"X-Remote-Group": {testGroup1},
 	}
 
-	ident, err := conn.HandleCallback(connector.Scopes{OfflineAccess: true, Groups: true}, req)
+	ident, err := callback.HandleCallback(connector.Scopes{OfflineAccess: true, Groups: true}, nil, req)
 	expectNil(t, err)
 
 	expectEquals(t, ident.UserID, testEmail)
@@ -67,21 +94,45 @@ func TestSingleGroup(t *testing.T) {
 }
 
 func TestMultipleGroup(t *testing.T) {
+	config := Config{}
+
+	conn, _ := config.Open("test", logger)
+	callback := conn.(*callback)
+
+	req, err := http.NewRequest("GET", "/", nil)
+	expectNil(t, err)
+	req.Header = map[string][]string{
+		"X-Remote-User":  {testEmail},
+		"X-Remote-Group": {testGroup1 + ", " + testGroup2 + ", " + testGroup3 + ", " + testGroup4},
+	}
+
+	ident, err := callback.HandleCallback(connector.Scopes{OfflineAccess: true, Groups: true}, nil, req)
+	expectNil(t, err)
+
+	expectEquals(t, ident.UserID, testEmail)
+	expectEquals(t, len(ident.Groups), 4)
+	expectEquals(t, ident.Groups[0], testGroup1)
+	expectEquals(t, ident.Groups[1], testGroup2)
+	expectEquals(t, ident.Groups[2], testGroup3)
+	expectEquals(t, ident.Groups[3], testGroup4)
+}
+
+func TestMultipleGroupWithCustomSeparator(t *testing.T) {
 	config := Config{
-		UserHeader:  "X-Remote-User",
-		GroupHeader: "X-Remote-Group",
+		GroupHeaderSeparator: ";",
 	}
 
-	conn := callback{userHeader: config.UserHeader, groupHeader: config.GroupHeader, logger: logger, pathSuffix: "/test"}
+	conn, _ := config.Open("test", logger)
+	callback := conn.(*callback)
 
 	req, err := http.NewRequest("GET", "/", nil)
 	expectNil(t, err)
 	req.Header = map[string][]string{
 		"X-Remote-User":  {testEmail},
-		"X-Remote-Group": {testGroup1 + ", " + testGroup2 + ", " + testGroup3 + ", " + testGroup4},
+		"X-Remote-Group": {testGroup1 + ";" + testGroup2 + ";" + testGroup3 + ";" + testGroup4},
 	}
 
-	ident, err := conn.HandleCallback(connector.Scopes{OfflineAccess: true, Groups: true}, req)
+	ident, err := callback.HandleCallback(connector.Scopes{OfflineAccess: true, Groups: true}, nil, req)
 	expectNil(t, err)
 
 	expectEquals(t, ident.UserID, testEmail)
@@ -94,12 +145,11 @@ func TestMultipleGroup(t *testing.T) {
 
 func TestStaticGroup(t *testing.T) {
 	config := Config{
-		UserHeader:  "X-Remote-User",
-		GroupHeader: "X-Remote-Group",
-		Groups:      []string{"static1", "static 2"},
+		Groups: []string{"static1", "static 2"},
 	}
 
-	conn := callback{userHeader: config.UserHeader, groupHeader: config.GroupHeader, groups: config.Groups, logger: logger, pathSuffix: "/test"}
+	conn, _ := config.Open("test", logger)
+	callback := conn.(*callback)
 
 	req, err := http.NewRequest("GET", "/", nil)
 	expectNil(t, err)
@@ -108,7 +158,7 @@ func TestStaticGroup(t *testing.T) {
 		"X-Remote-Group": {testGroup1 + ", " + testGroup2 + ", " + testGroup3 + ", " + testGroup4},
 	}
 
-	ident, err := conn.HandleCallback(connector.Scopes{OfflineAccess: true, Groups: true}, req)
+	ident, err := callback.HandleCallback(connector.Scopes{OfflineAccess: true, Groups: true}, nil, req)
 	expectNil(t, err)
 
 	expectEquals(t, ident.UserID, testEmail)
diff --git a/connector/bitbucketcloud/bitbucketcloud.go b/connector/bitbucketcloud/bitbucketcloud.go
index 27eafb5299..dcf104a34a 100644
--- a/connector/bitbucketcloud/bitbucketcloud.go
+++ b/connector/bitbucketcloud/bitbucketcloud.go
@@ -7,6 +7,7 @@ import (
 	"errors"
 	"fmt"
 	"io"
+	"log/slog"
 	"net/http"
 	"sync"
 	"time"
@@ -16,42 +17,48 @@ import (
 
 	"github.com/dexidp/dex/connector"
 	"github.com/dexidp/dex/pkg/groups"
-	"github.com/dexidp/dex/pkg/log"
 )
 
 const (
 	apiURL = "https://api.bitbucket.org/2.0"
-	// Switch to API v2.0 when the Atlassian platform services are fully available in Bitbucket
-	legacyAPIURL = "https://api.bitbucket.org/1.0"
 	// Bitbucket requires this scope to access '/user' API endpoints.
 	scopeAccount = "account"
 	// Bitbucket requires this scope to access '/user/emails' API endpoints.
 	scopeEmail = "email"
-	// Bitbucket requires this scope to access '/teams' API endpoints
-	// which are used when a client includes the 'groups' scope.
-	scopeTeams = "team"
 )
 
 // Config holds configuration options for Bitbucket logins.
 type Config struct {
-	ClientID          string   `json:"clientID"`
-	ClientSecret      string   `json:"clientSecret"`
-	RedirectURI       string   `json:"redirectURI"`
-	Teams             []string `json:"teams"`
-	IncludeTeamGroups bool     `json:"includeTeamGroups,omitempty"`
+	ClientID     string   `json:"clientID"`
+	ClientSecret string   `json:"clientSecret"`
+	RedirectURI  string   `json:"redirectURI"`
+	Teams        []string `json:"teams"`
+
+	// Deprecated: The Bitbucket 1.0 API (/1.0/groups/{team}) that this feature
+	// relied on has been removed by Atlassian. This option is ignored; if set,
+	// a warning is logged at startup. Consider using getWorkspacePermissions.
+	IncludeTeamGroups bool `json:"includeTeamGroups,omitempty"`
+
+	// When enabled, appends workspace permission suffixes (e.g. "workspace:owner",
+	// "workspace:member") to the groups claim, similar to GitLab's getGroupsPermission.
+	GetWorkspacePermissions bool `json:"getWorkspacePermissions,omitempty"`
 }
 
 // Open returns a strategy for logging in through Bitbucket.
-func (c *Config) Open(_ string, logger log.Logger) (connector.Connector, error) {
+func (c *Config) Open(id string, logger *slog.Logger) (connector.Connector, error) {
+	if c.IncludeTeamGroups {
+		logger.Warn("bitbucket: includeTeamGroups is deprecated and has no effect; " +
+			"the Bitbucket 1.0 API it relied on has been removed by Atlassian")
+	}
+
 	b := bitbucketConnector{
-		redirectURI:       c.RedirectURI,
-		teams:             c.Teams,
-		clientID:          c.ClientID,
-		clientSecret:      c.ClientSecret,
-		includeTeamGroups: c.IncludeTeamGroups,
-		apiURL:            apiURL,
-		legacyAPIURL:      legacyAPIURL,
-		logger:            logger,
+		redirectURI:             c.RedirectURI,
+		teams:                   c.Teams,
+		clientID:                c.ClientID,
+		clientSecret:            c.ClientSecret,
+		getWorkspacePermissions: c.GetWorkspacePermissions,
+		apiURL:                  apiURL,
+		logger:                  logger.With(slog.Group("connector", "type", "bitbucketcloud", "id", id)),
 	}
 
 	return &b, nil
@@ -69,31 +76,26 @@ var (
 )
 
 type bitbucketConnector struct {
-	redirectURI  string
-	teams        []string
-	clientID     string
-	clientSecret string
-	logger       log.Logger
-	apiURL       string
-	legacyAPIURL string
+	redirectURI             string
+	teams                   []string
+	clientID                string
+	clientSecret            string
+	logger                  *slog.Logger
+	apiURL                  string
+	getWorkspacePermissions bool
 
 	// the following are used only for tests
 	hostName   string
 	httpClient *http.Client
-
-	includeTeamGroups bool
 }
 
-// groupsRequired returns whether dex requires Bitbucket's 'team' scope.
+// groupsRequired returns whether dex needs to fetch Bitbucket workspace membership.
 func (b *bitbucketConnector) groupsRequired(groupScope bool) bool {
 	return len(b.teams) > 0 || groupScope
 }
 
 func (b *bitbucketConnector) oauth2Config(scopes connector.Scopes) *oauth2.Config {
 	bitbucketScopes := []string{scopeAccount, scopeEmail}
-	if b.groupsRequired(scopes.Groups) {
-		bitbucketScopes = append(bitbucketScopes, scopeTeams)
-	}
 
 	endpoint := bitbucket.Endpoint
 	if b.hostName != "" {
@@ -111,12 +113,12 @@ func (b *bitbucketConnector) oauth2Config(scopes connector.Scopes) *oauth2.Confi
 	}
 }
 
-func (b *bitbucketConnector) LoginURL(scopes connector.Scopes, callbackURL, state string) (string, error) {
+func (b *bitbucketConnector) LoginURL(scopes connector.Scopes, callbackURL, state string) (string, []byte, error) {
 	if b.redirectURI != callbackURL {
-		return "", fmt.Errorf("expected callback URL %q did not match the URL in the config %q", callbackURL, b.redirectURI)
+		return "", nil, fmt.Errorf("expected callback URL %q did not match the URL in the config %q", callbackURL, b.redirectURI)
 	}
 
-	return b.oauth2Config(scopes).AuthCodeURL(state), nil
+	return b.oauth2Config(scopes).AuthCodeURL(state), nil, nil
 }
 
 type oauth2Error struct {
@@ -131,7 +133,7 @@ func (e *oauth2Error) Error() string {
 	return e.error + ": " + e.errorDescription
 }
 
-func (b *bitbucketConnector) HandleCallback(s connector.Scopes, r *http.Request) (identity connector.Identity, err error) {
+func (b *bitbucketConnector) HandleCallback(s connector.Scopes, connData []byte, r *http.Request) (identity connector.Identity, err error) {
 	q := r.URL.Query()
 	if errType := q.Get("error"); errType != "" {
 		return identity, &oauth2Error{errType, q.Get("error_description")}
@@ -344,6 +346,7 @@ func (b *bitbucketConnector) userEmail(ctx context.Context, client *http.Client)
 		if response.Next == nil {
 			break
 		}
+		apiURL = *response.Next
 	}
 
 	return "", errors.New("bitbucket: user has no confirmed, primary email")
@@ -369,29 +372,33 @@ func (b *bitbucketConnector) getGroups(ctx context.Context, client *http.Client,
 	return nil, nil
 }
 
-type workspaceSlug struct {
+type workspaceRef struct {
 	Slug string `json:"slug"`
 }
 
-type workspace struct {
-	Workspace workspaceSlug `json:"workspace"`
+type workspaceAccess struct {
+	Workspace workspaceRef `json:"workspace"`
 }
 
-type userWorkspacesResponse struct {
+type workspacesResponse struct {
 	pagedResponse
-	Values []workspace `json:"values"`
+	Values []workspaceAccess `json:"values"`
+}
+
+type workspacePermission struct {
+	Permission string `json:"permission"`
 }
 
 func (b *bitbucketConnector) userWorkspaces(ctx context.Context, client *http.Client) ([]string, error) {
 	var teams []string
-	apiURL := b.apiURL + "/user/permissions/workspaces"
+	apiURL := b.apiURL + "/user/workspaces"
 
 	for {
-		// https://developer.atlassian.com/cloud/bitbucket/rest/api-group-workspaces/#api-workspaces-get
-		var response userWorkspacesResponse
+		// https://developer.atlassian.com/cloud/bitbucket/rest/api-group-user/#api-user-workspaces-get
+		var response workspacesResponse
 
 		if err := get(ctx, client, apiURL, &response); err != nil {
-			return nil, fmt.Errorf("bitbucket: get user teams: %v", err)
+			return nil, fmt.Errorf("bitbucket: get user workspaces: %v", err)
 		}
 
 		for _, value := range response.Values {
@@ -401,39 +408,33 @@ func (b *bitbucketConnector) userWorkspaces(ctx context.Context, client *http.Cl
 		if response.Next == nil {
 			break
 		}
+		apiURL = *response.Next
 	}
 
-	if b.includeTeamGroups {
+	if b.getWorkspacePermissions {
+		var permissionGroups []string
 		for _, team := range teams {
-			teamGroups, err := b.userTeamGroups(ctx, client, team)
+			perm, err := b.userWorkspacePermission(ctx, client, team)
 			if err != nil {
-				return nil, fmt.Errorf("bitbucket: %v", err)
+				b.logger.Warn("bitbucket: failed to get permission for workspace, skipping permission suffix",
+					"workspace", team, "error", err)
+				continue
 			}
-			teams = append(teams, teamGroups...)
+			permissionGroups = append(permissionGroups, team+":"+perm)
 		}
+		teams = append(teams, permissionGroups...)
 	}
 
 	return teams, nil
 }
 
-type group struct {
-	Slug string `json:"slug"`
-}
-
-func (b *bitbucketConnector) userTeamGroups(ctx context.Context, client *http.Client, teamName string) ([]string, error) {
-	apiURL := b.legacyAPIURL + "/groups/" + teamName
-
-	var response []group
+func (b *bitbucketConnector) userWorkspacePermission(ctx context.Context, client *http.Client, workspaceSlug string) (string, error) {
+	apiURL := b.apiURL + "/user/workspaces/" + workspaceSlug + "/permission"
+	var response workspacePermission
 	if err := get(ctx, client, apiURL, &response); err != nil {
-		return nil, fmt.Errorf("get user team %q groups: %v", teamName, err)
+		return "", fmt.Errorf("get workspace %q permission: %v", workspaceSlug, err)
 	}
-
-	teamGroups := make([]string, 0, len(response))
-	for _, group := range response {
-		teamGroups = append(teamGroups, teamName+"/"+group.Slug)
-	}
-
-	return teamGroups, nil
+	return response.Permission, nil
 }
 
 // get creates a "GET `apiURL`" request with context, sends the request using
diff --git a/connector/bitbucketcloud/bitbucketcloud_test.go b/connector/bitbucketcloud/bitbucketcloud_test.go
index 9545ff09c5..1ae1286fb6 100644
--- a/connector/bitbucketcloud/bitbucketcloud_test.go
+++ b/connector/bitbucketcloud/bitbucketcloud_test.go
@@ -1,40 +1,40 @@
 package bitbucketcloud
 
 import (
+	"bytes"
 	"context"
 	"crypto/tls"
 	"encoding/json"
+	"log/slog"
 	"net/http"
 	"net/http/httptest"
 	"net/url"
 	"reflect"
+	"strings"
 	"testing"
 
 	"github.com/dexidp/dex/connector"
 )
 
 func TestUserGroups(t *testing.T) {
-	teamsResponse := userWorkspacesResponse{
+	workspacesResponse := workspacesResponse{
 		pagedResponse: pagedResponse{
 			Size:    3,
 			Page:    1,
 			PageLen: 10,
 		},
-		Values: []workspace{
-			{Workspace: workspaceSlug{Slug: "team-1"}},
-			{Workspace: workspaceSlug{Slug: "team-2"}},
-			{Workspace: workspaceSlug{Slug: "team-3"}},
+		Values: []workspaceAccess{
+			{Workspace: workspaceRef{Slug: "team-1"}},
+			{Workspace: workspaceRef{Slug: "team-2"}},
+			{Workspace: workspaceRef{Slug: "team-3"}},
 		},
 	}
 
 	s := newTestServer(map[string]interface{}{
-		"/user/permissions/workspaces": teamsResponse,
-		"/groups/team-1":               []group{{Slug: "administrators"}, {Slug: "members"}},
-		"/groups/team-2":               []group{{Slug: "everyone"}},
-		"/groups/team-3":               []group{},
+		"/user/workspaces": workspacesResponse,
 	})
 
-	connector := bitbucketConnector{apiURL: s.URL, legacyAPIURL: s.URL}
+	connector := bitbucketConnector{apiURL: s.URL}
 	groups, err := connector.userWorkspaces(context.Background(), newClient())
 
 	expectNil(t, err)
@@ -44,25 +44,12 @@ func TestUserGroups(t *testing.T) {
 		"team-3",
 	})
 
-	connector.includeTeamGroups = true
-	groups, err = connector.userWorkspaces(context.Background(), newClient())
-
-	expectNil(t, err)
-	expectEquals(t, groups, []string{
-		"team-1",
-		"team-2",
-		"team-3",
-		"team-1/administrators",
-		"team-1/members",
-		"team-2/everyone",
-	})
-
 	s.Close()
 }
 
 func TestUserWithoutTeams(t *testing.T) {
 	s := newTestServer(map[string]interface{}{
-		"/user/permissions/workspaces": userWorkspacesResponse{},
+		"/user/workspaces": workspacesResponse{},
 	})
 
 	connector := bitbucketConnector{apiURL: s.URL}
@@ -74,6 +61,58 @@ func TestUserWithoutTeams(t *testing.T) {
 	s.Close()
 }
 
+func TestUserGroupsWithPermissions(t *testing.T) {
+	workspacesResp := workspacesResponse{
+		pagedResponse: pagedResponse{
+			Size:    2,
+			Page:    1,
+			PageLen: 10,
+		},
+		Values: []workspaceAccess{
+			{Workspace: workspaceRef{Slug: "team-1"}},
+			{Workspace: workspaceRef{Slug: "team-2"}},
+		},
+	}
+
+	s := newTestServer(map[string]interface{}{
+		"/user/workspaces":                   workspacesResp,
+		"/user/workspaces/team-1/permission": workspacePermission{Permission: "owner"},
+		"/user/workspaces/team-2/permission": workspacePermission{Permission: "member"},
+	})
+	defer s.Close()
+
+	logger := slog.New(slog.NewTextHandler(&bytes.Buffer{}, nil))
+	c := bitbucketConnector{apiURL: s.URL, getWorkspacePermissions: true, logger: logger}
+	groups, err := c.userWorkspaces(context.Background(), newClient())
+
+	expectNil(t, err)
+	expectEquals(t, groups, []string{
+		"team-1",
+		"team-2",
+		"team-1:owner",
+		"team-2:member",
+	})
+}
+
+func TestDeprecatedIncludeTeamGroups(t *testing.T) {
+	var buf bytes.Buffer
+	logger := slog.New(slog.NewTextHandler(&buf, nil))
+
+	cfg := Config{
+		ClientID:          "id",
+		ClientSecret:      "secret",
+		RedirectURI:       "http://localhost",
+		IncludeTeamGroups: true,
+	}
+
+	_, err := cfg.Open("test", logger)
+	expectNil(t, err)
+
+	if !strings.Contains(buf.String(), "includeTeamGroups is deprecated") {
+		t.Fatal("expected deprecation warning for includeTeamGroups")
+	}
+}
+
 func TestUsernameIncludedInFederatedIdentity(t *testing.T) {
 	s := newTestServer(map[string]interface{}{
 		"/user": user{Username: "some-login"},
@@ -102,7 +141,7 @@ func TestUsernameIncludedInFederatedIdentity(t *testing.T) {
 	expectNil(t, err)
 
 	bitbucketConnector := bitbucketConnector{apiURL: s.URL, hostName: hostURL.Host, httpClient: newClient()}
-	identity, err := bitbucketConnector.HandleCallback(connector.Scopes{}, req)
+	identity, err := bitbucketConnector.HandleCallback(connector.Scopes{}, nil, req)
 
 	expectNil(t, err)
 	expectEquals(t, identity.Username, "some-login")
diff --git a/connector/connector.go b/connector/connector.go
index aab994b468..f95c62e4a2 100644
--- a/connector/connector.go
+++ b/connector/connector.go
@@ -3,9 +3,22 @@ package connector
 
 import (
 	"context"
+	"fmt"
 	"net/http"
 )
 
+// UserNotInRequiredGroupsError is returned by a connector when a user
+// successfully authenticates but is not a member of any of the required groups.
+// The server will respond with HTTP 403 Forbidden instead of 500.
+type UserNotInRequiredGroupsError struct {
+	UserID string
+	Groups []string
+}
+
+func (e *UserNotInRequiredGroupsError) Error() string {
+	return fmt.Sprintf("user %q is not in any of the required groups %v", e.UserID, e.Groups)
+}
+
 // Connector is a mechanism for federating login to a remote identity service.
 //
 // Implementations are expected to implement either the PasswordConnector or
@@ -63,14 +76,15 @@ type CallbackConnector interface {
 	// requested if one has already been issues. There's no good general answer
 	// for these kind of restrictions, and may require this package to become more
 	// aware of the global set of user/connector interactions.
-	LoginURL(s Scopes, callbackURL, state string) (string, error)
+	LoginURL(s Scopes, callbackURL, state string) (string, []byte, error)
 
 	// Handle the callback to the server and return an identity.
-	HandleCallback(s Scopes, r *http.Request) (identity Identity, err error)
+	HandleCallback(s Scopes, connData []byte, r *http.Request) (identity Identity, err error)
 }
 
 // SAMLConnector represents SAML connectors which implement the HTTP POST binding.
-//  RelayState is handled by the server.
+//
+//	RelayState is handled by the server.
 //
 // See: https://docs.oasis-open.org/security/saml/v2.0/saml-bindings-2.0-os.pdf
 // "3.5 HTTP POST Binding"
@@ -98,3 +112,26 @@ type RefreshConnector interface {
 	// changes since the token was last refreshed.
 	Refresh(ctx context.Context, s Scopes, identity Identity) (Identity, error)
 }
+
+type TokenIdentityConnector interface {
+	TokenIdentity(ctx context.Context, subjectTokenType, subjectToken string) (Identity, error)
+}
+
+// LogoutCallbackConnector is a connector that can initiate upstream logout and
+// optionally validate the upstream provider's logout response.
+// Connectors that implement this interface support RP-Initiated Logout by
+// returning a URL that Dex should redirect the user to in order to terminate
+// the upstream session.
+type LogoutCallbackConnector interface {
+	// LogoutURL returns the upstream provider's logout URL.
+	// postLogoutRedirectURI is the URL the upstream provider should redirect back to after logout.
+	// Returns the upstream logout URL or empty string if upstream logout is not available.
+	LogoutURL(ctx context.Context, postLogoutRedirectURI string) (string, error)
+
+	// HandleLogoutCallback validates the upstream provider's logout response
+	// received in the callback request. For example, SAML connectors should
+	// verify the LogoutResponse signature and status code here.
+	// Connectors that don't receive a structured response (e.g. OIDC) should
+	// return nil.
+	HandleLogoutCallback(ctx context.Context, r *http.Request) error
+}
diff --git a/connector/gitea/gitea.go b/connector/gitea/gitea.go
index 6b02099414..059c861705 100644
--- a/connector/gitea/gitea.go
+++ b/connector/gitea/gitea.go
@@ -7,6 +7,7 @@ import (
 	"errors"
 	"fmt"
 	"io"
+	"log/slog"
 	"net/http"
 	"strconv"
 	"sync"
@@ -15,7 +16,6 @@ import (
 	"golang.org/x/oauth2"
 
 	"github.com/dexidp/dex/connector"
-	"github.com/dexidp/dex/pkg/log"
 )
 
 // Config holds configuration options for gitea logins.
@@ -51,7 +51,7 @@ type giteaUser struct {
 }
 
 // Open returns a strategy for logging in through Gitea
-func (c *Config) Open(id string, logger log.Logger) (connector.Connector, error) {
+func (c *Config) Open(id string, logger *slog.Logger) (connector.Connector, error) {
 	if c.BaseURL == "" {
 		c.BaseURL = "https://gitea.com"
 	}
@@ -61,7 +61,7 @@ func (c *Config) Open(id string, logger log.Logger) (connector.Connector, error)
 		orgs:          c.Orgs,
 		clientID:      c.ClientID,
 		clientSecret:  c.ClientSecret,
-		logger:        logger,
+		logger:        logger.With(slog.Group("connector", "type", "gitea", "id", id)),
 		loadAllGroups: c.LoadAllGroups,
 		useLoginAsID:  c.UseLoginAsID,
 	}, nil
@@ -84,7 +84,7 @@ type giteaConnector struct {
 	orgs         []Org
 	clientID     string
 	clientSecret string
-	logger       log.Logger
+	logger       *slog.Logger
 	httpClient   *http.Client
 	// if set to true and no orgs are configured then connector loads all user claims (all orgs and team)
 	loadAllGroups bool
@@ -102,11 +102,11 @@ func (c *giteaConnector) oauth2Config(_ connector.Scopes) *oauth2.Config {
 	}
 }
 
-func (c *giteaConnector) LoginURL(scopes connector.Scopes, callbackURL, state string) (string, error) {
+func (c *giteaConnector) LoginURL(scopes connector.Scopes, callbackURL, state string) (string, []byte, error) {
 	if c.redirectURI != callbackURL {
-		return "", fmt.Errorf("expected callback URL %q did not match the URL in the config %q", c.redirectURI, callbackURL)
+		return "", nil, fmt.Errorf("expected callback URL %q did not match the URL in the config %q", c.redirectURI, callbackURL)
 	}
-	return c.oauth2Config(scopes).AuthCodeURL(state), nil
+	return c.oauth2Config(scopes).AuthCodeURL(state), nil, nil
 }
 
 type oauth2Error struct {
@@ -121,7 +121,7 @@ func (e *oauth2Error) Error() string {
 	return e.error + ": " + e.errorDescription
 }
 
-func (c *giteaConnector) HandleCallback(s connector.Scopes, r *http.Request) (identity connector.Identity, err error) {
+func (c *giteaConnector) HandleCallback(s connector.Scopes, connData []byte, r *http.Request) (identity connector.Identity, err error) {
 	q := r.URL.Query()
 	if errType := q.Get("error"); errType != "" {
 		return identity, &oauth2Error{errType, q.Get("error_description")}
diff --git a/connector/gitea/gitea_test.go b/connector/gitea/gitea_test.go
index a71d79956e..4fe7768901 100644
--- a/connector/gitea/gitea_test.go
+++ b/connector/gitea/gitea_test.go
@@ -30,14 +30,14 @@ func TestUsernameIncludedInFederatedIdentity(t *testing.T) {
 	expectNil(t, err)
 
 	c := giteaConnector{baseURL: s.URL, httpClient: newClient()}
-	identity, err := c.HandleCallback(connector.Scopes{}, req)
+	identity, err := c.HandleCallback(connector.Scopes{}, nil, req)
 
 	expectNil(t, err)
 	expectEquals(t, identity.Username, "some@email.com")
 	expectEquals(t, identity.UserID, "12345678")
 
 	c = giteaConnector{baseURL: s.URL, httpClient: newClient()}
-	identity, err = c.HandleCallback(connector.Scopes{}, req)
+	identity, err = c.HandleCallback(connector.Scopes{}, nil, req)
 
 	expectNil(t, err)
 	expectEquals(t, identity.Username, "some@email.com")
diff --git a/connector/github/github.go b/connector/github/github.go
index ef8d418fa8..a9672fb532 100644
--- a/connector/github/github.go
+++ b/connector/github/github.go
@@ -3,18 +3,16 @@ package github
 
 import (
 	"context"
-	"crypto/tls"
-	"crypto/x509"
 	"encoding/json"
 	"errors"
 	"fmt"
 	"io"
-	"net"
+	"log/slog"
 	"net/http"
-	"os"
 	"regexp"
 	"strconv"
 	"strings"
+	"sync"
 	"time"
 
 	"golang.org/x/oauth2"
@@ -22,7 +20,7 @@ import (
 
 	"github.com/dexidp/dex/connector"
 	groups_pkg "github.com/dexidp/dex/pkg/groups"
-	"github.com/dexidp/dex/pkg/log"
+	"github.com/dexidp/dex/pkg/httpclient"
 )
 
 const (
@@ -32,6 +30,8 @@ const (
 	// GitHub requires this scope to access '/user/teams' and '/orgs' API endpoints
 	// which are used when a client includes the 'groups' scope.
 	scopeOrgs = "read:org"
+	// githubAPIVersion pins the GitHub REST API version used in requests.
+	githubAPIVersion = "2022-11-28"
 )
 
 // Pagination URL patterns
@@ -43,16 +43,17 @@ var (
 
 // Config holds configuration options for github logins.
 type Config struct {
-	ClientID      string `json:"clientID"`
-	ClientSecret  string `json:"clientSecret"`
-	RedirectURI   string `json:"redirectURI"`
-	Org           string `json:"org"`
-	Orgs          []Org  `json:"orgs"`
-	HostName      string `json:"hostName"`
-	RootCA        string `json:"rootCA"`
-	TeamNameField string `json:"teamNameField"`
-	LoadAllGroups bool   `json:"loadAllGroups"`
-	UseLoginAsID  bool   `json:"useLoginAsID"`
+	ClientID             string `json:"clientID"`
+	ClientSecret         string `json:"clientSecret"`
+	RedirectURI          string `json:"redirectURI"`
+	Org                  string `json:"org"`
+	Orgs                 []Org  `json:"orgs"`
+	HostName             string `json:"hostName"`
+	RootCA               string `json:"rootCA"`
+	TeamNameField        string `json:"teamNameField"`
+	LoadAllGroups        bool   `json:"loadAllGroups"`
+	UseLoginAsID         bool   `json:"useLoginAsID"`
+	PreferredEmailDomain string `json:"preferredEmailDomain"`
 }
 
 // Org holds org-team filters, in which teams are optional.
@@ -69,7 +70,7 @@ type Org struct {
 }
 
 // Open returns a strategy for logging in through GitHub.
-func (c *Config) Open(id string, logger log.Logger) (connector.Connector, error) {
+func (c *Config) Open(id string, logger *slog.Logger) (connector.Connector, error) {
 	if c.Org != "" {
 		// Return error if both 'org' and 'orgs' fields are used.
 		if len(c.Orgs) > 0 {
@@ -79,14 +80,15 @@ func (c *Config) Open(id string, logger log.Logger) (connector.Connector, error)
 	}
 
 	g := githubConnector{
-		redirectURI:  c.RedirectURI,
-		org:          c.Org,
-		orgs:         c.Orgs,
-		clientID:     c.ClientID,
-		clientSecret: c.ClientSecret,
-		apiURL:       apiURL,
-		logger:       logger,
-		useLoginAsID: c.UseLoginAsID,
+		redirectURI:          c.RedirectURI,
+		org:                  c.Org,
+		orgs:                 c.Orgs,
+		clientID:             c.ClientID,
+		clientSecret:         c.ClientSecret,
+		apiURL:               apiURL,
+		logger:               logger.With(slog.Group("connector", "type", "github", "id", id)),
+		useLoginAsID:         c.UseLoginAsID,
+		preferredEmailDomain: c.PreferredEmailDomain,
 	}
 
 	if c.HostName != "" {
@@ -106,7 +108,7 @@ func (c *Config) Open(id string, logger log.Logger) (connector.Connector, error)
 		g.rootCA = c.RootCA
 
 		var err error
-		if g.httpClient, err = newHTTPClient(g.rootCA); err != nil {
+		if g.httpClient, err = httpclient.NewHTTPClient([]string{g.rootCA}, false); err != nil {
 			return nil, fmt.Errorf("failed to create HTTP client: %v", err)
 		}
 	}
@@ -119,12 +121,21 @@ func (c *Config) Open(id string, logger log.Logger) (connector.Connector, error)
 		return nil, fmt.Errorf("invalid connector config: unsupported team name field value `%s`", c.TeamNameField)
 	}
 
+	if c.PreferredEmailDomain != "" {
+		if strings.HasSuffix(c.PreferredEmailDomain, "*") {
+			return nil, errors.New("invalid PreferredEmailDomain: glob pattern cannot end with \"*\"")
+		}
+	}
+
 	return &g, nil
 }
 
 type connectorData struct {
-	// GitHub's OAuth2 tokens never expire. We don't need a refresh token.
-	AccessToken string `json:"accessToken"`
+	// GitHub OAuth Apps return long-lived access tokens. GitHub Apps can return
+	// expiring user access tokens with refresh tokens.
+	AccessToken  string    `json:"accessToken"`
+	RefreshToken string    `json:"refreshToken,omitempty"`
+	Expiry       time.Time `json:"expiry,omitempty"`
 }
 
 var (
@@ -138,7 +149,7 @@ type githubConnector struct {
 	orgs         []Org
 	clientID     string
 	clientSecret string
-	logger       log.Logger
+	logger       *slog.Logger
 	// apiURL defaults to "https://api.github.com"
 	apiURL string
 	// hostName of the GitHub enterprise account.
@@ -153,6 +164,8 @@ type githubConnector struct {
 	loadAllGroups bool
 	// if set to true will use the user's handle rather than their numeric id as the ID
 	useLoginAsID bool
+	// the domain to be preferred among the user's emails. e.g. "github.com"
+	preferredEmailDomain string
 }
 
 // groupsRequired returns whether dex requires GitHub's 'read:org' scope. Dex
@@ -188,12 +201,12 @@ func (c *githubConnector) oauth2Config(scopes connector.Scopes) *oauth2.Config {
 	}
 }
 
-func (c *githubConnector) LoginURL(scopes connector.Scopes, callbackURL, state string) (string, error) {
+func (c *githubConnector) LoginURL(scopes connector.Scopes, callbackURL, state string) (string, []byte, error) {
 	if c.redirectURI != callbackURL {
-		return "", fmt.Errorf("expected callback URL %q did not match the URL in the config %q", callbackURL, c.redirectURI)
+		return "", nil, fmt.Errorf("expected callback URL %q did not match the URL in the config %q", callbackURL, c.redirectURI)
 	}
 
-	return c.oauth2Config(scopes).AuthCodeURL(state), nil
+	return c.oauth2Config(scopes).AuthCodeURL(state), nil, nil
 }
 
 type oauth2Error struct {
@@ -208,35 +221,7 @@ func (e *oauth2Error) Error() string {
 	return e.error + ": " + e.errorDescription
 }
 
-// newHTTPClient returns a new HTTP client that trusts the custom declared rootCA cert.
-func newHTTPClient(rootCA string) (*http.Client, error) {
-	tlsConfig := tls.Config{RootCAs: x509.NewCertPool()}
-	rootCABytes, err := os.ReadFile(rootCA)
-	if err != nil {
-		return nil, fmt.Errorf("failed to read root-ca: %v", err)
-	}
-	if !tlsConfig.RootCAs.AppendCertsFromPEM(rootCABytes) {
-		return nil, fmt.Errorf("no certs found in root CA file %q", rootCA)
-	}
-
-	return &http.Client{
-		Transport: &http.Transport{
-			TLSClientConfig: &tlsConfig,
-			Proxy:           http.ProxyFromEnvironment,
-			DialContext: (&net.Dialer{
-				Timeout:   30 * time.Second,
-				KeepAlive: 30 * time.Second,
-				DualStack: true,
-			}).DialContext,
-			MaxIdleConns:          100,
-			IdleConnTimeout:       90 * time.Second,
-			TLSHandshakeTimeout:   10 * time.Second,
-			ExpectContinueTimeout: 1 * time.Second,
-		},
-	}, nil
-}
-
-func (c *githubConnector) HandleCallback(s connector.Scopes, r *http.Request) (identity connector.Identity, err error) {
+func (c *githubConnector) HandleCallback(s connector.Scopes, connData []byte, r *http.Request) (identity connector.Identity, err error) {
 	q := r.URL.Query()
 	if errType := q.Get("error"); errType != "" {
 		return identity, &oauth2Error{errType, q.Get("error_description")}
@@ -288,7 +273,14 @@ func (c *githubConnector) HandleCallback(s connector.Scopes, r *http.Request) (i
 	}
 
 	if s.OfflineAccess {
-		data := connectorData{AccessToken: token.AccessToken}
+		data := connectorData{
+			AccessToken:  token.AccessToken,
+			RefreshToken: token.RefreshToken,
+			Expiry:       token.Expiry,
+		}
+		if token.RefreshToken != "" && c.logger != nil {
+			c.logger.DebugContext(ctx, "github: received upstream refresh token", "access_token_expiry", token.Expiry)
+		}
 		connData, err := json.Marshal(data)
 		if err != nil {
 			return identity, fmt.Errorf("marshal connector data: %v", err)
@@ -299,6 +291,34 @@ func (c *githubConnector) HandleCallback(s connector.Scopes, r *http.Request) (i
 	return identity, nil
 }
 
+// Refreshing tokens
+// https://github.com/golang/oauth2/issues/84#issuecomment-332860871
+type tokenNotifyFunc func(*oauth2.Token) error
+
+// notifyRefreshTokenSource is essentially `oauth2.ReuseTokenSource` with `TokenNotifyFunc` added.
+type notifyRefreshTokenSource struct {
+	new oauth2.TokenSource
+	mu  sync.Mutex // guards t
+	t   *oauth2.Token
+	f   tokenNotifyFunc // called when token refreshed so new refresh token can be persisted
+}
+
+// Token returns the current token if it's still valid, else will
+// refresh the current token and return the new one.
+func (s *notifyRefreshTokenSource) Token() (*oauth2.Token, error) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	if s.t.Valid() {
+		return s.t, nil
+	}
+	t, err := s.new.Token()
+	if err != nil {
+		return nil, err
+	}
+	s.t = t
+	return t, s.f(t)
+}
+
 func (c *githubConnector) Refresh(ctx context.Context, s connector.Scopes, identity connector.Identity) (connector.Identity, error) {
 	if len(identity.ConnectorData) == 0 {
 		return identity, errors.New("no upstream access token found")
@@ -309,7 +329,52 @@ func (c *githubConnector) Refresh(ctx context.Context, s connector.Scopes, ident
 		return identity, fmt.Errorf("github: unmarshal access token: %v", err)
 	}
 
-	client := c.oauth2Config(s).Client(ctx, &oauth2.Token{AccessToken: data.AccessToken})
+	if data.AccessToken == "" && data.RefreshToken == "" {
+		return identity, errors.New("no upstream access token found")
+	}
+
+	oauth2Config := c.oauth2Config(s)
+	if c.httpClient != nil {
+		ctx = context.WithValue(ctx, oauth2.HTTPClient, c.httpClient)
+	}
+
+	tok := &oauth2.Token{
+		AccessToken:  data.AccessToken,
+		RefreshToken: data.RefreshToken,
+		Expiry:       data.Expiry,
+	}
+	oldRefreshToken := data.RefreshToken
+	if oldRefreshToken != "" && c.logger != nil {
+		c.logger.DebugContext(ctx, "github: upstream refresh token available",
+			"will_refresh_access_token", !tok.Valid(),
+			"access_token_expiry", data.Expiry,
+		)
+	}
+
+	client := oauth2.NewClient(ctx, &notifyRefreshTokenSource{
+		new: oauth2Config.TokenSource(ctx, tok),
+		t:   tok,
+		f: func(tok *oauth2.Token) error {
+			if c.logger != nil {
+				c.logger.DebugContext(ctx, "github: refreshed upstream access token with refresh token",
+					"access_token_expiry", tok.Expiry,
+					"refresh_token_rotated", oldRefreshToken != "" && tok.RefreshToken != "" && tok.RefreshToken != oldRefreshToken,
+				)
+			}
+
+			data := connectorData{
+				AccessToken:  tok.AccessToken,
+				RefreshToken: tok.RefreshToken,
+				Expiry:       tok.Expiry,
+			}
+			connData, err := json.Marshal(data)
+			if err != nil {
+				return fmt.Errorf("github: marshal connector data: %v", err)
+			}
+			identity.ConnectorData = connData
+			return nil
+		},
+	})
 	user, err := c.user(ctx, client)
 	if err != nil {
 		return identity, fmt.Errorf("github: get user: %v", err)
@@ -356,9 +421,11 @@ func formatTeamName(org string, team string) string {
 
 // groupsForOrgs enforces org and team constraints on user authorization
 // Cases in which user is authorized:
-// 	N orgs, no teams: user is member of at least 1 org
-// 	N orgs, M teams per org: user is member of any team from at least 1 org
-// 	N-1 orgs, M teams per org, 1 org with no teams: user is member of any team
+//
+//	N orgs, no teams: user is member of at least 1 org
+//	N orgs, M teams per org: user is member of any team from at least 1 org
+//	N-1 orgs, M teams per org, 1 org with no teams: user is member of any team
+//
 // from at least 1 org, or member of org with no teams
 func (c *githubConnector) groupsForOrgs(ctx context.Context, client *http.Client, userName string) ([]string, error) {
 	groups := make([]string, 0)
@@ -382,7 +449,7 @@ func (c *githubConnector) groupsForOrgs(ctx context.Context, client *http.Client
 		if len(org.Teams) == 0 {
 			inOrgNoTeams = true
 		} else if teams = groups_pkg.Filter(teams, org.Teams); len(teams) == 0 {
-			c.logger.Infof("github: user %q in org %q but no teams", userName, org.Name)
+			c.logger.Info("user in org but no teams", "user", userName, "org", org.Name)
 		}
 
 		for _, teamName := range teams {
@@ -482,6 +549,7 @@ func get(ctx context.Context, client *http.Client, apiURL string, v interface{})
 		return "", fmt.Errorf("github: new req: %v", err)
 	}
 	req = req.WithContext(ctx)
+	req.Header.Set("X-GitHub-Api-Version", githubAPIVersion)
 	resp, err := client.Do(req)
 	if err != nil {
 		return "", fmt.Errorf("github: get URL %v", err)
@@ -551,9 +619,10 @@ func (c *githubConnector) user(ctx context.Context, client *http.Client) (user,
 		return u, err
 	}
 
-	// Only public user emails are returned by 'GET /user'. u.Email will be empty
-	// if a users' email is private. We must retrieve private emails explicitly.
-	if u.Email == "" {
+	// Only public user emails are returned by 'GET /user'.
+	// If a user has no public email, we must retrieve private emails explicitly.
+	// If preferredEmailDomain is set, we always need to retrieve all emails.
+	if u.Email == "" || c.preferredEmailDomain != "" {
 		var err error
 		if u.Email, err = c.userEmail(ctx, client); err != nil {
 			return u, err
@@ -578,7 +647,13 @@ type userEmail struct {
 // The HTTP client is expected to be constructed by the golang.org/x/oauth2 package,
 // which inserts a bearer token as part of the request.
 func (c *githubConnector) userEmail(ctx context.Context, client *http.Client) (string, error) {
+	var (
+		primaryEmail    userEmail
+		preferredEmails []userEmail
+	)
+
 	apiURL := c.apiURL + "/user/emails"
+
 	for {
 		// https://developer.github.com/v3/users/emails/#list-email-addresses-for-a-user
 		var (
@@ -605,7 +680,17 @@ func (c *githubConnector) userEmail(ctx context.Context, client *http.Client) (s
 			}
 
 			if email.Verified && email.Primary {
-				return email.Email, nil
+				primaryEmail = email
+			}
+
+			if c.preferredEmailDomain != "" {
+				_, domainPart, ok := strings.Cut(email.Email, "@")
+				if !ok {
+					return "", errors.New("github: invalid format email is detected")
+				}
+				if email.Verified && c.isPreferredEmailDomain(domainPart) {
+					preferredEmails = append(preferredEmails, email)
+				}
 			}
 		}
 
@@ -614,7 +699,36 @@ func (c *githubConnector) userEmail(ctx context.Context, client *http.Client) (s
 		}
 	}
 
-	return "", errors.New("github: user has no verified, primary email")
+	if len(preferredEmails) > 0 {
+		return preferredEmails[0].Email, nil
+	}
+
+	if primaryEmail.Email != "" {
+		return primaryEmail.Email, nil
+	}
+
+	return "", errors.New("github: user has no verified, primary email or preferred-domain email")
+}
+
+// isPreferredEmailDomain checks the domain is matching with preferredEmailDomain.
+func (c *githubConnector) isPreferredEmailDomain(domain string) bool {
+	if domain == c.preferredEmailDomain {
+		return true
+	}
+
+	preferredDomainParts := strings.Split(c.preferredEmailDomain, ".")
+	domainParts := strings.Split(domain, ".")
+
+	if len(preferredDomainParts) != len(domainParts) {
+		return false
+	}
+
+	for i, v := range preferredDomainParts {
+		if domainParts[i] != v && v != "*" {
+			return false
+		}
+	}
+	return true
 }
 
 // userInOrg queries the GitHub API for a users' org membership.
@@ -633,6 +747,7 @@ func (c *githubConnector) userInOrg(ctx context.Context, client *http.Client, us
 		return false, fmt.Errorf("github: new req: %v", err)
 	}
 	req = req.WithContext(ctx)
+	req.Header.Set("X-GitHub-Api-Version", githubAPIVersion)
 	resp, err := client.Do(req)
 	if err != nil {
 		return false, fmt.Errorf("github: get teams: %v", err)
@@ -642,7 +757,7 @@ func (c *githubConnector) userInOrg(ctx context.Context, client *http.Client, us
 	switch resp.StatusCode {
 	case http.StatusNoContent:
 	case http.StatusFound, http.StatusNotFound:
-		c.logger.Infof("github: user %q not in org %q or application not authorized to read org data", userName, orgName)
+		c.logger.Info("user not in org or application not authorized to read org data", "user", userName, "org", orgName)
 	default:
 		err = fmt.Errorf("github: unexpected return status: %q", resp.Status)
 	}
diff --git a/connector/github/github_test.go b/connector/github/github_test.go
index 76d7463cf6..1426c682fd 100644
--- a/connector/github/github_test.go
+++ b/connector/github/github_test.go
@@ -4,13 +4,17 @@ import (
 	"context"
 	"crypto/tls"
 	"encoding/json"
+	"errors"
 	"fmt"
+	"log/slog"
 	"net/http"
 	"net/http/httptest"
 	"net/url"
 	"reflect"
 	"strings"
+	"sync/atomic"
 	"testing"
+	"time"
 
 	"github.com/dexidp/dex/connector"
 )
@@ -150,7 +154,7 @@ func TestUsernameIncludedInFederatedIdentity(t *testing.T) {
 	expectNil(t, err)
 
 	c := githubConnector{apiURL: s.URL, hostName: hostURL.Host, httpClient: newClient()}
-	identity, err := c.HandleCallback(connector.Scopes{Groups: true}, req)
+	identity, err := c.HandleCallback(connector.Scopes{Groups: true}, nil, req)
 
 	expectNil(t, err)
 	expectEquals(t, identity.Username, "some-login")
@@ -158,7 +162,7 @@ func TestUsernameIncludedInFederatedIdentity(t *testing.T) {
 	expectEquals(t, 0, len(identity.Groups))
 
 	c = githubConnector{apiURL: s.URL, hostName: hostURL.Host, httpClient: newClient(), loadAllGroups: true}
-	identity, err = c.HandleCallback(connector.Scopes{Groups: true}, req)
+	identity, err = c.HandleCallback(connector.Scopes{Groups: true}, nil, req)
 
 	expectNil(t, err)
 	expectEquals(t, identity.Username, "some-login")
@@ -191,13 +195,455 @@ func TestLoginUsedAsIDWhenConfigured(t *testing.T) {
 	expectNil(t, err)
 
 	c := githubConnector{apiURL: s.URL, hostName: hostURL.Host, httpClient: newClient(), useLoginAsID: true}
-	identity, err := c.HandleCallback(connector.Scopes{Groups: true}, req)
+	identity, err := c.HandleCallback(connector.Scopes{Groups: true}, nil, req)
 
 	expectNil(t, err)
 	expectEquals(t, identity.UserID, "some-login")
 	expectEquals(t, identity.Username, "Joe Bloggs")
 }
 
+func TestHandleCallbackStoresRefreshToken(t *testing.T) {
+	s := newTestServer(map[string]testResponse{
+		"/user": {data: user{Login: "some-login", ID: 12345678, Name: "Joe Bloggs", Email: "some@email.com"}},
+		"/login/oauth/access_token": {data: map[string]interface{}{
+			"access_token":  "access-token",
+			"refresh_token": "refresh-token",
+			"expires_in":    28800,
+		}},
+	})
+	defer s.Close()
+
+	hostURL, err := url.Parse(s.URL)
+	expectNil(t, err)
+
+	req, err := http.NewRequest("GET", hostURL.String(), nil)
+	expectNil(t, err)
+
+	c := githubConnector{apiURL: s.URL, hostName: hostURL.Host, httpClient: newClient()}
+	identity, err := c.HandleCallback(connector.Scopes{OfflineAccess: true}, nil, req)
+	expectNil(t, err)
+
+	var data connectorData
+	if err := json.Unmarshal(identity.ConnectorData, &data); err != nil {
+		t.Fatalf("failed to unmarshal connector data: %v", err)
+	}
+	expectEquals(t, data.AccessToken, "access-token")
+	expectEquals(t, data.RefreshToken, "refresh-token")
+	if data.Expiry.IsZero() || !data.Expiry.After(time.Now()) {
+		t.Fatalf("expected future token expiry, got %v", data.Expiry)
+	}
+}
+
+func TestRefreshUsesRefreshToken(t *testing.T) {
+	var tokenRefreshCalled atomic.Bool
+	s := httptest.NewTLSServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Content-Type", "application/json")
+
+		switch r.URL.Path {
+		case "/login/oauth/access_token":
+			tokenRefreshCalled.Store(true)
+			if err := r.ParseForm(); err != nil {
+				t.Fatalf("failed to parse token refresh form: %v", err)
+			}
+			if got := r.Form.Get("grant_type"); got != "refresh_token" {
+				t.Fatalf("expected refresh_token grant type, got %q", got)
+			}
+			if got := r.Form.Get("refresh_token"); got != "old-refresh-token" {
+				t.Fatalf("expected old refresh token, got %q", got)
+			}
+			json.NewEncoder(w).Encode(map[string]interface{}{
+				"access_token":  "new-access-token",
+				"refresh_token": "new-refresh-token",
+				"expires_in":    28800,
+			})
+		case "/user":
+			if got := r.Header.Get("Authorization"); got != "Bearer new-access-token" {
+				t.Fatalf("expected refreshed access token, got %q", got)
+			}
+			json.NewEncoder(w).Encode(user{Login: "new-login", ID: 12345678, Name: "New User", Email: "new@email.com"})
+		default:
+			http.NotFound(w, r)
+		}
+	}))
+	defer s.Close()
+
+	hostURL, err := url.Parse(s.URL)
+	expectNil(t, err)
+
+	connData, err := json.Marshal(connectorData{
+		AccessToken:  "old-access-token",
+		RefreshToken: "old-refresh-token",
+		Expiry:       time.Now().Add(-time.Hour),
+	})
+	expectNil(t, err)
+
+	c := githubConnector{
+		apiURL:       s.URL,
+		hostName:     hostURL.Host,
+		httpClient:   newClient(),
+		clientID:     "client-id",
+		clientSecret: "client-secret",
+	}
+	identity, err := c.Refresh(context.Background(), connector.Scopes{OfflineAccess: true}, connector.Identity{ConnectorData: connData})
+	expectNil(t, err)
+
+	if !tokenRefreshCalled.Load() {
+		t.Fatal("expected refresh token request")
+	}
+	expectEquals(t, identity.Username, "New User")
+	expectEquals(t, identity.PreferredUsername, "new-login")
+	expectEquals(t, identity.Email, "new@email.com")
+
+	var data connectorData
+	if err := json.Unmarshal(identity.ConnectorData, &data); err != nil {
+		t.Fatalf("failed to unmarshal connector data: %v", err)
+	}
+	expectEquals(t, data.AccessToken, "new-access-token")
+	expectEquals(t, data.RefreshToken, "new-refresh-token")
+	if data.Expiry.IsZero() || !data.Expiry.After(time.Now()) {
+		t.Fatalf("expected future token expiry, got %v", data.Expiry)
+	}
+}
+
+func TestRefreshWithAccessTokenOnlyConnectorData(t *testing.T) {
+	var tokenEndpointCalled atomic.Bool
+	s := httptest.NewTLSServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Content-Type", "application/json")
+
+		switch r.URL.Path {
+		case "/login/oauth/access_token":
+			tokenEndpointCalled.Store(true)
+			http.Error(w, "unexpected token refresh", http.StatusInternalServerError)
+		case "/user":
+			if got := r.Header.Get("Authorization"); got != "Bearer old-access-token" {
+				t.Fatalf("expected old access token, got %q", got)
+			}
+			json.NewEncoder(w).Encode(user{Login: "some-login", ID: 12345678, Name: "Some User", Email: "some@email.com"})
+		default:
+			http.NotFound(w, r)
+		}
+	}))
+	defer s.Close()
+
+	hostURL, err := url.Parse(s.URL)
+	expectNil(t, err)
+
+	connData, err := json.Marshal(connectorData{AccessToken: "old-access-token"})
+	expectNil(t, err)
+
+	c := githubConnector{apiURL: s.URL, hostName: hostURL.Host, httpClient: newClient()}
+	identity, err := c.Refresh(context.Background(), connector.Scopes{}, connector.Identity{ConnectorData: connData})
+	expectNil(t, err)
+
+	if tokenEndpointCalled.Load() {
+		t.Fatal("did not expect token refresh request")
+	}
+	expectEquals(t, identity.Username, "Some User")
+	expectEquals(t, identity.PreferredUsername, "some-login")
+	expectEquals(t, identity.Email, "some@email.com")
+	expectEquals(t, identity.ConnectorData, connData)
+}
+
+func TestPreferredEmailDomainConfigured(t *testing.T) {
+	ctx := context.Background()
+	s := newTestServer(map[string]testResponse{
+		"/user": {data: user{Login: "some-login", ID: 12345678, Name: "Joe Bloggs"}},
+		"/user/emails": {
+			data: []userEmail{
+				{
+					Email:    "some@email.com",
+					Verified: true,
+					Primary:  true,
+				},
+				{
+					Email:    "another@email.com",
+					Verified: true,
+					Primary:  false,
+				},
+				{
+					Email:    "some@preferred-domain.com",
+					Verified: true,
+					Primary:  false,
+				},
+				{
+					Email:    "another@preferred-domain.com",
+					Verified: true,
+					Primary:  false,
+				},
+			},
+		},
+	})
+	defer s.Close()
+
+	hostURL, err := url.Parse(s.URL)
+	expectNil(t, err)
+
+	client := newClient()
+	c := githubConnector{apiURL: s.URL, hostName: hostURL.Host, httpClient: client, preferredEmailDomain: "preferred-domain.com"}
+
+	u, err := c.user(ctx, client)
+	expectNil(t, err)
+	expectEquals(t, u.Email, "some@preferred-domain.com")
+}
+
+func TestPreferredEmailDomainConfiguredWithGlob(t *testing.T) {
+	ctx := context.Background()
+	s := newTestServer(map[string]testResponse{
+		"/user": {data: user{Login: "some-login", ID: 12345678, Name: "Joe Bloggs"}},
+		"/user/emails": {
+			data: []userEmail{
+				{
+					Email:    "some@email.com",
+					Verified: true,
+					Primary:  true,
+				},
+				{
+					Email:    "another@email.com",
+					Verified: true,
+					Primary:  false,
+				},
+				{
+					Email:    "some@another.preferred-domain.com",
+					Verified: true,
+					Primary:  false,
+				},
+				{
+					Email:    "some@sub-domain.preferred-domain.co",
+					Verified: true,
+					Primary:  false,
+				},
+			},
+		},
+	})
+	defer s.Close()
+
+	hostURL, err := url.Parse(s.URL)
+	expectNil(t, err)
+
+	client := newClient()
+	c := githubConnector{apiURL: s.URL, hostName: hostURL.Host, httpClient: client, preferredEmailDomain: "*.preferred-domain.co"}
+
+	u, err := c.user(ctx, client)
+	expectNil(t, err)
+	expectEquals(t, u.Email, "some@sub-domain.preferred-domain.co")
+}
+
+func TestPreferredEmailDomainConfigured_UserHasNoPreferredDomainEmail(t *testing.T) {
+	ctx := context.Background()
+	s := newTestServer(map[string]testResponse{
+		"/user": {data: user{Login: "some-login", ID: 12345678, Name: "Joe Bloggs"}},
+		"/user/emails": {
+			data: []userEmail{
+				{
+					Email:    "some@email.com",
+					Verified: true,
+					Primary:  true,
+				},
+				{
+					Email:    "another@email.com",
+					Verified: true,
+					Primary:  false,
+				},
+			},
+		},
+	})
+	defer s.Close()
+
+	hostURL, err := url.Parse(s.URL)
+	expectNil(t, err)
+
+	client := newClient()
+	c := githubConnector{apiURL: s.URL, hostName: hostURL.Host, httpClient: client, preferredEmailDomain: "preferred-domain.com"}
+
+	u, err := c.user(ctx, client)
+	expectNil(t, err)
+	expectEquals(t, u.Email, "some@email.com")
+}
+
+func TestPreferredEmailDomainNotConfigured(t *testing.T) {
+	ctx := context.Background()
+	s := newTestServer(map[string]testResponse{
+		"/user": {data: user{Login: "some-login", ID: 12345678, Name: "Joe Bloggs"}},
+		"/user/emails": {
+			data: []userEmail{
+				{
+					Email:    "some@email.com",
+					Verified: true,
+					Primary:  true,
+				},
+				{
+					Email:    "another@email.com",
+					Verified: true,
+					Primary:  false,
+				},
+				{
+					Email:    "some@preferred-domain.com",
+					Verified: true,
+					Primary:  false,
+				},
+			},
+		},
+	})
+	defer s.Close()
+
+	hostURL, err := url.Parse(s.URL)
+	expectNil(t, err)
+
+	client := newClient()
+	c := githubConnector{apiURL: s.URL, hostName: hostURL.Host, httpClient: client}
+
+	u, err := c.user(ctx, client)
+	expectNil(t, err)
+	expectEquals(t, u.Email, "some@email.com")
+}
+
+func TestPreferredEmailDomainConfigured_Error_BothPrimaryAndPreferredDomainEmailNotFound(t *testing.T) {
+	ctx := context.Background()
+	s := newTestServer(map[string]testResponse{
+		"/user": {data: user{Login: "some-login", ID: 12345678, Name: "Joe Bloggs"}},
+		"/user/emails": {
+			data: []userEmail{
+				{
+					Email:    "some@email.com",
+					Verified: true,
+					Primary:  false,
+				},
+				{
+					Email:    "another@email.com",
+					Verified: true,
+					Primary:  false,
+				},
+				{
+					Email:    "some@preferred-domain.com",
+					Verified: true,
+					Primary:  false,
+				},
+			},
+		},
+	})
+	defer s.Close()
+
+	hostURL, err := url.Parse(s.URL)
+	expectNil(t, err)
+
+	client := newClient()
+	c := githubConnector{apiURL: s.URL, hostName: hostURL.Host, httpClient: client, preferredEmailDomain: "foo.bar"}
+
+	_, err = c.user(ctx, client)
+	expectNotNil(t, err, "Email not found error")
+	expectEquals(t, err.Error(), "github: user has no verified, primary email or preferred-domain email")
+}
+
+func Test_isPreferredEmailDomain(t *testing.T) {
+	client := newClient()
+	tests := []struct {
+		preferredEmailDomain string
+		email                string
+		expected             bool
+	}{
+		{
+			preferredEmailDomain: "example.com",
+			email:                "test@example.com",
+			expected:             true,
+		},
+		{
+			preferredEmailDomain: "example.com",
+			email:                "test@another.com",
+			expected:             false,
+		},
+		{
+			preferredEmailDomain: "*.example.com",
+			email:                "test@my.example.com",
+			expected:             true,
+		},
+		{
+			preferredEmailDomain: "*.example.com",
+			email:                "test@my.another.com",
+			expected:             false,
+		},
+		{
+			preferredEmailDomain: "*.example.com",
+			email:                "test@my.domain.example.com",
+			expected:             false,
+		},
+		{
+			preferredEmailDomain: "*.example.com",
+			email:                "test@sub.domain.com",
+			expected:             false,
+		},
+		{
+			preferredEmailDomain: "*.*.example.com",
+			email:                "test@sub.my.example.com",
+			expected:             true,
+		},
+		{
+			preferredEmailDomain: "*.*.example.com",
+			email:                "test@a.my.google.com",
+			expected:             false,
+		},
+	}
+	for _, test := range tests {
+		t.Run(test.preferredEmailDomain, func(t *testing.T) {
+			c := githubConnector{apiURL: "apiURL", hostName: "github.com", httpClient: client, preferredEmailDomain: test.preferredEmailDomain}
+			_, domainPart, _ := strings.Cut(test.email, "@")
+			res := c.isPreferredEmailDomain(domainPart)
+
+			expectEquals(t, res, test.expected)
+		})
+	}
+}
+
+func Test_Open_PreferredDomainConfig(t *testing.T) {
+	log := slog.New(slog.DiscardHandler)
+	tests := []struct {
+		preferredEmailDomain string
+		email                string
+		expected             error
+	}{
+		{
+			preferredEmailDomain: "example.com",
+			expected:             nil,
+		},
+		{
+			preferredEmailDomain: "*.example.com",
+			expected:             nil,
+		},
+		{
+			preferredEmailDomain: "*.*.example.com",
+			expected:             nil,
+		},
+		{
+			preferredEmailDomain: "example.*",
+			expected:             errors.New("invalid PreferredEmailDomain: glob pattern cannot end with \"*\""),
+		},
+	}
+	for _, test := range tests {
+		t.Run(test.preferredEmailDomain, func(t *testing.T) {
+			c := Config{
+				PreferredEmailDomain: test.preferredEmailDomain,
+			}
+			_, err := c.Open("id", log)
+
+			expectEquals(t, err, test.expected)
+		})
+	}
+}
+
+func TestGetSendsAPIVersionHeader(t *testing.T) {
+	var gotHeader string
+	s := httptest.NewTLSServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		gotHeader = r.Header.Get("X-GitHub-Api-Version")
+		w.Header().Add("Content-Type", "application/json")
+		json.NewEncoder(w).Encode([]org{})
+	}))
+	defer s.Close()
+
+	var result []org
+	_, err := get(context.Background(), newClient(), s.URL+"/user/orgs", &result)
+	expectNil(t, err)
+	expectEquals(t, gotHeader, githubAPIVersion)
+}
+
 func newTestServer(responses map[string]testResponse) *httptest.Server {
 	var s *httptest.Server
 	s = httptest.NewTLSServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
@@ -231,6 +677,12 @@ func expectNil(t *testing.T, a interface{}) {
 	}
 }
 
+func expectNotNil(t *testing.T, a interface{}, msg string) {
+	if a == nil {
+		t.Errorf("Expected %+v to not to be nil", msg)
+	}
+}
+
 func expectEquals(t *testing.T, a interface{}, b interface{}) {
 	if !reflect.DeepEqual(a, b) {
 		t.Errorf("Expected %+v to equal %+v", a, b)
diff --git a/connector/gitlab/gitlab.go b/connector/gitlab/gitlab.go
index f35ac35753..85783b71b9 100644
--- a/connector/gitlab/gitlab.go
+++ b/connector/gitlab/gitlab.go
@@ -1,4 +1,4 @@
-// Package gitlab provides authentication strategies using Gitlab.
+// Package gitlab provides authentication strategies using GitLab.
 package gitlab
 
 import (
@@ -7,33 +7,64 @@ import (
 	"errors"
 	"fmt"
 	"io"
+	"log/slog"
 	"net/http"
 	"strconv"
+	"strings"
 	"time"
 
 	"golang.org/x/oauth2"
 
 	"github.com/dexidp/dex/connector"
 	"github.com/dexidp/dex/pkg/groups"
-	"github.com/dexidp/dex/pkg/log"
+	"github.com/dexidp/dex/pkg/httpclient"
 )
 
 const (
 	// read operations of the /api/v4/user endpoint
 	scopeUser = "read_user"
+	// read operations of the REST API, including /api/v4/groups
+	scopeReadAPI = "read_api"
 	// used to retrieve groups from /oauth/userinfo
 	// https://docs.gitlab.com/ee/integration/openid_connect_provider.html
 	scopeOpenID = "openid"
 )
 
+const (
+	// constants for inheritedGroups flag
+	inheritedGroupsPerPage   = 100
+	accessLevelMinimalAccess = 5
+	accessLevelGuest         = 10
+	accessLevelPlanner       = 15
+	accessLevelReporter      = 20
+	accessLevelSecurityMgr   = 25
+	accessLevelDeveloper     = 30
+	accessLevelMaintainer    = 40
+	accessLevelOwner         = 50
+	accessLevelAdmin         = 60
+)
+
 // Config holds configuration options for gitlab logins.
 type Config struct {
-	BaseURL      string   `json:"baseURL"`
-	ClientID     string   `json:"clientID"`
-	ClientSecret string   `json:"clientSecret"`
-	RedirectURI  string   `json:"redirectURI"`
-	Groups       []string `json:"groups"`
-	UseLoginAsID bool     `json:"useLoginAsID"`
+	// BaseURL is the root URL of the GitLab instance. Defaults to https://gitlab.com.
+	BaseURL string `json:"baseURL"`
+	// ClientID is the OAuth client ID registered in GitLab.
+	ClientID string `json:"clientID"`
+	// ClientSecret is the OAuth client secret registered in GitLab.
+	ClientSecret string `json:"clientSecret"`
+	// RedirectURI is the callback URL configured for the GitLab OAuth application.
+	RedirectURI string `json:"redirectURI"`
+	// Groups limits logins to users who belong to at least one of the configured GitLab groups.
+	Groups []string `json:"groups"`
+	// UseLoginAsID uses the GitLab username as the Dex user ID instead of the numeric GitLab user ID.
+	UseLoginAsID bool `json:"useLoginAsID"`
+	// GetGroupsPermission appends role-qualified entries, such as group:owner, to the groups claim.
+	GetGroupsPermission bool `json:"getGroupsPermission"`
+	// When enabled, Dex uses /api/v4/groups as the source of truth for group names so
+	// inherited memberships are included as well. This requires GitLab's read_api scope.
+	InheritedGroups bool `json:"inheritedGroups"`
+	// RootCAData is a PEM-encoded CA bundle used to trust custom TLS certificates on the GitLab instance.
+	RootCAData []byte `json:"rootCAData,omitempty"`
 }
 
 type gitlabUser struct {
@@ -46,18 +77,34 @@ type gitlabUser struct {
 }
 
 // Open returns a strategy for logging in through GitLab.
-func (c *Config) Open(id string, logger log.Logger) (connector.Connector, error) {
+func (c *Config) Open(id string, logger *slog.Logger) (connector.Connector, error) {
 	if c.BaseURL == "" {
 		c.BaseURL = "https://gitlab.com"
 	}
+	var httpClient *http.Client
+	if len(c.RootCAData) > 0 {
+		var err error
+		httpClient, err = httpclient.NewHTTPClient([]string{string(c.RootCAData)}, false)
+		if err != nil {
+			// Keep backward-compatible error semantics for invalid PEM input.
+			if strings.Contains(err.Error(), "not in PEM format") {
+				return nil, fmt.Errorf("gitlab: invalid rootCAData")
+			}
+			return nil, fmt.Errorf("gitlab: failed to create HTTP client: %v", err)
+		}
+		httpClient.Timeout = 30 * time.Second
+	}
 	return &gitlabConnector{
-		baseURL:      c.BaseURL,
-		redirectURI:  c.RedirectURI,
-		clientID:     c.ClientID,
-		clientSecret: c.ClientSecret,
-		logger:       logger,
-		groups:       c.Groups,
-		useLoginAsID: c.UseLoginAsID,
+		baseURL:             c.BaseURL,
+		redirectURI:         c.RedirectURI,
+		clientID:            c.ClientID,
+		clientSecret:        c.ClientSecret,
+		logger:              logger.With(slog.Group("connector", "type", "gitlab", "id", id)),
+		groups:              c.Groups,
+		useLoginAsID:        c.UseLoginAsID,
+		getGroupsPermission: c.GetGroupsPermission,
+		inheritedGroups:     c.InheritedGroups,
+		httpClient:          httpClient,
 	}, nil
 }
 
@@ -68,8 +115,9 @@ type connectorData struct {
 }
 
 var (
-	_ connector.CallbackConnector = (*gitlabConnector)(nil)
-	_ connector.RefreshConnector  = (*gitlabConnector)(nil)
+	_ connector.CallbackConnector      = (*gitlabConnector)(nil)
+	_ connector.RefreshConnector       = (*gitlabConnector)(nil)
+	_ connector.TokenIdentityConnector = (*gitlabConnector)(nil)
 )
 
 type gitlabConnector struct {
@@ -78,16 +126,26 @@ type gitlabConnector struct {
 	groups       []string
 	clientID     string
 	clientSecret string
-	logger       log.Logger
+	logger       *slog.Logger
 	httpClient   *http.Client
 	// if set to true will use the user's handle rather than their numeric id as the ID
 	useLoginAsID bool
+
+	// if set to true permissions will be added to list of groups
+	getGroupsPermission bool
+
+	// if set to true inherited groups will be retrieved from /api/v4/groups
+	inheritedGroups bool
 }
 
+// oauth2Config builds the OAuth2 client configuration and scopes for this connector.
 func (c *gitlabConnector) oauth2Config(scopes connector.Scopes) *oauth2.Config {
 	gitlabScopes := []string{scopeUser}
 	if c.groupsRequired(scopes.Groups) {
-		gitlabScopes = []string{scopeUser, scopeOpenID}
+		gitlabScopes = append(gitlabScopes, scopeOpenID)
+		if c.inheritedGroups {
+			gitlabScopes = append(gitlabScopes, scopeReadAPI)
+		}
 	}
 
 	gitlabEndpoint := oauth2.Endpoint{AuthURL: c.baseURL + "/oauth/authorize", TokenURL: c.baseURL + "/oauth/token"}
@@ -100,11 +158,12 @@ func (c *gitlabConnector) oauth2Config(scopes connector.Scopes) *oauth2.Config {
 	}
 }
 
-func (c *gitlabConnector) LoginURL(scopes connector.Scopes, callbackURL, state string) (string, error) {
+// LoginURL returns the GitLab authorization URL for the requested scopes.
+func (c *gitlabConnector) LoginURL(scopes connector.Scopes, callbackURL, state string) (string, []byte, error) {
 	if c.redirectURI != callbackURL {
-		return "", fmt.Errorf("expected callback URL %q did not match the URL in the config %q", c.redirectURI, callbackURL)
+		return "", nil, fmt.Errorf("expected callback URL %q did not match the URL in the config %q", c.redirectURI, callbackURL)
 	}
-	return c.oauth2Config(scopes).AuthCodeURL(state), nil
+	return c.oauth2Config(scopes).AuthCodeURL(state), nil, nil
 }
 
 type oauth2Error struct {
@@ -112,6 +171,7 @@ type oauth2Error struct {
 	errorDescription string
 }
 
+// Error formats the OAuth error returned by GitLab during the callback flow.
 func (e *oauth2Error) Error() string {
 	if e.errorDescription == "" {
 		return e.error
@@ -119,7 +179,8 @@ func (e *oauth2Error) Error() string {
 	return e.error + ": " + e.errorDescription
 }
 
-func (c *gitlabConnector) HandleCallback(s connector.Scopes, r *http.Request) (identity connector.Identity, err error) {
+// HandleCallback exchanges the authorization code and resolves the authenticated identity.
+func (c *gitlabConnector) HandleCallback(s connector.Scopes, connData []byte, r *http.Request) (identity connector.Identity, err error) {
 	q := r.URL.Query()
 	if errType := q.Get("error"); errType != "" {
 		return identity, &oauth2Error{errType, q.Get("error_description")}
@@ -140,6 +201,7 @@ func (c *gitlabConnector) HandleCallback(s connector.Scopes, r *http.Request) (i
 	return c.identity(ctx, s, token)
 }
 
+// identity resolves the Dex identity fields from a GitLab access token.
 func (c *gitlabConnector) identity(ctx context.Context, s connector.Scopes, token *oauth2.Token) (identity connector.Identity, err error) {
 	oauth2Config := c.oauth2Config(s)
 	client := oauth2Config.Client(ctx, token)
@@ -166,7 +228,7 @@ func (c *gitlabConnector) identity(ctx context.Context, s connector.Scopes, toke
 	}
 
 	if c.groupsRequired(s.Groups) {
-		groups, err := c.getGroups(ctx, client, s.Groups, user.Username)
+		groups, err := c.resolveIdentityGroups(ctx, client, s.Groups, user.Username, user.ID)
 		if err != nil {
 			return identity, fmt.Errorf("gitlab: get groups: %v", err)
 		}
@@ -185,6 +247,7 @@ func (c *gitlabConnector) identity(ctx context.Context, s connector.Scopes, toke
 	return identity, nil
 }
 
+// Refresh rebuilds the identity using the stored refresh token or access token.
 func (c *gitlabConnector) Refresh(ctx context.Context, s connector.Scopes, ident connector.Identity) (connector.Identity, error) {
 	var data connectorData
 	if err := json.Unmarshal(ident.ConnectorData, &data); err != nil {
@@ -221,6 +284,35 @@ func (c *gitlabConnector) Refresh(ctx context.Context, s connector.Scopes, ident
 	}
 }
 
+// TokenIdentity is used for token exchange, verifying a GitLab access token
+// and returning the associated user identity. This enables direct authentication
+// with Dex using an existing GitLab token without going through the OAuth flow.
+//
+// Note: The connector decides whether to fetch groups based on its configuration
+// (groups filter, getGroupsPermission), not on the scopes from the token exchange request.
+// The server will then decide whether to include groups in the final token based on
+// the requested scopes. This matches the behavior of other connectors (e.g., OIDC).
+func (c *gitlabConnector) TokenIdentity(ctx context.Context, _, subjectToken string) (connector.Identity, error) {
+	if c.httpClient != nil {
+		ctx = context.WithValue(ctx, oauth2.HTTPClient, c.httpClient)
+	}
+
+	token := &oauth2.Token{
+		AccessToken: subjectToken,
+		TokenType:   "Bearer", // GitLab tokens are typically Bearer tokens even if the type is not explicitly provided.
+	}
+
+	// For token exchange, we determine if groups should be fetched based on connector configuration.
+	// If the connector has groups filter or getGroupsPermission enabled, we fetch groups.
+	scopes := connector.Scopes{
+		// Scopes are not provided in token exchange, so we request groups every time and return only if configured.
+		Groups: true,
+	}
+
+	return c.identity(ctx, scopes, token)
+}
+
+// groupsRequired reports whether this request needs group resolution.
 func (c *gitlabConnector) groupsRequired(groupScope bool) bool {
 	return len(c.groups) > 0 || groupScope
 }
@@ -256,55 +348,325 @@ func (c *gitlabConnector) user(ctx context.Context, client *http.Client) (gitlab
 }
 
 type userInfo struct {
-	Groups []string
+	Groups               []string `json:"groups"`
+	OwnerPermission      []string `json:"https://gitlab.org/claims/groups/owner"`
+	MaintainerPermission []string `json:"https://gitlab.org/claims/groups/maintainer"`
+	DeveloperPermission  []string `json:"https://gitlab.org/claims/groups/developer"`
+}
+
+type gitlabGroup struct {
+	ID       int    `json:"id"`
+	FullPath string `json:"full_path"`
+	Path     string `json:"path"`
+}
+
+type gitlabGroupMember struct {
+	AccessLevel int `json:"access_level"`
+}
+
+// resolveIdentityGroups resolves group claims and applies configured group filtering.
+func (c *gitlabConnector) resolveIdentityGroups(ctx context.Context, client *http.Client, groupScope bool, userLogin string, userID int) ([]string, error) {
+	gitlabGroups, err := c.resolveGroupClaims(ctx, client, userID)
+	if err != nil {
+		return nil, err
+	}
+
+	if len(c.groups) > 0 {
+		filteredGroups := groups.Filter(gitlabGroups, c.groups)
+		if len(filteredGroups) == 0 {
+			return nil, fmt.Errorf("gitlab: user %q is not in any of the required groups", userLogin)
+		}
+		return filteredGroups, nil
+	} else if groupScope {
+		return gitlabGroups, nil
+	}
+
+	return nil, nil
+}
+
+// resolveGroupClaims selects the direct or inherited group resolution path.
+func (c *gitlabConnector) resolveGroupClaims(ctx context.Context, client *http.Client, userID int) ([]string, error) {
+	if c.inheritedGroups {
+		return c.resolveInheritedGroupClaims(ctx, client, userID)
+	}
+
+	return c.resolveDirectGroupClaims(ctx, client)
+}
+
+// resolveDirectGroupClaims returns group claims from the OIDC userinfo response.
+func (c *gitlabConnector) resolveDirectGroupClaims(ctx context.Context, client *http.Client) ([]string, error) {
+	u, err := c.fetchUserInfo(ctx, client)
+	if err != nil {
+		return nil, err
+	}
+
+	if !c.getGroupsPermission {
+		return u.Groups, nil
+	}
+
+	return appendPermissionsFromUserInfo(u.Groups, u), nil
+}
+
+// resolveInheritedGroupClaims returns group claims from the GitLab groups API.
+func (c *gitlabConnector) resolveInheritedGroupClaims(ctx context.Context, client *http.Client, userID int) ([]string, error) {
+	groupRecords, err := c.fetchInheritedGroupRecords(ctx, client)
+	if err != nil {
+		return nil, err
+	}
+
+	groupClaims := groupPathsFromRecords(groupRecords)
+	if !c.getGroupsPermission {
+		return groupClaims, nil
+	}
+
+	u, err := c.fetchUserInfo(ctx, client)
+	if err != nil {
+		return nil, err
+	}
+
+	groupClaims = appendPermissionsFromUserInfo(groupClaims, u)
+	if userID == 0 {
+		return nil, errors.New("gitlab: user id is required to fetch effective group permissions")
+	}
+
+	for _, groupRecord := range groupRecords {
+		groupPath := groupPathFromRecord(groupRecord)
+		if groupPath == "" {
+			continue
+		}
+
+		if _, ok := permissionFromUserInfo(groupPath, u); ok {
+			continue
+		}
+
+		permission, ok, err := c.fetchEffectiveGroupPermission(ctx, client, groupRecord.ID, userID)
+		if err != nil {
+			return nil, err
+		}
+		if ok {
+			groupClaims = append(groupClaims, fmt.Sprintf("%s:%s", groupPath, permission))
+		}
+	}
+
+	return groupClaims, nil
 }
 
-// userGroups queries the GitLab API for group membership.
+// fetchUserInfo queries the GitLab OIDC userinfo endpoint for profile and direct group membership.
 //
 // The HTTP passed client is expected to be constructed by the golang.org/x/oauth2 package,
 // which inserts a bearer token as part of the request.
-func (c *gitlabConnector) userGroups(ctx context.Context, client *http.Client) ([]string, error) {
+func (c *gitlabConnector) fetchUserInfo(ctx context.Context, client *http.Client) (userInfo, error) {
+	var u userInfo
 	req, err := http.NewRequest("GET", c.baseURL+"/oauth/userinfo", nil)
 	if err != nil {
-		return nil, fmt.Errorf("gitlab: new req: %v", err)
+		return u, fmt.Errorf("gitlab: new req: %v", err)
 	}
 	req = req.WithContext(ctx)
 	resp, err := client.Do(req)
 	if err != nil {
-		return nil, fmt.Errorf("gitlab: get URL %v", err)
+		return u, fmt.Errorf("gitlab: get URL %v", err)
 	}
 	defer resp.Body.Close()
 
 	if resp.StatusCode != http.StatusOK {
 		body, err := io.ReadAll(resp.Body)
 		if err != nil {
-			return nil, fmt.Errorf("gitlab: read body: %v", err)
+			return u, fmt.Errorf("gitlab: read body: %v", err)
 		}
-		return nil, fmt.Errorf("%s: %s", resp.Status, body)
+		return u, fmt.Errorf("%s: %s", resp.Status, body)
 	}
-	var u userInfo
 	if err := json.NewDecoder(resp.Body).Decode(&u); err != nil {
-		return nil, fmt.Errorf("failed to decode response: %v", err)
+		return u, fmt.Errorf("failed to decode response: %v", err)
+	}
+	return u, nil
+}
+
+// fetchInheritedGroupRecords queries the GitLab groups API for all groups the current user is a member of.
+// When inheritedGroups is enabled, this becomes the source of truth for group names.
+func (c *gitlabConnector) fetchInheritedGroupRecords(ctx context.Context, client *http.Client) ([]gitlabGroup, error) {
+	groupRecords := make([]gitlabGroup, 0)
+	for page := 1; ; page++ {
+		req, err := http.NewRequest("GET", c.baseURL+"/api/v4/groups", nil)
+		if err != nil {
+			return nil, fmt.Errorf("gitlab: new req: %v", err)
+		}
+
+		q := req.URL.Query()
+		q.Set("all_available", "false")
+		q.Set("per_page", strconv.Itoa(inheritedGroupsPerPage))
+		q.Set("page", strconv.Itoa(page))
+		req.URL.RawQuery = q.Encode()
+		req = req.WithContext(ctx)
+
+		resp, err := client.Do(req)
+		if err != nil {
+			return nil, fmt.Errorf("gitlab: get URL %v", err)
+		}
+
+		if resp.StatusCode != http.StatusOK {
+			body, err := io.ReadAll(resp.Body)
+			_ = resp.Body.Close()
+			if err != nil {
+				return nil, fmt.Errorf("gitlab: read body: %v", err)
+			}
+			return nil, fmt.Errorf("%s: %s", resp.Status, body)
+		}
+
+		var pageGroupRecords []gitlabGroup
+		if err := json.NewDecoder(resp.Body).Decode(&pageGroupRecords); err != nil {
+			_ = resp.Body.Close()
+			return nil, fmt.Errorf("failed to decode response: %v", err)
+		}
+		_ = resp.Body.Close()
+
+		groupRecords = append(groupRecords, pageGroupRecords...)
+
+		if len(pageGroupRecords) < inheritedGroupsPerPage {
+			break
+		}
 	}
 
-	return u.Groups, nil
+	return groupRecords, nil
 }
 
-func (c *gitlabConnector) getGroups(ctx context.Context, client *http.Client, groupScope bool, userLogin string) ([]string, error) {
-	gitlabGroups, err := c.userGroups(ctx, client)
+// fetchEffectiveGroupPermission returns the effective permission for a user within a GitLab group.
+func (c *gitlabConnector) fetchEffectiveGroupPermission(ctx context.Context, client *http.Client, groupID, userID int) (string, bool, error) {
+	if groupID == 0 {
+		return "", false, errors.New("gitlab: group id is required to fetch effective group permissions")
+	}
+
+	req, err := http.NewRequest("GET", fmt.Sprintf("%s/api/v4/groups/%d/members/all/%d", c.baseURL, groupID, userID), nil)
 	if err != nil {
-		return nil, err
+		return "", false, fmt.Errorf("gitlab: new req: %v", err)
 	}
 
-	if len(c.groups) > 0 {
-		filteredGroups := groups.Filter(gitlabGroups, c.groups)
-		if len(filteredGroups) == 0 {
-			return nil, fmt.Errorf("gitlab: user %q is not in any of the required groups", userLogin)
+	req = req.WithContext(ctx)
+	resp, err := client.Do(req)
+	if err != nil {
+		return "", false, fmt.Errorf("gitlab: get URL %v", err)
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode != http.StatusOK {
+		body, err := io.ReadAll(resp.Body)
+		if err != nil {
+			return "", false, fmt.Errorf("gitlab: read body: %v", err)
 		}
-		return filteredGroups, nil
-	} else if groupScope {
-		return gitlabGroups, nil
+		if resp.StatusCode == http.StatusForbidden || resp.StatusCode == http.StatusNotFound {
+			if c.logger != nil {
+				c.logger.Debug("gitlab: skipping effective group permission lookup", "groupID", groupID, "userID", userID, "status", resp.Status)
+			}
+			return "", false, nil
+		}
+		return "", false, fmt.Errorf("%s: %s", resp.Status, body)
 	}
 
-	return nil, nil
+	var member gitlabGroupMember
+	if err := json.NewDecoder(resp.Body).Decode(&member); err != nil {
+		return "", false, fmt.Errorf("failed to decode response: %v", err)
+	}
+
+	permission, ok := permissionFromAccessLevel(member.AccessLevel)
+	return permission, ok, nil
+}
+
+// groupPathsFromRecords extracts claim-ready group paths from GitLab group records.
+func groupPathsFromRecords(groupRecords []gitlabGroup) []string {
+	groupPaths := make([]string, 0, len(groupRecords))
+	for _, groupRecord := range groupRecords {
+		if groupPath := groupPathFromRecord(groupRecord); groupPath != "" {
+			groupPaths = append(groupPaths, groupPath)
+		}
+	}
+
+	return groupPaths
+}
+
+// groupPathFromRecord returns the canonical path for a GitLab group record.
+func groupPathFromRecord(groupRecord gitlabGroup) string {
+	if groupRecord.FullPath != "" {
+		return groupRecord.FullPath
+	}
+	return groupRecord.Path
+}
+
+// appendPermissionsFromUserInfo adds permission-qualified group claims derived from userinfo.
+func appendPermissionsFromUserInfo(groupPaths []string, u userInfo) []string {
+	groupsWithPermissions := append([]string(nil), groupPaths...)
+	for _, groupPath := range groupPaths {
+		if permission, ok := permissionFromUserInfo(groupPath, u); ok {
+			groupsWithPermissions = append(groupsWithPermissions, fmt.Sprintf("%s:%s", groupPath, permission))
+		}
+	}
+
+	return groupsWithPermissions
+}
+
+// permissionFromUserInfo resolves a permission suffix for a group path from userinfo claims.
+func permissionFromUserInfo(groupPath string, u userInfo) (string, bool) {
+	if matchesGroupPathOrAncestor(groupPath, u.OwnerPermission) {
+		return "owner", true
+	}
+	if matchesGroupPathOrAncestor(groupPath, u.MaintainerPermission) {
+		return "maintainer", true
+	}
+	if matchesGroupPathOrAncestor(groupPath, u.DeveloperPermission) {
+		return "developer", true
+	}
+	return "", false
+}
+
+// matchesGroupPathOrAncestor reports whether a permission path applies to the given group path.
+func matchesGroupPathOrAncestor(groupPath string, permissionPaths []string) bool {
+	for _, permissionPath := range permissionPaths {
+		// Exact group match, for example "ops" matches "ops".
+		if groupPath == permissionPath {
+			return true
+		}
+
+		// A parent-group permission cannot match a shorter or equally long path.
+		if len(groupPath) <= len(permissionPath) {
+			continue
+		}
+
+		// The permission path must be a prefix of the subgroup path.
+		if groupPath[0:len(permissionPath)] != permissionPath {
+			continue
+		}
+
+		// Require a path separator so "dev" does not match "developer".
+		if string(groupPath[len(permissionPath)]) != "/" {
+			continue
+		}
+
+		// Parent-group permissions apply to descendant subgroups.
+		return true
+	}
+	return false
+}
+
+// permissionFromAccessLevel maps GitLab numeric access levels to permission suffix strings.
+func permissionFromAccessLevel(accessLevel int) (string, bool) {
+	switch accessLevel {
+	case accessLevelMinimalAccess:
+		return "minimal_access", true
+	case accessLevelGuest:
+		return "guest", true
+	case accessLevelPlanner:
+		return "planner", true
+	case accessLevelReporter:
+		return "reporter", true
+	case accessLevelSecurityMgr:
+		return "security_manager", true
+	case accessLevelDeveloper:
+		return "developer", true
+	case accessLevelMaintainer:
+		return "maintainer", true
+	case accessLevelOwner:
+		return "owner", true
+	case accessLevelAdmin:
+		return "admin", true
+	default:
+		return "", false
+	}
 }
diff --git a/connector/gitlab/gitlab_test.go b/connector/gitlab/gitlab_test.go
index d828b8bd16..aba2e96056 100644
--- a/connector/gitlab/gitlab_test.go
+++ b/connector/gitlab/gitlab_test.go
@@ -4,15 +4,196 @@ import (
 	"context"
 	"crypto/tls"
 	"encoding/json"
+	"fmt"
+	"io"
+	"log/slog"
 	"net/http"
 	"net/http/httptest"
 	"net/url"
+	"os"
 	"reflect"
+	"strings"
 	"testing"
+	"time"
 
 	"github.com/dexidp/dex/connector"
 )
 
+func readValidRootCAData(t *testing.T) []byte {
+	t.Helper()
+	b, err := os.ReadFile("testdata/rootCA.pem")
+	if err != nil {
+		t.Fatalf("failed to read rootCA.pem testdata: %v", err)
+	}
+	return b
+}
+
+func newLocalHTTPSTestServer(t *testing.T, handler http.Handler) *httptest.Server {
+	t.Helper()
+
+	ts := httptest.NewUnstartedServer(handler)
+	cert, err := tls.LoadX509KeyPair("testdata/server.crt", "testdata/server.key")
+	if err != nil {
+		t.Fatalf("failed to load TLS test cert/key: %v", err)
+	}
+	ts.TLS = &tls.Config{Certificates: []tls.Certificate{cert}}
+	ts.StartTLS()
+	return ts
+}
+
+func TestOpenWithRootCADataCreatesHTTPClient(t *testing.T) {
+	logger := slog.New(slog.NewTextHandler(io.Discard, nil))
+
+	cfg := &Config{
+		RootCAData: readValidRootCAData(t),
+	}
+
+	conn, err := cfg.Open("test", logger)
+	if err != nil {
+		t.Fatalf("expected nil error, got %v", err)
+	}
+
+	gc, ok := conn.(*gitlabConnector)
+	if !ok {
+		t.Fatalf("expected *gitlabConnector, got %T", conn)
+	}
+	if gc.httpClient == nil {
+		t.Fatalf("expected httpClient to be non-nil")
+	}
+	if gc.httpClient.Timeout != 30*time.Second {
+		t.Fatalf("expected httpClient timeout %v, got %v", 30*time.Second, gc.httpClient.Timeout)
+	}
+	tr, ok := gc.httpClient.Transport.(*http.Transport)
+	if !ok {
+		t.Fatalf("expected transport to be *http.Transport, got %T", gc.httpClient.Transport)
+	}
+	// ProxyFromEnvironment is expected to be enabled (non-nil proxy func).
+	if tr.Proxy == nil {
+		t.Fatalf("expected transport.Proxy to be set (ProxyFromEnvironment)")
+	}
+	if tr.TLSClientConfig == nil || tr.TLSClientConfig.RootCAs == nil {
+		t.Fatalf("expected transport TLS root CAs to be configured")
+	}
+}
+
+func TestOpenWithInvalidRootCADataReturnsError(t *testing.T) {
+	logger := slog.New(slog.NewTextHandler(io.Discard, nil))
+
+	cfg := &Config{
+		RootCAData: []byte("not a pem"),
+	}
+
+	_, err := cfg.Open("test", logger)
+	if err == nil {
+		t.Fatalf("expected error, got nil")
+	}
+	if !strings.Contains(err.Error(), "invalid rootCAData") {
+		t.Fatalf("expected error to contain %q, got %q", "invalid rootCAData", err.Error())
+	}
+}
+
+func TestHandleCallbackCustomRootCADataEnablesTLSRequests(t *testing.T) {
+	logger := slog.New(slog.NewTextHandler(io.Discard, nil))
+
+	ts := newLocalHTTPSTestServer(t, http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Add("Content-Type", "application/json")
+		switch r.URL.Path {
+		case "/oauth/token":
+			// oauth2.Exchange expects an access token in response.
+			fmt.Fprint(w, `{"access_token":"abc","token_type":"bearer","expires_in":30}`)
+		case "/api/v4/user":
+			json.NewEncoder(w).Encode(gitlabUser{Email: "some@email.com", ID: 12345678})
+		default:
+			http.NotFound(w, r)
+		}
+	}))
+	defer ts.Close()
+
+	cfg := &Config{
+		BaseURL:      ts.URL,
+		ClientID:     "client-id",
+		ClientSecret: "client-secret",
+		RedirectURI:  "https://example.invalid/callback",
+		RootCAData:   readValidRootCAData(t),
+	}
+
+	conn, err := cfg.Open("test", logger)
+	if err != nil {
+		t.Fatalf("Open() error: %v", err)
+	}
+
+	hostURL, err := url.Parse(ts.URL)
+	expectNil(t, err)
+	req, err := http.NewRequest("GET", hostURL.String()+"?code=testcode", nil)
+	expectNil(t, err)
+
+	identity, err := conn.(connector.CallbackConnector).HandleCallback(connector.Scopes{Groups: false}, nil, req)
+	if err != nil {
+		t.Fatalf("HandleCallback() error: %v", err)
+	}
+	if identity.Email != "some@email.com" || identity.UserID != "12345678" {
+		t.Fatalf("unexpected identity: %#v", identity)
+	}
+}
+
+func TestHandleCallbackWithoutRootCADataFailsTLS(t *testing.T) {
+	logger := slog.New(slog.NewTextHandler(io.Discard, nil))
+
+	ts := newLocalHTTPSTestServer(t, http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Add("Content-Type", "application/json")
+		switch r.URL.Path {
+		case "/oauth/token":
+			fmt.Fprint(w, `{"access_token":"abc","token_type":"bearer","expires_in":30}`)
+		case "/api/v4/user":
+			json.NewEncoder(w).Encode(gitlabUser{Email: "some@email.com", ID: 12345678})
+		default:
+			http.NotFound(w, r)
+		}
+	}))
+	defer ts.Close()
+
+	cfg := &Config{
+		BaseURL:      ts.URL,
+		ClientID:     "client-id",
+		ClientSecret: "client-secret",
+		RedirectURI:  "https://example.invalid/callback",
+		// RootCAData intentionally omitted: should fail TLS verification against our custom server cert.
+	}
+
+	conn, err := cfg.Open("test", logger)
+	if err != nil {
+		t.Fatalf("Open() error: %v", err)
+	}
+
+	hostURL, err := url.Parse(ts.URL)
+	expectNil(t, err)
+	req, err := http.NewRequest("GET", hostURL.String()+"?code=testcode", nil)
+	expectNil(t, err)
+
+	_, err = conn.(connector.CallbackConnector).HandleCallback(connector.Scopes{Groups: false}, nil, req)
+	if err == nil {
+		t.Fatalf("expected TLS error, got nil")
+	}
+}
+
+func TestOAuth2ConfigScopesForInheritedGroups(t *testing.T) {
+	c := gitlabConnector{inheritedGroups: true}
+
+	cfg := c.oauth2Config(connector.Scopes{})
+	expectEquals(t, cfg.Scopes, []string{scopeUser})
+
+	cfg = c.oauth2Config(connector.Scopes{Groups: true})
+	expectEquals(t, cfg.Scopes, []string{scopeUser, scopeOpenID, scopeReadAPI})
+
+	c.groups = []string{"team-1"}
+	cfg = c.oauth2Config(connector.Scopes{})
+	expectEquals(t, cfg.Scopes, []string{scopeUser, scopeOpenID, scopeReadAPI})
+
+	c.getGroupsPermission = true
+	cfg = c.oauth2Config(connector.Scopes{Groups: true})
+	expectEquals(t, cfg.Scopes, []string{scopeUser, scopeOpenID, scopeReadAPI})
+}
+
 func TestUserGroups(t *testing.T) {
 	s := newTestServer(map[string]interface{}{
 		"/oauth/userinfo": userInfo{
@@ -22,7 +203,7 @@ func TestUserGroups(t *testing.T) {
 	defer s.Close()
 
 	c := gitlabConnector{baseURL: s.URL}
-	groups, err := c.getGroups(context.Background(), newClient(), true, "joebloggs")
+	groups, err := c.resolveIdentityGroups(context.Background(), newClient(), true, "joebloggs", 12345678)
 
 	expectNil(t, err)
 	expectEquals(t, groups, []string{
@@ -31,6 +212,56 @@ func TestUserGroups(t *testing.T) {
 	})
 }
 
+func TestUserGroupsWithInheritedGroups(t *testing.T) {
+	s := newTestServer(map[string]interface{}{
+		"/oauth/userinfo": userInfo{
+			Groups: []string{"team-legacy"},
+		},
+		"/api/v4/groups?all_available=false&page=1&per_page=100": []gitlabGroup{
+			{FullPath: "team-1"},
+			{FullPath: "team-2/sub"},
+		},
+	})
+	defer s.Close()
+
+	c := gitlabConnector{baseURL: s.URL, inheritedGroups: true}
+	groups, err := c.resolveIdentityGroups(context.Background(), newClient(), true, "joebloggs", 12345678)
+
+	expectNil(t, err)
+	expectEquals(t, groups, []string{
+		"team-1",
+		"team-2/sub",
+	})
+}
+
+func TestUserGroupsWithInheritedGroupsPagination(t *testing.T) {
+	pageOneGroups := make([]gitlabGroup, 0, inheritedGroupsPerPage)
+	expectedGroups := make([]string, 0, inheritedGroupsPerPage+1)
+	for i := 0; i < inheritedGroupsPerPage; i++ {
+		group := fmt.Sprintf("team-%03d", i)
+		pageOneGroups = append(pageOneGroups, gitlabGroup{FullPath: group})
+		expectedGroups = append(expectedGroups, group)
+	}
+	expectedGroups = append(expectedGroups, "team-100")
+
+	s := newTestServer(map[string]interface{}{
+		"/oauth/userinfo": userInfo{
+			Groups: []string{},
+		},
+		"/api/v4/groups?all_available=false&page=1&per_page=100": pageOneGroups,
+		"/api/v4/groups?all_available=false&page=2&per_page=100": []gitlabGroup{
+			{FullPath: "team-100"},
+		},
+	})
+	defer s.Close()
+
+	c := gitlabConnector{baseURL: s.URL, inheritedGroups: true}
+	groups, err := c.resolveIdentityGroups(context.Background(), newClient(), true, "joebloggs", 12345678)
+
+	expectNil(t, err)
+	expectEquals(t, groups, expectedGroups)
+}
+
 func TestUserGroupsWithFiltering(t *testing.T) {
 	s := newTestServer(map[string]interface{}{
 		"/oauth/userinfo": userInfo{
@@ -40,7 +271,7 @@ func TestUserGroupsWithFiltering(t *testing.T) {
 	defer s.Close()
 
 	c := gitlabConnector{baseURL: s.URL, groups: []string{"team-1"}}
-	groups, err := c.getGroups(context.Background(), newClient(), true, "joebloggs")
+	groups, err := c.resolveIdentityGroups(context.Background(), newClient(), true, "joebloggs", 12345678)
 
 	expectNil(t, err)
 	expectEquals(t, groups, []string{
@@ -48,6 +279,31 @@ func TestUserGroupsWithFiltering(t *testing.T) {
 	})
 }
 
+func TestUserGroupsWithInheritedGroupsFiltering(t *testing.T) {
+	s := newTestServer(map[string]interface{}{
+		"/oauth/userinfo": userInfo{
+			Groups: []string{"team-legacy"},
+		},
+		"/api/v4/groups?all_available=false&page=1&per_page=100": []gitlabGroup{
+			{FullPath: "team-1"},
+			{FullPath: "team-2/sub"},
+		},
+	})
+	defer s.Close()
+
+	c := gitlabConnector{
+		baseURL:         s.URL,
+		groups:          []string{"team-2/sub"},
+		inheritedGroups: true,
+	}
+	groups, err := c.resolveIdentityGroups(context.Background(), newClient(), true, "joebloggs", 12345678)
+
+	expectNil(t, err)
+	expectEquals(t, groups, []string{
+		"team-2/sub",
+	})
+}
+
 func TestUserGroupsWithoutOrgs(t *testing.T) {
 	s := newTestServer(map[string]interface{}{
 		"/oauth/userinfo": userInfo{
@@ -57,7 +313,7 @@ func TestUserGroupsWithoutOrgs(t *testing.T) {
 	defer s.Close()
 
 	c := gitlabConnector{baseURL: s.URL}
-	groups, err := c.getGroups(context.Background(), newClient(), true, "joebloggs")
+	groups, err := c.resolveIdentityGroups(context.Background(), newClient(), true, "joebloggs", 12345678)
 
 	expectNil(t, err)
 	expectEquals(t, len(groups), 0)
@@ -84,7 +340,7 @@ func TestUsernameIncludedInFederatedIdentity(t *testing.T) {
 	expectNil(t, err)
 
 	c := gitlabConnector{baseURL: s.URL, httpClient: newClient()}
-	identity, err := c.HandleCallback(connector.Scopes{Groups: false}, req)
+	identity, err := c.HandleCallback(connector.Scopes{Groups: false}, nil, req)
 
 	expectNil(t, err)
 	expectEquals(t, identity.Username, "some@email.com")
@@ -92,7 +348,7 @@ func TestUsernameIncludedInFederatedIdentity(t *testing.T) {
 	expectEquals(t, 0, len(identity.Groups))
 
 	c = gitlabConnector{baseURL: s.URL, httpClient: newClient()}
-	identity, err = c.HandleCallback(connector.Scopes{Groups: true}, req)
+	identity, err = c.HandleCallback(connector.Scopes{Groups: true}, nil, req)
 
 	expectNil(t, err)
 	expectEquals(t, identity.Username, "some@email.com")
@@ -120,7 +376,7 @@ func TestLoginUsedAsIDWhenConfigured(t *testing.T) {
 	expectNil(t, err)
 
 	c := gitlabConnector{baseURL: s.URL, httpClient: newClient(), useLoginAsID: true}
-	identity, err := c.HandleCallback(connector.Scopes{Groups: true}, req)
+	identity, err := c.HandleCallback(connector.Scopes{Groups: true}, nil, req)
 
 	expectNil(t, err)
 	expectEquals(t, identity.UserID, "joebloggs")
@@ -147,7 +403,7 @@ func TestLoginWithTeamWhitelisted(t *testing.T) {
 	expectNil(t, err)
 
 	c := gitlabConnector{baseURL: s.URL, httpClient: newClient(), groups: []string{"team-1"}}
-	identity, err := c.HandleCallback(connector.Scopes{Groups: true}, req)
+	identity, err := c.HandleCallback(connector.Scopes{Groups: true}, nil, req)
 
 	expectNil(t, err)
 	expectEquals(t, identity.UserID, "12345678")
@@ -174,7 +430,7 @@ func TestLoginWithTeamNonWhitelisted(t *testing.T) {
 	expectNil(t, err)
 
 	c := gitlabConnector{baseURL: s.URL, httpClient: newClient(), groups: []string{"team-2"}}
-	_, err = c.HandleCallback(connector.Scopes{Groups: true}, req)
+	_, err = c.HandleCallback(connector.Scopes{Groups: true}, nil, req)
 
 	expectNotNil(t, err, "HandleCallback error")
 	expectEquals(t, err.Error(), "gitlab: get groups: gitlab: user \"joebloggs\" is not in any of the required groups")
@@ -208,7 +464,7 @@ func TestRefresh(t *testing.T) {
 	})
 	expectNil(t, err)
 
-	identity, err := c.HandleCallback(connector.Scopes{OfflineAccess: true}, req)
+	identity, err := c.HandleCallback(connector.Scopes{OfflineAccess: true}, nil, req)
 	expectNil(t, err)
 	expectEquals(t, identity.Username, "some@email.com")
 	expectEquals(t, identity.UserID, "12345678")
@@ -249,6 +505,156 @@ func TestRefreshWithEmptyConnectorData(t *testing.T) {
 	expectEquals(t, emptyIdentity, identity)
 }
 
+func TestGroupsWithPermission(t *testing.T) {
+	s := newTestServer(map[string]interface{}{
+		"/api/v4/user": gitlabUser{Email: "some@email.com", ID: 12345678, Name: "Joe Bloggs", Username: "joebloggs"},
+		"/oauth/token": map[string]interface{}{
+			"access_token": "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9",
+			"expires_in":   "30",
+		},
+		"/oauth/userinfo": userInfo{
+			Groups:               []string{"ops", "dev", "ops-test", "ops/project", "dev/project1", "dev/project2"},
+			OwnerPermission:      []string{"ops"},
+			DeveloperPermission:  []string{"dev"},
+			MaintainerPermission: []string{"dev/project1"},
+		},
+	})
+	defer s.Close()
+
+	hostURL, err := url.Parse(s.URL)
+	expectNil(t, err)
+
+	req, err := http.NewRequest("GET", hostURL.String(), nil)
+	expectNil(t, err)
+
+	c := gitlabConnector{baseURL: s.URL, httpClient: newClient(), getGroupsPermission: true}
+	identity, err := c.HandleCallback(connector.Scopes{Groups: true}, nil, req)
+	expectNil(t, err)
+
+	expectEquals(t, identity.Groups, []string{
+		"ops",
+		"dev",
+		"ops-test",
+		"ops/project",
+		"dev/project1",
+		"dev/project2",
+		"ops:owner",
+		"dev:developer",
+		"ops/project:owner",
+		"dev/project1:maintainer",
+		"dev/project2:developer",
+	})
+}
+
+func TestGroupsWithPermissionAndInheritedGroups(t *testing.T) {
+	s := httptest.NewTLSServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Add("Content-Type", "application/json")
+
+		switch r.RequestURI {
+		case "/api/v4/user":
+			json.NewEncoder(w).Encode(gitlabUser{Email: "some@email.com", ID: 12345678, Name: "Joe Bloggs", Username: "joebloggs"})
+		case "/oauth/token":
+			json.NewEncoder(w).Encode(map[string]interface{}{
+				"access_token": "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9",
+				"expires_in":   "30",
+			})
+		case "/oauth/userinfo":
+			json.NewEncoder(w).Encode(userInfo{
+				Groups:          []string{"ignored-direct-group"},
+				OwnerPermission: []string{"ops"},
+			})
+		case "/api/v4/groups?all_available=false&page=1&per_page=100":
+			json.NewEncoder(w).Encode([]gitlabGroup{
+				{ID: 1, FullPath: "ops"},
+				{ID: 2, FullPath: "ops/project"},
+				{ID: 3, FullPath: "analytics"},
+			})
+		case "/api/v4/groups/3/members/all/12345678":
+			json.NewEncoder(w).Encode(gitlabGroupMember{AccessLevel: accessLevelReporter})
+		default:
+			http.NotFound(w, r)
+		}
+	}))
+	defer s.Close()
+
+	hostURL, err := url.Parse(s.URL)
+	expectNil(t, err)
+
+	req, err := http.NewRequest("GET", hostURL.String(), nil)
+	expectNil(t, err)
+
+	c := gitlabConnector{
+		baseURL:             s.URL,
+		httpClient:          newClient(),
+		getGroupsPermission: true,
+		inheritedGroups:     true,
+	}
+	identity, err := c.HandleCallback(connector.Scopes{Groups: true}, nil, req)
+	expectNil(t, err)
+
+	expectEquals(t, identity.Groups, []string{
+		"ops",
+		"ops/project",
+		"analytics",
+		"ops:owner",
+		"ops/project:owner",
+		"analytics:reporter",
+	})
+}
+
+func TestGroupsWithPermissionAndInheritedGroupsSkipsForbiddenPermissionLookup(t *testing.T) {
+	s := httptest.NewTLSServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Add("Content-Type", "application/json")
+
+		switch r.RequestURI {
+		case "/api/v4/user":
+			json.NewEncoder(w).Encode(gitlabUser{Email: "some@email.com", ID: 12345678, Name: "Joe Bloggs", Username: "joebloggs"})
+		case "/oauth/token":
+			json.NewEncoder(w).Encode(map[string]interface{}{
+				"access_token": "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9",
+				"expires_in":   "30",
+			})
+		case "/oauth/userinfo":
+			json.NewEncoder(w).Encode(userInfo{
+				Groups:          []string{"ignored-direct-group"},
+				OwnerPermission: []string{"ops"},
+			})
+		case "/api/v4/groups?all_available=false&page=1&per_page=100":
+			json.NewEncoder(w).Encode([]gitlabGroup{
+				{ID: 1, FullPath: "ops"},
+				{ID: 2, FullPath: "private/analytics"},
+			})
+		case "/api/v4/groups/2/members/all/12345678":
+			w.WriteHeader(http.StatusForbidden)
+			_, _ = w.Write([]byte(`{"message":"403 Forbidden"}`))
+		default:
+			http.NotFound(w, r)
+		}
+	}))
+	defer s.Close()
+
+	hostURL, err := url.Parse(s.URL)
+	expectNil(t, err)
+
+	req, err := http.NewRequest("GET", hostURL.String(), nil)
+	expectNil(t, err)
+
+	c := gitlabConnector{
+		baseURL:             s.URL,
+		httpClient:          newClient(),
+		getGroupsPermission: true,
+		inheritedGroups:     true,
+	}
+	identity, err := c.HandleCallback(connector.Scopes{Groups: true}, nil, req)
+	expectNil(t, err)
+
+	expectEquals(t, identity.Groups, []string{
+		"ops",
+		"private/analytics",
+		"ops:owner",
+	})
+}
+
 func newTestServer(responses map[string]interface{}) *httptest.Server {
 	return httptest.NewTLSServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		response := responses[r.RequestURI]
@@ -281,3 +687,88 @@ func expectEquals(t *testing.T, a interface{}, b interface{}) {
 		t.Errorf("Expected %+v to equal %+v", a, b)
 	}
 }
+
+func TestTokenIdentity(t *testing.T) {
+	// Note: These tests verify that the connector returns groups based on its configuration.
+	// The actual inclusion of groups in the final Dex token depends on the 'groups' scope
+	// in the token exchange request, which is handled by the Dex server, not the connector.
+	tests := []struct {
+		name                string
+		userInfo            userInfo
+		groups              []string
+		getGroupsPermission bool
+		useLoginAsID        bool
+		expectUserID        string
+		expectGroups        []string
+	}{
+		{
+			name:         "without groups config",
+			expectUserID: "12345678",
+			expectGroups: nil,
+		},
+		{
+			name: "with groups filter",
+			userInfo: userInfo{
+				Groups: []string{"team-1", "team-2"},
+			},
+			groups:       []string{"team-1"},
+			expectUserID: "12345678",
+			expectGroups: []string{"team-1"},
+		},
+		{
+			name: "with groups permission",
+			userInfo: userInfo{
+				Groups:               []string{"ops", "dev"},
+				OwnerPermission:      []string{"ops"},
+				DeveloperPermission:  []string{"dev"},
+				MaintainerPermission: []string{},
+			},
+			getGroupsPermission: true,
+			expectUserID:        "12345678",
+			expectGroups:        []string{"ops", "dev", "ops:owner", "dev:developer"},
+		},
+		{
+			name:         "with useLoginAsID",
+			useLoginAsID: true,
+			expectUserID: "joebloggs",
+			expectGroups: nil,
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			responses := map[string]interface{}{
+				"/api/v4/user": gitlabUser{
+					Email:    "some@email.com",
+					ID:       12345678,
+					Name:     "Joe Bloggs",
+					Username: "joebloggs",
+				},
+				"/oauth/userinfo": tc.userInfo,
+			}
+
+			s := newTestServer(responses)
+			defer s.Close()
+
+			c := gitlabConnector{
+				baseURL:             s.URL,
+				httpClient:          newClient(),
+				groups:              tc.groups,
+				getGroupsPermission: tc.getGroupsPermission,
+				useLoginAsID:        tc.useLoginAsID,
+			}
+
+			accessToken := "test-access-token"
+			ctx := context.Background()
+			identity, err := c.TokenIdentity(ctx, "urn:ietf:params:oauth:token-type:access_token", accessToken)
+
+			expectNil(t, err)
+			expectEquals(t, identity.UserID, tc.expectUserID)
+			expectEquals(t, identity.Username, "Joe Bloggs")
+			expectEquals(t, identity.PreferredUsername, "joebloggs")
+			expectEquals(t, identity.Email, "some@email.com")
+			expectEquals(t, identity.EmailVerified, true)
+			expectEquals(t, identity.Groups, tc.expectGroups)
+		})
+	}
+}
diff --git a/connector/gitlab/testdata/rootCA.pem b/connector/gitlab/testdata/rootCA.pem
new file mode 100644
index 0000000000..c03bdac0c0
--- /dev/null
+++ b/connector/gitlab/testdata/rootCA.pem
@@ -0,0 +1,23 @@
+-----BEGIN CERTIFICATE-----
+MIID1jCCAr4CCQCG4JBeSi6cDjANBgkqhkiG9w0BAQsFADCBrDELMAkGA1UEBhMC
+VVMxFDASBgNVBAgMC1JhbmRvbVN0YXRlMRMwEQYDVQQHDApSYW5kb21DaXR5MRsw
+GQYDVQQKDBJSYW5kb21Pcmdhbml6YXRpb24xHzAdBgNVBAsMFlJhbmRvbU9yZ2Fu
+aXphdGlvblVuaXQxIDAeBgkqhkiG9w0BCQEWEWhlbGxvQGV4YW1wbGUuY29tMRIw
+EAYDVQQDDAlsb2NhbGhvc3QwHhcNMjIxMDA3MjIwNjQwWhcNMzIxMDA0MjIwNjQw
+WjCBrDELMAkGA1UEBhMCVVMxFDASBgNVBAgMC1JhbmRvbVN0YXRlMRMwEQYDVQQH
+DApSYW5kb21DaXR5MRswGQYDVQQKDBJSYW5kb21Pcmdhbml6YXRpb24xHzAdBgNV
+BAsMFlJhbmRvbU9yZ2FuaXphdGlvblVuaXQxIDAeBgkqhkiG9w0BCQEWEWhlbGxv
+QGV4YW1wbGUuY29tMRIwEAYDVQQDDAlsb2NhbGhvc3QwggEiMA0GCSqGSIb3DQEB
+AQUAA4IBDwAwggEKAoIBAQDh0HlpAKMKYyxbvW70XRY2bVNiNdAFninug1P4FDAJ
+z8xnbFzk17FLY7zqdtGTDmPDJ8AAxIwpGv2zYWW5VMeqKWfvyuD5dSCauY1Pdmug
+uZbpAvoJrx1sw+TL61ByVmy8x3ccB4LLKuzil/vAzUDJQkPsfTECVUPV+yiGSDuO
+EEVR9X6rZUwx2expXm8Wtb/a88FbPVI09b9eb4iWfLvGD2eNAtw8w21W0X7sQ8Hq
+zEPqquMEL4qPnNDdtk592uHvLLrd1uH8qH7c1JyA76T7H3YeUCNEi+PnLgqtsZmX
+sKY62HnLt8/LAClVsN9lFYkKEjU9V+U7IN2cL6+EwtsdAgMBAAEwDQYJKoZIhvcN
+AQELBQADggEBAN6g0qit/3R2X+KdR0LgRXF/h4qQFgcV6cxnhRAmLIDNJlxKSHqN
+IE5+bxzCbkblzGfr/jNPqW0s+yaN4CyMgKNYSzkLBPE4FF+19Uv+dyYfFms3mDJ7
+0rGjS5bCscThWhpaSw20LcwQcr/+X+/fGzJ01dVFK1UOjBKg4d4dMwxklbIkZqIq
+siRW0GMy26mgVZ/BSjeh5kEjs6h6H3cJsGl7xYT+BI7wnxHwGeT9tkBgiyT5FwaS
+vtdZkBpQ9q8f7FwsEm3woLHdWuOnrtUtVpY/oc6WFGdROQdGzjSk0D3kHs9YhueC
+GSzZKrqX+TSIgpPrLYNHX4uxlo5TAwP/5GM=
+-----END CERTIFICATE-----
diff --git a/connector/gitlab/testdata/server.crt b/connector/gitlab/testdata/server.crt
new file mode 100644
index 0000000000..9b0f12ec58
--- /dev/null
+++ b/connector/gitlab/testdata/server.crt
@@ -0,0 +1,29 @@
+-----BEGIN CERTIFICATE-----
+MIIE5TCCA82gAwIBAgIJAMGzXwBRpkG7MA0GCSqGSIb3DQEBCwUAMIGsMQswCQYD
+VQQGEwJVUzEUMBIGA1UECAwLUmFuZG9tU3RhdGUxEzARBgNVBAcMClJhbmRvbUNp
+dHkxGzAZBgNVBAoMElJhbmRvbU9yZ2FuaXphdGlvbjEfMB0GA1UECwwWUmFuZG9t
+T3JnYW5pemF0aW9uVW5pdDEgMB4GCSqGSIb3DQEJARYRaGVsbG9AZXhhbXBsZS5j
+b20xEjAQBgNVBAMMCWxvY2FsaG9zdDAeFw0yMjEwMDcyMjA3MDhaFw0zMjEwMDQy
+MjA3MDhaMIGsMQswCQYDVQQGEwJVUzEUMBIGA1UECAwLUmFuZG9tU3RhdGUxEzAR
+BgNVBAcMClJhbmRvbUNpdHkxGzAZBgNVBAoMElJhbmRvbU9yZ2FuaXphdGlvbjEf
+MB0GA1UECwwWUmFuZG9tT3JnYW5pemF0aW9uVW5pdDEgMB4GCSqGSIb3DQEJARYR
+aGVsbG9AZXhhbXBsZS5jb20xEjAQBgNVBAMMCWxvY2FsaG9zdDCCASIwDQYJKoZI
+hvcNAQEBBQADggEPADCCAQoCggEBAMuKdpXP87Q7Kg3iafXzvBuVIyV1K5UmMYiN
+koztkC5XrCzHaQRS/CoIb7/nUqmtAxx7RL0jzhZ93zBN4HY/Zcnrd9tXoPPxi0mG
+ZZWfFU6nN8nOkMHWzEbHVBmhxpfGtwmLcajQ4HrK1TZwJUn6GqclHQRy/gjxkiw5
+KPqzfVOVlA6ht4KdKstKazQkWZ5gdWT4d8yrEy/IT4oaW05xALBMQ7YGjkzWKsSF
+6ygXI7xqF9rg9jCnUsPYg4f8ut3N0c00KjsfKOOj2dF/ZyjedQ5c0u4hHmxSo3Ka
+0ZTmIrMfbVXgGjxRG2HZXLpPvQKoCf/fOX8Irdr+lahFVKASxN0CAwEAAaOCAQYw
+ggECMIHLBgNVHSMEgcMwgcChgbKkga8wgawxCzAJBgNVBAYTAlVTMRQwEgYDVQQI
+DAtSYW5kb21TdGF0ZTETMBEGA1UEBwwKUmFuZG9tQ2l0eTEbMBkGA1UECgwSUmFu
+ZG9tT3JnYW5pemF0aW9uMR8wHQYDVQQLDBZSYW5kb21Pcmdhbml6YXRpb25Vbml0
+MSAwHgYJKoZIhvcNAQkBFhFoZWxsb0BleGFtcGxlLmNvbTESMBAGA1UEAwwJbG9j
+YWxob3N0ggkAhuCQXkounA4wCQYDVR0TBAIwADALBgNVHQ8EBAMCBPAwGgYDVR0R
+BBMwEYIJbG9jYWxob3N0hwR/AAABMA0GCSqGSIb3DQEBCwUAA4IBAQCWmh5ebpkm
+v2B1yQgarSCSSkLZ5DZSAJjrPgW2IJqCW2q2D1HworbW1Yn5jqrM9FKGnJfjCyve
+zBB5AOlGp+0bsZGgMRMCavgv4QhTThXUoJqqHcfEu4wHndcgrqSadxmV5aisSR4u
+gXnjW43o3akby+h1K40RR3vVkpzPaoC3/bgk7WVpfpPiP32E24a01gETozRb/of/
+ATN3JBe0xh+e63CrPX1sago5+u3UETIoOr0fW8M/gU9GApmJiFAXwHag6j54hLCG
+23EtVDwmlarG8Pj+i0yru8s22QqzAJi5E0OwR4aB8tqicLKYBVfzyLCOielIBUrK
+OkuFKp+VjxQX
+-----END CERTIFICATE-----
diff --git a/connector/gitlab/testdata/server.key b/connector/gitlab/testdata/server.key
new file mode 100644
index 0000000000..9708e1e6ea
--- /dev/null
+++ b/connector/gitlab/testdata/server.key
@@ -0,0 +1,28 @@
+-----BEGIN PRIVATE KEY-----
+MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQDLinaVz/O0OyoN
+4mn187wblSMldSuVJjGIjZKM7ZAuV6wsx2kEUvwqCG+/51KprQMce0S9I84Wfd8w
+TeB2P2XJ63fbV6Dz8YtJhmWVnxVOpzfJzpDB1sxGx1QZocaXxrcJi3Go0OB6ytU2
+cCVJ+hqnJR0Ecv4I8ZIsOSj6s31TlZQOobeCnSrLSms0JFmeYHVk+HfMqxMvyE+K
+GltOcQCwTEO2Bo5M1irEhesoFyO8ahfa4PYwp1LD2IOH/LrdzdHNNCo7Hyjjo9nR
+f2co3nUOXNLuIR5sUqNymtGU5iKzH21V4Bo8URth2Vy6T70CqAn/3zl/CK3a/pWo
+RVSgEsTdAgMBAAECggEAU6cxu7q+54kVbKVsdThaTF/MFR4F7oPHAd9lpuQQSOuh
+iLngMHXGy6OyAgYZlEDWMYN8KdwoXFgZPaoUIaVGuWk8Vnq6XOgeHfbNk2PRhwT0
+yc1K80/Lnx9XMj2p+EEkgxi7eu12BSGN5ZTLzo6rG50GQwjb3WMjd2d6rybL0GjC
+wg2arcBk3sSMYmvZOqlAsaQmtgwkJhvhVkVfEQSD3VKF7g0dh/h3LIPyM0Ff4M67
+KpLMPPwzUJ/0Z4ewAP06mMKUA86R93M+dWs2eh1oBGnRkVQdhCJLXJpuGHZ6BTiB
+Ry0AeorHfnVXPbtpUeAq6m5/BBl6qX0ooB08BIFwAQKBgQDqJpTZS/ZzqL6Kcs14
+MyFu+7DungSxQ5oK9ju7EFSosanSk4UEa/lw992kM6nsIMwgSVQgba5zKcVMeSmk
+AVbpznegQD1BYCwOGwbGvkJ8jbhPy+WLbbRjWT/E6AItZgUK+fyTIcNvSehcQqsT
+fhgWsK7ueZCmLQfVhK1AxtvY3QKBgQDeiKuo8plsH/7IxDn7KVHBOHKPC2ZPzg03
+i7La6zomiRckwwPnhicRSYsjtfCCW6Ms+uzjTEItgFM+5PdrXheeku+z/sExRtZu
+emqPqDomixlXDRQ6RN3gnBSk4RU+ROB1u1uBLWXqRz8Gp2zJGRxhHfYt2zefBv4w
+/cIuPC3cAQKBgD2UsAkGJWb9tj8LOmama+CYaUwYWvuT3+uKHuNvxBQpxZQQICet
+jgjb53rL66Cib4z+PBXbQsoe7jjSlNUBVS5gkq2et31+IZgEG6AhYbMIQrUZ1uD4
+lTybuF289vWhoynj3T2E37VhJq89CWky/HrbNOabKiPKLAlHv5kNs7wxAoGBANEJ
+XQbU7J2O6Iy7FyQBSlTQq3wHX1Iz4mJ9DcNrFzK/sEfOEMrZT7WDefpPm984KW3F
+P+S766ZGVuxLtMbcmh9RM23HLr8VJbSdtZ/AjO9L1r/Y/1lE+49TzmibLpNRq++r
+0WbkuEl8J44ek6fLuMbZmDi3JeZycTCgDlnUGdgBAoGAYdliovtURZCm46t1uE3F
+idCLCXCccjkt1hcNGNjck/b0trHA7wOEqICIguoWDlEBTc0PDvHEq6PfKyqptGkj
+AgaZTMF/aZiGqlT7VRpBuzxM/uV5xzCg+i2ViaW/p3xq0z2PRljVZiEfe5aWcjiM
+ouTtnC3TgmcjhTgGmb48QQE=
+-----END PRIVATE KEY-----
diff --git a/connector/google/google.go b/connector/google/google.go
index 72cc6a18a5..68bdf18ccd 100644
--- a/connector/google/google.go
+++ b/connector/google/google.go
@@ -5,23 +5,28 @@ import (
 	"context"
 	"errors"
 	"fmt"
+	"log/slog"
 	"net/http"
 	"os"
+	"strings"
 	"time"
 
+	"cloud.google.com/go/compute/metadata"
 	"github.com/coreos/go-oidc/v3/oidc"
+	"golang.org/x/exp/slices"
 	"golang.org/x/oauth2"
 	"golang.org/x/oauth2/google"
 	admin "google.golang.org/api/admin/directory/v1"
+	"google.golang.org/api/impersonate"
 	"google.golang.org/api/option"
 
 	"github.com/dexidp/dex/connector"
 	pkg_groups "github.com/dexidp/dex/pkg/groups"
-	"github.com/dexidp/dex/pkg/log"
 )
 
 const (
-	issuerURL = "https://accounts.google.com"
+	issuerURL                  = "https://accounts.google.com"
+	wildcardDomainToAdminEmail = "*"
 )
 
 // Config holds configuration options for Google logins.
@@ -45,17 +50,33 @@ type Config struct {
 	// check groups with the admin directory api
 	ServiceAccountFilePath string `json:"serviceAccountFilePath"`
 
+	// Deprecated: Use DomainToAdminEmail
+	AdminEmail string
+
 	// Required if ServiceAccountFilePath
-	// The email of a GSuite super user which the service account will impersonate
+	// The map workspace domain to email of a GSuite super user which the service account will impersonate
 	// when listing groups
-	AdminEmail string
+	DomainToAdminEmail map[string]string
 
 	// If this field is true, fetch direct group membership and transitive group membership
 	FetchTransitiveGroupMembership bool `json:"fetchTransitiveGroupMembership"`
+
+	// Optional value for the prompt parameter, defaults to consent when offline_access
+	// scope is requested
+	PromptType *string `json:"promptType"`
 }
 
 // Open returns a connector which can be used to login users through Google.
-func (c *Config) Open(id string, logger log.Logger) (conn connector.Connector, err error) {
+func (c *Config) Open(id string, logger *slog.Logger) (conn connector.Connector, err error) {
+	logger = logger.With(slog.Group("connector", "type", "google", "id", id))
+	if c.AdminEmail != "" {
+		logger.Warn(`use "domainToAdminEmail.*" option instead of "adminEmail"`, "deprecated", true)
+		if c.DomainToAdminEmail == nil {
+			c.DomainToAdminEmail = make(map[string]string)
+		}
+
+		c.DomainToAdminEmail[wildcardDomainToAdminEmail] = c.AdminEmail
+	}
 	ctx, cancel := context.WithCancel(context.Background())
 
 	provider, err := oidc.NewProvider(ctx, issuerURL)
@@ -71,10 +92,30 @@ func (c *Config) Open(id string, logger log.Logger) (conn connector.Connector, e
 		scopes = append(scopes, "profile", "email")
 	}
 
-	srv, err := createDirectoryService(c.ServiceAccountFilePath, c.AdminEmail, logger)
-	if err != nil {
+	adminSrv := make(map[string]*admin.Service)
+
+	// We know impersonation is required when using a service account credential
+	// TODO: or is it?
+	if len(c.DomainToAdminEmail) == 0 && c.ServiceAccountFilePath != "" {
 		cancel()
-		return nil, fmt.Errorf("could not create directory service: %v", err)
+		return nil, fmt.Errorf("directory service requires the domainToAdminEmail option to be configured")
+	}
+
+	if (len(c.DomainToAdminEmail) > 0) || slices.Contains(scopes, "groups") {
+		for domain, adminEmail := range c.DomainToAdminEmail {
+			srv, err := createDirectoryService(c.ServiceAccountFilePath, adminEmail, logger)
+			if err != nil {
+				cancel()
+				return nil, fmt.Errorf("could not create directory service: %v", err)
+			}
+
+			adminSrv[domain] = srv
+		}
+	}
+
+	promptType := "consent"
+	if c.PromptType != nil {
+		promptType = *c.PromptType
 	}
 
 	clientID := c.ClientID
@@ -95,9 +136,10 @@ func (c *Config) Open(id string, logger log.Logger) (conn connector.Connector, e
 		hostedDomains:                  c.HostedDomains,
 		groups:                         c.Groups,
 		serviceAccountFilePath:         c.ServiceAccountFilePath,
-		adminEmail:                     c.AdminEmail,
+		domainToAdminEmail:             c.DomainToAdminEmail,
 		fetchTransitiveGroupMembership: c.FetchTransitiveGroupMembership,
-		adminSrv:                       srv,
+		adminSrv:                       adminSrv,
+		promptType:                     promptType,
 	}, nil
 }
 
@@ -111,13 +153,14 @@ type googleConnector struct {
 	oauth2Config                   *oauth2.Config
 	verifier                       *oidc.IDTokenVerifier
 	cancel                         context.CancelFunc
-	logger                         log.Logger
+	logger                         *slog.Logger
 	hostedDomains                  []string
 	groups                         []string
 	serviceAccountFilePath         string
-	adminEmail                     string
+	domainToAdminEmail             map[string]string
 	fetchTransitiveGroupMembership bool
-	adminSrv                       *admin.Service
+	adminSrv                       map[string]*admin.Service
+	promptType                     string
 }
 
 func (c *googleConnector) Close() error {
@@ -125,9 +168,9 @@ func (c *googleConnector) Close() error {
 	return nil
 }
 
-func (c *googleConnector) LoginURL(s connector.Scopes, callbackURL, state string) (string, error) {
+func (c *googleConnector) LoginURL(s connector.Scopes, callbackURL, state string) (string, []byte, error) {
 	if c.redirectURI != callbackURL {
-		return "", fmt.Errorf("expected callback URL %q did not match the URL in the config %q", callbackURL, c.redirectURI)
+		return "", nil, fmt.Errorf("expected callback URL %q did not match the URL in the config %q", callbackURL, c.redirectURI)
 	}
 
 	var opts []oauth2.AuthCodeOption
@@ -140,9 +183,10 @@ func (c *googleConnector) LoginURL(s connector.Scopes, callbackURL, state string
 	}
 
 	if s.OfflineAccess {
-		opts = append(opts, oauth2.AccessTypeOffline, oauth2.SetAuthURLParam("prompt", "consent"))
+		opts = append(opts, oauth2.AccessTypeOffline, oauth2.SetAuthURLParam("prompt", c.promptType))
 	}
-	return c.oauth2Config.AuthCodeURL(state, opts...), nil
+
+	return c.oauth2Config.AuthCodeURL(state, opts...), nil, nil
 }
 
 type oauth2Error struct {
@@ -157,7 +201,7 @@ func (e *oauth2Error) Error() string {
 	return e.error + ": " + e.errorDescription
 }
 
-func (c *googleConnector) HandleCallback(s connector.Scopes, r *http.Request) (identity connector.Identity, err error) {
+func (c *googleConnector) HandleCallback(s connector.Scopes, connData []byte, r *http.Request) (identity connector.Identity, err error) {
 	q := r.URL.Query()
 	if errType := q.Get("error"); errType != "" {
 		return identity, &oauth2Error{errType, q.Get("error_description")}
@@ -203,6 +247,15 @@ func (c *googleConnector) createIdentity(ctx context.Context, identity connector
 		return identity, fmt.Errorf("oidc: failed to decode claims: %v", err)
 	}
 
+	// Google sometimes do not return username and other claims. It is correct, according to OIDC spec.
+	// One option to solve this is to call the user endpoint, but Google throttles it more aggressive than
+	// the token endpoint. For concurrent refreshes it is an unwanted behavior.
+	// As a tradeoff, dex preserves previous username and preferred username if absent in the ide token
+	// as a way to keep the claims and do not call the userinfo endpoint.
+	if claims.Username == "" {
+		claims.Username = identity.Username
+	}
+
 	if len(c.hostedDomains) > 0 {
 		found := false
 		for _, domain := range c.hostedDomains {
@@ -218,8 +271,9 @@ func (c *googleConnector) createIdentity(ctx context.Context, identity connector
 	}
 
 	var groups []string
-	if s.Groups && c.adminSrv != nil {
-		groups, err = c.getGroups(claims.Email, c.fetchTransitiveGroupMembership)
+	if s.Groups && len(c.adminSrv) > 0 {
+		checkedGroups := make(map[string]struct{})
+		groups, err = c.getGroups(claims.Email, c.fetchTransitiveGroupMembership, checkedGroups)
 		if err != nil {
 			return identity, fmt.Errorf("google: could not retrieve groups: %v", err)
 		}
@@ -245,30 +299,43 @@ func (c *googleConnector) createIdentity(ctx context.Context, identity connector
 
 // getGroups creates a connection to the admin directory service and lists
 // all groups the user is a member of
-func (c *googleConnector) getGroups(email string, fetchTransitiveGroupMembership bool) ([]string, error) {
+func (c *googleConnector) getGroups(email string, fetchTransitiveGroupMembership bool, checkedGroups map[string]struct{}) ([]string, error) {
 	var userGroups []string
 	var err error
 	groupsList := &admin.Groups{}
+	domain := c.extractDomainFromEmail(email)
+	adminSrv, err := c.findAdminService(domain)
+	if err != nil {
+		return nil, err
+	}
+
 	for {
-		groupsList, err = c.adminSrv.Groups.List().
+		groupsList, err = adminSrv.Groups.List().
 			UserKey(email).PageToken(groupsList.NextPageToken).Do()
 		if err != nil {
 			return nil, fmt.Errorf("could not list groups: %v", err)
 		}
 
 		for _, group := range groupsList.Groups {
+			if _, exists := checkedGroups[group.Email]; exists {
+				continue
+			}
+
+			checkedGroups[group.Email] = struct{}{}
 			// TODO (joelspeed): Make desired group key configurable
 			userGroups = append(userGroups, group.Email)
 
-			// getGroups takes a user's email/alias as well as a group's email/alias
-			if fetchTransitiveGroupMembership {
-				transitiveGroups, err := c.getGroups(group.Email, fetchTransitiveGroupMembership)
-				if err != nil {
-					return nil, fmt.Errorf("could not list transitive groups: %v", err)
-				}
+			if !fetchTransitiveGroupMembership {
+				continue
+			}
 
-				userGroups = append(userGroups, transitiveGroups...)
+			// getGroups takes a user's email/alias as well as a group's email/alias
+			transitiveGroups, err := c.getGroups(group.Email, fetchTransitiveGroupMembership, checkedGroups)
+			if err != nil {
+				return nil, fmt.Errorf("could not list transitive groups: %v", err)
 			}
+
+			userGroups = append(userGroups, transitiveGroups...)
 		}
 
 		if groupsList.NextPageToken == "" {
@@ -276,51 +343,124 @@ func (c *googleConnector) getGroups(email string, fetchTransitiveGroupMembership
 		}
 	}
 
-	return uniqueGroups(userGroups), nil
+	return userGroups, nil
+}
+
+func (c *googleConnector) findAdminService(domain string) (*admin.Service, error) {
+	adminSrv, ok := c.adminSrv[domain]
+	if !ok {
+		adminSrv, ok = c.adminSrv[wildcardDomainToAdminEmail]
+		c.logger.Debug("using wildcard admin email to fetch groups", "admin_email", c.domainToAdminEmail[wildcardDomainToAdminEmail])
+	}
+
+	if !ok {
+		return nil, fmt.Errorf("unable to find super admin email, domainToAdminEmail for domain: %s not set, %s is also empty", domain, wildcardDomainToAdminEmail)
+	}
+
+	return adminSrv, nil
+}
+
+// extracts the domain name from an email input. If the email is valid, it returns the domain name after the "@" symbol.
+// However, in the case of a broken or invalid email, it returns a wildcard symbol.
+func (c *googleConnector) extractDomainFromEmail(email string) string {
+	at := strings.LastIndex(email, "@")
+	if at >= 0 {
+		_, domain := email[:at], email[at+1:]
+
+		return domain
+	}
+
+	return wildcardDomainToAdminEmail
+}
+
+// getCredentialsFromFilePath reads and returns the service account credentials from the file at the provided path.
+// If an error occurs during the read, it is returned.
+func getCredentialsFromFilePath(serviceAccountFilePath string) ([]byte, error) {
+	jsonCredentials, err := os.ReadFile(serviceAccountFilePath)
+	if err != nil {
+		return nil, fmt.Errorf("error reading credentials from file: %v", err)
+	}
+	return jsonCredentials, nil
+}
+
+// getCredentialsFromDefault retrieves the application's default credentials.
+// If the default credential is empty, it attempts to create a new service with metadata credentials.
+// If successful, it returns the service and nil error.
+// If unsuccessful, it returns the error and a nil service.
+func getCredentialsFromDefault(ctx context.Context, email string, logger *slog.Logger) ([]byte, *admin.Service, error) {
+	credential, err := google.FindDefaultCredentials(ctx)
+	if err != nil {
+		return nil, nil, fmt.Errorf("failed to fetch application default credentials: %w", err)
+	}
+
+	if credential.JSON == nil {
+		logger.Info("JSON is empty, using flow for GCE")
+		service, err := createServiceWithMetadataServer(ctx, email, logger)
+		if err != nil {
+			return nil, nil, err
+		}
+		return nil, service, nil
+	}
+
+	return credential.JSON, nil, nil
+}
+
+// createServiceWithMetadataServer creates a new service using metadata server.
+// If an error occurs during the process, it is returned along with a nil service.
+func createServiceWithMetadataServer(ctx context.Context, adminEmail string, logger *slog.Logger) (*admin.Service, error) {
+	serviceAccountEmail, err := metadata.EmailWithContext(ctx, "default")
+	logger.Info("discovered serviceAccountEmail", "email", serviceAccountEmail)
+
+	if err != nil {
+		return nil, fmt.Errorf("unable to get service account email from metadata server: %v", err)
+	}
+
+	config := impersonate.CredentialsConfig{
+		TargetPrincipal: serviceAccountEmail,
+		Scopes:          []string{admin.AdminDirectoryGroupReadonlyScope},
+		Lifetime:        0,
+		Subject:         adminEmail,
+	}
+
+	tokenSource, err := impersonate.CredentialsTokenSource(ctx, config)
+	if err != nil {
+		return nil, fmt.Errorf("unable to impersonate with %s, error: %v", adminEmail, err)
+	}
+
+	return admin.NewService(ctx, option.WithHTTPClient(oauth2.NewClient(ctx, tokenSource)))
 }
 
 // createDirectoryService sets up super user impersonation and creates an admin client for calling
 // the google admin api. If no serviceAccountFilePath is defined, the application default credential
 // is used.
-func createDirectoryService(serviceAccountFilePath, email string, logger log.Logger) (*admin.Service, error) {
-	if email == "" {
-		return nil, fmt.Errorf("directory service requires adminEmail")
-	}
-
+func createDirectoryService(serviceAccountFilePath, email string, logger *slog.Logger) (service *admin.Service, err error) {
 	var jsonCredentials []byte
-	var err error
 
 	ctx := context.Background()
 	if serviceAccountFilePath == "" {
 		logger.Warn("the application default credential is used since the service account file path is not used")
-		credential, err := google.FindDefaultCredentials(ctx)
+		jsonCredentials, service, err = getCredentialsFromDefault(ctx, email, logger)
 		if err != nil {
-			return nil, fmt.Errorf("failed to fetch application default credentials: %w", err)
+			return
+		}
+		if service != nil {
+			return
 		}
-		jsonCredentials = credential.JSON
 	} else {
-		jsonCredentials, err = os.ReadFile(serviceAccountFilePath)
+		jsonCredentials, err = getCredentialsFromFilePath(serviceAccountFilePath)
 		if err != nil {
-			return nil, fmt.Errorf("error reading credentials from file: %v", err)
+			return
 		}
 	}
 	config, err := google.JWTConfigFromJSON(jsonCredentials, admin.AdminDirectoryGroupReadonlyScope)
 	if err != nil {
-		return nil, fmt.Errorf("unable to parse credentials to config: %v", err)
+		return nil, fmt.Errorf("unable to parse client secret file to config: %v", err)
 	}
-	config.Subject = email
-	return admin.NewService(ctx, option.WithHTTPClient(config.Client(ctx)))
-}
 
-// uniqueGroups returns the unique groups of a slice
-func uniqueGroups(groups []string) []string {
-	keys := make(map[string]struct{})
-	unique := []string{}
-	for _, group := range groups {
-		if _, exists := keys[group]; !exists {
-			keys[group] = struct{}{}
-			unique = append(unique, group)
-		}
+	// Only attempt impersonation when there is a user configured
+	if email != "" {
+		config.Subject = email
 	}
-	return unique
+
+	return admin.NewService(ctx, option.WithHTTPClient(config.Client(ctx)))
 }
diff --git a/connector/google/google_test.go b/connector/google/google_test.go
index 5cecbec994..ce0e017cf8 100644
--- a/connector/google/google_test.go
+++ b/connector/google/google_test.go
@@ -1,31 +1,57 @@
 package google
 
 import (
+	"context"
 	"encoding/json"
 	"fmt"
+	"log/slog"
 	"net/http"
 	"net/http/httptest"
+	"net/url"
 	"os"
+	"strings"
 	"testing"
 
-	"github.com/sirupsen/logrus"
 	"github.com/stretchr/testify/assert"
+	admin "google.golang.org/api/admin/directory/v1"
+	"google.golang.org/api/option"
+
+	"github.com/dexidp/dex/connector"
+)
+
+var (
+	//			groups_0
+	//		┌───────┤
+	//  groups_2 groups_1
+	//		│		├────────┐
+	//		└──	 user_1	  user_2
+	testGroups = map[string][]*admin.Group{
+		"user_1@dexidp.com":   {{Email: "groups_2@dexidp.com"}, {Email: "groups_1@dexidp.com"}},
+		"user_2@dexidp.com":   {{Email: "groups_1@dexidp.com"}},
+		"groups_1@dexidp.com": {{Email: "groups_0@dexidp.com"}},
+		"groups_2@dexidp.com": {{Email: "groups_0@dexidp.com"}},
+		"groups_0@dexidp.com": {},
+	}
+	callCounter = make(map[string]int)
 )
 
-func testSetup(t *testing.T) *httptest.Server {
+func testSetup() *httptest.Server {
 	mux := http.NewServeMux()
-	// TODO: mock calls
-	// mux.HandleFunc("/admin/directory/v1/groups", func(w http.ResponseWriter, r *http.Request) {
-	// 	w.Header().Add("Content-Type", "application/json")
-	// 	json.NewEncoder(w).Encode(&admin.Groups{
-	// 		Groups: []*admin.Group{},
-	// 	})
-	// })
+
+	mux.HandleFunc("/admin/directory/v1/groups/", func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Add("Content-Type", "application/json")
+		userKey := r.URL.Query().Get("userKey")
+		if groups, ok := testGroups[userKey]; ok {
+			json.NewEncoder(w).Encode(admin.Groups{Groups: groups})
+			callCounter[userKey]++
+		}
+	})
+
 	return httptest.NewServer(mux)
 }
 
-func newConnector(config *Config, serverURL string) (*googleConnector, error) {
-	log := logrus.New()
+func newConnector(config *Config) (*googleConnector, error) {
+	log := slog.New(slog.DiscardHandler)
 	conn, err := config.Open("id", log)
 	if err != nil {
 		return nil, err
@@ -56,7 +82,7 @@ func tempServiceAccountKey() (string, error) {
 }
 
 func TestOpen(t *testing.T) {
-	ts := testSetup(t)
+	ts := testSetup()
 	defer ts.Close()
 
 	type testCase struct {
@@ -64,7 +90,7 @@ func TestOpen(t *testing.T) {
 		expectedErr string
 
 		// string to set in GOOGLE_APPLICATION_CREDENTIALS. As local development environments can
-		// already contain ADC, test cases will be built uppon this setting this env variable
+		// already contain ADC, test cases will be built upon this setting this env variable
 		adc string
 	}
 
@@ -74,12 +100,13 @@ func TestOpen(t *testing.T) {
 	for name, reference := range map[string]testCase{
 		"missing_admin_email": {
 			config: &Config{
-				ClientID:     "testClient",
-				ClientSecret: "testSecret",
-				RedirectURI:  ts.URL + "/callback",
-				Scopes:       []string{"openid", "groups"},
+				ClientID:               "testClient",
+				ClientSecret:           "testSecret",
+				RedirectURI:            ts.URL + "/callback",
+				Scopes:                 []string{"openid", "groups"},
+				ServiceAccountFilePath: serviceAccountFilePath,
 			},
-			expectedErr: "requires adminEmail",
+			expectedErr: "requires the domainToAdminEmail",
 		},
 		"service_account_key_not_found": {
 			config: &Config{
@@ -87,7 +114,7 @@ func TestOpen(t *testing.T) {
 				ClientSecret:           "testSecret",
 				RedirectURI:            ts.URL + "/callback",
 				Scopes:                 []string{"openid", "groups"},
-				AdminEmail:             "foo@bar.com",
+				DomainToAdminEmail:     map[string]string{"*": "foo@bar.com"},
 				ServiceAccountFilePath: "not_found.json",
 			},
 			expectedErr: "error reading credentials",
@@ -98,18 +125,18 @@ func TestOpen(t *testing.T) {
 				ClientSecret:           "testSecret",
 				RedirectURI:            ts.URL + "/callback",
 				Scopes:                 []string{"openid", "groups"},
-				AdminEmail:             "foo@bar.com",
+				DomainToAdminEmail:     map[string]string{"bar.com": "foo@bar.com"},
 				ServiceAccountFilePath: serviceAccountFilePath,
 			},
 			expectedErr: "",
 		},
 		"adc": {
 			config: &Config{
-				ClientID:     "testClient",
-				ClientSecret: "testSecret",
-				RedirectURI:  ts.URL + "/callback",
-				Scopes:       []string{"openid", "groups"},
-				AdminEmail:   "foo@bar.com",
+				ClientID:           "testClient",
+				ClientSecret:       "testSecret",
+				RedirectURI:        ts.URL + "/callback",
+				Scopes:             []string{"openid", "groups"},
+				DomainToAdminEmail: map[string]string{"*": "foo@bar.com"},
 			},
 			adc:         serviceAccountFilePath,
 			expectedErr: "",
@@ -120,7 +147,7 @@ func TestOpen(t *testing.T) {
 				ClientSecret:           "testSecret",
 				RedirectURI:            ts.URL + "/callback",
 				Scopes:                 []string{"openid", "groups"},
-				AdminEmail:             "foo@bar.com",
+				DomainToAdminEmail:     map[string]string{"*": "foo@bar.com"},
 				ServiceAccountFilePath: serviceAccountFilePath,
 			},
 			adc:         "/dev/null",
@@ -132,7 +159,7 @@ func TestOpen(t *testing.T) {
 			assert := assert.New(t)
 
 			os.Setenv("GOOGLE_APPLICATION_CREDENTIALS", reference.adc)
-			conn, err := newConnector(reference.config, ts.URL)
+			conn, err := newConnector(reference.config)
 
 			if reference.expectedErr == "" {
 				assert.Nil(err)
@@ -143,3 +170,282 @@ func TestOpen(t *testing.T) {
 		})
 	}
 }
+
+func TestGetGroups(t *testing.T) {
+	ts := testSetup()
+	defer ts.Close()
+
+	serviceAccountFilePath, err := tempServiceAccountKey()
+	assert.Nil(t, err)
+
+	os.Setenv("GOOGLE_APPLICATION_CREDENTIALS", serviceAccountFilePath)
+	conn, err := newConnector(&Config{
+		ClientID:           "testClient",
+		ClientSecret:       "testSecret",
+		RedirectURI:        ts.URL + "/callback",
+		Scopes:             []string{"openid", "groups"},
+		DomainToAdminEmail: map[string]string{"*": "admin@dexidp.com"},
+	})
+	assert.Nil(t, err)
+
+	conn.adminSrv[wildcardDomainToAdminEmail], err = admin.NewService(context.Background(), option.WithoutAuthentication(), option.WithEndpoint(ts.URL))
+	assert.Nil(t, err)
+	type testCase struct {
+		userKey                        string
+		fetchTransitiveGroupMembership bool
+		shouldErr                      bool
+		expectedGroups                 []string
+	}
+
+	for name, testCase := range map[string]testCase{
+		"user1_non_transitive_lookup": {
+			userKey:                        "user_1@dexidp.com",
+			fetchTransitiveGroupMembership: false,
+			shouldErr:                      false,
+			expectedGroups:                 []string{"groups_1@dexidp.com", "groups_2@dexidp.com"},
+		},
+		"user1_transitive_lookup": {
+			userKey:                        "user_1@dexidp.com",
+			fetchTransitiveGroupMembership: true,
+			shouldErr:                      false,
+			expectedGroups:                 []string{"groups_0@dexidp.com", "groups_1@dexidp.com", "groups_2@dexidp.com"},
+		},
+		"user2_non_transitive_lookup": {
+			userKey:                        "user_2@dexidp.com",
+			fetchTransitiveGroupMembership: false,
+			shouldErr:                      false,
+			expectedGroups:                 []string{"groups_1@dexidp.com"},
+		},
+		"user2_transitive_lookup": {
+			userKey:                        "user_2@dexidp.com",
+			fetchTransitiveGroupMembership: true,
+			shouldErr:                      false,
+			expectedGroups:                 []string{"groups_0@dexidp.com", "groups_1@dexidp.com"},
+		},
+	} {
+		testCase := testCase
+		callCounter = map[string]int{}
+		t.Run(name, func(t *testing.T) {
+			assert := assert.New(t)
+			lookup := make(map[string]struct{})
+
+			groups, err := conn.getGroups(testCase.userKey, testCase.fetchTransitiveGroupMembership, lookup)
+			if testCase.shouldErr {
+				assert.NotNil(err)
+			} else {
+				assert.Nil(err)
+			}
+			assert.ElementsMatch(testCase.expectedGroups, groups)
+			t.Logf("[%s] Amount of API calls per userKey: %+v\n", t.Name(), callCounter)
+		})
+	}
+}
+
+func TestDomainToAdminEmailConfig(t *testing.T) {
+	ts := testSetup()
+	defer ts.Close()
+
+	serviceAccountFilePath, err := tempServiceAccountKey()
+	assert.Nil(t, err)
+
+	os.Setenv("GOOGLE_APPLICATION_CREDENTIALS", serviceAccountFilePath)
+	conn, err := newConnector(&Config{
+		ClientID:           "testClient",
+		ClientSecret:       "testSecret",
+		RedirectURI:        ts.URL + "/callback",
+		Scopes:             []string{"openid", "groups"},
+		DomainToAdminEmail: map[string]string{"dexidp.com": "admin@dexidp.com"},
+	})
+	assert.Nil(t, err)
+
+	conn.adminSrv["dexidp.com"], err = admin.NewService(context.Background(), option.WithoutAuthentication(), option.WithEndpoint(ts.URL))
+	assert.Nil(t, err)
+	type testCase struct {
+		userKey     string
+		expectedErr string
+	}
+
+	for name, testCase := range map[string]testCase{
+		"correct_user_request": {
+			userKey:     "user_1@dexidp.com",
+			expectedErr: "",
+		},
+		"wrong_user_request": {
+			userKey:     "user_1@foo.bar",
+			expectedErr: "unable to find super admin email",
+		},
+		"wrong_connector_response": {
+			userKey:     "user_1_foo.bar",
+			expectedErr: "unable to find super admin email",
+		},
+	} {
+		testCase := testCase
+		callCounter = map[string]int{}
+		t.Run(name, func(t *testing.T) {
+			assert := assert.New(t)
+			lookup := make(map[string]struct{})
+
+			_, err := conn.getGroups(testCase.userKey, true, lookup)
+			if testCase.expectedErr != "" {
+				assert.ErrorContains(err, testCase.expectedErr)
+			} else {
+				assert.Nil(err)
+			}
+			t.Logf("[%s] Amount of API calls per userKey: %+v\n", t.Name(), callCounter)
+		})
+	}
+}
+
+var gceMetadataFlags = map[string]bool{
+	"failOnEmailRequest": false,
+}
+
+func mockGCEMetadataServer() *httptest.Server {
+	mux := http.NewServeMux()
+
+	mux.HandleFunc("/computeMetadata/v1/instance/service-accounts/default/email", func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Add("Content-Type", "application/json")
+		if gceMetadataFlags["failOnEmailRequest"] {
+			w.WriteHeader(http.StatusBadRequest)
+		}
+		json.NewEncoder(w).Encode("my-service-account@example-project.iam.gserviceaccount.com")
+	})
+	mux.HandleFunc("/computeMetadata/v1/instance/service-accounts/default/token", func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Add("Content-Type", "application/json")
+		json.NewEncoder(w).Encode(struct {
+			AccessToken  string `json:"access_token"`
+			ExpiresInSec int    `json:"expires_in"`
+			TokenType    string `json:"token_type"`
+		}{
+			AccessToken:  "my-example.token",
+			ExpiresInSec: 3600,
+			TokenType:    "Bearer",
+		})
+	})
+
+	return httptest.NewServer(mux)
+}
+
+func TestGCEWorkloadIdentity(t *testing.T) {
+	ts := testSetup()
+	defer ts.Close()
+
+	metadataServer := mockGCEMetadataServer()
+	defer metadataServer.Close()
+	metadataServerHost := strings.Replace(metadataServer.URL, "http://", "", 1)
+
+	os.Setenv("GCE_METADATA_HOST", metadataServerHost)
+	os.Setenv("GOOGLE_APPLICATION_CREDENTIALS", "")
+	os.Setenv("HOME", "/tmp")
+
+	gceMetadataFlags["failOnEmailRequest"] = true
+	_, err := newConnector(&Config{
+		ClientID:           "testClient",
+		ClientSecret:       "testSecret",
+		RedirectURI:        ts.URL + "/callback",
+		Scopes:             []string{"openid", "groups"},
+		DomainToAdminEmail: map[string]string{"dexidp.com": "admin@dexidp.com"},
+	})
+	assert.Error(t, err)
+
+	gceMetadataFlags["failOnEmailRequest"] = false
+	conn, err := newConnector(&Config{
+		ClientID:           "testClient",
+		ClientSecret:       "testSecret",
+		RedirectURI:        ts.URL + "/callback",
+		Scopes:             []string{"openid", "groups"},
+		DomainToAdminEmail: map[string]string{"dexidp.com": "admin@dexidp.com"},
+	})
+	assert.Nil(t, err)
+
+	conn.adminSrv["dexidp.com"], err = admin.NewService(context.Background(), option.WithoutAuthentication(), option.WithEndpoint(ts.URL))
+	assert.Nil(t, err)
+	type testCase struct {
+		userKey     string
+		expectedErr string
+	}
+
+	for name, testCase := range map[string]testCase{
+		"correct_user_request": {
+			userKey:     "user_1@dexidp.com",
+			expectedErr: "",
+		},
+		"wrong_user_request": {
+			userKey:     "user_1@foo.bar",
+			expectedErr: "unable to find super admin email",
+		},
+		"wrong_connector_response": {
+			userKey:     "user_1_foo.bar",
+			expectedErr: "unable to find super admin email",
+		},
+	} {
+		t.Run(name, func(t *testing.T) {
+			assert := assert.New(t)
+			lookup := make(map[string]struct{})
+
+			_, err := conn.getGroups(testCase.userKey, true, lookup)
+			if testCase.expectedErr != "" {
+				assert.ErrorContains(err, testCase.expectedErr)
+			} else {
+				assert.Nil(err)
+			}
+		})
+	}
+}
+
+func TestPromptTypeConfig(t *testing.T) {
+	promptTypeLogin := "login"
+	cases := []struct {
+		name                    string
+		promptType              *string
+		expectedPromptTypeValue string
+	}{
+		{
+			name:                    "prompt type is nil",
+			promptType:              nil,
+			expectedPromptTypeValue: "consent",
+		},
+		{
+			name:                    "prompt type is empty",
+			promptType:              new(string),
+			expectedPromptTypeValue: "",
+		},
+		{
+			name:                    "prompt type is set",
+			promptType:              &promptTypeLogin,
+			expectedPromptTypeValue: "login",
+		},
+	}
+
+	ts := testSetup()
+	defer ts.Close()
+
+	serviceAccountFilePath, err := tempServiceAccountKey()
+	assert.Nil(t, err)
+
+	os.Setenv("GOOGLE_APPLICATION_CREDENTIALS", serviceAccountFilePath)
+
+	for _, test := range cases {
+		t.Run(test.name, func(t *testing.T) {
+			conn, err := newConnector(&Config{
+				ClientID:           "testClient",
+				ClientSecret:       "testSecret",
+				RedirectURI:        ts.URL + "/callback",
+				Scopes:             []string{"openid", "groups", "offline_access"},
+				DomainToAdminEmail: map[string]string{"dexidp.com": "admin@dexidp.com"},
+				PromptType:         test.promptType,
+			})
+
+			assert.Nil(t, err)
+			assert.Equal(t, test.expectedPromptTypeValue, conn.promptType)
+
+			loginURL, _, err := conn.LoginURL(connector.Scopes{OfflineAccess: true}, ts.URL+"/callback", "state")
+			assert.Nil(t, err)
+
+			urlp, err := url.Parse(loginURL)
+			assert.Nil(t, err)
+
+			assert.Equal(t, test.expectedPromptTypeValue, urlp.Query().Get("prompt"))
+		})
+	}
+}
diff --git a/connector/keystone/keystone.go b/connector/keystone/keystone.go
index db97b5a71f..7d3084b238 100644
--- a/connector/keystone/keystone.go
+++ b/connector/keystone/keystone.go
@@ -7,18 +7,26 @@ import (
 	"encoding/json"
 	"fmt"
 	"io"
+	"log/slog"
 	"net/http"
 
+	"github.com/google/uuid"
+
 	"github.com/dexidp/dex/connector"
-	"github.com/dexidp/dex/pkg/log"
+)
+
+var (
+	_ connector.PasswordConnector = (*conn)(nil)
+	_ connector.RefreshConnector  = (*conn)(nil)
 )
 
 type conn struct {
-	Domain        string
+	Domain        domainKeystone
 	Host          string
 	AdminUsername string
 	AdminPassword string
-	Logger        log.Logger
+	client        *http.Client
+	Logger        *slog.Logger
 }
 
 type userKeystone struct {
@@ -28,13 +36,14 @@ type userKeystone struct {
 }
 
 type domainKeystone struct {
-	ID   string `json:"id"`
-	Name string `json:"name"`
+	ID   string `json:"id,omitempty"`
+	Name string `json:"name,omitempty"`
 }
 
 // Config holds the configuration parameters for Keystone connector.
 // Keystone should expose API v3
 // An example config:
+//
 //	connectors:
 //		type: keystone
 //		id: keystone
@@ -69,13 +78,9 @@ type password struct {
 }
 
 type user struct {
-	Name     string `json:"name"`
-	Domain   domain `json:"domain"`
-	Password string `json:"password"`
-}
-
-type domain struct {
-	ID string `json:"id"`
+	Name     string         `json:"name"`
+	Domain   domainKeystone `json:"domain"`
+	Password string         `json:"password"`
 }
 
 type token struct {
@@ -103,19 +108,29 @@ type userResponse struct {
 	} `json:"user"`
 }
 
-var (
-	_ connector.PasswordConnector = &conn{}
-	_ connector.RefreshConnector  = &conn{}
-)
-
 // Open returns an authentication strategy using Keystone.
-func (c *Config) Open(id string, logger log.Logger) (connector.Connector, error) {
+func (c *Config) Open(id string, logger *slog.Logger) (connector.Connector, error) {
+	_, err := uuid.Parse(c.Domain)
+	var domain domainKeystone
+	// check if the supplied domain is a UUID or the special "default" value
+	// which is treated as an ID and not a name
+	if err == nil || c.Domain == "default" {
+		domain = domainKeystone{
+			ID: c.Domain,
+		}
+	} else {
+		domain = domainKeystone{
+			Name: c.Domain,
+		}
+	}
+
 	return &conn{
-		c.Domain,
-		c.Host,
-		c.AdminUsername,
-		c.AdminPassword,
-		logger,
+		Domain:        domain,
+		Host:          c.Host,
+		AdminUsername: c.AdminUsername,
+		AdminPassword: c.AdminPassword,
+		Logger:        logger.With(slog.Group("connector", "type", "keystone", "id", id)),
+		client:        http.DefaultClient,
 	}, nil
 }
 
@@ -192,7 +207,6 @@ func (p *conn) Refresh(
 }
 
 func (p *conn) getTokenResponse(ctx context.Context, username, pass string) (response *http.Response, err error) {
-	client := &http.Client{}
 	jsonData := loginRequestData{
 		auth: auth{
 			Identity: identity{
@@ -200,7 +214,7 @@ func (p *conn) getTokenResponse(ctx context.Context, username, pass string) (res
 				Password: password{
 					User: user{
 						Name:     username,
-						Domain:   domain{ID: p.Domain},
+						Domain:   p.Domain,
 						Password: pass,
 					},
 				},
@@ -221,7 +235,7 @@ func (p *conn) getTokenResponse(ctx context.Context, username, pass string) (res
 	req.Header.Set("Content-Type", "application/json")
 	req = req.WithContext(ctx)
 
-	return client.Do(req)
+	return p.client.Do(req)
 }
 
 func (p *conn) getAdminToken(ctx context.Context) (string, error) {
@@ -243,7 +257,6 @@ func (p *conn) checkIfUserExists(ctx context.Context, userID string, token strin
 func (p *conn) getUser(ctx context.Context, userID string, token string) (*userResponse, error) {
 	// https://developer.openstack.org/api-ref/identity/v3/#show-user-details
 	userURL := p.Host + "/v3/users/" + userID
-	client := &http.Client{}
 	req, err := http.NewRequest("GET", userURL, nil)
 	if err != nil {
 		return nil, err
@@ -251,7 +264,7 @@ func (p *conn) getUser(ctx context.Context, userID string, token string) (*userR
 
 	req.Header.Set("X-Auth-Token", token)
 	req = req.WithContext(ctx)
-	resp, err := client.Do(req)
+	resp, err := p.client.Do(req)
 	if err != nil {
 		return nil, err
 	}
@@ -276,7 +289,6 @@ func (p *conn) getUser(ctx context.Context, userID string, token string) (*userR
 }
 
 func (p *conn) getUserGroups(ctx context.Context, userID string, token string) ([]string, error) {
-	client := &http.Client{}
 	// https://developer.openstack.org/api-ref/identity/v3/#list-groups-to-which-a-user-belongs
 	groupsURL := p.Host + "/v3/users/" + userID + "/groups"
 	req, err := http.NewRequest("GET", groupsURL, nil)
@@ -285,9 +297,9 @@ func (p *conn) getUserGroups(ctx context.Context, userID string, token string) (
 	}
 	req.Header.Set("X-Auth-Token", token)
 	req = req.WithContext(ctx)
-	resp, err := client.Do(req)
+	resp, err := p.client.Do(req)
 	if err != nil {
-		p.Logger.Errorf("keystone: error while fetching user %q groups\n", userID)
+		p.Logger.Error("error while fetching user groups", "user_id", userID, "err", err)
 		return nil, err
 	}
 
diff --git a/connector/keystone/keystone_test.go b/connector/keystone/keystone_test.go
index fc6c01e229..9b0590df12 100644
--- a/connector/keystone/keystone_test.go
+++ b/connector/keystone/keystone_test.go
@@ -17,11 +17,13 @@ import (
 const (
 	invalidPass = "WRONG_PASS"
 
-	testUser   = "test_user"
-	testPass   = "test_pass"
-	testEmail  = "test@example.com"
-	testGroup  = "test_group"
-	testDomain = "default"
+	testUser          = "test_user"
+	testPass          = "test_pass"
+	testEmail         = "test@example.com"
+	testGroup         = "test_group"
+	testDomainAltName = "altdomain"
+	testDomainID      = "default"
+	testDomainName    = "Default"
 )
 
 var (
@@ -32,8 +34,26 @@ var (
 	authTokenURL     = ""
 	usersURL         = ""
 	groupsURL        = ""
+	domainsURL       = ""
 )
 
+type userReq struct {
+	Name     string   `json:"name"`
+	Email    string   `json:"email"`
+	Enabled  bool     `json:"enabled"`
+	Password string   `json:"password"`
+	Roles    []string `json:"roles"`
+	DomainID string   `json:"domain_id,omitempty"`
+}
+
+type domainResponse struct {
+	Domain domainKeystone `json:"domain"`
+}
+
+type domainsResponse struct {
+	Domains []domainKeystone `json:"domains"`
+}
+
 type groupResponse struct {
 	Group struct {
 		ID string `json:"id"`
@@ -42,8 +62,6 @@ type groupResponse struct {
 
 func getAdminToken(t *testing.T, adminName, adminPass string) (token, id string) {
 	t.Helper()
-	client := &http.Client{}
-
 	jsonData := loginRequestData{
 		auth: auth{
 			Identity: identity{
@@ -51,7 +69,7 @@ func getAdminToken(t *testing.T, adminName, adminPass string) (token, id string)
 				Password: password{
 					User: user{
 						Name:     adminName,
-						Domain:   domain{ID: testDomain},
+						Domain:   domainKeystone{ID: testDomainID},
 						Password: adminPass,
 					},
 				},
@@ -70,7 +88,7 @@ func getAdminToken(t *testing.T, adminName, adminPass string) (token, id string)
 	}
 
 	req.Header.Set("Content-Type", "application/json")
-	resp, err := client.Do(req)
+	resp, err := http.DefaultClient.Do(req)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -91,17 +109,91 @@ func getAdminToken(t *testing.T, adminName, adminPass string) (token, id string)
 	return token, tokenResp.Token.User.ID
 }
 
-func createUser(t *testing.T, token, userName, userEmail, userPass string) string {
+func getOrCreateDomain(t *testing.T, token, domainName string) string {
+	t.Helper()
+
+	domainSearchURL := domainsURL + "?name=" + domainName
+	reqGet, err := http.NewRequest("GET", domainSearchURL, nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	reqGet.Header.Set("X-Auth-Token", token)
+	reqGet.Header.Add("Content-Type", "application/json")
+	respGet, err := http.DefaultClient.Do(reqGet)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	dataGet, err := io.ReadAll(respGet.Body)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer respGet.Body.Close()
+
+	domainsResp := new(domainsResponse)
+	err = json.Unmarshal(dataGet, &domainsResp)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	if len(domainsResp.Domains) >= 1 {
+		return domainsResp.Domains[0].ID
+	}
+
+	createDomainData := map[string]interface{}{
+		"domain": map[string]interface{}{
+			"name":    domainName,
+			"enabled": true,
+		},
+	}
+
+	body, err := json.Marshal(createDomainData)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	req, err := http.NewRequest("POST", domainsURL, bytes.NewBuffer(body))
+	if err != nil {
+		t.Fatal(err)
+	}
+	req.Header.Set("X-Auth-Token", token)
+	req.Header.Add("Content-Type", "application/json")
+	resp, err := http.DefaultClient.Do(req)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	if resp.StatusCode != 201 {
+		t.Fatalf("failed to create domain %s", domainName)
+	}
+
+	data, err := io.ReadAll(resp.Body)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer resp.Body.Close()
+
+	domainResp := new(domainResponse)
+	err = json.Unmarshal(data, &domainResp)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	return domainResp.Domain.ID
+}
+
+func createUser(t *testing.T, token, domainID, userName, userEmail, userPass string) string {
 	t.Helper()
-	client := &http.Client{}
 
 	createUserData := map[string]interface{}{
-		"user": map[string]interface{}{
-			"name":     userName,
-			"email":    userEmail,
-			"enabled":  true,
-			"password": userPass,
-			"roles":    []string{"admin"},
+		"user": userReq{
+			DomainID: domainID,
+			Name:     userName,
+			Email:    userEmail,
+			Enabled:  true,
+			Password: userPass,
+			Roles:    []string{"admin"},
 		},
 	}
 
@@ -116,7 +208,7 @@ func createUser(t *testing.T, token, userName, userEmail, userPass string) strin
 	}
 	req.Header.Set("X-Auth-Token", token)
 	req.Header.Add("Content-Type", "application/json")
-	resp, err := client.Do(req)
+	resp, err := http.DefaultClient.Do(req)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -139,7 +231,6 @@ func createUser(t *testing.T, token, userName, userEmail, userPass string) strin
 // delete group or user
 func deleteResource(t *testing.T, token, id, uri string) {
 	t.Helper()
-	client := &http.Client{}
 
 	deleteURI := uri + id
 	req, err := http.NewRequest("DELETE", deleteURI, nil)
@@ -148,7 +239,7 @@ func deleteResource(t *testing.T, token, id, uri string) {
 	}
 	req.Header.Set("X-Auth-Token", token)
 
-	resp, err := client.Do(req)
+	resp, err := http.DefaultClient.Do(req)
 	if err != nil {
 		t.Fatalf("error: %v", err)
 	}
@@ -157,7 +248,6 @@ func deleteResource(t *testing.T, token, id, uri string) {
 
 func createGroup(t *testing.T, token, description, name string) string {
 	t.Helper()
-	client := &http.Client{}
 
 	createGroupData := map[string]interface{}{
 		"group": map[string]interface{}{
@@ -177,7 +267,7 @@ func createGroup(t *testing.T, token, description, name string) string {
 	}
 	req.Header.Set("X-Auth-Token", token)
 	req.Header.Add("Content-Type", "application/json")
-	resp, err := client.Do(req)
+	resp, err := http.DefaultClient.Do(req)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -200,14 +290,13 @@ func createGroup(t *testing.T, token, description, name string) string {
 func addUserToGroup(t *testing.T, token, groupID, userID string) error {
 	t.Helper()
 	uri := groupsURL + groupID + "/users/" + userID
-	client := &http.Client{}
 	req, err := http.NewRequest("PUT", uri, nil)
 	if err != nil {
 		return err
 	}
 	req.Header.Set("X-Auth-Token", token)
 
-	resp, err := client.Do(req)
+	resp, err := http.DefaultClient.Do(req)
 	if err != nil {
 		t.Fatalf("error: %v", err)
 	}
@@ -219,7 +308,8 @@ func addUserToGroup(t *testing.T, token, groupID, userID string) error {
 func TestIncorrectCredentialsLogin(t *testing.T) {
 	setupVariables(t)
 	c := conn{
-		Host: keystoneURL, Domain: testDomain,
+		client: http.DefaultClient,
+		Host:   keystoneURL, Domain: domainKeystone{ID: testDomainID},
 		AdminUsername: adminUser, AdminPassword: adminPass,
 	}
 	s := connector.Scopes{OfflineAccess: true, Groups: true}
@@ -243,10 +333,11 @@ func TestValidUserLogin(t *testing.T) {
 	token, _ := getAdminToken(t, adminUser, adminPass)
 
 	type tUser struct {
-		username string
-		domain   string
-		email    string
-		password string
+		createDomain bool
+		domain       domainKeystone
+		username     string
+		email        string
+		password     string
 	}
 
 	type expect struct {
@@ -263,10 +354,11 @@ func TestValidUserLogin(t *testing.T) {
 		{
 			name: "test with email address",
 			input: tUser{
-				username: testUser,
-				domain:   testDomain,
-				email:    testEmail,
-				password: testPass,
+				createDomain: false,
+				domain:       domainKeystone{ID: testDomainID},
+				username:     testUser,
+				email:        testEmail,
+				password:     testPass,
 			},
 			expected: expect{
 				username:      testUser,
@@ -277,10 +369,11 @@ func TestValidUserLogin(t *testing.T) {
 		{
 			name: "test without email address",
 			input: tUser{
-				username: testUser,
-				domain:   testDomain,
-				email:    "",
-				password: testPass,
+				createDomain: false,
+				domain:       domainKeystone{ID: testDomainID},
+				username:     testUser,
+				email:        "",
+				password:     testPass,
 			},
 			expected: expect{
 				username:      testUser,
@@ -288,21 +381,77 @@ func TestValidUserLogin(t *testing.T) {
 				verifiedEmail: false,
 			},
 		},
+		{
+			name: "test with default domain Name",
+			input: tUser{
+				createDomain: false,
+				domain:       domainKeystone{Name: testDomainName},
+				username:     testUser,
+				email:        testEmail,
+				password:     testPass,
+			},
+			expected: expect{
+				username:      testUser,
+				email:         testEmail,
+				verifiedEmail: true,
+			},
+		},
+		{
+			name: "test with custom domain Name",
+			input: tUser{
+				createDomain: true,
+				domain:       domainKeystone{Name: testDomainAltName},
+				username:     testUser,
+				email:        testEmail,
+				password:     testPass,
+			},
+			expected: expect{
+				username:      testUser,
+				email:         testEmail,
+				verifiedEmail: true,
+			},
+		},
+		{
+			name: "test with custom domain ID",
+			input: tUser{
+				createDomain: true,
+				domain:       domainKeystone{},
+				username:     testUser,
+				email:        testEmail,
+				password:     testPass,
+			},
+			expected: expect{
+				username:      testUser,
+				email:         testEmail,
+				verifiedEmail: true,
+			},
+		},
 	}
 
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			userID := createUser(t, token, tt.input.username, tt.input.email, tt.input.password)
+			domainID := ""
+			if tt.input.createDomain == true {
+				domainID = getOrCreateDomain(t, token, testDomainAltName)
+				t.Logf("getOrCreateDomain ID: %s\n", domainID)
+
+				// if there was nothing set then use the dynamically generated domain ID
+				if tt.input.domain.ID == "" && tt.input.domain.Name == "" {
+					tt.input.domain.ID = domainID
+				}
+			}
+			userID := createUser(t, token, domainID, tt.input.username, tt.input.email, tt.input.password)
 			defer deleteResource(t, token, userID, usersURL)
 
 			c := conn{
-				Host: keystoneURL, Domain: tt.input.domain,
+				client: http.DefaultClient,
+				Host:   keystoneURL, Domain: tt.input.domain,
 				AdminUsername: adminUser, AdminPassword: adminPass,
 			}
 			s := connector.Scopes{OfflineAccess: true, Groups: true}
 			identity, validPW, err := c.Login(context.Background(), s, tt.input.username, tt.input.password)
 			if err != nil {
-				t.Fatal(err.Error())
+				t.Fatalf("Login failed for user %s: %v", tt.input.username, err.Error())
 			}
 			t.Log(identity)
 			if identity.Username != tt.expected.username {
@@ -333,7 +482,8 @@ func TestUseRefreshToken(t *testing.T) {
 	defer deleteResource(t, token, groupID, groupsURL)
 
 	c := conn{
-		Host: keystoneURL, Domain: testDomain,
+		client: http.DefaultClient,
+		Host:   keystoneURL, Domain: domainKeystone{ID: testDomainID},
 		AdminUsername: adminUser, AdminPassword: adminPass,
 	}
 	s := connector.Scopes{OfflineAccess: true, Groups: true}
@@ -355,10 +505,11 @@ func TestUseRefreshToken(t *testing.T) {
 func TestUseRefreshTokenUserDeleted(t *testing.T) {
 	setupVariables(t)
 	token, _ := getAdminToken(t, adminUser, adminPass)
-	userID := createUser(t, token, testUser, testEmail, testPass)
+	userID := createUser(t, token, "", testUser, testEmail, testPass)
 
 	c := conn{
-		Host: keystoneURL, Domain: testDomain,
+		client: http.DefaultClient,
+		Host:   keystoneURL, Domain: domainKeystone{ID: testDomainID},
 		AdminUsername: adminUser, AdminPassword: adminPass,
 	}
 	s := connector.Scopes{OfflineAccess: true, Groups: true}
@@ -384,11 +535,12 @@ func TestUseRefreshTokenUserDeleted(t *testing.T) {
 func TestUseRefreshTokenGroupsChanged(t *testing.T) {
 	setupVariables(t)
 	token, _ := getAdminToken(t, adminUser, adminPass)
-	userID := createUser(t, token, testUser, testEmail, testPass)
+	userID := createUser(t, token, "", testUser, testEmail, testPass)
 	defer deleteResource(t, token, userID, usersURL)
 
 	c := conn{
-		Host: keystoneURL, Domain: testDomain,
+		client: http.DefaultClient,
+		Host:   keystoneURL, Domain: domainKeystone{ID: testDomainID},
 		AdminUsername: adminUser, AdminPassword: adminPass,
 	}
 	s := connector.Scopes{OfflineAccess: true, Groups: true}
@@ -420,11 +572,12 @@ func TestUseRefreshTokenGroupsChanged(t *testing.T) {
 func TestNoGroupsInScope(t *testing.T) {
 	setupVariables(t)
 	token, _ := getAdminToken(t, adminUser, adminPass)
-	userID := createUser(t, token, testUser, testEmail, testPass)
+	userID := createUser(t, token, "", testUser, testEmail, testPass)
 	defer deleteResource(t, token, userID, usersURL)
 
 	c := conn{
-		Host: keystoneURL, Domain: testDomain,
+		client: http.DefaultClient,
+		Host:   keystoneURL, Domain: domainKeystone{ID: testDomainID},
 		AdminUsername: adminUser, AdminPassword: adminPass,
 	}
 	s := connector.Scopes{OfflineAccess: true, Groups: false}
@@ -474,6 +627,7 @@ func setupVariables(t *testing.T) {
 	authTokenURL = keystoneURL + "/v3/auth/tokens/"
 	usersURL = keystoneAdminURL + "/v3/users/"
 	groupsURL = keystoneAdminURL + "/v3/groups/"
+	domainsURL = keystoneAdminURL + "/v3/domains/"
 }
 
 func expectEquals(t *testing.T, a interface{}, b interface{}) {
diff --git a/connector/ldap/kerberos.go b/connector/ldap/kerberos.go
new file mode 100644
index 0000000000..1d5931d2b6
--- /dev/null
+++ b/connector/ldap/kerberos.go
@@ -0,0 +1,398 @@
+// Package ldap implements strategies for authenticating using the LDAP protocol.
+// This file contains Kerberos/SPNEGO authentication support for LDAP connector.
+package ldap
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"os"
+	"strings"
+	"time"
+
+	"github.com/go-ldap/ldap/v3"
+	"github.com/jcmturner/goidentity/v6"
+	"github.com/jcmturner/gokrb5/v8/credentials"
+	"github.com/jcmturner/gokrb5/v8/keytab"
+	"github.com/jcmturner/gokrb5/v8/service"
+	"github.com/jcmturner/gokrb5/v8/spnego"
+
+	"github.com/dexidp/dex/connector"
+)
+
+// bufferedResponse is a minimal http.ResponseWriter that buffers status,
+// headers, and body in memory so the SPNEGO middleware's response can be
+// inspected and conditionally forwarded. spnego.SPNEGOKRB5Authenticate is a
+// "terminal" middleware (it commits failure responses directly to the
+// ResponseWriter), but Dex needs to layer policy on top — FallbackToPassword
+// may want to discard a 401 so the password form can render, and
+// ExpectedRealm checks happen after a successful auth. Buffering decouples
+// the middleware's output from the eventual client response.
+type bufferedResponse struct {
+	header      http.Header
+	body        bytes.Buffer
+	code        int
+	wroteHeader bool
+}
+
+func newBufferedResponse() *bufferedResponse {
+	return &bufferedResponse{
+		header: make(http.Header),
+		code:   http.StatusOK,
+	}
+}
+
+func (r *bufferedResponse) Header() http.Header {
+	return r.header
+}
+
+// WriteHeader mirrors net/http: the first call wins, subsequent calls are
+// silently ignored (stdlib emits a "superfluous WriteHeader" warning and
+// keeps the original status; we just drop the override).
+func (r *bufferedResponse) WriteHeader(code int) {
+	if r.wroteHeader {
+		return
+	}
+	r.code = code
+	r.wroteHeader = true
+}
+
+// Write mirrors net/http: a Write before any WriteHeader implicitly commits
+// status 200, locking the status against later overrides.
+func (r *bufferedResponse) Write(b []byte) (int, error) {
+	if !r.wroteHeader {
+		r.WriteHeader(http.StatusOK)
+	}
+	return r.body.Write(b)
+}
+
+// krbState holds Kerberos/SPNEGO configuration bound to a ldapConnector.
+//
+// The authenticate field is the SPNEGO HTTP middleware factory: it wraps an
+// inner http.Handler so that inner runs only after successful SPNEGO auth,
+// with an authenticated *credentials.Credentials attached to the request
+// context under goidentity.CTXKey. In production it delegates to
+// spnego.SPNEGOKRB5Authenticate. Unit tests replace it with a stub that
+// injects a fake credential without any real Kerberos exchange.
+type krbState struct {
+	authenticate func(inner http.Handler) http.Handler
+}
+
+// loadKerberosState validates the keytab and returns a krbState wired to
+// spnego.SPNEGOKRB5Authenticate with the requested service settings.
+func loadKerberosState(cfg kerberosConfig) (*krbState, error) {
+	fi, err := os.Stat(cfg.KeytabPath)
+	if err != nil {
+		return nil, fmt.Errorf("keytab file not found: %w", err)
+	}
+	if fi.IsDir() {
+		return nil, fmt.Errorf("keytab path is a directory: %s", cfg.KeytabPath)
+	}
+	kt, err := keytab.Load(cfg.KeytabPath)
+	if err != nil {
+		return nil, fmt.Errorf("failed to load keytab: %w", err)
+	}
+
+	settings := []func(*service.Settings){service.DecodePAC(false)}
+	if cfg.SPN != "" {
+		settings = append(settings, service.SName(cfg.SPN))
+	}
+	if cfg.KeytabPrincipal != "" {
+		settings = append(settings, service.KeytabPrincipal(cfg.KeytabPrincipal))
+	}
+	if cfg.MaxClockSkew > 0 {
+		settings = append(settings, service.MaxClockSkew(time.Duration(cfg.MaxClockSkew)*time.Second))
+	}
+
+	return &krbState{
+		authenticate: func(inner http.Handler) http.Handler {
+			return spnego.SPNEGOKRB5Authenticate(inner, kt, settings...)
+		},
+	}, nil
+}
+
+// mapPrincipal builds the LDAP-side username from the Kerberos credentials
+// according to the configured mapping. Inputs come from gokrb5:
+// username is credentials.UserName() (bare, no realm); realm is Domain().
+//
+//   - "userprincipalname":                    "username@realm".
+//   - "localpart"/"samaccountname" (default): bare username.
+//
+// Case of the output is preserved; callers rely on the LDAP server's
+// attribute matching rules (typically case-insensitive) for comparisons.
+func mapPrincipal(username, realm, mapping string) string {
+	// Defensive: if username somehow carries an '@', trim to before it; we
+	// always derive the realm from the separate Domain() field.
+	if i := strings.IndexByte(username, '@'); i >= 0 {
+		username = username[:i]
+	}
+	if strings.EqualFold(mapping, "userprincipalname") {
+		if realm == "" {
+			return username
+		}
+		return username + "@" + realm
+	}
+	return username
+}
+
+// TrySPNEGO attempts SPNEGO authentication against the LDAP connector's keytab.
+//
+// Behavior:
+//   - Kerberos disabled: returns (nil, false, nil) so the caller renders the
+//     password form.
+//   - FallbackToPassword=true with no Authorization header: a cookie probe
+//     gives the browser exactly one round to negotiate. The first such
+//     request sets a short-lived "tried" cookie and forwards the middleware's
+//     401 Negotiate challenge so a Kerberos-aware client can respond. If the
+//     follow-up request still has no Authorization header (cookie present),
+//     we treat the client as unable to SPNEGO and render the password form.
+//   - FallbackToPassword=true with an Authorization header that the
+//     middleware rejects: render the password form (the client tried and
+//     failed; do not loop 401s).
+//   - FallbackToPassword=false: forward the middleware's response verbatim.
+//   - On success, the authenticated principal is resolved in LDAP and a
+//     connector.Identity is returned. Any prior probe cookie is cleared.
+func (c *ldapConnector) TrySPNEGO(ctx context.Context, s connector.Scopes, w http.ResponseWriter, r *http.Request) (*connector.Identity, connector.Handled, error) {
+	if c.krb == nil {
+		return nil, false, nil
+	}
+
+	hasNegotiate := strings.HasPrefix(r.Header.Get("Authorization"), "Negotiate ")
+
+	// Cookie probe: see the package-level doc on spnegoProbeCookieName. Only
+	// applies when fallback is enabled and the client has not (yet) sent a
+	// SPNEGO token; "Authorization present" paths bypass the probe entirely.
+	if c.krbConf.FallbackToPassword && !hasNegotiate {
+		if hasSPNEGOProbeCookie(r) {
+			c.logger.Info("kerberos: SPNEGO probe cookie present and no Negotiate header; falling back to password form")
+			return nil, false, nil
+		}
+		setSPNEGOProbeCookie(w, r)
+	}
+
+	// Run the SPNEGO middleware with a capturing recorder so we can decide
+	// whether to forward its response or fall back to the password form.
+	var (
+		id       *credentials.Credentials
+		innerErr error
+	)
+	inner := http.HandlerFunc(func(_ http.ResponseWriter, rr *http.Request) {
+		ident := goidentity.FromHTTPRequestContext(rr)
+		if ident == nil {
+			innerErr = fmt.Errorf("kerberos: no identity in request context after SPNEGO")
+			return
+		}
+		creds, ok := ident.(*credentials.Credentials)
+		if !ok {
+			innerErr = fmt.Errorf("kerberos: unexpected identity type %T", ident)
+			return
+		}
+		id = creds
+	})
+
+	rec := newBufferedResponse()
+	c.krb.authenticate(inner).ServeHTTP(rec, r)
+
+	if innerErr != nil {
+		c.logger.Error("kerberos: SPNEGO middleware completed with unusable credentials", "err", innerErr)
+		return nil, true, innerErr
+	}
+
+	if id == nil {
+		// Client offered a token and the middleware rejected it: under
+		// fallback semantics this is "tried and failed" — render the form
+		// rather than looping 401s.
+		if c.krbConf.FallbackToPassword && hasNegotiate {
+			c.logger.Info("kerberos: SPNEGO rejected client token; falling back to password form")
+			return nil, false, nil
+		}
+		// Otherwise (fallback=false, OR fallback=true probe round): forward
+		// the middleware-authored response (challenge token, error payload,
+		// etc.) verbatim — the protocol decided to reject and we preserve
+		// its wire details.
+		c.logger.Info("kerberos: SPNEGO did not authenticate; forwarding middleware response", "status", rec.code)
+		copyBuffered(rec, w)
+		return nil, true, nil
+	}
+
+	if c.krbConf.ExpectedRealm != "" && !strings.EqualFold(c.krbConf.ExpectedRealm, id.Domain()) {
+		c.logger.Info("kerberos: realm mismatch", "expected", c.krbConf.ExpectedRealm, "actual", id.Domain())
+		if c.krbConf.FallbackToPassword {
+			// Intentionally do NOT clear the probe cookie here: the
+			// client's TGT is for a realm we will never accept. Clearing
+			// would re-arm a probe round on the next no-Authorization GET,
+			// re-issue 401 Negotiate, the browser would resend the same
+			// wrong-realm token, and we'd land back here — an infinite
+			// flap. Keeping the cookie pins the client to the password
+			// form until the cookie's Max-Age elapses.
+			return nil, false, nil
+		}
+		// SPNEGO authenticated successfully, but our ExpectedRealm policy
+		// rejects it. The middleware's buffered response is irrelevant here
+		// (it represents the post-success path through the inner handler);
+		// emit our own bare Negotiate challenge so the client knows to
+		// retry with a different realm.
+		writeBareNegotiateChallenge(w)
+		return nil, true, nil
+	}
+
+	mapped := mapPrincipal(id.UserName(), id.Domain(), c.krbConf.UsernameFromPrincipal)
+	c.logger.Info("kerberos: principal authenticated",
+		"principal", id.UserName(),
+		"realm", id.Domain(),
+		"auth_time", id.AuthTime(),
+		"mapped_username", mapped,
+	)
+
+	userEntry, err := c.lookupKerberosUser(ctx, mapped)
+	if err != nil {
+		c.logger.Error("kerberos: LDAP user lookup failed",
+			"principal", id.UserName(), "mapped", mapped, "err", err)
+		return nil, true, fmt.Errorf("ldap: user lookup failed for kerberos principal %q: %w", id.UserName(), err)
+	}
+	c.logger.Info("kerberos: LDAP user found", "dn", userEntry.DN)
+
+	ident, err := c.identityFromEntry(userEntry)
+	if err != nil {
+		c.logger.Error("kerberos: failed to build identity from LDAP entry", "err", err)
+		return nil, true, err
+	}
+	if s.Groups {
+		groups, err := c.groups(ctx, userEntry)
+		if err != nil {
+			c.logger.Error("kerberos: failed to query groups", "err", err)
+			return nil, true, fmt.Errorf("ldap: failed to query groups: %w", err)
+		}
+		ident.Groups = groups
+	}
+
+	// No user-bind has happened; only materialize ConnectorData when refresh
+	// needs the LDAP entry later (OfflineAccess). Mirror (*ldapConnector).Login:
+	// a marshal failure here would silently break a subsequent Refresh call
+	// (Unmarshal on nil), so fail the login instead of letting that happen.
+	if s.OfflineAccess {
+		refresh := refreshData{Username: mapped, Entry: userEntry}
+		data, mErr := json.Marshal(refresh)
+		if mErr != nil {
+			c.logger.Error("kerberos: failed to marshal refresh data", "err", mErr)
+			return nil, true, fmt.Errorf("ldap: marshal refresh data: %w", mErr)
+		}
+		ident.ConnectorData = data
+	}
+
+	// If the client carried a stale probe cookie from a prior fallback
+	// round, clear it so a future logout/re-login starts negotiation fresh.
+	if hasSPNEGOProbeCookie(r) {
+		clearSPNEGOProbeCookie(w, r)
+	}
+
+	c.logger.Info("kerberos: SPNEGO login succeeded",
+		"username", ident.Username, "email", ident.Email, "groups_count", len(ident.Groups))
+	return &ident, true, nil
+}
+
+// copyBuffered forwards a buffered handler response to the real client.
+// Used when we want the middleware-authored bytes to reach the user agent
+// unchanged (e.g. SPNEGO continuation/reject tokens).
+func copyBuffered(rec *bufferedResponse, w http.ResponseWriter) {
+	for k, vv := range rec.header {
+		for _, v := range vv {
+			w.Header().Add(k, v)
+		}
+	}
+	w.WriteHeader(rec.code)
+	_, _ = w.Write(rec.body.Bytes())
+}
+
+// writeBareNegotiateChallenge emits an unsolicited "WWW-Authenticate:
+// Negotiate" 401 directly to the client. This is reserved for cases where
+// Dex itself rejects an otherwise-successful SPNEGO exchange (currently
+// only ExpectedRealm mismatch); in those cases the middleware's buffered
+// output does not represent the answer we want to send.
+func writeBareNegotiateChallenge(w http.ResponseWriter) {
+	w.Header().Set("WWW-Authenticate", "Negotiate")
+	w.WriteHeader(http.StatusUnauthorized)
+}
+
+// spnegoProbeCookieName names the short-lived cookie that records "we
+// already issued a 401 Negotiate challenge to this client". It implements
+// the fallback-to-password semantics: the very first GET without an
+// Authorization header gets a real Negotiate challenge so a Kerberos-aware
+// browser can SSO; if the client comes back without a token we treat that
+// as "client cannot/will not negotiate" and render the password form
+// instead of looping 401s. The cookie is bounded by a small Max-Age so a
+// later visit gets a fresh chance to negotiate.
+const (
+	spnegoProbeCookieName = "dex_spnego_tried"
+	spnegoProbeMaxAge     = 60 // seconds; long enough for one challenge round-trip
+)
+
+func hasSPNEGOProbeCookie(r *http.Request) bool {
+	_, err := r.Cookie(spnegoProbeCookieName)
+	return err == nil
+}
+
+// newSPNEGOProbeCookie returns a probe-cookie carrier with the attributes
+// shared between "set" and "clear" forms (Path, HttpOnly, Secure, SameSite),
+// so the two callers cannot accidentally drift apart.
+func newSPNEGOProbeCookie(r *http.Request, value string, maxAge int) *http.Cookie {
+	return &http.Cookie{
+		Name:  spnegoProbeCookieName,
+		Value: value,
+		// Scope to "/" so the cookie reaches every Dex auth endpoint
+		// regardless of issuer prefix; the cookie carries no secret and
+		// expires within spnegoProbeMaxAge seconds, so the broad path is
+		// not a privacy or security boundary concern.
+		Path:     "/",
+		MaxAge:   maxAge,
+		HttpOnly: true,
+		Secure:   isSecureRequest(r),
+		SameSite: http.SameSiteLaxMode,
+	}
+}
+
+func setSPNEGOProbeCookie(w http.ResponseWriter, r *http.Request) {
+	http.SetCookie(w, newSPNEGOProbeCookie(r, "1", spnegoProbeMaxAge))
+}
+
+func clearSPNEGOProbeCookie(w http.ResponseWriter, r *http.Request) {
+	http.SetCookie(w, newSPNEGOProbeCookie(r, "", -1))
+}
+
+// isSecureRequest reports whether the original client connection is HTTPS.
+// It honors X-Forwarded-Proto so the cookie's Secure attribute is correct
+// when Dex sits behind a TLS-terminating proxy. The header is treated as
+// advisory: misbehaving/spoofed values can only flip Secure to true on a
+// plain-HTTP setup (which makes browsers refuse to echo the cookie back —
+// a graceful no-op for the probe), never to false on a real HTTPS link.
+func isSecureRequest(r *http.Request) bool {
+	if r.TLS != nil {
+		return true
+	}
+	return strings.EqualFold(r.Header.Get("X-Forwarded-Proto"), "https")
+}
+
+// lookupKerberosUser resolves an LDAP user entry by username. When
+// krbLookupUserHook is non-nil it is used exclusively and the real LDAP
+// search is skipped entirely — this keeps unit tests hermetic.
+func (c *ldapConnector) lookupKerberosUser(ctx context.Context, username string) (ldap.Entry, error) {
+	if c.krbLookupUserHook != nil {
+		return c.krbLookupUserHook(ctx, c, username)
+	}
+
+	var userEntry ldap.Entry
+	err := c.do(ctx, func(conn *ldap.Conn) error {
+		entry, found, err := c.userEntry(conn, username)
+		if err != nil {
+			return err
+		}
+		if !found {
+			return fmt.Errorf("user not found for principal")
+		}
+		userEntry = entry
+		return nil
+	})
+	return userEntry, err
+}
diff --git a/connector/ldap/kerberos_test.go b/connector/ldap/kerberos_test.go
new file mode 100644
index 0000000000..8b9df0ade8
--- /dev/null
+++ b/connector/ldap/kerberos_test.go
@@ -0,0 +1,602 @@
+package ldap
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"log/slog"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+
+	ldaplib "github.com/go-ldap/ldap/v3"
+	"github.com/jcmturner/goidentity/v6"
+	"github.com/jcmturner/gokrb5/v8/credentials"
+
+	"github.com/dexidp/dex/connector"
+)
+
+// fakeAuthenticate returns a krbState whose authenticate middleware immediately
+// invokes inner with the given credentials attached to the request context
+// under goidentity.CTXKey — mimicking a successful SPNEGO handshake.
+func fakeAuthenticate(creds *credentials.Credentials) *krbState {
+	return &krbState{
+		authenticate: func(inner http.Handler) http.Handler {
+			return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+				if creds == nil {
+					// Emulate a failed SPNEGO exchange: middleware writes 401
+					// without invoking the inner handler.
+					w.Header().Set("WWW-Authenticate", "Negotiate")
+					http.Error(w, "auth failed\n", http.StatusUnauthorized)
+					return
+				}
+				rr := r.WithContext(context.WithValue(r.Context(), goidentity.CTXKey, goidentity.Identity(creds)))
+				inner.ServeHTTP(w, rr)
+			})
+		},
+	}
+}
+
+// fakeAuthenticateWithResponse returns a krbState whose middleware writes an
+// arbitrary response and does not invoke inner. Useful for testing the
+// forward-vs-discard branch on failed SPNEGO.
+func fakeAuthenticateWithResponse(status int, headers map[string]string, body string) *krbState {
+	return &krbState{
+		authenticate: func(_ http.Handler) http.Handler {
+			return http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+				for k, v := range headers {
+					w.Header().Set(k, v)
+				}
+				w.WriteHeader(status)
+				_, _ = w.Write([]byte(body))
+			})
+		},
+	}
+}
+
+func newCreds(username, realm string) *credentials.Credentials {
+	c := credentials.New(username, realm)
+	c.SetAuthenticated(true)
+	return c
+}
+
+func TestKerberos_NoHeader_NoFallback_ForwardsMiddleware401(t *testing.T) {
+	lc := &ldapConnector{
+		logger:  slog.Default(),
+		krbConf: kerberosConfig{FallbackToPassword: false, UsernameFromPrincipal: "localpart"},
+		krb:     fakeAuthenticate(nil),
+	}
+	r := httptest.NewRequest("GET", "/auth/ldap/login?state=abc", nil)
+	w := httptest.NewRecorder()
+	ident, handled, err := lc.TrySPNEGO(r.Context(), connector.Scopes{}, w, r)
+	if err != nil {
+		t.Fatalf("unexpected err: %v", err)
+	}
+	if !bool(handled) {
+		t.Fatalf("expected handled")
+	}
+	if ident != nil {
+		t.Fatalf("expected no identity")
+	}
+	if w.Result().StatusCode != http.StatusUnauthorized {
+		t.Fatalf("expected 401, got %d", w.Result().StatusCode)
+	}
+	if hdr := w.Header().Get("WWW-Authenticate"); hdr != "Negotiate" {
+		t.Fatalf("expected bare Negotiate challenge, got %q", hdr)
+	}
+}
+
+func TestKerberos_NoHeader_Fallback_NoCookie_ChallengesAndSetsCookie(t *testing.T) {
+	// First contact under fallback: no Authorization header, no probe cookie.
+	// We expect the middleware to run, its 401 Negotiate to be forwarded to
+	// the client, and a probe cookie to be set so the *next* round (still
+	// without an Authorization header) can short-circuit to the form.
+	middlewareRan := false
+	lc := &ldapConnector{
+		logger:  slog.Default(),
+		krbConf: kerberosConfig{FallbackToPassword: true, UsernameFromPrincipal: "localpart"},
+		krb: &krbState{authenticate: func(_ http.Handler) http.Handler {
+			return http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+				middlewareRan = true
+				w.Header().Set("WWW-Authenticate", "Negotiate")
+				w.WriteHeader(http.StatusUnauthorized)
+			})
+		}},
+	}
+	r := httptest.NewRequest("GET", "/auth/ldap/login?state=abc", nil)
+	w := httptest.NewRecorder()
+	ident, handled, err := lc.TrySPNEGO(r.Context(), connector.Scopes{}, w, r)
+	if err != nil {
+		t.Fatalf("unexpected err: %v", err)
+	}
+	if !bool(handled) {
+		t.Fatalf("expected handled (probe round forwards 401)")
+	}
+	if ident != nil {
+		t.Fatalf("expected no identity")
+	}
+	if !middlewareRan {
+		t.Fatalf("SPNEGO middleware should run on the probe round")
+	}
+	if w.Result().StatusCode != http.StatusUnauthorized {
+		t.Fatalf("expected 401, got %d", w.Result().StatusCode)
+	}
+	if hdr := w.Header().Get("WWW-Authenticate"); hdr != "Negotiate" {
+		t.Fatalf("expected Negotiate challenge, got %q", hdr)
+	}
+	if !setCookieHasName(w, spnegoProbeCookieName) {
+		t.Fatalf("expected probe cookie %q to be set, got %q", spnegoProbeCookieName, w.Header().Values("Set-Cookie"))
+	}
+}
+
+func TestKerberos_NoHeader_Fallback_WithCookie_RendersForm(t *testing.T) {
+	// Follow-up round: probe cookie is already in the request and the client
+	// still hasn't sent a Negotiate token. Treat that as "client cannot/will
+	// not SPNEGO" and short-circuit to the password form without running the
+	// middleware (otherwise w would get tainted with another 401).
+	middlewareRan := false
+	lc := &ldapConnector{
+		logger:  slog.Default(),
+		krbConf: kerberosConfig{FallbackToPassword: true, UsernameFromPrincipal: "localpart"},
+		krb: &krbState{authenticate: func(_ http.Handler) http.Handler {
+			return http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+				middlewareRan = true
+				w.WriteHeader(http.StatusUnauthorized)
+			})
+		}},
+	}
+	r := httptest.NewRequest("GET", "/auth/ldap/login?state=abc", nil)
+	r.AddCookie(&http.Cookie{Name: spnegoProbeCookieName, Value: "1"})
+	w := httptest.NewRecorder()
+	ident, handled, err := lc.TrySPNEGO(r.Context(), connector.Scopes{}, w, r)
+	if err != nil {
+		t.Fatalf("unexpected err: %v", err)
+	}
+	if bool(handled) {
+		t.Fatalf("expected not handled (caller should render form)")
+	}
+	if ident != nil {
+		t.Fatalf("expected no identity")
+	}
+	if middlewareRan {
+		t.Fatalf("SPNEGO middleware should not run on probe-follow-up round")
+	}
+	if w.Code != 200 && w.Code != 0 {
+		t.Fatalf("expected w untouched, got status=%d", w.Code)
+	}
+}
+
+func TestKerberos_MiddlewareFails_Fallback_DiscardsResponse(t *testing.T) {
+	// Authorization header is present (so we enter middleware), middleware
+	// rejects the ticket, fallback is on: TrySPNEGO must return (nil, false, nil)
+	// and must not forward the middleware's 401 to the real ResponseWriter.
+	lc := &ldapConnector{
+		logger:  slog.Default(),
+		krbConf: kerberosConfig{FallbackToPassword: true, UsernameFromPrincipal: "localpart"},
+		krb: fakeAuthenticateWithResponse(
+			http.StatusUnauthorized,
+			map[string]string{"WWW-Authenticate": "Negotiate oQcwBaADCgEC"},
+			"auth failed\n",
+		),
+	}
+	r := httptest.NewRequest("GET", "/auth/ldap/login?state=abc", nil)
+	r.Header.Set("Authorization", "Negotiate deadbeef")
+	w := httptest.NewRecorder()
+	ident, handled, err := lc.TrySPNEGO(r.Context(), connector.Scopes{}, w, r)
+	if err != nil {
+		t.Fatalf("unexpected err: %v", err)
+	}
+	if bool(handled) {
+		t.Fatalf("expected not handled (caller should render form)")
+	}
+	if ident != nil {
+		t.Fatalf("expected no identity")
+	}
+	if w.Code != 200 && w.Code != 0 {
+		t.Fatalf("expected w untouched, got status=%d", w.Code)
+	}
+	if hdr := w.Header().Get("WWW-Authenticate"); hdr != "" {
+		t.Fatalf("expected no WWW-Authenticate on fallback, got %q", hdr)
+	}
+}
+
+func TestKerberos_MiddlewareFails_NoFallback_ForwardsResponse(t *testing.T) {
+	// Middleware writes a reject token; no fallback: forward to client verbatim.
+	lc := &ldapConnector{
+		logger:  slog.Default(),
+		krbConf: kerberosConfig{FallbackToPassword: false, UsernameFromPrincipal: "localpart"},
+		krb: fakeAuthenticateWithResponse(
+			http.StatusUnauthorized,
+			map[string]string{"WWW-Authenticate": "Negotiate oQcwBaADCgEC"},
+			"auth failed\n",
+		),
+	}
+	r := httptest.NewRequest("GET", "/auth/ldap/login?state=abc", nil)
+	r.Header.Set("Authorization", "Negotiate deadbeef")
+	w := httptest.NewRecorder()
+	ident, handled, err := lc.TrySPNEGO(r.Context(), connector.Scopes{}, w, r)
+	if err != nil {
+		t.Fatalf("unexpected err: %v", err)
+	}
+	if !bool(handled) {
+		t.Fatalf("expected handled")
+	}
+	if ident != nil {
+		t.Fatalf("expected no identity")
+	}
+	if w.Code != http.StatusUnauthorized {
+		t.Fatalf("expected 401 forwarded, got %d", w.Code)
+	}
+	if hdr := w.Header().Get("WWW-Authenticate"); !strings.HasPrefix(hdr, "Negotiate ") {
+		t.Fatalf("expected reject token forwarded, got %q", hdr)
+	}
+}
+
+func TestKerberos_Success_BuildsIdentity(t *testing.T) {
+	lc := &ldapConnector{
+		logger:  slog.Default(),
+		krbConf: kerberosConfig{FallbackToPassword: false, UsernameFromPrincipal: "localpart"},
+		krb:     fakeAuthenticate(newCreds("jdoe", "EXAMPLE.COM")),
+	}
+	lc.Config.UserSearch.IDAttr = "uid"
+	lc.Config.UserSearch.EmailAttr = "mail"
+	lc.Config.UserSearch.NameAttr = "cn"
+	lc.krbLookupUserHook = func(_ context.Context, c *ldapConnector, username string) (ldaplib.Entry, error) {
+		if username != "jdoe" {
+			t.Fatalf("expected username=jdoe, got %q", username)
+		}
+		e := ldaplib.NewEntry("cn=jdoe,dc=example,dc=org", map[string][]string{
+			c.UserSearch.IDAttr:    {"uid-jdoe"},
+			c.UserSearch.EmailAttr: {"jdoe@example.com"},
+			c.UserSearch.NameAttr:  {"John Doe"},
+		})
+		return *e, nil
+	}
+	r := httptest.NewRequest("GET", "/auth/ldap/login?state=abc", nil)
+	w := httptest.NewRecorder()
+	ident, handled, err := lc.TrySPNEGO(r.Context(), connector.Scopes{}, w, r)
+	if err != nil {
+		t.Fatalf("unexpected err: %v", err)
+	}
+	if !bool(handled) || ident == nil {
+		t.Fatalf("expected handled with identity")
+	}
+	if ident.Username == "" || ident.Email == "" || ident.UserID == "" {
+		t.Fatalf("expected populated identity, got %+v", *ident)
+	}
+	// No probe cookie was on the request, so the success path must not emit
+	// a clearing Set-Cookie either (avoids needless header noise).
+	if setCookieHasName(w, spnegoProbeCookieName) {
+		t.Fatalf("did not expect Set-Cookie %q on success without prior probe cookie, got %q",
+			spnegoProbeCookieName, w.Header().Values("Set-Cookie"))
+	}
+}
+
+// TestKerberos_Success_ClearsProbeCookie verifies that a successful SPNEGO
+// login on a request that *did* carry a probe cookie clears it, so a future
+// no-Authorization GET starts a fresh negotiation round instead of going
+// straight to the password form.
+func TestKerberos_Success_ClearsProbeCookie(t *testing.T) {
+	lc := &ldapConnector{
+		logger:  slog.Default(),
+		krbConf: kerberosConfig{FallbackToPassword: true, UsernameFromPrincipal: "localpart"},
+		krb:     fakeAuthenticate(newCreds("jdoe", "EXAMPLE.COM")),
+	}
+	lc.Config.UserSearch.IDAttr = "uid"
+	lc.Config.UserSearch.EmailAttr = "mail"
+	lc.Config.UserSearch.NameAttr = "cn"
+	lc.krbLookupUserHook = func(_ context.Context, c *ldapConnector, _ string) (ldaplib.Entry, error) {
+		e := ldaplib.NewEntry("cn=jdoe,dc=example,dc=org", map[string][]string{
+			c.UserSearch.IDAttr:    {"uid-jdoe"},
+			c.UserSearch.EmailAttr: {"jdoe@example.com"},
+			c.UserSearch.NameAttr:  {"John Doe"},
+		})
+		return *e, nil
+	}
+	r := httptest.NewRequest("GET", "/auth/ldap/login?state=abc", nil)
+	r.Header.Set("Authorization", "Negotiate deadbeef")
+	r.AddCookie(&http.Cookie{Name: spnegoProbeCookieName, Value: "1"})
+	w := httptest.NewRecorder()
+	ident, handled, err := lc.TrySPNEGO(r.Context(), connector.Scopes{}, w, r)
+	if err != nil {
+		t.Fatalf("unexpected err: %v", err)
+	}
+	if !bool(handled) || ident == nil {
+		t.Fatalf("expected handled with identity")
+	}
+	if !setCookieClearsName(w, spnegoProbeCookieName) {
+		t.Fatalf("expected probe cookie %q to be cleared, got %q",
+			spnegoProbeCookieName, w.Header().Values("Set-Cookie"))
+	}
+}
+
+// setCookieHasName reports whether any Set-Cookie response header sets a
+// cookie with the given name and a non-empty value (i.e. an actual set, not
+// a clear). Order-tolerant; useful for assertions that don't care about
+// exact attributes.
+func setCookieHasName(w *httptest.ResponseRecorder, name string) bool {
+	for _, sc := range w.Result().Cookies() {
+		if sc.Name == name && sc.Value != "" && sc.MaxAge >= 0 {
+			return true
+		}
+	}
+	return false
+}
+
+// setCookieClearsName reports whether any Set-Cookie response header clears
+// the cookie with the given name (Max-Age<=0 or empty value).
+func setCookieClearsName(w *httptest.ResponseRecorder, name string) bool {
+	for _, sc := range w.Result().Cookies() {
+		if sc.Name == name && (sc.MaxAge < 0 || sc.Value == "") {
+			return true
+		}
+	}
+	return false
+}
+
+// TestKerberos_UserNotFound_ReturnsError pins the behavior when the LDAP
+// directory has no entry for an authenticated Kerberos principal. The hook
+// is authoritative, so the test is hermetic (no network call to :636).
+func TestKerberos_UserNotFound_ReturnsError(t *testing.T) {
+	lc := &ldapConnector{
+		logger:  slog.Default(),
+		krbConf: kerberosConfig{FallbackToPassword: false, UsernameFromPrincipal: "localpart"},
+		krb:     fakeAuthenticate(newCreds("jdoe", "EXAMPLE.COM")),
+	}
+	lc.krbLookupUserHook = func(_ context.Context, _ *ldapConnector, _ string) (ldaplib.Entry, error) {
+		return ldaplib.Entry{}, fmt.Errorf("user not found for principal")
+	}
+	r := httptest.NewRequest("GET", "/auth/ldap/login?state=abc", nil)
+	w := httptest.NewRecorder()
+	_, handled, err := lc.TrySPNEGO(r.Context(), connector.Scopes{}, w, r)
+	if err == nil {
+		t.Fatalf("expected error for user not found")
+	}
+	if !bool(handled) {
+		t.Fatalf("expected handled")
+	}
+	if !strings.Contains(err.Error(), "user lookup failed") {
+		t.Fatalf("expected 'user lookup failed' error, got: %v", err)
+	}
+	if !strings.Contains(err.Error(), "user not found for principal") {
+		t.Fatalf("expected wrapped hook error, got: %v", err)
+	}
+}
+
+// TestKerberos_LookupHookError_Wrapped verifies hook errors propagate through
+// TrySPNEGO with %w wrapping so callers can errors.Is against the original.
+func TestKerberos_LookupHookError_Wrapped(t *testing.T) {
+	sentinel := errors.New("boom: LDAP server tantrum")
+	lc := &ldapConnector{
+		logger:  slog.Default(),
+		krbConf: kerberosConfig{FallbackToPassword: false, UsernameFromPrincipal: "localpart"},
+		krb:     fakeAuthenticate(newCreds("jdoe", "EXAMPLE.COM")),
+	}
+	lc.krbLookupUserHook = func(_ context.Context, _ *ldapConnector, _ string) (ldaplib.Entry, error) {
+		return ldaplib.Entry{}, sentinel
+	}
+	r := httptest.NewRequest("GET", "/auth/ldap/login?state=abc", nil)
+	w := httptest.NewRecorder()
+	_, _, err := lc.TrySPNEGO(r.Context(), connector.Scopes{}, w, r)
+	if err == nil {
+		t.Fatalf("expected error")
+	}
+	if !errors.Is(err, sentinel) {
+		t.Fatalf("expected errors.Is(err, sentinel), got: %v", err)
+	}
+}
+
+func TestKerberos_ExpectedRealmMismatch_NoFallback_401(t *testing.T) {
+	lc := &ldapConnector{
+		logger: slog.Default(),
+		krbConf: kerberosConfig{
+			FallbackToPassword:    false,
+			UsernameFromPrincipal: "localpart",
+			ExpectedRealm:         "EXAMPLE.COM",
+		},
+		krb: fakeAuthenticate(newCreds("jdoe", "OTHER.COM")),
+	}
+	r := httptest.NewRequest("GET", "/auth/ldap/login?state=abc", nil)
+	w := httptest.NewRecorder()
+	ident, handled, err := lc.TrySPNEGO(r.Context(), connector.Scopes{}, w, r)
+	if err != nil {
+		t.Fatalf("unexpected err: %v", err)
+	}
+	if !bool(handled) || ident != nil {
+		t.Fatalf("expected handled with no identity")
+	}
+	if w.Result().StatusCode != http.StatusUnauthorized {
+		t.Fatalf("expected 401, got %d", w.Result().StatusCode)
+	}
+	if hdr := w.Header().Get("WWW-Authenticate"); hdr != "Negotiate" {
+		t.Fatalf("expected bare Negotiate, got %q", hdr)
+	}
+}
+
+func TestKerberos_ExpectedRealmMismatch_Fallback_RendersForm(t *testing.T) {
+	lc := &ldapConnector{
+		logger: slog.Default(),
+		krbConf: kerberosConfig{
+			FallbackToPassword:    true,
+			UsernameFromPrincipal: "localpart",
+			ExpectedRealm:         "EXAMPLE.COM",
+		},
+		krb: fakeAuthenticate(newCreds("jdoe", "OTHER.COM")),
+	}
+	r := httptest.NewRequest("GET", "/auth/ldap/login?state=abc", nil)
+	r.Header.Set("Authorization", "Negotiate deadbeef")
+	w := httptest.NewRecorder()
+	ident, handled, err := lc.TrySPNEGO(r.Context(), connector.Scopes{}, w, r)
+	if err != nil {
+		t.Fatalf("unexpected err: %v", err)
+	}
+	if bool(handled) || ident != nil {
+		t.Fatalf("expected not handled, got handled=%v ident=%v", handled, ident)
+	}
+}
+
+func TestKerberos_ExpectedRealm_CaseInsensitive(t *testing.T) {
+	lc := &ldapConnector{
+		logger: slog.Default(),
+		krbConf: kerberosConfig{
+			FallbackToPassword:    false,
+			UsernameFromPrincipal: "localpart",
+			ExpectedRealm:         "ExAmPlE.CoM",
+		},
+		krb: fakeAuthenticate(newCreds("user", "EXAMPLE.COM")),
+	}
+	lc.Config.UserSearch.IDAttr = "uid"
+	lc.Config.UserSearch.EmailAttr = "mail"
+	lc.Config.UserSearch.NameAttr = "cn"
+	lc.krbLookupUserHook = func(_ context.Context, c *ldapConnector, _ string) (ldaplib.Entry, error) {
+		e := ldaplib.NewEntry("cn=user,dc=example,dc=com", map[string][]string{
+			c.UserSearch.IDAttr:    {"uid-user"},
+			c.UserSearch.EmailAttr: {"user@example.com"},
+			c.UserSearch.NameAttr:  {"User"},
+		})
+		return *e, nil
+	}
+	r := httptest.NewRequest("GET", "/auth/ldap/login?state=abc", nil)
+	w := httptest.NewRecorder()
+	ident, handled, err := lc.TrySPNEGO(r.Context(), connector.Scopes{}, w, r)
+	if err != nil {
+		t.Fatalf("unexpected err: %v", err)
+	}
+	if !bool(handled) || ident == nil {
+		t.Fatalf("expected handled with identity")
+	}
+}
+
+func TestKerberos_UserPrincipalName_Mapping(t *testing.T) {
+	lc := &ldapConnector{
+		logger:  slog.Default(),
+		krbConf: kerberosConfig{FallbackToPassword: false, UsernameFromPrincipal: "userPrincipalName"},
+		krb:     fakeAuthenticate(newCreds("J.Doe", "Example.COM")),
+	}
+	lc.Config.UserSearch.IDAttr = "uid"
+	lc.Config.UserSearch.EmailAttr = "mail"
+	lc.Config.UserSearch.NameAttr = "cn"
+	lc.krbLookupUserHook = func(_ context.Context, c *ldapConnector, username string) (ldaplib.Entry, error) {
+		// userPrincipalName mapping reconstructs "username@realm" from the
+		// gokrb5 credentials; LDAP server handles case according to the
+		// attribute's matching rule.
+		if username != "J.Doe@Example.COM" {
+			t.Fatalf("expected reconstructed UPN, got %q", username)
+		}
+		e := ldaplib.NewEntry("cn=jdoe,dc=example,dc=org", map[string][]string{
+			c.UserSearch.IDAttr:    {"uid-jdoe"},
+			c.UserSearch.EmailAttr: {"jdoe@example.com"},
+			c.UserSearch.NameAttr:  {"John Doe"},
+		})
+		return *e, nil
+	}
+	r := httptest.NewRequest("GET", "/auth/ldap/login?state=abc", nil)
+	w := httptest.NewRecorder()
+	ident, handled, err := lc.TrySPNEGO(r.Context(), connector.Scopes{}, w, r)
+	if err != nil {
+		t.Fatalf("unexpected err: %v", err)
+	}
+	if !bool(handled) || ident == nil {
+		t.Fatalf("expected handled with identity")
+	}
+}
+
+func TestKerberos_sAMAccountName_EqualsLocalpart(t *testing.T) {
+	lc := &ldapConnector{
+		logger:  slog.Default(),
+		krbConf: kerberosConfig{FallbackToPassword: false, UsernameFromPrincipal: "sAMAccountName"},
+		krb:     fakeAuthenticate(newCreds("Admin", "REALM.LOCAL")),
+	}
+	lc.Config.UserSearch.IDAttr = "uid"
+	lc.Config.UserSearch.EmailAttr = "mail"
+	lc.Config.UserSearch.NameAttr = "cn"
+	lc.krbLookupUserHook = func(_ context.Context, c *ldapConnector, username string) (ldaplib.Entry, error) {
+		if username != "Admin" {
+			t.Fatalf("expected localpart-derived username Admin, got %q", username)
+		}
+		e := ldaplib.NewEntry("cn=admin,dc=local", map[string][]string{
+			c.UserSearch.IDAttr:    {"uid-admin"},
+			c.UserSearch.EmailAttr: {"admin@local"},
+			c.UserSearch.NameAttr:  {"Admin"},
+		})
+		return *e, nil
+	}
+	r := httptest.NewRequest("GET", "/auth/ldap/login?state=abc", nil)
+	w := httptest.NewRecorder()
+	ident, handled, err := lc.TrySPNEGO(r.Context(), connector.Scopes{}, w, r)
+	if err != nil {
+		t.Fatalf("unexpected err: %v", err)
+	}
+	if !bool(handled) || ident == nil {
+		t.Fatalf("expected handled with identity")
+	}
+}
+
+func TestKerberos_OfflineAccess_SetsConnectorData(t *testing.T) {
+	lc := &ldapConnector{
+		logger:  slog.Default(),
+		krbConf: kerberosConfig{FallbackToPassword: false, UsernameFromPrincipal: "localpart"},
+		krb:     fakeAuthenticate(newCreds("jdoe", "EXAMPLE.COM")),
+	}
+	lc.Config.UserSearch.IDAttr = "uid"
+	lc.Config.UserSearch.EmailAttr = "mail"
+	lc.Config.UserSearch.NameAttr = "cn"
+	lc.krbLookupUserHook = func(_ context.Context, c *ldapConnector, _ string) (ldaplib.Entry, error) {
+		e := ldaplib.NewEntry("cn=jdoe,dc=example,dc=org", map[string][]string{
+			c.UserSearch.IDAttr:    {"uid-jdoe"},
+			c.UserSearch.EmailAttr: {"jdoe@example.com"},
+			c.UserSearch.NameAttr:  {"John Doe"},
+		})
+		return *e, nil
+	}
+	r := httptest.NewRequest("GET", "/auth/ldap/login?state=abc", nil)
+	w := httptest.NewRecorder()
+	ident, handled, err := lc.TrySPNEGO(r.Context(), connector.Scopes{OfflineAccess: true}, w, r)
+	if err != nil {
+		t.Fatalf("unexpected err: %v", err)
+	}
+	if !bool(handled) || ident == nil {
+		t.Fatalf("expected handled with identity")
+	}
+	if len(ident.ConnectorData) == 0 {
+		t.Fatalf("expected connector data for offline access")
+	}
+}
+
+func TestKerberos_Disabled_PassThrough(t *testing.T) {
+	// krb==nil: TrySPNEGO must leave w untouched and return (nil, false, nil).
+	lc := &ldapConnector{logger: slog.Default()}
+	r := httptest.NewRequest("GET", "/auth/ldap/login?state=abc", nil)
+	w := httptest.NewRecorder()
+	ident, handled, err := lc.TrySPNEGO(r.Context(), connector.Scopes{}, w, r)
+	if err != nil {
+		t.Fatalf("unexpected err: %v", err)
+	}
+	if bool(handled) || ident != nil {
+		t.Fatalf("expected not handled with no identity")
+	}
+}
+
+func TestKerberos_mapPrincipal(t *testing.T) {
+	cases := []struct {
+		username, realm, mode, want string
+	}{
+		{"JDoe", "EXAMPLE.COM", "localpart", "JDoe"},
+		{"JDoe", "EXAMPLE.COM", "sAMAccountName", "JDoe"},
+		{"JDoe", "EXAMPLE.COM", "userPrincipalName", "JDoe@EXAMPLE.COM"},
+		{"JDoe", "EXAMPLE.COM", "", "JDoe"},
+		// Defensive cases: username accidentally contains '@'.
+		{"JDoe@EXAMPLE.COM", "EXAMPLE.COM", "localpart", "JDoe"},
+		{"JDoe@EXAMPLE.COM", "EXAMPLE.COM", "userPrincipalName", "JDoe@EXAMPLE.COM"},
+		// Empty realm for userPrincipalName degrades to bare username.
+		{"jdoe", "", "userPrincipalName", "jdoe"},
+		{"", "EXAMPLE.COM", "localpart", ""},
+	}
+	for _, c := range cases {
+		got := mapPrincipal(c.username, c.realm, c.mode)
+		if got != c.want {
+			t.Fatalf("mapPrincipal(%q,%q,%q)=%q; want %q", c.username, c.realm, c.mode, got, c.want)
+		}
+	}
+}
diff --git a/connector/ldap/ldap.go b/connector/ldap/ldap.go
index 543402718c..27f93e3393 100644
--- a/connector/ldap/ldap.go
+++ b/connector/ldap/ldap.go
@@ -7,13 +7,15 @@ import (
 	"crypto/x509"
 	"encoding/json"
 	"fmt"
+	"log/slog"
 	"net"
+	"net/url"
 	"os"
+	"strings"
 
 	"github.com/go-ldap/ldap/v3"
 
 	"github.com/dexidp/dex/connector"
-	"github.com/dexidp/dex/pkg/log"
 )
 
 // Config holds the configuration parameters for the LDAP connector. The LDAP
@@ -32,10 +34,12 @@ import (
 //       bindDN: uid=serviceaccount,cn=users,dc=example,dc=com
 //       bindPW: password
 //       userSearch:
-//         # Would translate to the query "(&(objectClass=person)(uid=<username>))"
+//         # Would translate to the query "(&(objectClass=person)(|(uid=<username>)(mail=<username>)))"
 //         baseDN: cn=users,dc=example,dc=com
 //         filter: "(objectClass=person)"
-//         username: uid
+//         username:
+//         - uid
+//         - mail
 //         idAttr: uid
 //         emailAttr: mail
 //         nameAttr: name
@@ -56,10 +60,33 @@ import (
 //         nameAttr: name
 //
 
+// UsernameAttributes represents one or more LDAP attributes to match against
+// the username input. It supports unmarshaling from both a single string
+// (e.g. "uid") and a list of strings (e.g. ["uid", "mail"]).
+type UsernameAttributes []string
+
+func (u *UsernameAttributes) UnmarshalJSON(data []byte) error {
+	var arr []string
+	if err := json.Unmarshal(data, &arr); err == nil {
+		*u = arr
+		return nil
+	}
+	var s string
+	if err := json.Unmarshal(data, &s); err != nil {
+		return fmt.Errorf("username must be a string or list of strings")
+	}
+	if s != "" {
+		*u = UsernameAttributes{s}
+	}
+	return nil
+}
+
 // UserMatcher holds information about user and group matching.
 type UserMatcher struct {
 	UserAttr  string `json:"userAttr"`
 	GroupAttr string `json:"groupAttr"`
+	// Look for parent groups
+	RecursionGroupAttr string `json:"recursionGroupAttr"`
 }
 
 // Config holds configuration options for LDAP logins.
@@ -98,6 +125,9 @@ type Config struct {
 	// "Username".
 	UsernamePrompt string `json:"usernamePrompt"`
 
+	// Optional Kerberos (SPNEGO) SSO configuration.
+	Kerberos *kerberosConfig `json:"kerberos"`
+
 	// User entry search configuration.
 	UserSearch struct {
 		// BaseDN to start the search from. For example "cn=users,dc=example,dc=com"
@@ -106,9 +136,10 @@ type Config struct {
 		// Optional filter to apply when searching the directory. For example "(objectClass=person)"
 		Filter string `json:"filter"`
 
-		// Attribute to match against the inputted username. This will be translated and combined
-		// with the other filter as "(<attr>=<username>)".
-		Username string `json:"username"`
+		// Attribute(s) to match against the inputted username. Accepts a single string
+		// or a list of strings. When multiple attributes are specified, an OR filter is
+		// constructed: "(|(<attr1>=<username>)(<attr2>=<username>))".
+		Username UsernameAttributes `json:"username"`
 
 		// Can either be:
 		// * "sub" - search the whole sub tree
@@ -142,6 +173,8 @@ type Config struct {
 		UserAttr  string `json:"userAttr"`
 		GroupAttr string `json:"groupAttr"`
 
+		RecursionGroupAttr string `json:"recursionGroupAttr"`
+
 		// Array of the field pairs used to match a user to a group.
 		// See the "UserMatcher" struct for the exact field names
 		//
@@ -158,6 +191,33 @@ type Config struct {
 	} `json:"groupSearch"`
 }
 
+// kerberosConfig defines optional Kerberos (SPNEGO) SSO settings for LDAP.
+//
+// Required:
+//   - Enabled, KeytabPath.
+//
+// Optional tuning:
+//   - SPN: overrides the service principal name extracted from the keytab
+//     (useful when Dex sits behind a reverse proxy that rewrites Host).
+//   - KeytabPrincipal: selects a specific principal out of a multi-entry
+//     keytab (e.g. "HTTP/dex.example.com").
+//   - MaxClockSkew: seconds of acceptable clock skew between the KDC, the
+//     client and Dex; defaults to gokrb5's 300s when unset.
+//   - ExpectedRealm: rejects tickets from realms other than this one.
+//   - UsernameFromPrincipal: "localpart" (default) or "userPrincipalName".
+//   - FallbackToPassword: render the password form when SPNEGO is absent or
+//     fails, instead of returning 401.
+type kerberosConfig struct {
+	Enabled               bool   `json:"enabled"`
+	KeytabPath            string `json:"keytabPath"`
+	SPN                   string `json:"spn"`
+	KeytabPrincipal       string `json:"keytabPrincipal"`
+	MaxClockSkew          int    `json:"maxClockSkew"`
+	ExpectedRealm         string `json:"expectedRealm"`
+	UsernameFromPrincipal string `json:"usernameFromPrincipal"`
+	FallbackToPassword    bool   `json:"fallbackToPassword"`
+}
+
 func scopeString(i int) string {
 	switch i {
 	case ldap.ScopeBaseObject:
@@ -187,26 +247,48 @@ func parseScope(s string) (int, bool) {
 // Function exists here to allow backward compatibility between old and new
 // group to user matching implementations.
 // See "Config.GroupSearch.UserMatchers" comments for the details
-func userMatchers(c *Config, logger log.Logger) []UserMatcher {
+func userMatchers(c *Config, logger *slog.Logger) []UserMatcher {
 	if len(c.GroupSearch.UserMatchers) > 0 && c.GroupSearch.UserMatchers[0].UserAttr != "" {
 		return c.GroupSearch.UserMatchers
 	}
 
-	log.Deprecated(logger, `LDAP: use groupSearch.userMatchers option instead of "userAttr/groupAttr" fields.`)
+	if c.GroupSearch.UserAttr != "" || c.GroupSearch.GroupAttr != "" {
+		logger.Warn(`use "groupSearch.userMatchers" option instead of "userAttr/groupAttr" fields`, "deprecated", true)
+	}
 	return []UserMatcher{
 		{
-			UserAttr:  c.GroupSearch.UserAttr,
-			GroupAttr: c.GroupSearch.GroupAttr,
+			UserAttr:           c.GroupSearch.UserAttr,
+			GroupAttr:          c.GroupSearch.GroupAttr,
+			RecursionGroupAttr: c.GroupSearch.RecursionGroupAttr,
 		},
 	}
 }
 
 // Open returns an authentication strategy using LDAP.
-func (c *Config) Open(id string, logger log.Logger) (connector.Connector, error) {
+func (c *Config) Open(id string, logger *slog.Logger) (connector.Connector, error) {
+	logger = logger.With(slog.Group("connector", "type", "ldap", "id", id))
 	conn, err := c.OpenConnector(logger)
 	if err != nil {
 		return nil, err
 	}
+	// If Kerberos is enabled, load the keytab and bind SPNEGO middleware.
+	// The presence of a non-nil krb on ldapConnector is the single source of
+	// truth for "SPNEGO is live"; TrySPNEGO short-circuits when it's nil.
+	if lc, ok := conn.(*ldapConnector); ok && lc.krbConf.Enabled && lc.krb == nil {
+		st, kerr := loadKerberosState(lc.krbConf)
+		if kerr != nil {
+			logger.Warn("failed to initialize kerberos; disabling kerberos", "err", kerr)
+		} else {
+			lc.krb = st
+			logger.Info("kerberos SPNEGO enabled for LDAP connector",
+				"keytab", lc.krbConf.KeytabPath,
+				"spn", lc.krbConf.SPN,
+				"keytab_principal", lc.krbConf.KeytabPrincipal,
+				"expected_realm", lc.krbConf.ExpectedRealm,
+				"fallback_to_password", lc.krbConf.FallbackToPassword,
+			)
+		}
+	}
 	return connector.Connector(conn), nil
 }
 
@@ -216,7 +298,7 @@ type refreshData struct {
 }
 
 // OpenConnector is the same as Open but returns a type with all implemented connector interfaces.
-func (c *Config) OpenConnector(logger log.Logger) (interface {
+func (c *Config) OpenConnector(logger *slog.Logger) (interface {
 	connector.Connector
 	connector.PasswordConnector
 	connector.RefreshConnector
@@ -225,14 +307,13 @@ func (c *Config) OpenConnector(logger log.Logger) (interface {
 	return c.openConnector(logger)
 }
 
-func (c *Config) openConnector(logger log.Logger) (*ldapConnector, error) {
+func (c *Config) openConnector(logger *slog.Logger) (*ldapConnector, error) {
 	requiredFields := []struct {
 		name string
 		val  string
 	}{
 		{"host", c.Host},
 		{"userSearch.baseDN", c.UserSearch.BaseDN},
-		{"userSearch.username", c.UserSearch.Username},
 	}
 
 	for _, field := range requiredFields {
@@ -241,6 +322,10 @@ func (c *Config) openConnector(logger log.Logger) (*ldapConnector, error) {
 		}
 	}
 
+	if len(c.UserSearch.Username) == 0 {
+		return nil, fmt.Errorf("ldap: missing required field %q", "userSearch.username")
+	}
+
 	var (
 		host string
 		err  error
@@ -288,9 +373,41 @@ func (c *Config) openConnector(logger log.Logger) (*ldapConnector, error) {
 
 	// TODO(nabokihms): remove it after deleting deprecated groupSearch options
 	c.GroupSearch.UserMatchers = userMatchers(c, logger)
-	return &ldapConnector{*c, userSearchScope, groupSearchScope, tlsConfig, logger}, nil
+
+	// Normalize Kerberos defaults. We persist krbConf only when it is
+	// usable (Enabled + KeytabPath set); otherwise it stays at the zero
+	// value and Open() will skip loadKerberosState — which keeps krb nil
+	// and effectively disables SPNEGO without any extra flag.
+	var krbConf kerberosConfig
+	if c.Kerberos != nil && c.Kerberos.Enabled {
+		krbConf = *c.Kerberos
+		if krbConf.UsernameFromPrincipal == "" {
+			krbConf.UsernameFromPrincipal = "localpart"
+		}
+		if krbConf.KeytabPath == "" {
+			logger.Warn("kerberos enabled but keytabPath is empty; disabling kerberos")
+			krbConf = kerberosConfig{}
+		}
+	}
+
+	lc := &ldapConnector{
+		Config:           *c,
+		userSearchScope:  userSearchScope,
+		groupSearchScope: groupSearchScope,
+		tlsConfig:        tlsConfig,
+		usernameAttrs:    c.UserSearch.Username,
+		logger:           logger,
+		krbConf:          krbConf,
+	}
+	return lc, nil
 }
 
+var (
+	_ connector.PasswordConnector = (*ldapConnector)(nil)
+	_ connector.RefreshConnector  = (*ldapConnector)(nil)
+	_ connector.SPNEGOAware       = (*ldapConnector)(nil)
+)
+
 type ldapConnector struct {
 	Config
 
@@ -299,13 +416,21 @@ type ldapConnector struct {
 
 	tlsConfig *tls.Config
 
-	logger log.Logger
-}
+	usernameAttrs []string
 
-var (
-	_ connector.PasswordConnector = (*ldapConnector)(nil)
-	_ connector.RefreshConnector  = (*ldapConnector)(nil)
-)
+	logger *slog.Logger
+
+	// Kerberos/SPNEGO support. krb is nil until the keytab has been loaded
+	// successfully in Open(); TrySPNEGO uses (krb == nil) as the single
+	// "is SPNEGO available" check, so no separate enable flag is needed.
+	krbConf kerberosConfig
+	krb     *krbState
+	// krbLookupUserHook allows tests to replace the LDAP user lookup entirely.
+	// When set it is authoritative: lookupKerberosUser does not fall through
+	// to a real LDAP search. Tests signal "user not found" by returning an
+	// error, not by returning a zero entry with a nil error.
+	krbLookupUserHook func(ctx context.Context, c *ldapConnector, username string) (ldap.Entry, error)
+}
 
 // do initializes a connection to the LDAP directory and passes it to the
 // provided function. It then performs appropriate teardown or reuse before
@@ -316,11 +441,14 @@ func (c *ldapConnector) do(_ context.Context, f func(c *ldap.Conn) error) error
 		conn *ldap.Conn
 		err  error
 	)
+
 	switch {
 	case c.InsecureNoSSL:
-		conn, err = ldap.Dial("tcp", c.Host)
+		u := url.URL{Scheme: "ldap", Host: c.Host}
+		conn, err = ldap.DialURL(u.String())
 	case c.StartTLS:
-		conn, err = ldap.Dial("tcp", c.Host)
+		u := url.URL{Scheme: "ldap", Host: c.Host}
+		conn, err = ldap.DialURL(u.String())
 		if err != nil {
 			return fmt.Errorf("failed to connect: %v", err)
 		}
@@ -328,7 +456,8 @@ func (c *ldapConnector) do(_ context.Context, f func(c *ldap.Conn) error) error
 			return fmt.Errorf("start TLS failed: %v", err)
 		}
 	default:
-		conn, err = ldap.DialTLS("tcp", c.Host, c.tlsConfig)
+		u := url.URL{Scheme: "ldaps", Host: c.Host}
+		conn, err = ldap.DialURL(u.String(), ldap.DialWithTLSConfig(c.tlsConfig))
 	}
 	if err != nil {
 		return fmt.Errorf("failed to connect: %v", err)
@@ -347,21 +476,23 @@ func (c *ldapConnector) do(_ context.Context, f func(c *ldap.Conn) error) error
 	return f(conn)
 }
 
-func getAttrs(e ldap.Entry, name string) []string {
+func (c *ldapConnector) getAttrs(e ldap.Entry, name string) []string {
 	for _, a := range e.Attributes {
 		if a.Name != name {
 			continue
 		}
 		return a.Values
 	}
-	if name == "DN" {
+	if strings.ToLower(name) == "dn" {
 		return []string{e.DN}
 	}
+
+	c.logger.Debug("attribute is not fround in entry", "attribute", name)
 	return nil
 }
 
-func getAttr(e ldap.Entry, name string) string {
-	if a := getAttrs(e, name); len(a) > 0 {
+func (c *ldapConnector) getAttr(e ldap.Entry, name string) string {
+	if a := c.getAttrs(e, name); len(a) > 0 {
 		return a[0]
 	}
 	return ""
@@ -373,25 +504,25 @@ func (c *ldapConnector) identityFromEntry(user ldap.Entry) (ident connector.Iden
 	missing := []string{}
 
 	// Fill the identity struct using the attributes from the user entry.
-	if ident.UserID = getAttr(user, c.UserSearch.IDAttr); ident.UserID == "" {
+	if ident.UserID = c.getAttr(user, c.UserSearch.IDAttr); ident.UserID == "" {
 		missing = append(missing, c.UserSearch.IDAttr)
 	}
 
 	if c.UserSearch.NameAttr != "" {
-		if ident.Username = getAttr(user, c.UserSearch.NameAttr); ident.Username == "" {
+		if ident.Username = c.getAttr(user, c.UserSearch.NameAttr); ident.Username == "" {
 			missing = append(missing, c.UserSearch.NameAttr)
 		}
 	}
 
 	if c.UserSearch.PreferredUsernameAttrAttr != "" {
-		if ident.PreferredUsername = getAttr(user, c.UserSearch.PreferredUsernameAttrAttr); ident.PreferredUsername == "" {
+		if ident.PreferredUsername = c.getAttr(user, c.UserSearch.PreferredUsernameAttrAttr); ident.PreferredUsername == "" {
 			missing = append(missing, c.UserSearch.PreferredUsernameAttrAttr)
 		}
 	}
 
 	if c.UserSearch.EmailSuffix != "" {
 		ident.Email = ident.Username + "@" + c.UserSearch.EmailSuffix
-	} else if ident.Email = getAttr(user, c.UserSearch.EmailAttr); ident.Email == "" {
+	} else if ident.Email = c.getAttr(user, c.UserSearch.EmailAttr); ident.Email == "" {
 		missing = append(missing, c.UserSearch.EmailAttr)
 	}
 	// TODO(ericchiang): Let this value be set from an attribute.
@@ -405,7 +536,19 @@ func (c *ldapConnector) identityFromEntry(user ldap.Entry) (ident connector.Iden
 }
 
 func (c *ldapConnector) userEntry(conn *ldap.Conn, username string) (user ldap.Entry, found bool, err error) {
-	filter := fmt.Sprintf("(%s=%s)", c.UserSearch.Username, ldap.EscapeFilter(username))
+	var filter string
+	escapedUsername := ldap.EscapeFilter(username)
+
+	attrFilters := make([]string, 0, len(c.usernameAttrs))
+	for _, attr := range c.usernameAttrs {
+		attrFilters = append(attrFilters, fmt.Sprintf("(%s=%s)", attr, escapedUsername))
+	}
+	if len(attrFilters) == 1 {
+		filter = attrFilters[0] // Skip OR wrapper for single attribute
+	} else {
+		filter = fmt.Sprintf("(|%s)", strings.Join(attrFilters, ""))
+	}
+
 	if c.UserSearch.Filter != "" {
 		filter = fmt.Sprintf("(&%s%s)", c.UserSearch.Filter, filter)
 	}
@@ -423,6 +566,8 @@ func (c *ldapConnector) userEntry(conn *ldap.Conn, username string) (user ldap.E
 		},
 	}
 
+	req.Attributes = append(req.Attributes, c.usernameAttrs...)
+
 	for _, matcher := range c.GroupSearch.UserMatchers {
 		req.Attributes = append(req.Attributes, matcher.UserAttr)
 	}
@@ -435,8 +580,8 @@ func (c *ldapConnector) userEntry(conn *ldap.Conn, username string) (user ldap.E
 		req.Attributes = append(req.Attributes, c.UserSearch.PreferredUsernameAttrAttr)
 	}
 
-	c.logger.Infof("performing ldap search %s %s %s",
-		req.BaseDN, scopeString(req.Scope), req.Filter)
+	c.logger.Info("performing ldap search",
+		"base_dn", req.BaseDN, "scope", scopeString(req.Scope), "filter", req.Filter)
 	resp, err := conn.Search(req)
 	if err != nil {
 		return ldap.Entry{}, false, fmt.Errorf("ldap: search with filter %q failed: %v", req.Filter, err)
@@ -444,11 +589,11 @@ func (c *ldapConnector) userEntry(conn *ldap.Conn, username string) (user ldap.E
 
 	switch n := len(resp.Entries); n {
 	case 0:
-		c.logger.Errorf("ldap: no results returned for filter: %q", filter)
+		c.logger.Error("no results returned for filter", "filter", filter)
 		return ldap.Entry{}, false, nil
 	case 1:
 		user = *resp.Entries[0]
-		c.logger.Infof("username %q mapped to entry %s", username, user.DN)
+		c.logger.Info("username mapped to entry", "username", username, "user_dn", user.DN)
 		return user, true, nil
 	default:
 		return ldap.Entry{}, false, fmt.Errorf("ldap: filter returned multiple (%d) results: %q", n, filter)
@@ -457,6 +602,7 @@ func (c *ldapConnector) userEntry(conn *ldap.Conn, username string) (user ldap.E
 
 func (c *ldapConnector) Login(ctx context.Context, s connector.Scopes, username, password string) (ident connector.Identity, validPass bool, err error) {
 	// make this check to avoid unauthenticated bind to the LDAP server.
+
 	if password == "" {
 		return connector.Identity{}, false, nil
 	}
@@ -468,6 +614,8 @@ func (c *ldapConnector) Login(ctx context.Context, s connector.Scopes, username,
 		user          ldap.Entry
 	)
 
+	username = ldap.EscapeFilter(username)
+
 	err = c.do(ctx, func(conn *ldap.Conn) error {
 		entry, found, err := c.userEntry(conn, username)
 		if err != nil {
@@ -485,11 +633,11 @@ func (c *ldapConnector) Login(ctx context.Context, s connector.Scopes, username,
 			if ldapErr, ok := err.(*ldap.Error); ok {
 				switch ldapErr.ResultCode {
 				case ldap.LDAPResultInvalidCredentials:
-					c.logger.Errorf("ldap: invalid password for user %q", user.DN)
+					c.logger.Error("invalid password for user", "user_dn", user.DN)
 					incorrectPass = true
 					return nil
 				case ldap.LDAPResultConstraintViolation:
-					c.logger.Errorf("ldap: constraint violation for user %q: %s", user.DN, ldapErr.Error())
+					c.logger.Error("constraint violation for user", "user_dn", user.DN, "err", ldapErr.Error())
 					incorrectPass = true
 					return nil
 				}
@@ -575,61 +723,124 @@ func (c *ldapConnector) Refresh(ctx context.Context, s connector.Scopes, ident c
 
 func (c *ldapConnector) groups(ctx context.Context, user ldap.Entry) ([]string, error) {
 	if c.GroupSearch.BaseDN == "" {
-		c.logger.Debugf("No groups returned for %q because no groups baseDN has been configured.", getAttr(user, c.UserSearch.NameAttr))
+		c.logger.Debug("No groups returned because no groups baseDN has been configured.", "base_dn", c.getAttr(user, c.UserSearch.NameAttr))
 		return nil, nil
 	}
 
-	var groups []*ldap.Entry
+	var groupNames []string
+
 	for _, matcher := range c.GroupSearch.UserMatchers {
-		for _, attr := range getAttrs(user, matcher.UserAttr) {
-			filter := fmt.Sprintf("(%s=%s)", matcher.GroupAttr, ldap.EscapeFilter(attr))
-			if c.GroupSearch.Filter != "" {
-				filter = fmt.Sprintf("(&%s%s)", c.GroupSearch.Filter, filter)
+		// Initial Search
+		var groups []*ldap.Entry
+		for _, attr := range c.getAttrs(user, matcher.UserAttr) {
+			obtained, filter, err := c.queryGroups(ctx, matcher.GroupAttr, attr)
+			if err != nil {
+				return nil, err
 			}
+			gotGroups := len(obtained) != 0
+			if !gotGroups {
+				// TODO(ericchiang): Is this going to spam the logs?
+				c.logger.Error("ldap: groups search returned no groups", "filter", filter)
+			}
+			groups = append(groups, obtained...)
+		}
 
-			req := &ldap.SearchRequest{
-				BaseDN:     c.GroupSearch.BaseDN,
-				Filter:     filter,
-				Scope:      c.groupSearchScope,
-				Attributes: []string{c.GroupSearch.NameAttr},
+		// If RecursionGroupAttr is not set, convert direct groups into names and return
+		if matcher.RecursionGroupAttr == "" {
+			for _, group := range groups {
+				name := c.getAttr(*group, c.GroupSearch.NameAttr)
+				if name == "" {
+					return nil, fmt.Errorf(
+						"ldap: group entity %q missing required attribute %q",
+						group.DN, c.GroupSearch.NameAttr,
+					)
+				}
+				groupNames = append(groupNames, name)
 			}
+			continue
+		}
 
-			gotGroups := false
-			if err := c.do(ctx, func(conn *ldap.Conn) error {
-				c.logger.Infof("performing ldap search %s %s %s",
-					req.BaseDN, scopeString(req.Scope), req.Filter)
-				resp, err := conn.Search(req)
+		// Recursive Search
+		c.logger.Info("Recursive group search enabled", "groupAttr", matcher.GroupAttr, "recursionAttr", matcher.RecursionGroupAttr)
+		for {
+			var nextLevel []*ldap.Entry
+			for _, group := range groups {
+				name := c.getAttr(*group, c.GroupSearch.NameAttr)
+				if name == "" {
+					return nil, fmt.Errorf("ldap: group entity %q missing required attribute %q",
+						group.DN, c.GroupSearch.NameAttr)
+				}
+
+				// Prevent duplicates and circular references.
+				duplicate := false
+				for _, existingName := range groupNames {
+					if name == existingName {
+						c.logger.Debug("Found duplicate group", "name", name)
+						duplicate = true
+						break
+					}
+				}
+				if duplicate {
+					continue
+				}
+
+				groupNames = append(groupNames, name)
+
+				// Search for parent groups using the group's DN.
+				parents, filter, err := c.queryGroups(ctx, matcher.RecursionGroupAttr, group.DN)
 				if err != nil {
-					return fmt.Errorf("ldap: search failed: %v", err)
+					return nil, err
+				}
+				if len(parents) == 0 {
+					c.logger.Debug("No parent groups found", "filter", filter)
+				} else {
+					nextLevel = append(nextLevel, parents...)
 				}
-				gotGroups = len(resp.Entries) != 0
-				groups = append(groups, resp.Entries...)
-				return nil
-			}); err != nil {
-				return nil, err
 			}
-			if !gotGroups {
-				// TODO(ericchiang): Is this going to spam the logs?
-				c.logger.Errorf("ldap: groups search with filter %q returned no groups", filter)
+			if len(nextLevel) == 0 {
+				break
 			}
+			groups = nextLevel
 		}
 	}
+	return groupNames, nil
+}
 
-	groupNames := make([]string, 0, len(groups))
-	for _, group := range groups {
-		name := getAttr(*group, c.GroupSearch.NameAttr)
-		if name == "" {
-			// Be obnoxious about missing missing attributes. If the group entry is
-			// missing its name attribute, that indicates a misconfiguration.
-			//
-			// In the future we can add configuration options to just log these errors.
-			return nil, fmt.Errorf("ldap: group entity %q missing required attribute %q",
-				group.DN, c.GroupSearch.NameAttr)
-		}
+func (c *ldapConnector) queryGroups(ctx context.Context, memberAttr, dn string) ([]*ldap.Entry, string, error) {
+	filter := fmt.Sprintf("(%s=%s)", memberAttr, ldap.EscapeFilter(dn))
+	if c.GroupSearch.Filter != "" {
+		filter = fmt.Sprintf("(&%s%s)", c.GroupSearch.Filter, filter)
+	}
 
-		groupNames = append(groupNames, name)
+	req := &ldap.SearchRequest{
+		BaseDN:     c.GroupSearch.BaseDN,
+		Filter:     filter,
+		Scope:      c.groupSearchScope,
+		Attributes: []string{c.GroupSearch.NameAttr},
+	}
+
+	var entries []*ldap.Entry
+	if err := c.do(ctx, func(conn *ldap.Conn) error {
+		c.logger.Info(
+			"performing ldap search",
+			"base_dn", req.BaseDN,
+			"scope", scopeString(req.Scope),
+			"filter", req.Filter,
+		)
+		resp, err := conn.Search(req)
+		if err != nil {
+			if ldapErr, ok := err.(*ldap.Error); ok && ldapErr.ResultCode == ldap.LDAPResultNoSuchObject {
+				c.logger.Info("LDAP search returned no groups", "filter", filter)
+				return nil
+			}
+			return fmt.Errorf("ldap: search failed: %v", err)
+		}
+		entries = append(entries, resp.Entries...)
+		return nil
+	}); err != nil {
+		return nil, filter, err
 	}
-	return groupNames, nil
+	return entries, filter, nil
 }
 
 func (c *ldapConnector) Prompt() string {
diff --git a/connector/ldap/ldap_test.go b/connector/ldap/ldap_test.go
index 83f9f4790c..3335d56b5e 100644
--- a/connector/ldap/ldap_test.go
+++ b/connector/ldap/ldap_test.go
@@ -3,12 +3,11 @@ package ldap
 import (
 	"context"
 	"fmt"
-	"io"
+	"log/slog"
 	"os"
 	"testing"
 
 	"github.com/kylelemons/godebug/pretty"
-	"github.com/sirupsen/logrus"
 
 	"github.com/dexidp/dex/connector"
 )
@@ -46,7 +45,7 @@ func TestQuery(t *testing.T) {
 	c.UserSearch.NameAttr = "cn"
 	c.UserSearch.EmailAttr = "mail"
 	c.UserSearch.IDAttr = "DN"
-	c.UserSearch.Username = "cn"
+	c.UserSearch.Username = UsernameAttributes{"cn"}
 
 	tests := []subtest{
 		{
@@ -83,6 +82,18 @@ func TestQuery(t *testing.T) {
 			password:  "foo",
 			wantBadPW: true, // Want invalid password, not a query error.
 		},
+		{
+			name:      "invalid wildcard username",
+			username:  "a*", // wildcard query is not allowed
+			password:  "foo",
+			wantBadPW: true, // Want invalid password, not a query error.
+		},
+		{
+			name:      "invalid wildcard password",
+			username:  "john",
+			password:  "*",  // wildcard password is not allowed
+			wantBadPW: true, // Want invalid password, not a query error.
+		},
 	}
 
 	runTests(t, connectLDAP, c, tests)
@@ -94,7 +105,7 @@ func TestQueryWithEmailSuffix(t *testing.T) {
 	c.UserSearch.NameAttr = "cn"
 	c.UserSearch.EmailSuffix = "test.example.com"
 	c.UserSearch.IDAttr = "DN"
-	c.UserSearch.Username = "cn"
+	c.UserSearch.Username = UsernameAttributes{"cn"}
 
 	tests := []subtest{
 		{
@@ -130,7 +141,7 @@ func TestUserFilter(t *testing.T) {
 	c.UserSearch.NameAttr = "cn"
 	c.UserSearch.EmailAttr = "mail"
 	c.UserSearch.IDAttr = "DN"
-	c.UserSearch.Username = "cn"
+	c.UserSearch.Username = UsernameAttributes{"cn"}
 	c.UserSearch.Filter = "(ou:dn:=Seattle)"
 
 	tests := []subtest{
@@ -173,13 +184,50 @@ func TestUserFilter(t *testing.T) {
 	runTests(t, connectLDAP, c, tests)
 }
 
+func TestUsernameWithMultipleAttributes(t *testing.T) {
+	c := &Config{}
+	c.UserSearch.BaseDN = "ou=TestUsernameWithMultipleAttributes,dc=example,dc=org"
+	c.UserSearch.NameAttr = "cn"
+	c.UserSearch.EmailAttr = "mail"
+	c.UserSearch.IDAttr = "DN"
+	c.UserSearch.Username = UsernameAttributes{"cn", "mail"}
+	c.UserSearch.Filter = "(ou:dn:=Seattle)"
+
+	tests := []subtest{
+		{
+			name:     "cn",
+			username: "jane",
+			password: "foo",
+			want: connector.Identity{
+				UserID:        "cn=jane,ou=People,ou=Seattle,ou=TestUsernameWithMultipleAttributes,dc=example,dc=org",
+				Username:      "jane",
+				Email:         "janedoe@example.com",
+				EmailVerified: true,
+			},
+		},
+		{
+			name:     "mail",
+			username: "janedoe@example.com",
+			password: "foo",
+			want: connector.Identity{
+				UserID:        "cn=jane,ou=People,ou=Seattle,ou=TestUsernameWithMultipleAttributes,dc=example,dc=org",
+				Username:      "jane",
+				Email:         "janedoe@example.com",
+				EmailVerified: true,
+			},
+		},
+	}
+
+	runTests(t, connectLDAP, c, tests)
+}
+
 func TestGroupQuery(t *testing.T) {
 	c := &Config{}
 	c.UserSearch.BaseDN = "ou=People,ou=TestGroupQuery,dc=example,dc=org"
 	c.UserSearch.NameAttr = "cn"
 	c.UserSearch.EmailAttr = "mail"
 	c.UserSearch.IDAttr = "DN"
-	c.UserSearch.Username = "cn"
+	c.UserSearch.Username = UsernameAttributes{"cn"}
 	c.GroupSearch.BaseDN = "ou=Groups,ou=TestGroupQuery,dc=example,dc=org"
 	c.GroupSearch.UserMatchers = []UserMatcher{
 		{
@@ -227,7 +275,7 @@ func TestGroupsOnUserEntity(t *testing.T) {
 	c.UserSearch.NameAttr = "cn"
 	c.UserSearch.EmailAttr = "mail"
 	c.UserSearch.IDAttr = "DN"
-	c.UserSearch.Username = "cn"
+	c.UserSearch.Username = UsernameAttributes{"cn"}
 	c.GroupSearch.BaseDN = "ou=Groups,ou=TestGroupsOnUserEntity,dc=example,dc=org"
 	c.GroupSearch.UserMatchers = []UserMatcher{
 		{
@@ -273,11 +321,11 @@ func TestGroupFilter(t *testing.T) {
 	c.UserSearch.NameAttr = "cn"
 	c.UserSearch.EmailAttr = "mail"
 	c.UserSearch.IDAttr = "DN"
-	c.UserSearch.Username = "cn"
+	c.UserSearch.Username = UsernameAttributes{"cn"}
 	c.GroupSearch.BaseDN = "ou=TestGroupFilter,dc=example,dc=org"
 	c.GroupSearch.UserMatchers = []UserMatcher{
 		{
-			UserAttr:  "DN",
+			UserAttr:  "dn",
 			GroupAttr: "member",
 		},
 	}
@@ -322,7 +370,7 @@ func TestGroupToUserMatchers(t *testing.T) {
 	c.UserSearch.NameAttr = "cn"
 	c.UserSearch.EmailAttr = "mail"
 	c.UserSearch.IDAttr = "DN"
-	c.UserSearch.Username = "cn"
+	c.UserSearch.Username = UsernameAttributes{"cn"}
 	c.GroupSearch.BaseDN = "ou=TestGroupToUserMatchers,dc=example,dc=org"
 	c.GroupSearch.UserMatchers = []UserMatcher{
 		{
@@ -378,7 +426,7 @@ func TestDeprecatedGroupToUserMatcher(t *testing.T) {
 	c.UserSearch.NameAttr = "cn"
 	c.UserSearch.EmailAttr = "mail"
 	c.UserSearch.IDAttr = "DN"
-	c.UserSearch.Username = "cn"
+	c.UserSearch.Username = UsernameAttributes{"cn"}
 	c.GroupSearch.BaseDN = "ou=TestDeprecatedGroupToUserMatcher,dc=example,dc=org"
 	c.GroupSearch.UserAttr = "DN"
 	c.GroupSearch.GroupAttr = "member"
@@ -423,7 +471,7 @@ func TestStartTLS(t *testing.T) {
 	c.UserSearch.NameAttr = "cn"
 	c.UserSearch.EmailAttr = "mail"
 	c.UserSearch.IDAttr = "DN"
-	c.UserSearch.Username = "cn"
+	c.UserSearch.Username = UsernameAttributes{"cn"}
 
 	tests := []subtest{
 		{
@@ -447,7 +495,7 @@ func TestInsecureSkipVerify(t *testing.T) {
 	c.UserSearch.NameAttr = "cn"
 	c.UserSearch.EmailAttr = "mail"
 	c.UserSearch.IDAttr = "DN"
-	c.UserSearch.Username = "cn"
+	c.UserSearch.Username = UsernameAttributes{"cn"}
 
 	tests := []subtest{
 		{
@@ -471,7 +519,7 @@ func TestLDAPS(t *testing.T) {
 	c.UserSearch.NameAttr = "cn"
 	c.UserSearch.EmailAttr = "mail"
 	c.UserSearch.IDAttr = "DN"
-	c.UserSearch.Username = "cn"
+	c.UserSearch.Username = UsernameAttributes{"cn"}
 
 	tests := []subtest{
 		{
@@ -514,6 +562,86 @@ func TestUsernamePrompt(t *testing.T) {
 	}
 }
 
+func TestUsernameAttributesUnmarshal(t *testing.T) {
+	tests := []struct {
+		name    string
+		json    string
+		want    UsernameAttributes
+		wantErr bool
+	}{
+		{name: "single string", json: `"uid"`, want: UsernameAttributes{"uid"}},
+		{name: "array of strings", json: `["uid","mail"]`, want: UsernameAttributes{"uid", "mail"}},
+		{name: "single element array", json: `["cn"]`, want: UsernameAttributes{"cn"}},
+		{name: "empty string", json: `""`, want: nil},
+		{name: "invalid type", json: `123`, wantErr: true},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			var got UsernameAttributes
+			err := got.UnmarshalJSON([]byte(tt.json))
+			if (err != nil) != tt.wantErr {
+				t.Fatalf("UnmarshalJSON() error = %v, wantErr %v", err, tt.wantErr)
+			}
+			if !tt.wantErr {
+				if diff := pretty.Compare(tt.want, got); diff != "" {
+					t.Errorf("unexpected result: %s", diff)
+				}
+			}
+		})
+	}
+}
+
+func TestNestedGroups(t *testing.T) {
+	c := &Config{}
+	c.UserSearch.BaseDN = "ou=People,ou=TestNestedGroups,dc=example,dc=org"
+	c.UserSearch.NameAttr = "cn"
+	c.UserSearch.EmailAttr = "mail"
+	c.UserSearch.IDAttr = "DN"
+	c.UserSearch.Username = UsernameAttributes{"cn"}
+
+	c.GroupSearch.BaseDN = "ou=TestNestedGroups,dc=example,dc=org"
+	c.GroupSearch.UserMatchers = []UserMatcher{
+		{
+			UserAttr:  "DN",
+			GroupAttr: "member",
+			// Enable Recursive Search
+			RecursionGroupAttr: "member",
+		},
+	}
+	c.GroupSearch.NameAttr = "cn"
+
+	tests := []subtest{
+		{
+			name:     "nestedgroups_jane",
+			username: "jane",
+			password: "foo",
+			groups:   true,
+			want: connector.Identity{
+				UserID:        "cn=jane,ou=People,ou=TestNestedGroups,dc=example,dc=org",
+				Username:      "jane",
+				Email:         "janedoe@example.com",
+				EmailVerified: true,
+				Groups:        []string{"childGroup", "circularGroup1", "intermediateGroup", "circularGroup2", "parentGroup"},
+			},
+		},
+		{
+			name:     "nestedgroups_john",
+			username: "john",
+			password: "bar",
+			groups:   true,
+			want: connector.Identity{
+				UserID:        "cn=john,ou=People,ou=TestNestedGroups,dc=example,dc=org",
+				Username:      "john",
+				Email:         "johndoe@example.com",
+				EmailVerified: true,
+				Groups:        []string{"circularGroup2", "intermediateGroup", "circularGroup1", "parentGroup"},
+			},
+		},
+	}
+	runTests(t, connectLDAP, c, tests)
+}
+
 func getenv(key, defaultVal string) string {
 	if val := os.Getenv(key); val != "" {
 		return val
@@ -523,7 +651,7 @@ func getenv(key, defaultVal string) string {
 
 // runTests runs a set of tests against an LDAP schema.
 //
-// The tests require LDAP to be runnning.
+// The tests require LDAP to be running.
 // You can use the provided docker-compose file to setup an LDAP server.
 func runTests(t *testing.T, connMethod connectionMethod, config *Config, tests []subtest) {
 	ldapHost := os.Getenv("DEX_LDAP_HOST")
@@ -555,7 +683,7 @@ func runTests(t *testing.T, connMethod connectionMethod, config *Config, tests [
 	c.BindDN = "cn=admin,dc=example,dc=org"
 	c.BindPW = "admin"
 
-	l := &logrus.Logger{Out: io.Discard, Formatter: &logrus.TextFormatter{}}
+	l := slog.New(slog.DiscardHandler)
 
 	conn, err := c.openConnector(l)
 	if err != nil {
diff --git a/connector/ldap/testdata/schema.ldif b/connector/ldap/testdata/schema.ldif
index 69c7b3ff64..ab133543b4 100644
--- a/connector/ldap/testdata/schema.ldif
+++ b/connector/ldap/testdata/schema.ldif
@@ -445,3 +445,85 @@ sn: doe
 cn: jane
 mail: janedoe@example.com
 userpassword: foo
+
+########################################################################
+
+dn: ou=TestNestedGroups,dc=example,dc=org
+objectClass: organizationalUnit
+ou: TestNestedGroups
+
+dn: ou=People,ou=TestNestedGroups,dc=example,dc=org
+objectClass: organizationalUnit
+ou: People
+
+dn: cn=jane,ou=People,ou=TestNestedGroups,dc=example,dc=org
+objectClass: person
+objectClass: inetOrgPerson
+sn: doe
+cn: jane
+mail: janedoe@example.com
+userpassword: foo
+
+dn: cn=john,ou=People,ou=TestNestedGroups,dc=example,dc=org
+objectClass: person
+objectClass: inetOrgPerson
+sn: doe
+cn: john
+mail: johndoe@example.com
+userpassword: bar
+
+# Group definitions.
+
+dn: ou=Groups,ou=TestNestedGroups,dc=example,dc=org
+objectClass: organizationalUnit
+ou: Groups
+
+dn: cn=childGroup,ou=Groups,ou=TestNestedGroups,dc=example,dc=org
+objectClass: groupOfNames
+cn: childGroup
+member: cn=jane,ou=People,ou=TestNestedGroups,dc=example,dc=org
+
+dn: cn=intermediateGroup,ou=Groups,ou=TestNestedGroups,dc=example,dc=org
+objectClass: groupOfNames
+cn: intermediateGroup
+member: cn=childGroup,ou=Groups,ou=TestNestedGroups,dc=example,dc=org
+member: cn=john,ou=People,ou=TestNestedGroups,dc=example,dc=org
+
+dn: cn=parentGroup,ou=Groups,ou=TestNestedGroups,dc=example,dc=org
+objectClass: groupOfNames
+cn: parentGroup
+member: cn=intermediateGroup,ou=Groups,ou=TestNestedGroups,dc=example,dc=org
+
+dn: cn=circularGroup1,ou=Groups,ou=TestNestedGroups,dc=example,dc=org
+objectClass: groupOfNames
+cn: circularGroup1
+member: cn=circularGroup2,ou=Groups,ou=TestNestedGroups,dc=example,dc=org
+member: cn=jane,ou=People,ou=TestNestedGroups,dc=example,dc=org
+
+dn: cn=circularGroup2,ou=Groups,ou=TestNestedGroups,dc=example,dc=org
+objectClass: groupOfNames
+cn: circularGroup2
+member: cn=circularGroup1,ou=Groups,ou=TestNestedGroups,dc=example,dc=org
+member: cn=john,ou=People,ou=TestNestedGroups,dc=example,dc=org
+
+########################################################################
+
+dn: ou=TestUsernameWithMultipleAttributes,dc=example,dc=org
+objectClass: organizationalUnit
+ou: TestUsernameWithMultipleAttributes
+
+dn: ou=Seattle,ou=TestUsernameWithMultipleAttributes,dc=example,dc=org
+objectClass: organizationalUnit
+ou: Seattle
+
+dn: ou=People,ou=Seattle,ou=TestUsernameWithMultipleAttributes,dc=example,dc=org
+objectClass: organizationalUnit
+ou: People
+
+dn: cn=jane,ou=People,ou=Seattle,ou=TestUsernameWithMultipleAttributes,dc=example,dc=org
+objectClass: person
+objectClass: inetOrgPerson
+sn: doe
+cn: jane
+mail: janedoe@example.com
+userpassword: foo
\ No newline at end of file
diff --git a/connector/linkedin/linkedin.go b/connector/linkedin/linkedin.go
index f79f1c49d8..32e33aeaca 100644
--- a/connector/linkedin/linkedin.go
+++ b/connector/linkedin/linkedin.go
@@ -6,13 +6,13 @@ import (
 	"encoding/json"
 	"fmt"
 	"io"
+	"log/slog"
 	"net/http"
 	"strings"
 
 	"golang.org/x/oauth2"
 
 	"github.com/dexidp/dex/connector"
-	"github.com/dexidp/dex/pkg/log"
 )
 
 const (
@@ -29,7 +29,7 @@ type Config struct {
 }
 
 // Open returns a strategy for logging in through LinkedIn
-func (c *Config) Open(id string, logger log.Logger) (connector.Connector, error) {
+func (c *Config) Open(id string, logger *slog.Logger) (connector.Connector, error) {
 	return &linkedInConnector{
 		oauth2Config: &oauth2.Config{
 			ClientID:     c.ClientID,
@@ -41,7 +41,7 @@ func (c *Config) Open(id string, logger log.Logger) (connector.Connector, error)
 			Scopes:      []string{"r_liteprofile", "r_emailaddress"},
 			RedirectURL: c.RedirectURI,
 		},
-		logger: logger,
+		logger: logger.With(slog.Group("connector", "type", "linkedin", "id", id)),
 	}, nil
 }
 
@@ -49,30 +49,28 @@ type connectorData struct {
 	AccessToken string `json:"accessToken"`
 }
 
-type linkedInConnector struct {
-	oauth2Config *oauth2.Config
-	logger       log.Logger
-}
-
-// LinkedIn doesn't provide refresh tokens, so refresh tokens issued by Dex
-// will expire in 60 days (default LinkedIn token lifetime).
 var (
 	_ connector.CallbackConnector = (*linkedInConnector)(nil)
 	_ connector.RefreshConnector  = (*linkedInConnector)(nil)
 )
 
+type linkedInConnector struct {
+	oauth2Config *oauth2.Config
+	logger       *slog.Logger
+}
+
 // LoginURL returns an access token request URL
-func (c *linkedInConnector) LoginURL(scopes connector.Scopes, callbackURL, state string) (string, error) {
+func (c *linkedInConnector) LoginURL(scopes connector.Scopes, callbackURL, state string) (string, []byte, error) {
 	if c.oauth2Config.RedirectURL != callbackURL {
-		return "", fmt.Errorf("expected callback URL %q did not match the URL in the config %q",
+		return "", nil, fmt.Errorf("expected callback URL %q did not match the URL in the config %q",
 			callbackURL, c.oauth2Config.RedirectURL)
 	}
 
-	return c.oauth2Config.AuthCodeURL(state), nil
+	return c.oauth2Config.AuthCodeURL(state), nil, nil
 }
 
 // HandleCallback handles HTTP redirect from LinkedIn
-func (c *linkedInConnector) HandleCallback(s connector.Scopes, r *http.Request) (identity connector.Identity, err error) {
+func (c *linkedInConnector) HandleCallback(s connector.Scopes, connData []byte, r *http.Request) (identity connector.Identity, err error) {
 	q := r.URL.Query()
 	if errType := q.Get("error"); errType != "" {
 		return identity, &oauth2Error{errType, q.Get("error_description")}
diff --git a/connector/microsoft/TESTING.md b/connector/microsoft/TESTING.md
new file mode 100644
index 0000000000..f9e8e7c8c4
--- /dev/null
+++ b/connector/microsoft/TESTING.md
@@ -0,0 +1,422 @@
+# Testing the Microsoft Connector
+
+This guide covers how to test the Microsoft connector with both client secret and client assertion authentication methods.
+
+## Prerequisites
+
+- `az` CLI installed and logged in (`az login`)
+- `openssl` (for generating keypairs)
+- Dex built locally (`make build examples`)
+- `jq` (for JSON parsing)
+- `kubectl` - for testing using Federated Credential
+
+## Setup Azure AD Application
+
+First, create an Azure AD application that will be used for testing:
+
+```bash
+# Set variables
+APP_NAME="dex-test-$(date +%s)"
+REDIRECT_URI="http://127.0.0.1:5556/dex/callback"
+
+# Create the application
+APP_JSON=$(az ad app create \
+  --display-name "${APP_NAME}" \
+  --sign-in-audience AzureADMyOrg \
+  --web-redirect-uris "${REDIRECT_URI}" \
+  --query '{appId:appId,displayName:displayName}' \
+  -o json)
+
+APP_ID=$(echo "${APP_JSON}" | jq -r .appId)
+
+# Get your tenant ID
+TENANT_ID=$(az account show --query tenantId -o tsv)
+```
+
+Add Microsoft Graph API permissions:
+
+```bash
+# Add User.Read and Directory.Read.All permissions
+az ad app permission add \
+  --id "${APP_ID}" \
+  --api 00000003-0000-0000-c000-000000000000 \
+  --api-permissions \
+    e1fe6dd8-ba31-4d61-89e7-88639da4683d=Scope \
+    06da0dbc-49e2-44d2-8312-53f166ab848a=Scope
+
+# Note: Admin consent may be required for Directory.Read.All
+# You can grant it via Azure Portal or with admin permissions:
+az ad app permission admin-consent --id "${APP_ID}"
+```
+
+## Method 1: Testing with Client Secret
+
+### Create Client Secret
+
+```bash
+# Create a client secret (expires in 1 year)
+SECRET_JSON=$(az ad app credential reset \
+  --id "${APP_ID}" \
+  --append \
+  --years 1 \
+  --query '{secret:password}' \
+  -o json)
+
+CLIENT_SECRET=$(echo "${SECRET_JSON}" | jq -r '.secret')
+```
+
+### Create Dex Configuration for Client Secret
+
+```bash
+# Create temporary config file with client secret
+CONFIG_FILE=$(mktemp -t dex-config-secret.yaml)
+cat > "${CONFIG_FILE}" <<EOF
+issuer: http://127.0.0.1:5556/dex
+
+storage:
+  type: sqlite3
+  config:
+    file: var/dex.db
+
+web:
+  http: 127.0.0.1:5556
+
+telemetry:
+  http: 127.0.0.1:5558
+
+staticClients:
+  - id: example-app
+    redirectURIs:
+      - 'http://127.0.0.1:5555/callback'
+    name: 'Example App'
+    secret: ZXhhbXBsZS1hcHAtc2VjcmV0
+
+connectors:
+  - type: microsoft
+    id: microsoft
+    name: Microsoft
+    config:
+      clientID: "${APP_ID}"
+      clientSecret: "${CLIENT_SECRET}"
+      tenant: "${TENANT_ID}"
+      redirectURI: http://127.0.0.1:5556/dex/callback
+
+enablePasswordDB: true
+EOF
+```
+
+### Run the Test with Client Secret
+
+```bash
+# Terminal 1: Start Dex
+./bin/dex serve "${CONFIG_FILE}"
+
+# Terminal 2: Start example app
+./bin/example-app --issuer http://127.0.0.1:5556/dex
+
+# Open browser to http://127.0.0.1:5555 and test login with the following:
+echo "Test the config with the following:"
+echo "Authenticate for: example-app"
+echo "Connector ID: microsoft"
+
+# When done, remove the temporary config file
+rm "${CONFIG_FILE}"
+```
+
+## Method 2: Testing with Client Assertion (JWT)
+
+### Generate RSA Keypair and Certificate
+
+```bash
+# Create temporary directory for keys
+KEYS_DIR=$(mktemp -d -t microsoft-test-keys.XXXXXX)
+
+# Generate RSA private key (2048-bit)
+openssl genrsa -out "${KEYS_DIR}/private.pem" 2048
+
+# Create a self-signed certificate
+openssl req -new -x509 \
+  -key "${KEYS_DIR}/private.pem" \
+  -out "${KEYS_DIR}/cert.pem" \
+  -days 365 \
+  -subj "/CN=dex-test"
+```
+
+### Upload Public Certificate to Azure AD
+
+```bash
+# Upload certificate to Azure AD application
+az ad app credential reset \
+  --id "${APP_ID}" \
+  --cert "@${KEYS_DIR}/cert.pem" \
+  --append
+
+# Get certificate thumbprint (for JWT header)
+THUMBPRINT=$(openssl x509 -in "${KEYS_DIR}/cert.pem" \
+  -fingerprint -noout -sha1 | sed 's/://g' | cut -d= -f2)
+```
+
+### Create JWT Generation Script
+
+Create the JWT generation script:
+
+```bash
+cat > "${KEYS_DIR}/generate-jwt.sh" <<'SCRIPT'
+#!/bin/bash
+set -e
+
+PRIVATE_KEY="$1"
+CERT="$2"
+APP_ID="$3"
+TENANT_ID="$4"
+
+if [[ -z "${PRIVATE_KEY}" || -z "${CERT}" || -z "${APP_ID}" || -z "${TENANT_ID}" ]]; then
+  echo "Usage: $0 <private-key> <cert> <app-id> <tenant-id>"
+  exit 1
+fi
+
+# Base64URL encode function
+base64url() {
+  openssl base64 -e -A | tr '+/' '-_' | tr -d '='
+}
+
+# Get certificate thumbprint for x5t header
+X5T=$(openssl x509 -in "${CERT}" -fingerprint -noout -sha1 | \
+  sed 's/://g' | cut -d= -f2 | xxd -r -p | base64url)
+
+# JWT Header
+HEADER=$(echo -n "{\"alg\":\"RS256\",\"typ\":\"JWT\",\"x5t\":\"${X5T}\"}" | base64url)
+
+# JWT Claims
+NOW=$(date +%s)
+EXP=$((NOW + 3600))  # Expires in 1 hour
+JTI=$(uuidgen 2>/dev/null || cat /proc/sys/kernel/random/uuid 2>/dev/null || echo "$(date +%s)-$$")
+
+CLAIMS=$(cat <<EOF | tr -d '\n' | tr -d ' '
+{
+  "aud": "https://login.microsoftonline.com/${TENANT_ID}/oauth2/v2.0/token",
+  "exp": ${EXP},
+  "iss": "${APP_ID}",
+  "jti": "${JTI}",
+  "nbf": ${NOW},
+  "sub": "${APP_ID}",
+  "iat": ${NOW}
+}
+EOF
+)
+
+CLAIMS_B64=$(echo -n "${CLAIMS}" | base64url)
+
+# Create signature
+SIGNATURE=$(echo -n "${HEADER}.${CLAIMS_B64}" | \
+  openssl dgst -sha256 -sign "${PRIVATE_KEY}" -binary | base64url)
+
+# Output JWT
+echo "${HEADER}.${CLAIMS_B64}.${SIGNATURE}"
+SCRIPT
+
+chmod +x "${KEYS_DIR}/generate-jwt.sh"
+```
+
+### Generate JWT Assertion
+
+```bash
+# Generate JWT assertion
+"${KEYS_DIR}/generate-jwt.sh" \
+  "${KEYS_DIR}/private.pem" \
+  "${KEYS_DIR}/cert.pem" \
+  "${APP_ID}" \
+  "${TENANT_ID}" \
+  > "${KEYS_DIR}/assertion.jwt"
+
+```
+
+### Create Dex Configuration for Client Assertion
+
+```bash
+# Create temporary config file with client assertion
+CONFIG_FILE=$(mktemp -t dex-config-assertion.XXXXXX.yaml)
+cat > "${CONFIG_FILE}" <<EOF
+issuer: http://127.0.0.1:5556/dex
+
+storage:
+  type: sqlite3
+  config:
+    file: var/dex-assertion.db
+
+web:
+  http: 127.0.0.1:5556
+
+telemetry:
+  http: 127.0.0.1:5558
+
+staticClients:
+  - id: example-app
+    redirectURIs:
+      - 'http://127.0.0.1:5555/callback'
+    name: 'Example App'
+    secret: ZXhhbXBsZS1hcHAtc2VjcmV0
+
+connectors:
+  - type: microsoft
+    id: microsoft-assertion
+    name: Microsoft (Client Assertion)
+    config:
+      clientID: "${APP_ID}"
+      clientAssertion: "${KEYS_DIR}/assertion.jwt"
+      tenant: "${TENANT_ID}"
+      redirectURI: http://127.0.0.1:5556/dex/callback
+
+enablePasswordDB: true
+EOF
+```
+
+### Run the Test with Client Assertion
+
+```bash
+# Regenerate JWT before each test (they expire after 1 hour)
+"${KEYS_DIR}/generate-jwt.sh" \
+  "${KEYS_DIR}/private.pem" \
+  "${KEYS_DIR}/cert.pem" \
+  "${APP_ID}" \
+  "${TENANT_ID}" \
+  > "${KEYS_DIR}/assertion.jwt"
+
+# Terminal 1: Start Dex
+./bin/dex serve "${CONFIG_FILE}"
+
+# Terminal 2: Start example app
+./bin/example-app --issuer http://127.0.0.1:5556/dex
+
+# Open browser to http://127.0.0.1:5555 and test login
+echo "Test the config with the following:"
+echo "Authenticate for: example-app"
+echo "Connector ID: microsoft-assertion"
+
+# When done, remove the temporary files
+rm "${CONFIG_FILE}"
+rm -rf "${KEYS_DIR}"
+```
+
+## Method 3: Testing with Client Assertion Using Kubernetes Workload Identity
+
+If you have a Kubernetes cluster with a publicly available OIDC issuer configured for service accounts:
+
+### Create Service Account
+
+```bash
+kubectl create serviceaccount dex-test -n default
+```
+
+### Configure Federated Credential in Azure
+
+```bash
+# Get your Kubernetes OIDC issuer
+K8S_ISSUER=$(kubectl get --raw /.well-known/openid-configuration | jq -r '.issuer')
+
+# Create federated credential
+az ad app federated-credential create \
+  --id "${APP_ID}" \
+  --parameters "{
+    \"name\": \"k8s-dex-test\",
+    \"issuer\": \"${K8S_ISSUER}\",
+    \"subject\": \"system:serviceaccount:default:dex-test\",
+    \"audiences\": [\"api://AzureADTokenExchange\"]
+  }"
+```
+
+### Generate Kubernetes Token
+
+```bash
+# Create temporary file for the Kubernetes token
+K8S_TOKEN_FILE=$(mktemp -t k8s-token.jwt)
+
+# Create token with correct audience
+kubectl create token dex-test \
+  -n default \
+  --duration=1h \
+  --audience=api://AzureADTokenExchange \
+  > "${K8S_TOKEN_FILE}"
+```
+
+### Create Dex Configuration for Kubernetes
+
+```bash
+# Create temporary config file with Kubernetes token
+CONFIG_FILE=$(mktemp -t dex-config-k8s.yaml)
+cat > "${CONFIG_FILE}" <<EOF
+issuer: http://127.0.0.1:5556/dex
+
+storage:
+  type: sqlite3
+  config:
+    file: var/dex-k8s.db
+
+web:
+  http: 127.0.0.1:5556
+
+telemetry:
+  http: 127.0.0.1:5558
+
+staticClients:
+  - id: example-app
+    redirectURIs:
+      - 'http://127.0.0.1:5555/callback'
+    name: 'Example App'
+    secret: ZXhhbXBsZS1hcHAtc2VjcmV0
+
+connectors:
+  - type: microsoft
+    id: microsoft-k8s
+    name: Microsoft (Kubernetes Workload Identity)
+    config:
+      clientID: "${APP_ID}"
+      clientAssertion: "${K8S_TOKEN_FILE}"
+      tenant: "${TENANT_ID}"
+      redirectURI: http://127.0.0.1:5556/dex/callback
+
+enablePasswordDB: true
+EOF
+```
+
+### Run Dex
+
+```bash
+# Terminal 1: Start Dex
+./bin/dex serve "${CONFIG_FILE}"
+
+# Terminal 2: Start example app
+./bin/example-app --issuer http://127.0.0.1:5556/dex
+
+# Open browser to http://127.0.0.1:5555 and test login
+echo "Test the config with the following:"
+echo "Authenticate for: example-app"
+echo "Connector ID: microsoft-k8s"
+
+# When done, remove the temporary files
+rm "${CONFIG_FILE}"
+rm "${K8S_TOKEN_FILE}"
+```
+
+## Cleanup
+
+```bash
+# Delete the Azure AD application
+az ad app delete --id "${APP_ID}"
+
+# Delete Kubernetes resources (if created)
+kubectl delete serviceaccount dex-test -n default
+
+# Remove temporary files and directories
+rm -f var/dex.db var/dex-assertion.db var/dex-k8s.db
+[ -n "${CONFIG_FILE}" ] && rm -f "${CONFIG_FILE}"
+[ -n "${KEYS_DIR}" ] && rm -rf "${KEYS_DIR}"
+[ -n "${K8S_TOKEN_FILE}" ] && rm -f "${K8S_TOKEN_FILE}"
+```
+
+## Notes
+
+- JWTs generated with the script are valid for 1 hour
+- Dex reads the assertion file on each authentication request, so you can update it without restarting Dex
+- For production use with Kubernetes, the token is automatically rotated by the kubelet
+- Client assertions are recommended over client secrets for improved security (no secrets to store)
diff --git a/connector/microsoft/microsoft.go b/connector/microsoft/microsoft.go
index 3952c94be6..202c5e91eb 100644
--- a/connector/microsoft/microsoft.go
+++ b/connector/microsoft/microsoft.go
@@ -8,7 +8,10 @@ import (
 	"errors"
 	"fmt"
 	"io"
+	"log/slog"
 	"net/http"
+	"net/url"
+	"os"
 	"strings"
 	"sync"
 	"time"
@@ -17,7 +20,6 @@ import (
 
 	"github.com/dexidp/dex/connector"
 	groups_pkg "github.com/dexidp/dex/pkg/groups"
-	"github.com/dexidp/dex/pkg/log"
 )
 
 // GroupNameFormat represents the format of the group identifier
@@ -42,10 +44,11 @@ const (
 	scopeOfflineAccess = "offline_access"
 )
 
-// Config holds configuration options for microsoft logins.
+// Config holds configuration options for Microsoft logins.
 type Config struct {
 	ClientID             string          `json:"clientID"`
 	ClientSecret         string          `json:"clientSecret"`
+	ClientAssertion      string          `json:"clientAssertion"`
 	RedirectURI          string          `json:"redirectURI"`
 	Tenant               string          `json:"tenant"`
 	OnlySecurityGroups   bool            `json:"onlySecurityGroups"`
@@ -54,33 +57,62 @@ type Config struct {
 	UseGroupsAsWhitelist bool            `json:"useGroupsAsWhitelist"`
 	EmailToLowercase     bool            `json:"emailToLowercase"`
 
+	// BatchGroupLookups controls whether group name lookups are split into
+	// batches of 1000 IDs (the Graph API's per-request limit for
+	// /directoryObjects/getByIds). When false (the default), all group IDs
+	// are sent in a single request, which fails for users in more than 1000
+	// groups — this preserves existing behavior for deployments that haven't
+	// opted in. When true, lookups are chunked, adding one Graph API request
+	// per 1000 groups a user belongs to.
+	BatchGroupLookups bool `json:"batchGroupLookups"`
+
+	APIURL   string `json:"apiURL"`
+	GraphURL string `json:"graphURL"`
+
 	// PromptType is used for the prompt query parameter.
 	// For valid values, see https://docs.microsoft.com/en-us/azure/active-directory/develop/v2-oauth2-auth-code-flow#request-an-authorization-code.
 	PromptType string `json:"promptType"`
 	DomainHint string `json:"domainHint"`
 
 	Scopes []string `json:"scopes"` // defaults to scopeUser (user.read)
+
+	// PreferredUsernameField allows users to set the field to any of the
+	// following values: "name", "email", "mailNickname" or "onPremisesSamAccountName".
+	// If unset, the preferred_username field will remain empty.
+	PreferredUsernameField string `json:"preferredUsernameField"`
 }
 
 // Open returns a strategy for logging in through Microsoft.
-func (c *Config) Open(id string, logger log.Logger) (connector.Connector, error) {
+func (c *Config) Open(id string, logger *slog.Logger) (connector.Connector, error) {
 	m := microsoftConnector{
-		apiURL:               "https://login.microsoftonline.com",
-		graphURL:             "https://graph.microsoft.com",
-		redirectURI:          c.RedirectURI,
-		clientID:             c.ClientID,
-		clientSecret:         c.ClientSecret,
-		tenant:               c.Tenant,
-		onlySecurityGroups:   c.OnlySecurityGroups,
-		groups:               c.Groups,
-		groupNameFormat:      c.GroupNameFormat,
-		useGroupsAsWhitelist: c.UseGroupsAsWhitelist,
-		logger:               logger,
-		emailToLowercase:     c.EmailToLowercase,
-		promptType:           c.PromptType,
-		domainHint:           c.DomainHint,
-		scopes:               c.Scopes,
+		apiURL:                 strings.TrimSuffix(c.APIURL, "/"),
+		graphURL:               strings.TrimSuffix(c.GraphURL, "/"),
+		redirectURI:            c.RedirectURI,
+		clientID:               c.ClientID,
+		clientSecret:           c.ClientSecret,
+		clientAssertion:        c.ClientAssertion,
+		tenant:                 c.Tenant,
+		onlySecurityGroups:     c.OnlySecurityGroups,
+		groups:                 c.Groups,
+		groupNameFormat:        c.GroupNameFormat,
+		useGroupsAsWhitelist:   c.UseGroupsAsWhitelist,
+		batchGroupLookups:      c.BatchGroupLookups,
+		logger:                 logger.With(slog.Group("connector", "type", "microsoft", "id", id)),
+		emailToLowercase:       c.EmailToLowercase,
+		promptType:             c.PromptType,
+		domainHint:             c.DomainHint,
+		scopes:                 c.Scopes,
+		preferredUsernameField: c.PreferredUsernameField,
+	}
+
+	if m.apiURL == "" {
+		m.apiURL = "https://login.microsoftonline.com"
+	}
+
+	if m.graphURL == "" {
+		m.graphURL = "https://graph.microsoft.com"
 	}
+
 	// By default allow logins from both personal and business/school
 	// accounts.
 	if m.tenant == "" {
@@ -111,21 +143,24 @@ var (
 )
 
 type microsoftConnector struct {
-	apiURL               string
-	graphURL             string
-	redirectURI          string
-	clientID             string
-	clientSecret         string
-	tenant               string
-	onlySecurityGroups   bool
-	groupNameFormat      GroupNameFormat
-	groups               []string
-	useGroupsAsWhitelist bool
-	logger               log.Logger
-	emailToLowercase     bool
-	promptType           string
-	domainHint           string
-	scopes               []string
+	apiURL                 string
+	graphURL               string
+	redirectURI            string
+	clientID               string
+	clientSecret           string
+	clientAssertion        string
+	tenant                 string
+	onlySecurityGroups     bool
+	groupNameFormat        GroupNameFormat
+	groups                 []string
+	useGroupsAsWhitelist   bool
+	batchGroupLookups      bool
+	logger                 *slog.Logger
+	emailToLowercase       bool
+	promptType             string
+	domainHint             string
+	scopes                 []string
+	preferredUsernameField string
 }
 
 func (c *microsoftConnector) isOrgTenant() bool {
@@ -151,9 +186,8 @@ func (c *microsoftConnector) oauth2Config(scopes connector.Scopes) *oauth2.Confi
 		microsoftScopes = append(microsoftScopes, scopeOfflineAccess)
 	}
 
-	return &oauth2.Config{
-		ClientID:     c.clientID,
-		ClientSecret: c.clientSecret,
+	config := &oauth2.Config{
+		ClientID: c.clientID,
 		Endpoint: oauth2.Endpoint{
 			AuthURL:  c.apiURL + "/" + c.tenant + "/oauth2/v2.0/authorize",
 			TokenURL: c.apiURL + "/" + c.tenant + "/oauth2/v2.0/token",
@@ -161,11 +195,20 @@ func (c *microsoftConnector) oauth2Config(scopes connector.Scopes) *oauth2.Confi
 		Scopes:      microsoftScopes,
 		RedirectURL: c.redirectURI,
 	}
+
+	// Only set ClientSecret if not using client assertion
+	if c.clientAssertion == "" {
+		config.ClientSecret = c.clientSecret
+	} else {
+		config.Endpoint.AuthStyle = oauth2.AuthStyleInParams
+	}
+
+	return config
 }
 
-func (c *microsoftConnector) LoginURL(scopes connector.Scopes, callbackURL, state string) (string, error) {
+func (c *microsoftConnector) LoginURL(scopes connector.Scopes, callbackURL, state string) (string, []byte, error) {
 	if c.redirectURI != callbackURL {
-		return "", fmt.Errorf("expected callback URL %q did not match the URL in the config %q", callbackURL, c.redirectURI)
+		return "", nil, fmt.Errorf("expected callback URL %q did not match the URL in the config %q", callbackURL, c.redirectURI)
 	}
 
 	var options []oauth2.AuthCodeOption
@@ -176,10 +219,50 @@ func (c *microsoftConnector) LoginURL(scopes connector.Scopes, callbackURL, stat
 		options = append(options, oauth2.SetAuthURLParam("domain_hint", c.domainHint))
 	}
 
-	return c.oauth2Config(scopes).AuthCodeURL(state, options...), nil
+	return c.oauth2Config(scopes).AuthCodeURL(state, options...), nil, nil
+}
+
+// assertionTransport is an http.RoundTripper that intercepts token endpoint requests
+// and injects client_assertion parameters for refresh token flow.
+// Note: For initial token exchange, we use oauth2.SetAuthURLParam instead.
+type assertionTransport struct {
+	assertion string
+	tokenURL  string
+	base      http.RoundTripper
+}
+
+func (t *assertionTransport) RoundTrip(req *http.Request) (*http.Response, error) {
+	// Only modify requests to the token endpoint
+	if req.URL.String() != t.tokenURL {
+		return t.base.RoundTrip(req)
+	}
+
+	// Read the original request body
+	body, err := io.ReadAll(req.Body)
+	if err != nil {
+		return nil, fmt.Errorf("failed to read request body: %v", err)
+	}
+	req.Body.Close()
+
+	// Parse the form data
+	values, err := url.ParseQuery(string(body))
+	if err != nil {
+		return nil, fmt.Errorf("failed to parse request body: %v", err)
+	}
+
+	// Add client_assertion parameters (no need to delete client_secret since it's not set)
+	values.Set("client_assertion", t.assertion)
+	values.Set("client_assertion_type", "urn:ietf:params:oauth:client-assertion-type:jwt-bearer")
+
+	// Create new request with modified body
+	newBody := strings.NewReader(values.Encode())
+	req.Body = io.NopCloser(newBody)
+	req.ContentLength = int64(len(values.Encode()))
+
+	return t.base.RoundTrip(req)
 }
 
-func (c *microsoftConnector) HandleCallback(s connector.Scopes, r *http.Request) (identity connector.Identity, err error) {
+func (c *microsoftConnector) HandleCallback(s connector.Scopes, connData []byte, r *http.Request) (identity connector.Identity, err error) {
 	q := r.URL.Query()
 	if errType := q.Get("error"); errType != "" {
 		return identity, &oauth2Error{errType, q.Get("error_description")}
@@ -189,6 +272,24 @@ func (c *microsoftConnector) HandleCallback(s connector.Scopes, r *http.Request)
 
 	ctx := r.Context()
 
+	// If using client assertion, wrap the HTTP client with a custom transport
+	if c.clientAssertion != "" {
+		assertionBytes, err := os.ReadFile(c.clientAssertion)
+		if err != nil {
+			return identity, fmt.Errorf("microsoft: failed to read client assertion: %v", err)
+		}
+
+		// Create HTTP client with custom transport that injects client_assertion
+		httpClient := &http.Client{
+			Transport: &assertionTransport{
+				assertion: strings.TrimSpace(string(assertionBytes)),
+				tokenURL:  oauth2Config.Endpoint.TokenURL,
+				base:      http.DefaultTransport,
+			},
+		}
+		ctx = context.WithValue(ctx, oauth2.HTTPClient, httpClient)
+	}
+
 	token, err := oauth2Config.Exchange(ctx, q.Get("code"))
 	if err != nil {
 		return identity, fmt.Errorf("microsoft: failed to get token: %v", err)
@@ -211,11 +312,12 @@ func (c *microsoftConnector) HandleCallback(s connector.Scopes, r *http.Request)
 		Email:         user.Email,
 		EmailVerified: true,
 	}
+	c.setPreferredUsername(&identity, user)
 
 	if c.groupsRequired(s.Groups) {
 		groups, err := c.getGroups(ctx, client, user.ID)
 		if err != nil {
-			return identity, fmt.Errorf("microsoft: get groups: %v", err)
+			return identity, fmt.Errorf("microsoft: get groups: %w", err)
 		}
 		identity.Groups = groups
 	}
@@ -278,6 +380,24 @@ func (c *microsoftConnector) Refresh(ctx context.Context, s connector.Scopes, id
 		Expiry:       data.Expiry,
 	}
 
+	// If using client assertion, wrap the HTTP client with a custom transport
+	if c.clientAssertion != "" {
+		assertionBytes, err := os.ReadFile(c.clientAssertion)
+		if err != nil {
+			return identity, fmt.Errorf("microsoft: failed to read client assertion: %v", err)
+		}
+
+		oauth2Config := c.oauth2Config(s)
+		httpClient := &http.Client{
+			Transport: &assertionTransport{
+				assertion: strings.TrimSpace(string(assertionBytes)),
+				tokenURL:  oauth2Config.Endpoint.TokenURL,
+				base:      http.DefaultTransport,
+			},
+		}
+		ctx = context.WithValue(ctx, oauth2.HTTPClient, httpClient)
+	}
+
 	client := oauth2.NewClient(ctx, &notifyRefreshTokenSource{
 		new: c.oauth2Config(s).TokenSource(ctx, tok),
 		t:   tok,
@@ -302,11 +422,12 @@ func (c *microsoftConnector) Refresh(ctx context.Context, s connector.Scopes, id
 
 	identity.Username = user.Name
 	identity.Email = user.Email
+	c.setPreferredUsername(&identity, user)
 
 	if c.groupsRequired(s.Groups) {
 		groups, err := c.getGroups(ctx, client, user.ID)
 		if err != nil {
-			return identity, fmt.Errorf("microsoft: get groups: %v", err)
+			return identity, fmt.Errorf("microsoft: get groups: %w", err)
 		}
 		identity.Groups = groups
 	}
@@ -314,33 +435,70 @@ func (c *microsoftConnector) Refresh(ctx context.Context, s connector.Scopes, id
 	return identity, nil
 }
 
+func (c *microsoftConnector) setPreferredUsername(identity *connector.Identity, u user) {
+	switch c.preferredUsernameField {
+	case "name":
+		identity.PreferredUsername = u.Name
+	case "email":
+		identity.PreferredUsername = u.Email
+	case "mailNickname":
+		identity.PreferredUsername = u.MailNickname
+	case "onPremisesSamAccountName":
+		identity.PreferredUsername = u.OnPremisesSamAccountName
+	default:
+		if c.preferredUsernameField != "" {
+			c.logger.Warn("preferred_username left empty. Invalid microsoft field mapped to preferred_username", "field", c.preferredUsernameField)
+		}
+	}
+}
+
 // https://developer.microsoft.com/en-us/graph/docs/api-reference/v1.0/resources/user
 // id                - The unique identifier for the user. Inherited from
-//                     directoryObject. Key. Not nullable. Read-only.
+//
+//	directoryObject. Key. Not nullable. Read-only.
+//
 // displayName       - The name displayed in the address book for the user.
-//                     This is usually the combination of the user's first name,
-//                     middle initial and last name. This property is required
-//                     when a user is created and it cannot be cleared during
-//                     updates. Supports $filter and $orderby.
+//
+//	This is usually the combination of the user's first name,
+//	middle initial and last name. This property is required
+//	when a user is created and it cannot be cleared during
+//	updates. Supports $filter and $orderby.
+//
 // userPrincipalName - The user principal name (UPN) of the user.
-//                     The UPN is an Internet-style login name for the user
-//                     based on the Internet standard RFC 822. By convention,
-//                     this should map to the user's email name. The general
-//                     format is alias@domain, where domain must be present in
-//                     the tenant’s collection of verified domains. This
-//                     property is required when a user is created. The
-//                     verified domains for the tenant can be accessed from the
-//                     verifiedDomains property of organization. Supports
-//                     $filter and $orderby.
+//
+//	The UPN is an Internet-style login name for the user
+//	based on the Internet standard RFC 822. By convention,
+//	this should map to the user’s email name. The general
+//	format is alias@domain, where domain must be present in
+//	the tenant’s collection of verified domains. This
+//	property is required when a user is created. The
+//	verified domains for the tenant can be accessed from the
+//	verifiedDomains property of organization. Supports
+//	$filter and $orderby.
+//
+// mailNickname      - The mail alias for the user.
+//
+//	This property must be specified when a user is created.
+//	Maximum length is 64 characters. Supports $filter.
+//
+// onPremisesSamAccountName - Contains the on-premises SAM account name
+//
+//	synchronized from the on-premises directory.
+//	This property is only populated for customers
+//	who are synchronizing their on-premises directory
+//	to Azure Active Directory via Azure AD Connect.
+//	Read-only.
 type user struct {
-	ID    string `json:"id"`
-	Name  string `json:"displayName"`
-	Email string `json:"userPrincipalName"`
+	ID                       string `json:"id"`
+	Name                     string `json:"displayName"`
+	Email                    string `json:"userPrincipalName"`
+	MailNickname             string `json:"mailNickname"`
+	OnPremisesSamAccountName string `json:"onPremisesSamAccountName"`
 }
 
 func (c *microsoftConnector) user(ctx context.Context, client *http.Client) (u user, err error) {
 	// https://developer.microsoft.com/en-us/graph/docs/api-reference/v1.0/api/user_get
-	req, err := http.NewRequest("GET", c.graphURL+"/v1.0/me?$select=id,displayName,userPrincipalName", nil)
+	req, err := http.NewRequest("GET", c.graphURL+"/v1.0/me?$select=id,displayName,userPrincipalName,mailNickname,onPremisesSamAccountName", nil)
 	if err != nil {
 		return u, fmt.Errorf("new req: %v", err)
 	}
@@ -364,8 +522,9 @@ func (c *microsoftConnector) user(ctx context.Context, client *http.Client) (u u
 
 // https://developer.microsoft.com/en-us/graph/docs/api-reference/v1.0/resources/group
 // displayName - The display name for the group. This property is required when
-//               a group is created and it cannot be cleared during updates.
-//               Supports $filter and $orderby.
+//
+//	a group is created and it cannot be cleared during updates.
+//	Supports $filter and $orderby.
 type group struct {
 	Name string `json:"displayName"`
 }
@@ -386,7 +545,7 @@ func (c *microsoftConnector) getGroups(ctx context.Context, client *http.Client,
 	// ensure that the user is in at least one required group
 	filteredGroups := groups_pkg.Filter(userGroups, c.groups)
 	if len(c.groups) > 0 && len(filteredGroups) == 0 {
-		return nil, fmt.Errorf("microsoft: user %v not in any of the required groups", userID)
+		return nil, &connector.UserNotInRequiredGroupsError{UserID: userID, Groups: c.groups}
 	} else if c.useGroupsAsWhitelist {
 		return filteredGroups, nil
 	}
@@ -419,32 +578,53 @@ func (c *microsoftConnector) getGroupIDs(ctx context.Context, client *http.Clien
 
 func (c *microsoftConnector) getGroupNames(ctx context.Context, client *http.Client, ids []string) (groups []string, err error) {
 	if len(ids) == 0 {
-		return
+		return nil, nil
 	}
 
-	// https://developer.microsoft.com/en-us/graph/docs/api-reference/v1.0/api/directoryobject_getbyids
-	in := &struct {
-		IDs   []string `json:"ids"`
-		Types []string `json:"types"`
-	}{ids, []string{"group"}}
-	reqURL := c.graphURL + "/v1.0/directoryObjects/getByIds"
-	for {
-		var out []group
-		var next string
+	// Graph API caps /directoryObjects/getByIds at 1000 identifiers per request.
+	// See: https://learn.microsoft.com/en-us/graph/api/directoryobject-getbyids?view=graph-rest-1.0&tabs=http#http-request
+	const maxBatchSize = 1000
 
-		next, err = c.post(ctx, client, reqURL, in, &out)
-		if err != nil {
-			return groups, err
-		}
+	// Default to a single request covering all IDs, matching pre-existing
+	// behavior. Only chunk into multiple requests when BatchGroupLookups is
+	// enabled, since that trades a login failure (>1000 groups) for
+	// additional Graph API requests.
+	batchSize := len(ids)
+	if c.batchGroupLookups {
+		batchSize = maxBatchSize
+	}
 
-		for _, g := range out {
-			groups = append(groups, g.Name)
+	for i := 0; i < len(ids); i += batchSize {
+		end := i + batchSize
+		if end > len(ids) {
+			end = len(ids)
 		}
-		if next == "" {
-			return
+
+		// https://developer.microsoft.com/en-us/graph/docs/api-reference/v1.0/api/directoryobject_getbyids
+		in := &struct {
+			IDs   []string `json:"ids"`
+			Types []string `json:"types"`
+		}{ids[i:end], []string{"group"}}
+		reqURL := c.graphURL + "/v1.0/directoryObjects/getByIds"
+		for {
+			var out []group
+			var next string
+
+			next, err = c.post(ctx, client, reqURL, in, &out)
+			if err != nil {
+				return groups, err
+			}
+
+			for _, g := range out {
+				groups = append(groups, g.Name)
+			}
+			if next == "" {
+				break
+			}
+			reqURL = next
 		}
-		reqURL = next
 	}
+	return groups, err
 }
 
 func (c *microsoftConnector) post(ctx context.Context, client *http.Client, reqURL string, in interface{}, out interface{}) (string, error) {
diff --git a/connector/microsoft/microsoft_test.go b/connector/microsoft/microsoft_test.go
index 67be660fce..b01a9ed916 100644
--- a/connector/microsoft/microsoft_test.go
+++ b/connector/microsoft/microsoft_test.go
@@ -2,12 +2,16 @@ package microsoft
 
 import (
 	"encoding/json"
+	"errors"
 	"fmt"
+	"io"
+	"log/slog"
 	"net/http"
 	"net/http/httptest"
 	"net/url"
 	"os"
 	"reflect"
+	"sync/atomic"
 	"testing"
 
 	"github.com/dexidp/dex/connector"
@@ -39,7 +43,7 @@ func TestLoginURL(t *testing.T) {
 		tenant:      tenant,
 	}
 
-	loginURL, _ := conn.LoginURL(connector.Scopes{}, conn.redirectURI, testState)
+	loginURL, _, _ := conn.LoginURL(connector.Scopes{}, conn.redirectURI, testState)
 
 	parsedLoginURL, _ := url.Parse(loginURL)
 	queryParams := parsedLoginURL.Query()
@@ -70,7 +74,7 @@ func TestLoginURLWithOptions(t *testing.T) {
 		domainHint: domainHint,
 	}
 
-	loginURL, _ := conn.LoginURL(connector.Scopes{}, conn.redirectURI, "some-state")
+	loginURL, _, _ := conn.LoginURL(connector.Scopes{}, conn.redirectURI, "some-state")
 
 	parsedLoginURL, _ := url.Parse(loginURL)
 	queryParams := parsedLoginURL.Query()
@@ -81,7 +85,7 @@ func TestLoginURLWithOptions(t *testing.T) {
 
 func TestUserIdentityFromGraphAPI(t *testing.T) {
 	s := newTestServer(map[string]testResponse{
-		"/v1.0/me?$select=id,displayName,userPrincipalName": {
+		"/v1.0/me?$select=id,displayName,userPrincipalName,mailNickname,onPremisesSamAccountName": {
 			data: user{ID: "S56767889", Name: "Jane Doe", Email: "jane.doe@example.com"},
 		},
 		"/" + tenant + "/oauth2/v2.0/token": dummyToken,
@@ -91,7 +95,7 @@ func TestUserIdentityFromGraphAPI(t *testing.T) {
 	req, _ := http.NewRequest("GET", s.URL, nil)
 
 	c := microsoftConnector{apiURL: s.URL, graphURL: s.URL, tenant: tenant}
-	identity, err := c.HandleCallback(connector.Scopes{Groups: false}, req)
+	identity, err := c.HandleCallback(connector.Scopes{Groups: false}, nil, req)
 	expectNil(t, err)
 	expectEquals(t, identity.Username, "Jane Doe")
 	expectEquals(t, identity.UserID, "S56767889")
@@ -101,9 +105,39 @@ func TestUserIdentityFromGraphAPI(t *testing.T) {
 	expectEquals(t, len(identity.Groups), 0)
 }
 
+func TestPreferredUsernameField(t *testing.T) {
+	s := newTestServer(map[string]testResponse{
+		"/v1.0/me?$select=id,displayName,userPrincipalName,mailNickname,onPremisesSamAccountName": {
+			data: user{ID: "S56767889", Name: "Jane Doe", Email: "jane.doe@example.com", MailNickname: "janedoe", OnPremisesSamAccountName: "DOMAIN\\janedoe"},
+		},
+		"/" + tenant + "/oauth2/v2.0/token": dummyToken,
+	})
+	defer s.Close()
+
+	tests := []struct {
+		field    string
+		expected string
+	}{
+		{"", ""},
+		{"name", "Jane Doe"},
+		{"email", "jane.doe@example.com"},
+		{"mailNickname", "janedoe"},
+		{"onPremisesSamAccountName", "DOMAIN\\janedoe"},
+		{"invalidstring", ""},
+	}
+
+	for _, tt := range tests {
+		req, _ := http.NewRequest("GET", s.URL, nil)
+		c := microsoftConnector{apiURL: s.URL, graphURL: s.URL, tenant: tenant, preferredUsernameField: tt.field, logger: slog.Default()}
+		identity, err := c.HandleCallback(connector.Scopes{Groups: false}, nil, req)
+		expectNil(t, err)
+		expectEquals(t, identity.PreferredUsername, tt.expected)
+	}
+}
+
 func TestUserGroupsFromGraphAPI(t *testing.T) {
 	s := newTestServer(map[string]testResponse{
-		"/v1.0/me?$select=id,displayName,userPrincipalName": {data: user{}},
+		"/v1.0/me?$select=id,displayName,userPrincipalName,mailNickname,onPremisesSamAccountName": {data: user{}},
 		"/v1.0/me/getMemberGroups": {data: map[string]interface{}{
 			"value": []string{"a", "b"},
 		}},
@@ -114,11 +148,195 @@ func TestUserGroupsFromGraphAPI(t *testing.T) {
 	req, _ := http.NewRequest("GET", s.URL, nil)
 
 	c := microsoftConnector{apiURL: s.URL, graphURL: s.URL, tenant: tenant}
-	identity, err := c.HandleCallback(connector.Scopes{Groups: true}, req)
+	identity, err := c.HandleCallback(connector.Scopes{Groups: true}, nil, req)
 	expectNil(t, err)
 	expectEquals(t, identity.Groups, []string{"a", "b"})
 }
 
+func TestUserNotInRequiredGroupFromGraphAPI(t *testing.T) {
+	s := newTestServer(map[string]testResponse{
+		"/v1.0/me?$select=id,displayName,userPrincipalName,mailNickname,onPremisesSamAccountName": {
+			data: user{ID: "user-id-123", Name: "Jane Doe", Email: "jane.doe@example.com"},
+		},
+		// The user is a member of groups "c" and "d", but the connector only
+		// allows group "a" — so the user should be denied.
+		"/v1.0/me/getMemberGroups": {data: map[string]interface{}{
+			"value": []string{"c", "d"},
+		}},
+		"/" + tenant + "/oauth2/v2.0/token": dummyToken,
+	})
+	defer s.Close()
+
+	req, _ := http.NewRequest("GET", s.URL, nil)
+
+	c := microsoftConnector{
+		apiURL:   s.URL,
+		graphURL: s.URL,
+		tenant:   tenant,
+		groups:   []string{"a"},
+	}
+	_, err := c.HandleCallback(connector.Scopes{Groups: true}, nil, req)
+	if err == nil {
+		t.Fatal("expected error when user is not in any required group, got nil")
+	}
+
+	var groupsErr *connector.UserNotInRequiredGroupsError
+	if !errors.As(err, &groupsErr) {
+		t.Errorf("expected *connector.UserNotInRequiredGroupsError, got %T: %v", err, err)
+	}
+}
+
+// newGetByIdsBatchServer starts a test server simulating the Graph API's
+// /directoryObjects/getByIds endpoint, which rejects requests with more than
+// 1000 IDs — the same error Graph returns in production.
+func newGetByIdsBatchServer(batchCalls *atomic.Int32) *httptest.Server {
+	return httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.URL.Path != "/v1.0/directoryObjects/getByIds" {
+			http.NotFound(w, r)
+			return
+		}
+		batchCalls.Add(1)
+
+		var body struct {
+			IDs   []string `json:"ids"`
+			Types []string `json:"types"`
+		}
+		if err := json.NewDecoder(r.Body).Decode(&body); err != nil {
+			http.Error(w, "bad request", http.StatusBadRequest)
+			return
+		}
+		if len(body.IDs) > 1000 {
+			w.WriteHeader(http.StatusBadRequest)
+			fmt.Fprintf(w, `{"error":{"code":"Request_BadRequest","message":"Number of included identifiers cannot exceed '1000'."}}`)
+			return
+		}
+
+		out := make([]group, len(body.IDs))
+		for i, id := range body.IDs {
+			out[i] = group{Name: "name-for-" + id}
+		}
+		w.Header().Set("Content-Type", "application/json")
+		json.NewEncoder(w).Encode(map[string]any{"value": out})
+	}))
+}
+
+// TestGetGroupNamesBatchLimit verifies that, when BatchGroupLookups is
+// enabled, getGroupNames splits large ID lists into batches of ≤1000,
+// matching the Graph API limit.
+func TestGetGroupNamesBatchLimit(t *testing.T) {
+	const totalGroups = 1500
+
+	ids := make([]string, totalGroups)
+	for i := range ids {
+		ids[i] = fmt.Sprintf("group-id-%d", i)
+	}
+
+	var batchCalls atomic.Int32
+	s := newGetByIdsBatchServer(&batchCalls)
+	defer s.Close()
+
+	c := microsoftConnector{graphURL: s.URL, logger: slog.Default(), batchGroupLookups: true}
+	names, err := c.getGroupNames(t.Context(), s.Client(), ids)
+	if err != nil {
+		t.Fatalf("getGroupNames returned error: %v", err)
+	}
+	expected := make([]string, totalGroups)
+	for i, id := range ids {
+		expected[i] = "name-for-" + id
+	}
+	if !reflect.DeepEqual(names, expected) {
+		t.Errorf("got %d names %v, want %d names matching input IDs", len(names), names, totalGroups)
+	}
+	// ceil(1500 / 1000) = 2 batches
+	if batchCalls.Load() != 2 {
+		t.Errorf("expected 2 batch calls, got %d", batchCalls.Load())
+	}
+}
+
+// TestGetGroupNamesSingleRequestByDefault verifies that, without
+// BatchGroupLookups enabled, getGroupNames sends all IDs in a single request
+// — preserving pre-existing behavior — and that a user in more than 1000
+// groups gets the same Graph API error as before this feature existed.
+func TestGetGroupNamesSingleRequestByDefault(t *testing.T) {
+	const totalGroups = 1500
+
+	ids := make([]string, totalGroups)
+	for i := range ids {
+		ids[i] = fmt.Sprintf("group-id-%d", i)
+	}
+
+	var batchCalls atomic.Int32
+	s := newGetByIdsBatchServer(&batchCalls)
+	defer s.Close()
+
+	c := microsoftConnector{graphURL: s.URL, logger: slog.Default()}
+	_, err := c.getGroupNames(t.Context(), s.Client(), ids)
+	if err == nil {
+		t.Fatal("expected error for >1000 groups when BatchGroupLookups is disabled, got nil")
+	}
+	if batchCalls.Load() != 1 {
+		t.Errorf("expected exactly 1 request, got %d", batchCalls.Load())
+	}
+}
+
+func TestClientAssertionTokenExchange(t *testing.T) {
+	assertion := "dummy-jwt-assertion"
+	file, err := os.CreateTemp("", "assertion.jwt")
+	if err != nil {
+		t.Fatalf("failed to create temp file: %v", err)
+	}
+	defer os.Remove(file.Name())
+	file.WriteString(assertion + "\n")
+	file.Close()
+
+	tokenCalled := false
+	var receivedAssertion, receivedClientID, receivedSecret, receivedAuthorization string
+	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.Method == "POST" && r.URL.Path == "/testtenant/oauth2/v2.0/token" {
+			receivedAuthorization = r.Header.Get("Authorization")
+			bodyBytes, _ := io.ReadAll(r.Body)
+			r.Body.Close()
+			form, _ := url.ParseQuery(string(bodyBytes))
+			receivedAssertion = form.Get("client_assertion")
+			receivedClientID = form.Get("client_id")
+			receivedSecret = form.Get("client_secret")
+			tokenCalled = true
+			w.Header().Set("Content-Type", "application/json")
+			w.Write([]byte(`{"access_token": "token", "expires_in": 3600}`))
+		}
+	}))
+	defer ts.Close()
+
+	conn := microsoftConnector{
+		apiURL:          ts.URL,
+		graphURL:        ts.URL,
+		redirectURI:     "https://test.com",
+		clientID:        clientID,
+		clientSecret:    "should-not-be-used",
+		tenant:          "testtenant",
+		clientAssertion: file.Name(),
+	}
+
+	req, _ := http.NewRequest("GET", ts.URL, nil)
+	conn.HandleCallback(connector.Scopes{}, nil, req)
+
+	if !tokenCalled {
+		t.Errorf("Token endpoint was not called")
+	}
+	if receivedAssertion != assertion {
+		t.Errorf("Expected client_assertion to be %q, got %q", assertion, receivedAssertion)
+	}
+	if receivedClientID != clientID {
+		t.Errorf("Expected client_id to be %q, got %q", clientID, receivedClientID)
+	}
+	if receivedSecret != "" {
+		t.Errorf("Expected client_secret to be empty, got %q", receivedSecret)
+	}
+	if receivedAuthorization != "" {
+		t.Errorf("Expected Authorization header to be empty, got %q", receivedAuthorization)
+	}
+}
+
 func newTestServer(responses map[string]testResponse) *httptest.Server {
 	s := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		response, found := responses[r.RequestURI]
diff --git a/connector/mock/connectortest.go b/connector/mock/connectortest.go
index e7ee438625..4d9e9e2707 100644
--- a/connector/mock/connectortest.go
+++ b/connector/mock/connectortest.go
@@ -5,16 +5,16 @@ import (
 	"context"
 	"errors"
 	"fmt"
+	"log/slog"
 	"net/http"
 	"net/url"
 
 	"github.com/dexidp/dex/connector"
-	"github.com/dexidp/dex/pkg/log"
 )
 
 // NewCallbackConnector returns a mock connector which requires no user interaction. It always returns
 // the same (fake) identity.
-func NewCallbackConnector(logger log.Logger) connector.Connector {
+func NewCallbackConnector(logger *slog.Logger) connector.Connector {
 	return &Callback{
 		Identity: connector.Identity{
 			UserID:        "0-385-28089-0",
@@ -29,35 +29,34 @@ func NewCallbackConnector(logger log.Logger) connector.Connector {
 }
 
 var (
-	_ connector.CallbackConnector = &Callback{}
-
-	_ connector.PasswordConnector = passwordConnector{}
-	_ connector.RefreshConnector  = passwordConnector{}
+	_ connector.CallbackConnector      = &Callback{}
+	_ connector.RefreshConnector       = &Callback{}
+	_ connector.TokenIdentityConnector = &Callback{}
 )
 
 // Callback is a connector that requires no user interaction and always returns the same identity.
 type Callback struct {
 	// The returned identity.
 	Identity connector.Identity
-	Logger   log.Logger
+	Logger   *slog.Logger
 }
 
 // LoginURL returns the URL to redirect the user to login with.
-func (m *Callback) LoginURL(s connector.Scopes, callbackURL, state string) (string, error) {
+func (m *Callback) LoginURL(s connector.Scopes, callbackURL, state string) (string, []byte, error) {
 	u, err := url.Parse(callbackURL)
 	if err != nil {
-		return "", fmt.Errorf("failed to parse callbackURL %q: %v", callbackURL, err)
+		return "", nil, fmt.Errorf("failed to parse callbackURL %q: %v", callbackURL, err)
 	}
 	v := u.Query()
 	v.Set("state", state)
 	u.RawQuery = v.Encode()
-	return u.String(), nil
+	return u.String(), nil, nil
 }
 
 var connectorData = []byte("foobar")
 
 // HandleCallback parses the request and returns the user's identity
-func (m *Callback) HandleCallback(s connector.Scopes, r *http.Request) (connector.Identity, error) {
+func (m *Callback) HandleCallback(s connector.Scopes, connData []byte, r *http.Request) (connector.Identity, error) {
 	return m.Identity, nil
 }
 
@@ -66,11 +65,16 @@ func (m *Callback) Refresh(ctx context.Context, s connector.Scopes, identity con
 	return m.Identity, nil
 }
 
+func (m *Callback) TokenIdentity(ctx context.Context, subjectTokenType, subjectToken string) (connector.Identity, error) {
+	return m.Identity, nil
+}
+
 // CallbackConfig holds the configuration parameters for a connector which requires no interaction.
 type CallbackConfig struct{}
 
 // Open returns an authentication strategy which requires no user interaction.
-func (c *CallbackConfig) Open(id string, logger log.Logger) (connector.Connector, error) {
+func (c *CallbackConfig) Open(id string, logger *slog.Logger) (connector.Connector, error) {
+	logger = logger.With(slog.Group("connector", "type", "callback", "id", id))
 	return NewCallbackConnector(logger), nil
 }
 
@@ -82,7 +86,7 @@ type PasswordConfig struct {
 }
 
 // Open returns an authentication strategy which prompts for a predefined username and password.
-func (c *PasswordConfig) Open(id string, logger log.Logger) (connector.Connector, error) {
+func (c *PasswordConfig) Open(id string, logger *slog.Logger) (connector.Connector, error) {
 	if c.Username == "" {
 		return nil, errors.New("no username supplied")
 	}
@@ -92,10 +96,15 @@ func (c *PasswordConfig) Open(id string, logger log.Logger) (connector.Connector
 	return &passwordConnector{c.Username, c.Password, logger}, nil
 }
 
+var (
+	_ connector.PasswordConnector = passwordConnector{}
+	_ connector.RefreshConnector  = passwordConnector{}
+)
+
 type passwordConnector struct {
 	username string
 	password string
-	logger   log.Logger
+	logger   *slog.Logger
 }
 
 func (p passwordConnector) Close() error { return nil }
diff --git a/connector/oauth/oauth.go b/connector/oauth/oauth.go
index 237d075e83..2ae13a693b 100644
--- a/connector/oauth/oauth.go
+++ b/connector/oauth/oauth.go
@@ -2,24 +2,22 @@ package oauth
 
 import (
 	"context"
-	"crypto/tls"
-	"crypto/x509"
 	"encoding/base64"
 	"encoding/json"
 	"errors"
 	"fmt"
-	"net"
+	"log/slog"
 	"net/http"
-	"os"
 	"strings"
-	"time"
 
 	"golang.org/x/oauth2"
 
 	"github.com/dexidp/dex/connector"
-	"github.com/dexidp/dex/pkg/log"
+	"github.com/dexidp/dex/pkg/httpclient"
 )
 
+var _ connector.CallbackConnector = (*oauthConnector)(nil)
+
 type oauthConnector struct {
 	clientID             string
 	clientSecret         string
@@ -35,7 +33,7 @@ type oauthConnector struct {
 	emailVerifiedKey     string
 	groupsKey            string
 	httpClient           *http.Client
-	logger               log.Logger
+	logger               *slog.Logger
 }
 
 type connectorData struct {
@@ -62,7 +60,7 @@ type Config struct {
 	} `json:"claimMapping"`
 }
 
-func (c *Config) Open(id string, logger log.Logger) (connector.Connector, error) {
+func (c *Config) Open(id string, logger *slog.Logger) (connector.Connector, error) {
 	var err error
 
 	userIDKey := c.UserIDKey
@@ -103,7 +101,7 @@ func (c *Config) Open(id string, logger log.Logger) (connector.Connector, error)
 		userInfoURL:          c.UserInfoURL,
 		scopes:               c.Scopes,
 		redirectURI:          c.RedirectURI,
-		logger:               logger,
+		logger:               logger.With(slog.Group("connector", "type", "oauth", "id", id)),
 		userIDKey:            userIDKey,
 		userNameKey:          userNameKey,
 		preferredUsernameKey: preferredUsernameKey,
@@ -112,7 +110,7 @@ func (c *Config) Open(id string, logger log.Logger) (connector.Connector, error)
 		emailVerifiedKey:     emailVerifiedKey,
 	}
 
-	oauthConn.httpClient, err = newHTTPClient(c.RootCAs, c.InsecureSkipVerify)
+	oauthConn.httpClient, err = httpclient.NewHTTPClient(c.RootCAs, c.InsecureSkipVerify)
 	if err != nil {
 		return nil, err
 	}
@@ -120,43 +118,9 @@ func (c *Config) Open(id string, logger log.Logger) (connector.Connector, error)
 	return oauthConn, err
 }
 
-func newHTTPClient(rootCAs []string, insecureSkipVerify bool) (*http.Client, error) {
-	pool, err := x509.SystemCertPool()
-	if err != nil {
-		return nil, err
-	}
-
-	tlsConfig := tls.Config{RootCAs: pool, InsecureSkipVerify: insecureSkipVerify}
-	for _, rootCA := range rootCAs {
-		rootCABytes, err := os.ReadFile(rootCA)
-		if err != nil {
-			return nil, fmt.Errorf("failed to read root-ca: %v", err)
-		}
-		if !tlsConfig.RootCAs.AppendCertsFromPEM(rootCABytes) {
-			return nil, fmt.Errorf("no certs found in root CA file %q", rootCA)
-		}
-	}
-
-	return &http.Client{
-		Transport: &http.Transport{
-			TLSClientConfig: &tlsConfig,
-			Proxy:           http.ProxyFromEnvironment,
-			DialContext: (&net.Dialer{
-				Timeout:   30 * time.Second,
-				KeepAlive: 30 * time.Second,
-				DualStack: true,
-			}).DialContext,
-			MaxIdleConns:          100,
-			IdleConnTimeout:       90 * time.Second,
-			TLSHandshakeTimeout:   10 * time.Second,
-			ExpectContinueTimeout: 1 * time.Second,
-		},
-	}, nil
-}
-
-func (c *oauthConnector) LoginURL(scopes connector.Scopes, callbackURL, state string) (string, error) {
+func (c *oauthConnector) LoginURL(scopes connector.Scopes, callbackURL, state string) (string, []byte, error) {
 	if c.redirectURI != callbackURL {
-		return "", fmt.Errorf("expected callback URL %q did not match the URL in the config %q", callbackURL, c.redirectURI)
+		return "", nil, fmt.Errorf("expected callback URL %q did not match the URL in the config %q", callbackURL, c.redirectURI)
 	}
 
 	oauth2Config := &oauth2.Config{
@@ -167,10 +131,10 @@ func (c *oauthConnector) LoginURL(scopes connector.Scopes, callbackURL, state st
 		Scopes:       c.scopes,
 	}
 
-	return oauth2Config.AuthCodeURL(state), nil
+	return oauth2Config.AuthCodeURL(state), nil, nil
 }
 
-func (c *oauthConnector) HandleCallback(s connector.Scopes, r *http.Request) (identity connector.Identity, err error) {
+func (c *oauthConnector) HandleCallback(s connector.Scopes, _ []byte, r *http.Request) (identity connector.Identity, err error) {
 	q := r.URL.Query()
 	if errType := q.Get("error"); errType != "" {
 		return identity, errors.New(q.Get("error_description"))
diff --git a/connector/oauth/oauth_test.go b/connector/oauth/oauth_test.go
index 3a5ec6bf59..cdd2d3c687 100644
--- a/connector/oauth/oauth_test.go
+++ b/connector/oauth/oauth_test.go
@@ -6,15 +6,15 @@ import (
 	"encoding/json"
 	"errors"
 	"fmt"
+	"log/slog"
 	"net/http"
 	"net/http/httptest"
 	"net/url"
 	"sort"
 	"testing"
 
-	"github.com/sirupsen/logrus"
+	"github.com/go-jose/go-jose/v4"
 	"github.com/stretchr/testify/assert"
-	jose "gopkg.in/square/go-jose.v2"
 
 	"github.com/dexidp/dex/connector"
 )
@@ -50,7 +50,7 @@ func TestLoginURL(t *testing.T) {
 
 	conn := newConnector(t, testServer.URL)
 
-	loginURL, err := conn.LoginURL(connector.Scopes{}, conn.redirectURI, "some-state")
+	loginURL, _, err := conn.LoginURL(connector.Scopes{}, conn.redirectURI, "some-state")
 	assert.Equal(t, err, nil)
 
 	expectedURL, err := url.Parse(testServer.URL + "/authorize")
@@ -86,7 +86,7 @@ func TestHandleCallBackForGroupsInUserInfo(t *testing.T) {
 	conn := newConnector(t, testServer.URL)
 	req := newRequestWithAuthCode(t, testServer.URL, "TestHandleCallBackForGroupsInUserInfo")
 
-	identity, err := conn.HandleCallback(connector.Scopes{Groups: true}, req)
+	identity, err := conn.HandleCallback(connector.Scopes{Groups: true}, nil, req)
 	assert.Equal(t, err, nil)
 
 	sort.Strings(identity.Groups)
@@ -122,7 +122,7 @@ func TestHandleCallBackForGroupMapsInUserInfo(t *testing.T) {
 	conn := newConnector(t, testServer.URL)
 	req := newRequestWithAuthCode(t, testServer.URL, "TestHandleCallBackForGroupMapsInUserInfo")
 
-	identity, err := conn.HandleCallback(connector.Scopes{Groups: true}, req)
+	identity, err := conn.HandleCallback(connector.Scopes{Groups: true}, nil, req)
 	assert.Equal(t, err, nil)
 
 	sort.Strings(identity.Groups)
@@ -156,7 +156,7 @@ func TestHandleCallBackForGroupsInToken(t *testing.T) {
 	conn := newConnector(t, testServer.URL)
 	req := newRequestWithAuthCode(t, testServer.URL, "TestHandleCallBackForGroupsInToken")
 
-	identity, err := conn.HandleCallback(connector.Scopes{Groups: true}, req)
+	identity, err := conn.HandleCallback(connector.Scopes{Groups: true}, nil, req)
 	assert.Equal(t, err, nil)
 
 	assert.Equal(t, len(identity.Groups), 1)
@@ -186,7 +186,7 @@ func TestHandleCallbackForNumericUserID(t *testing.T) {
 	conn := newConnector(t, testServer.URL)
 	req := newRequestWithAuthCode(t, testServer.URL, "TestHandleCallbackForNumericUserID")
 
-	identity, err := conn.HandleCallback(connector.Scopes{Groups: true}, req)
+	identity, err := conn.HandleCallback(connector.Scopes{Groups: true}, nil, req)
 	assert.Equal(t, err, nil)
 
 	assert.Equal(t, identity.UserID, "1000")
@@ -270,7 +270,7 @@ func newConnector(t *testing.T, serverURL string) *oauthConnector {
 	testConfig.ClaimMapping.EmailKey = "mail"
 	testConfig.ClaimMapping.EmailVerifiedKey = "has_verified_email"
 
-	log := logrus.New()
+	log := slog.New(slog.DiscardHandler)
 
 	conn, err := testConfig.Open("id", log)
 	if err != nil {
diff --git a/connector/oidc/oidc.go b/connector/oidc/oidc.go
index e345dca0b2..c8104dc912 100644
--- a/connector/oidc/oidc.go
+++ b/connector/oidc/oidc.go
@@ -6,8 +6,10 @@ import (
 	"encoding/json"
 	"errors"
 	"fmt"
+	"log/slog"
 	"net/http"
 	"net/url"
+	"regexp"
 	"strings"
 	"time"
 
@@ -15,16 +17,40 @@ import (
 	"golang.org/x/oauth2"
 
 	"github.com/dexidp/dex/connector"
-	"github.com/dexidp/dex/pkg/log"
+	groups_pkg "github.com/dexidp/dex/pkg/groups"
+	"github.com/dexidp/dex/pkg/httpclient"
 )
 
+const (
+	codeChallengeMethodPlain = "plain"
+	codeChallengeMethodS256  = "S256"
+)
+
+func contains(arr []string, item string) bool {
+	for _, itemFromArray := range arr {
+		if itemFromArray == item {
+			return true
+		}
+	}
+	return false
+}
+
 // Config holds configuration options for OpenID Connect logins.
 type Config struct {
-	Issuer       string `json:"issuer"`
+	Issuer string `json:"issuer"`
+	// Some offspec providers like Azure, Oracle IDCS have oidc discovery url
+	// different from issuer url which causes issuerValidation to fail
+	// IssuerAlias provides a way to override the Issuer url
+	// from the .well-known/openid-configuration issuer
+	IssuerAlias  string `json:"issuerAlias"`
 	ClientID     string `json:"clientID"`
 	ClientSecret string `json:"clientSecret"`
 	RedirectURI  string `json:"redirectURI"`
 
+	// The section to override options discovered automatically from
+	// the providers' discovery URL (.well-known/openid-configuration).
+	ProviderDiscoveryOverrides ProviderDiscoveryOverrides `json:"providerDiscoveryOverrides"`
+
 	// Causes client_secret to be passed as POST parameters instead of basic
 	// auth. This is specifically "NOT RECOMMENDED" by the OAuth2 RFC, but some
 	// providers require it.
@@ -34,17 +60,32 @@ type Config struct {
 
 	Scopes []string `json:"scopes"` // defaults to "profile" and "email"
 
+	// HostedDomains was an optional list of whitelisted domains when using the OIDC connector with Google.
+	// Only users from a whitelisted domain were allowed to log in.
+	// Support for this option was removed from the OIDC connector.
+	// Consider switching to the Google connector which supports this option.
+	//
+	// Deprecated: will be removed in future releases.
+	HostedDomains []string `json:"hostedDomains"`
+
+	// Certificates for SSL validation
+	RootCAs []string `json:"rootCAs"`
+
 	// Override the value of email_verified to true in the returned claims
 	InsecureSkipEmailVerified bool `json:"insecureSkipEmailVerified"`
 
 	// InsecureEnableGroups enables groups claims. This is disabled by default until https://github.com/dexidp/dex/issues/1065 is resolved
-	InsecureEnableGroups bool `json:"insecureEnableGroups"`
+	InsecureEnableGroups bool     `json:"insecureEnableGroups"`
+	AllowedGroups        []string `json:"allowedGroups"`
 
 	// AcrValues (Authentication Context Class Reference Values) that specifies the Authentication Context Class Values
 	// within the Authentication Request that the Authorization Server is being requested to use for
 	// processing requests from this Client, with the values appearing in order of preference.
 	AcrValues []string `json:"acrValues"`
 
+	// Disable certificate verification
+	InsecureSkipVerify bool `json:"insecureSkipVerify"`
+
 	// GetUserInfo uses the userinfo endpoint to get additional claims for
 	// the token. This is especially useful where upstreams return "thin"
 	// id tokens
@@ -54,8 +95,12 @@ type Config struct {
 
 	UserNameKey string `json:"userNameKey"`
 
-	// PromptType will be used fot the prompt parameter (when offline_access, by default prompt=consent)
-	PromptType string `json:"promptType"`
+	// PromptType will be used for the prompt parameter (when offline_access, by default prompt=consent)
+	PromptType *string `json:"promptType"`
+
+	// PKCEChallenge specifies which PKCE algorithm will be used
+	// If not setted it will be auto-detected the best-fit for the connector.
+	PKCEChallenge string `json:"pkceChallenge"`
 
 	// OverrideClaimMapping will be used to override the options defined in claimMappings.
 	// i.e. if there are 'email' and `preferred_email` claims available, by default Dex will always use the `email` claim independent of the ClaimMapping.EmailKey.
@@ -72,6 +117,116 @@ type Config struct {
 		// Configurable key which contains the groups claims
 		GroupsKey string `json:"groups"` // defaults to "groups"
 	} `json:"claimMapping"`
+
+	// ClaimMutations holds all claim mutations options
+	ClaimMutations struct {
+		NewGroupFromClaims []NewGroupFromClaims `json:"newGroupFromClaims"`
+		FilterGroupClaims  FilterGroupClaims    `json:"filterGroupClaims"`
+		ModifyGroupNames   ModifyGroupNames     `json:"modifyGroupNames"`
+	} `json:"claimModifications"`
+}
+
+type ProviderDiscoveryOverrides struct {
+	// TokenURL provides a way to user overwrite the Token URL
+	// from the .well-known/openid-configuration token_endpoint
+	TokenURL string `json:"tokenURL"`
+	// AuthURL provides a way to user overwrite the Auth URL
+	// from the .well-known/openid-configuration authorization_endpoint
+	AuthURL string `json:"authURL"`
+	// JWKSURL provides a way to user overwrite the JWKS URL
+	// from the .well-known/openid-configuration jwks_uri
+	JWKSURL string `json:"jwksURL"`
+	// UserInfoURL provides a way to override the UserInfo URL
+	// from the .well-known/openid-configuration userinfo_endpoint
+	UserInfoURL string `json:"userInfoURL"`
+	// DeviceAuthURL provides a way to override the Device Authorization URL
+	// from the .well-known/openid-configuration device_authorization_endpoint
+	DeviceAuthURL string `json:"deviceAuthURL"`
+	// EndSessionURL provides a way to override the end_session_endpoint
+	// from the .well-known/openid-configuration
+	EndSessionURL string `json:"endSessionURL"`
+}
+
+func (o *ProviderDiscoveryOverrides) Empty() bool {
+	return o.TokenURL == "" && o.AuthURL == "" && o.JWKSURL == "" && o.UserInfoURL == "" && o.DeviceAuthURL == "" && o.EndSessionURL == ""
+}
+
+func getProvider(ctx context.Context, issuer string, overrides ProviderDiscoveryOverrides) (*oidc.Provider, error) {
+	provider, err := oidc.NewProvider(ctx, issuer)
+	if err != nil {
+		return nil, fmt.Errorf("failed to get provider: %v", err)
+	}
+
+	if overrides.Empty() {
+		return provider, nil
+	}
+
+	v := &struct {
+		Issuer        string   `json:"issuer"`
+		AuthURL       string   `json:"authorization_endpoint"`
+		TokenURL      string   `json:"token_endpoint"`
+		DeviceAuthURL string   `json:"device_authorization_endpoint"`
+		JWKSURL       string   `json:"jwks_uri"`
+		UserInfoURL   string   `json:"userinfo_endpoint"`
+		Algorithms    []string `json:"id_token_signing_alg_values_supported"`
+	}{}
+	if err := provider.Claims(v); err != nil {
+		return nil, fmt.Errorf("failed to extract provider discovery claims: %v", err)
+	}
+	config := oidc.ProviderConfig{
+		IssuerURL:     v.Issuer,
+		AuthURL:       v.AuthURL,
+		TokenURL:      v.TokenURL,
+		DeviceAuthURL: v.DeviceAuthURL,
+		JWKSURL:       v.JWKSURL,
+		UserInfoURL:   v.UserInfoURL,
+		Algorithms:    v.Algorithms,
+	}
+
+	if overrides.TokenURL != "" {
+		config.TokenURL = overrides.TokenURL
+	}
+	if overrides.AuthURL != "" {
+		config.AuthURL = overrides.AuthURL
+	}
+	if overrides.JWKSURL != "" {
+		config.JWKSURL = overrides.JWKSURL
+	}
+	if overrides.UserInfoURL != "" {
+		config.UserInfoURL = overrides.UserInfoURL
+	}
+	if overrides.DeviceAuthURL != "" {
+		config.DeviceAuthURL = overrides.DeviceAuthURL
+	}
+	return config.NewProvider(context.Background()), nil
+}
+
+// NewGroupFromClaims creates a new group from a list of claims and appends it to the list of existing groups.
+type NewGroupFromClaims struct {
+	// List of claim to join together
+	Claims []string `json:"claims"`
+
+	// String to separate the claims
+	Delimiter string `json:"delimiter"`
+
+	// Should Dex remove the Delimiter string from claim values
+	// This is done to keep resulting claim structure in full control of the Dex operator
+	ClearDelimiter bool `json:"clearDelimiter"`
+
+	// String to place before the first claim
+	Prefix string `json:"prefix"`
+}
+
+// FilterGroupClaims is a regex filter for to keep only the matching groups.
+// This is useful when the groups list is too large to fit within an HTTP header.
+type FilterGroupClaims struct {
+	GroupsFilter string `json:"groupsFilter"`
+}
+
+// ModifyGroupNames allows to modify the group claims by adding a prefix and/or suffix to each group.
+type ModifyGroupNames struct {
+	Prefix string `json:"prefix"`
+	Suffix string `json:"suffix"`
 }
 
 // Domains that don't support basic auth. golang.org/x/oauth2 has an internal
@@ -102,15 +257,49 @@ func knownBrokenAuthHeaderProvider(issuerURL string) bool {
 	return false
 }
 
+// PKCEChallengeData is used to store info for PKCE Challenge method and verifier
+// in the connectorData
+type PKCEChallengeData struct {
+	CodeChallenge       string `json:"codeChallenge"`
+	CodeChallengeMethod string `json:"codeChallengeMethod"`
+}
+
+// Returns an AuthCodeOption according to the provided codeChallengeMethod
+func getAuthCodeOptionForCodeChallenge(codeVerifier, codeChallengeMethod string) (oauth2.AuthCodeOption, error) {
+	switch codeChallengeMethod {
+	case codeChallengeMethodPlain:
+		return oauth2.VerifierOption(codeVerifier), nil
+	case codeChallengeMethodS256:
+		return oauth2.S256ChallengeOption(codeVerifier), nil
+	default:
+		return nil, fmt.Errorf("unknown challenge method (%v)", codeChallengeMethod)
+	}
+}
+
 // Open returns a connector which can be used to login users through an upstream
 // OpenID Connect provider.
-func (c *Config) Open(id string, logger log.Logger) (conn connector.Connector, err error) {
-	ctx, cancel := context.WithCancel(context.Background())
+func (c *Config) Open(id string, logger *slog.Logger) (conn connector.Connector, err error) {
+	if len(c.HostedDomains) > 0 {
+		return nil, fmt.Errorf("support for the Hosted domains option had been deprecated and removed, consider switching to the Google connector")
+	}
+
+	httpClient, err := httpclient.NewHTTPClient(c.RootCAs, c.InsecureSkipVerify)
+	if err != nil {
+		return nil, err
+	}
 
-	provider, err := oidc.NewProvider(ctx, c.Issuer)
+	bgctx, cancel := context.WithCancel(context.Background())
+	ctx := context.WithValue(bgctx, oauth2.HTTPClient, httpClient)
+	if c.IssuerAlias != "" {
+		ctx = oidc.InsecureIssuerURLContext(ctx, c.IssuerAlias)
+	}
+	provider, err := getProvider(ctx, c.Issuer, c.ProviderDiscoveryOverrides)
 	if err != nil {
 		cancel()
-		return nil, fmt.Errorf("failed to get provider: %v", err)
+		return nil, err
+	}
+	if !c.ProviderDiscoveryOverrides.Empty() {
+		logger.Warn("overrides for connector are set, this can be a vulnerability when not properly configured", "connector_id", id)
 	}
 
 	endpoint := provider.Endpoint()
@@ -132,8 +321,55 @@ func (c *Config) Open(id string, logger log.Logger) (conn connector.Connector, e
 	}
 
 	// PromptType should be "consent" by default, if not set
-	if c.PromptType == "" {
-		c.PromptType = "consent"
+	promptType := "consent"
+	if c.PromptType != nil {
+		promptType = *c.PromptType
+	}
+
+	var groupsFilter *regexp.Regexp
+	if c.ClaimMutations.FilterGroupClaims.GroupsFilter != "" {
+		groupsFilter, err = regexp.Compile(c.ClaimMutations.FilterGroupClaims.GroupsFilter)
+		if err != nil {
+			logger.Warn("ignoring invalid", "invalid_regex", c.ClaimMutations.FilterGroupClaims.GroupsFilter, "connector_id", id)
+		}
+	}
+
+	// Obtain metadata from the provider
+	var metadata struct {
+		CodeChallengeMethodsSupported []string `json:"code_challenge_methods_supported"`
+		EndSessionEndpoint            string   `json:"end_session_endpoint"`
+	}
+	if err := provider.Claims(&metadata); err != nil {
+		logger.Warn("failed to parse provider metadata")
+	}
+	// if PKCEChallenge method has not been setted in the config, auto-detect the best fit
+	if c.PKCEChallenge == "" {
+		if contains(metadata.CodeChallengeMethodsSupported, codeChallengeMethodS256) {
+			c.PKCEChallenge = codeChallengeMethodS256
+		} else if contains(metadata.CodeChallengeMethodsSupported, codeChallengeMethodPlain) {
+			c.PKCEChallenge = codeChallengeMethodPlain
+		}
+	} else {
+		// if PKCEChallenge method has been setted in the config, check if it is supported
+		if !contains(metadata.CodeChallengeMethodsSupported, c.PKCEChallenge) {
+			logger.Warn("provided PKCEChallenge method not supported by the connector")
+		}
+	}
+
+	endSessionURL := metadata.EndSessionEndpoint
+	if c.ProviderDiscoveryOverrides.EndSessionURL != "" {
+		endSessionURL = c.ProviderDiscoveryOverrides.EndSessionURL
+	}
+	if endSessionURL != "" {
+		endSessionParsed, err := url.Parse(endSessionURL)
+		if err != nil {
+			cancel()
+			return nil, fmt.Errorf("oidc: invalid end_session_endpoint: %v", err)
+		}
+		if endSessionParsed.Scheme != "https" && endSessionParsed.Scheme != "http" {
+			cancel()
+			return nil, fmt.Errorf("oidc: end_session_endpoint must use http or https scheme, got %q", endSessionParsed.Scheme)
+		}
 	}
 
 	clientID := c.ClientID
@@ -147,28 +383,39 @@ func (c *Config) Open(id string, logger log.Logger) (conn connector.Connector, e
 			Scopes:       scopes,
 			RedirectURL:  c.RedirectURI,
 		},
-		verifier: provider.Verifier(
+		verifier: provider.VerifierContext(
+			ctx, // Pass our ctx with customized http.Client
 			&oidc.Config{ClientID: clientID},
 		),
-		logger:                    logger,
+		logger:                    logger.With(slog.Group("connector", "type", "oidc", "id", id)),
 		cancel:                    cancel,
+		httpClient:                httpClient,
 		insecureSkipEmailVerified: c.InsecureSkipEmailVerified,
 		insecureEnableGroups:      c.InsecureEnableGroups,
+		allowedGroups:             c.AllowedGroups,
 		acrValues:                 c.AcrValues,
 		getUserInfo:               c.GetUserInfo,
-		promptType:                c.PromptType,
+		promptType:                promptType,
 		userIDKey:                 c.UserIDKey,
 		userNameKey:               c.UserNameKey,
 		overrideClaimMapping:      c.OverrideClaimMapping,
 		preferredUsernameKey:      c.ClaimMapping.PreferredUsernameKey,
 		emailKey:                  c.ClaimMapping.EmailKey,
 		groupsKey:                 c.ClaimMapping.GroupsKey,
+		newGroupFromClaims:        c.ClaimMutations.NewGroupFromClaims,
+		groupsFilter:              groupsFilter,
+		groupsPrefix:              c.ClaimMutations.ModifyGroupNames.Prefix,
+		groupsSuffix:              c.ClaimMutations.ModifyGroupNames.Suffix,
+		pkceChallenge:             c.PKCEChallenge,
+		endSessionURL:             endSessionURL,
 	}, nil
 }
 
 var (
-	_ connector.CallbackConnector = (*oidcConnector)(nil)
-	_ connector.RefreshConnector  = (*oidcConnector)(nil)
+	_ connector.CallbackConnector       = (*oidcConnector)(nil)
+	_ connector.RefreshConnector        = (*oidcConnector)(nil)
+	_ connector.TokenIdentityConnector  = (*oidcConnector)(nil)
+	_ connector.LogoutCallbackConnector = (*oidcConnector)(nil)
 )
 
 type oidcConnector struct {
@@ -177,9 +424,11 @@ type oidcConnector struct {
 	oauth2Config              *oauth2.Config
 	verifier                  *oidc.IDTokenVerifier
 	cancel                    context.CancelFunc
-	logger                    log.Logger
+	logger                    *slog.Logger
+	httpClient                *http.Client
 	insecureSkipEmailVerified bool
 	insecureEnableGroups      bool
+	allowedGroups             []string
 	acrValues                 []string
 	getUserInfo               bool
 	promptType                string
@@ -189,6 +438,12 @@ type oidcConnector struct {
 	preferredUsernameKey      string
 	emailKey                  string
 	groupsKey                 string
+	newGroupFromClaims        []NewGroupFromClaims
+	groupsFilter              *regexp.Regexp
+	groupsPrefix              string
+	groupsSuffix              string
+	pkceChallenge             string
+	endSessionURL             string
 }
 
 func (c *oidcConnector) Close() error {
@@ -196,12 +451,13 @@ func (c *oidcConnector) Close() error {
 	return nil
 }
 
-func (c *oidcConnector) LoginURL(s connector.Scopes, callbackURL, state string) (string, error) {
+func (c *oidcConnector) LoginURL(s connector.Scopes, callbackURL, state string) (string, []byte, error) {
 	if c.redirectURI != callbackURL {
-		return "", fmt.Errorf("expected callback URL %q did not match the URL in the config %q", callbackURL, c.redirectURI)
+		return "", nil, fmt.Errorf("expected callback URL %q did not match the URL in the config %q", callbackURL, c.redirectURI)
 	}
 
 	var opts []oauth2.AuthCodeOption
+	var connectorData []byte
 
 	if len(c.acrValues) > 0 {
 		acrValues := strings.Join(c.acrValues, " ")
@@ -211,7 +467,25 @@ func (c *oidcConnector) LoginURL(s connector.Scopes, callbackURL, state string)
 	if s.OfflineAccess {
 		opts = append(opts, oauth2.AccessTypeOffline, oauth2.SetAuthURLParam("prompt", c.promptType))
 	}
-	return c.oauth2Config.AuthCodeURL(state, opts...), nil
+
+	if c.pkceChallenge != "" {
+		codeVerifier := oauth2.GenerateVerifier()
+		authCodeOption, err := getAuthCodeOptionForCodeChallenge(codeVerifier, c.pkceChallenge)
+		if err != nil {
+			return "", nil, fmt.Errorf("oidc: failed to get PKCE AuthCodeOption for CodeChallenge: %v", err)
+		}
+		data := PKCEChallengeData{
+			CodeChallenge:       codeVerifier,
+			CodeChallengeMethod: c.pkceChallenge,
+		}
+		connectorData, err = json.Marshal(data)
+		if err != nil {
+			return "", nil, fmt.Errorf("oidc: failed to create PKCEChallenge data: %v", err)
+		}
+		opts = append(opts, authCodeOption)
+	}
+
+	return c.oauth2Config.AuthCodeURL(state, opts...), connectorData, nil
 }
 
 type oauth2Error struct {
@@ -231,18 +505,34 @@ type caller uint
 const (
 	createCaller caller = iota
 	refreshCaller
+	exchangeCaller
 )
 
-func (c *oidcConnector) HandleCallback(s connector.Scopes, r *http.Request) (identity connector.Identity, err error) {
+func (c *oidcConnector) HandleCallback(s connector.Scopes, connData []byte, r *http.Request) (identity connector.Identity, err error) {
 	q := r.URL.Query()
 	if errType := q.Get("error"); errType != "" {
 		return identity, &oauth2Error{errType, q.Get("error_description")}
 	}
-	token, err := c.oauth2Config.Exchange(r.Context(), q.Get("code"))
+
+	ctx := context.WithValue(r.Context(), oauth2.HTTPClient, c.httpClient)
+
+	var opts []oauth2.AuthCodeOption
+	if c.pkceChallenge != "" {
+		var data PKCEChallengeData
+		if err := json.Unmarshal(connData, &data); err != nil {
+			return identity, fmt.Errorf("oidc: failed to parse PKCEChallenge data: %v", err)
+		}
+		if data.CodeChallenge == "" {
+			return identity, fmt.Errorf("oidc: invalid PKCE CodeChallenge")
+		}
+		opts = append(opts, oauth2.VerifierOption(data.CodeChallenge))
+	}
+
+	token, err := c.oauth2Config.Exchange(ctx, q.Get("code"), opts...)
 	if err != nil {
 		return identity, fmt.Errorf("oidc: failed to get token: %v", err)
 	}
-	return c.createIdentity(r.Context(), identity, token, createCaller)
+	return c.createIdentity(ctx, identity, token, createCaller)
 }
 
 // Refresh is used to refresh a session with the refresh token provided by the IdP
@@ -253,6 +543,8 @@ func (c *oidcConnector) Refresh(ctx context.Context, s connector.Scopes, identit
 		return identity, fmt.Errorf("oidc: failed to unmarshal connector data: %v", err)
 	}
 
+	ctx = context.WithValue(ctx, oauth2.HTTPClient, c.httpClient)
+
 	t := &oauth2.Token{
 		RefreshToken: string(cd.RefreshToken),
 		Expiry:       time.Now().Add(-time.Hour),
@@ -264,11 +556,22 @@ func (c *oidcConnector) Refresh(ctx context.Context, s connector.Scopes, identit
 	return c.createIdentity(ctx, identity, token, refreshCaller)
 }
 
+func (c *oidcConnector) TokenIdentity(ctx context.Context, subjectTokenType, subjectToken string) (connector.Identity, error) {
+	var identity connector.Identity
+
+	ctx = context.WithValue(ctx, oauth2.HTTPClient, c.httpClient)
+
+	token := &oauth2.Token{
+		AccessToken: subjectToken,
+		TokenType:   subjectTokenType,
+	}
+	return c.createIdentity(ctx, identity, token, exchangeCaller)
+}
+
 func (c *oidcConnector) createIdentity(ctx context.Context, identity connector.Identity, token *oauth2.Token, caller caller) (connector.Identity, error) {
 	var claims map[string]interface{}
 
-	rawIDToken, ok := token.Extra("id_token").(string)
-	if ok {
+	if rawIDToken, ok := token.Extra("id_token").(string); ok {
 		idToken, err := c.verifier.Verify(ctx, rawIDToken)
 		if err != nil {
 			return identity, fmt.Errorf("oidc: failed to verify ID Token: %v", err)
@@ -277,14 +580,36 @@ func (c *oidcConnector) createIdentity(ctx context.Context, identity connector.I
 		if err := idToken.Claims(&claims); err != nil {
 			return identity, fmt.Errorf("oidc: failed to decode claims: %v", err)
 		}
+	} else if caller == exchangeCaller {
+		switch token.TokenType {
+		case "urn:ietf:params:oauth:token-type:id_token":
+			// Verify only works on ID tokens
+			idToken, err := c.provider.Verifier(&oidc.Config{SkipClientIDCheck: true}).Verify(ctx, token.AccessToken)
+			if err != nil {
+				return identity, fmt.Errorf("oidc: failed to verify token: %v", err)
+			}
+			if err := idToken.Claims(&claims); err != nil {
+				return identity, fmt.Errorf("oidc: failed to decode claims: %v", err)
+			}
+		case "urn:ietf:params:oauth:token-type:access_token":
+			if !c.getUserInfo {
+				return identity, fmt.Errorf("oidc: getUserInfo is required for access token exchange")
+			}
+		default:
+			return identity, fmt.Errorf("unknown token type for token exchange: %s", token.TokenType)
+		}
 	} else if caller != refreshCaller {
 		// ID tokens aren't mandatory in the reply when using a refresh_token grant
 		return identity, errors.New("oidc: no id_token in token response")
 	}
 
-	// We immediately want to run getUserInfo if configured before we validate the claims
+	// We immediately want to run getUserInfo if configured before we validate the claims.
+	// For token exchanges with access tokens, this is how we verify the token.
 	if c.getUserInfo {
-		userInfo, err := c.provider.UserInfo(ctx, oauth2.StaticTokenSource(token))
+		userInfo, err := c.provider.UserInfo(ctx, oauth2.StaticTokenSource(&oauth2.Token{
+			AccessToken: token.AccessToken,
+			TokenType:   "Bearer", // The UserInfo endpoint requires a bearer token as per RFC6750
+		}))
 		if err != nil {
 			return identity, fmt.Errorf("oidc: error loading userinfo: %v", err)
 		}
@@ -359,12 +684,65 @@ func (c *oidcConnector) createIdentity(ctx context.Context, identity connector.I
 		if found {
 			for _, v := range vs {
 				if s, ok := v.(string); ok {
+					if c.groupsFilter != nil && !c.groupsFilter.MatchString(s) {
+						continue
+					}
 					groups = append(groups, s)
+				} else if groupMap, ok := v.(map[string]interface{}); ok {
+					if s, ok := groupMap["name"].(string); ok {
+						if c.groupsFilter != nil && !c.groupsFilter.MatchString(s) {
+							continue
+						}
+						groups = append(groups, s)
+					}
 				} else {
 					return identity, fmt.Errorf("malformed \"%v\" claim", groupsKey)
 				}
 			}
 		}
+
+		// Validate that the user is part of allowedGroups
+		if len(c.allowedGroups) > 0 {
+			groupMatches := groups_pkg.Filter(groups, c.allowedGroups)
+
+			if len(groupMatches) == 0 {
+				// No group membership matches found, disallowing
+				return identity, fmt.Errorf("user not a member of allowed groups")
+			}
+
+			groups = groupMatches
+		}
+	}
+
+	// add prefix/suffix to groups
+	if c.groupsPrefix != "" || c.groupsSuffix != "" {
+		for i, group := range groups {
+			groups[i] = c.groupsPrefix + group + c.groupsSuffix
+		}
+	}
+
+	for _, config := range c.newGroupFromClaims {
+		newGroupSegments := []string{
+			config.Prefix,
+		}
+		for _, claimName := range config.Claims {
+			claimValue, ok := claims[claimName].(string)
+			if !ok { // Non string claim value are ignored, concatenating them doesn't really make any sense
+				continue
+			}
+
+			if config.ClearDelimiter {
+				// Removing the delimiter string from the concatenated claim to ensure resulting claim structure
+				// is in full control of Dex operator
+				claimValue = strings.ReplaceAll(claimValue, config.Delimiter, "")
+			}
+
+			newGroupSegments = append(newGroupSegments, claimValue)
+		}
+
+		if len(newGroupSegments) > 1 {
+			groups = append(groups, strings.Join(newGroupSegments, config.Delimiter))
+		}
 	}
 
 	cd := connectorData{
@@ -396,3 +774,32 @@ func (c *oidcConnector) createIdentity(ctx context.Context, identity connector.I
 
 	return identity, nil
 }
+
+// LogoutURL returns the upstream OIDC provider's end_session_endpoint URL.
+// Per the OIDC RP-Initiated Logout spec, the post_logout_redirect_uri parameter
+// tells the upstream where to redirect after logout.
+func (c *oidcConnector) LogoutURL(_ context.Context, postLogoutRedirectURI string) (string, error) {
+	if c.endSessionURL == "" {
+		return "", nil
+	}
+
+	u, err := url.Parse(c.endSessionURL)
+	if err != nil {
+		return "", fmt.Errorf("oidc: failed to parse end_session_endpoint: %v", err)
+	}
+
+	q := u.Query()
+	if postLogoutRedirectURI != "" {
+		q.Set("post_logout_redirect_uri", postLogoutRedirectURI)
+		q.Set("client_id", c.oauth2Config.ClientID)
+	}
+	u.RawQuery = q.Encode()
+
+	return u.String(), nil
+}
+
+// HandleLogoutCallback is a no-op for OIDC. The end_session_endpoint simply
+// redirects back without a structured response to validate.
+func (c *oidcConnector) HandleLogoutCallback(_ context.Context, _ *http.Request) error {
+	return nil
+}
diff --git a/connector/oidc/oidc_test.go b/connector/oidc/oidc_test.go
index d94af79de8..00be45c6f7 100644
--- a/connector/oidc/oidc_test.go
+++ b/connector/oidc/oidc_test.go
@@ -2,6 +2,7 @@ package oidc
 
 import (
 	"bytes"
+	"context"
 	"crypto/rand"
 	"crypto/rsa"
 	"encoding/base64"
@@ -9,6 +10,7 @@ import (
 	"encoding/json"
 	"errors"
 	"fmt"
+	"log/slog"
 	"net/http"
 	"net/http/httptest"
 	"reflect"
@@ -16,8 +18,9 @@ import (
 	"testing"
 	"time"
 
-	"github.com/sirupsen/logrus"
-	"gopkg.in/square/go-jose.v2"
+	"github.com/go-jose/go-jose/v4"
+	"github.com/stretchr/testify/require"
+	"golang.org/x/oauth2"
 
 	"github.com/dexidp/dex/connector"
 )
@@ -61,6 +64,11 @@ func TestHandleCallback(t *testing.T) {
 		expectPreferredUsername   string
 		expectedEmailField        string
 		token                     map[string]interface{}
+		groupsRegex               string
+		newGroupFromClaims        []NewGroupFromClaims
+		groupsPrefix              string
+		groupsSuffix              string
+		pkceChallenge             string
 	}{
 		{
 			name:               "simpleCase",
@@ -287,6 +295,231 @@ func TestHandleCallback(t *testing.T) {
 				"email_verified": true,
 			},
 		},
+		{
+			name:               "singularGroupResponseAsMap",
+			userIDKey:          "", // not configured
+			userNameKey:        "", // not configured
+			expectUserID:       "subvalue",
+			expectUserName:     "namevalue",
+			expectGroups:       []string{"group1"},
+			expectedEmailField: "emailvalue",
+			token: map[string]interface{}{
+				"sub":            "subvalue",
+				"name":           "namevalue",
+				"groups":         []map[string]string{{"name": "group1"}},
+				"email":          "emailvalue",
+				"email_verified": true,
+			},
+		},
+		{
+			name:               "multipleGroupResponseAsMap",
+			userIDKey:          "", // not configured
+			userNameKey:        "", // not configured
+			expectUserID:       "subvalue",
+			expectUserName:     "namevalue",
+			expectGroups:       []string{"group1", "group2"},
+			expectedEmailField: "emailvalue",
+			token: map[string]interface{}{
+				"sub":            "subvalue",
+				"name":           "namevalue",
+				"groups":         []map[string]string{{"name": "group1"}, {"name": "group2"}},
+				"email":          "emailvalue",
+				"email_verified": true,
+			},
+		},
+		{
+			name:               "newGroupFromClaims",
+			userIDKey:          "", // not configured
+			userNameKey:        "", // not configured
+			expectUserID:       "subvalue",
+			expectUserName:     "namevalue",
+			expectGroups:       []string{"group1", "gh::acme::pipeline-one", "clr_delim-acme-foobar", "keep_delim-acme-foo-bar", "bk-emailvalue"},
+			expectedEmailField: "emailvalue",
+			newGroupFromClaims: []NewGroupFromClaims{
+				{ // The basic functionality, should create "gh::acme::pipeline-one".
+					Claims: []string{
+						"organization",
+						"pipeline",
+					},
+					Delimiter: "::",
+					Prefix:    "gh",
+				},
+				{ // Non existing claims, should not generate any any new group claim.
+					Claims: []string{
+						"non-existing1",
+						"non-existing2",
+					},
+					Delimiter: "::",
+					Prefix:    "tfe",
+				},
+				{ // In this case the delimiter character("-") should be removed removed from "claim-with-delimiter" claim to ensure the resulting
+					// claim structure is in full control of the Dex operator and not the person creating a new pipeline.
+					// Should create "clr_delim-acme-foobar" and not "tfe-acme-foo-bar".
+					Claims: []string{
+						"organization",
+						"claim-with-delimiter",
+					},
+					Delimiter:      "-",
+					ClearDelimiter: true,
+					Prefix:         "clr_delim",
+				},
+				{ // In this case the delimiter character("-") should be NOT removed from "claim-with-delimiter" claim.
+					// Should create  "keep_delim-acme-foo-bar".
+					Claims: []string{
+						"organization",
+						"claim-with-delimiter",
+					},
+					Delimiter: "-",
+					// ClearDelimiter: false,
+					Prefix: "keep_delim",
+				},
+				{ // Ignore non string claims (like arrays), this should result in "bk-emailvalue".
+					Claims: []string{
+						"non-string-claim",
+						"non-string-claim2",
+						"email",
+					},
+					Delimiter: "-",
+					Prefix:    "bk",
+				},
+			},
+
+			token: map[string]interface{}{
+				"sub":                  "subvalue",
+				"name":                 "namevalue",
+				"groups":               "group1",
+				"organization":         "acme",
+				"pipeline":             "pipeline-one",
+				"email":                "emailvalue",
+				"email_verified":       true,
+				"claim-with-delimiter": "foo-bar",
+				"non-string-claim": []string{
+					"element1",
+					"element2",
+				},
+				"non-string-claim2": 666,
+			},
+		},
+		{
+			name:               "prefixGroupNames",
+			userIDKey:          "", // not configured
+			userNameKey:        "", // not configured
+			expectUserID:       "subvalue",
+			expectUserName:     "namevalue",
+			expectGroups:       []string{"prefix-group1", "prefix-group2", "prefix-groupA", "prefix-groupB"},
+			expectedEmailField: "emailvalue",
+			groupsPrefix:       "prefix-",
+			token: map[string]interface{}{
+				"sub":            "subvalue",
+				"name":           "namevalue",
+				"groups":         []string{"group1", "group2", "groupA", "groupB"},
+				"email":          "emailvalue",
+				"email_verified": true,
+			},
+		},
+		{
+			name:               "suffixGroupNames",
+			userIDKey:          "", // not configured
+			userNameKey:        "", // not configured
+			expectUserID:       "subvalue",
+			expectUserName:     "namevalue",
+			expectGroups:       []string{"group1-suffix", "group2-suffix", "groupA-suffix", "groupB-suffix"},
+			expectedEmailField: "emailvalue",
+			groupsSuffix:       "-suffix",
+			token: map[string]interface{}{
+				"sub":            "subvalue",
+				"name":           "namevalue",
+				"groups":         []string{"group1", "group2", "groupA", "groupB"},
+				"email":          "emailvalue",
+				"email_verified": true,
+			},
+		},
+		{
+			name:               "preAndSuffixGroupNames",
+			userIDKey:          "", // not configured
+			userNameKey:        "", // not configured
+			expectUserID:       "subvalue",
+			expectUserName:     "namevalue",
+			expectGroups:       []string{"prefix-group1-suffix", "prefix-group2-suffix", "prefix-groupA-suffix", "prefix-groupB-suffix"},
+			expectedEmailField: "emailvalue",
+			groupsPrefix:       "prefix-",
+			groupsSuffix:       "-suffix",
+			token: map[string]interface{}{
+				"sub":            "subvalue",
+				"name":           "namevalue",
+				"groups":         []string{"group1", "group2", "groupA", "groupB"},
+				"email":          "emailvalue",
+				"email_verified": true,
+			},
+		},
+		{
+			name:               "filterGroupClaims",
+			userIDKey:          "", // not configured
+			userNameKey:        "", // not configured
+			groupsRegex:        `^.*\d$`,
+			expectUserID:       "subvalue",
+			expectUserName:     "namevalue",
+			expectGroups:       []string{"group1", "group2"},
+			expectedEmailField: "emailvalue",
+			token: map[string]interface{}{
+				"sub":            "subvalue",
+				"name":           "namevalue",
+				"groups":         []string{"group1", "group2", "groupA", "groupB"},
+				"email":          "emailvalue",
+				"email_verified": true,
+			},
+		},
+		{
+			name:               "filterGroupClaimsMap",
+			userIDKey:          "", // not configured
+			userNameKey:        "", // not configured
+			groupsRegex:        `^.*\d$`,
+			expectUserID:       "subvalue",
+			expectUserName:     "namevalue",
+			expectGroups:       []string{"group1", "group2"},
+			expectedEmailField: "emailvalue",
+			token: map[string]interface{}{
+				"sub":            "subvalue",
+				"name":           "namevalue",
+				"groups":         []map[string]string{{"name": "group1"}, {"name": "group2"}, {"name": "groupA"}, {"name": "groupB"}},
+				"email":          "emailvalue",
+				"email_verified": true,
+			},
+		},
+		{
+			name:               "S256PKCEChallenge",
+			userIDKey:          "", // not configured
+			userNameKey:        "", // not configured
+			pkceChallenge:      "S256",
+			expectUserID:       "subvalue",
+			expectUserName:     "namevalue",
+			expectGroups:       []string{"group1", "group2"},
+			expectedEmailField: "emailvalue",
+			token: map[string]interface{}{
+				"sub":            "subvalue",
+				"name":           "namevalue",
+				"groups":         []string{"group1", "group2"},
+				"email":          "emailvalue",
+				"email_verified": true,
+			},
+		},
+		{
+			name:               "plainPKCEChallenge",
+			userIDKey:          "", // not configured
+			userNameKey:        "", // not configured
+			pkceChallenge:      "plain",
+			expectUserID:       "subvalue",
+			expectUserName:     "namevalue",
+			expectGroups:       []string{"group1", "group2"},
+			expectedEmailField: "emailvalue",
+			token: map[string]interface{}{
+				"sub":            "subvalue",
+				"name":           "namevalue",
+				"groups":         []string{"group1", "group2"},
+				"email":          "emailvalue",
+				"email_verified": true,
+			},
+		},
 	}
 
 	for _, tc := range tests {
@@ -318,10 +551,15 @@ func TestHandleCallback(t *testing.T) {
 				InsecureEnableGroups:      true,
 				BasicAuthUnsupported:      &basicAuth,
 				OverrideClaimMapping:      tc.overrideClaimMapping,
+				PKCEChallenge:             tc.pkceChallenge,
 			}
 			config.ClaimMapping.PreferredUsernameKey = tc.preferredUsernameKey
 			config.ClaimMapping.EmailKey = tc.emailKey
 			config.ClaimMapping.GroupsKey = tc.groupsKey
+			config.ClaimMutations.NewGroupFromClaims = tc.newGroupFromClaims
+			config.ClaimMutations.FilterGroupClaims.GroupsFilter = tc.groupsRegex
+			config.ClaimMutations.ModifyGroupNames.Prefix = tc.groupsPrefix
+			config.ClaimMutations.ModifyGroupNames.Suffix = tc.groupsSuffix
 
 			conn, err := newConnector(config)
 			if err != nil {
@@ -333,7 +571,11 @@ func TestHandleCallback(t *testing.T) {
 				t.Fatal("failed to create request", err)
 			}
 
-			identity, err := conn.HandleCallback(connector.Scopes{Groups: true}, req)
+			connectorDataStrTemplate := `{"codeChallenge":"abcdefgh123456qwertuiop89101112uvpwizABC234","codeChallengeMethod":"%s"}`
+			connectorDataStr := fmt.Sprintf(connectorDataStrTemplate, config.PKCEChallenge)
+			connectorData := []byte(connectorDataStr)
+
+			identity, err := conn.HandleCallback(connector.Scopes{Groups: true}, connectorData, req)
 			if err != nil {
 				t.Fatal("handle callback failed", err)
 			}
@@ -428,6 +670,207 @@ func TestRefresh(t *testing.T) {
 	}
 }
 
+func TestTokenIdentity(t *testing.T) {
+	tokenTypeAccess := "urn:ietf:params:oauth:token-type:access_token"
+	tokenTypeID := "urn:ietf:params:oauth:token-type:id_token"
+	long2short := map[string]string{
+		tokenTypeAccess: "access_token",
+		tokenTypeID:     "id_token",
+	}
+
+	tests := []struct {
+		name        string
+		subjectType string
+		userInfo    bool
+		expectError bool
+	}{
+		{
+			name:        "id_token",
+			subjectType: tokenTypeID,
+		}, {
+			name:        "access_token",
+			subjectType: tokenTypeAccess,
+			expectError: true,
+		}, {
+			name:        "id_token with user info",
+			subjectType: tokenTypeID,
+			userInfo:    true,
+		}, {
+			name:        "access_token with user info",
+			subjectType: tokenTypeAccess,
+			userInfo:    true,
+		},
+	}
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			ctx := context.Background()
+			ctx, cancel := context.WithCancel(ctx)
+			defer cancel()
+
+			testServer, err := setupServer(map[string]any{
+				"sub":  "subvalue",
+				"name": "namevalue",
+			}, true)
+			if err != nil {
+				t.Fatal("failed to setup test server", err)
+			}
+			conn, err := newConnector(Config{
+				Issuer:      testServer.URL,
+				Scopes:      []string{"openid", "groups"},
+				GetUserInfo: tc.userInfo,
+			})
+			if err != nil {
+				t.Fatal("failed to create new connector", err)
+			}
+
+			res, err := http.Get(testServer.URL + "/token")
+			if err != nil {
+				t.Fatal("failed to get initial token", err)
+			}
+			defer res.Body.Close()
+			var tokenResponse map[string]any
+			err = json.NewDecoder(res.Body).Decode(&tokenResponse)
+			if err != nil {
+				t.Fatal("failed to decode initial token", err)
+			}
+
+			origToken := tokenResponse[long2short[tc.subjectType]].(string)
+			identity, err := conn.TokenIdentity(ctx, tc.subjectType, origToken)
+			if err != nil {
+				if tc.expectError {
+					return
+				}
+				t.Fatal("failed to get token identity", err)
+			}
+
+			// assert identity
+			expectEquals(t, identity.UserID, "subvalue")
+			expectEquals(t, identity.Username, "namevalue")
+		})
+	}
+}
+
+func TestPromptType(t *testing.T) {
+	pointer := func(s string) *string {
+		return &s
+	}
+
+	tests := []struct {
+		name       string
+		promptType *string
+		res        string
+	}{
+		{name: "none", promptType: pointer("none"), res: "none"},
+		{name: "provided empty string", promptType: pointer(""), res: ""},
+		{name: "login", promptType: pointer("login"), res: "login"},
+		{name: "consent", promptType: pointer("consent"), res: "consent"},
+		{name: "default value", promptType: nil, res: "consent"},
+	}
+
+	testServer, err := setupServer(nil, true)
+	require.NoError(t, err)
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			conn, err := newConnector(Config{
+				Issuer:     testServer.URL,
+				Scopes:     []string{"openid", "groups"},
+				PromptType: tc.promptType,
+			})
+			require.NoError(t, err)
+
+			require.Equal(t, tc.res, conn.promptType)
+		})
+	}
+}
+
+func TestProviderOverride(t *testing.T) {
+	testServer, err := setupServer(map[string]any{
+		"sub":  "subvalue",
+		"name": "namevalue",
+	}, true)
+	if err != nil {
+		t.Fatal("failed to setup test server", err)
+	}
+
+	t.Run("No override", func(t *testing.T) {
+		conn, err := newConnector(Config{
+			Issuer: testServer.URL,
+			Scopes: []string{"openid", "groups"},
+		})
+		if err != nil {
+			t.Fatal("failed to create new connector", err)
+		}
+
+		expAuth := fmt.Sprintf("%s/authorize", testServer.URL)
+		if conn.provider.Endpoint().AuthURL != expAuth {
+			t.Fatalf("unexpected auth URL: %s, expected: %s\n", conn.provider.Endpoint().AuthURL, expAuth)
+		}
+
+		expToken := fmt.Sprintf("%s/token", testServer.URL)
+		if conn.provider.Endpoint().TokenURL != expToken {
+			t.Fatalf("unexpected token URL: %s, expected: %s\n", conn.provider.Endpoint().TokenURL, expToken)
+		}
+	})
+
+	t.Run("Override", func(t *testing.T) {
+		conn, err := newConnector(Config{
+			Issuer:                     testServer.URL,
+			Scopes:                     []string{"openid", "groups"},
+			ProviderDiscoveryOverrides: ProviderDiscoveryOverrides{TokenURL: "/test1", AuthURL: "/test2"},
+		})
+		if err != nil {
+			t.Fatal("failed to create new connector", err)
+		}
+
+		expAuth := "/test2"
+		if conn.provider.Endpoint().AuthURL != expAuth {
+			t.Fatalf("unexpected auth URL: %s, expected: %s\n", conn.provider.Endpoint().AuthURL, expAuth)
+		}
+
+		expToken := "/test1"
+		if conn.provider.Endpoint().TokenURL != expToken {
+			t.Fatalf("unexpected token URL: %s, expected: %s\n", conn.provider.Endpoint().TokenURL, expToken)
+		}
+	})
+
+	t.Run("Override userinfo and device auth URLs", func(t *testing.T) {
+		// A second server whose userinfo endpoint returns a distinct subject,
+		// so we can prove the overridden endpoint (not the discovery default)
+		// is the one actually used.
+		overrideServer, err := setupServer(map[string]any{"sub": "override-sub"}, true)
+		if err != nil {
+			t.Fatal("failed to setup override server", err)
+		}
+		defer overrideServer.Close()
+
+		conn, err := newConnector(Config{
+			Issuer: testServer.URL,
+			Scopes: []string{"openid", "groups"},
+			ProviderDiscoveryOverrides: ProviderDiscoveryOverrides{
+				DeviceAuthURL: "/test-device",
+				UserInfoURL:   fmt.Sprintf("%s/userinfo", overrideServer.URL),
+			},
+		})
+		if err != nil {
+			t.Fatal("failed to create new connector", err)
+		}
+
+		expDevice := "/test-device"
+		if conn.provider.Endpoint().DeviceAuthURL != expDevice {
+			t.Fatalf("unexpected device auth URL: %s, expected: %s\n", conn.provider.Endpoint().DeviceAuthURL, expDevice)
+		}
+
+		userInfo, err := conn.provider.UserInfo(context.Background(), oauth2.StaticTokenSource(&oauth2.Token{AccessToken: "sometoken"}))
+		if err != nil {
+			t.Fatal("failed to call UserInfo", err)
+		}
+		if userInfo.Subject != "override-sub" {
+			t.Fatalf("UserInfo did not use the overridden endpoint: got subject %q, expected %q", userInfo.Subject, "override-sub")
+		}
+	})
+}
+
 func setupServer(tok map[string]interface{}, idTokenDesired bool) (*httptest.Server, error) {
 	key, err := rsa.GenerateKey(rand.Reader, 1024)
 	if err != nil {
@@ -523,7 +966,7 @@ func newToken(key *jose.JSONWebKey, claims map[string]interface{}) (string, erro
 }
 
 func newConnector(config Config) (*oidcConnector, error) {
-	logger := logrus.New()
+	logger := slog.New(slog.DiscardHandler)
 	conn, err := config.Open("id", logger)
 	if err != nil {
 		return nil, fmt.Errorf("unable to open: %v", err)
@@ -570,3 +1013,108 @@ func expectEquals(t *testing.T, a interface{}, b interface{}) {
 		t.Errorf("Expected %+v to equal %+v", a, b)
 	}
 }
+
+func TestLogoutURL(t *testing.T) {
+	tests := []struct {
+		name                  string
+		endSessionURL         string
+		postLogoutRedirectURI string
+		wantURL               string
+		wantEmpty             bool
+	}{
+		{
+			name:          "no end_session_endpoint",
+			endSessionURL: "",
+			wantEmpty:     true,
+		},
+		{
+			name:          "with end_session_endpoint, no redirect",
+			endSessionURL: "https://provider.example.com/logout",
+			wantURL:       "https://provider.example.com/logout",
+		},
+		{
+			name:                  "with end_session_endpoint and redirect",
+			endSessionURL:         "https://provider.example.com/logout",
+			postLogoutRedirectURI: "https://dex.example.com/logout/callback",
+			wantURL:               "https://provider.example.com/logout?client_id=clientID&post_logout_redirect_uri=https%3A%2F%2Fdex.example.com%2Flogout%2Fcallback",
+		},
+		{
+			name:                  "with existing query params",
+			endSessionURL:         "https://provider.example.com/logout?existing=param",
+			postLogoutRedirectURI: "https://dex.example.com/callback",
+			wantURL:               "https://provider.example.com/logout?client_id=clientID&existing=param&post_logout_redirect_uri=https%3A%2F%2Fdex.example.com%2Fcallback",
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			conn := &oidcConnector{
+				endSessionURL: tc.endSessionURL,
+				oauth2Config: &oauth2.Config{
+					ClientID: "clientID",
+				},
+			}
+
+			got, err := conn.LogoutURL(context.Background(), tc.postLogoutRedirectURI)
+			require.NoError(t, err)
+
+			if tc.wantEmpty {
+				require.Empty(t, got)
+				return
+			}
+
+			require.Equal(t, tc.wantURL, got)
+		})
+	}
+}
+
+func TestEndSessionURLDiscovery(t *testing.T) {
+	// Setup a server that advertises end_session_endpoint in discovery.
+	key, err := rsa.GenerateKey(rand.Reader, 1024)
+	require.NoError(t, err)
+
+	mux := http.NewServeMux()
+	mux.HandleFunc("/keys", func(w http.ResponseWriter, r *http.Request) {
+		json.NewEncoder(w).Encode(&map[string]interface{}{
+			"keys": []map[string]interface{}{},
+		})
+	})
+
+	mux.HandleFunc("/.well-known/openid-configuration", func(w http.ResponseWriter, r *http.Request) {
+		url := fmt.Sprintf("http://%s", r.Host)
+		json.NewEncoder(w).Encode(&map[string]string{
+			"issuer":                 url,
+			"token_endpoint":         fmt.Sprintf("%s/token", url),
+			"authorization_endpoint": fmt.Sprintf("%s/authorize", url),
+			"jwks_uri":               fmt.Sprintf("%s/keys", url),
+			"end_session_endpoint":   fmt.Sprintf("%s/logout", url),
+		})
+	})
+
+	ts := httptest.NewServer(mux)
+	defer ts.Close()
+	_ = key // We only need the server for discovery.
+
+	conn, err := newConnector(Config{
+		Issuer: ts.URL,
+		Scopes: []string{"openid"},
+	})
+	require.NoError(t, err)
+	require.Equal(t, fmt.Sprintf("%s/logout", ts.URL), conn.endSessionURL)
+}
+
+func TestEndSessionURLOverride(t *testing.T) {
+	testServer, err := setupServer(nil, true)
+	require.NoError(t, err)
+	defer testServer.Close()
+
+	conn, err := newConnector(Config{
+		Issuer: testServer.URL,
+		Scopes: []string{"openid"},
+		ProviderDiscoveryOverrides: ProviderDiscoveryOverrides{
+			EndSessionURL: "https://custom.example.com/logout",
+		},
+	})
+	require.NoError(t, err)
+	require.Equal(t, "https://custom.example.com/logout", conn.endSessionURL)
+}
diff --git a/connector/openshift/openshift.go b/connector/openshift/openshift.go
index 81d2b35633..3d4408c585 100644
--- a/connector/openshift/openshift.go
+++ b/connector/openshift/openshift.go
@@ -2,22 +2,18 @@ package openshift
 
 import (
 	"context"
-	"crypto/tls"
-	"crypto/x509"
 	"encoding/json"
 	"fmt"
 	"io"
-	"net"
+	"log/slog"
 	"net/http"
-	"os"
 	"strings"
-	"time"
 
 	"golang.org/x/oauth2"
 
 	"github.com/dexidp/dex/connector"
 	"github.com/dexidp/dex/pkg/groups"
-	"github.com/dexidp/dex/pkg/log"
+	"github.com/dexidp/dex/pkg/httpclient"
 	"github.com/dexidp/dex/storage/kubernetes/k8sapi"
 )
 
@@ -48,7 +44,7 @@ type openshiftConnector struct {
 	clientID     string
 	clientSecret string
 	cancel       context.CancelFunc
-	logger       log.Logger
+	logger       *slog.Logger
 	httpClient   *http.Client
 	oauth2Config *oauth2.Config
 	insecureCA   bool
@@ -66,8 +62,13 @@ type user struct {
 
 // Open returns a connector which can be used to login users through an upstream
 // OpenShift OAuth2 provider.
-func (c *Config) Open(id string, logger log.Logger) (conn connector.Connector, err error) {
-	httpClient, err := newHTTPClient(c.InsecureCA, c.RootCA)
+func (c *Config) Open(id string, logger *slog.Logger) (conn connector.Connector, err error) {
+	var rootCAs []string
+	if c.RootCA != "" {
+		rootCAs = append(rootCAs, c.RootCA)
+	}
+
+	httpClient, err := httpclient.NewHTTPClient(rootCAs, c.InsecureCA)
 	if err != nil {
 		return nil, fmt.Errorf("failed to create HTTP client: %w", err)
 	}
@@ -77,13 +78,17 @@ func (c *Config) Open(id string, logger log.Logger) (conn connector.Connector, e
 
 // OpenWithHTTPClient returns a connector which can be used to login users through an upstream
 // OpenShift OAuth2 provider. It provides the ability to inject a http.Client.
-func (c *Config) OpenWithHTTPClient(id string, logger log.Logger,
+func (c *Config) OpenWithHTTPClient(id string, logger *slog.Logger,
 	httpClient *http.Client,
 ) (conn connector.Connector, err error) {
 	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
 
 	wellKnownURL := strings.TrimSuffix(c.Issuer, "/") + wellKnownURLPath
 	req, err := http.NewRequest(http.MethodGet, wellKnownURL, nil)
+	if err != nil {
+		return nil, fmt.Errorf("failed to create a request to OpenShift endpoint %w", err)
+	}
 
 	openshiftConnector := openshiftConnector{
 		apiURL:       c.Issuer,
@@ -91,7 +96,7 @@ func (c *Config) OpenWithHTTPClient(id string, logger log.Logger,
 		clientID:     c.ClientID,
 		clientSecret: c.ClientSecret,
 		insecureCA:   c.InsecureCA,
-		logger:       logger,
+		logger:       logger.With(slog.Group("connector", "type", "openshift", "id", id)),
 		redirectURI:  c.RedirectURI,
 		rootCA:       c.RootCA,
 		groups:       c.Groups,
@@ -105,14 +110,12 @@ func (c *Config) OpenWithHTTPClient(id string, logger log.Logger,
 
 	resp, err := openshiftConnector.httpClient.Do(req.WithContext(ctx))
 	if err != nil {
-		cancel()
 		return nil, fmt.Errorf("failed to query OpenShift endpoint %w", err)
 	}
 
 	defer resp.Body.Close()
 
 	if err := json.NewDecoder(resp.Body).Decode(&metadata); err != nil {
-		cancel()
 		return nil, fmt.Errorf("discovery through endpoint %s failed to decode body: %w",
 			wellKnownURL, err)
 	}
@@ -135,12 +138,12 @@ func (c *openshiftConnector) Close() error {
 }
 
 // LoginURL returns the URL to redirect the user to login with.
-func (c *openshiftConnector) LoginURL(scopes connector.Scopes, callbackURL, state string) (string, error) {
+func (c *openshiftConnector) LoginURL(scopes connector.Scopes, callbackURL, state string) (string, []byte, error) {
 	if c.redirectURI != callbackURL {
-		return "", fmt.Errorf("expected callback URL %q did not match the URL in the config %q",
+		return "", nil, fmt.Errorf("expected callback URL %q did not match the URL in the config %q",
 			callbackURL, c.redirectURI)
 	}
-	return c.oauth2Config.AuthCodeURL(state), nil
+	return c.oauth2Config.AuthCodeURL(state), nil, nil
 }
 
 type oauth2Error struct {
@@ -157,6 +160,7 @@ func (e *oauth2Error) Error() string {
 
 // HandleCallback parses the request and returns the user's identity
 func (c *openshiftConnector) HandleCallback(s connector.Scopes,
+	connData []byte,
 	r *http.Request,
 ) (identity connector.Identity, err error) {
 	q := r.URL.Query()
@@ -262,36 +266,3 @@ func validateAllowedGroups(userGroups, allowedGroups []string) bool {
 
 	return len(matchingGroups) != 0
 }
-
-// newHTTPClient returns a new HTTP client
-func newHTTPClient(insecureCA bool, rootCA string) (*http.Client, error) {
-	tlsConfig := tls.Config{}
-	if insecureCA {
-		tlsConfig = tls.Config{InsecureSkipVerify: true}
-	} else if rootCA != "" {
-		tlsConfig = tls.Config{RootCAs: x509.NewCertPool()}
-		rootCABytes, err := os.ReadFile(rootCA)
-		if err != nil {
-			return nil, fmt.Errorf("failed to read root-ca: %w", err)
-		}
-		if !tlsConfig.RootCAs.AppendCertsFromPEM(rootCABytes) {
-			return nil, fmt.Errorf("no certs found in root CA file %q", rootCA)
-		}
-	}
-
-	return &http.Client{
-		Transport: &http.Transport{
-			TLSClientConfig: &tlsConfig,
-			Proxy:           http.ProxyFromEnvironment,
-			DialContext: (&net.Dialer{
-				Timeout:   30 * time.Second,
-				KeepAlive: 30 * time.Second,
-				DualStack: true,
-			}).DialContext,
-			MaxIdleConns:          100,
-			IdleConnTimeout:       90 * time.Second,
-			TLSHandshakeTimeout:   10 * time.Second,
-			ExpectContinueTimeout: 1 * time.Second,
-		},
-	}, nil
-}
diff --git a/connector/openshift/openshift_test.go b/connector/openshift/openshift_test.go
index 6280b831de..bdddfc83be 100644
--- a/connector/openshift/openshift_test.go
+++ b/connector/openshift/openshift_test.go
@@ -4,6 +4,7 @@ import (
 	"context"
 	"encoding/json"
 	"fmt"
+	"log/slog"
 	"net/http"
 	"net/http/httptest"
 	"net/url"
@@ -11,10 +12,10 @@ import (
 	"testing"
 	"time"
 
-	"github.com/sirupsen/logrus"
 	"golang.org/x/oauth2"
 
 	"github.com/dexidp/dex/connector"
+	"github.com/dexidp/dex/pkg/httpclient"
 	"github.com/dexidp/dex/storage/kubernetes/k8sapi"
 )
 
@@ -36,7 +37,7 @@ func TestOpen(t *testing.T) {
 		InsecureCA:   true,
 	}
 
-	logger := logrus.New()
+	logger := slog.New(slog.DiscardHandler)
 
 	oconfig, err := c.Open("id", logger)
 
@@ -70,7 +71,7 @@ func TestGetUser(t *testing.T) {
 	_, err = http.NewRequest("GET", hostURL.String(), nil)
 	expectNil(t, err)
 
-	h, err := newHTTPClient(true, "")
+	h, err := httpclient.NewHTTPClient(nil, true)
 
 	expectNil(t, err)
 
@@ -128,7 +129,7 @@ func TestVerifyGroup(t *testing.T) {
 	_, err = http.NewRequest("GET", hostURL.String(), nil)
 	expectNil(t, err)
 
-	h, err := newHTTPClient(true, "")
+	h, err := httpclient.NewHTTPClient(nil, true)
 
 	expectNil(t, err)
 
@@ -164,7 +165,7 @@ func TestCallbackIdentity(t *testing.T) {
 	req, err := http.NewRequest("GET", hostURL.String(), nil)
 	expectNil(t, err)
 
-	h, err := newHTTPClient(true, "")
+	h, err := httpclient.NewHTTPClient(nil, true)
 
 	expectNil(t, err)
 
@@ -174,7 +175,7 @@ func TestCallbackIdentity(t *testing.T) {
 			TokenURL: fmt.Sprintf("%s/oauth/token", s.URL),
 		},
 	}}
-	identity, err := oc.HandleCallback(connector.Scopes{Groups: true}, req)
+	identity, err := oc.HandleCallback(connector.Scopes{Groups: true}, nil, req)
 
 	expectNil(t, err)
 	expectEquals(t, identity.UserID, "12345")
@@ -198,7 +199,7 @@ func TestRefreshIdentity(t *testing.T) {
 	})
 	defer s.Close()
 
-	h, err := newHTTPClient(true, "")
+	h, err := httpclient.NewHTTPClient(nil, true)
 	expectNil(t, err)
 
 	oc := openshiftConnector{apiURL: s.URL, httpClient: h, oauth2Config: &oauth2.Config{
@@ -237,7 +238,7 @@ func TestRefreshIdentityFailure(t *testing.T) {
 	})
 	defer s.Close()
 
-	h, err := newHTTPClient(true, "")
+	h, err := httpclient.NewHTTPClient(nil, true)
 	expectNil(t, err)
 
 	oc := openshiftConnector{apiURL: s.URL, httpClient: h, oauth2Config: &oauth2.Config{
diff --git a/connector/saml/saml.go b/connector/saml/saml.go
index 908ec703c9..8ef434b62a 100644
--- a/connector/saml/saml.go
+++ b/connector/saml/saml.go
@@ -3,11 +3,14 @@ package saml
 
 import (
 	"bytes"
+	"context"
 	"crypto/x509"
 	"encoding/base64"
+	"encoding/json"
 	"encoding/pem"
 	"encoding/xml"
 	"fmt"
+	"log/slog"
 	"os"
 	"strings"
 	"sync"
@@ -21,10 +24,8 @@ import (
 
 	"github.com/dexidp/dex/connector"
 	"github.com/dexidp/dex/pkg/groups"
-	"github.com/dexidp/dex/pkg/log"
 )
 
-// nolint
 const (
 	bindingRedirect = "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"
 	bindingPOST     = "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
@@ -120,11 +121,12 @@ func (c certStore) Certificates() (roots []*x509.Certificate, err error) {
 
 // Open validates the config and returns a connector. It does not actually
 // validate connectivity with the provider.
-func (c *Config) Open(id string, logger log.Logger) (connector.Connector, error) {
+func (c *Config) Open(id string, logger *slog.Logger) (connector.Connector, error) {
+	logger = logger.With(slog.Group("connector", "type", "saml", "id", id))
 	return c.openConnector(logger)
 }
 
-func (c *Config) openConnector(logger log.Logger) (*provider, error) {
+func (c *Config) openConnector(logger *slog.Logger) (*provider, error) {
 	requiredFields := []struct {
 		name, val string
 	}{
@@ -230,6 +232,11 @@ func (c *Config) openConnector(logger log.Logger) (*provider, error) {
 	return p, nil
 }
 
+var (
+	_ connector.SAMLConnector    = (*provider)(nil)
+	_ connector.RefreshConnector = (*provider)(nil)
+)
+
 type provider struct {
 	entityIssuer string
 	ssoIssuer    string
@@ -252,7 +259,37 @@ type provider struct {
 
 	nameIDPolicyFormat string
 
-	logger log.Logger
+	logger *slog.Logger
+}
+
+// cachedIdentity stores the identity from SAML assertion for refresh token support.
+// Since SAML has no native refresh mechanism, we cache the identity obtained during
+// the initial authentication and return it on subsequent refresh requests.
+type cachedIdentity struct {
+	UserID            string   `json:"userId"`
+	Username          string   `json:"username"`
+	PreferredUsername string   `json:"preferredUsername"`
+	Email             string   `json:"email"`
+	EmailVerified     bool     `json:"emailVerified"`
+	Groups            []string `json:"groups,omitempty"`
+}
+
+// marshalCachedIdentity serializes the identity into ConnectorData for refresh token support.
+func marshalCachedIdentity(ident connector.Identity) (connector.Identity, error) {
+	ci := cachedIdentity{
+		UserID:            ident.UserID,
+		Username:          ident.Username,
+		PreferredUsername: ident.PreferredUsername,
+		Email:             ident.Email,
+		EmailVerified:     ident.EmailVerified,
+		Groups:            ident.Groups,
+	}
+	connectorData, err := json.Marshal(ci)
+	if err != nil {
+		return ident, fmt.Errorf("saml: failed to marshal cached identity: %v", err)
+	}
+	ident.ConnectorData = connectorData
+	return ident, nil
 }
 
 func (p *provider) POSTData(s connector.Scopes, id string) (action, value string, err error) {
@@ -292,7 +329,6 @@ func (p *provider) POSTData(s connector.Scopes, id string) (action, value string
 // * Verify signature on XML document (or verify sig on assertion elements).
 // * Verify various parts of the Assertion element. Conditions, audience, etc.
 // * Map the Assertion's attribute elements to user info.
-//
 func (p *provider) HandlePOST(s connector.Scopes, samlResponse, inResponseTo string) (ident connector.Identity, err error) {
 	rawResp, err := base64.StdEncoding.DecodeString(samlResponse)
 	if err != nil {
@@ -390,7 +426,7 @@ func (p *provider) HandlePOST(s connector.Scopes, samlResponse, inResponseTo str
 	// Log the actual attributes we got back from the server. This helps debug
 	// configuration errors on the server side, where the SAML server doesn't
 	// send us the correct attributes.
-	p.logger.Infof("parsed and verified saml response attributes %s", attributes)
+	p.logger.Info("parsed and verified saml response attributes", "attributes", attributes)
 
 	// Grab the email.
 	if ident.Email, _ = attributes.get(p.emailAttr); ident.Email == "" {
@@ -406,7 +442,7 @@ func (p *provider) HandlePOST(s connector.Scopes, samlResponse, inResponseTo str
 
 	if len(p.allowedGroups) == 0 && (!s.Groups || p.groupsAttr == "") {
 		// Groups not requested or not configured. We're done.
-		return ident, nil
+		return marshalCachedIdentity(ident)
 	}
 
 	if len(p.allowedGroups) > 0 && (!s.Groups || p.groupsAttr == "") {
@@ -432,7 +468,7 @@ func (p *provider) HandlePOST(s connector.Scopes, samlResponse, inResponseTo str
 
 	if len(p.allowedGroups) == 0 {
 		// No allowed groups set, just return the ident
-		return ident, nil
+		return marshalCachedIdentity(ident)
 	}
 
 	// Look for membership in one of the allowed groups
@@ -448,6 +484,35 @@ func (p *provider) HandlePOST(s connector.Scopes, samlResponse, inResponseTo str
 	}
 
 	// Otherwise, we're good
+	return marshalCachedIdentity(ident)
+}
+
+// Refresh implements connector.RefreshConnector.
+// Since SAML has no native refresh mechanism, this method returns the cached
+// identity from the initial SAML assertion stored in ConnectorData.
+func (p *provider) Refresh(ctx context.Context, s connector.Scopes, ident connector.Identity) (connector.Identity, error) {
+	if len(ident.ConnectorData) == 0 {
+		return ident, fmt.Errorf("saml: no connector data available for refresh")
+	}
+
+	var ci cachedIdentity
+	if err := json.Unmarshal(ident.ConnectorData, &ci); err != nil {
+		return ident, fmt.Errorf("saml: failed to unmarshal cached identity: %v", err)
+	}
+
+	ident.UserID = ci.UserID
+	ident.Username = ci.Username
+	ident.PreferredUsername = ci.PreferredUsername
+	ident.Email = ci.Email
+	ident.EmailVerified = ci.EmailVerified
+
+	// Only populate groups if the client requested the groups scope.
+	if s.Groups {
+		ident.Groups = ci.Groups
+	} else {
+		ident.Groups = nil
+	}
+
 	return ident, nil
 }
 
@@ -468,7 +533,7 @@ func (p *provider) validateStatus(status *status) error {
 		if statusMessage != nil && statusMessage.Value != "" {
 			errorMessage += " -> " + statusMessage.Value
 		}
-		return fmt.Errorf(errorMessage)
+		return errors.New(errorMessage)
 	}
 	return nil
 }
@@ -531,7 +596,7 @@ func (p *provider) validateSubject(subject *subject, inResponseTo string) error
 	return fmt.Errorf("failed to validate subject confirmation: %v", errs)
 }
 
-// validationConditions ensures that dex is the intended audience
+// validateConditions ensures that dex is the intended audience
 // for the request, and not another service provider.
 //
 // See: https://docs.oasis-open.org/security/saml/v2.0/saml-core-2.0-os.pdf
@@ -598,6 +663,9 @@ func verifyResponseSig(validator *dsig.ValidationContext, data []byte) (signed [
 	}
 
 	response := doc.Root()
+	if response == nil {
+		return nil, false, fmt.Errorf("parse document: empty root")
+	}
 	transformedResponse, err := validator.Validate(response)
 	if err == nil {
 		// Root element is verified, return it.
@@ -610,7 +678,7 @@ func verifyResponseSig(validator *dsig.ValidationContext, data []byte) (signed [
 	//
 	// TODO: Only select from child elements of the root.
 	assertion, err := etreeutils.NSSelectOne(response, "urn:oasis:names:tc:SAML:2.0:assertion", "Assertion")
-	if err != nil {
+	if err != nil || assertion == nil {
 		return nil, false, fmt.Errorf("response does not contain an Assertion element")
 	}
 	transformedAssertion, err := validator.Validate(assertion)
diff --git a/connector/saml/saml_test.go b/connector/saml/saml_test.go
index 95d513ed19..3eba5cf878 100644
--- a/connector/saml/saml_test.go
+++ b/connector/saml/saml_test.go
@@ -1,10 +1,13 @@
 package saml
 
 import (
+	"context"
 	"crypto/x509"
 	"encoding/base64"
+	"encoding/json"
 	"encoding/pem"
 	"errors"
+	"log/slog"
 	"os"
 	"sort"
 	"testing"
@@ -12,7 +15,6 @@ import (
 
 	"github.com/kylelemons/godebug/pretty"
 	dsig "github.com/russellhaering/goxmldsig"
-	"github.com/sirupsen/logrus"
 
 	"github.com/dexidp/dex/connector"
 )
@@ -24,19 +26,18 @@ import (
 // To add a new test, define a new, unsigned SAML 2.0 response that exercises some
 // case, then sign it using the "testdata/gen.sh" script.
 //
-//     cp testdata/good-resp.tmpl testdata/( testname ).tmpl
-//     vim ( testname ).tmpl # Modify your template for your test case.
-//     vim testdata/gen.sh   # Add a xmlsec1 command to the generation script.
-//     ./testdata/gen.sh     # Sign your template.
+//	cp testdata/good-resp.tmpl testdata/( testname ).tmpl
+//	vim ( testname ).tmpl # Modify your template for your test case.
+//	vim testdata/gen.sh   # Add a xmlsec1 command to the generation script.
+//	./testdata/gen.sh     # Sign your template.
 //
 // To install xmlsec1 on Fedora run:
 //
-//     sudo dnf install xmlsec1 xmlsec1-openssl
+//	sudo dnf install xmlsec1 xmlsec1-openssl
 //
 // On mac:
 //
-//     brew install Libxmlsec1
-//
+//	brew install Libxmlsec1
 type responseTest struct {
 	// CA file and XML file of the response.
 	caFile   string
@@ -421,7 +422,7 @@ func (r responseTest) run(t *testing.T) {
 		t.Fatalf("parse test time: %v", err)
 	}
 
-	conn, err := c.openConnector(logrus.New())
+	conn, err := c.openConnector(slog.New(slog.DiscardHandler))
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -449,13 +450,31 @@ func (r responseTest) run(t *testing.T) {
 	}
 	sort.Strings(ident.Groups)
 	sort.Strings(r.wantIdent.Groups)
+
+	// Verify ConnectorData contains valid cached identity, then clear it
+	// for the main identity comparison (ConnectorData is an implementation
+	// detail of refresh token support).
+	if len(ident.ConnectorData) > 0 {
+		var ci cachedIdentity
+		if err := json.Unmarshal(ident.ConnectorData, &ci); err != nil {
+			t.Fatalf("failed to unmarshal ConnectorData: %v", err)
+		}
+		if ci.UserID != ident.UserID {
+			t.Errorf("cached identity UserID mismatch: got %q, want %q", ci.UserID, ident.UserID)
+		}
+		if ci.Email != ident.Email {
+			t.Errorf("cached identity Email mismatch: got %q, want %q", ci.Email, ident.Email)
+		}
+	}
+	ident.ConnectorData = nil
+
 	if diff := pretty.Compare(ident, r.wantIdent); diff != "" {
 		t.Error(diff)
 	}
 }
 
 func TestConfigCAData(t *testing.T) {
-	logger := logrus.New()
+	logger := slog.New(slog.DiscardHandler)
 	validPEM, err := os.ReadFile("testdata/ca.crt")
 	if err != nil {
 		t.Fatal(err)
@@ -590,3 +609,310 @@ func TestVerifySignedMessageAndSignedAssertion(t *testing.T) {
 func TestVerifyUnsignedMessageAndUnsignedAssertion(t *testing.T) {
 	runVerify(t, "testdata/idp-cert.pem", "testdata/idp-resp.xml", false)
 }
+
+func TestSAMLRefresh(t *testing.T) {
+	// Create a provider using the same pattern as existing tests.
+	c := Config{
+		CA:           "testdata/ca.crt",
+		UsernameAttr: "Name",
+		EmailAttr:    "email",
+		GroupsAttr:   "groups",
+		RedirectURI:  "http://127.0.0.1:5556/dex/callback",
+		SSOURL:       "http://foo.bar/",
+	}
+
+	conn, err := c.openConnector(slog.New(slog.DiscardHandler))
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	t.Run("SuccessfulRefresh", func(t *testing.T) {
+		ci := cachedIdentity{
+			UserID:            "test-user-id",
+			Username:          "testuser",
+			PreferredUsername: "testuser",
+			Email:             "test@example.com",
+			EmailVerified:     true,
+			Groups:            []string{"group1", "group2"},
+		}
+		connectorData, err := json.Marshal(ci)
+		if err != nil {
+			t.Fatal(err)
+		}
+
+		ident := connector.Identity{
+			UserID:        "old-id",
+			Username:      "old-name",
+			ConnectorData: connectorData,
+		}
+
+		refreshed, err := conn.Refresh(context.Background(), connector.Scopes{Groups: true}, ident)
+		if err != nil {
+			t.Fatalf("Refresh failed: %v", err)
+		}
+
+		if refreshed.UserID != "test-user-id" {
+			t.Errorf("expected UserID %q, got %q", "test-user-id", refreshed.UserID)
+		}
+		if refreshed.Username != "testuser" {
+			t.Errorf("expected Username %q, got %q", "testuser", refreshed.Username)
+		}
+		if refreshed.PreferredUsername != "testuser" {
+			t.Errorf("expected PreferredUsername %q, got %q", "testuser", refreshed.PreferredUsername)
+		}
+		if refreshed.Email != "test@example.com" {
+			t.Errorf("expected Email %q, got %q", "test@example.com", refreshed.Email)
+		}
+		if !refreshed.EmailVerified {
+			t.Error("expected EmailVerified to be true")
+		}
+		if len(refreshed.Groups) != 2 || refreshed.Groups[0] != "group1" || refreshed.Groups[1] != "group2" {
+			t.Errorf("expected groups [group1, group2], got %v", refreshed.Groups)
+		}
+		// ConnectorData should be preserved through refresh
+		if len(refreshed.ConnectorData) == 0 {
+			t.Error("expected ConnectorData to be preserved")
+		}
+	})
+
+	t.Run("RefreshPreservesConnectorData", func(t *testing.T) {
+		ci := cachedIdentity{
+			UserID:        "user-123",
+			Username:      "alice",
+			Email:         "alice@example.com",
+			EmailVerified: true,
+		}
+		connectorData, err := json.Marshal(ci)
+		if err != nil {
+			t.Fatal(err)
+		}
+
+		ident := connector.Identity{
+			UserID:        "old-id",
+			ConnectorData: connectorData,
+		}
+
+		refreshed, err := conn.Refresh(context.Background(), connector.Scopes{}, ident)
+		if err != nil {
+			t.Fatalf("Refresh failed: %v", err)
+		}
+
+		// Verify the refreshed identity can be refreshed again (round-trip)
+		var roundTrip cachedIdentity
+		if err := json.Unmarshal(refreshed.ConnectorData, &roundTrip); err != nil {
+			t.Fatalf("failed to unmarshal ConnectorData after refresh: %v", err)
+		}
+		if roundTrip.UserID != "user-123" {
+			t.Errorf("round-trip UserID mismatch: got %q, want %q", roundTrip.UserID, "user-123")
+		}
+	})
+
+	t.Run("EmptyConnectorData", func(t *testing.T) {
+		ident := connector.Identity{
+			UserID:        "test-id",
+			ConnectorData: nil,
+		}
+		_, err := conn.Refresh(context.Background(), connector.Scopes{}, ident)
+		if err == nil {
+			t.Error("expected error for empty ConnectorData")
+		}
+	})
+
+	t.Run("InvalidJSON", func(t *testing.T) {
+		ident := connector.Identity{
+			UserID:        "test-id",
+			ConnectorData: []byte("not-json"),
+		}
+		_, err := conn.Refresh(context.Background(), connector.Scopes{}, ident)
+		if err == nil {
+			t.Error("expected error for invalid JSON")
+		}
+	})
+
+	t.Run("HandlePOSTThenRefresh", func(t *testing.T) {
+		// Full integration: HandlePOST → get ConnectorData → Refresh → verify identity
+		now, err := time.Parse(timeFormat, "2017-04-04T04:34:59.330Z")
+		if err != nil {
+			t.Fatal(err)
+		}
+		conn.now = func() time.Time { return now }
+
+		resp, err := os.ReadFile("testdata/good-resp.xml")
+		if err != nil {
+			t.Fatal(err)
+		}
+		samlResp := base64.StdEncoding.EncodeToString(resp)
+
+		scopes := connector.Scopes{
+			OfflineAccess: true,
+			Groups:        true,
+		}
+		ident, err := conn.HandlePOST(scopes, samlResp, "6zmm5mguyebwvajyf2sdwwcw6m")
+		if err != nil {
+			t.Fatalf("HandlePOST failed: %v", err)
+		}
+
+		if len(ident.ConnectorData) == 0 {
+			t.Fatal("expected ConnectorData to be set after HandlePOST")
+		}
+
+		// Now refresh using the ConnectorData from HandlePOST
+		refreshed, err := conn.Refresh(context.Background(), scopes, ident)
+		if err != nil {
+			t.Fatalf("Refresh failed: %v", err)
+		}
+
+		if refreshed.UserID != ident.UserID {
+			t.Errorf("UserID mismatch: got %q, want %q", refreshed.UserID, ident.UserID)
+		}
+		if refreshed.Username != ident.Username {
+			t.Errorf("Username mismatch: got %q, want %q", refreshed.Username, ident.Username)
+		}
+		if refreshed.Email != ident.Email {
+			t.Errorf("Email mismatch: got %q, want %q", refreshed.Email, ident.Email)
+		}
+		if refreshed.EmailVerified != ident.EmailVerified {
+			t.Errorf("EmailVerified mismatch: got %v, want %v", refreshed.EmailVerified, ident.EmailVerified)
+		}
+		sort.Strings(refreshed.Groups)
+		sort.Strings(ident.Groups)
+		if len(refreshed.Groups) != len(ident.Groups) {
+			t.Errorf("Groups length mismatch: got %d, want %d", len(refreshed.Groups), len(ident.Groups))
+		}
+		for i := range ident.Groups {
+			if i < len(refreshed.Groups) && refreshed.Groups[i] != ident.Groups[i] {
+				t.Errorf("Groups[%d] mismatch: got %q, want %q", i, refreshed.Groups[i], ident.Groups[i])
+			}
+		}
+	})
+
+	t.Run("HandlePOSTThenDoubleRefresh", func(t *testing.T) {
+		// Verify that refresh tokens can be chained: HandlePOST → Refresh → Refresh
+		now, err := time.Parse(timeFormat, "2017-04-04T04:34:59.330Z")
+		if err != nil {
+			t.Fatal(err)
+		}
+		conn.now = func() time.Time { return now }
+
+		resp, err := os.ReadFile("testdata/good-resp.xml")
+		if err != nil {
+			t.Fatal(err)
+		}
+		samlResp := base64.StdEncoding.EncodeToString(resp)
+
+		scopes := connector.Scopes{OfflineAccess: true, Groups: true}
+		ident, err := conn.HandlePOST(scopes, samlResp, "6zmm5mguyebwvajyf2sdwwcw6m")
+		if err != nil {
+			t.Fatalf("HandlePOST failed: %v", err)
+		}
+
+		// First refresh
+		refreshed1, err := conn.Refresh(context.Background(), scopes, ident)
+		if err != nil {
+			t.Fatalf("first Refresh failed: %v", err)
+		}
+		if len(refreshed1.ConnectorData) == 0 {
+			t.Fatal("expected ConnectorData after first refresh")
+		}
+
+		// Second refresh using output of first refresh
+		refreshed2, err := conn.Refresh(context.Background(), scopes, refreshed1)
+		if err != nil {
+			t.Fatalf("second Refresh failed: %v", err)
+		}
+
+		// All fields should match original
+		if refreshed2.UserID != ident.UserID {
+			t.Errorf("UserID mismatch after double refresh: got %q, want %q", refreshed2.UserID, ident.UserID)
+		}
+		if refreshed2.Email != ident.Email {
+			t.Errorf("Email mismatch after double refresh: got %q, want %q", refreshed2.Email, ident.Email)
+		}
+		if refreshed2.Username != ident.Username {
+			t.Errorf("Username mismatch after double refresh: got %q, want %q", refreshed2.Username, ident.Username)
+		}
+	})
+
+	t.Run("HandlePOSTWithAssertionSignedThenRefresh", func(t *testing.T) {
+		// Test with assertion-signed.xml (signature on assertion, not response)
+		now, err := time.Parse(timeFormat, "2017-04-04T04:34:59.330Z")
+		if err != nil {
+			t.Fatal(err)
+		}
+		conn.now = func() time.Time { return now }
+
+		resp, err := os.ReadFile("testdata/assertion-signed.xml")
+		if err != nil {
+			t.Fatal(err)
+		}
+		samlResp := base64.StdEncoding.EncodeToString(resp)
+
+		scopes := connector.Scopes{OfflineAccess: true, Groups: true}
+		ident, err := conn.HandlePOST(scopes, samlResp, "6zmm5mguyebwvajyf2sdwwcw6m")
+		if err != nil {
+			t.Fatalf("HandlePOST with assertion-signed failed: %v", err)
+		}
+
+		if len(ident.ConnectorData) == 0 {
+			t.Fatal("expected ConnectorData after HandlePOST with assertion-signed")
+		}
+
+		refreshed, err := conn.Refresh(context.Background(), scopes, ident)
+		if err != nil {
+			t.Fatalf("Refresh after assertion-signed HandlePOST failed: %v", err)
+		}
+
+		if refreshed.Email != ident.Email {
+			t.Errorf("Email mismatch: got %q, want %q", refreshed.Email, ident.Email)
+		}
+		if refreshed.Username != ident.Username {
+			t.Errorf("Username mismatch: got %q, want %q", refreshed.Username, ident.Username)
+		}
+	})
+
+	t.Run("HandlePOSTRefreshWithoutGroupsScope", func(t *testing.T) {
+		// Verify that groups are NOT returned when groups scope is not requested during refresh
+		now, err := time.Parse(timeFormat, "2017-04-04T04:34:59.330Z")
+		if err != nil {
+			t.Fatal(err)
+		}
+		conn.now = func() time.Time { return now }
+
+		resp, err := os.ReadFile("testdata/good-resp.xml")
+		if err != nil {
+			t.Fatal(err)
+		}
+		samlResp := base64.StdEncoding.EncodeToString(resp)
+
+		// Initial auth WITH groups
+		scopesWithGroups := connector.Scopes{OfflineAccess: true, Groups: true}
+		ident, err := conn.HandlePOST(scopesWithGroups, samlResp, "6zmm5mguyebwvajyf2sdwwcw6m")
+		if err != nil {
+			t.Fatalf("HandlePOST failed: %v", err)
+		}
+		if len(ident.Groups) == 0 {
+			t.Fatal("expected groups in initial identity")
+		}
+
+		// Refresh WITHOUT groups scope
+		scopesNoGroups := connector.Scopes{OfflineAccess: true, Groups: false}
+		refreshed, err := conn.Refresh(context.Background(), scopesNoGroups, ident)
+		if err != nil {
+			t.Fatalf("Refresh failed: %v", err)
+		}
+
+		if len(refreshed.Groups) != 0 {
+			t.Errorf("expected no groups when groups scope not requested, got %v", refreshed.Groups)
+		}
+
+		// Refresh WITH groups scope — groups should be back
+		refreshedWithGroups, err := conn.Refresh(context.Background(), scopesWithGroups, ident)
+		if err != nil {
+			t.Fatalf("Refresh with groups failed: %v", err)
+		}
+
+		if len(refreshedWithGroups.Groups) == 0 {
+			t.Error("expected groups when groups scope is requested")
+		}
+	})
+}
diff --git a/connector/saml/testdata/oam-ca.pem b/connector/saml/testdata/oam-ca.pem
index 41645dda75..160ac52b59 100644
--- a/connector/saml/testdata/oam-ca.pem
+++ b/connector/saml/testdata/oam-ca.pem
@@ -1,13 +1,19 @@
 -----BEGIN CERTIFICATE-----
-MIIB/jCCAWegAwIBAgIBCjANBgkqhkiG9w0BAQQFADAkMSIwIAYDVQQDExlkZWFv
-YW0tZGV2MDIuanBsLm5hc2EuZ292MB4XDTE2MDYzMDA0NTQxNloXDTI2MDYyODA0
-NTQxNlowJDEiMCAGA1UEAxMZZGVhb2FtLWRldjAyLmpwbC5uYXNhLmdvdjCBnzAN
-BgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAht1N4lGdwUbl7YRyHwSCrnep6/e2I3+V
-eue0pSA/DGn8OuR/udM8UCja5utqlqJdq200ox4b4Mpz0Jg9kMckALtKe+1DgeES
-EIx9FpeuBdHlitYQNSbEr30HIG2nmeTOy4Vi5unBO54um3tNazcUTMA0/LJ6KQL8
-LeZSlB/IxwUCAwEAAaNAMD4wDAYDVR0TAQH/BAIwADAPBgNVHQ8BAf8EBQMDB9gA
-MB0GA1UdDgQWBBRYo1YjfrNonauLzj6/AsueWFGSszANBgkqhkiG9w0BAQQFAAOB
-gQACq7GHK/Zsg0+qC0WWa2ZjmOXE6Dqk/xuooG49QT7ihABs7k9U27Fw3xKF6MkC
-7pca1FwT82eZK1N3XKKpZe7Flu1fMKt2o/XSiBkDjWwUcChVnwGsUBe8hJFwFqg7
-olNJn1kaVBJUqZIiXF9kS0d+1H55rStOd0CNXAzp9utr2A==
+MIIDATCCAemgAwIBAgIBATANBgkqhkiG9w0BAQsFADAyMQwwCgYDVQQKEwNERVgx
+IjAgBgNVBAMTGWRleC1zYW1sLW9hbS10ZXN0LWZpeHR1cmUwIBcNMjYwNzAyMTIw
+NDUyWhgPMjEyNTA3MDIxMjA0NTJaMDIxDDAKBgNVBAoTA0RFWDEiMCAGA1UEAxMZ
+ZGV4LXNhbWwtb2FtLXRlc3QtZml4dHVyZTCCASIwDQYJKoZIhvcNAQEBBQADggEP
+ADCCAQoCggEBAMlA5rxidl/KIjQYJNMey55ujzYXBuJvZrBz3m+bsw8VqUkwcOVc
+EMZkcmu865mvGuCkE6kdo7c3t6HfzjOpPEv0oM+xB1RqzCzGoT7pMTJ+p77Es/yQ
+ML393N19MyDDb2bdUucbw+fAqSyZanUoBB+uobduO3z5cUtZIpF0RDg6wPltbnYL
+CX/F9ccIUidjUSA8YwzHRPIe6ozb+y/SMp+9cZvo7EMBSaFqPengCMXuAGLHCOQ+
+nfxcW24YpC4J3mFCulYT/M+dS8sJiD33Uup81lfM6F3/wF8faWryuEIUWpWgZLLA
+hs0qN+D/Vnx7ZrqtzFFbD67qEP6N4toas9ECAwEAAaMgMB4wDgYDVR0PAQH/BAQD
+AgWgMAwGA1UdEwEB/wQCMAAwDQYJKoZIhvcNAQELBQADggEBAE9n3RkGdpYbb8Tk
+AZswdSiBlB47GYuPrTdTfQFSxxaWj7iyaVi4RZL/Llp3HO3ndTLAc6Glr0P6Yx79
+Njv9nlFTBW+gqWD0vaB4zfWEdwKfY+ZBCUg+IXxtKc/V/IGCotMDZAYXIiDblRP7
+i2IBOSZAhuPY1B8pRnCZ5UvvRv+9v5NvUe4kwmSfqAflQ+NbBDRgwHG2sQ+dZqHV
+e+BoGlbKYoTEOJTDLBPH6BgNKredTFANp34+rIwPAAzQxCOsrVus2109KKVxKkGp
+Q0ycdieQ9FnRrq3320YPNa7NZu0Vqiip2yklZYh5qz/7UD5JAn6AuQZzC3m8kUJO
+mz20rDI=
 -----END CERTIFICATE-----
diff --git a/connector/saml/testdata/oam-resp.xml b/connector/saml/testdata/oam-resp.xml
index 99d148770c..870b3c9f25 100644
--- a/connector/saml/testdata/oam-resp.xml
+++ b/connector/saml/testdata/oam-resp.xml
@@ -1 +1 @@
-<samlp:Response xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:dsig="http://www.w3.org/2000/09/xmldsig#" xmlns:enc="http://www.w3.org/2001/04/xmlenc#" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:x500="urn:oasis:names:tc:SAML:2.0:profiles:attribute:X500" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" Destination="http://127.0.0.1:5556/callback" ID="id-IWlPTptSB-PlR80dwt8ZhVeG70mrz7nPvTVrhduK" InResponseTo="_e66b3a98-831c-4c96-5706-b63fe0549624" IssueInstant="2016-12-12T16:54:35Z" Version="2.0"><saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">https://deaoam-dev02.jpl.nasa.gov:14101/oam/fed</saml:Issuer><samlp:Status><samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success"/></samlp:Status><saml:Assertion ID="id-rT9rTqxdQC9j34YhVeNayUWC9EbIBgym6gp-MZt-" IssueInstant="2016-12-12T16:54:35Z" Version="2.0"><saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">https://deaoam-dev02.jpl.nasa.gov:14101/oam/fed</saml:Issuer><dsig:Signature><dsig:SignedInfo><dsig:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/><dsig:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/><dsig:Reference URI="#id-rT9rTqxdQC9j34YhVeNayUWC9EbIBgym6gp-MZt-"><dsig:Transforms><dsig:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/><dsig:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/></dsig:Transforms><dsig:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/><dsig:DigestValue>z1HD/59hv6UOd5+jeG+ihaFWLgI=</dsig:DigestValue></dsig:Reference></dsig:SignedInfo><dsig:SignatureValue>I99oG5kiOfIgbXYa21z/TOmzftTkFnXe9ObhBNSKit9kAhT93apYROqqXv4Ax96P144Ld7ERX1hgJsytK8LC2874Pk7QrSNm4zvW3x0D4GR4lM06CvJK/EhIur3TrCUJDPigvyP7TJitheCyBejwt0x0lqNP/OzR3tMbAIMRoho=</dsig:SignatureValue></dsig:Signature><saml:Subject><saml:NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent" NameQualifier="https://deaoam-dev02.jpl.nasa.gov:14101/oam/fed" SPNameQualifier="JSAuth">pkieu</saml:NameID><saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"><saml:SubjectConfirmationData InResponseTo="_e66b3a98-831c-4c96-5706-b63fe0549624" NotOnOrAfter="2016-12-12T16:59:35Z" Recipient="http://127.0.0.1:5556/callback"/></saml:SubjectConfirmation></saml:Subject><saml:Conditions NotBefore="2016-12-12T16:54:35Z" NotOnOrAfter="2016-12-12T16:59:35Z"><saml:AudienceRestriction><saml:Audience>JSAuth</saml:Audience></saml:AudienceRestriction></saml:Conditions><saml:AuthnStatement AuthnInstant="2016-12-12T16:54:10Z" SessionIndex="id-l3NCbxKoBfUZcuKhlotMuIF3ydgYJgGGG6BGTTU6" SessionNotOnOrAfter="2016-12-12T17:54:35Z"><saml:AuthnContext><saml:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</saml:AuthnContextClassRef></saml:AuthnContext></saml:AuthnStatement></saml:Assertion></samlp:Response>
+<samlp:Response xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:dsig="http://www.w3.org/2000/09/xmldsig#" xmlns:enc="http://www.w3.org/2001/04/xmlenc#" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:x500="urn:oasis:names:tc:SAML:2.0:profiles:attribute:X500" xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" Destination="http://127.0.0.1:5556/callback" ID="id-root-unsigned-oam-fixture" InResponseTo="_e66b3a98-831c-4c96-5706-b63fe0549624" IssueInstant="2026-07-02T00:00:00Z" Version="2.0"><saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">https://dex.example.com/oam/fed</saml:Issuer><samlp:Status><samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success"/></samlp:Status><saml:Assertion ID="id-signed-assertion-oam-fixture" IssueInstant="2026-07-02T00:00:00Z" Version="2.0"><saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">https://dex.example.com/oam/fed</saml:Issuer><saml:Subject><saml:NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent">dex-oam-fixture-user</saml:NameID><saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"><saml:SubjectConfirmationData InResponseTo="_e66b3a98-831c-4c96-5706-b63fe0549624" NotOnOrAfter="2125-07-02T00:00:00Z" Recipient="http://127.0.0.1:5556/callback"/></saml:SubjectConfirmation></saml:Subject><saml:Conditions NotBefore="2026-07-02T00:00:00Z" NotOnOrAfter="2125-07-02T00:00:00Z"><saml:AudienceRestriction><saml:Audience>http://127.0.0.1:5556/callback</saml:Audience></saml:AudienceRestriction></saml:Conditions><saml:AttributeStatement><saml:Attribute Name="email"><saml:AttributeValue xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:string">dex-oam-fixture@example.com</saml:AttributeValue></saml:Attribute></saml:AttributeStatement><dsig:Signature xmlns:dsig="http://www.w3.org/2000/09/xmldsig#"><dsig:SignedInfo><dsig:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/><dsig:SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256"/><dsig:Reference URI="#id-signed-assertion-oam-fixture"><dsig:Transforms><dsig:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/><dsig:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/></dsig:Transforms><dsig:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/><dsig:DigestValue>Ni0lhZEaolfxURixgYJCa6+h4RwEvIrpA2/WvVtNMOM=</dsig:DigestValue></dsig:Reference></dsig:SignedInfo><dsig:SignatureValue>QTWGSorT5sQlOxK1Ez1ex3Us22IPC4azEXiI0EuxG0lbMzy+einBPHEFpTsjTguIEuhx5odwInNURSBty8j6BxY4V02qzFOr/yrFu1ULavX8drojYaU0cNQpJgUnYgrTb+5iI4WzVBxn+yM24RE79gLqEG6spQ7S6+kvDSVBgSUnSnVTKChiqGJ0Jm2FJQSwiyf9MMgFFbFvSK9Mqw6D3gpa45uAv8K6GJhE9l12UhrtP+craDCOBiLVcGDFcR0f+TY9MFh9gGm2o3CmiNl39MHGH9EY4RWjLAmieDUR5bdYi97L87xGx0jhrO4shYEb2BwFbOQFsQbzuJPlU6KKTA==</dsig:SignatureValue><dsig:KeyInfo><dsig:X509Data><dsig:X509Certificate>MIIDATCCAemgAwIBAgIBATANBgkqhkiG9w0BAQsFADAyMQwwCgYDVQQKEwNERVgxIjAgBgNVBAMTGWRleC1zYW1sLW9hbS10ZXN0LWZpeHR1cmUwIBcNMjYwNzAyMTIwNDUyWhgPMjEyNTA3MDIxMjA0NTJaMDIxDDAKBgNVBAoTA0RFWDEiMCAGA1UEAxMZZGV4LXNhbWwtb2FtLXRlc3QtZml4dHVyZTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMlA5rxidl/KIjQYJNMey55ujzYXBuJvZrBz3m+bsw8VqUkwcOVcEMZkcmu865mvGuCkE6kdo7c3t6HfzjOpPEv0oM+xB1RqzCzGoT7pMTJ+p77Es/yQML393N19MyDDb2bdUucbw+fAqSyZanUoBB+uobduO3z5cUtZIpF0RDg6wPltbnYLCX/F9ccIUidjUSA8YwzHRPIe6ozb+y/SMp+9cZvo7EMBSaFqPengCMXuAGLHCOQ+nfxcW24YpC4J3mFCulYT/M+dS8sJiD33Uup81lfM6F3/wF8faWryuEIUWpWgZLLAhs0qN+D/Vnx7ZrqtzFFbD67qEP6N4toas9ECAwEAAaMgMB4wDgYDVR0PAQH/BAQDAgWgMAwGA1UdEwEB/wQCMAAwDQYJKoZIhvcNAQELBQADggEBAE9n3RkGdpYbb8TkAZswdSiBlB47GYuPrTdTfQFSxxaWj7iyaVi4RZL/Llp3HO3ndTLAc6Glr0P6Yx79Njv9nlFTBW+gqWD0vaB4zfWEdwKfY+ZBCUg+IXxtKc/V/IGCotMDZAYXIiDblRP7i2IBOSZAhuPY1B8pRnCZ5UvvRv+9v5NvUe4kwmSfqAflQ+NbBDRgwHG2sQ+dZqHVe+BoGlbKYoTEOJTDLBPH6BgNKredTFANp34+rIwPAAzQxCOsrVus2109KKVxKkGpQ0ycdieQ9FnRrq3320YPNa7NZu0Vqiip2yklZYh5qz/7UD5JAn6AuQZzC3m8kUJOmz20rDI=</dsig:X509Certificate></dsig:X509Data></dsig:KeyInfo></dsig:Signature></saml:Assertion></samlp:Response>
diff --git a/connector/spnego.go b/connector/spnego.go
new file mode 100644
index 0000000000..ab89e84069
--- /dev/null
+++ b/connector/spnego.go
@@ -0,0 +1,22 @@
+package connector
+
+import (
+	"context"
+	"net/http"
+)
+
+// Handled indicates whether the SPNEGO-aware connector handled the request.
+type Handled bool
+
+// SPNEGOAware is an optional extension for connectors that can authenticate
+// users via Kerberos SPNEGO on the initial GET to the password login endpoint.
+//
+// If handled is true and ident is non-nil, the caller should complete the
+// OAuth flow as with a successful password login. If handled is true and
+// ident is nil, the implementation has already written an appropriate
+// response (e.g., 401 with WWW-Authenticate: Negotiate) and the caller should
+// return without rendering the password form. If handled is false, proceed
+// with the legacy password form flow.
+type SPNEGOAware interface {
+	TrySPNEGO(ctx context.Context, s Scopes, w http.ResponseWriter, r *http.Request) (*Identity, Handled, error)
+}
diff --git a/devenv.lock b/devenv.lock
new file mode 100644
index 0000000000..a76549c58e
--- /dev/null
+++ b/devenv.lock
@@ -0,0 +1,65 @@
+{
+  "nodes": {
+    "devenv": {
+      "locked": {
+        "dir": "src/modules",
+        "lastModified": 1782938471,
+        "narHash": "sha256-m//AHi+NJN+1eTTdEaL3oXcuTHy1XtV6XiyGtsP9PJE=",
+        "owner": "cachix",
+        "repo": "devenv",
+        "rev": "46197d1e4c2ca0cc1f0635927b3bee3d62b51779",
+        "type": "github"
+      },
+      "original": {
+        "dir": "src/modules",
+        "owner": "cachix",
+        "repo": "devenv",
+        "type": "github"
+      }
+    },
+    "nixpkgs": {
+      "inputs": {
+        "nixpkgs-src": "nixpkgs-src"
+      },
+      "locked": {
+        "lastModified": 1782924808,
+        "narHash": "sha256-tn2ahNv3ZNXyVHdPx/uw+N0xa7YSMtXUr6OEvu+s8ng=",
+        "owner": "cachix",
+        "repo": "devenv-nixpkgs",
+        "rev": "e2c881cb8d5f1cac6cef9d71f0d450a55691b999",
+        "type": "github"
+      },
+      "original": {
+        "owner": "cachix",
+        "ref": "rolling",
+        "repo": "devenv-nixpkgs",
+        "type": "github"
+      }
+    },
+    "nixpkgs-src": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1782636521,
+        "narHash": "sha256-OG8laCOGtkxlB1JH3XqOnXxnkGJme4mQdXo5hkhCQIY=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "e1c1b84752fb0897897380a3cae9dc7fcab91ca3",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixpkgs-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "root": {
+      "inputs": {
+        "devenv": "devenv",
+        "nixpkgs": "nixpkgs"
+      }
+    }
+  },
+  "root": "root",
+  "version": 7
+}
\ No newline at end of file
diff --git a/devenv.nix b/devenv.nix
new file mode 100644
index 0000000000..741733ba1f
--- /dev/null
+++ b/devenv.nix
@@ -0,0 +1,24 @@
+{
+  pkgs,
+  ...
+}:
+
+{
+  dotenv.enable = true;
+
+  packages = with pkgs; [
+    gnumake
+
+    gotestsum
+    protobuf
+    protoc-gen-go
+    protoc-gen-go-grpc
+    kind
+  ];
+
+  languages = {
+    go = {
+      enable = true;
+    };
+  };
+}
diff --git a/devenv.yaml b/devenv.yaml
new file mode 100644
index 0000000000..68616a49cd
--- /dev/null
+++ b/devenv.yaml
@@ -0,0 +1,4 @@
+# yaml-language-server: $schema=https://devenv.sh/devenv.schema.json
+inputs:
+  nixpkgs:
+    url: github:cachix/devenv-nixpkgs/rolling
diff --git a/docker-compose.override.yaml.dist b/docker-compose.override.yaml.dist
index b9eefac533..30591add0f 100644
--- a/docker-compose.override.yaml.dist
+++ b/docker-compose.override.yaml.dist
@@ -5,6 +5,10 @@ services:
         ports:
             - "127.0.0.1:3306:3306"
 
+    mysql8:
+        ports:
+            - "127.0.0.1:3307:3306"
+
     postgres:
         ports:
             - "127.0.0.1:5432:5432"
diff --git a/docker-compose.test.yaml b/docker-compose.test.yaml
index 46dfd84c4d..933ff80164 100644
--- a/docker-compose.test.yaml
+++ b/docker-compose.test.yaml
@@ -11,8 +11,8 @@ services:
             LDAP_TLS: "true"
             LDAP_TLS_VERIFY_CLIENT: try
         ports:
-            - 389:389
-            - 636:636
+            - 3890:389
+            - 6360:636
         volumes:
             - ./connector/ldap/testdata/certs:/container/service/slapd/assets/certs
             - ./connector/ldap/testdata/schema.ldif:/container/service/slapd/assets/config/bootstrap/ldif/99-schema.ldif
diff --git a/docker-compose.yaml b/docker-compose.yaml
index eee32f93e9..6c5a052a70 100644
--- a/docker-compose.yaml
+++ b/docker-compose.yaml
@@ -17,6 +17,15 @@ services:
             MYSQL_PASSWORD: mysql
             MYSQL_ROOT_PASSWORD: root
 
+    mysql8:
+        image: mysql:8.0
+        command: --default-authentication-plugin=mysql_native_password
+        environment:
+            MYSQL_DATABASE: dex
+            MYSQL_USER: mysql
+            MYSQL_PASSWORD: mysql
+            MYSQL_ROOT_PASSWORD: root
+
     postgres:
         image: postgres:10.15
         environment:
@@ -45,3 +54,23 @@ services:
         volumes:
             - ./connector/ldap/testdata/certs:/container/service/slapd/assets/certs
             - ./connector/ldap/testdata/schema.ldif:/container/service/slapd/assets/config/bootstrap/ldif/99-schema.ldif
+
+    vault:
+        image: hashicorp/vault:1.21
+        environment:
+            VAULT_DEV_ROOT_TOKEN_ID: root-token
+            VAULT_DEV_LISTEN_ADDRESS: "0.0.0.0:8200"
+        cap_add:
+            - IPC_LOCK
+        ports:
+            - 8200:8200
+
+    openbao:
+        image: quay.io/openbao/openbao:2.5
+        environment:
+            BAO_DEV_ROOT_TOKEN_ID: root-token
+            BAO_DEV_LISTEN_ADDRESS: "0.0.0.0:8200"
+        cap_add:
+            - IPC_LOCK
+        ports:
+            - 8210:8200
diff --git a/docs/enhancements/auth-sessions-2026-02-18.md b/docs/enhancements/auth-sessions-2026-02-18.md
new file mode 100644
index 0000000000..28f5208ccb
--- /dev/null
+++ b/docs/enhancements/auth-sessions-2026-02-18.md
@@ -0,0 +1,1505 @@
+# Dex Enhancement Proposal (DEP 4560) - 2026-02-18 - Auth Sessions
+
+## Table of Contents
+
+- [Summary](#summary)
+- [Motivation](#motivation)
+    - [Goals/Pain](#goalspain)
+    - [Non-Goals](#non-goals)
+- [Proposal](#proposal)
+    - [User Experience](#user-experience)
+    - [Implementation Details/Notes/Constraints](#implementation-detailsnotesconstraints)
+    - [Risks and Mitigations](#risks-and-mitigations)
+    - [Alternatives](#alternatives)
+- [Future Improvements](#future-improvements)
+
+## Summary
+
+This DEP introduces **auth sessions** - a persistent authentication state that enables Dex to track logged-in users across browser sessions. Currently, Dex relies entirely on refresh tokens for session management, which prevents proper implementation of OIDC conformance features like `prompt=none`, `prompt=login`, `id_token_hint`, SSO across clients, and proper logout. User Sessions will be stored server-side with a browser cookie reference, enabling these features while maintaining Dex's simplicity and compatibility with all storage backends (SQL, etcd, Kubernetes CRDs).
+
+## Context
+
+- [OIDC Core 1.0 - Authentication Request](https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest) - `prompt` parameter specification
+- [OIDC Core 1.0 - ID Token Hint](https://openid.net/specs/openid-connect-core-1_0.html#IDToken) - `id_token_hint` specification
+- [OIDC Session Management 1.0](https://openid.net/specs/openid-connect-session-1_0.html) - Session management specification
+- [OIDC RP-Initiated Logout 1.0](https://openid.net/specs/openid-connect-rpinitiated-1_0.html) - Logout specification
+- [OIDC Front-Channel Logout 1.0](https://openid.net/specs/openid-connect-frontchannel-1_0.html) - Front-channel logout
+- [Keycloak Sessions](https://www.keycloak.org/docs/latest/server_admin/#_sessions) - Reference implementation
+- [Ory Hydra Login & Consent Flow](https://www.ory.sh/docs/hydra/concepts/login) - Reference implementation
+
+Current limitations:
+- No support for `prompt=none` (silent authentication)
+- No support for `prompt=login` (force re-authentication)
+- No support for `max_age` parameter
+- No support for `id_token_hint` validation
+- No SSO between clients (each client requires separate login)
+- No proper logout (only refresh token revocation)
+- No consent persistence (user must approve every time if not skipped globally)
+- No 2FA enrollment storage
+- No "Remember Me" functionality
+
+## Motivation
+
+### Goals/Pain
+
+1. **OIDC Conformance** - Enable proper `prompt=none`, `prompt=login`, `max_age`, and `id_token_hint` support
+2. **SSO (Single Sign-On)** - Allow users to authenticate once and access multiple clients without re-login
+3. **Remember Me** - Allow users to choose persistent vs session-based authentication
+4. **Consent Persistence** - Store user consent decisions per client/scope combination within session
+5. **Proper Logout** - Enable session termination with optional front-channel logout
+6. **Foundation for 2FA** - Enable future TOTP/WebAuthn enrollment storage
+
+### Non-Goals
+
+- **2FA Implementation** - This DEP only provides storage foundation; 2FA flow is a separate DEP
+- **Back-Channel Logout** - Server-to-server logout notifications are out of scope
+- **Session Clustering/Replication** - Storage backends handle this
+- **Admin Session Management UI** - API only, no admin UI
+- **Per-connector Session Policies** - Single global session policy initially
+- **Identity Refresh During Session** - Deferred to future DEP; initially identity is refreshed only at session termination (like Keycloak)
+- **Upstream Connector Logout** - Terminating sessions at upstream IDPs is deferred
+
+## Proposal
+
+### User Experience
+
+#### Configuration
+
+Sessions are controlled by a feature flag and configuration:
+
+```yaml
+# Feature flag (environment variable)
+# DEX_SESSIONS_ENABLED=true
+
+# config.yaml
+sessions:
+  # Session cookie name (default: "dex_session")
+  # Other cookie settings (Secure, HttpOnly, SameSite=Lax) are not configurable
+  # and are set to secure defaults automatically
+  cookieName: "dex_session"
+
+  # Session lifetime settings (matches refresh token expiry naming)
+  absoluteLifetime: "24h"         # Maximum session lifetime, default: 24h
+  validIfNotUsedFor: "1h"         # Session expires if not used, default: 1h
+
+  # Default SSO sharing policy for clients without explicit ssoSharedWith config
+  # Options:
+  #   "all" - clients without ssoSharedWith share sessions with all other clients (Keycloak-like)
+  #   "none" - clients without ssoSharedWith don't share sessions (default)
+  ssoSharedWithDefault: "none"
+
+  # Whether "Remember Me" checkbox is checked by default in login/approval forms
+  # When true: checkbox is pre-checked, user can uncheck
+  # When false: checkbox is unchecked, user must check to persist session (default)
+  rememberMeCheckedByDefault: false
+```
+
+**ssoSharedWithDefault** controls the default SSO behavior:
+- `"none"` (default): Clients without explicit `ssoSharedWith` config don't participate in SSO
+- `"all"`: Clients without explicit `ssoSharedWith` config share sessions with all other clients (realm-wide SSO like Keycloak)
+
+Clients with explicit `ssoSharedWith` configuration always use their configured value.
+
+**Note**: The `ssoSharedWith` option is separate from the existing `trustedPeers` option. `trustedPeers` controls which clients can issue tokens on behalf of this client (existing behavior), while `ssoSharedWith` controls which clients can reuse this client's authentication session (new behavior). These can be configured independently based on different security requirements.
+
+**rememberMeCheckedByDefault** controls the initial checkbox state in templates.
+This value is passed to templates as `.RememberMeChecked` boolean.
+
+**SSO via ssoSharedWith**: SSO between clients is controlled by the new `ssoSharedWith` configuration on clients. The `ssoSharedWith` setting defines **which clients can USE this client's session**, not which clients this client can use.
+
+If client B is listed in client A's `ssoSharedWith`:
+1. If user logged in via client A, client B can reuse that session
+
+This is intentionally separate from `trustedPeers` (which controls token issuance on behalf of another client). Organizations may want different policies for session sharing vs token delegation:
+- **ssoSharedWith**: "Can this client's login be reused by another client?"
+- **trustedPeers**: "Can another client issue tokens claiming to be this client?"
+
+**Wildcard Support**: `ssoSharedWith: ["*"]` enables SSO with all clients. This is similar to Keycloak's default behavior where all clients in a realm share sessions.
+
+**SSO Direction**: SSO sharing is **unidirectional**. Client A sharing with client B does NOT mean client B shares with client A.
+
+```yaml
+staticClients:
+  # Public app - allows any client to reuse its sessions
+  - id: public-app
+    name: Public App
+    ssoSharedWith: ["*"]
+    # trustedPeers can be configured separately for token delegation
+    # ...
+
+  # Admin app - only specific apps can reuse its sessions
+  - id: admin-app
+    name: Admin App
+    ssoSharedWith: ["monitoring-app"]  # Only monitoring can SSO from admin sessions
+    # ...
+
+  # Secret internal service - NO other clients can reuse its sessions
+  - id: secret-service
+    name: Secret Service
+    ssoSharedWith: []  # Empty = no SSO allowed from this client's sessions
+    # But this client CAN use sessions from other clients that share with it!
+    # ...
+
+  # Monitoring app - can SSO from admin-app (because admin-app shares with it)
+  - id: monitoring-app
+    name: Monitoring App
+    ssoSharedWith: ["admin-app"]  # Bidirectional sharing with admin-app
+    # ...
+```
+
+**Example Scenarios:**
+
+| User logged in via | Accessing | SSO works? | Why |
+|-------------------|-----------|------------|-----|
+| public-app | admin-app | ✅ Yes | public-app has `ssoSharedWith: ["*"]` |
+| admin-app | public-app | ❌ No | admin-app only shares with monitoring-app |
+| admin-app | monitoring-app | ✅ Yes | admin-app shares with monitoring-app |
+| secret-service | any client | ❌ No | secret-service has `ssoSharedWith: []` |
+| public-app | secret-service | ✅ Yes | public-app has `ssoSharedWith: ["*"]` |
+
+**Key Insight**: A "secret" client that doesn't want others to SSO into it simply doesn't list them in `ssoSharedWith`. But it can still BENEFIT from SSO by being listed in OTHER clients' `ssoSharedWith`.
+
+**Comparison with Keycloak**: In Keycloak, SSO is realm-wide by default - all clients in a realm share sessions. Dex's approach is more granular: SSO is opt-in per client via `ssoSharedWith`. Use `["*"]` to achieve Keycloak-like behavior.
+
+**Comparison with trustedPeers**: The `trustedPeers` option continues to control cross-client token issuance (e.g., client B issuing tokens for client A). This is a separate security concern from session sharing. Organizations can configure these independently:
+- High SSO sharing, restricted token delegation
+- Restricted SSO sharing, high token delegation
+- Or any combination based on their security model
+
+**Cookie Security**: The session cookie is always set with secure defaults:
+- `HttpOnly: true` - Not accessible via JavaScript
+- `Secure: (issuerURL.Scheme == "https")` - Only sent over HTTPS; for `http` (commonly used on localhost in dev) this is disabled
+- `SameSite: Lax` - CSRF protection
+- `Path: <issuerURL.Path>` - Derived from issuer URL (e.g., `/dex` for `https://example.com/dex`)
+
+These settings are not configurable to prevent security misconfigurations.
+
+#### Authentication Flow with Sessions
+
+```
+┌─────────┐       ┌─────────┐       ┌───────────┐       ┌───────────┐
+│ Browser │       │  Dex    │       │  Storage  │       │ Connector │
+└────┬────┘       └────┬────┘       └─────┬─────┘       └─────┬─────┘
+     │                 │                  │                   │
+     │  GET /auth      │                  │                   │
+     │ (no session)    │                  │                   │
+     ├────────────────>│                  │                   │
+     │                 │                  │                   │
+     │                 │  Check session   │                   │
+     │                 │  cookie          │                   │
+     │                 ├─────────────────>│                   │
+     │                 │  (not found)     │                   │
+     │                 │<─────────────────│                   │
+     │                 │                  │                   │
+     │  Redirect to    │                  │                   │
+     │  connector      │                  │                   │
+     │<────────────────│                  │                   │
+     │                 │                  │                   │
+     │        ... connector auth flow ... │                   │
+     │                 │                  │                   │
+     │  Callback with  │                  │                   │
+     │  identity       │                  │                   │
+     ├────────────────>│                  │                   │
+     │                 │                  │                   │
+     │                 │  Create/update   │                   │
+     │                 │  AuthSession     │                   │
+     │                 │  (ALWAYS)        │                   │
+     │                 ├─────────────────>│                   │
+     │                 │                  │                   │
+     │  Set-Cookie:    │                  │                   │
+     │  - Session cookie (no MaxAge)      │                   │
+     │    if Remember Me unchecked        │                   │
+     │  - Persistent cookie (with MaxAge) │                   │
+     │    if Remember Me checked          │                   │
+     │  + redirect to /approval           │                   │
+     │<────────────────│                  │                   │
+     │                 │                  │                   │
+```
+
+**Key Point**: AuthSession is always created on successful authentication. The "Remember Me" checkbox only controls whether the cookie is a session cookie (deleted on browser close) or a persistent cookie (survives browser restart). This is consistent with Keycloak's behavior.
+
+#### SSO Flow (Returning User)
+
+```
+┌─────────┐       ┌─────────┐       ┌───────────┐
+│ Browser │       │  Dex    │       │  Storage  │
+└────┬────┘       └────┬────┘       └─────┬─────┘
+     │                 │                  │
+     │  GET /auth      │                  │
+     │ (with cookie)   │                  │
+     │  client_id=B    │                  │
+     ├────────────────>│                  │
+     │                 │                  │
+     │                 │  Get session     │
+     │                 ├─────────────────>│
+     │                 │  (valid session) │
+     │                 │<─────────────────│
+     │                 │                  │
+     │                 │  Check SSO       │
+     │                 │  policy for      │
+     │                 │  client B        │
+     │                 │                  │
+     │                 │  Check consent   │
+     │                 │  for client B    │
+     │                 ├─────────────────>│
+     │                 │                  │
+     │  If consented:  │                  │
+     │  redirect with  │                  │
+     │  code           │                  │
+     │<────────────────│                  │
+     │                 │                  │
+     │  If not:        │                  │
+     │  show approval  │                  │
+     │<────────────────│                  │
+     │                 │                  │
+```
+
+#### prompt=none Flow
+
+```
+┌─────────┐       ┌─────────┐       ┌───────────┐
+│ Browser │       │  Dex    │       │  Storage  │
+└────┬────┘       └────┬────┘       └─────┬─────┘
+     │                 │                  │
+     │  GET /auth      │                  │
+     │  prompt=none    │                  │
+     ├────────────────>│                  │
+     │                 │                  │
+     │                 │  Get session     │
+     │                 ├─────────────────>│
+     │                 │                  │
+     │  If valid session + consent:       │
+     │  redirect with code                │
+     │<────────────────│                  │
+     │                 │                  │
+     │  If no session or no consent:      │
+     │  redirect with error=login_required│
+     │  or error=consent_required         │
+     │<────────────────│                  │
+     │                 │                  │
+```
+
+#### Logout Flow
+
+```
+┌─────────┐       ┌─────────┐       ┌───────────┐
+│ Browser │       │  Dex    │       │  Storage  │
+└────┬────┘       └────┬────┘       └─────┬─────┘
+     │                 │                  │
+     │  GET /logout    │                  │
+     │  id_token_hint= │                  │
+     ├────────────────>│                  │
+     │                 │                  │
+     │                 │  Validate        │
+     │                 │  id_token_hint   │
+     │                 │                  │
+     │                 │  Get identity    │
+     │                 │  by session ID   │
+     │                 ├─────────────────>│
+     │                 │                  │
+     │                 │  Deactivate      │
+     │                 │  (Active=false)  │
+     │                 ├─────────────────>│
+     │                 │                  │
+     │                 │  Revoke refresh  │
+     │                 │  tokens          │
+     │                 ├─────────────────>│
+     │                 │                  │
+     │  Clear cookie + │                  │
+     │  redirect or    │                  │
+     │  show logout    │                  │
+     │  confirmation   │                  │
+     │<────────────────│                  │
+     │                 │                  │
+```
+
+### Implementation Details/Notes/Constraints
+
+#### Feature Flag
+
+```go
+// pkg/featureflags/set.go
+var (
+    // ...existing flags...
+
+    // SessionsEnabled enables user sessions feature
+    SessionsEnabled = newFlag("sessions_enabled", false)
+)
+```
+
+#### New Storage Entities
+
+
+Two entities are required to properly handle the case where a user might be logged into different clients as different identities in the same browser:
+
+###### AuthSession
+
+```go
+// storage/storage.go
+
+// AuthSession represents a browser's authentication state.
+// One per browser, referenced by session cookie.
+// Key: SessionID (random 32-byte string, stored in cookie)
+type AuthSession struct {
+    // ID is the session identifier stored in cookie
+    ID string
+
+    // ClientStates maps clientID → authentication state for that client
+    // Allows different users/identities per client in same browser
+    //
+    // Design note: This map-based approach is consistent with how OfflineSessions
+    // stores refresh tokens per client (OfflineSessions.Refresh map). Given that
+    // the number of OAuth clients in a typical deployment is bounded and relatively
+    // small (tens to hundreds, not thousands), the serialized size of this map
+    // will not exceed practical storage limits for any supported backend.
+    ClientStates map[string]*ClientAuthState
+
+    // CreatedAt is when this browser session started
+    CreatedAt time.Time
+
+    // LastActivity is when any client was last accessed
+    LastActivity time.Time
+
+    // IPAddress at session creation (for audit)
+    IPAddress string
+
+    // UserAgent at session creation (for audit)
+    UserAgent string
+}
+
+// ClientAuthState represents authentication state for a specific client within an auth session.
+// Expiration follows OIDC conventions with both absolute and idle timeout:
+// - ExpiresAt enforces absolute lifetime (sessions.absoluteLifetime)
+// - LastActivity + sessions.validIfNotUsedFor enforces idle timeout
+// A client state is considered expired if EITHER condition is met.
+type ClientAuthState struct {
+    // UserID + ConnectorID identify which UserIdentity is authenticated for this client
+    UserID      string
+    ConnectorID string
+
+    // Active indicates if authentication is active for this client
+    Active bool
+
+    // ExpiresAt is the absolute expiration time for this client session.
+    // Set to time.Now() + absoluteLifetime at session creation.
+    // Cannot be extended - hard upper bound on session duration.
+    ExpiresAt time.Time
+
+    // LastActivity is when this client session was last used (token issued, SSO check, etc.)
+    // Used with validIfNotUsedFor to enforce idle timeout.
+    // Updated on each request that touches this client state.
+    LastActivity time.Time
+
+    // LastTokenIssuedAt is when a token was last issued for this client.
+    // Used for logout notifications and audit.
+    LastTokenIssuedAt time.Time
+}
+```
+
+###### UserIdentity
+
+```go
+// storage/storage.go
+
+// UserIdentity represents a user's persistent identity data.
+// Stores data that persists across sessions:
+// - Consent decisions
+// - Future: 2FA enrollment
+//
+// Key: composite of UserID + ConnectorID (one per user per connector)
+type UserIdentity struct {
+    // UserID is the subject identifier from the connector
+    UserID string
+
+    // ConnectorID is the connector that authenticated the user
+    ConnectorID string
+
+    // Claims holds the user's identity claims
+    // Updated on:
+    // 1. Each login (from connector callback)
+    // 2. Each refresh token usage (from RefreshConnector.Refresh)
+    // This ensures claims stay in sync with OfflineSessions and upstream IDP
+    Claims Claims
+
+    // Consents stores user consent per client: map[clientID][]scopes
+    // Persists across sessions so user doesn't need to re-consent
+    Consents map[string][]string
+
+    // CreatedAt is when this identity was first created
+    CreatedAt time.Time
+
+    // LastLogin is when the user last authenticated (used for auth_time claim)
+    LastLogin time.Time
+
+    // BlockedUntil is set when user is blocked from logging in
+    BlockedUntil time.Time
+
+    // Future: 2FA fields
+    // TOTPSecret string
+    // WebAuthnCredentials []WebAuthnCredential
+}
+```
+
+**Two-Entity Design Rationale**
+
+| Entity | Purpose | Lifecycle | Key |
+|--------|---------|-----------|-----|
+| AuthSession | Browser binding, per-client auth state | Short-lived (session timeout) | SessionID (cookie) |
+| UserIdentity | User data, consents, 2FA | Long-lived (persists) | UserID + ConnectorID |
+
+**How It Works: Different Users in Different Clients**
+
+```
+Auth Session (cookie: dex_session=abc123)
+├── ClientStates["client-A"]:
+│   └── UserID: "alice", ConnectorID: "google", Active: true
+├── ClientStates["client-B"]:
+│   └── UserID: "bob", ConnectorID: "ldap", Active: true
+└── ClientStates["client-C"]:
+    └── (empty - never authenticated)
+
+UserIdentity (alice + google):
+├── Claims: {email: alice@example.com, ...}
+├── Consents: {"client-A": ["openid", "email"]}
+└── LastLogin: 2024-01-01
+
+UserIdentity (bob + ldap):
+├── Claims: {email: bob@corp.com, ...}
+├── Consents: {"client-B": ["openid", "groups"]}
+└── LastLogin: 2024-01-02
+```
+
+**How SSO Works**
+
+When user accesses client-B with existing session:
+
+1. Get `AuthSession` by cookie
+2. Check `ClientStates["client-B"]`:
+   - If exists and active → user already authenticated for this client
+3. If not, check SSO:
+   - Find any `ClientStates[X]` where client-X has `ssoSharedWith` containing "client-B"
+   - If found → SSO! Copy auth state to `ClientStates["client-B"]`
+   - If not found → require authentication
+
+**SSO Session Lookup Algorithm**
+
+```go
+// findSSOSession searches for a valid SSO source session for the target client
+func (s *Server) findSSOSession(authSession *AuthSession, targetClientID string) (*ClientAuthState, *UserIdentity) {
+    targetClient, err := s.storage.GetClient(ctx, targetClientID)
+    if err != nil {
+        return nil, nil
+    }
+
+    // Iterate through all active client states in this browser session
+    for sourceClientID, state := range authSession.ClientStates {
+        // Skip inactive or expired states
+        if !state.Active || time.Now().After(state.ExpiresAt) {
+            continue
+        }
+
+        // Get the source client configuration
+        sourceClient, err := s.storage.GetClient(ctx, sourceClientID)
+        if err != nil {
+            continue
+        }
+
+        // Check if source client shares its session with the target client
+        // SSO is allowed if:
+        // 1. Source client has ssoSharedWith: ["*"] (shares with everyone)
+        // 2. Source client has targetClientID in its ssoSharedWith list
+        if !s.clientSharesSessionWith(sourceClient, targetClientID) {
+            continue
+        }
+
+        // Found a valid SSO source! Get the user identity
+        identity, err := s.storage.GetUserIdentity(ctx, state.UserID, state.ConnectorID)
+        if err != nil {
+            continue
+        }
+
+        // Check if user is not blocked
+        if identity.BlockedUntil.After(time.Now()) {
+            continue
+        }
+
+        return state, identity
+    }
+
+    return nil, nil
+}
+
+// clientSharesSessionWith checks if sourceClient shares its session with targetClientID
+func (s *Server) clientSharesSessionWith(sourceClient Client, targetClientID string) bool {
+    for _, peer := range sourceClient.SSOSharedWith {
+        if peer == "*" || peer == targetClientID {
+            return true
+        }
+    }
+    return false
+}
+```
+
+**SSO Lookup Flow Diagram**
+
+```
+User accesses client-B with existing session
+                │
+                ▼
+┌─────────────────────────────────┐
+│ Get AuthSession from cookie     │
+└─────────────────────────────────┘
+                │
+                ▼
+┌─────────────────────────────────┐
+│ Check ClientStates["client-B"]  │
+│ exists and active?              │
+└─────────────────────────────────┘
+        │               │
+       Yes              No
+        │               │
+        ▼               ▼
+┌──────────────┐  ┌─────────────────────────────────┐
+│ Use existing │  │ For each ClientStates[X]:       │
+│ session      │  │   - Is state active?            │
+└──────────────┘  │   - Get client-X config         │
+                  │   - Does client-X share with B? │
+                  │     (X.ssoSharedWith has B or *)│
+                  └─────────────────────────────────┘
+                          │               │
+                    Found match       No match
+                          │               │
+                          ▼               ▼
+                  ┌──────────────┐  ┌──────────────┐
+                  │ SSO! Copy    │  │ Require      │
+                  │ state to B   │  │ authentication│
+                  └──────────────┘  └──────────────┘
+```
+
+**Example: SSO Flow**
+
+```
+1. User logs into client-A as alice
+   AuthSession.ClientStates["client-A"] = {UserID: "alice", Active: true}
+
+2. User accesses client-B
+   - client-A.ssoSharedWith includes "client-B" ✓
+   - SSO! Copy: ClientStates["client-B"] = {UserID: "alice", Active: true}
+   - Issue tokens for alice to client-B
+```
+
+**Example: No SSO, Different User**
+
+```
+1. User logged into client-A as alice
+   AuthSession.ClientStates["client-A"] = {UserID: "alice", Active: true}
+
+2. User accesses client-B (client-A does NOT share with client-B)
+   - No SSO available
+   - Redirect to connector for authentication
+
+3. User logs in as bob (different account)
+   AuthSession.ClientStates["client-B"] = {UserID: "bob", Active: true}
+
+Same browser, two different users, no conflict!
+```
+
+**Claims Synchronization with Refresh Tokens**
+
+When a refresh token is used:
+1. `RefreshConnector.Refresh()` returns updated claims
+2. Update `OfflineSessions.ConnectorData` (existing behavior)
+3. **NEW**: Also update `UserIdentity.Claims`:
+
+```go
+// In refresh token handler
+func (s *Server) handleRefreshToken(...) {
+    // ...existing refresh logic...
+
+    newIdentity, err := refreshConn.Refresh(ctx, scopes, oldIdentity)
+    if err != nil {
+        // Handle refresh failure
+    }
+
+    // Update OfflineSessions (existing)
+    s.storage.UpdateOfflineSessions(...)
+
+    // Update UserIdentity claims (NEW)
+    if s.sessionsEnabled {
+        s.storage.UpdateUserIdentity(ctx, newIdentity.UserID, connectorID,
+            func(u UserIdentity) (UserIdentity, error) {
+                u.Claims = storage.Claims{
+                    UserID:    newIdentity.UserID,
+                    Username:  newIdentity.Username,
+                    Email:     newIdentity.Email,
+                    Groups:    newIdentity.Groups,
+                    // ...
+                }
+                return u, nil
+            })
+    }
+}
+```
+
+This ensures `UserIdentity.Claims` stays synchronized with:
+- Connector's current user data
+- `OfflineSessions.ConnectorData`
+- Actual refresh token claims
+
+**Why UserIdentity instead of AuthSession?**
+
+The name `UserIdentity` is chosen because this entity stores more than just session state:
+1. **Persistent data**: Consent decisions survive session expiration
+2. **Future 2FA**: TOTP secrets and WebAuthn credentials will be stored here
+3. **One per user/connector**: Unlike sessions which could be per-browser, this is per-identity
+
+**Session ID Regeneration**
+
+The `AuthSession.ID` is regenerated when:
+- User logs in from a new browser (new session created)
+- Security concern requires new session (e.g., after password change)
+
+Individual `ClientStates` can be invalidated without changing the auth session ID.
+
+**Multiple Users in Same Browser**
+
+With the two-entity design:
+- `AuthSession` tracks which user is authenticated for which client
+- Different clients can have different users (if no SSO trust)
+- Same user can be authenticated for multiple clients (SSO or separate logins)
+
+**SSO and Different Users**
+
+With SSO enabled between clients, the same user is used for all sharing clients:
+- User logs in to client-A as "alice@example.com"
+- User accesses client-B (client-A shares with client-B) → automatically authenticated as "alice@example.com"
+- SSO reuses the identity from the sharing client
+
+If user needs to login as different identity to a sharing client:
+- Use `prompt=login` to force re-authentication
+- This creates new ClientState for that client with potentially different user
+
+Without SSO, user can be different identities in different clients (see examples above).
+
+#### Storage Interface Extensions
+
+Two new entities require CRUD operations:
+
+```go
+// storage/storage.go
+
+type Storage interface {
+    // ...existing methods...
+
+    // AuthSession management
+    CreateAuthSession(ctx context.Context, s AuthSession) error
+    GetAuthSession(ctx context.Context, sessionID string) (AuthSession, error)
+    UpdateAuthSession(ctx context.Context, sessionID string, updater func(s AuthSession) (AuthSession, error)) error
+    DeleteAuthSession(ctx context.Context, sessionID string) error
+
+    // UserIdentity management
+    CreateUserIdentity(ctx context.Context, u UserIdentity) error
+    GetUserIdentity(ctx context.Context, userID, connectorID string) (UserIdentity, error)
+    UpdateUserIdentity(ctx context.Context, userID, connectorID string, updater func(u UserIdentity) (UserIdentity, error)) error
+    DeleteUserIdentity(ctx context.Context, userID, connectorID string) error
+
+    // List for admin API
+    ListUserIdentities(ctx context.Context) ([]UserIdentity, error)
+}
+```
+
+**Garbage Collection**
+
+```go
+type GCResult struct {
+    // ...existing fields...
+    AuthSessions int64  // NEW: expired auth sessions cleaned up
+}
+```
+
+`AuthSession` objects are garbage collected when:
+- `LastActivity + validIfNotUsedFor` exceeded (inactivity)
+- All `ClientStates` have expired
+
+`UserIdentity` objects are NOT garbage collected (preserve consents, future 2FA).
+
+#### Session Expiration
+
+**AuthSession expiration:**
+- Entire session expires when `LastActivity + validIfNotUsedFor` is reached (idle timeout)
+- On expiration, `AuthSession` is deleted by GC
+- User must re-authenticate for all clients
+
+**ClientAuthState expiration (per-client within AuthSession):**
+
+Each client state enforces **both** absolute lifetime and idle timeout, consistent with standard OIDC session semantics:
+
+```go
+func (s *Server) isClientStateValid(state *ClientAuthState) bool {
+    now := time.Now()
+
+    // 1. Check absolute lifetime - hard upper bound, cannot be extended
+    if now.After(state.ExpiresAt) {
+        return false
+    }
+
+    // 2. Check idle timeout - session unused for too long
+    if now.After(state.LastActivity.Add(s.sessionsConfig.validIfNotUsedFor)) {
+        return false
+    }
+
+    // 3. Check explicit deactivation (admin revoked)
+    if !state.Active {
+        return false
+    }
+
+    return true
+}
+```
+
+When a client state expires:
+- Other clients in same auth session remain active
+- User must re-authenticate only for the expired client
+- On successful re-authentication, a new `ClientAuthState` is created with fresh `ExpiresAt`
+
+**Admin can force re-authentication:**
+- Delete `AuthSession` → user must re-auth for all clients
+- Set `ClientStates[clientID].Active = false` → user must re-auth for that client only
+
+#### Deletion Risks
+
+**Deleting AuthSession:**
+- User must re-authenticate for all clients
+- No data loss (consents preserved in UserIdentity)
+- Safe operation for logout
+
+**Deleting UserIdentity:**
+
+| What's Lost | Impact |
+|-------------|--------|
+| Consent decisions | User must re-approve scopes for all clients |
+| Future: 2FA enrollment | User must re-enroll TOTP/WebAuthn |
+
+**When to delete UserIdentity:**
+- User explicitly requests account deletion (GDPR)
+- Admin cleanup of stale identities
+- User removed from upstream identity provider
+
+**When NOT to delete (delete AuthSession instead):**
+- Regular logout - delete AuthSession or set ClientState.Active = false
+- Session expiration - GC handles AuthSession cleanup
+- Security concern - delete AuthSession to force re-auth
+
+#### Session Cookie Format
+
+The session cookie contains only the session ID (not the session data):
+
+```
+Cookie: dex_session=<session_id>; Path=<issuer_path>; Secure; HttpOnly; SameSite=Lax
+```
+
+**Cookie Path**: Derived from the issuer URL path (`issuerURL.Path`). For example:
+- Issuer: `https://dex.example.com/` → `Path=/`
+- Issuer: `https://example.com/dex` → `Path=/dex`
+
+This is consistent with how Dex already handles routing - all endpoints are prefixed with the issuer path.
+
+**Session Creation vs Cookie Persistence (Keycloak-like behavior)**
+
+Unlike some implementations where "Remember Me" controls session creation, we follow Keycloak's approach:
+
+- **AuthSession is ALWAYS created** on successful authentication
+- **"Remember Me" controls cookie persistence**:
+  - Unchecked: Session cookie (expires when browser closes)
+  - Checked: Persistent cookie (expires at `absoluteLifetime`)
+
+This approach is better because:
+1. SSO works within a browser session even without "Remember Me"
+2. Consent decisions are preserved during the browser session
+3. `prompt=none` works correctly within browser session
+4. More intuitive: "Remember Me" = "remember me after I close the browser"
+
+```go
+func (s *Server) setSessionCookie(w http.ResponseWriter, sessionID string, rememberMe bool) {
+    cookie := &http.Cookie{
+        Name:     s.sessionsConfig.CookieName,
+        Value:    sessionID,
+        Path:     s.issuerURL.Path,
+        HttpOnly: true,
+        Secure:   s.issuerURL.Scheme == "https",
+        SameSite: http.SameSiteLaxMode,
+    }
+
+    if rememberMe {
+        // Persistent cookie - survives browser restart
+        cookie.MaxAge = int(s.sessionsConfig.absoluteLifetime.Seconds())
+    }
+    // else: Session cookie - no MaxAge, browser deletes on close
+
+    http.SetCookie(w, cookie)
+}
+```
+
+Session ID generation:
+```go
+func NewSessionID() string {
+    return newSecureID(32) // 256-bit random value
+}
+```
+
+#### Client Configuration Extension
+
+A new client configuration field is introduced for SSO control:
+
+```go
+// storage/storage.go
+
+type Client struct {
+    // ...existing fields...
+
+    // TrustedPeers are a list of peers which can issue tokens on this client's behalf.
+    // This is used for cross-client token issuance (existing behavior).
+    TrustedPeers []string `json:"trustedPeers" yaml:"trustedPeers"`
+
+    // SSOSharedWith defines which other clients can reuse this client's authentication session.
+    // When a user is authenticated for this client, clients listed here can skip authentication.
+    // This is separate from TrustedPeers - organizations may want different policies for
+    // session sharing vs token delegation.
+    // Special value "*" means share with all clients (Keycloak-like realm-wide SSO).
+    // nil means use ssoSharedWithDefault from sessions config.
+    // Empty slice [] means explicitly share with no one.
+    SSOSharedWith []string `json:"ssoSharedWith,omitempty" yaml:"ssoSharedWith,omitempty"`
+}
+```
+
+#### Connector Logout (Future)
+
+Logout URLs should be configured on connectors, not clients. A new connector interface will be added:
+
+```go
+// connector/connector.go
+
+// LogoutConnector is an optional interface for connectors that support
+// terminating upstream sessions on logout.
+type LogoutConnector interface {
+    // Logout terminates the user's session at the upstream identity provider.
+    // Returns a URL to redirect the user to for upstream logout, or empty string
+    // if no redirect is needed.
+    Logout(ctx context.Context, connectorData []byte) (logoutURL string, err error)
+}
+```
+
+Connectors that implement this interface (e.g., OIDC with `end_session_endpoint`, SAML with SLO):
+- Are called during Dex logout flow
+- Can redirect user to upstream for complete logout
+- Implementation details are connector-specific
+
+This is tracked as a future improvement.
+
+#### Server Configuration Extension
+
+```go
+// cmd/dex/config.go
+
+type Sessions struct {
+    // CookieName is the session cookie name (default: "dex_session")
+    CookieName string `json:"cookieName"`
+
+    // AbsoluteLifetime is the maximum session lifetime (default: "24h")
+    AbsoluteLifetime string `json:"absoluteLifetime"`
+
+    // ValidIfNotUsedFor is the inactivity timeout (default: "1h")
+    ValidIfNotUsedFor string `json:"validIfNotUsedFor"`
+
+    // SSOSharedWithDefault is the default SSO sharing policy
+    // "all" = share with all clients, "none" = share with no one (default: "none")
+    SSOSharedWithDefault string `json:"ssoSharedWithDefault"`
+
+    // RememberMeCheckedByDefault controls the initial checkbox state in templates
+    // true = pre-checked, false = unchecked (default: false)
+    RememberMeCheckedByDefault bool `json:"rememberMeCheckedByDefault"`
+}
+```
+
+**Using ssoSharedWithDefault in SSO logic:**
+
+```go
+func (s *Server) clientSharesSessionWith(sourceClient Client, targetClientID string) bool {
+    ssoSharedWith := sourceClient.SSOSharedWith
+
+    // If client has no explicit ssoSharedWith, use default
+    if ssoSharedWith == nil {
+        switch s.sessionsConfig.SSOSharedWithDefault {
+        case "all":
+            return true // Share with everyone by default
+        default: // "none"
+            return false // Share with no one by default
+        }
+    }
+
+    // Explicit configuration: empty slice means explicitly share with no one
+    // This is different from nil (not configured)
+    if len(ssoSharedWith) == 0 {
+        return false
+    }
+
+    // Check explicit sharing list
+    for _, peer := range ssoSharedWith {
+        if peer == "*" || peer == targetClientID {
+            return true
+        }
+    }
+    return false
+}
+```
+
+**Three states for ssoSharedWith:**
+1. `nil` (not configured) → use `ssoSharedWithDefault`
+2. `[]` (empty slice) → explicitly share with no one
+3. `["client-a", ...]` or `["*"]` → explicit sharing list
+
+#### Prompt Parameter Handling
+
+Dex will support the following `prompt` values per OIDC Core specification:
+- `none` - Silent authentication, no UI displayed
+- `login` - Force re-authentication
+- `consent` - Force consent screen
+- Empty (default) - Normal flow with session reuse
+
+The `select_account` value is not supported initially (would require account linking feature).
+
+```go
+func (s *Server) handleAuthorization(w http.ResponseWriter, r *http.Request) {
+    // ...existing parsing...
+
+    prompt := r.Form.Get("prompt")
+    maxAge := r.Form.Get("max_age")
+    idTokenHint := r.Form.Get("id_token_hint")
+    clientID := r.Form.Get("client_id")
+
+    // Get auth session from cookie
+    authSession, err := s.getAuthSessionFromCookie(r)
+
+    // Get client auth state for this specific client
+    var clientState *ClientAuthState
+    var userIdentity *UserIdentity
+    if authSession != nil {
+        clientState = authSession.ClientStates[clientID]
+        if clientState != nil && clientState.Active {
+            userIdentity, _ = s.storage.GetUserIdentity(ctx, clientState.UserID, clientState.ConnectorID)
+        }
+    }
+
+    // Handle max_age parameter (OIDC Core 3.1.2.1)
+    if maxAge != "" && userIdentity != nil {
+        maxAgeSeconds, err := strconv.Atoi(maxAge)
+        if err == nil && maxAgeSeconds >= 0 {
+            authAge := time.Since(userIdentity.LastLogin)
+            if authAge > time.Duration(maxAgeSeconds)*time.Second {
+                // Session is too old, force re-authentication
+                clientState = nil
+                userIdentity = nil
+            }
+        }
+    }
+
+    switch prompt {
+    case "none":
+        // Silent authentication - must have valid session and consent
+        if clientState == nil || userIdentity == nil {
+            s.authErr(w, r, redirectURI, "login_required", state)
+            return
+        }
+        // Check consent in identity
+        consentedScopes, hasConsent := userIdentity.Consents[clientID]
+        if !hasConsent || !s.scopesCovered(consentedScopes, requestedScopes) {
+            s.authErr(w, r, redirectURI, "consent_required", state)
+            return
+        }
+        // Issue tokens without UI
+
+    case "login":
+        // Force re-authentication - ignore existing session for this client
+        clientState = nil
+        userIdentity = nil
+        // Continue to connector login
+
+    case "consent":
+        // Force consent screen even if previously consented
+        // Continue but don't check consent
+
+    default: // "" - normal flow
+        // Check for SSO from trusted clients if no direct session
+        if clientState == nil && authSession != nil {
+            clientState, userIdentity = s.findSSOSession(authSession, clientID)
+        }
+    }
+
+    // Validate id_token_hint if provided
+    if idTokenHint != "" {
+        claims, err := s.validateIDTokenHint(idTokenHint)
+        if err != nil {
+            s.authErr(w, r, redirectURI, "invalid_request", state)
+            return
+        }
+        if userIdentity != nil && userIdentity.UserID != claims.Subject {
+            // Identity user doesn't match hint
+            if prompt == "none" {
+                s.authErr(w, r, redirectURI, "login_required", state)
+                return
+            }
+            // Force re-login for different user
+            clientState = nil
+            userIdentity = nil
+        }
+    }
+
+    // ...continue with flow...
+}
+
+// findSSOSession looks for a valid SSO session from a sharing client
+func (s *Server) findSSOSession(authSession *AuthSession, targetClientID string) (*ClientAuthState, *UserIdentity) {
+    for sourceClientID, state := range authSession.ClientStates {
+        if !state.Active {
+            continue
+        }
+        sourceClient, _ := s.storage.GetClient(ctx, sourceClientID)
+        if sourceClient == nil {
+            continue
+        }
+        // Check if source client shares its session with target client
+        if s.clientSharesSessionWith(sourceClient, targetClientID) {
+            identity, _ := s.storage.GetUserIdentity(ctx, state.UserID, state.ConnectorID)
+            if identity != nil {
+                return state, identity
+            }
+        }
+    }
+    return nil, nil
+}
+```
+
+**max_age Parameter**
+
+The `max_age` parameter is supported per OIDC Core specification:
+- Specifies the maximum authentication age in seconds
+- If the identity's last authentication time (`LastLogin`) exceeds `max_age`, force re-authentication
+- When `max_age` is used, the `auth_time` claim MUST be included in the ID token
+
+#### New Endpoints
+
+```
+POST /logout
+GET  /logout
+```
+
+Logout endpoint following the OpenID RP-Initiated Logout specification ([OpenID spec](https://openid.net/specs/openid-connect-rpinitiated-1_0.html)):
+
+```go
+func (s *Server) handleLogout(w http.ResponseWriter, r *http.Request) {
+    idTokenHint := r.FormValue("id_token_hint")
+    postLogoutRedirectURI := r.FormValue("post_logout_redirect_uri")
+    state := r.FormValue("state")
+    clientID := r.FormValue("client_id") // Optional: logout from specific client
+
+    // Get auth session from cookie
+    authSession, _ := s.getAuthSessionFromCookie(r)
+
+    // Validate id_token_hint if provided
+    var hintUserID, hintConnectorID string
+    if idTokenHint != "" {
+        claims, err := s.validateIDTokenHint(idTokenHint)
+        if err == nil {
+            hintUserID = claims.Subject
+            // Extract connector from token if possible
+        }
+    }
+
+    if authSession != nil {
+        if clientID != "" {
+            // Logout from specific client only
+            delete(authSession.ClientStates, clientID)
+            s.storage.UpdateAuthSession(ctx, authSession.ID, ...)
+        } else {
+            // Logout from all clients - delete entire auth session
+            s.storage.DeleteAuthSession(ctx, authSession.ID)
+        }
+
+        // Revoke refresh tokens for logged-out clients
+        // ...
+    }
+
+    // Clear cookie and redirect
+    s.clearSessionCookie(w)
+
+    // Show logout confirmation or redirect
+    if postLogoutRedirectURI != "" && s.isValidPostLogoutURI(postLogoutRedirectURI, idTokenHint) {
+        u, _ := url.Parse(postLogoutRedirectURI)
+        if state != "" {
+            q := u.Query()
+            q.Set("state", state)
+            u.RawQuery = q.Encode()
+        }
+        http.Redirect(w, r, u.String(), http.StatusFound)
+        return
+    }
+
+    // Show logout confirmation page
+    s.templates.logout(w, r)
+}
+```
+
+**Future: Upstream Connector Logout**
+
+For CallbackConnectors (OIDC, OAuth, SAML), the upstream identity provider may also have an active session. Future work should include:
+- Implement `LogoutConnector` interface (see above)
+- OIDC connectors use `end_session_endpoint` from discovery
+- SAML connectors use Single Logout (SLO)
+- Redirect user to upstream after Dex logout
+
+This is tracked as a future improvement.
+
+#### Discovery Updates
+
+```go
+func (s *Server) constructDiscovery(ctx context.Context) discovery {
+    d := discovery{
+        // ...existing fields...
+    }
+
+    if s.sessionsEnabled {
+        d.EndSessionEndpoint = s.absURL("/logout")
+    }
+
+    return d
+}
+```
+
+#### Login Template Updates
+
+When sessions are enabled, add "Remember Me" checkbox to authentication flow.
+
+**Template Data**
+
+The server passes these values to templates:
+
+```go
+type templateData struct {
+    // ...existing fields...
+
+    // SessionsEnabled indicates if sessions feature is active
+    SessionsEnabled bool
+
+    // RememberMeChecked is the default checkbox state
+    // Set from config: sessions.rememberMeCheckedByDefault
+    RememberMeChecked bool
+}
+```
+
+**For PasswordConnector (login form exists in Dex):**
+
+```html
+<!-- templates/password.html -->
+<form method="post">
+    <!-- existing fields -->
+
+    {{ if .SessionsEnabled }}
+    <div class="remember-me">
+        <input type="checkbox" id="remember_me" name="remember_me" value="true"
+               {{ if .RememberMeChecked }}checked{{ end }}>
+        <label for="remember_me">Remember me</label>
+    </div>
+    {{ end }}
+
+    <button type="submit">Login</button>
+</form>
+```
+
+**For CallbackConnector (no login form in Dex):**
+
+For OAuth/OIDC/SAML connectors, the user is redirected to upstream IDP and there's no Dex login form.
+
+**Show on Approval Page** (recommended): Add "Remember Me" checkbox to the approval/consent page. User sees it after returning from upstream IDP, before granting consent.
+
+```html
+<!-- templates/approval.html -->
+<form method="post">
+    <!-- existing scope approval fields -->
+
+    {{ if .SessionsEnabled }}
+    <div class="remember-me">
+        <input type="checkbox" id="remember_me" name="remember_me" value="true"
+               {{ if .RememberMeChecked }}checked{{ end }}>
+        <label for="remember_me">Remember me on this device</label>
+    </div>
+    {{ end }}
+
+    <button type="submit" name="approval" value="approve">Grant Access</button>
+</form>
+```
+
+**When skipApprovalScreen is true**: If approval screen is skipped, the `rememberMeCheckedByDefault` config determines cookie persistence:
+- `false` (default): Session cookie (deleted on browser close)
+- `true`: Persistent cookie (survives browser restart)
+
+**Remember Me Behavior** (Keycloak-like):
+- **AuthSession is ALWAYS created** on successful authentication regardless of checkbox
+- **Checkbox controls cookie persistence only**:
+  - **Unchecked**: Session cookie - expires when browser closes. SSO works within browser session.
+  - **Checked**: Persistent cookie - survives browser restart until `absoluteLifetime` expires.
+
+#### Connector Type Considerations
+
+**CallbackConnector** (OIDC, OAuth, SAML, GitHub, etc.):
+- Session created after successful callback
+- Upstream tokens stored in refresh token's ConnectorData (not in session)
+- Identity refresh via RefreshConnector when refresh token is used
+
+**PasswordConnector** (LDAP, local passwords):
+- Session created after successful password verification
+- No upstream tokens
+- Identity refresh re-validates against password backend when refresh token is used
+
+Both types work the same way with sessions - the connector type only affects:
+1. Initial authentication flow (redirect vs password form)
+2. How identity refresh works (via refresh tokens, not sessions)
+
+#### Connector Configuration Changes
+
+Sessions reference a `ConnectorID`, but connector configuration may change after session creation (e.g., OIDC issuer URL changes, LDAP server replaced, connector removed entirely).
+
+**Behavior**: Dex does NOT automatically invalidate sessions when connector configuration changes. This is by design - Dex has no mechanism to detect configuration changes at runtime, and connectors are typically reconfigured during planned maintenance.
+
+**Administrator responsibility**: When connector configuration changes in a way that invalidates existing user identities (e.g., connector removed, upstream IdP replaced), administrators should:
+1. Terminate affected sessions via gRPC admin API (future: `DexSessions.TerminateByConnector(connectorID)`)
+2. Or wait for sessions to expire naturally
+3. Or restart Dex with `DEX_SESSIONS_ENABLED=false` temporarily to force re-authentication
+
+If a session references a connector that no longer exists, the session will fail gracefully at the next use: `GetConnector()` will return an error, and the user will be redirected to authenticate again.
+
+### Risks and Mitigations
+
+#### Security Risks
+
+| Risk | Mitigation |
+|------|------------|
+| Session hijacking | Secure cookie flags (HttpOnly, Secure, SameSite), short idle timeout |
+| Session fixation | Generate new session ID after authentication (see below) |
+| CSRF on logout | GET shows confirmation page, POST performs logout |
+| Cookie theft | Bind session to fingerprint (IP range, partial user agent) - optional |
+| Storage exposure | Session IDs are random 256-bit values, no sensitive data in cookie |
+
+**Session Fixation Protection**
+
+Session fixation attacks occur when an attacker sets a known session ID in a victim's browser before authentication, then hijacks the session after the victim logs in.
+
+References:
+- [OWASP Session Fixation](https://owasp.org/www-community/attacks/Session_fixation)
+- [OWASP Session Management Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html)
+
+**Mitigations implemented:**
+
+1. **Regenerate session ID on authentication**: When a user successfully authenticates, ALWAYS generate a new `AuthSession.ID` even if a session already exists. Never reuse a pre-authentication session ID.
+
+```go
+// This is not the real method signature, but the implementation example of a specific behavior.
+func (s *Server) onSuccessfulAuthentication(w http.ResponseWriter, userID, connectorID, clientID string, rememberMe bool) {
+    // ALWAYS generate new session ID - prevents session fixation
+    newSessionID := NewSessionID()
+
+    // Create or update AuthSession with NEW ID
+    authSession := &AuthSession{
+        ID:           newSessionID,  // Always new, never reuse
+        ClientStates: make(map[string]*ClientAuthState),
+        CreatedAt:    time.Now(),
+        // ...
+    }
+
+    // Set cookie with new session ID
+    s.setSessionCookie(w, newSessionID, rememberMe)
+}
+```
+
+2. **Don't accept session IDs from URL parameters**: Session IDs are ONLY accepted from cookies, never from query parameters or POST data.
+
+3. **Strict cookie settings**: `HttpOnly`, `Secure`, `SameSite=Lax` prevent common session theft vectors.
+
+4. **Session binding (optional future enhancement)**: Bind session to client characteristics (IP range, user agent) to detect stolen cookies.
+
+**Handling existing sessions during authentication:**
+
+When a user authenticates and an existing `AuthSession` is found:
+1. Generate a completely new session ID
+2. Copy relevant state from old session to new session (if any)
+3. Delete the old `AuthSession` from storage
+4. Set cookie with new session ID
+
+This ensures that even if an attacker set a session cookie before authentication, they cannot use it after the victim logs in.
+
+#### Operational Risks
+
+| Risk | Mitigation |
+|------|------------|
+| Storage growth | AuthSessions are GC'd on inactivity; UserIdentities are per-user like OfflineSessions; admin API allows cleanup |
+| Storage performance | Additional read per request to resolve session cookie. Impact depends on backend — see note below |
+| Migration complexity | Feature flag allows gradual rollout, no breaking changes |
+
+**Storage Performance Note**
+
+Enabling sessions introduces an additional storage read on each authorization request (to resolve the session cookie to an `AuthSession`). The actual performance impact depends on the storage backend:
+
+- **SQL (Postgres, MySQL, SQLite)**: Session lookup by primary key is a single indexed read — negligible overhead
+- **etcd**: Single key-value lookup — negligible overhead
+- **Kubernetes CRDs**: GET by resource name — slightly higher latency than SQL/etcd but still within acceptable bounds (may require [priority&fairness](https://kubernetes.io/docs/concepts/cluster-administration/flow-control/) tuning)
+- **Memory**: In-process map lookup — no overhead
+
+At this stage, we do not have production metrics to quantify the exact impact. The storage access pattern is identical to existing `OfflineSessions` lookups (single record by key), which are already proven in production. It is recommended to monitor storage latency after enabling sessions and adjusting `validIfNotUsedFor` if the GC frequency needs tuning.
+
+#### Breaking Changes
+
+**None** - Sessions are opt-in via feature flag and configuration. Existing deployments continue to work without changes.
+
+#### Rollback Plan
+
+Sessions are fully controlled by the `DEX_SESSIONS_ENABLED` feature flag. Rollback is straightforward:
+
+1. **Disable feature flag**: Set `DEX_SESSIONS_ENABLED=false` (or remove it)
+2. **Immediate effect**: Dex stops creating, reading, and validating sessions. All authorization requests proceed as before sessions were introduced — connector authentication on every request, no SSO, no session cookies
+3. **Cookie cleanup**: Existing session cookies in browsers become inert — Dex ignores them when sessions are disabled. They expire naturally per their MaxAge or when the browser is closed
+4. **Storage cleanup**: `AuthSession` and `UserIdentity` records remain in storage but are unused. They can be cleaned up manually or left to accumulate no further growth
+5. **No downtime required**: Feature flag can be toggled without restart if environment variable reload is supported; otherwise, a rolling restart is sufficient
+
+**Key guarantee**: Disabling the feature flag returns Dex to its pre-sessions behavior with zero side effects. No existing functionality (refresh tokens, connector authentication, token issuance) depends on sessions. Additional tables in the database cost nothing when the feature flag is disabled: they remain unused schema objects and can be deleted later if desired.
+
+#### Migration Path
+
+1. Deploy new Dex version - storage migrations create `AuthSession` and `UserIdentity` tables/resources automatically (no feature flag needed for schema)
+2. Enable feature flag `DEX_SESSIONS_ENABLED=true` when ready to use sessions
+3. Add `sessions:` configuration block
+4. Sessions start being created for all new logins; "Remember Me" controls cookie persistence (session vs persistent cookie)
+5. Existing refresh tokens continue to work
+
+**Note**: Storage schema changes (new tables/CRDs) are applied on startup regardless of feature flag. The feature flag only controls whether sessions are actually created and used. This simplifies deployment - you can deploy the new version, then enable sessions later without another deployment.
+
+### Alternatives
+
+#### 1. Stateless Sessions (JWT in Cookie)
+
+**Approach**: Store session data directly in a signed/encrypted JWT cookie.
+
+**Pros**:
+- No server-side storage required
+- Scales horizontally without shared state
+
+**Cons**:
+- Cannot revoke sessions without blocklist
+- Cookie size limits (~4KB)
+- Cannot store consent history or client tracking for logout
+- No server-side session list for logout
+
+**Decision**: Rejected. Server-side sessions are required for proper logout and SSO.
+
+#### 2. Extend OfflineSessions
+
+**Approach**: Add session data to existing OfflineSessions entity.
+
+**Pros**:
+- Reuses existing storage
+- Simpler migration
+
+**Cons**:
+- OfflineSessions are per-connector, not per-browser
+- Different lifecycle (refresh token vs browser session)
+- Would complicate existing OfflineSessions logic
+
+**Decision**: Rejected. Clean separation is better for maintainability.
+
+#### 3. External Session Store (Redis)
+
+**Approach**: Use Redis for session storage instead of existing backends.
+
+**Pros**:
+- Built-in TTL support
+- Fast reads/writes
+- Proven session store
+
+**Cons**:
+- Adds infrastructure dependency
+- Against Dex's simplicity philosophy
+- Doesn't work with Kubernetes CRD backend
+
+**Decision**: Rejected. Must work with existing storage backends.
+
+#### 4. Do Nothing
+
+**Approach**: Keep using refresh tokens as implicit sessions.
+
+**Cons**:
+- Cannot implement OIDC conformance features
+- No proper SSO
+- No proper logout
+- Blocks future features (2FA, etc.)
+
+**Decision**: Rejected. These features are essential for enterprise adoption.
+
+## Future Improvements
+
+1. **Identity Refresh for Long-Lived Sessions**
+   - Periodic refresh of user identity from connector during active session
+   - Configurable refresh interval
+   - Refresh on token request option
+   - Handle connector revocation (terminate session)
+
+2. **Upstream Connector Logout**
+   - Redirect to upstream IDP logout endpoint after Dex logout
+   - Support RP-Initiated Logout towards upstream OIDC providers
+   - SAML Single Logout (SLO) support
+   - Configurable per-connector logout URLs
+
+3. **Session Introspection Endpoint**
+   - Implement session check endpoint similar to [RFC 7662 Token Introspection](https://datatracker.ietf.org/doc/html/rfc7662)
+   - Could enable replacing OAuth2 Proxy in some deployments
+   - Endpoint: `GET /session/introspect` or similar
+   - Returns session validity and user claims
+   - Useful for reverse proxies to validate session cookies directly
+
+4. **Front-Channel Logout**
+   - Implement [OIDC Front-Channel Logout 1.0](https://openid.net/specs/openid-connect-frontchannel-1_0.html)
+   - Notify client applications when user logs out via iframes
+   - Requires client `logoutURL` configuration
+
+5. **2FA/MFA Support**
+   - Store TOTP secrets in user profile
+   - Add MFA enrollment flow
+   - Step-up authentication for sensitive operations
+   - WebAuthn/Passkey support
+
+6. **Session Management API**
+   - List active sessions via gRPC API
+   - Revoke sessions via gRPC API
+   - Session activity audit log
+
+7. **Back-Channel Logout**
+   - Implement [OIDC Back-Channel Logout](https://openid.net/specs/openid-connect-backchannel-1_0.html)
+   - Server-to-server logout notifications
+
+8. **Account Linking**
+   - Link multiple connector identities to single user
+   - Switch between linked identities
+
+9. **Device/Session Fingerprinting**
+   - Optional session binding to client characteristics
+   - Anomaly detection for session theft
+
+10. **Per-Connector Session Policies**
+    - Different session lifetimes per connector
+    - Different SSO policies per connector
+
+11. **Session Impersonation for Admin**
+    - Admin can impersonate user sessions for debugging
+    - Audit logging for impersonation
+
+12. **Consent Management UI**
+    - User-facing page to view/revoke consents
+    - GDPR compliance features
+
diff --git a/docs/enhancements/cel-expressions-2026-02-28.md b/docs/enhancements/cel-expressions-2026-02-28.md
new file mode 100644
index 0000000000..efd2831f7e
--- /dev/null
+++ b/docs/enhancements/cel-expressions-2026-02-28.md
@@ -0,0 +1,732 @@
+# Dex Enhancement Proposal (DEP) - 2026-02-28 - CEL (Common Expression Language) Integration
+
+## Table of Contents
+
+- [Summary](#summary)
+- [Context](#context)
+- [Motivation](#motivation)
+    - [Goals/Pain](#goalspain)
+    - [Non-Goals](#non-goals)
+- [Proposal](#proposal)
+    - [User Experience](#user-experience)
+    - [Implementation Details/Notes/Constraints](#implementation-detailsnotesconstraints)
+        - [Phase 1: pkg/cel - Core CEL Library](#phase-1-pkgcel---core-cel-library)
+        - [Phase 2: Authentication Policies](#phase-2-authentication-policies)
+        - [Phase 3: Token Policies](#phase-3-token-policies)
+        - [Phase 4: OIDC Connector Claim Mapping](#phase-4-oidc-connector-claim-mapping)
+    - [Policy Application Flow](#policy-application-flow)
+    - [Risks and Mitigations](#risks-and-mitigations)
+    - [Alternatives](#alternatives)
+- [Future Improvements](#future-improvements)
+
+## Summary
+
+This DEP proposes integrating [CEL (Common Expression Language)][cel-spec] into Dex as a first-class
+expression engine for policy evaluation, claim mapping, and token customization. A new reusable
+`pkg/cel` package will provide a safe, sandboxed CEL environment with Kubernetes-grade compatibility
+guarantees, cost budgets, and a curated set of extension libraries. Subsequent phases will leverage
+this package to implement authentication policies, token policies, advanced claim mapping in
+connectors, and per-client/global access rules — replacing the need for ad-hoc configuration fields
+and external policy engines.
+
+[cel-spec]: https://github.com/google/cel-spec
+
+## Context
+
+- [#1583 Add allowedGroups option for clients config][#1583] — a long-standing request for a
+  configuration option to allow a client to specify a list of allowed groups.
+- [#1635 Connector Middleware][#1635] — long-standing request for a policy/middleware layer between
+  connectors and the server for claim transformations and access control.
+- [#1052 Allow restricting connectors per client][#1052] — frequently requested feature to restrict
+  which connectors are available to specific OAuth2 clients.
+- [#2178 Custom claims in ID tokens][#2178] — requests for including additional payload in issued tokens.
+- [#2812 Token Exchange DEP][dep-token-exchange] — mentions CEL/Rego as future improvement for
+  policy-based assertions on exchanged tokens.
+- The OIDC connector already has a growing set of ad-hoc claim mutation options
+  (`ClaimMapping`, `ClaimMutations.NewGroupFromClaims`, `FilterGroupClaims`, `ModifyGroupNames`)
+  that would benefit from a unified expression language.
+- Previous community discussions explored OPA/Rego and JMESPath, but CEL offers a better fit
+  (see [Alternatives](#alternatives)).
+
+[#1583]: https://github.com/dexidp/dex/pull/1583
+[#1635]: https://github.com/dexidp/dex/issues/1635
+[#1052]: https://github.com/dexidp/dex/issues/1052
+[#2178]: https://github.com/dexidp/dex/issues/2178
+[dep-token-exchange]: /docs/enhancements/token-exchange-2023-02-03-%232812.md
+
+## Motivation
+
+### Goals/Pain
+
+1. **Complex query/filter capabilities** — Dex needs a way to express complex validations and
+   mutations in multiple places (authentication flow, token issuance, claim mapping). Today each
+   feature requires new Go code, new config fields, and a new release cycle. CEL allows operators
+   to express these rules declaratively without code changes.
+
+2. **Authentication policies** — Operators want to control _who_ can log in based on rich
+   conditions: restrict specific connectors to specific clients, require group membership for
+   certain clients, deny login based on email domain, enforce MFA claims, etc. Currently there is
+   no unified mechanism; users rely on downstream applications or external proxies.
+
+3. **Token policies** — Operators want to customize issued tokens: add extra claims to ID tokens,
+   restrict scopes per client, modify `aud` claims, include upstream connector metadata, etc.
+   Today this requires forking Dex or using a reverse proxy.
+
+4. **Claim mapping in OIDC connector** — The OIDC connector has accumulated multiple ad-hoc config
+   options for claim mapping and group mutations (`ClaimMapping`, `NewGroupFromClaims`,
+   `FilterGroupClaims`, `ModifyGroupNames`). A single CEL expression field would replace all of
+   these with a more powerful and composable approach.
+
+5. **Per-client and global policies** — One of the most frequent requests is allowing different
+   connectors for different clients and restricting group-based access per client. CEL policies at
+   the global and per-client level address this cleanly.
+
+6. **CNCF ecosystem alignment** — CEL has massive adoption across the CNCF ecosystem:
+
+   | Project                   | CEL Usage                                                                                                                                                  | Evidence |
+   |---------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------|----------|
+   | **Kubernetes**            | ValidatingAdmissionPolicy, CRD validation rules (`x-kubernetes-validations`), AuthorizationPolicy, field selectors, CEL-based match conditions in webhooks | [KEP-3488][k8s-cel-kep], [CRD Validation Rules][k8s-crd-cel], [AuthorizationPolicy KEP-3221][k8s-authz-cel] |
+   | **Kyverno**               | CEL expressions in validation/mutation policies (v1.12+), preconditions                                                                                    | [Kyverno CEL docs][kyverno-cel] |
+   | **OPA Gatekeeper**        | Partially added support for CEL in constraint templates                                                                                                    | [Gatekeeper CEL][gatekeeper-cel] |
+   | **Istio**                 | AuthorizationPolicy conditions, request routing, telemetry                                                                                                 | [Istio CEL docs][istio-cel] |
+   | **Envoy / Envoy Gateway** | RBAC filter, ext_authz, rate limiting, route matching, access logging                                                                                      | [Envoy CEL docs][envoy-cel] |
+   | **Tekton**                | Pipeline when expressions, CEL custom tasks                                                                                                                | [Tekton CEL Interceptor][tekton-cel] |
+   | **Knative**               | Trigger filters using CEL expressions                                                                                                                      | [Knative CEL filters][knative-cel] |
+   | **Google Cloud**          | IAM Conditions, Cloud Deploy, Security Command Center                                                                                                      | [Google IAM CEL][gcp-cel] |
+   | **Cert-Manager**          | CertificateRequestPolicy approval using CEL                                                                                                                | [cert-manager approver-policy CEL][cert-manager-cel] |
+   | **Cilium**                | Hubble CEL filter logic                                                                                                                                    | [Cilium CEL docs][cilium-cel] |
+   | **Crossplane**            | Composition functions with CEL-based patch transforms                                                                                                      | [Crossplane CEL transforms][crossplane-cel] |
+   | **Kube-OVN**              | Network policy extensions using CEL                                                                                                                        | [Kube-OVN CEL][kube-ovn-cel] |
+
+   [k8s-cel-kep]: https://github.com/kubernetes/enhancements/tree/master/keps/sig-api-machinery/3488-cel-admission-control
+   [k8s-crd-cel]: https://kubernetes.io/docs/tasks/extend-kubernetes/custom-resources/custom-resource-definitions/#validation-rules
+   [k8s-authz-cel]: https://github.com/kubernetes/enhancements/tree/master/keps/sig-auth/3221-structured-authorization-configuration
+   [kyverno-cel]: https://kyverno.io/docs/writing-policies/cel/
+   [gatekeeper-cel]: https://open-policy-agent.github.io/gatekeeper/website/docs/validating-admission-policy/#policy-updates-to-add-vap-cel
+   [istio-cel]: https://istio.io/latest/docs/reference/config/security/conditions/
+   [envoy-cel]: https://www.envoyproxy.io/docs/envoy/latest/xds/type/v3/cel.proto
+   [tekton-cel]: https://tekton.dev/docs/triggers/cel_expressions/
+   [knative-cel]: https://github.com/knative/eventing/blob/main/docs/broker/filtering.md#add-cel-expression-filter
+   [gcp-cel]: https://cloud.google.com/iam/docs/conditions-overview
+   [cert-manager-cel]: https://cert-manager.io/docs/policy/approval/approver-policy/#validations
+   [cilium-cel]: https://docs.cilium.io/en/stable/_api/v1/flow/README/#flowfilter-experimental
+   [crossplane-cel]: https://github.com/crossplane-contrib/function-cel-filter
+   [kube-ovn-cel]: https://kubeovn.github.io/docs/stable/en/advance/cel-expression/
+
+   By choosing CEL, Dex operators who already use Kubernetes or other CNCF tools can reuse their
+   existing knowledge of the expression language.
+
+### Non-Goals
+
+- **Full policy engine** — This DEP does not aim to replace dedicated external policy engines
+  (OPA, Kyverno). CEL in Dex is scoped to identity and token operations.
+- **Breaking changes to existing configuration** — All existing config fields (`ClaimMapping`,
+  `ClaimMutations`, etc.) will continue to work. CEL expressions are additive/opt-in.
+- **Authorization (beyond Dex scope)** — Dex is an identity provider; downstream authorization
+  decisions remain the responsibility of relying parties. CEL policies in Dex are limited to
+  authentication and token issuance concerns.
+- **Multi-phase CEL in a single DEP** — Only Phase 1 (`pkg/cel` package) is targeted for
+  immediate implementation. Phases 2-4 are included here for design context and will have their
+  own implementation PRs.
+- **Multi-step logic** — CEL in Dex is scoped to single-expression evaluation. Each expression
+  is a standalone, stateless computation with no intermediate variables, chaining, or
+  multi-step transformations. If a use case requires sequential logic or conditionally chained
+  expressions, it belongs outside Dex (e.g. in an external policy engine or middleware).
+  This boundary protects the design from scope creep that pushes CEL beyond what it's good at.
+
+## Proposal
+
+### User Experience
+
+#### Authentication Policy (Phase 2)
+
+Operators can define global and per-client authentication policies in the Dex config:
+
+```yaml
+# Global authentication policy — each expression evaluates to bool.
+# If true — the request is denied. Evaluated in order; first match wins.
+authPolicy:
+  - expression: "!identity.email.endsWith('@example.com')"
+    message: "'Login restricted to example.com domain'"
+  - expression: "!identity.email_verified"
+    message: "'Email must be verified'"
+
+staticClients:
+  - id: admin-app
+    name: Admin Application
+    secret: ...
+    redirectURIs: [...]
+    # Per-client policy — same structure as global
+    authPolicy:
+      - expression: "!(request.connector_id in ['okta', 'ldap'])"
+        message: "'This application requires Okta or LDAP login'"
+      - expression: "!('admin' in identity.groups)"
+        message: "'Admin group membership required'"
+```
+
+#### Token Policy (Phase 3)
+
+Operators can add extra claims or mutate token contents:
+
+```yaml
+tokenPolicy:
+  # Global mutations applied to all ID tokens
+  claims:
+    # Add a custom claim based on group membership
+    - key: "'role'"
+      value: "identity.groups.exists(g, g == 'admin') ? 'admin' : 'user'"
+    # Include connector ID as a claim
+    - key: "'idp'"
+      value: "request.connector_id"
+    # Add department from upstream claims (only if present)
+    - key: "'department'"
+      value: "identity.extra['department']"
+      condition: "'department' in identity.extra"
+
+staticClients:
+  - id: internal-api
+    name: Internal API
+    secret: ...
+    redirectURIs: [...]
+    tokenPolicy:
+      claims:
+        - key: "'custom-claim.company.com/team'"
+          value: "identity.extra['team'].orValue('engineering')"
+        # Only add on-call claim for ops group members
+        - key: "'on_call'"
+          value: "true"
+          condition: "identity.groups.exists(g, g == 'ops')"
+      # Restrict scopes
+      filter:
+        expression: "request.scopes.all(s, s in ['openid', 'email', 'profile'])"
+        message: "'Unsupported scope requested'"
+```
+
+#### OIDC Connector Claim Mapping (Phase 4)
+
+Replace ad-hoc claim mapping with CEL:
+
+```yaml
+connectors:
+  - type: oidc
+    id: corporate-idp
+    name: Corporate IdP
+    config:
+      issuer: https://idp.example.com
+      clientID: dex-client
+      clientSecret: ...
+      # CEL-based claim mapping — replaces claimMapping and claimModifications
+      claimMappingExpressions:
+        username: "claims.preferred_username.orValue(claims.email)"
+        email: "claims.email"
+        groups: >
+          claims.groups
+            .filter(g, g.startsWith('dex:'))
+            .map(g, g.trimPrefix('dex:'))
+        emailVerified: "claims.email_verified.orValue(true)"
+        # Extra claims to pass through to token policies
+        extra:
+          department: "claims.department.orValue('unknown')"
+          cost_center: "claims.cost_center.orValue('')"
+```
+
+### Implementation Details/Notes/Constraints
+
+### Phase 1: `pkg/cel` — Core CEL Library
+
+This is the foundation that all subsequent phases build upon. The package provides a safe,
+reusable CEL environment with Kubernetes-grade guarantees.
+
+#### Package Structure
+
+```
+pkg/
+  cel/
+    cel.go              # Core Environment, compilation, evaluation
+    types.go            # CEL type declarations (Identity, Request, etc.)
+    cost.go             # Cost estimation and budgeting
+    doc.go              # Package documentation
+    library/
+      email.go          # Email-related CEL functions
+      groups.go         # Group-related CEL functions
+```
+
+#### Dependencies
+
+```
+github.com/google/cel-go v0.27.0
+```
+
+The `cel-go` library is the canonical Go implementation maintained by Google, used by Kubernetes
+and all major CNCF projects. It follows semantic versioning and provides strong backward
+compatibility guarantees.
+
+#### Core API Design
+
+**Public types:**
+
+```go
+// CompilationResult holds a compiled CEL program ready for evaluation.
+type CompilationResult struct {
+    Program    cel.Program
+    OutputType *cel.Type
+    Expression string
+}
+
+// Compiler compiles CEL expressions against a specific environment.
+type Compiler struct { /* ... */ }
+
+// CompilerOption configures a Compiler.
+type CompilerOption func(*compilerConfig)
+```
+
+**Compilation pipeline:**
+
+Each `Compile*` call performs these steps sequentially:
+1. Reject expressions exceeding `MaxExpressionLength` (10,240 chars).
+2. Compile and type-check the expression via `cel-go`.
+3. Validate output type matches the expected type (for typed variants).
+4. Estimate cost using `defaultCostEstimator` with size hints — reject if estimated max cost
+   exceeds the cost budget.
+5. Create an optimized `cel.Program` with runtime cost limit.
+
+Presence tests (`has(field)`, `'key' in map`) have zero cost, matching Kubernetes CEL behavior.
+
+#### Variable Declarations
+
+Variables are declared via `VariableDeclaration{Name, Type}` and registered with `NewCompiler`.
+Helper constructors provide pre-defined variable sets:
+
+**`IdentityVariables()`** — the `identity` variable (from `connector.Identity`),
+typed as `cel.ObjectType`:
+
+| Field | CEL Type | Source |
+|-------|----------|--------|
+| `identity.user_id` | `string` | `connector.Identity.UserID` |
+| `identity.username` | `string` | `connector.Identity.Username` |
+| `identity.preferred_username` | `string` | `connector.Identity.PreferredUsername` |
+| `identity.email` | `string` | `connector.Identity.Email` |
+| `identity.email_verified` | `bool` | `connector.Identity.EmailVerified` |
+| `identity.groups` | `list(string)` | `connector.Identity.Groups` |
+
+**`RequestVariables()`** — the `request` variable (from `RequestContext`),
+typed as `cel.ObjectType`:
+
+| Field | CEL Type |
+|-------|----------|
+| `request.client_id` | `string` |
+| `request.connector_id` | `string` |
+| `request.scopes` | `list(string)` |
+| `request.redirect_uri` | `string` |
+
+**`ClaimsVariable()`** — the `claims` variable for raw upstream claims as `map(string, dyn)`.
+
+**Typing strategy:**
+
+`identity` and `request` use `cel.ObjectType` with explicitly declared fields. This gives
+compile-time type checking: a typo like `identity.emial` is rejected at config load time
+rather than silently evaluating to null in production — critical for an auth system where a
+misconfigured policy could lock users out.
+
+`claims` remains `map(string, dyn)` because its shape is genuinely unknown — it carries
+arbitrary upstream IdP data.
+
+#### Compatibility Guarantees
+
+Following the Kubernetes CEL compatibility model
+([KEP-3488: CEL for Admission Control][kep-3488], [Kubernetes CEL Migration Guide][k8s-cel-compat]):
+
+1. **Environment versioning** — The CEL environment is versioned. When new functions or variables
+   are added, they are introduced under a new environment version. Existing expressions compiled
+   against an older version continue to work.
+
+   ```go
+   // EnvironmentVersion represents the version of the CEL environment.
+   // New variables, functions, or libraries are introduced in new versions.
+   type EnvironmentVersion uint32
+
+   const (
+       // EnvironmentV1 is the initial CEL environment.
+       EnvironmentV1 EnvironmentVersion = 1
+   )
+
+   // WithVersion sets the target environment version for the compiler.
+   func WithVersion(v EnvironmentVersion) CompilerOption
+   ```
+
+   This is directly modeled on `k8s.io/apiserver/pkg/cel/environment`.
+
+2. **Library stability** — Custom functions in the `pkg/cel/library` subpackage follow these rules:
+   - Functions MUST NOT be removed once released.
+   - Function signatures MUST NOT change once released.
+   - New functions MUST be added under a new `EnvironmentVersion`.
+   - If a function needs to be replaced, the old one is deprecated but kept forever.
+
+3. **Type stability** — CEL types (`Identity`, `Request`, `Claims`) follow the same rules:
+   - Fields MUST NOT be removed.
+   - Field types MUST NOT change.
+   - New fields are added in a new `EnvironmentVersion`.
+
+4. **Semantic versioning of `cel-go`** — The `cel-go` dependency follows semver. Dex pins to a
+   minor version range and updates are tested for behavioral changes. This is exactly the approach
+   Kubernetes takes: `k8s.io/apiextensions-apiserver` pins `cel-go` and gates new features behind
+   environment versions.
+
+5. **Feature gates** — New CEL-powered features are gated behind Dex feature flags (using the
+   existing `pkg/featureflags` mechanism) during their alpha phase.
+
+[kep-3488]: https://github.com/kubernetes/enhancements/tree/master/keps/sig-api-machinery/3488-cel-admission-control
+[k8s-cel-compat]: https://kubernetes.io/docs/reference/using-api/cel/
+
+#### Cost Estimation and Budgets
+
+Like Kubernetes, Dex CEL expressions must be bounded to prevent denial-of-service.
+
+**Constants:**
+
+| Constant | Value | Description |
+|----------|-------|-------------|
+| `DefaultCostBudget` | `10_000_000` | Max cost units per evaluation (aligned with Kubernetes) |
+| `MaxExpressionLength` | `10_240` | Max expression string length in characters |
+| `DefaultStringMaxLength` | `256` | Estimated max string size for cost estimation |
+| `DefaultListMaxLength` | `100` | Estimated max list size for cost estimation |
+
+**How it works:**
+
+A `defaultCostEstimator` (implementing `checker.CostEstimator`) provides size hints for known
+variables (`identity`, `request`, `claims`) so the `cel-go` cost estimator doesn't assume
+unbounded sizes. It also provides call cost estimates for custom Dex functions
+(`dex.emailDomain`, `dex.emailLocalPart`, `dex.groupMatches`, `dex.groupFilter`).
+
+Expressions are validated at three levels:
+1. **Length check** — reject expressions exceeding `MaxExpressionLength`.
+2. **Compile-time cost estimation** — reject expressions whose estimated max cost exceeds
+   the cost budget.
+3. **Runtime cost limit** — abort evaluation if actual cost exceeds the budget.
+
+#### Extension Libraries
+
+The `pkg/cel` environment includes these cel-go standard extensions (same set as Kubernetes):
+
+| Library | Description | Examples |
+|---------|-------------|---------|
+| `ext.Strings()` | Extended string functions | `"hello".upperAscii()`, `"foo:bar".split(':')`, `s.trim()`, `s.replace('a','b')` |
+| `ext.Encoders()` | Base64 encoding/decoding | `base64.encode(bytes)`, `base64.decode(str)` |
+| `ext.Lists()` | Extended list functions | `list.slice(1, 3)`, `list.flatten()` |
+| `ext.Sets()` | Set operations on lists | `sets.contains(a, b)`, `sets.intersects(a, b)`, `sets.equivalent(a, b)` |
+| `ext.Math()` | Math functions | `math.greatest(a, b)`, `math.least(a, b)` |
+
+Plus custom Dex libraries in the `pkg/cel/library` subpackage, each implementing the
+`cel.Library` interface:
+
+**`library.Email`** — email-related helpers:
+
+| Function | Signature | Description |
+|----------|-----------|-------------|
+| `dex.emailDomain` | `(string) -> string` | Returns the domain portion of an email address. `dex.emailDomain("user@example.com") == "example.com"` |
+| `dex.emailLocalPart` | `(string) -> string` | Returns the local part of an email address. `dex.emailLocalPart("user@example.com") == "user"` |
+
+**`library.Groups`** — group-related helpers:
+
+| Function | Signature | Description |
+|----------|-----------|-------------|
+| `dex.groupMatches` | `(list(string), string) -> list(string)` | Returns groups matching a glob pattern. `dex.groupMatches(identity.groups, "team:*")` |
+| `dex.groupFilter` | `(list(string), list(string)) -> list(string)` | Returns only groups present in the allowed list. `dex.groupFilter(identity.groups, ["admin", "ops"])` |
+
+#### Example: Compile and Evaluate
+
+```go
+// 1. Create a compiler with identity and request variables
+compiler, _ := cel.NewCompiler(
+    append(cel.IdentityVariables(), cel.RequestVariables()...),
+)
+
+// 2. Compile a policy expression (type-checked, cost-estimated)
+prog, _ := compiler.CompileBool(
+    `identity.email.endsWith('@example.com') && 'admin' in identity.groups`,
+)
+
+// 3. Evaluate against real data
+result, _ := cel.EvalBool(ctx, prog, map[string]any{
+    "identity": cel.IdentityFromConnector(connectorIdentity),
+    "request":  cel.RequestFromContext(cel.RequestContext{...}),
+})
+// result == true
+```
+
+### Phase 2: Authentication Policies
+
+**Config Model:**
+
+```go
+// AuthPolicy is a list of deny expressions evaluated after a user
+// authenticates with a connector. Each expression evaluates to bool.
+// If true — the request is denied. Evaluated in order; first match wins.
+type AuthPolicy []PolicyExpression
+
+// PolicyExpression is a CEL expression with an optional human-readable message.
+type PolicyExpression struct {
+    // Expression is a CEL expression that evaluates to bool.
+    Expression string `json:"expression"`
+    // Message is a CEL expression that evaluates to string (displayed to the user on deny).
+    // If empty, a generic message is shown.
+    Message string `json:"message,omitempty"`
+}
+```
+
+**Evaluation point:** After `connector.CallbackConnector.HandleCallback()` or
+`connector.PasswordConnector.Login()` returns an identity, and before the auth request is
+finalized. Implemented in `server/handlers.go` at `handleConnectorCallback`.
+
+**Available CEL variables:** `identity` (from connector), `request` (client_id, connector_id,
+scopes, redirect_uri).
+
+**Compilation:** All policy expressions are compiled once at config load time (in
+`cmd/dex/serve.go`) and stored in the `Server` struct. This ensures:
+- Syntax/type errors are caught at startup, not at runtime.
+- No compilation overhead per request.
+- Cost estimation can warn operators about expensive expressions at startup.
+
+**Evaluation flow:**
+
+```
+User authenticates via connector
+         │
+         v
+connector.HandleCallback() returns Identity
+         │
+         v
+Evaluate global authPolicy (in order)
+  - For each expression: evaluate → bool
+  - If true → deny with message, HTTP 403
+         │
+         v
+Evaluate per-client authPolicy (in order)
+  - Same logic as global
+         │
+         v
+Continue normal flow (approval screen or redirect)
+```
+
+### Phase 3: Token Policies
+
+**Config Model:**
+
+```go
+// TokenPolicy defines policies for token issuance.
+type TokenPolicy struct {
+    // Claims adds or overrides claims in the issued ID token.
+    Claims []ClaimExpression `json:"claims,omitempty"`
+    // Filter validates the token request. If expression evaluates to false,
+    // the request is denied.
+    Filter *PolicyExpression `json:"filter,omitempty"`
+}
+
+type ClaimExpression struct {
+    // Key is a CEL expression evaluating to string — the claim name.
+    Key string `json:"key"`
+    // Value is a CEL expression evaluating to dyn — the claim value.
+    Value string `json:"value"`
+    // Condition is an optional CEL expression evaluating to bool.
+    // When set, the claim is only included in the token if the condition
+    // evaluates to true. If omitted, the claim is always included.
+    Condition string `json:"condition,omitempty"`
+}
+```
+
+**Evaluation point:** In `server/oauth2.go` during ID token construction, after standard
+claims are built but before JWT signing.
+
+**Available CEL variables:** `identity`, `request`, `existing_claims` (the standard claims already
+computed as `map(string, dyn)`).
+
+**Claim merge order:**
+1. Standard Dex claims (sub, iss, aud, email, groups, etc.)
+2. Global `tokenPolicy.claims` evaluated and merged
+3. Per-client `tokenPolicy.claims` evaluated and merged (overrides global)
+
+**Reserved (forbidden) claim names:**
+
+Certain claim names are reserved and MUST NOT be set or overridden by CEL token policy
+expressions. Attempting to use a reserved claim key will result in a config validation error at
+startup. This prevents operators from accidentally breaking the OIDC/OAuth2 contract or
+undermining Dex's security guarantees.
+
+```go
+// ReservedClaimNames is the set of claim names that CEL token policy
+// expressions are forbidden from setting. These are core OIDC/OAuth2 claims
+// managed exclusively by Dex.
+var ReservedClaimNames = map[string]struct{}{
+    "iss":       {},  // Issuer — always set by Dex to its own issuer URL
+    "sub":       {},  // Subject — derived from connector identity, must not be spoofed
+    "aud":       {},  // Audience — determined by the OAuth2 client, not policy
+    "exp":       {},  // Expiration — controlled by Dex token TTL configuration
+    "iat":       {},  // Issued At — set by Dex at signing time
+    "nbf":       {},  // Not Before — set by Dex at signing time
+    "jti":       {},  // JWT ID — generated by Dex for token revocation/uniqueness
+    "auth_time": {},  // Authentication Time — set by Dex from the auth session
+    "nonce":     {},  // Nonce — echoed from the client's authorization request
+    "at_hash":   {},  // Access Token Hash — computed by Dex from the access token
+    "c_hash":    {},  // Code Hash — computed by Dex from the authorization code
+}
+```
+
+The reserved list is enforced in two places:
+1. **Config load time** — When compiling token policy `ClaimExpression` entries, Dex statically
+   evaluates the `Key` expression (which must be a string literal or constant-foldable) and rejects
+   it if the result is in `ReservedClaimNames`.
+2. **Runtime (defense in depth)** — Before merging evaluated claims into the ID token, Dex checks
+   each key against `ReservedClaimNames` and logs a warning + skips the claim if it matches. This
+   guards against dynamic key expressions that couldn't be statically checked.
+
+### Phase 4: OIDC Connector Claim Mapping
+
+**Config Model:**
+
+In `connector/oidc/oidc.go`:
+
+```go
+type Config struct {
+    // ... existing fields ...
+
+    // ClaimMappingExpressions provides CEL-based claim mapping.
+    // When set, these take precedence over ClaimMapping and ClaimMutations.
+    ClaimMappingExpressions *ClaimMappingExpression `json:"claimMappingExpressions,omitempty"`
+}
+
+type ClaimMappingExpression struct {
+    // Username is a CEL expression evaluating to string.
+    // Available variable: 'claims' (map of upstream claims).
+    Username string `json:"username,omitempty"`
+    // Email is a CEL expression evaluating to string.
+    Email string `json:"email,omitempty"`
+    // Groups is a CEL expression evaluating to list(string).
+    Groups string `json:"groups,omitempty"`
+    // EmailVerified is a CEL expression evaluating to bool.
+    EmailVerified string `json:"emailVerified,omitempty"`
+    // Extra is a map of claim names to CEL expressions evaluating to dyn.
+    // These are carried through to token policies.
+    Extra map[string]string `json:"extra,omitempty"`
+}
+```
+
+**Available CEL variable:** `claims` — `map(string, dyn)` containing all raw upstream claims from
+the ID token and/or UserInfo endpoint.
+
+This replaces the need for `ClaimMapping`, `NewGroupFromClaims`, `FilterGroupClaims`, and
+`ModifyGroupNames` with a single, more powerful mechanism.
+
+**Backward compatibility:** When `claimMappingExpressions` is nil, the existing `ClaimMapping` and
+`ClaimMutations` logic is used unchanged. When `claimMappingExpressions` is set, a startup warning is
+logged if legacy mapping fields are also configured.
+
+### Policy Application Flow
+
+The following diagram shows the order in which CEL policies are applied.
+Each step is optional — if not configured, it is skipped.
+
+```
+Connector Authentication
+  │
+  │ upstream claims → connector.Identity
+  │
+  v
+Authentication Policies
+  │
+  │  Global authPolicy
+  │  Per-client authPolicy
+  │
+  v
+Token Issuance
+  │
+  │  Global tokenPolicy.filter
+  │  Per-client tokenPolicy.filter
+  │
+  │  Global tokenPolicy.claims
+  │  Per-client tokenPolicy.claims
+  │
+  │  Sign JWT
+  │
+  v
+Token Response
+```
+
+| Step | Policy | Scope | Action on match |
+|------|--------|-------|-----------------|
+| 2 | `authPolicy` (global) | Global | Expression → `true` = DENY login |
+| 3 | `authPolicy` (per-client) | Per-client | Expression → `true` = DENY login |
+| 4 | `tokenPolicy.filter` (global) | Global | Expression → `false` = DENY token |
+| 5 | `tokenPolicy.filter` (per-client) | Per-client | Expression → `false` = DENY token |
+| 6 | `tokenPolicy.claims` (global) | Global | Adds/overrides claims (with optional condition) |
+| 7 | `tokenPolicy.claims` (per-client) | Per-client | Adds/overrides claims (overrides global) |
+
+### Risks and Mitigations
+
+| Risk | Mitigation |
+|------|------------|
+| **CEL expression complexity / DoS** | Cost budgets with configurable limits (default aligned with Kubernetes). Expressions are validated at config load time. Runtime evaluation is aborted if cost exceeds budget. |
+| **Learning curve for operators** | CEL has excellent documentation, playground ([cel.dev](https://cel.dev)), and massive CNCF adoption. Dex docs will include a dedicated CEL guide with examples. Most operators already know CEL from Kubernetes. |
+| **`cel-go` dependency size** | `cel-go` adds ~5MB to binary. This is acceptable for the functionality provided. Kubernetes, Istio, Envoy all accept this trade-off. |
+| **Breaking changes in `cel-go`** | Pin to semver minor range. Environment versioning ensures existing expressions continue to work across upgrades. |
+| **Security: CEL expression injection** | CEL expressions are defined by operators in the server config, not by end users. No CEL expression is ever constructed from user input at runtime. |
+| **Config migration** | Old config fields (`ClaimMapping`, `ClaimMutations`) continue to work. CEL expressions are opt-in. If both are specified, CEL takes precedence with a config-time warning. |
+| **Error messages exposing internals** | CEL deny `message` expressions are controlled by the operator. Default messages are generic. Evaluation errors are logged server-side, not exposed to end users. |
+| **Performance** | Expressions are compiled once at startup. Evaluation is sub-millisecond for typical identity operations. Cost budgets prevent pathological cases. Benchmarks will be included in `pkg/cel` tests. |
+
+### Alternatives
+
+#### OPA/Rego
+
+OPA was previously considered ([#1635], token exchange DEP). While powerful, it has significant
+drawbacks for Dex:
+
+- **Separate daemon** — OPA typically runs as a sidecar or daemon; adds operational complexity.
+  Even the embedded Go library (`github.com/open-policy-agent/opa/rego`) is significantly
+  heavier than `cel-go`.
+- **Rego learning curve** — Rego is a Datalog-derived language unfamiliar to most developers.
+  CEL syntax is closer to C/Java/Go and is immediately readable.
+- **Overkill** — Dex needs simple expression evaluation, not a full policy engine with data
+  loading, bundles, and partial evaluation.
+- **No inline expressions** — Rego policies are typically separate files, not inline config
+  expressions. This makes the config harder to understand and deploy.
+- **Smaller CNCF footprint for embedding** — While OPA is a graduated CNCF project, CEL has
+  broader adoption as an _embedded_ language (Kubernetes, Istio, Envoy, Kyverno, etc.).
+
+#### JMESPath
+
+JMESPath was proposed for claim mapping. Drawbacks:
+
+- **Query-only** — JMESPath is a JSON query language. It cannot express boolean conditions,
+  mutations, or string operations naturally.
+- **Limited type system** — No type checking at compile time. Errors are only caught at runtime.
+- **Small ecosystem** — Limited adoption compared to CEL. No CNCF projects use JMESPath for
+  policy evaluation.
+- **No cost estimation** — No way to bound execution time.
+
+#### Hardcoded Go Logic
+
+The current approach: each feature requires new Go structs, config fields, and code. This is
+unsustainable:
+- `ClaimMapping`, `NewGroupFromClaims`, `FilterGroupClaims`, `ModifyGroupNames` are each separate
+  features that could be one CEL expression.
+- Every new policy need requires a Dex code change and release.
+- Combinatorial explosion of config options.
+
+#### No Change
+
+Without CEL or an equivalent:
+- Operators continue to request per-client connector restrictions, custom claims, claim
+  transformations, and access policies — issues remain open indefinitely.
+- Dex accumulates more ad-hoc config fields, increasing maintenance burden.
+- Complex use cases require external reverse proxies, forking Dex, or middleware.
+
+## Future Improvements
+
+- **CEL in other connectors** — Extend CEL claim mapping beyond OIDC to LDAP (attribute mapping),
+  SAML (assertion mapping), and other connectors with complex attribute mapping needs.
+- **Policy testing framework** — Unit test framework for operators to validate their CEL
+  expressions against fixture data before deployment.
+- **Connector selection via CEL** — Replace the static connector-per-client mapping with a CEL
+  expression that dynamically determines which connectors to show based on request attributes.
+
+
diff --git a/docs/enhancements/id-jag-2026-03-02#4600.md b/docs/enhancements/id-jag-2026-03-02#4600.md
new file mode 100644
index 0000000000..231921c883
--- /dev/null
+++ b/docs/enhancements/id-jag-2026-03-02#4600.md
@@ -0,0 +1,283 @@
+# Dex Enhancement Proposal (DEP) 4600 - 2026-03-02 - Identity Assertion JWT Authorization Grant (ID-JAG)
+
+## Table of Contents
+
+- [Dex Enhancement Proposal (DEP) 4600 - 2026-03-02 - Identity Assertion JWT Authorization Grant (ID-JAG)](#dex-enhancement-proposal-dep-4600---2026-03-02---identity-assertion-jwt-authorization-grant-id-jag)
+  - [Table of Contents](#table-of-contents)
+  - [Summary](#summary)
+  - [Context](#context)
+  - [Motivation](#motivation)
+    - [Goals/Pain](#goalspain)
+    - [Non-goals](#non-goals)
+  - [Proposal](#proposal)
+    - [User Experience](#user-experience)
+    - [Implementation Details/Notes/Constraints](#implementation-detailsnotesconstraints)
+    - [Observability](#observability)
+    - [Risks and Mitigations](#risks-and-mitigations)
+    - [Alternatives](#alternatives)
+  - [Future Improvements](#future-improvements)
+
+## Summary
+
+[draft-ietf-oauth-identity-assertion-authz-grant-02] specifies a mechanism
+for an application to use an identity assertion to obtain an access token
+for a third-party API by coordinating through a common enterprise identity
+provider using Token Exchange [RFC 8693] and JWT Profile for OAuth 2.0
+Authorization Grants [RFC 7523].
+
+This DEP proposes to extend Dex's existing Token Exchange implementation
+to support issuing Identity Assertion JWT Authorization Grants (ID-JAGs),
+enabling cross-domain access managed by the enterprise IdP.
+
+[draft-ietf-oauth-identity-assertion-authz-grant-02]: https://datatracker.ietf.org/doc/draft-ietf-oauth-identity-assertion-authz-grant/
+
+## Context
+
+- [#2812 DEP for RFC 8693 OAuth 2 Token Exchange]
+  established the Token Exchange foundation that ID-JAG builds upon.
+- [draft-ietf-oauth-identity-assertion-authz-grant-02]
+  is the IETF Standards Track specification this DEP implements.
+- [draft-ietf-oauth-identity-chaining]
+  is the broader identity chaining specification that ID-JAG profiles.
+
+The specification is authored by A. Parecki (Okta), K. McGuinness, and
+B. Campbell (Ping Identity). It is actively being developed within the
+IETF OAuth Working Group.
+
+Use cases:
+
+- LLM agents accessing enterprise APIs on behalf of users (Appendix A.3 of the spec)
+- Enterprise applications embedding content from third-party apps
+- Email/calendaring applications accessing cross-domain resources
+
+Real-world adoption:
+
+- [Okta Cross App Access] is GA, implementing ID-JAG for SaaS-to-SaaS and
+  AI agent scenarios with a developer tutorial available.
+- [Okta AI Agent Token Exchange] (Early Access) uses ID-JAG for AI agents
+  accessing enterprise APIs on behalf of authenticated users.
+- [Keycloak #43971] tracks ID-JAG support as a feature request.
+- The upcoming MCP (Model Context Protocol) specification references ID-JAG
+  for AI agent authorization flows.
+
+[#2812 DEP for RFC 8693 OAuth 2 Token Exchange]: https://github.com/dexidp/dex/pull/2812
+[draft-ietf-oauth-identity-chaining]: https://datatracker.ietf.org/doc/draft-ietf-oauth-identity-chaining/
+[Okta Cross App Access]: https://developer.okta.com/blog/2026/02/10/xaa-client
+[Okta AI Agent Token Exchange]: https://developer.okta.com/docs/guides/ai-agent-token-exchange/authserver/main/
+[Keycloak #43971]: https://github.com/keycloak/keycloak/issues/43971
+
+## Motivation
+
+### Goals/Pain
+
+In enterprise environments, applications are configured for SSO through
+a common IdP. When one application needs to access a user's data at another
+application, the current approach requires either:
+
+1. A direct OAuth flow between apps (bypassing the IdP's visibility and policy)
+2. Static API keys or service accounts (security risk)
+
+ID-JAG solves this by letting the IdP broker cross-domain access, maintaining
+visibility and policy control.
+
+**Specific goals:**
+
+- Issue ID-JAG tokens via Token Exchange (`requested_token_type=urn:ietf:params:oauth:token-type:id-jag`)
+- Support `audience` and `resource` parameters per the specification
+- Validate subject token audience against requesting client
+- Support configurable policy evaluation for token exchange requests
+
+### Non-goals
+
+- Implementing the Resource Authorization Server role (JWT Bearer Grant / RFC 7523)
+  is out of scope for this initial DEP. It may be addressed in a follow-up.
+- SAML assertion support as `subject_token_type` is deferred.
+- Step-up authentication flow is deferred.
+
+## Proposal
+
+### User Experience
+
+End-to-end flow:
+
+```mermaid
+sequenceDiagram
+    participant C as Client (Wiki App)
+    participant Dex as Dex (IdP AS)
+    participant RAS as Resource AS (Chat AS)
+    participant RS as Resource Server (Chat API)
+
+    C->>Dex: 1. OIDC Authentication (authorization_code flow)
+    Dex-->>C: ID Token + optional Refresh Token
+
+    C->>Dex: 2. Token Exchange (grant_type=token-exchange)<br/>subject_token=ID Token<br/>requested_token_type=id-jag<br/>audience=https://acme.chat.example/<br/>connector_id=google
+    Note over Dex: Validate subject_token aud == client_id<br/>Evaluate policy (clientID → allowed audiences)<br/>Issue ID-JAG JWT (typ: oauth-id-jag+jwt)
+    Dex-->>C: ID-JAG (access_token, token_type=N_A, expires_in=300)
+
+    C->>RAS: 3. JWT Bearer Grant (RFC 7523)<br/>grant_type=jwt-bearer, assertion=ID-JAG
+    Note over RAS: Validate ID-JAG signature (Dex JWKS)<br/>Validate aud == RAS issuer<br/>Issue access token
+    RAS-->>C: Access Token
+
+    C->>RS: 4. API Request with Access Token
+    RS-->>C: Protected Resource
+```
+
+Clients can request ID-JAG tokens from Dex's `/token` endpoint by specifying
+`requested_token_type=urn:ietf:params:oauth:token-type:id-jag` in a
+Token Exchange request. ID-JAG support is enabled by adding
+`urn:ietf:params:oauth:token-type:id-jag` to `oauth2.tokenExchange.tokenTypes`.
+When not listed, requests with this `requested_token_type` are rejected,
+ensuring no change in behavior for existing deployments.
+
+The request parameters (extending existing Token Exchange):
+
+- `grant_type`: REQUIRED - `urn:ietf:params:oauth:grant-type:token-exchange`
+- `subject_token`: REQUIRED - the identity assertion (OpenID Connect ID Token)
+- `subject_token_type`: REQUIRED - `urn:ietf:params:oauth:token-type:id_token`.
+  SAML 2.0 (`urn:ietf:params:oauth:token-type:saml2`) is deferred (see Non-goals).
+- `requested_token_type`: REQUIRED - `urn:ietf:params:oauth:token-type:id-jag`
+- `audience`: REQUIRED - the Issuer URL of the Resource Authorization Server.
+  **Note**: The existing Token Exchange implementation uses a Dex-specific `connector_id`
+  parameter (not part of RFC 8693) for connector selection. The `audience` parameter was
+  not used in the current implementation despite DEP #2812 originally proposing it for
+  connector identification. ID-JAG introduces `audience` with its standard RFC 8693
+  meaning (target Resource AS). This is purely additive and does not affect existing
+  Token Exchange requests.
+- `connector_id`: REQUIRED (Dex extension) - the ID of the Dex connector to verify the
+  subject token against. The connector validates the token (issuer, signature, etc.),
+  so a mismatched token is rejected. This parameter already exists in the current
+  Token Exchange implementation and is reused as-is.
+- `resource`: OPTIONAL - the Resource Identifier of the Resource Server
+- `scope`: OPTIONAL - the requested scopes at the Resource Server
+
+The response:
+
+- `access_token`: the ID-JAG JWT (named `access_token` for RFC 8693 compatibility)
+- `issued_token_type`: `urn:ietf:params:oauth:token-type:id-jag`
+- `token_type`: `N_A` (this is not an OAuth access token)
+- `expires_in`: lifetime in seconds (default: 300, configurable independently of ID token
+  lifetime via `expiry.idJAGTokens`)
+- `scope`: OPTIONAL if the issued scope is identical to the requested scope; REQUIRED
+  otherwise. Per Section 4.3.2 of the specification, policy evaluation at the IdP may
+  result in different scopes being issued than were requested.
+
+Complete configuration example:
+
+```yaml
+oauth2:
+  grantTypes:
+    - authorization_code
+    - urn:ietf:params:oauth:grant-type:token-exchange
+  tokenExchange:
+    # List of token types enabled for exchange. Adding id-jag enables ID-JAG support.
+    # Omitting it (default) disables ID-JAG without affecting other token exchange flows.
+    # SAML2 (urn:ietf:params:oauth:token-type:saml2) may be added in a future release.
+    tokenTypes:
+      - urn:ietf:params:oauth:token-type:id_token
+      - urn:ietf:params:oauth:token-type:id-jag
+
+expiry:
+  idTokens: "24h"
+  idJAGTokens: "5m"  # default: 5m; independent of idTokens
+
+staticClients:
+  - id: wiki-app
+    name: "Wiki Application"
+    secret: "wiki-secret"
+    redirectURIs:
+      - "https://wiki.example/callback"
+    # Per-client ID-JAG policy. Clients without this section cannot obtain ID-JAG tokens
+    # (default-deny). Only audiences and scopes listed here may be requested.
+    idJAGPolicies:
+      allowedAudiences:
+        - "https://chat.example/"
+        - "https://calendar.example/"
+      allowedScopes:
+        - "chat.read"
+        - "calendar.read"
+
+  - id: supermarket-app
+    name: "Supermarket Application"
+    secret: "supermarket-secret"
+    redirectURIs:
+      - "https://supermarket.example/callback"
+    idJAGPolicies:
+      allowedAudiences:
+        - "https://grocery.store.1/"
+        - "https://grocery.store.2/"
+      allowedScopes:
+        - "eat.bananas"
+        - "eat.apples"
+```
+
+### Implementation Details/Notes/Constraints
+
+- A new `id-jag` branch is added to the existing Token Exchange flow, issuing a signed JWT
+  per Section 3 of the specification (header `typ: "oauth-id-jag+jwt"`, claims including
+  `iss`, `sub`, `aud`, `client_id`, `jti`, `exp`, `iat`).
+
+- Per-client `idJAGPolicies` in `staticClients` control which audiences and scopes a
+  given client may request in an ID-JAG. Clients without `idJAGPolicies` are denied
+  by default. Dynamically registered clients are currently unsupported for ID-JAG policies;
+  support via CEL expressions (building on the CEL infrastructure from #4601) is future work.
+
+- OIDC discovery is extended with `identity_chaining_requested_token_types_supported` per
+  Section 7 of the specification. When ID-JAG is enabled, Dex includes
+  `urn:ietf:params:oauth:token-type:id-jag` in this metadata property.
+
+- ID-JAG support is enabled by listing `urn:ietf:params:oauth:token-type:id-jag` in
+  `oauth2.tokenExchange.tokenTypes`. When not listed (default), requests are rejected,
+  ensuring no change in behavior for existing deployments.
+
+### Observability
+
+- Every ID-JAG token exchange request (issued or rejected) emits a structured log entry
+  with `client_id`, `connector_id`, `audience`, `resource` (if present), requested and
+  granted `scope` (these may differ after policy evaluation), `sub`, `jti` (if issued),
+  and the policy decision (`approved`/`denied` with reason like `audience_not_allowed`
+  or `client_has_no_policy`).
+
+- The following Prometheus counters are exposed:
+  - `dex_id_jag_requests_total` (labels: `result`) — issued vs rejected
+  - `dex_id_jag_policy_rejections_total` (labels: `reason`) —
+    breakdown by denial reason, useful for spotting misconfigurations or abuse
+  - `dex_id_jag_scope_modifications_total` — cases where policy reduced the requested scopes
+
+### Risks and Mitigations
+
+- **Lateral movement risk**: Same as existing Token Exchange. Mitigated by
+  not issuing refresh tokens, short expiry (5 min recommended), and
+  policy-based audience restrictions.
+- **Token confusion**: The `typ: "oauth-id-jag+jwt"` header and distinct
+  `issued_token_type` prevent confusion with ID Tokens or access tokens.
+- **Replay attack risk**: Server-side `jti` tracking is deferred, so a stolen ID-JAG
+  can be replayed within its 5-minute lifetime. Short `expires_in` is the only Dex-side
+  mitigation; Resource Authorization Servers should implement `jti` caching independently.
+- **Public client misuse**: Per Section 8.1 of the specification, ID-JAG SHOULD only be
+  used by confidential clients. Public clients should use the standard authorization code
+  flow with interactive user consent at the Resource Authorization Server. Dex will enforce
+  this by rejecting ID-JAG requests from public clients (clients without a secret).
+- **Breaking changes**: None. This is purely additive to the existing
+  Token Exchange implementation. The `audience` parameter is newly introduced
+  (not previously used in the implementation despite DEP #2812's original proposal),
+  and `connector_id` already exists.
+
+### Alternatives
+
+- **Wait for spec finalization**: The draft is Standards Track and stable enough
+  to implement. Okta and Ping Identity (the spec authors) already ship implementations,
+  and the spec has been adopted by the IETF OAuth WG.
+- **External policy engine (OPA/CEL)**: Config-based policies are sufficient for now.
+  The CEL infrastructure (#4601) is merged; ID-JAG policy evaluation via CEL is future work.
+
+## Future Improvements
+
+- Resource Authorization Server role (JWT Bearer Grant / RFC 7523)
+  accepting ID-JAGs from external IdPs
+- SAML 2.0 assertion support as `subject_token_type`
+  (`urn:ietf:params:oauth:token-type:saml2`)
+- CEL-based ID-JAG policy evaluation (building on #4601) enabling dynamic policies for
+  DB-managed clients, including runtime policy changes without restart
+- Step-up authentication when authentication context is insufficient
+- `actor_token` support for delegation scenarios
+- Server-side `jti` tracking to prevent ID-JAG replay attacks
diff --git a/docs/enhancements/token-exchange-2023-02-03-#2812.md b/docs/enhancements/token-exchange-2023-02-03-#2812.md
new file mode 100644
index 0000000000..f9f556d26e
--- /dev/null
+++ b/docs/enhancements/token-exchange-2023-02-03-#2812.md
@@ -0,0 +1,175 @@
+# Dex Enhancement Proposal (DEP) 2812 - 2023-02-03 - Token Exchange
+
+## Table of Contents
+
+- [Summary](#summary)
+- [Motivation](#motivation)
+    - [Goals/Pain](#goals)
+    - [Non-Goals](#non-goals)
+- [Proposal](#proposal)
+    - [User Experience](#user-experience)
+    - [Implementation Details/Notes/Constraints](#implementation-detailsnotesconstraints)
+    - [Risks and Mitigations](#risks-and-mitigations)
+    - [Alternatives](#alternatives)
+- [Future Improvements](#future-improvements)
+
+## Summary
+
+[RFC 8693] specifies a new OAuth2 `grant_type` of `urn:ietf:params:oauth:grant-type:token-exchange`.
+Using this grant type, when clients start an authentication flow with Dex,
+in lieu of being redirected to their upstream IDP for authentication on demand,
+clients can present an independently obtained, valid token from their IDP to Dex.
+This is primarily useful in fully automated environments with job/machine identities,
+where there is no human in the loop to handle browser-based login flows.
+This DEP proposes to implement the new grant type for Dex.
+
+[RFC 8693]: https://www.rfc-editor.org/rfc/rfc8693.html
+
+## Context
+
+- [#1668 Question: non-web based clients?]
+  was closed with no real resolution
+- [#1484 Token exchange for external tokens]
+  mentions that Keycloak has a similar capability
+- [#2657 Get OIDC token issued by Dex using a token issued by one of the connectors] 
+  is similar to the previous issue, but this time links to the new (January 2020) [RFC 8693].
+
+I believe the context for all of these are similar:
+a downstream project using Dex as its only IDP wants to grant access to programmatic clients
+without issuing long lived API tokens.
+
+Examples of downstream issues:
+
+- [argoproj/argo-cd#11632 ArgoCD SSO login via Azure AD Auth using OIDC not work for cli sso login]
+
+Other related Dex issues:
+
+- [#2450 Non-OIDC JWT Connector] is a functionally similar request, but expanded to arbitrary JWTs
+- [#1225 GitHub Non-Web application flow support] also asks for an exchange, but for an opaque GitHub PAT
+
+More broadly, this fits into recent movements to issue machine identities:
+
+- [GCP Service Identity](https://cloud.google.com/run/docs/securing/service-identity)
+- [AWS Execution Role](https://docs.aws.amazon.com/lambda/latest/dg/lambda-intro-execution-role.html)
+- [GitHub Actions OIDC](https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/about-security-hardening-with-openid-connect)
+- [CircleCI OIDC](https://circleci.com/docs/openid-connect-tokens/)
+- [Kubernetes Service Accounts](https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/)
+- [SPIFFE](https://spiffe.io/)
+
+and granting access to resources based on trusting federated identities:
+
+- [GCP Workload Identity Federation](https://cloud.google.com/iam/docs/workload-identity-federation)
+- [AWS STS AssumeRoleWithWebIdentity](https://docs.aws.amazon.com/STS/latest/APIReference/API_AssumeRoleWithWebIdentity.html)
+
+[#1484 Token exchange for external tokens]: https://github.com/dexidp/dex/issues/1484
+[#1668 Question: non-web based clients?]: https://github.com/dexidp/dex/issues/1668
+[#2657 Get OIDC token issued by Dex using a token issued by one of the connectors]: https://github.com/dexidp/dex/issues/2657
+[argoproj/argo-cd#11632 ArgoCD SSO login via Azure AD Auth using OIDC not work for cli sso login]: https://github.com/argoproj/argo-cd/issues/11632
+[#2450 Non-OIDC JWT Connector]: https://github.com/dexidp/dex/issues/2450
+[#1225 GitHub Non-Web application flow support]: https://github.com/dexidp/dex/issues/1225
+
+An initial attempt is at [#2806](https://github.com/dexidp/dex/pull/2806)
+
+## Motivation
+
+### Goals/Pain
+
+The goal is to allow programmatic access to Dex-protected resources 
+without the use of static/long-lived secret tokens (API keys, username/password)
+or web-based redirect flows.
+Such scenarios are common in CI/CD workflows,
+and in general automation of common tasks.
+
+### Non-goals
+
+- Work will be scoped to just the OIDC connector
+- [RFC 8693 Section 2.1.1. Relationship between Resource, Audience, and Scope]
+  details more complex authorization checks based on targeted resources.
+  This is considered out of scope.
+
+[RFC 8693 Section 2.1.1. Relationship between Resource, Audience, and Scope]: https://www.rfc-editor.org/rfc/rfc8693.html#name-relationship-between-resour
+
+## Proposal
+
+### User Experience
+
+Clients can make `POST` requests with `application/x-www-form-urlencoded` 
+parameters as specified by [RFC 8693] to Dex's `/token` endpoint.
+If successful, an access token will be returned,
+allowing direct authentication with Dex.
+No refresh tokens will be issued,
+perform a new exchange (possibly with refreshed upstream tokens) to obtain a new access token.
+
+The request parameters from [RFC 8693 Section 2.1](https://www.rfc-editor.org/rfc/rfc8693.html#name-request):
+
+- `grant_type`: REQUIRED - `urn:ietf:params:oauth:grant-type:token-exchange`
+- `resource`: OPTIONAL - the `audience` in the issued Dex token
+- `audience`: REQUIRED (RFC OPTIONAL) - the connector to verify the provided token against
+- `scope`: OPTIONAL - the `scope` in the issued Dex token
+- `requested_token_type`: OPTIONAL - one of `urn:ietf:params:oauth:token-type:access_token` or `urn:ietf:params:oauth:token-type:id_token`, defaulting to access token
+- `subject_token`: REQUIRED - the token issued by the upstream IDP
+- `subject_token_type`: REQUIRED - `urn:ietf:params:oauth:token-type:id_token` or `urn:ietf:params:oauth:token-type:access_token` if `getUserInfo` is `true`.
+- `actor_token`: OPTIONAL - unused
+- `actor_token_type`: OPTIONAL - unused
+
+The response parameters from [RFC 8693 Section 2.2](https://www.rfc-editor.org/rfc/rfc8693.html#name-response):
+
+- `access_token`: the issued token, the field is called `access_token` for legacy reasons
+- `issued_token_type`: the actual type of the issued token
+- `token_type`: the value `Bearer`
+- `expires_in`: validity lifetime in seconds
+- `scope`: the requested scope
+- `refresh_token`: unused
+
+The connector only needs to be configured with an issuer,
+no client ID / client secrets are necessary
+
+```yaml
+connectors:
+- type: oidc
+  id: my-platform
+  name: My Platform
+  config:
+    issuer: https://oidc.my-platform.example/
+```
+
+We expose a global and connector setting, 
+`allowedGrantTypes: []string` defaulting to all implemented types.
+
+### Implementation Details/Notes/Constraints
+
+- Connectors expose a new interface `TokenIdentity` that will verify the given token and return the associated identity.
+  A Dex access/id token is then minted for the given identity.
+
+- `actor_token` and `actor_token_type` are "MUST ... if the actor token is present, 
+  also perform the appropriate validation procedures for its indicated token type".
+  We will ignore these fields for the initial implementation.
+
+
+### Risks and Mitigations
+
+With token exchanges (sometimes known as identity impersonation), 
+is they allow for easier lateral movement if an attacker gains access to an upstream token.
+We limit the potential impact by not issuing refresh tokens, preventing persistent access.
+Combined with short token lifetimes, it should limit the period of time between authentication to upstream IDPs.
+Additionally, a new `allowedGrantTypes` would allow for disabling exchanges if the functionality isn't needed.
+
+### Alternatives
+
+- Continue to use static keys - 
+  this is a secret management nightmare 
+  and quite painful when client storage of keys is [breached](https://circleci.com/blog/january-4-2023-security-alert/)
+
+## Future Improvements
+
+- Other connectors may wish to implement the same capability under Oauth
+- The password connector could be switch to support this new endpoint, submitting passwords as access tokens,
+  allowing for multiple password connectors to be configured
+- The `audience` field could be made optional if there is a single connector or the id token is inspected for issuer url
+- The `actor_token` and `actor_token_type` can be checked / validated if a suitable use case is determined.
+- A policy language like [cel] or [rego] as mentioned on [#1635 Connector Middleware] 
+  would allow for stronger assertions of the provided identity against requested resource access.
+
+[cel]: https://github.com/google/cel-go
+[rego]: https://www.openpolicyagent.org/docs/latest/policy-language/
+[#1635 Connector Middleware]: https://github.com/dexidp/dex/issues/1635
diff --git a/examples/config-dev.yaml b/examples/config-dev.yaml
index bf11570a4e..cc576261a8 100644
--- a/examples/config-dev.yaml
+++ b/examples/config-dev.yaml
@@ -52,12 +52,25 @@ web:
   # https: 127.0.0.1:5554
   # tlsCert: /etc/dex/tls.crt
   # tlsKey: /etc/dex/tls.key
+  # headers:
+  #   X-Frame-Options: "DENY"
+  #   X-Content-Type-Options: "nosniff"
+  #   X-XSS-Protection: "1; mode=block"
+  #   Content-Security-Policy: "default-src 'self'"
+  #   Strict-Transport-Security: "max-age=31536000; includeSubDomains"
+  # The header is read only for requests arriving from one of trustedProxies;
+  # without them any client could spoof it, so it is ignored.
+  # clientRemoteIP:
+  #   header: X-Forwarded-For
+  #   trustedProxies:
+  #   - 10.0.0.0/8
 
 # Configuration for dex appearance
 # frontend:
 #   issuer: dex
 #   logoURL: theme/logo.png
 #   dir: web/
+#   Allowed values: light, dark
 #   theme: light
 
 # Configuration for telemetry
@@ -67,8 +80,8 @@ telemetry:
 
 # Uncomment this block to enable the gRPC API. This values MUST be different
 # from the HTTP endpoints.
-# grpc:
-#   addr: 127.0.0.1:5557
+grpc:
+  addr: 127.0.0.1:5557
 #   tlsCert: examples/grpc-client/server.crt
 #   tlsKey: examples/grpc-client/server.key
 #   tlsClientCA: examples/grpc-client/ca.crt
@@ -77,31 +90,110 @@ telemetry:
 # Is possible to specify units using only s, m and h suffixes.
 # expiry:
 #   deviceRequests: "5m"
-#   signingKeys: "6h"
+#   signingKeys: "6h" # deprecated, use signer.config.keysRotationPeriod
 #   idTokens: "24h"
 #   refreshTokens:
 #     reuseInterval: "3s"
 #     validIfNotUsedFor: "2160h" # 90 days
 #     absoluteLifetime: "3960h" # 165 days
 
+# Authentication sessions configuration.
+# Requires DEX_SESSIONS_ENABLED=true feature flag.
+#
+# Enabled here so that single sign-on works out of the box: without it every
+# authorization is a fresh login, the home page has no session to describe, and
+# prompt=none requests — how a client asks whether you are still signed in —
+# always answer no.
+sessions:
+  cookieName: "dex_session"
+  absoluteLifetime: "24h"
+  validIfNotUsedFor: "1h"
+#   rememberMeCheckedByDefault: false
+#   # Default SSO sharing policy for clients without explicit ssoSharedWith.
+#   # "all" = share with all clients (Keycloak-like), "none" = no sharing (default).
+#   ssoSharedWithDefault: "none"
+
 # Options for controlling the logger.
 # logger:
 #   level: "debug"
 #   format: "text" # can also be "json"
 
+# Enabled so the example app can exercise the grants dex implements. The
+# password grant needs passwordConnector to name the connector that checks it;
+# without that it is refused however the grant types are listed.
+oauth2:
+  # Listed explicitly so none of them depends on a default: the example app
+  # draws a flow only when the provider advertises the grant behind it.
+  grantTypes:
+    - "authorization_code"
+    - "refresh_token"
+    - "client_credentials"
+    - "urn:ietf:params:oauth:grant-type:device_code"
+    - "urn:ietf:params:oauth:grant-type:token-exchange"
+    - "password"
+  # The password grant is refused without this: dex needs to know which
+  # connector checks the password.
+  passwordConnector: local
+
 # Default values shown below
 # oauth2:
-    # use ["code", "token", "id_token"] to enable implicit flow for web-only clients
+#   # grantTypes determines the allowed set of authorization flows.
+#   grantTypes:
+#     - "authorization_code"
+#     - "client_credentials"
+#     - "refresh_token"
+#     - "implicit"
+#     - "password"
+#     - "urn:ietf:params:oauth:grant-type:device_code"
+#     - "urn:ietf:params:oauth:grant-type:token-exchange"
+#   # responseTypes determines the allowed response contents of a successful authorization flow.
+#   # use ["code", "token", "id_token"] to enable implicit flow for web-only clients.
 #   responseTypes: [ "code" ] # also allowed are "token" and "id_token"
-    # By default, Dex will ask for approval to share data with application
-    # (approval for sharing data from connected IdP to Dex is separate process on IdP)
+#   # By default, Dex will ask for approval to share data with application
+#   # (approval for sharing data from connected IdP to Dex is separate process on IdP)
 #   skipApprovalScreen: false
-    # If only one authentication method is enabled, the default behavior is to
-    # go directly to it. For connected IdPs, this redirects the browser away
-    # from application to upstream provider such as the Google login page
+#   # If only one authentication method is enabled, the default behavior is to
+#   # go directly to it. For connected IdPs, this redirects the browser away
+#   # from application to upstream provider such as the Google login page
 #   alwaysShowLoginScreen: false
-    # Uncomment the passwordConnector to use a specific connector for password grants
+#   # Uncomment the passwordConnector to use a specific connector for password grants
 #   passwordConnector: local
+#   # PKCE (Proof Key for Code Exchange) configuration
+#   pkce:
+#     # If true, PKCE is required for all authorization code flows (OAuth 2.1).
+#     enforce: false
+#     # Supported code challenge methods. Defaults to ["S256", "plain"].
+#     codeChallengeMethodsSupported: ["S256", "plain"]
+
+# Multi-factor authentication configuration.
+# Requires DEX_SESSIONS_ENABLED=true feature flag.
+# mfa:
+#  authenticators:
+#  - id: totp-1
+#    type: TOTP
+#    config:
+#      issuer: "dex-1"
+#    # Optional: limit this authenticator to specific connector types (e.g., ldap, oidc, saml).
+#    # If omitted or empty, applies to all connector types.
+#    # It is recommended to use this option to prevent MFA from being used for connectors
+#    # with their own MFA mechanisms, e.g., OIDC, Google, etc. (but technically, it is possible).
+#    connectorTypes:
+#    - mockCallback
+#  - id: webauthn-1
+#    type: WebAuthn
+#    config:
+#      rpDisplayName: "Dex Dev"
+#      # rpID defaults to the hostname of the issuer URL.
+#      # rpID: "127.0.0.1"
+#      # rpOrigins defaults to the issuer URL.
+#      # rpOrigins:
+#      # - "http://127.0.0.1:5556"
+#      attestationPreference: "indirect"  # none, indirect, or direct
+#      userVerification: "preferred"      # required, preferred, or discouraged
+#      # authenticatorAttachment: ""      # platform, cross-platform, or empty (any)
+#      timeout: "60s"
+#  defaultMFAChain:
+#  - totp-1
 
 # Instead of reading from an external storage, use this list of clients.
 #
@@ -110,17 +202,59 @@ staticClients:
 - id: example-app
   redirectURIs:
   - 'http://127.0.0.1:5555/callback'
+  - '/dex/device/callback'
+  postLogoutRedirectURIs:
+  - 'http://127.0.0.1:5555/'
+  # Where dex POSTs a logout token when this user's session ends, per OIDC
+  # Back-Channel Logout 1.0. Needs sessions enabled (see the sessions block).
+  backchannelLogoutURI: 'http://127.0.0.1:5555/backchannel-logout'
   name: 'Example App'
   secret: ZXhhbXBsZS1hcHAtc2VjcmV0
+  # Optional: restrict which connectors this client can use for authentication.
+  # If omitted or empty, all connectors are allowed.
+  # allowedConnectors:
+  # - mock
+  # Optional: ordered list of MFA authenticator IDs the user must complete during login.
+  # References authenticator IDs from mfa.authenticators.
+  # If omitted, mfa.defaultMFAChain is used.
+  # mfaChain:
+  # - totp-1
+  # Optional: which other clients can reuse this client's authentication session (SSO).
+  # ["*"] = share with all clients, [] = share with no one.
+  # If omitted, ssoSharedWithDefault from sessions config is used.
+  # ssoSharedWith:
+  # - "*"
+
+# Example using environment variables
+# Set DEX_CLIENT_ID and DEX_SECURE_CLIENT_SECRET before starting Dex
+# - idEnv: DEX_CLIENT_ID
+#   secretEnv: DEX_CLIENT_SECRET
+#   redirectURIs:
+#   - 'http://127.0.0.1:5556/callback'
+#   name: 'Secure Example App'
+
 #  - id: example-device-client
 #    redirectURIs:
 #      - /device/callback
 #    name: 'Static Client for Device Flow'
 #    public: true
+
 connectors:
 - type: mockCallback
   id: mock
   name: Example
+  # grantTypes restricts which grant types can use this connector.
+  # If not specified, all grant types are allowed.
+  # Supported values:
+  #   - "authorization_code"
+  #   - "implicit"
+  #   - "refresh_token"
+  #   - "password"
+  #   - "urn:ietf:params:oauth:grant-type:device_code"
+  #   - "urn:ietf:params:oauth:grant-type:token-exchange"
+#  grantTypes:
+#  - "authorization_code"
+#  - "refresh_token"
 # - type: google
 #   id: google
 #   name: Google
@@ -145,4 +279,25 @@ staticPasswords:
   # bcrypt hash of the string "password": $(echo password | htpasswd -BinC 10 admin | cut -d: -f2)
   hash: "$2a$10$2b2cU8CPhOTaGrs1HRQuAueS7JTT5ZHsHSzYiFPm1leZck7Mc8T4W"
   username: "admin"
+  name: "Admin User"
+  emailVerified: true
+  preferredUsername: "admin"
+  groups:
+  - "team-a"
+  - "team-a/admins"
   userID: "08a8684b-db88-4b73-90a9-3cd1661f5466"
+
+# Configuration for signing JWT tokens.
+# - "local": use local keys (supports RS256 (default) and ES256)
+# - "vault": use Vault Transit backend (supports RSA, ECDSA, and Ed25519)
+signer:
+  type: local
+  config:
+    keysRotationPeriod: "6h"
+    algorithm: "RS256" # changes apply on the next key rotation
+# signer
+#   type: vault
+#   config:
+#     addr: http://127.0.0.1:8200
+#     token: root
+#     keyName: dex-key
diff --git a/examples/example-app/README.md b/examples/example-app/README.md
new file mode 100644
index 0000000000..0b5a42ff3f
--- /dev/null
+++ b/examples/example-app/README.md
@@ -0,0 +1,117 @@
+# Example app
+
+An OpenID Connect client for trying dex out. It runs the flows dex implements,
+shows what comes back, and — given `--grpc-addr` — talks to dex's management API.
+
+```
+go run ./examples/example-app
+```
+
+It listens on `http://127.0.0.1:5555` and expects dex at `http://127.0.0.1:5556/dex`.
+
+## What it does
+
+**Browser flows.** Authorization code with PKCE, and device code. Each
+authorization gets its own `state`, `nonce` and PKCE verifier, kept against the
+browser's session — that is what the callback is checked against.
+
+**Direct grants.** Refresh, client credentials, password and token exchange,
+each from a form on the front page.
+
+**Token tools.** Introspection, local signature verification, and UserInfo.
+The first two answer different questions: introspection asks dex whether it is
+still honouring a token, verification checks the signature and lifetime the way
+a resource server would. A revoked token passes the second and fails the first.
+
+**Sessions.** The app keeps a session per browser and, by default, re-checks
+every 30s with a `prompt=none` request that dex still has one. Sign out of dex
+in another tab and this app stops showing you as signed in.
+
+## Configuring dex for it
+
+`examples/config-dev.yaml` is set up for all of this already — sessions, the
+device callback, the password connector and the gRPC API. What each part is for,
+if you are writing your own config:
+
+```yaml
+oauth2:
+  # Grants are refused unless listed. The default list is authorization_code
+  # and refresh_token.
+  grantTypes:
+    - authorization_code
+    - refresh_token
+    - urn:ietf:params:oauth:grant-type:device_code
+    - client_credentials
+    - password
+    - urn:ietf:params:oauth:grant-type:token-exchange
+  # Without this the password grant is refused: dex needs to know which
+  # connector verifies the password.
+  passwordConnector: local
+
+# Sessions are what make single sign-on, the home page and prompt=none session
+# checks work. Also needs DEX_SESSIONS_ENABLED=true.
+sessions:
+  cookieName: dex_session
+
+staticClients:
+  - id: example-app
+    secret: ZXhhbXBsZS1hcHAtc2VjcmV0
+    name: Example App
+    redirectURIs:
+      - http://127.0.0.1:5555/callback
+      # The device flow redirects through dex itself, so this has to be
+      # registered too — with the issuer's path prefix.
+      - /dex/device/callback
+
+# Only needed for the gRPC API page.
+grpc:
+  addr: 127.0.0.1:5557
+```
+
+Token exchange also needs a connector that can verify the token you bring, which
+in dex means one implementing `TokenIdentityConnector`.
+
+## The gRPC API page
+
+```
+--grpc-addr 127.0.0.1:5557
+```
+
+The page is in sections: clients, local passwords, connectors, the identities
+dex has recorded, and a user's sessions and refresh tokens. Without
+`--grpc-addr` the page still exists and says what to pass to connect it.
+
+The last two sections call methods behind a feature flag, so dex has to be
+started with it:
+
+```
+DEX_API_SESSIONS_IDENTITIES_CRUD=true
+```
+
+The connection is plaintext by default, which is how dex's example config
+exposes the API locally. For anything else, pass certificates — see
+`examples/grpc-client/cert-gen` for generating a set:
+
+```
+--grpc-addr 127.0.0.1:5557
+--grpc-ca examples/grpc-client/ca.crt
+--grpc-client-cert examples/grpc-client/client.crt
+--grpc-client-key examples/grpc-client/client.key
+```
+
+Revoking a refresh token is worth trying against your own session: revoke it,
+then let the app refresh, and the sign-in ends.
+
+## Flags
+
+Run `--help` for the full list. The ones worth knowing:
+
+| Flag | Default | |
+|---|---|---|
+| `--issuer` | `http://127.0.0.1:5556/dex` | Where dex is. |
+| `--listen` | `http://127.0.0.1:5555` | Where this app serves. |
+| `--redirect-uri` | `http://127.0.0.1:5555/callback` | Also decides the path the callback is served on. |
+| `--pkce` | `true` | Send a PKCE challenge. |
+| `--session-check-interval` | `30s` | How stale the app lets its idea of dex's session get. `0` stops checking, and then it will show a user who has signed out. |
+| `--grpc-addr` | — | Enables the API page. |
+| `--debug` | `false` | Log every request to and from dex. |
diff --git a/examples/example-app/main.go b/examples/example-app/main.go
index 451bea5b46..da891b4ff1 100644
--- a/examples/example-app/main.go
+++ b/examples/example-app/main.go
@@ -1,205 +1,75 @@
 package main
 
 import (
-	"bytes"
-	"context"
-	"crypto/tls"
-	"crypto/x509"
-	"encoding/json"
 	"errors"
 	"fmt"
-	"log"
-	"net"
-	"net/http"
-	"net/http/httputil"
-	"net/url"
 	"os"
-	"strings"
 	"time"
 
-	"github.com/coreos/go-oidc/v3/oidc"
 	"github.com/spf13/cobra"
-	"golang.org/x/oauth2"
-)
-
-const exampleAppState = "I wish to wash my irish wristwatch"
-
-type app struct {
-	clientID     string
-	clientSecret string
-	redirectURI  string
-
-	verifier *oidc.IDTokenVerifier
-	provider *oidc.Provider
-
-	// Does the provider use "offline_access" scope to request a refresh token
-	// or does it use "access_type=offline" (e.g. Google)?
-	offlineAsScope bool
 
-	client *http.Client
-}
-
-// return an HTTP client which trusts the provided root CAs.
-func httpClientForRootCAs(rootCAs string) (*http.Client, error) {
-	tlsConfig := tls.Config{RootCAs: x509.NewCertPool()}
-	rootCABytes, err := os.ReadFile(rootCAs)
-	if err != nil {
-		return nil, fmt.Errorf("failed to read root-ca: %v", err)
-	}
-	if !tlsConfig.RootCAs.AppendCertsFromPEM(rootCABytes) {
-		return nil, fmt.Errorf("no certs found in root CA file %q", rootCAs)
-	}
-	return &http.Client{
-		Transport: &http.Transport{
-			TLSClientConfig: &tlsConfig,
-			Proxy:           http.ProxyFromEnvironment,
-			Dial: (&net.Dialer{
-				Timeout:   30 * time.Second,
-				KeepAlive: 30 * time.Second,
-			}).Dial,
-			TLSHandshakeTimeout:   10 * time.Second,
-			ExpectContinueTimeout: 1 * time.Second,
-		},
-	}, nil
-}
-
-type debugTransport struct {
-	t http.RoundTripper
-}
-
-func (d debugTransport) RoundTrip(req *http.Request) (*http.Response, error) {
-	reqDump, err := httputil.DumpRequest(req, true)
-	if err != nil {
-		return nil, err
-	}
-	log.Printf("%s", reqDump)
+	"github.com/dexidp/dex/examples/example-app/server"
+)
 
-	resp, err := d.t.RoundTrip(req)
-	if err != nil {
-		return nil, err
-	}
-
-	respDump, err := httputil.DumpResponse(resp, true)
-	if err != nil {
-		resp.Body.Close()
-		return nil, err
-	}
-	log.Printf("%s", respDump)
-	return resp, nil
-}
+// defaultSessionCheck is short enough that signing out of dex in another tab
+// shows up here while you are still looking at the page.
+const defaultSessionCheck = 30 * time.Second
 
 func cmd() *cobra.Command {
 	var (
-		a         app
-		issuerURL string
-		listen    string
-		tlsCert   string
-		tlsKey    string
-		rootCAs   string
-		debug     bool
+		opts    server.Options
+		listen  string
+		tlsCert string
+		tlsKey  string
 	)
+
 	c := cobra.Command{
 		Use:   "example-app",
 		Short: "An example OpenID Connect client",
-		Long:  "",
+		Long: `An example OpenID Connect client for dex.
+
+It runs the flows dex implements — authorization code, device code, refresh,
+client credentials, password and token exchange — and shows what comes back.
+Given --grpc-addr it also talks to dex's management API.`,
 		RunE: func(cmd *cobra.Command, args []string) error {
 			if len(args) != 0 {
 				return errors.New("surplus arguments provided")
 			}
 
-			u, err := url.Parse(a.redirectURI)
-			if err != nil {
-				return fmt.Errorf("parse redirect-uri: %v", err)
-			}
-			listenURL, err := url.Parse(listen)
+			s, err := server.New(opts)
 			if err != nil {
-				return fmt.Errorf("parse listen address: %v", err)
-			}
-
-			if rootCAs != "" {
-				client, err := httpClientForRootCAs(rootCAs)
-				if err != nil {
-					return err
-				}
-				a.client = client
-			}
-
-			if debug {
-				if a.client == nil {
-					a.client = &http.Client{
-						Transport: debugTransport{http.DefaultTransport},
-					}
-				} else {
-					a.client.Transport = debugTransport{a.client.Transport}
-				}
+				return err
 			}
+			return s.Run(listen, tlsCert, tlsKey)
+		},
+	}
 
-			if a.client == nil {
-				a.client = http.DefaultClient
-			}
+	flags := c.Flags()
 
-			// TODO(ericchiang): Retry with backoff
-			ctx := oidc.ClientContext(context.Background(), a.client)
-			provider, err := oidc.NewProvider(ctx, issuerURL)
-			if err != nil {
-				return fmt.Errorf("failed to query provider %q: %v", issuerURL, err)
-			}
+	// This client.
+	flags.StringVar(&opts.ClientID, "client-id", "example-app", "OAuth2 client ID of this application.")
+	flags.StringVar(&opts.ClientSecret, "client-secret", "ZXhhbXBsZS1hcHAtc2VjcmV0", "OAuth2 client secret of this application.")
+	flags.StringVar(&opts.RedirectURI, "redirect-uri", "http://127.0.0.1:5555/callback", "Callback URL for OAuth2 responses. Its path is where this app serves the callback.")
+	flags.BoolVar(&opts.PKCE, "pkce", true, "Send a PKCE challenge with authorization requests.")
 
-			var s struct {
-				// What scopes does a provider support?
-				//
-				// See: https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderMetadata
-				ScopesSupported []string `json:"scopes_supported"`
-			}
-			if err := provider.Claims(&s); err != nil {
-				return fmt.Errorf("failed to parse provider scopes_supported: %v", err)
-			}
-
-			if len(s.ScopesSupported) == 0 {
-				// scopes_supported is a "RECOMMENDED" discovery claim, not a required
-				// one. If missing, assume that the provider follows the spec and has
-				// an "offline_access" scope.
-				a.offlineAsScope = true
-			} else {
-				// See if scopes_supported has the "offline_access" scope.
-				a.offlineAsScope = func() bool {
-					for _, scope := range s.ScopesSupported {
-						if scope == oidc.ScopeOfflineAccess {
-							return true
-						}
-					}
-					return false
-				}()
-			}
+	// The provider.
+	flags.StringVar(&opts.IssuerURL, "issuer", "http://127.0.0.1:5556/dex", "URL of the OpenID Connect issuer.")
+	flags.StringVar(&opts.RootCAs, "issuer-root-ca", "", "Root certificate authorities for the issuer. Defaults to host certs.")
+	flags.DurationVar(&opts.SessionCheckInterval, "session-check-interval", defaultSessionCheck,
+		"How often to confirm with the provider, using prompt=none, that its session still exists. Zero stops checking, which lets this app show a user who has signed out of the provider.")
 
-			a.provider = provider
-			a.verifier = provider.Verifier(&oidc.Config{ClientID: a.clientID})
+	// The management API.
+	flags.StringVar(&opts.GRPCAddr, "grpc-addr", "", "Address of dex's gRPC API, e.g. 127.0.0.1:5557. Enables the API page; empty leaves it out.")
+	flags.StringVar(&opts.GRPCCA, "grpc-ca", "", "CA certificate for the gRPC API. Without it the connection is plaintext.")
+	flags.StringVar(&opts.GRPCClientCert, "grpc-client-cert", "", "Client certificate for the gRPC API.")
+	flags.StringVar(&opts.GRPCClientKey, "grpc-client-key", "", "Client key for the gRPC API.")
 
-			http.HandleFunc("/", a.handleIndex)
-			http.HandleFunc("/login", a.handleLogin)
-			http.HandleFunc(u.Path, a.handleCallback)
+	// This process.
+	flags.StringVar(&listen, "listen", "http://127.0.0.1:5555", "HTTP(S) address to listen at.")
+	flags.StringVar(&tlsCert, "tls-cert", "", "X509 cert file to present when serving HTTPS.")
+	flags.StringVar(&tlsKey, "tls-key", "", "Private key for the HTTPS cert.")
+	flags.BoolVar(&opts.Debug, "debug", false, "Print all requests and responses to and from the issuer.")
 
-			switch listenURL.Scheme {
-			case "http":
-				log.Printf("listening on %s", listen)
-				return http.ListenAndServe(listenURL.Host, nil)
-			case "https":
-				log.Printf("listening on %s", listen)
-				return http.ListenAndServeTLS(listenURL.Host, tlsCert, tlsKey, nil)
-			default:
-				return fmt.Errorf("listen address %q is not using http or https", listen)
-			}
-		},
-	}
-	c.Flags().StringVar(&a.clientID, "client-id", "example-app", "OAuth2 client ID of this application.")
-	c.Flags().StringVar(&a.clientSecret, "client-secret", "ZXhhbXBsZS1hcHAtc2VjcmV0", "OAuth2 client secret of this application.")
-	c.Flags().StringVar(&a.redirectURI, "redirect-uri", "http://127.0.0.1:5555/callback", "Callback URL for OAuth2 responses.")
-	c.Flags().StringVar(&issuerURL, "issuer", "http://127.0.0.1:5556/dex", "URL of the OpenID Connect issuer.")
-	c.Flags().StringVar(&listen, "listen", "http://127.0.0.1:5555", "HTTP(S) address to listen at.")
-	c.Flags().StringVar(&tlsCert, "tls-cert", "", "X509 cert file to present when serving HTTPS.")
-	c.Flags().StringVar(&tlsKey, "tls-key", "", "Private key for the HTTPS cert.")
-	c.Flags().StringVar(&rootCAs, "issuer-root-ca", "", "Root certificate authorities for the issuer. Defaults to host certs.")
-	c.Flags().BoolVar(&debug, "debug", false, "Print all request and responses from the OpenID Connect issuer.")
 	return &c
 }
 
@@ -209,131 +79,3 @@ func main() {
 		os.Exit(2)
 	}
 }
-
-func (a *app) handleIndex(w http.ResponseWriter, r *http.Request) {
-	renderIndex(w)
-}
-
-func (a *app) oauth2Config(scopes []string) *oauth2.Config {
-	return &oauth2.Config{
-		ClientID:     a.clientID,
-		ClientSecret: a.clientSecret,
-		Endpoint:     a.provider.Endpoint(),
-		Scopes:       scopes,
-		RedirectURL:  a.redirectURI,
-	}
-}
-
-func (a *app) handleLogin(w http.ResponseWriter, r *http.Request) {
-	var scopes []string
-	if extraScopes := r.FormValue("extra_scopes"); extraScopes != "" {
-		scopes = strings.Split(extraScopes, " ")
-	}
-	var clients []string
-	if crossClients := r.FormValue("cross_client"); crossClients != "" {
-		clients = strings.Split(crossClients, " ")
-	}
-	for _, client := range clients {
-		scopes = append(scopes, "audience:server:client_id:"+client)
-	}
-	connectorID := ""
-	if id := r.FormValue("connector_id"); id != "" {
-		connectorID = id
-	}
-
-	authCodeURL := ""
-	scopes = append(scopes, "openid", "profile", "email")
-	if r.FormValue("offline_access") != "yes" {
-		authCodeURL = a.oauth2Config(scopes).AuthCodeURL(exampleAppState)
-	} else if a.offlineAsScope {
-		scopes = append(scopes, "offline_access")
-		authCodeURL = a.oauth2Config(scopes).AuthCodeURL(exampleAppState)
-	} else {
-		authCodeURL = a.oauth2Config(scopes).AuthCodeURL(exampleAppState, oauth2.AccessTypeOffline)
-	}
-	if connectorID != "" {
-		authCodeURL = authCodeURL + "&connector_id=" + connectorID
-	}
-
-	http.Redirect(w, r, authCodeURL, http.StatusSeeOther)
-}
-
-func (a *app) handleCallback(w http.ResponseWriter, r *http.Request) {
-	var (
-		err   error
-		token *oauth2.Token
-	)
-
-	ctx := oidc.ClientContext(r.Context(), a.client)
-	oauth2Config := a.oauth2Config(nil)
-	switch r.Method {
-	case http.MethodGet:
-		// Authorization redirect callback from OAuth2 auth flow.
-		if errMsg := r.FormValue("error"); errMsg != "" {
-			http.Error(w, errMsg+": "+r.FormValue("error_description"), http.StatusBadRequest)
-			return
-		}
-		code := r.FormValue("code")
-		if code == "" {
-			http.Error(w, fmt.Sprintf("no code in request: %q", r.Form), http.StatusBadRequest)
-			return
-		}
-		if state := r.FormValue("state"); state != exampleAppState {
-			http.Error(w, fmt.Sprintf("expected state %q got %q", exampleAppState, state), http.StatusBadRequest)
-			return
-		}
-		token, err = oauth2Config.Exchange(ctx, code)
-	case http.MethodPost:
-		// Form request from frontend to refresh a token.
-		refresh := r.FormValue("refresh_token")
-		if refresh == "" {
-			http.Error(w, fmt.Sprintf("no refresh_token in request: %q", r.Form), http.StatusBadRequest)
-			return
-		}
-		t := &oauth2.Token{
-			RefreshToken: refresh,
-			Expiry:       time.Now().Add(-time.Hour),
-		}
-		token, err = oauth2Config.TokenSource(ctx, t).Token()
-	default:
-		http.Error(w, fmt.Sprintf("method not implemented: %s", r.Method), http.StatusBadRequest)
-		return
-	}
-
-	if err != nil {
-		http.Error(w, fmt.Sprintf("failed to get token: %v", err), http.StatusInternalServerError)
-		return
-	}
-
-	rawIDToken, ok := token.Extra("id_token").(string)
-	if !ok {
-		http.Error(w, "no id_token in token response", http.StatusInternalServerError)
-		return
-	}
-
-	idToken, err := a.verifier.Verify(r.Context(), rawIDToken)
-	if err != nil {
-		http.Error(w, fmt.Sprintf("failed to verify ID token: %v", err), http.StatusInternalServerError)
-		return
-	}
-
-	accessToken, ok := token.Extra("access_token").(string)
-	if !ok {
-		http.Error(w, "no access_token in token response", http.StatusInternalServerError)
-		return
-	}
-
-	var claims json.RawMessage
-	if err := idToken.Claims(&claims); err != nil {
-		http.Error(w, fmt.Sprintf("error decoding ID token claims: %v", err), http.StatusInternalServerError)
-		return
-	}
-
-	buff := new(bytes.Buffer)
-	if err := json.Indent(buff, []byte(claims), "", "  "); err != nil {
-		http.Error(w, fmt.Sprintf("error indenting ID token claims: %v", err), http.StatusInternalServerError)
-		return
-	}
-
-	renderToken(w, a.redirectURI, rawIDToken, accessToken, token.RefreshToken, buff.String())
-}
diff --git a/examples/example-app/server/admin.go b/examples/example-app/server/admin.go
new file mode 100644
index 0000000000..d79e376b3f
--- /dev/null
+++ b/examples/example-app/server/admin.go
@@ -0,0 +1,790 @@
+package server
+
+import (
+	"context"
+	"crypto/tls"
+	"crypto/x509"
+	"fmt"
+	"net/http"
+	"net/url"
+	"os"
+	"time"
+
+	"golang.org/x/crypto/bcrypt"
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/credentials"
+	"google.golang.org/grpc/credentials/insecure"
+
+	api "github.com/dexidp/dex/api/v2"
+)
+
+// adminClient talks to dex's gRPC API — the interface that manages the
+// provider itself rather than authenticating against it.
+type adminClient struct {
+	conn *grpc.ClientConn
+	api  api.DexClient
+}
+
+// newAdminClient dials the gRPC API. Plaintext is allowed because that is how
+// dex's own example config exposes it locally; anything reachable off the host
+// should be given the certificates instead.
+func newAdminClient(opts Options) (*adminClient, error) {
+	creds := insecure.NewCredentials()
+
+	if opts.GRPCCA != "" {
+		pool := x509.NewCertPool()
+		caCert, err := os.ReadFile(opts.GRPCCA)
+		if err != nil {
+			return nil, fmt.Errorf("read gRPC CA: %v", err)
+		}
+		if !pool.AppendCertsFromPEM(caCert) {
+			return nil, fmt.Errorf("no certificates found in %q", opts.GRPCCA)
+		}
+
+		cfg := &tls.Config{RootCAs: pool}
+		if opts.GRPCClientCert != "" || opts.GRPCClientKey != "" {
+			cert, err := tls.LoadX509KeyPair(opts.GRPCClientCert, opts.GRPCClientKey)
+			if err != nil {
+				return nil, fmt.Errorf("load gRPC client key pair: %v", err)
+			}
+			cfg.Certificates = []tls.Certificate{cert}
+		}
+		creds = credentials.NewTLS(cfg)
+	}
+
+	conn, err := grpc.NewClient(opts.GRPCAddr, grpc.WithTransportCredentials(creds))
+	if err != nil {
+		return nil, fmt.Errorf("dial gRPC API at %q: %v", opts.GRPCAddr, err)
+	}
+
+	return &adminClient{conn: conn, api: api.NewDexClient(conn)}, nil
+}
+
+func (a *adminClient) close() {
+	if a.conn != nil {
+		a.conn.Close()
+	}
+}
+
+// adminSections are the tabs of the API page. dex's API has more than twenty
+// methods; putting every list and every form on one page is what made the last
+// version unreadable.
+// connectorTypes are the types dex's config parser knows. The list is short,
+// fixed, and impossible to guess the spelling of, so the form offers it rather
+// than asking you to type one.
+var connectorTypes = []string{
+	"atlassian-crowd", "authproxy", "bitbucket-cloud", "gitea", "github",
+	"gitlab", "google", "keystone", "ldap", "linkedin", "microsoft",
+	"mockCallback", "mockPassword", "oauth", "oidc", "openshift", "saml",
+}
+
+// connectorGrantTypes pairs each grant with a readable name: the two URNs are
+// forty characters of boilerplate and four of meaning.
+func connectorGrantTypes() []Option {
+	return []Option{
+		{Value: grantAuthorizationCode, Label: "authorization_code"},
+		{Value: grantRefreshToken, Label: "refresh_token"},
+		{Value: grantDeviceCode, Label: "device_code"},
+		{Value: grantTokenExchange, Label: "token_exchange"},
+		{Value: grantClientCredentials, Label: "client_credentials"},
+		{Value: grantPassword, Label: "password"},
+	}
+}
+
+var adminSections = []AdminSection{
+	{ID: "clients", Label: "Clients"},
+	{ID: "passwords", Label: "Passwords"},
+	{ID: "connectors", Label: "Connectors"},
+	{ID: "identities", Label: "Users"},
+	{ID: "sessions", Label: "Sessions"},
+	{ID: "discovery", Label: "Discovery"},
+}
+
+// handleAdmin renders one section of the API.
+func (s *Server) handleAdmin(w http.ResponseWriter, r *http.Request) {
+	section := r.URL.Query().Get("section")
+	if section == "" {
+		section = "clients"
+	}
+
+	data := AdminPageData{
+		LogoURI:      dexLogoDataURI,
+		AdminEnabled: true,
+		Configured:   s.admin != nil,
+		Section:      section,
+		Notice:       r.URL.Query().Get("notice"),
+		Error:        r.URL.Query().Get("error"),
+		UserID:       r.URL.Query().Get("user_id"),
+		ConnectorID:  r.URL.Query().Get("connector_id"),
+		Mode:         r.URL.Query().Get("mode"),
+
+		ConnectorTypes:      connectorTypes,
+		ConnectorGrantTypes: connectorGrantTypes(),
+	}
+	for _, sec := range adminSections {
+		sec.Current = sec.ID == section
+		data.Sections = append(data.Sections, sec)
+	}
+
+	// Without --grpc-addr the page explains itself rather than 404ing, which is
+	// how you find out the feature exists at all.
+	if s.admin == nil {
+		s.renderer.RenderAdminPage(w, data)
+		return
+	}
+
+	ctx, cancel := context.WithTimeout(r.Context(), 10*time.Second)
+	defer cancel()
+
+	fail := func(err error) {
+		if data.Error == "" {
+			data.Error = err.Error()
+		}
+	}
+
+	if version, err := s.admin.api.GetVersion(ctx, &api.VersionReq{}); err == nil {
+		data.Version = fmt.Sprintf("%s (API %d)", version.Server, version.Api)
+	} else {
+		fail(err)
+	}
+	if disco, err := s.admin.api.GetDiscovery(ctx, &api.DiscoveryReq{}); err == nil {
+		data.Issuer = disco.Issuer
+	}
+
+	switch section {
+	case "clients":
+		if resp, err := s.admin.api.ListClients(ctx, &api.ListClientReq{}); err == nil {
+			for _, c := range resp.Clients {
+				data.Clients = append(data.Clients, AdminClient{
+					ID:                     c.Id,
+					Name:                   c.Name,
+					RedirectURIs:           c.RedirectUris,
+					TrustedPeers:           c.TrustedPeers,
+					Public:                 c.Public,
+					LogoURL:                c.LogoUrl,
+					AllowedConnectors:      c.AllowedConnectors,
+					SSOSharedWith:          c.SsoSharedWith,
+					BackchannelLogoutURI:   c.BackchannelLogoutUri,
+					PostLogoutRedirectURIs: c.PostLogoutRedirectUris,
+					RefreshTokenLifetime:   c.RefreshTokenLifetime,
+				})
+			}
+		} else {
+			fail(err)
+		}
+
+	case "passwords":
+		if resp, err := s.admin.api.ListPasswords(ctx, &api.ListPasswordReq{}); err == nil {
+			for _, p := range resp.Passwords {
+				data.Passwords = append(data.Passwords, AdminPassword{
+					Email:    p.Email,
+					Username: p.Username,
+					UserID:   p.UserId,
+				})
+			}
+		} else {
+			fail(err)
+		}
+
+	case "connectors":
+		if resp, err := s.admin.api.ListConnectors(ctx, &api.ListConnectorReq{}); err == nil {
+			for _, c := range resp.Connectors {
+				data.Connectors = append(data.Connectors, AdminConnector{
+					ID: c.Id, Type: c.Type, Name: c.Name, GrantTypes: c.GrantTypes,
+				})
+			}
+		} else {
+			fail(err)
+		}
+
+	case "identities":
+		if resp, err := s.admin.api.ListUserIdentities(ctx, &api.ListUserIdentitiesReq{}); err == nil {
+			for _, u := range resp.Identities {
+				identity := AdminIdentity{
+					UserID:        u.UserId,
+					ConnectorID:   u.ConnectorId,
+					Email:         u.Email,
+					EmailVerified: u.EmailVerified,
+					Username:      u.Username,
+					Groups:        u.Groups,
+				}
+				for _, d := range u.MfaDevices {
+					identity.MFADevices = append(identity.MFADevices, AdminMFADevice{AuthenticatorID: d.AuthenticatorId})
+				}
+				data.Identities = append(data.Identities, identity)
+			}
+		} else {
+			fail(err)
+		}
+
+	case "discovery":
+		endpoints, capabilities, err := s.discoveryEntries(ctx)
+		if err != nil {
+			fail(err)
+		}
+		data.Endpoints, data.Capabilities = endpoints, capabilities
+
+	case "sessions":
+		// The two listings are keyed differently, which is a property of the API
+		// rather than a choice here: sessions are stored under the ID the
+		// connector gave the user, refresh tokens under the encoded sub claim
+		// that ends up in tokens.
+		if data.UserID != "" {
+			req := &api.ListAuthSessionsReq{UserId: data.UserID, ConnectorId: data.ConnectorID}
+			if resp, err := s.admin.api.ListAuthSessions(ctx, req); err == nil {
+				for _, sess := range resp.Sessions {
+					data.Sessions = append(data.Sessions, AdminSession{
+						ID:          sess.Id,
+						UserID:      sess.UserId,
+						ConnectorID: sess.ConnectorId,
+						IPAddress:   sess.IpAddress,
+						UserAgent:   sess.UserAgent,
+						Created:     epochText(sess.CreatedAt),
+						Expires:     epochText(sess.AbsoluteExpiry),
+					})
+				}
+			} else {
+				fail(err)
+			}
+
+		}
+
+		// Refresh tokens are keyed by the sub claim, which is the user and the
+		// connector encoded together.
+		if data.UserID != "" && data.ConnectorID != "" {
+			subject := idTokenSubject(data.UserID, data.ConnectorID)
+			if resp, err := s.admin.api.ListRefresh(ctx, &api.ListRefreshReq{UserId: subject}); err == nil {
+				for _, t := range resp.RefreshTokens {
+					data.RefreshTokens = append(data.RefreshTokens, AdminRefreshToken{
+						ID:       t.Id,
+						ClientID: t.ClientId,
+						Created:  epochText(t.CreatedAt),
+						LastUsed: epochText(t.LastUsed),
+					})
+				}
+			} else {
+				fail(err)
+			}
+		}
+	}
+
+	// An edit starts from a row, so the form comes back filled in.
+	if id := r.URL.Query().Get("edit"); id != "" && section == "clients" {
+		if resp, err := s.admin.api.GetClient(ctx, &api.GetClientReq{Id: id}); err == nil && resp.Client != nil {
+			c := resp.Client
+			data.EditClient = &AdminClient{
+				ID:                     c.Id,
+				Name:                   c.Name,
+				RedirectURIs:           c.RedirectUris,
+				TrustedPeers:           c.TrustedPeers,
+				Public:                 c.Public,
+				LogoURL:                c.LogoUrl,
+				AllowedConnectors:      c.AllowedConnectors,
+				SSOSharedWith:          c.SsoSharedWith,
+				BackchannelLogoutURI:   c.BackchannelLogoutUri,
+				PostLogoutRedirectURIs: c.PostLogoutRedirectUris,
+				RefreshTokenLifetime:   c.RefreshTokenLifetime,
+			}
+		} else if err != nil {
+			fail(err)
+		}
+	}
+	if email := r.URL.Query().Get("edit"); email != "" && section == "passwords" {
+		for _, p := range data.Passwords {
+			if p.Email == email {
+				entry := p
+				data.EditPassword = &entry
+				break
+			}
+		}
+	}
+
+	s.renderer.RenderAdminPage(w, data)
+}
+
+// epochText renders one of the API's Unix timestamps, which are zero when the
+// field was never set.
+func epochText(epoch int64) string {
+	if epoch == 0 {
+		return ""
+	}
+	return time.Unix(epoch, 0).UTC().Format("2 Jan 2006, 15:04 UTC")
+}
+
+// handleAdminCreateClient registers an OAuth2 client.
+func (s *Server) handleAdminCreateClient(w http.ResponseWriter, r *http.Request) {
+	if err := r.ParseForm(); err != nil {
+		s.adminRedirect(w, r, "", err.Error())
+		return
+	}
+
+	ctx, cancel := context.WithTimeout(r.Context(), 10*time.Second)
+	defer cancel()
+
+	req := &api.CreateClientReq{
+		Client: &api.Client{
+			Id:                     r.FormValue("id"),
+			Name:                   r.FormValue("name"),
+			Secret:                 r.FormValue("secret"),
+			LogoUrl:                r.FormValue("logo_url"),
+			RedirectUris:           r.Form["redirect_uris"],
+			TrustedPeers:           r.Form["trusted_peers"],
+			AllowedConnectors:      r.Form["allowed_connectors"],
+			SsoSharedWith:          r.Form["sso_shared_with"],
+			BackchannelLogoutUri:   r.FormValue("backchannel_logout_uri"),
+			PostLogoutRedirectUris: r.Form["post_logout_redirect_uris"],
+			RefreshTokenLifetime:   r.FormValue("refresh_token_lifetime"),
+			Public:                 r.FormValue("public") != "",
+		},
+	}
+
+	resp, err := s.admin.api.CreateClient(ctx, req)
+	switch {
+	case err != nil:
+		s.adminRedirect(w, r, "", err.Error())
+	case resp.AlreadyExists:
+		s.adminRedirect(w, r, "", fmt.Sprintf("client %q already exists", req.Client.Id))
+	default:
+		s.adminRedirect(w, r, fmt.Sprintf("created client %q", req.Client.Id), "")
+	}
+}
+
+// handleAdminDeleteClient removes an OAuth2 client.
+func (s *Server) handleAdminDeleteClient(w http.ResponseWriter, r *http.Request) {
+	if err := r.ParseForm(); err != nil {
+		s.adminRedirect(w, r, "", err.Error())
+		return
+	}
+
+	ctx, cancel := context.WithTimeout(r.Context(), 10*time.Second)
+	defer cancel()
+
+	id := r.FormValue("id")
+	resp, err := s.admin.api.DeleteClient(ctx, &api.DeleteClientReq{Id: id})
+	switch {
+	case err != nil:
+		s.adminRedirect(w, r, "", err.Error())
+	case resp.NotFound:
+		s.adminRedirect(w, r, "", fmt.Sprintf("client %q not found", id))
+	default:
+		s.adminRedirect(w, r, fmt.Sprintf("deleted client %q", id), "")
+	}
+}
+
+// handleAdminCreatePassword adds a user to dex's local password database. The
+// API takes a bcrypt hash rather than a password, so the hashing happens here.
+func (s *Server) handleAdminCreatePassword(w http.ResponseWriter, r *http.Request) {
+	if err := r.ParseForm(); err != nil {
+		s.adminRedirect(w, r, "", err.Error())
+		return
+	}
+
+	password := r.FormValue("password")
+	if password == "" {
+		s.adminRedirect(w, r, "", "password is required")
+		return
+	}
+
+	hash, err := bcrypt.GenerateFromPassword([]byte(password), bcrypt.DefaultCost)
+	if err != nil {
+		s.adminRedirect(w, r, "", err.Error())
+		return
+	}
+
+	ctx, cancel := context.WithTimeout(r.Context(), 10*time.Second)
+	defer cancel()
+
+	email := r.FormValue("email")
+	req := &api.CreatePasswordReq{
+		Password: &api.Password{
+			Email:    email,
+			Username: r.FormValue("username"),
+			UserId:   r.FormValue("user_id"),
+			Hash:     hash,
+		},
+	}
+
+	resp, err := s.admin.api.CreatePassword(ctx, req)
+	switch {
+	case err != nil:
+		s.adminRedirect(w, r, "", err.Error())
+	case resp.AlreadyExists:
+		s.adminRedirect(w, r, "", fmt.Sprintf("password for %q already exists", email))
+	default:
+		s.adminRedirect(w, r, fmt.Sprintf("created password for %q", email), "")
+	}
+}
+
+// handleAdminDeletePassword removes a user from the local password database.
+func (s *Server) handleAdminDeletePassword(w http.ResponseWriter, r *http.Request) {
+	if err := r.ParseForm(); err != nil {
+		s.adminRedirect(w, r, "", err.Error())
+		return
+	}
+
+	ctx, cancel := context.WithTimeout(r.Context(), 10*time.Second)
+	defer cancel()
+
+	email := r.FormValue("email")
+	resp, err := s.admin.api.DeletePassword(ctx, &api.DeletePasswordReq{Email: email})
+	switch {
+	case err != nil:
+		s.adminRedirect(w, r, "", err.Error())
+	case resp.NotFound:
+		s.adminRedirect(w, r, "", fmt.Sprintf("password for %q not found", email))
+	default:
+		s.adminRedirect(w, r, fmt.Sprintf("deleted password for %q", email), "")
+	}
+}
+
+// handleAdminRevokeRefresh revokes a user's refresh token for one client. This
+// is the other half of the session story: it is what makes a sign-in stop
+// working before the token expires on its own.
+func (s *Server) handleAdminRevokeRefresh(w http.ResponseWriter, r *http.Request) {
+	if err := r.ParseForm(); err != nil {
+		s.adminRedirect(w, r, "", err.Error())
+		return
+	}
+
+	ctx, cancel := context.WithTimeout(r.Context(), 10*time.Second)
+	defer cancel()
+
+	// The API keys refresh tokens by the sub claim, not by the user id the
+	// connector gave — the same encoding the listing above uses.
+	userID, clientID := r.FormValue("user_id"), r.FormValue("client_id")
+	resp, err := s.admin.api.RevokeRefresh(ctx, &api.RevokeRefreshReq{
+		UserId:   idTokenSubject(userID, r.FormValue("connector_id")),
+		ClientId: clientID,
+	})
+	switch {
+	case err != nil:
+		s.adminRedirect(w, r, "", err.Error())
+	case resp.NotFound:
+		s.adminRedirect(w, r, "", fmt.Sprintf("no refresh token for user %q and client %q", userID, clientID))
+	default:
+		s.adminRedirect(w, r, fmt.Sprintf("revoked refresh token for user %q", userID), "")
+	}
+}
+
+// adminRedirect returns to the admin page carrying the outcome, so a reload
+// does not repeat the action.
+func (s *Server) adminRedirect(w http.ResponseWriter, r *http.Request, notice, errMsg string) {
+	q := url.Values{}
+	if section := r.FormValue("section"); section != "" {
+		q.Set("section", section)
+	}
+	if userID := r.FormValue("list_user_id"); userID != "" {
+		q.Set("user_id", userID)
+	}
+	if connectorID := r.FormValue("list_connector_id"); connectorID != "" {
+		q.Set("connector_id", connectorID)
+	}
+	switch {
+	case errMsg != "":
+		q.Set("error", errMsg)
+	case notice != "":
+		q.Set("notice", notice)
+	}
+
+	u := "/admin"
+	if len(q) > 0 {
+		u += "?" + q.Encode()
+	}
+	http.Redirect(w, r, u, http.StatusSeeOther)
+}
+
+// handleAdminUpdateClient changes a client. Empty fields are left alone, since
+// the API's update takes only what it should overwrite.
+func (s *Server) handleAdminUpdateClient(w http.ResponseWriter, r *http.Request) {
+	if err := r.ParseForm(); err != nil {
+		s.adminRedirect(w, r, "", err.Error())
+		return
+	}
+
+	ctx, cancel := context.WithTimeout(r.Context(), 10*time.Second)
+	defer cancel()
+
+	id := r.FormValue("id")
+
+	// The form always submits the field, so an emptied box has to reach the API as
+	// a present-but-empty value — that is what clears the URI. Sending nothing
+	// would leave the old one in place, and the box would fill itself back in on
+	// the next load.
+	backchannelLogoutURI := r.FormValue("backchannel_logout_uri")
+	refreshTokenLifetime := r.FormValue("refresh_token_lifetime")
+
+	resp, err := s.admin.api.UpdateClient(ctx, &api.UpdateClientReq{
+		Id:                     id,
+		Name:                   r.FormValue("name"),
+		LogoUrl:                r.FormValue("logo_url"),
+		RedirectUris:           r.Form["redirect_uris"],
+		TrustedPeers:           r.Form["trusted_peers"],
+		AllowedConnectors:      r.Form["allowed_connectors"],
+		SsoSharedWith:          r.Form["sso_shared_with"],
+		BackchannelLogoutUri:   &backchannelLogoutURI,
+		PostLogoutRedirectUris: r.Form["post_logout_redirect_uris"],
+		RefreshTokenLifetime:   &refreshTokenLifetime,
+	})
+	switch {
+	case err != nil:
+		s.adminRedirect(w, r, "", err.Error())
+	case resp.NotFound:
+		s.adminRedirect(w, r, "", fmt.Sprintf("client %q not found", id))
+	default:
+		s.adminRedirect(w, r, fmt.Sprintf("updated client %q", id), "")
+	}
+}
+
+// handleAdminUpdatePassword changes a user's password or username.
+func (s *Server) handleAdminUpdatePassword(w http.ResponseWriter, r *http.Request) {
+	if err := r.ParseForm(); err != nil {
+		s.adminRedirect(w, r, "", err.Error())
+		return
+	}
+
+	req := &api.UpdatePasswordReq{
+		Email:       r.FormValue("email"),
+		NewUsername: r.FormValue("username"),
+	}
+	if password := r.FormValue("password"); password != "" {
+		hash, err := bcrypt.GenerateFromPassword([]byte(password), bcrypt.DefaultCost)
+		if err != nil {
+			s.adminRedirect(w, r, "", err.Error())
+			return
+		}
+		req.NewHash = hash
+	}
+
+	ctx, cancel := context.WithTimeout(r.Context(), 10*time.Second)
+	defer cancel()
+
+	resp, err := s.admin.api.UpdatePassword(ctx, req)
+	switch {
+	case err != nil:
+		s.adminRedirect(w, r, "", err.Error())
+	case resp.NotFound:
+		s.adminRedirect(w, r, "", fmt.Sprintf("password for %q not found", req.Email))
+	default:
+		s.adminRedirect(w, r, fmt.Sprintf("updated password for %q", req.Email), "")
+	}
+}
+
+// handleAdminVerifyPassword checks a password without issuing anything, which
+// is how a service that owns its own login screen would use dex's user store.
+func (s *Server) handleAdminVerifyPassword(w http.ResponseWriter, r *http.Request) {
+	if err := r.ParseForm(); err != nil {
+		s.adminRedirect(w, r, "", err.Error())
+		return
+	}
+
+	ctx, cancel := context.WithTimeout(r.Context(), 10*time.Second)
+	defer cancel()
+
+	email := r.FormValue("email")
+	resp, err := s.admin.api.VerifyPassword(ctx, &api.VerifyPasswordReq{
+		Email:    email,
+		Password: r.FormValue("password"),
+	})
+	switch {
+	case err != nil:
+		s.adminRedirect(w, r, "", err.Error())
+	case resp.NotFound:
+		s.adminRedirect(w, r, "", fmt.Sprintf("no password for %q", email))
+	case !resp.Verified:
+		s.adminRedirect(w, r, "", fmt.Sprintf("password for %q does not match", email))
+	default:
+		s.adminRedirect(w, r, fmt.Sprintf("password for %q verified", email), "")
+	}
+}
+
+// handleAdminCreateConnector adds a connector at runtime.
+func (s *Server) handleAdminCreateConnector(w http.ResponseWriter, r *http.Request) {
+	if err := r.ParseForm(); err != nil {
+		s.adminRedirect(w, r, "", err.Error())
+		return
+	}
+
+	ctx, cancel := context.WithTimeout(r.Context(), 10*time.Second)
+	defer cancel()
+
+	id := r.FormValue("id")
+	resp, err := s.admin.api.CreateConnector(ctx, &api.CreateConnectorReq{
+		Connector: &api.Connector{
+			Id:         id,
+			Type:       r.FormValue("type"),
+			Name:       r.FormValue("name"),
+			Config:     []byte(r.FormValue("config")),
+			GrantTypes: r.Form["grant_types"],
+		},
+	})
+	switch {
+	case err != nil:
+		s.adminRedirect(w, r, "", err.Error())
+	case resp.AlreadyExists:
+		s.adminRedirect(w, r, "", fmt.Sprintf("connector %q already exists", id))
+	default:
+		s.adminRedirect(w, r, fmt.Sprintf("created connector %q", id), "")
+	}
+}
+
+// handleAdminDeleteConnector removes a connector.
+func (s *Server) handleAdminDeleteConnector(w http.ResponseWriter, r *http.Request) {
+	if err := r.ParseForm(); err != nil {
+		s.adminRedirect(w, r, "", err.Error())
+		return
+	}
+
+	ctx, cancel := context.WithTimeout(r.Context(), 10*time.Second)
+	defer cancel()
+
+	id := r.FormValue("id")
+	resp, err := s.admin.api.DeleteConnector(ctx, &api.DeleteConnectorReq{Id: id})
+	switch {
+	case err != nil:
+		s.adminRedirect(w, r, "", err.Error())
+	case resp.NotFound:
+		s.adminRedirect(w, r, "", fmt.Sprintf("connector %q not found", id))
+	default:
+		s.adminRedirect(w, r, fmt.Sprintf("deleted connector %q", id), "")
+	}
+}
+
+// handleAdminDeleteIdentity forgets what dex recorded about a user from one
+// connector. The next sign-in records it again.
+func (s *Server) handleAdminDeleteIdentity(w http.ResponseWriter, r *http.Request) {
+	if err := r.ParseForm(); err != nil {
+		s.adminRedirect(w, r, "", err.Error())
+		return
+	}
+
+	ctx, cancel := context.WithTimeout(r.Context(), 10*time.Second)
+	defer cancel()
+
+	userID := r.FormValue("user_id")
+	resp, err := s.admin.api.DeleteUserIdentity(ctx, &api.DeleteUserIdentityReq{
+		UserId:      userID,
+		ConnectorId: r.FormValue("connector_id"),
+	})
+	switch {
+	case err != nil:
+		s.adminRedirect(w, r, "", err.Error())
+	case resp.NotFound:
+		s.adminRedirect(w, r, "", fmt.Sprintf("no identity for user %q", userID))
+	default:
+		s.adminRedirect(w, r, fmt.Sprintf("deleted identity for user %q", userID), "")
+	}
+}
+
+// handleAdminDeleteSession ends one of dex's sessions.
+func (s *Server) handleAdminDeleteSession(w http.ResponseWriter, r *http.Request) {
+	if err := r.ParseForm(); err != nil {
+		s.adminRedirect(w, r, "", err.Error())
+		return
+	}
+
+	ctx, cancel := context.WithTimeout(r.Context(), 10*time.Second)
+	defer cancel()
+
+	// One session is one signed-in browser, so this ends that device and no other.
+	sessionID := r.FormValue("session_id")
+	resp, err := s.admin.api.DeleteAuthSession(ctx, &api.DeleteAuthSessionReq{Id: sessionID})
+	switch {
+	case err != nil:
+		s.adminRedirect(w, r, "", err.Error())
+	case resp.NotFound:
+		s.adminRedirect(w, r, "", fmt.Sprintf("no session %q", sessionID))
+	default:
+		s.adminRedirect(w, r, fmt.Sprintf("deleted session %q", sessionID), "")
+	}
+}
+
+// handleAdminTerminateSessions ends every session a user has.
+func (s *Server) handleAdminTerminateSessions(w http.ResponseWriter, r *http.Request) {
+	if err := r.ParseForm(); err != nil {
+		s.adminRedirect(w, r, "", err.Error())
+		return
+	}
+
+	ctx, cancel := context.WithTimeout(r.Context(), 10*time.Second)
+	defer cancel()
+
+	userID := r.FormValue("user_id")
+	resp, err := s.admin.api.TerminateSessionsByUser(ctx, &api.TerminateSessionsByUserReq{UserId: userID})
+	if err != nil {
+		s.adminRedirect(w, r, "", err.Error())
+		return
+	}
+	s.adminRedirect(w, r, fmt.Sprintf("terminated %d session(s) for user %q", resp.SessionsTerminated, userID), "")
+}
+
+// handleAdminResetMFA clears a user's second factors so they enrol again.
+func (s *Server) handleAdminResetMFA(w http.ResponseWriter, r *http.Request) {
+	if err := r.ParseForm(); err != nil {
+		s.adminRedirect(w, r, "", err.Error())
+		return
+	}
+
+	ctx, cancel := context.WithTimeout(r.Context(), 10*time.Second)
+	defer cancel()
+
+	userID := r.FormValue("user_id")
+	resp, err := s.admin.api.ResetMFA(ctx, &api.ResetMFAReq{
+		UserId:      userID,
+		ConnectorId: r.FormValue("connector_id"),
+	})
+	switch {
+	case err != nil:
+		s.adminRedirect(w, r, "", err.Error())
+	case resp.NotFound:
+		s.adminRedirect(w, r, "", fmt.Sprintf("no MFA enrolment for user %q", userID))
+	default:
+		s.adminRedirect(w, r, fmt.Sprintf("reset MFA for user %q", userID), "")
+	}
+}
+
+// handleAdminDeleteMFASecret removes one authenticator's secret, leaving the
+// user's other factors alone.
+func (s *Server) handleAdminDeleteMFASecret(w http.ResponseWriter, r *http.Request) {
+	if err := r.ParseForm(); err != nil {
+		s.adminRedirect(w, r, "", err.Error())
+		return
+	}
+
+	ctx, cancel := context.WithTimeout(r.Context(), 10*time.Second)
+	defer cancel()
+
+	userID, authenticator := r.FormValue("user_id"), r.FormValue("authenticator_id")
+	resp, err := s.admin.api.DeleteMFASecret(ctx, &api.DeleteMFASecretReq{
+		UserId:          userID,
+		ConnectorId:     r.FormValue("connector_id"),
+		AuthenticatorId: authenticator,
+	})
+	switch {
+	case err != nil:
+		s.adminRedirect(w, r, "", err.Error())
+	case resp.NotFound:
+		s.adminRedirect(w, r, "", fmt.Sprintf("no %q secret for user %q", authenticator, userID))
+	default:
+		s.adminRedirect(w, r, fmt.Sprintf("deleted %q secret for user %q", authenticator, userID), "")
+	}
+}
+
+// handleAdminTerminateByConnector ends every session that came through one
+// connector — what you reach for when a connector is compromised or retired.
+func (s *Server) handleAdminTerminateByConnector(w http.ResponseWriter, r *http.Request) {
+	if err := r.ParseForm(); err != nil {
+		s.adminRedirect(w, r, "", err.Error())
+		return
+	}
+
+	ctx, cancel := context.WithTimeout(r.Context(), 10*time.Second)
+	defer cancel()
+
+	connectorID := r.FormValue("connector_id")
+	resp, err := s.admin.api.TerminateSessionsByConnector(ctx, &api.TerminateSessionsByConnectorReq{ConnectorId: connectorID})
+	if err != nil {
+		s.adminRedirect(w, r, "", err.Error())
+		return
+	}
+	s.detailRedirect(w, r, fmt.Sprintf("terminated %d session(s) from connector %q", resp.SessionsTerminated, connectorID), "")
+}
diff --git a/examples/example-app/server/admindetail.go b/examples/example-app/server/admindetail.go
new file mode 100644
index 0000000000..4d8b890ba2
--- /dev/null
+++ b/examples/example-app/server/admindetail.go
@@ -0,0 +1,357 @@
+package server
+
+import (
+	"context"
+	"encoding/base64"
+	"fmt"
+	"net/http"
+	"net/url"
+	"strings"
+	"time"
+
+	api "github.com/dexidp/dex/api/v2"
+)
+
+// The API page lists objects; these pages open one. A list can only show the
+// fields that fit, and for a connector the interesting part — its config — never
+// does.
+
+// handleAdminClientDetail shows one client in full.
+func (s *Server) handleAdminClientDetail(w http.ResponseWriter, r *http.Request) {
+	ctx, cancel := context.WithTimeout(r.Context(), 10*time.Second)
+	defer cancel()
+
+	id := r.PathValue("id")
+	data := AdminDetailPageData{
+		LogoURI:      dexLogoDataURI,
+		AdminEnabled: true,
+		Kind:         "client",
+		Title:        id,
+		BackURL:      "/admin?section=clients",
+	}
+
+	resp, err := s.admin.api.GetClient(ctx, &api.GetClientReq{Id: id})
+	switch {
+	case err != nil:
+		data.Error = err.Error()
+	case resp.Client == nil:
+		data.Error = fmt.Sprintf("client %q not found", id)
+	default:
+		c := resp.Client
+		data.Client = &AdminClient{
+			ID:                     c.Id,
+			Name:                   c.Name,
+			Secret:                 c.Secret,
+			RedirectURIs:           c.RedirectUris,
+			TrustedPeers:           c.TrustedPeers,
+			Public:                 c.Public,
+			LogoURL:                c.LogoUrl,
+			AllowedConnectors:      c.AllowedConnectors,
+			SSOSharedWith:          c.SsoSharedWith,
+			BackchannelLogoutURI:   c.BackchannelLogoutUri,
+			PostLogoutRedirectURIs: c.PostLogoutRedirectUris,
+			RefreshTokenLifetime:   c.RefreshTokenLifetime,
+		}
+	}
+
+	s.renderer.RenderAdminDetailPage(w, data)
+}
+
+// handleAdminConnectorDetail shows one connector, including the configuration
+// it was created with.
+func (s *Server) handleAdminConnectorDetail(w http.ResponseWriter, r *http.Request) {
+	ctx, cancel := context.WithTimeout(r.Context(), 10*time.Second)
+	defer cancel()
+
+	id := r.PathValue("id")
+	data := AdminDetailPageData{
+		LogoURI:      dexLogoDataURI,
+		AdminEnabled: true,
+		Kind:         "connector",
+		Title:        id,
+		BackURL:      "/admin?section=connectors",
+
+		ConnectorGrantTypes: connectorGrantTypes(),
+	}
+
+	// The API lists connectors but has no getter, so the list is the lookup.
+	resp, err := s.admin.api.ListConnectors(ctx, &api.ListConnectorReq{})
+	if err != nil {
+		data.Error = err.Error()
+		s.renderer.RenderAdminDetailPage(w, data)
+		return
+	}
+
+	for _, c := range resp.Connectors {
+		if c.Id != id {
+			continue
+		}
+		data.Connector = &AdminConnector{
+			ID:         c.Id,
+			Type:       c.Type,
+			Name:       c.Name,
+			GrantTypes: c.GrantTypes,
+			Config:     indentJSON(c.Config),
+		}
+		break
+	}
+	if data.Connector == nil {
+		data.Error = fmt.Sprintf("connector %q not found — connectors from the config file are not stored", id)
+	}
+
+	s.renderer.RenderAdminDetailPage(w, data)
+}
+
+// handleAdminUserDetail shows one identity: its claims, what it has consented
+// to, and what it has enrolled for MFA.
+func (s *Server) handleAdminUserDetail(w http.ResponseWriter, r *http.Request) {
+	ctx, cancel := context.WithTimeout(r.Context(), 10*time.Second)
+	defer cancel()
+
+	userID, connectorID := r.PathValue("user"), r.PathValue("connector")
+	data := AdminDetailPageData{
+		LogoURI:      dexLogoDataURI,
+		AdminEnabled: true,
+		Kind:         "user",
+		Title:        userID,
+		BackURL:      "/admin?section=identities",
+	}
+
+	resp, err := s.admin.api.GetUserIdentity(ctx, &api.GetUserIdentityReq{
+		UserId:      userID,
+		ConnectorId: connectorID,
+	})
+	switch {
+	case err != nil:
+		data.Error = err.Error()
+	case resp.Identity == nil:
+		data.Error = fmt.Sprintf("no identity for user %q on connector %q", userID, connectorID)
+	default:
+		data.Identity = adminIdentity(resp.Identity)
+		data.Title = data.Identity.Email
+		if data.Title == "" {
+			data.Title = userID
+		}
+	}
+
+	s.renderer.RenderAdminDetailPage(w, data)
+}
+
+// adminIdentity converts an identity, keeping everything the API returned.
+func adminIdentity(u *api.UserIdentity) *AdminIdentity {
+	identity := &AdminIdentity{
+		UserID:        u.UserId,
+		ConnectorID:   u.ConnectorId,
+		Email:         u.Email,
+		EmailVerified: u.EmailVerified,
+		Username:      u.Username,
+		Groups:        u.Groups,
+		Created:       epochText(u.CreatedAt),
+		LastLogin:     epochText(u.LastLogin),
+	}
+
+	for _, c := range u.Consents {
+		identity.Consents = append(identity.Consents, AdminConsent{ClientID: c.ClientId, Scopes: c.Scopes})
+	}
+
+	for _, d := range u.MfaDevices {
+		device := AdminMFADevice{
+			AuthenticatorID: d.AuthenticatorId,
+			HasSecret:       d.MfaSecret != nil,
+		}
+		for _, cred := range d.WebauthnCredentials {
+			device.Credentials = append(device.Credentials, AdminWebAuthnCredential{
+				ID:          base64.RawURLEncoding.EncodeToString(cred.CredentialId),
+				DisplayName: cred.DisplayName,
+				Transport:   cred.Transport,
+				SignCount:   cred.SignCount,
+				Created:     epochText(cred.CreatedAt),
+			})
+		}
+		identity.MFADevices = append(identity.MFADevices, device)
+	}
+
+	return identity
+}
+
+// handleAdminRevokeConsent withdraws a user's approval for one client, which
+// puts the consent screen back in front of them next time.
+func (s *Server) handleAdminRevokeConsent(w http.ResponseWriter, r *http.Request) {
+	if err := r.ParseForm(); err != nil {
+		http.Error(w, err.Error(), http.StatusBadRequest)
+		return
+	}
+
+	ctx, cancel := context.WithTimeout(r.Context(), 10*time.Second)
+	defer cancel()
+
+	userID, connectorID, clientID := r.FormValue("user_id"), r.FormValue("connector_id"), r.FormValue("client_id")
+	resp, err := s.admin.api.RevokeConsent(ctx, &api.RevokeConsentReq{
+		UserId:      userID,
+		ConnectorId: connectorID,
+		ClientId:    clientID,
+	})
+	switch {
+	case err != nil:
+		s.detailRedirect(w, r, "", err.Error())
+	case resp.NotFound:
+		s.detailRedirect(w, r, "", fmt.Sprintf("no consent for client %q", clientID))
+	default:
+		s.detailRedirect(w, r, fmt.Sprintf("revoked consent for client %q", clientID), "")
+	}
+}
+
+// handleAdminDeleteWebAuthn removes one registered key.
+func (s *Server) handleAdminDeleteWebAuthn(w http.ResponseWriter, r *http.Request) {
+	if err := r.ParseForm(); err != nil {
+		http.Error(w, err.Error(), http.StatusBadRequest)
+		return
+	}
+
+	credentialID, err := base64.RawURLEncoding.DecodeString(r.FormValue("credential_id"))
+	if err != nil {
+		s.detailRedirect(w, r, "", "credential id is not base64: "+err.Error())
+		return
+	}
+
+	ctx, cancel := context.WithTimeout(r.Context(), 10*time.Second)
+	defer cancel()
+
+	resp, err := s.admin.api.DeleteWebAuthnCredential(ctx, &api.DeleteWebAuthnCredentialReq{
+		UserId:       r.FormValue("user_id"),
+		ConnectorId:  r.FormValue("connector_id"),
+		CredentialId: credentialID,
+	})
+	switch {
+	case err != nil:
+		s.detailRedirect(w, r, "", err.Error())
+	case resp.NotFound:
+		s.detailRedirect(w, r, "", "credential not found")
+	default:
+		s.detailRedirect(w, r, "deleted the credential", "")
+	}
+}
+
+// localPath reports whether a redirect target stays inside this app.
+//
+// A leading slash is not enough: a browser reads "//host" as another host, and
+// so does it read "/\host", because it turns backslashes into slashes before
+// resolving. Normalising first and then insisting the parsed URL carries
+// neither scheme nor host covers both spellings.
+func localPath(target string) bool {
+	if !strings.HasPrefix(target, "/") {
+		return false
+	}
+
+	u, err := url.Parse(strings.ReplaceAll(target, `\`, "/"))
+	if err != nil {
+		return false
+	}
+
+	return u.Scheme == "" && u.Host == "" && strings.HasPrefix(u.Path, "/") && !strings.HasPrefix(u.Path, "//")
+}
+
+// detailRedirect returns to the detail page an action was started from.
+//
+// The target comes from the form, so it is only honoured when it points back
+// into this app. Anything else would make these endpoints a way to bounce
+// someone off to a site of the sender's choosing.
+func (s *Server) detailRedirect(w http.ResponseWriter, r *http.Request, notice, errMsg string) {
+	back := r.FormValue("back")
+	if !localPath(back) {
+		back = "/admin"
+	}
+
+	sep := "?"
+	if strings.Contains(back, "?") {
+		sep = "&"
+	}
+	switch {
+	case errMsg != "":
+		back += sep + "error=" + url.QueryEscape(errMsg)
+	case notice != "":
+		back += sep + "notice=" + url.QueryEscape(notice)
+	}
+
+	http.Redirect(w, r, back, http.StatusSeeOther)
+}
+
+// handleAdminUpdateConnector changes a connector in place. Its type, name,
+// config and grant types are all updatable; its id is what looks it up.
+func (s *Server) handleAdminUpdateConnector(w http.ResponseWriter, r *http.Request) {
+	if err := r.ParseForm(); err != nil {
+		s.detailRedirect(w, r, "", err.Error())
+		return
+	}
+
+	ctx, cancel := context.WithTimeout(r.Context(), 10*time.Second)
+	defer cancel()
+
+	id := r.FormValue("id")
+	req := &api.UpdateConnectorReq{
+		Id:      id,
+		NewType: r.FormValue("type"),
+		NewName: r.FormValue("name"),
+	}
+	if config := r.FormValue("config"); config != "" {
+		req.NewConfig = []byte(config)
+	}
+	// The field is a tri-state: absent leaves the restriction alone, an empty
+	// list lifts it, a list replaces it.
+	switch r.FormValue("grant_mode") {
+	case "any":
+		req.NewGrantTypes = &api.GrantTypes{}
+	case "restrict":
+		req.NewGrantTypes = &api.GrantTypes{GrantTypes: r.Form["grant_types"]}
+	}
+
+	resp, err := s.admin.api.UpdateConnector(ctx, req)
+	switch {
+	case err != nil:
+		s.detailRedirect(w, r, "", err.Error())
+	case resp.NotFound:
+		s.detailRedirect(w, r, "", fmt.Sprintf("connector %q not found", id))
+	default:
+		s.detailRedirect(w, r, fmt.Sprintf("updated connector %q", id), "")
+	}
+}
+
+// discoveryEntries asks dex what it says about itself, over the API rather than
+// by reading the document it publishes for clients.
+func (s *Server) discoveryEntries(ctx context.Context) (endpoints, capabilities []DiscoveryEntry, err error) {
+	resp, err := s.admin.api.GetDiscovery(ctx, &api.DiscoveryReq{})
+	if err != nil {
+		return nil, nil, err
+	}
+
+	for _, e := range []DiscoveryEntry{
+		{Name: "issuer", Value: resp.Issuer},
+		{Name: "authorization_endpoint", Value: resp.AuthorizationEndpoint},
+		{Name: "token_endpoint", Value: resp.TokenEndpoint},
+		{Name: "userinfo_endpoint", Value: resp.UserinfoEndpoint},
+		{Name: "jwks_uri", Value: resp.JwksUri},
+		{Name: "device_authorization_endpoint", Value: resp.DeviceAuthorizationEndpoint},
+		{Name: "introspection_endpoint", Value: resp.IntrospectionEndpoint},
+	} {
+		if e.Value != "" {
+			endpoints = append(endpoints, e)
+		}
+	}
+
+	for _, e := range []DiscoveryEntry{
+		{Name: "scopes_supported", Values: resp.ScopesSupported},
+		{Name: "grant_types_supported", Values: resp.GrantTypesSupported},
+		{Name: "response_types_supported", Values: resp.ResponseTypesSupported},
+		{Name: "claims_supported", Values: resp.ClaimsSupported},
+		{Name: "subject_types_supported", Values: resp.SubjectTypesSupported},
+		{Name: "id_token_signing_alg_values_supported", Values: resp.IdTokenSigningAlgValuesSupported},
+		{Name: "code_challenge_methods_supported", Values: resp.CodeChallengeMethodsSupported},
+		{Name: "token_endpoint_auth_methods_supported", Values: resp.TokenEndpointAuthMethodsSupported},
+	} {
+		if len(e.Values) > 0 {
+			capabilities = append(capabilities, e)
+		}
+	}
+
+	return endpoints, capabilities, nil
+}
diff --git a/examples/example-app/server/admindetail_test.go b/examples/example-app/server/admindetail_test.go
new file mode 100644
index 0000000000..bdd39a81a8
--- /dev/null
+++ b/examples/example-app/server/admindetail_test.go
@@ -0,0 +1,44 @@
+package server
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"net/url"
+	"strings"
+	"testing"
+)
+
+// The redirect target comes from a form field, so it has to stay inside the
+// app: an endpoint that bounces a browser to whatever a form says is an open
+// redirect, whatever the app is for.
+func TestDetailRedirectStaysLocal(t *testing.T) {
+	tests := []struct {
+		back string
+		want string
+	}{
+		{"/admin/client/example-app", "/admin/client/example-app?notice=done"},
+		{"/admin?section=clients", "/admin?section=clients&notice=done"},
+		{"", "/admin?notice=done"},
+		{"https://example.com/phish", "/admin?notice=done"},
+		{"//example.com/phish", "/admin?notice=done"},
+		// A browser turns the backslash into a slash, so these read as a host too.
+		{`/\example.com/phish`, "/admin?notice=done"},
+		{`/\/example.com/phish`, "/admin?notice=done"},
+		{"http://127.0.0.1:5599/", "/admin?notice=done"},
+		{"javascript:alert(1)", "/admin?notice=done"},
+	}
+
+	s := &Server{}
+	for _, tc := range tests {
+		r := httptest.NewRequest(http.MethodPost, "/admin/consent/revoke",
+			strings.NewReader(url.Values{"back": {tc.back}}.Encode()))
+		r.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+		w := httptest.NewRecorder()
+
+		s.detailRedirect(w, r, "done", "")
+
+		if got := w.Header().Get("Location"); got != tc.want {
+			t.Errorf("back=%q: redirected to %q, want %q", tc.back, got, tc.want)
+		}
+	}
+}
diff --git a/examples/example-app/server/authcode.go b/examples/example-app/server/authcode.go
new file mode 100644
index 0000000000..d48c8fe05b
--- /dev/null
+++ b/examples/example-app/server/authcode.go
@@ -0,0 +1,335 @@
+package server
+
+import (
+	"fmt"
+	"log"
+	"net/http"
+	"net/url"
+	"time"
+
+	"github.com/coreos/go-oidc/v3/oidc"
+	"golang.org/x/oauth2"
+
+	"github.com/dexidp/dex/examples/example-app/session"
+)
+
+// settleTime is how long after a check the app takes its own answer for
+// granted. It only has to outlast the redirect the check itself causes.
+const settleTime = 2 * time.Second
+
+// handleIndex renders the app's own view of who is signed in.
+//
+// Before rendering it makes sure that view is still true. An access token that
+// has expired is refreshed; if the refresh fails the sign-in is over. And every
+// so often the app asks the provider directly, with prompt=none, whether the
+// session there still exists — otherwise signing out of dex in another tab
+// would leave this app showing the user indefinitely.
+func (s *Server) handleIndex(w http.ResponseWriter, r *http.Request) {
+	sess := s.session(w, r)
+
+	if sess.SignedIn() {
+		s.refreshIfExpired(r, sess)
+	}
+
+	if s.shouldCheckProvider(sess) {
+		s.startAuth(w, r, sess, nil, "", true)
+		return
+	}
+
+	data := IndexPageData{
+		ScopesSupported: s.scopesSupported,
+		LogoURI:         dexLogoDataURI,
+		AdminEnabled:    s.admin != nil,
+		PKCE:            s.pkce,
+		SessionCheck:    s.sessionCheckInterval,
+
+		DeviceSupported:            s.deviceAuthURL != "" && s.supportsGrant(grantDeviceCode),
+		RefreshSupported:           s.supportsGrant(grantRefreshToken),
+		ClientCredentialsSupported: s.supportsGrant(grantClientCredentials),
+		PasswordSupported:          s.supportsGrant(grantPassword),
+		TokenExchangeSupported:     s.supportsGrant(grantTokenExchange),
+	}
+	if sess.SignedIn() {
+		data.User = sess.Claims
+		data.Token = tokenSummary(sess.Token, sess.IDToken)
+	}
+
+	s.renderer.RenderIndexPage(w, data)
+}
+
+// shouldCheckProvider decides whether to spend a redirect confirming the
+// session with the provider: for a signed-in browser once the app's answer has
+// gone stale, and for a browser that has not asked at all, which is how the app
+// picks up a session someone already has with dex.
+func (s *Server) shouldCheckProvider(sess *session.Session) bool {
+	if s.sessionCheckInterval <= 0 {
+		return false
+	}
+	if sess.LastProviderCheck.IsZero() {
+		return true
+	}
+
+	// A check redirects out and back, and the page it comes back to is this one.
+	// Without a floor it would ask again on that render, and again on the next:
+	// a browser bouncing through the provider forever.
+	if time.Since(sess.LastProviderCheck) < settleTime {
+		return false
+	}
+
+	// Past that, a signed-in browser is confirmed on every load. The interval
+	// only paces the check for a browser that is not signed in, where it is
+	// looking for a session rather than confirming one — a session dex has been
+	// told to end should not outlive the page it is shown on.
+	if sess.SignedIn() {
+		return true
+	}
+	return time.Since(sess.LastProviderCheck) > s.sessionCheckInterval
+}
+
+// refreshIfExpired renews an expired access token, and ends the app's session
+// if the provider will not renew it — a refresh token dex has revoked is as
+// good an answer as a failed session check.
+func (s *Server) refreshIfExpired(r *http.Request, sess *session.Session) {
+	if sess.Token == nil || sess.Token.Valid() {
+		return
+	}
+	if sess.Token.RefreshToken == "" {
+		s.sessions.SignOut(sess)
+		return
+	}
+
+	ctx := oidc.ClientContext(r.Context(), s.client)
+	token, err := s.oauth2Config(nil).TokenSource(ctx, sess.Token).Token()
+	if err != nil {
+		log.Printf("refreshing expired token: %v", err)
+		s.sessions.SignOut(sess)
+		return
+	}
+
+	claims, rawIDToken, err := s.claimsFromToken(r, token)
+	if err != nil {
+		log.Printf("verifying refreshed token: %v", err)
+		s.sessions.SignOut(sess)
+		return
+	}
+	s.sessions.SignIn(sess, claims, token, rawIDToken)
+}
+
+// handleLogin starts the authorization code flow.
+func (s *Server) handleLogin(w http.ResponseWriter, r *http.Request) {
+	if err := r.ParseForm(); err != nil {
+		http.Error(w, fmt.Sprintf("failed to parse form: %v", err), http.StatusBadRequest)
+		return
+	}
+
+	sess := s.session(w, r)
+	scopes := buildScopes(r.Form["extra_scopes"], r.Form["cross_client"])
+	s.startAuth(w, r, sess, scopes, r.FormValue("connector_id"), false)
+}
+
+// startAuth sends the browser to the provider. Each call gets its own state,
+// nonce and PKCE verifier, kept on this browser's session: they are what ties
+// the callback back to the request that started it, and reusing them across
+// requests would leave nothing to check.
+func (s *Server) startAuth(w http.ResponseWriter, r *http.Request, sess *session.Session, scopes []string, connectorID string, silent bool) {
+	if silent {
+		// A silent check needs only enough scope to identify the user.
+		scopes = []string{oidc.ScopeOpenID, "profile", "email"}
+	}
+
+	pending := s.sessions.StartAuth(sess, silent)
+
+	opts := []oauth2.AuthCodeOption{oidc.Nonce(pending.Nonce)}
+	if s.pkce {
+		opts = append(opts,
+			oauth2.SetAuthURLParam("code_challenge", oauth2.S256ChallengeFromVerifier(pending.CodeVerifier)),
+			oauth2.SetAuthURLParam("code_challenge_method", "S256"),
+		)
+	}
+	if silent {
+		opts = append(opts, oauth2.SetAuthURLParam("prompt", "none"))
+	}
+	if connectorID != "" {
+		opts = append(opts, oauth2.SetAuthURLParam("connector_id", connectorID))
+	}
+
+	// Providers that do not take offline_access as a scope want a parameter.
+	if !s.offlineAsScope && containsScope(scopes, oidc.ScopeOfflineAccess) {
+		opts = append(opts, oauth2.AccessTypeOffline)
+		scopes = withoutScope(scopes, oidc.ScopeOfflineAccess)
+	}
+
+	http.Redirect(w, r, s.oauth2Config(scopes).AuthCodeURL(pending.State, opts...), http.StatusSeeOther)
+}
+
+// handleAuthCallback finishes an authorization this browser started.
+func (s *Server) handleAuthCallback(w http.ResponseWriter, r *http.Request) {
+	sess := s.session(w, r)
+
+	state := r.FormValue("state")
+	pending, ok := s.sessions.TakeAuth(sess, state)
+	if !ok {
+		// A state is good for one callback, so coming back to this URL — the
+		// browser's Back button, a reload, a bookmark — finds nothing pending.
+		// For a browser that already holds what the callback produced that is
+		// not an error, it is the page it is looking for.
+		if sess.LastTokens != nil {
+			http.Redirect(w, r, "/tokens", http.StatusSeeOther)
+			return
+		}
+		http.Error(w, "no authorization in progress for this state — a callback is good once, so start the flow again", http.StatusBadRequest)
+		return
+	}
+
+	// A silent check answers a question, so its failure is a result: the
+	// provider has no session for this browser, and neither should the app.
+	if pending.Silent {
+		s.sessions.MarkChecked(sess)
+
+		if r.FormValue("error") != "" {
+			// The provider has no session for this browser. Whether it never had
+			// one or has just been told to end it, the app has no business
+			// showing a signed-in user either way.
+			s.sessions.SignOut(sess)
+			http.Redirect(w, r, "/", http.StatusFound)
+			return
+		}
+
+		if err := s.completeAuth(w, r, sess, pending); err != nil {
+			log.Printf("silent session check: %v", err)
+			s.sessions.SignOut(sess)
+		}
+		http.Redirect(w, r, "/", http.StatusFound)
+		return
+	}
+
+	if errMsg := r.FormValue("error"); errMsg != "" {
+		http.Error(w, errMsg+": "+r.FormValue("error_description"), http.StatusBadRequest)
+		return
+	}
+
+	if err := s.completeAuth(w, r, sess, pending); err != nil {
+		http.Error(w, err.Error(), http.StatusInternalServerError)
+		return
+	}
+
+	// The result lives at its own address rather than at the callback: a page
+	// rendered on a URL that carries a one-use code is a page that cannot be
+	// reloaded or come back to.
+	s.sessions.RememberTokens(sess, "Authorization code", sess.Token, sess.IDToken)
+	http.Redirect(w, r, "/tokens", http.StatusSeeOther)
+}
+
+// completeAuth exchanges the code and records the sign-in.
+func (s *Server) completeAuth(w http.ResponseWriter, r *http.Request, sess *session.Session, pending *session.PendingAuth) error {
+	code := r.FormValue("code")
+	if code == "" {
+		return fmt.Errorf("no code in callback: %q", r.URL.RawQuery)
+	}
+
+	ctx := oidc.ClientContext(r.Context(), s.client)
+
+	var opts []oauth2.AuthCodeOption
+	if s.pkce {
+		opts = append(opts, oauth2.VerifierOption(pending.CodeVerifier))
+	}
+
+	token, err := s.oauth2Config(nil).Exchange(ctx, code, opts...)
+	if err != nil {
+		return fmt.Errorf("failed to get token: %v", err)
+	}
+
+	claims, rawIDToken, err := s.claimsFromToken(r, token)
+	if err != nil {
+		return err
+	}
+
+	// The nonce ties the ID token to the authorization this browser started.
+	idToken, err := s.verifier.Verify(r.Context(), rawIDToken)
+	if err == nil && idToken.Nonce != pending.Nonce {
+		return fmt.Errorf("id token nonce does not match the authorization request")
+	}
+
+	// A silent check confirms who is signed in; it does not re-issue the
+	// sign-in. Its token set is narrower than the one the flow asked for — no
+	// offline_access, so no refresh token — and storing it would quietly cost
+	// the app the refresh token it already had.
+	if pending.Silent && sess.Token != nil {
+		s.sessions.Confirm(sess, claims)
+		return nil
+	}
+
+	s.sessions.SignIn(sess, claims, token, rawIDToken)
+	return nil
+}
+
+// claimsFromToken verifies the ID token in a token response and returns its
+// claims. A response without one is not an error for every grant, so callers
+// that can live without it check the returned raw token instead.
+func (s *Server) claimsFromToken(r *http.Request, token *oauth2.Token) (*session.UserClaims, string, error) {
+	rawIDToken, ok := token.Extra("id_token").(string)
+	if !ok {
+		return nil, "", fmt.Errorf("no id_token in token response")
+	}
+
+	idToken, err := s.verifier.Verify(r.Context(), rawIDToken)
+	if err != nil {
+		return nil, "", fmt.Errorf("failed to verify ID token: %v", err)
+	}
+
+	var claims session.UserClaims
+	if err := idToken.Claims(&claims); err != nil {
+		return nil, "", fmt.Errorf("failed to decode ID token claims: %v", err)
+	}
+	return &claims, rawIDToken, nil
+}
+
+// handleLogout ends the app's session and, when the provider supports it, the
+// provider's session too.
+func (s *Server) handleLogout(w http.ResponseWriter, r *http.Request) {
+	sess := s.session(w, r)
+	idToken := s.sessions.SignOut(sess)
+
+	if s.endSessionEndpoint == "" {
+		http.Redirect(w, r, "/", http.StatusFound)
+		return
+	}
+
+	logoutURL, err := url.Parse(s.endSessionEndpoint)
+	if err != nil {
+		http.Redirect(w, r, "/", http.StatusFound)
+		return
+	}
+
+	q := logoutURL.Query()
+	if idToken != "" {
+		q.Set("id_token_hint", idToken)
+	}
+	if appURL, err := url.Parse(s.redirectURI); err == nil {
+		appURL.Path = "/"
+		appURL.RawQuery = ""
+		q.Set("post_logout_redirect_uri", appURL.String())
+	}
+	logoutURL.RawQuery = q.Encode()
+
+	http.Redirect(w, r, logoutURL.String(), http.StatusFound)
+}
+
+func containsScope(scopes []string, want string) bool {
+	for _, s := range scopes {
+		if s == want {
+			return true
+		}
+	}
+	return false
+}
+
+func withoutScope(scopes []string, drop string) []string {
+	out := make([]string, 0, len(scopes))
+	for _, s := range scopes {
+		if s != drop {
+			out = append(out, s)
+		}
+	}
+	return out
+}
diff --git a/examples/example-app/server/backchannel.go b/examples/example-app/server/backchannel.go
new file mode 100644
index 0000000000..8558551a6a
--- /dev/null
+++ b/examples/example-app/server/backchannel.go
@@ -0,0 +1,167 @@
+package server
+
+import (
+	"encoding/json"
+	"fmt"
+	"log"
+	"net/http"
+	"time"
+
+	"github.com/coreos/go-oidc/v3/oidc"
+
+	"github.com/dexidp/dex/examples/example-app/session"
+)
+
+// backchannelLogoutEvent is the member a logout token's "events" claim must
+// carry, per OIDC Back-Channel Logout 1.0 §2.4. Its presence is what separates a
+// logout token from an ID token that happens to be POSTed here.
+const backchannelLogoutEvent = "http://schemas.openid.net/event/backchannel-logout"
+
+// logoutTokenClaims are the parts of a logout token this app reads.
+type logoutTokenClaims struct {
+	Events    map[string]json.RawMessage `json:"events"`
+	SessionID string                     `json:"sid"`
+	Nonce     string                     `json:"nonce"`
+}
+
+// handleBackchannelLogout receives a logout token from the provider and ends the
+// sessions it names.
+//
+// This is the half of single logout that does not involve the browser: dex POSTs
+// here directly, so a user who signs out somewhere else stops being signed in
+// here even if they never load a page. The app also runs a prompt=none check on
+// page load, which catches the same thing eventually — the difference is that
+// this arrives immediately, and works for a tab nobody is looking at.
+//
+// Validation follows Back-Channel Logout 1.0 §2.6. The signature, issuer,
+// audience and expiry checks come from the same verifier the app uses for ID
+// tokens; the rest is checked here.
+func (s *Server) handleBackchannelLogout(w http.ResponseWriter, r *http.Request) {
+	// §2.7: the response must not be cached, whatever it says.
+	w.Header().Set("Cache-Control", "no-cache, no-store")
+
+	if err := r.ParseForm(); err != nil {
+		backchannelError(w, "invalid_request", "could not parse form")
+		return
+	}
+
+	raw := r.PostFormValue("logout_token")
+	if raw == "" {
+		backchannelError(w, "invalid_request", "no logout_token in request")
+		return
+	}
+
+	ctx := oidc.ClientContext(r.Context(), s.client)
+
+	// Signature, iss, aud and exp. A logout token is signed and audienced exactly
+	// like an ID token, so the same verifier applies — which is also why the
+	// checks below matter: without them an ID token would pass for one.
+	token, err := s.verifier.Verify(ctx, raw)
+	if err != nil {
+		backchannelError(w, "invalid_request", "logout token did not verify: "+err.Error())
+		return
+	}
+
+	var claims logoutTokenClaims
+	if err := token.Claims(&claims); err != nil {
+		backchannelError(w, "invalid_request", "could not decode logout token claims")
+		return
+	}
+
+	if _, ok := claims.Events[backchannelLogoutEvent]; !ok {
+		backchannelError(w, "invalid_request", "logout token has no backchannel-logout event")
+		return
+	}
+
+	// §2.4 forbids a nonce, precisely so that an ID token replayed to this
+	// endpoint cannot be mistaken for a logout token.
+	if claims.Nonce != "" {
+		backchannelError(w, "invalid_request", "logout token must not contain a nonce")
+		return
+	}
+
+	if token.Subject == "" && claims.SessionID == "" {
+		backchannelError(w, "invalid_request", "logout token has neither sub nor sid")
+		return
+	}
+
+	// Replay detection on jti is left out. It is optional in §2.6, and a repeated
+	// logout token can only sign out a session that is already signed out. A real
+	// relying party with side effects on logout should keep recently seen jti
+	// values until their tokens expire.
+
+	// The result is shown on the home page rather than logged: what makes this
+	// worth seeing is when the token arrived relative to the next page load, and
+	// that comparison only means anything on the page itself.
+	s.sessions.SignOutByBackchannel(claims.SessionID, token.Subject)
+
+	w.WriteHeader(http.StatusOK)
+}
+
+// backchannelError writes the JSON error body §2.7 asks for.
+func backchannelError(w http.ResponseWriter, code, description string) {
+	log.Printf("back-channel logout rejected: %s: %s", code, description)
+
+	w.Header().Set("Content-Type", "application/json")
+	w.WriteHeader(http.StatusBadRequest)
+	_ = json.NewEncoder(w).Encode(map[string]string{
+		"error":             code,
+		"error_description": description,
+	})
+}
+
+// handleEvents streams this browser's session events over SSE.
+//
+// The stream is what makes a back channel observable. Without it the earliest a
+// page could learn its session had ended is the next request it makes — and a
+// request is exactly when the app's own prompt=none check would have found out
+// anyway, so a message delivered then demonstrates nothing.
+func (s *Server) handleEvents(w http.ResponseWriter, r *http.Request) {
+	flusher, ok := w.(http.Flusher)
+	if !ok {
+		http.Error(w, "streaming unsupported", http.StatusInternalServerError)
+		return
+	}
+
+	// Watch an existing browser, never mint one. This endpoint is opened by a page
+	// that already has a session; handing a cookie to anything that connects would
+	// let a crawler fill the store with sessions nobody is behind.
+	cookie, err := r.Cookie(session.CookieName)
+	if err != nil || cookie.Value == "" {
+		w.WriteHeader(http.StatusNoContent)
+		return
+	}
+
+	notices, stop := s.sessions.Watch(cookie.Value)
+	defer stop()
+
+	w.Header().Set("Content-Type", "text/event-stream")
+	w.Header().Set("Cache-Control", "no-cache")
+	w.Header().Set("Connection", "keep-alive")
+	w.WriteHeader(http.StatusOK)
+	flusher.Flush()
+
+	// Idle streams are kept alive with comments, which proxies and browsers both
+	// leave alone.
+	ping := time.NewTicker(25 * time.Second)
+	defer ping.Stop()
+
+	for {
+		select {
+		case <-r.Context().Done():
+			return
+
+		case <-ping.C:
+			fmt.Fprint(w, ": ping\n\n")
+			flusher.Flush()
+
+		case notice := <-notices:
+			payload, err := json.Marshal(notice)
+			if err != nil {
+				return
+			}
+			fmt.Fprintf(w, "event: backchannel-logout\ndata: %s\n\n", payload)
+			flusher.Flush()
+		}
+	}
+}
diff --git a/examples/example-app/server/devicecode.go b/examples/example-app/server/devicecode.go
new file mode 100644
index 0000000000..6307c84d21
--- /dev/null
+++ b/examples/example-app/server/devicecode.go
@@ -0,0 +1,210 @@
+package server
+
+import (
+	"bytes"
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"net/url"
+	"strings"
+
+	"golang.org/x/oauth2"
+
+	"github.com/dexidp/dex/examples/example-app/session"
+)
+
+// handleDeviceStart initiates the Device Code Flow by requesting a device code from the IdP.
+func (s *Server) handleDeviceStart(w http.ResponseWriter, r *http.Request) {
+	var reqBody struct {
+		Scopes       []string `json:"scopes"`
+		CrossClients []string `json:"cross_clients"`
+		ConnectorID  string   `json:"connector_id"`
+	}
+
+	if err := json.NewDecoder(r.Body).Decode(&reqBody); err != nil {
+		http.Error(w, fmt.Sprintf("failed to parse request body: %v", err), http.StatusBadRequest)
+		return
+	}
+
+	scopes := buildScopes(reqBody.Scopes, reqBody.CrossClients)
+
+	data := url.Values{}
+	data.Set("client_id", s.clientID)
+	data.Set("client_secret", s.clientSecret)
+	data.Set("scope", strings.Join(scopes, " "))
+	if reqBody.ConnectorID != "" {
+		data.Set("connector_id", reqBody.ConnectorID)
+	}
+
+	resp, err := s.client.PostForm(s.deviceAuthURL, data)
+	if err != nil {
+		http.Error(w, fmt.Sprintf("Failed to request device code: %v", err), http.StatusInternalServerError)
+		return
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode != http.StatusOK {
+		body := new(bytes.Buffer)
+		body.ReadFrom(resp.Body)
+		http.Error(w, fmt.Sprintf("Device code request failed: %s", body.String()), resp.StatusCode)
+		return
+	}
+
+	var deviceResp struct {
+		DeviceCode      string `json:"device_code"`
+		UserCode        string `json:"user_code"`
+		VerificationURI string `json:"verification_uri"`
+		ExpiresIn       int    `json:"expires_in"`
+		Interval        int    `json:"interval"`
+	}
+
+	if err := json.NewDecoder(resp.Body).Decode(&deviceResp); err != nil {
+		http.Error(w, fmt.Sprintf("Failed to decode device response: %v", err), http.StatusInternalServerError)
+		return
+	}
+
+	pollInterval := deviceResp.Interval
+	if pollInterval == 0 {
+		pollInterval = 5
+	}
+
+	s.sessions.StartDevice(s.session(w, r), &session.Device{
+		DeviceCode:      deviceResp.DeviceCode,
+		UserCode:        deviceResp.UserCode,
+		VerificationURI: deviceResp.VerificationURI,
+		PollInterval:    pollInterval,
+	})
+
+	w.Header().Set("Content-Type", "application/json")
+	json.NewEncoder(w).Encode(map[string]any{"status": "ok"})
+}
+
+// handleDeviceStatus renders the device flow pending page with verification URL and user code.
+func (s *Server) handleDeviceStatus(w http.ResponseWriter, r *http.Request) {
+	device := s.session(w, r).Device
+	if device == nil {
+		http.Error(w, "No device flow in progress", http.StatusBadRequest)
+		return
+	}
+
+	s.renderer.RenderDevicePage(w, DevicePageData{
+		AdminEnabled:    s.admin != nil,
+		DeviceCode:      device.DeviceCode,
+		UserCode:        device.UserCode,
+		VerificationURI: device.VerificationURI,
+		PollInterval:    device.PollInterval,
+		LogoURI:         dexLogoDataURI,
+	})
+}
+
+// handleDevicePoll polls the token endpoint on behalf of the device.
+func (s *Server) handleDevicePoll(w http.ResponseWriter, r *http.Request) {
+	sess := s.session(w, r)
+	device := sess.Device
+	if device == nil {
+		w.Header().Set("Content-Type", "application/json")
+		w.WriteHeader(http.StatusGone)
+		json.NewEncoder(w).Encode(map[string]any{
+			"error":             "no_device_flow",
+			"error_description": "This browser has no device flow in progress",
+		})
+		return
+	}
+
+	// If we already have a token, return success.
+	if device.Token != nil {
+		w.Header().Set("Content-Type", "application/json")
+		json.NewEncoder(w).Encode(map[string]string{"status": "complete"})
+		return
+	}
+
+	// Poll the token endpoint.
+	data := url.Values{}
+	data.Set("grant_type", "urn:ietf:params:oauth:grant-type:device_code")
+	data.Set("device_code", device.DeviceCode)
+	data.Set("client_id", s.clientID)
+	data.Set("client_secret", s.clientSecret)
+
+	tokenResp, err := s.client.PostForm(s.provider.Endpoint().TokenURL, data)
+	if err != nil {
+		w.Header().Set("Content-Type", "application/json")
+		json.NewEncoder(w).Encode(map[string]string{"status": "pending"})
+		return
+	}
+	defer tokenResp.Body.Close()
+
+	if tokenResp.StatusCode == http.StatusOK {
+		var tokenData struct {
+			AccessToken  string `json:"access_token"`
+			TokenType    string `json:"token_type"`
+			RefreshToken string `json:"refresh_token"`
+			ExpiresIn    int    `json:"expires_in"`
+			IDToken      string `json:"id_token"`
+		}
+
+		if err := json.NewDecoder(tokenResp.Body).Decode(&tokenData); err != nil {
+			http.Error(w, "Failed to decode token", http.StatusInternalServerError)
+			return
+		}
+
+		token := (&oauth2.Token{
+			AccessToken:  tokenData.AccessToken,
+			TokenType:    tokenData.TokenType,
+			RefreshToken: tokenData.RefreshToken,
+		}).WithExtra(map[string]any{
+			"id_token": tokenData.IDToken,
+		})
+
+		s.sessions.SetDeviceToken(sess, token)
+
+		w.Header().Set("Content-Type", "application/json")
+		json.NewEncoder(w).Encode(map[string]string{"status": "complete"})
+		return
+	}
+
+	// Check for OAuth2 error response.
+	var errorResp struct {
+		Error            string `json:"error"`
+		ErrorDescription string `json:"error_description"`
+	}
+
+	if err := json.NewDecoder(tokenResp.Body).Decode(&errorResp); err == nil {
+		if errorResp.Error == "authorization_pending" {
+			w.Header().Set("Content-Type", "application/json")
+			json.NewEncoder(w).Encode(map[string]string{"status": "pending"})
+			return
+		}
+
+		w.Header().Set("Content-Type", "application/json")
+		w.WriteHeader(tokenResp.StatusCode)
+		json.NewEncoder(w).Encode(map[string]any{
+			"error":             errorResp.Error,
+			"error_description": errorResp.ErrorDescription,
+		})
+		return
+	}
+
+	// Unknown response — treat as pending.
+	w.Header().Set("Content-Type", "application/json")
+	json.NewEncoder(w).Encode(map[string]string{"status": "pending"})
+}
+
+// handleDeviceComplete displays the token obtained via the Device Code Flow and
+// signs this browser in with it, the same as any other completed flow.
+func (s *Server) handleDeviceComplete(w http.ResponseWriter, r *http.Request) {
+	sess := s.session(w, r)
+	if sess.Device == nil || sess.Device.Token == nil {
+		http.Error(w, "No token available", http.StatusBadRequest)
+		return
+	}
+
+	token := sess.Device.Token
+	rawIDToken, _ := token.Extra("id_token").(string)
+	if claims, raw, err := s.claimsFromToken(r, token); err == nil {
+		s.sessions.SignIn(sess, claims, token, raw)
+		rawIDToken = raw
+	}
+
+	s.sessions.RememberTokens(sess, "Device code", token, rawIDToken)
+	http.Redirect(w, r, "/tokens", http.StatusSeeOther)
+}
diff --git a/examples/example-app/server/forms.go b/examples/example-app/server/forms.go
new file mode 100644
index 0000000000..3778d6a780
--- /dev/null
+++ b/examples/example-app/server/forms.go
@@ -0,0 +1,228 @@
+package server
+
+import "net/http"
+
+// A form page is one flow's parameters and nothing else. The front page lists
+// flows; choosing one opens its form. That split is the whole point: parameters
+// for six grants on one screen is a wall of inputs with no way to tell which
+// belong together, and every one of them is irrelevant to whatever you came to
+// do.
+type Field struct {
+	Name        string
+	Label       string
+	Hint        string
+	Type        string // text, password, textarea, select, scopes
+	Placeholder string
+	Value       string
+	Options     []Option
+	Required    bool
+	Wide        bool // full-width control, for tokens rather than identifiers
+}
+
+// scopeField offers the scopes the provider advertises, with the usual ones
+// ticked — the same control the browser flows use, rather than a text box you
+// have to know the spelling for.
+func (s *Server) scopeField(defaults ...string) Field {
+	chosen := make(map[string]bool, len(defaults))
+	for _, d := range defaults {
+		chosen[d] = true
+	}
+
+	options := make([]Option, 0, len(s.scopesSupported))
+	for _, scope := range s.scopesSupported {
+		options = append(options, Option{Value: scope, Label: scope, Selected: chosen[scope]})
+	}
+
+	return Field{
+		Name:    "scopes",
+		Label:   "Scopes",
+		Type:    "scopes",
+		Wide:    true,
+		Options: options,
+		Hint:    "What the token should be good for. Add any the provider does not advertise.",
+	}
+}
+
+// Option is one choice in a select or scope field.
+type Option struct {
+	Value    string
+	Label    string
+	Selected bool
+}
+
+// FormPageData is a page that asks for parameters and posts them somewhere.
+type FormPageData struct {
+	LogoURI      string
+	AdminEnabled bool
+	Title        string
+	Description  string
+	Note         string
+	Action       string
+	Submit       string
+	Fields       []Field
+}
+
+// handleGrantForm serves the parameters for one direct grant.
+func (s *Server) handleGrantForm(w http.ResponseWriter, r *http.Request) {
+	sess := s.session(w, r)
+
+	var data FormPageData
+	switch r.PathValue("grant") {
+	case "client-credentials":
+		data = FormPageData{
+			Title:       "Client credentials",
+			Description: "A token for this application itself. There is no user in this flow, and so no ID token — what comes back says only which client it belongs to.",
+			Action:      "/grant/client-credentials",
+			Submit:      "Request token",
+			Fields:      []Field{s.scopeField("openid")},
+		}
+	case "password":
+		data = FormPageData{
+			Title:       "Password",
+			Description: "Exchanges a username and password for tokens directly.",
+			Note:        "Deprecated. The password passes through this application instead of staying at the provider, which is the thing OAuth exists to avoid. dex allows it only when oauth2.passwordConnector names a connector.",
+			Action:      "/grant/password",
+			Submit:      "Request token",
+			Fields: []Field{
+				{Name: "username", Label: "Username", Type: "text", Placeholder: "user@example.com", Required: true},
+				{Name: "password", Label: "Password", Type: "password", Required: true},
+				s.scopeField("openid", "profile", "email", "offline_access"),
+			},
+		}
+	case "token-exchange":
+		data = FormPageData{
+			Title:       "Token exchange",
+			Description: "RFC 8693. Trades a token issued elsewhere for one issued by dex.",
+			Note:        "dex requires connector_id, which is an extension to the RFC: the connector is what verifies the subject token, so it must be one that can.",
+			Action:      "/grant/token-exchange",
+			Submit:      "Exchange",
+			Fields: []Field{
+				{Name: "subject_token", Label: "Subject token", Type: "textarea", Required: true, Wide: true, Hint: "The token you are trading in."},
+				{Name: "connector_id", Label: "Connector", Type: "text", Placeholder: "mock", Required: true, Hint: "Which connector verifies the subject token."},
+				{
+					Name: "subject_token_type", Label: "Subject token type", Type: "select",
+					Options: []Option{
+						{Value: tokenTypeAccess, Label: "Access token"},
+						{Value: tokenTypeID, Label: "ID token"},
+					},
+				},
+				{
+					Name: "requested_token_type", Label: "Requested token type", Type: "select",
+					Options: []Option{
+						{Value: "", Label: "Default (access token)"},
+						{Value: tokenTypeID, Label: "ID token"},
+						{Value: tokenTypeAccess, Label: "Access token"},
+					},
+				},
+				s.scopeField("openid"),
+			},
+		}
+	case "refresh":
+		value := ""
+		if sess.LastTokens != nil {
+			value = sess.LastTokens.RefreshToken
+		}
+		if value == "" && sess.Token != nil {
+			value = sess.Token.RefreshToken
+		}
+		data = FormPageData{
+			Title:       "Refresh",
+			Description: "Redeems a refresh token for a new set of tokens. dex rotates the refresh token, so the one that comes back replaces the one you sent.",
+			Action:      "/grant/refresh",
+			Submit:      "Redeem",
+			Fields: []Field{
+				{Name: "refresh_token", Label: "Refresh token", Type: "textarea", Required: true, Wide: true, Value: value},
+			},
+		}
+	default:
+		http.NotFound(w, r)
+		return
+	}
+
+	data.LogoURI = dexLogoDataURI
+	data.AdminEnabled = s.admin != nil
+	s.renderer.RenderFormPage(w, data)
+}
+
+// handleToolForm serves the parameters for one token tool.
+func (s *Server) handleToolForm(w http.ResponseWriter, r *http.Request) {
+	sess := s.session(w, r)
+
+	// Whatever this browser last got back is the likeliest thing to want to look
+	// at, so it is filled in already — including from flows that sign nobody in.
+	var accessToken, idToken, refreshToken string
+	if sess.LastTokens != nil {
+		accessToken = sess.LastTokens.AccessToken
+		refreshToken = sess.LastTokens.RefreshToken
+		idToken = sess.LastIDToken
+	} else if sess.Token != nil {
+		accessToken = sess.Token.AccessToken
+		refreshToken = sess.Token.RefreshToken
+		idToken = sess.IDToken
+	}
+
+	// Introspection takes any of the three, so the page offers whichever this
+	// browser holds rather than filling in one and leaving the rest to a paste.
+	held := []Option{}
+	if accessToken != "" {
+		held = append(held, Option{Value: accessToken, Label: "access token"})
+	}
+	if idToken != "" {
+		held = append(held, Option{Value: idToken, Label: "ID token"})
+	}
+	if refreshToken != "" {
+		held = append(held, Option{Value: refreshToken, Label: "refresh token"})
+	}
+
+	var data FormPageData
+	switch r.PathValue("tool") {
+	case "introspect":
+		data = FormPageData{
+			Title:       "Introspection",
+			Description: "Asks dex what it makes of a token — access, ID or refresh. This is the only way to learn that one has been revoked: a revoked token still has a valid signature.",
+			Action:      "/tools/introspect",
+			Submit:      "Introspect",
+			Fields: []Field{
+				{Name: "token", Label: "Token", Type: "textarea", Required: true, Wide: true, Value: accessToken, Options: held,
+					Hint: "Any token dex issued."},
+				{
+					Name: "token_type_hint", Label: "Type hint", Type: "select",
+					Hint: "Optional — dex works the type out from the token itself and only logs a mismatch.",
+					Options: []Option{
+						{Value: "", Label: "no hint"},
+						{Value: "access_token", Label: "access_token"},
+						{Value: "id_token", Label: "id_token"},
+						{Value: "refresh_token", Label: "refresh_token"},
+					},
+				},
+			},
+		}
+	case "verify":
+		data = FormPageData{
+			Title:       "Local verification",
+			Description: "Checks the signature against the issuer's published keys and reads the claims, the way a resource server would. It says nothing about revocation.",
+			Action:      "/tools/verify",
+			Submit:      "Verify",
+			Fields: []Field{
+				{Name: "token", Label: "JWT", Type: "textarea", Required: true, Wide: true, Value: idToken},
+			},
+		}
+	case "userinfo":
+		data = FormPageData{
+			Title:       "UserInfo",
+			Description: "Calls the provider's UserInfo endpoint with an access token, which is how a client gets claims it did not ask to have in the ID token.",
+			Action:      "/userinfo",
+			Submit:      "Call UserInfo",
+			Fields: []Field{
+				{Name: "access_token", Label: "Access token", Type: "textarea", Required: true, Wide: true, Value: accessToken},
+			},
+		}
+	default:
+		http.NotFound(w, r)
+		return
+	}
+
+	data.LogoURI = dexLogoDataURI
+	data.AdminEnabled = s.admin != nil
+	s.renderer.RenderFormPage(w, data)
+}
diff --git a/examples/example-app/server/grants.go b/examples/example-app/server/grants.go
new file mode 100644
index 0000000000..5d33540320
--- /dev/null
+++ b/examples/example-app/server/grants.go
@@ -0,0 +1,207 @@
+package server
+
+import (
+	"fmt"
+	"io"
+	"net/http"
+	"net/url"
+	"strings"
+	"time"
+
+	"github.com/coreos/go-oidc/v3/oidc"
+	"golang.org/x/oauth2"
+	"golang.org/x/oauth2/clientcredentials"
+)
+
+// Token type URNs from RFC 8693.
+const (
+	tokenTypeAccess = "urn:ietf:params:oauth:token-type:access_token"
+	tokenTypeID     = "urn:ietf:params:oauth:token-type:id_token"
+)
+
+// Grant type identifiers, as they appear in the provider's metadata.
+const (
+	grantAuthorizationCode = "authorization_code"
+	grantRefreshToken      = "refresh_token"
+	grantDeviceCode        = "urn:ietf:params:oauth:grant-type:device_code"
+	grantTokenExchange     = "urn:ietf:params:oauth:grant-type:token-exchange"
+	grantClientCredentials = "client_credentials"
+	grantPassword          = "password"
+)
+
+// handleRefreshGrant redeems a refresh token for a new token set. The token
+// comes from the form rather than the session so that a refresh token from
+// anywhere — another flow, a copy-paste — can be tried here.
+func (s *Server) handleRefreshGrant(w http.ResponseWriter, r *http.Request) {
+	refresh := r.FormValue("refresh_token")
+	if refresh == "" {
+		http.Error(w, "refresh_token is required", http.StatusBadRequest)
+		return
+	}
+
+	ctx := oidc.ClientContext(r.Context(), s.client)
+
+	// An expiry in the past is what tells the token source to redeem it now.
+	stale := &oauth2.Token{RefreshToken: refresh, Expiry: time.Now().Add(-time.Hour)}
+	token, err := s.oauth2Config(nil).TokenSource(ctx, stale).Token()
+	if err != nil {
+		http.Error(w, fmt.Sprintf("refresh failed: %v", err), http.StatusBadRequest)
+		return
+	}
+
+	// A refresh renews this browser's sign-in as well, when it produced one.
+	sess := s.session(w, r)
+	if claims, rawIDToken, err := s.claimsFromToken(r, token); err == nil {
+		s.sessions.SignIn(sess, claims, token, rawIDToken)
+	}
+
+	s.renderToken(w, r, "Refresh token", token)
+}
+
+// handleClientCredentialsGrant gets a token for the application itself. There
+// is no user in this flow, so there is no ID token either — what comes back
+// says only which client it belongs to.
+func (s *Server) handleClientCredentialsGrant(w http.ResponseWriter, r *http.Request) {
+	if err := r.ParseForm(); err != nil {
+		http.Error(w, fmt.Sprintf("failed to parse form: %v", err), http.StatusBadRequest)
+		return
+	}
+
+	cfg := clientcredentials.Config{
+		ClientID:     s.clientID,
+		ClientSecret: s.clientSecret,
+		TokenURL:     s.provider.Endpoint().TokenURL,
+		Scopes:       r.Form["scopes"],
+	}
+
+	ctx := oidc.ClientContext(r.Context(), s.client)
+	token, err := cfg.Token(ctx)
+	if err != nil {
+		http.Error(w, fmt.Sprintf("client credentials grant failed: %v", err), http.StatusBadRequest)
+		return
+	}
+
+	s.renderToken(w, r, "Client credentials", token)
+}
+
+// handlePasswordGrant exchanges a username and password for tokens.
+//
+// The flow is deprecated — it puts the user's password through the application
+// rather than keeping it at the provider, which is the thing OAuth exists to
+// avoid — and dex only allows it for clients and connectors configured for it.
+// It is here because dex still implements it and an example app is where you
+// find out whether your configuration works.
+func (s *Server) handlePasswordGrant(w http.ResponseWriter, r *http.Request) {
+	if err := r.ParseForm(); err != nil {
+		http.Error(w, fmt.Sprintf("failed to parse form: %v", err), http.StatusBadRequest)
+		return
+	}
+
+	username, password := r.FormValue("username"), r.FormValue("password")
+	if username == "" || password == "" {
+		http.Error(w, "username and password are required", http.StatusBadRequest)
+		return
+	}
+
+	ctx := oidc.ClientContext(r.Context(), s.client)
+	cfg := s.oauth2Config(r.Form["scopes"])
+	token, err := cfg.PasswordCredentialsToken(ctx, username, password)
+	if err != nil {
+		http.Error(w, fmt.Sprintf("password grant failed: %v", err), http.StatusBadRequest)
+		return
+	}
+
+	s.renderToken(w, r, "Password", token)
+}
+
+// handleTokenExchangeGrant trades a token from a connector for one issued by
+// dex (RFC 8693).
+//
+// The response carries a single token and an issued_token_type rather than the
+// usual set, so the app reads it directly instead of through the oauth2
+// library. dex also requires connector_id, which is an extension to the RFC:
+// the connector is what verifies the subject token.
+func (s *Server) handleTokenExchangeGrant(w http.ResponseWriter, r *http.Request) {
+	if err := r.ParseForm(); err != nil {
+		http.Error(w, fmt.Sprintf("failed to parse form: %v", err), http.StatusBadRequest)
+		return
+	}
+
+	subjectToken := r.FormValue("subject_token")
+	connectorID := r.FormValue("connector_id")
+	if subjectToken == "" || connectorID == "" {
+		http.Error(w, "subject_token and connector_id are required", http.StatusBadRequest)
+		return
+	}
+
+	subjectTokenType := r.FormValue("subject_token_type")
+	if subjectTokenType == "" {
+		subjectTokenType = tokenTypeAccess
+	}
+
+	form := url.Values{
+		"grant_type":         {"urn:ietf:params:oauth:grant-type:token-exchange"},
+		"subject_token":      {subjectToken},
+		"subject_token_type": {subjectTokenType},
+		"connector_id":       {connectorID},
+	}
+	if v := r.FormValue("requested_token_type"); v != "" {
+		form.Set("requested_token_type", v)
+	}
+	if scopes := r.Form["scopes"]; len(scopes) > 0 {
+		form.Set("scope", strings.Join(scopes, " "))
+	}
+
+	body, err := s.postToTokenEndpoint(r, form)
+	if err != nil {
+		http.Error(w, fmt.Sprintf("token exchange failed: %v", err), http.StatusBadRequest)
+		return
+	}
+
+	s.renderRawToken(w, r, "Token exchange", body)
+}
+
+// postToTokenEndpoint posts a form to the token endpoint with client
+// authentication and returns the response body.
+func (s *Server) postToTokenEndpoint(r *http.Request, form url.Values) ([]byte, error) {
+	req, err := http.NewRequestWithContext(r.Context(), http.MethodPost, s.provider.Endpoint().TokenURL, strings.NewReader(form.Encode()))
+	if err != nil {
+		return nil, err
+	}
+	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+	req.SetBasicAuth(url.QueryEscape(s.clientID), url.QueryEscape(s.clientSecret))
+
+	resp, err := s.client.Do(req)
+	if err != nil {
+		return nil, err
+	}
+	defer resp.Body.Close()
+
+	body, err := io.ReadAll(resp.Body)
+	if err != nil {
+		return nil, err
+	}
+	if resp.StatusCode != http.StatusOK {
+		return nil, fmt.Errorf("%s: %s", resp.Status, strings.TrimSpace(string(body)))
+	}
+	return body, nil
+}
+
+// buildScopes assembles the scope list for an authorization request.
+func buildScopes(extraScopes, crossClients []string) []string {
+	scopes := []string{oidc.ScopeOpenID}
+	seen := map[string]bool{oidc.ScopeOpenID: true}
+
+	for _, scope := range extraScopes {
+		if scope != "" && !seen[scope] {
+			scopes = append(scopes, scope)
+			seen[scope] = true
+		}
+	}
+	for _, client := range crossClients {
+		if client != "" {
+			scopes = append(scopes, "audience:server:client_id:"+client)
+		}
+	}
+	return scopes
+}
diff --git a/examples/example-app/server/render.go b/examples/example-app/server/render.go
new file mode 100644
index 0000000000..f1e5269d52
--- /dev/null
+++ b/examples/example-app/server/render.go
@@ -0,0 +1,397 @@
+package server
+
+import (
+	"embed"
+	"html/template"
+	"io/fs"
+	"log"
+	"net/http"
+	"time"
+
+	"golang.org/x/oauth2"
+
+	"github.com/dexidp/dex/examples/example-app/session"
+)
+
+//go:embed templates/*.html
+var templatesFS embed.FS
+
+//go:embed static/*
+var staticFS embed.FS
+
+const dexLogoDataURI = "/static/dex-glyph-color.svg"
+
+// staticHandler serves embedded static assets.
+var staticHandler http.Handler
+
+func init() {
+	staticSubFS, err := fs.Sub(staticFS, "static")
+	if err != nil {
+		log.Fatalf("failed to create static sub filesystem: %v", err)
+	}
+	staticHandler = http.FileServer(http.FS(staticSubFS))
+}
+
+// TokenSummary is what the index page says about the tokens this browser holds.
+type TokenSummary struct {
+	AccessToken  string
+	IDToken      string
+	RefreshToken bool
+	Expiry       string
+	Expired      bool
+}
+
+// tokenSummary describes a token set without printing it in full.
+func tokenSummary(token *oauth2.Token, rawIDToken string) *TokenSummary {
+	if token == nil {
+		return nil
+	}
+	s := &TokenSummary{
+		AccessToken:  abbreviate(token.AccessToken),
+		IDToken:      abbreviate(rawIDToken),
+		RefreshToken: token.RefreshToken != "",
+	}
+	if !token.Expiry.IsZero() {
+		s.Expiry = token.Expiry.Format(time.RFC3339)
+		s.Expired = time.Now().After(token.Expiry)
+	}
+	return s
+}
+
+func abbreviate(token string) string {
+	const keep = 12
+	if len(token) <= keep*2+1 {
+		return token
+	}
+	return token[:keep] + "…" + token[len(token)-keep:]
+}
+
+// IndexPageData holds data for the index page template.
+type IndexPageData struct {
+	ScopesSupported []string
+	LogoURI         string
+	AdminEnabled    bool
+	PKCE            bool
+	SessionCheck    time.Duration
+
+	// Which flows the provider says it supports. A button for a grant dex will
+	// refuse is a button that only teaches you it does not work.
+	DeviceSupported            bool
+	RefreshSupported           bool
+	ClientCredentialsSupported bool
+	PasswordSupported          bool
+	TokenExchangeSupported     bool
+
+	User  *session.UserClaims
+	Token *TokenSummary
+}
+
+// TokenPageData holds data for the token display template.
+type TokenPageData struct {
+	LogoURI            string
+	AdminEnabled       bool
+	Grant              string
+	IDToken            string
+	IDTokenJWTLink     string
+	AccessToken        string
+	AccessTokenJWTLink string
+	RefreshToken       string
+	IssuedTokenType    string
+	ExpiresIn          string
+	RedirectURL        string
+	Claims             string
+	RawResponse        string
+	PublicKeyPEM       string
+}
+
+// DevicePageData holds data for the device flow template.
+type DevicePageData struct {
+	AdminEnabled    bool
+	DeviceCode      string
+	UserCode        string
+	VerificationURI string
+	PollInterval    int
+	LogoURI         string
+}
+
+// ToolsPageData holds data for the token tools page.
+type ToolsPageData struct {
+	LogoURI      string
+	AdminEnabled bool
+}
+
+// ResultPageData holds the output of a tool.
+type ResultPageData struct {
+	LogoURI      string
+	AdminEnabled bool
+	Title        string
+	Verdict      string
+	Body         string
+	// LastGrant names the flow whose tokens are still on the session, so a tool
+	// result is not a dead end with the tokens left behind on a page you can no
+	// longer reach.
+	LastGrant string
+}
+
+// AdminConnector is one connector as the API reports it.
+type AdminConnector struct {
+	ID         string
+	Type       string
+	Name       string
+	GrantTypes []string
+	Config     string
+}
+
+// AdminIdentity is one user identity as the API reports it.
+type AdminIdentity struct {
+	UserID        string
+	ConnectorID   string
+	Email         string
+	EmailVerified bool
+	Username      string
+	Groups        []string
+	MFADevices    []AdminMFADevice
+	Consents      []AdminConsent
+	Created       string
+	LastLogin     string
+}
+
+// AdminConsent is one client a user has approved, and for what.
+type AdminConsent struct {
+	ClientID string
+	Scopes   []string
+}
+
+// AdminMFADevice is one enrolled authenticator.
+type AdminMFADevice struct {
+	AuthenticatorID string
+	HasSecret       bool
+	Credentials     []AdminWebAuthnCredential
+}
+
+// AdminWebAuthnCredential is one registered key.
+type AdminWebAuthnCredential struct {
+	ID          string
+	DisplayName string
+	Transport   []string
+	SignCount   uint32
+	Created     string
+}
+
+// AdminDetailPageData is one object with everything the API knows about it.
+// The lists say what a thing is; this says what it holds.
+type AdminDetailPageData struct {
+	LogoURI      string
+	AdminEnabled bool
+	Kind         string // client, connector, user
+	Title        string
+	BackURL      string
+	Error        string
+
+	Client    *AdminClient
+	Connector *AdminConnector
+	Identity  *AdminIdentity
+
+	// ConnectorGrantTypes are the grants a connector can be restricted to.
+	ConnectorGrantTypes []Option
+}
+
+// DiscoveryEntry is one metadata field worth reading without scrolling.
+type DiscoveryEntry struct {
+	Name   string
+	Value  string
+	Values []string
+}
+
+// AdminSession is one of dex's own sessions as the API reports it.
+type AdminSession struct {
+	ID          string
+	UserID      string
+	ConnectorID string
+	IPAddress   string
+	UserAgent   string
+	Created     string
+	Expires     string
+}
+
+// AdminRefreshToken is one refresh token as the API reports it.
+type AdminRefreshToken struct {
+	ID       string
+	ClientID string
+	Created  string
+	LastUsed string
+}
+
+// AdminClient is one OAuth2 client as the API reports it — every field it has,
+// since a list that shows three of nine invites you to guess the rest.
+type AdminClient struct {
+	ID                     string
+	Name                   string
+	Secret                 string
+	RedirectURIs           []string
+	TrustedPeers           []string
+	Public                 bool
+	LogoURL                string
+	AllowedConnectors      []string
+	SSOSharedWith          []string
+	BackchannelLogoutURI   string
+	PostLogoutRedirectURIs []string
+	RefreshTokenLifetime   string
+}
+
+// AdminPassword is one local password entry as the API reports it.
+type AdminPassword struct {
+	Email    string
+	Username string
+	UserID   string
+}
+
+// AdminPageData holds data for the gRPC API page. Configured is false when the
+// app was started without --grpc-addr: the page still exists and says what to
+// pass, because a feature that is simply absent reads as a feature that is
+// missing.
+type AdminPageData struct {
+	LogoURI      string
+	AdminEnabled bool
+	Configured   bool
+	Version      string
+	Issuer       string
+	Notice       string
+	Error        string
+
+	// Section is which part of the API the page is showing. The API has more
+	// than twenty methods; one page of all of them is the stack this replaced.
+	Section  string
+	Sections []AdminSection
+
+	Clients       []AdminClient
+	Passwords     []AdminPassword
+	Connectors    []AdminConnector
+	Identities    []AdminIdentity
+	Sessions      []AdminSession
+	RefreshTokens []AdminRefreshToken
+	// UserID and ConnectorID are who the sessions section is about. The refresh
+	// listing needs the sub claim, which the app derives from the pair rather
+	// than asking for a value nobody has to hand.
+	UserID      string
+	ConnectorID string
+
+	// Mode is which form the section is showing, if any: create, edit, verify.
+	// One at a time — three stacked forms is a page you have to read to find
+	// the one you wanted.
+	Mode string
+
+	// ConnectorTypes are the types dex accepts, and ConnectorGrantTypes the
+	// grants a connector can be restricted to, both for the create form.
+	ConnectorTypes      []string
+	ConnectorGrantTypes []Option
+
+	// Endpoints and Capabilities are what GetDiscovery reports.
+	Endpoints    []DiscoveryEntry
+	Capabilities []DiscoveryEntry
+
+	// EditClient and EditPassword are prefilled from the row an edit was
+	// started from, so updating is something you do to a thing you can see.
+	EditClient   *AdminClient
+	EditPassword *AdminPassword
+}
+
+// AdminSection is one tab of the API page.
+type AdminSection struct {
+	ID      string
+	Label   string
+	Current bool
+}
+
+// Renderer renders HTML pages for the application.
+type Renderer interface {
+	RenderIndexPage(w http.ResponseWriter, data IndexPageData)
+	RenderTokenPage(w http.ResponseWriter, data TokenPageData)
+	RenderDevicePage(w http.ResponseWriter, data DevicePageData)
+	RenderToolsPage(w http.ResponseWriter, data ToolsPageData)
+	RenderFormPage(w http.ResponseWriter, data FormPageData)
+	RenderResultPage(w http.ResponseWriter, data ResultPageData)
+	RenderAdminPage(w http.ResponseWriter, data AdminPageData)
+	RenderAdminDetailPage(w http.ResponseWriter, data AdminDetailPageData)
+}
+
+// templateRenderer implements Renderer using Go html/template.
+type templateRenderer struct {
+	index  *template.Template
+	token  *template.Template
+	device *template.Template
+	tools  *template.Template
+	form   *template.Template
+	result *template.Template
+	admin  *template.Template
+	detail *template.Template
+}
+
+// newTemplateRenderer parses embedded templates and returns a Renderer.
+func newTemplateRenderer() Renderer {
+	parse := func(name string) *template.Template {
+		t, err := template.ParseFS(templatesFS, "templates/layout.html", "templates/"+name)
+		if err != nil {
+			log.Fatalf("failed to parse template %s: %v", name, err)
+		}
+		return t
+	}
+
+	return &templateRenderer{
+		index:  parse("index.html"),
+		token:  parse("token.html"),
+		device: parse("device.html"),
+		tools:  parse("tools.html"),
+		form:   parse("form.html"),
+		result: parse("result.html"),
+		admin:  parse("admin.html"),
+		detail: parse("detail.html"),
+	}
+}
+
+func (r *templateRenderer) RenderIndexPage(w http.ResponseWriter, data IndexPageData) {
+	renderTemplate(w, r.index, data)
+}
+
+func (r *templateRenderer) RenderTokenPage(w http.ResponseWriter, data TokenPageData) {
+	renderTemplate(w, r.token, data)
+}
+
+func (r *templateRenderer) RenderDevicePage(w http.ResponseWriter, data DevicePageData) {
+	renderTemplate(w, r.device, data)
+}
+
+func (r *templateRenderer) RenderToolsPage(w http.ResponseWriter, data ToolsPageData) {
+	renderTemplate(w, r.tools, data)
+}
+
+func (r *templateRenderer) RenderFormPage(w http.ResponseWriter, data FormPageData) {
+	renderTemplate(w, r.form, data)
+}
+
+func (r *templateRenderer) RenderResultPage(w http.ResponseWriter, data ResultPageData) {
+	renderTemplate(w, r.result, data)
+}
+
+func (r *templateRenderer) RenderAdminPage(w http.ResponseWriter, data AdminPageData) {
+	renderTemplate(w, r.admin, data)
+}
+
+func (r *templateRenderer) RenderAdminDetailPage(w http.ResponseWriter, data AdminDetailPageData) {
+	renderTemplate(w, r.detail, data)
+}
+
+func renderTemplate(w http.ResponseWriter, tmpl *template.Template, data any) {
+	err := tmpl.ExecuteTemplate(w, "page", data)
+	if err == nil {
+		return
+	}
+
+	switch err := err.(type) {
+	case *template.Error:
+		log.Printf("Error rendering template %s: %s", tmpl.Name(), err)
+		http.Error(w, "Internal server error", http.StatusInternalServerError)
+	default:
+		// An error with the underlying writer (e.g. connection dropped). Ignore.
+	}
+}
diff --git a/examples/example-app/server/server.go b/examples/example-app/server/server.go
new file mode 100644
index 0000000000..c4869dcbae
--- /dev/null
+++ b/examples/example-app/server/server.go
@@ -0,0 +1,323 @@
+package server
+
+import (
+	"context"
+	"fmt"
+	"log"
+	"net"
+	"net/http"
+	"net/url"
+	"os"
+	"os/signal"
+	"slices"
+	"strings"
+	"syscall"
+	"time"
+
+	"github.com/coreos/go-oidc/v3/oidc"
+	"golang.org/x/oauth2"
+
+	"github.com/dexidp/dex/examples/example-app/session"
+)
+
+// Options configures the Server.
+type Options struct {
+	ClientID     string
+	ClientSecret string
+	RedirectURI  string
+	IssuerURL    string
+	PKCE         bool
+	RootCAs      string
+	Debug        bool
+
+	// SessionCheckInterval is how stale the app lets its idea of the provider's
+	// session get before confirming it with a prompt=none request. Zero turns
+	// the check off, which means the app will keep showing a user who has since
+	// signed out of the provider.
+	SessionCheckInterval time.Duration
+
+	// gRPC API. Empty GRPCAddr leaves the admin page out of the app entirely.
+	GRPCAddr       string
+	GRPCCA         string
+	GRPCClientCert string
+	GRPCClientKey  string
+}
+
+// Server is the HTTP server for the example OIDC client application.
+type Server struct {
+	clientID     string
+	clientSecret string
+	redirectURI  string
+	pkce         bool
+
+	sessionCheckInterval time.Duration
+
+	provider        *oidc.Provider
+	verifier        *oidc.IDTokenVerifier
+	scopesSupported []string
+	grantsSupported []string
+	offlineAsScope  bool
+
+	// Discovered endpoint URLs.
+	deviceAuthURL      string
+	userInfoURL        string
+	jwksURL            string
+	introspectURL      string
+	endSessionEndpoint string
+
+	client   *http.Client
+	renderer Renderer
+	sessions *session.Store
+	admin    *adminClient
+}
+
+// New creates a Server by performing OIDC discovery and initializing dependencies.
+func New(opts Options) (*Server, error) {
+	client, err := newHTTPClient(opts.RootCAs, opts.Debug)
+	if err != nil {
+		return nil, err
+	}
+
+	ctx := oidc.ClientContext(context.Background(), client)
+	provider, err := oidc.NewProvider(ctx, opts.IssuerURL)
+	if err != nil {
+		return nil, fmt.Errorf("failed to query provider %q: %v", opts.IssuerURL, err)
+	}
+
+	// Extract discovery metadata: scopes and endpoint URLs.
+	var discovery struct {
+		ScopesSupported             []string `json:"scopes_supported"`
+		GrantTypesSupported         []string `json:"grant_types_supported"`
+		UserInfoEndpoint            string   `json:"userinfo_endpoint"`
+		DeviceAuthorizationEndpoint string   `json:"device_authorization_endpoint"`
+		JWKSURI                     string   `json:"jwks_uri"`
+		IntrospectionEndpoint       string   `json:"introspection_endpoint"`
+		EndSessionEndpoint          string   `json:"end_session_endpoint"`
+	}
+	if err := provider.Claims(&discovery); err != nil {
+		return nil, fmt.Errorf("failed to parse provider discovery claims: %v", err)
+	}
+
+	// Determine offline access strategy.
+	offlineAsScope := true
+	if len(discovery.ScopesSupported) > 0 {
+		offlineAsScope = slices.Contains(discovery.ScopesSupported, oidc.ScopeOfflineAccess)
+	}
+
+	introspectURL := discovery.IntrospectionEndpoint
+	if introspectURL == "" {
+		// Dex serves it but has not always advertised it.
+		introspectURL = strings.TrimSuffix(opts.IssuerURL, "/") + "/token/introspect"
+	}
+
+	s := &Server{
+		clientID:     opts.ClientID,
+		clientSecret: opts.ClientSecret,
+		redirectURI:  opts.RedirectURI,
+		pkce:         opts.PKCE,
+
+		sessionCheckInterval: opts.SessionCheckInterval,
+
+		provider:        provider,
+		verifier:        provider.Verifier(&oidc.Config{ClientID: opts.ClientID}),
+		scopesSupported: discovery.ScopesSupported,
+		grantsSupported: discovery.GrantTypesSupported,
+		offlineAsScope:  offlineAsScope,
+
+		deviceAuthURL:      discovery.DeviceAuthorizationEndpoint,
+		userInfoURL:        discovery.UserInfoEndpoint,
+		jwksURL:            discovery.JWKSURI,
+		introspectURL:      introspectURL,
+		endSessionEndpoint: discovery.EndSessionEndpoint,
+
+		client:   client,
+		renderer: newTemplateRenderer(),
+		sessions: session.NewStore(),
+	}
+
+	if opts.GRPCAddr != "" {
+		admin, err := newAdminClient(opts)
+		if err != nil {
+			return nil, err
+		}
+		s.admin = admin
+	}
+
+	return s, nil
+}
+
+// supportsGrant reports whether the provider advertises a grant. A provider
+// that does not is not going to start honouring it because this app offers a
+// button for it, so the button is not drawn.
+func (s *Server) supportsGrant(grant string) bool {
+	if len(s.grantsSupported) == 0 {
+		// Nothing advertised: offer everything rather than nothing, since the
+		// metadata field is optional.
+		return true
+	}
+	return slices.Contains(s.grantsSupported, grant)
+}
+
+// oauth2Config returns an oauth2.Config for the given scopes.
+func (s *Server) oauth2Config(scopes []string) *oauth2.Config {
+	return &oauth2.Config{
+		ClientID:     s.clientID,
+		ClientSecret: s.clientSecret,
+		Endpoint:     s.provider.Endpoint(),
+		Scopes:       scopes,
+		RedirectURL:  s.redirectURI,
+	}
+}
+
+// sessionKey marks the session already resolved for a request.
+type sessionKey struct{}
+
+// session returns this browser's session, creating one if needed.
+//
+// The lookup is remembered on the request: handlers ask for the session more
+// than once, and on the very first request — the one that has no cookie yet —
+// asking twice used to mint two sessions and set two cookies. Whatever the
+// second one recorded then belonged to a session the browser never came back
+// with, which looked like tokens appearing from nowhere and sign-ins that did
+// not survive the redirect they arrived on.
+func (s *Server) session(w http.ResponseWriter, r *http.Request) *session.Session {
+	if sess, ok := r.Context().Value(sessionKey{}).(*session.Session); ok {
+		return sess
+	}
+
+	sess := s.sessions.FromRequest(w, r, strings.HasPrefix(s.redirectURI, "https://"))
+	*r = *r.WithContext(context.WithValue(r.Context(), sessionKey{}, sess))
+	return sess
+}
+
+// routes builds the HTTP handler with all application routes.
+func (s *Server) routes() http.Handler {
+	mux := http.NewServeMux()
+
+	mux.Handle("GET /static/", http.StripPrefix("/static/", staticHandler))
+
+	mux.HandleFunc("GET /{$}", s.handleIndex)
+	mux.HandleFunc("POST /login", s.handleLogin)
+	mux.HandleFunc("GET /logout", s.handleLogout)
+
+	// Back-channel logout. The provider POSTs here directly, so it takes no
+	// session cookie and belongs to no browser. The event stream is the other
+	// half: it is how an open page finds out, without waiting to be reloaded.
+	mux.HandleFunc("POST /backchannel-logout", s.handleBackchannelLogout)
+	mux.HandleFunc("GET /events", s.handleEvents)
+
+	// Parse redirect URI to register callback on the correct path.
+	callbackPath := "/callback"
+	if u, err := url.Parse(s.redirectURI); err == nil && u.Path != "" {
+		callbackPath = u.Path
+	}
+	mux.HandleFunc("GET "+callbackPath, s.handleAuthCallback)
+
+	mux.HandleFunc("POST /device/login", s.handleDeviceStart)
+	mux.HandleFunc("GET /device", s.handleDeviceStatus)
+	mux.HandleFunc("POST /device/poll", s.handleDevicePoll)
+	mux.HandleFunc("GET /device/result", s.handleDeviceComplete)
+
+	// Grants that need no browser redirect: a page for the parameters, and the
+	// endpoint the page posts to.
+	mux.HandleFunc("GET /grant/{grant}", s.handleGrantForm)
+	mux.HandleFunc("POST /grant/refresh", s.handleRefreshGrant)
+	mux.HandleFunc("POST /grant/client-credentials", s.handleClientCredentialsGrant)
+	mux.HandleFunc("POST /grant/password", s.handlePasswordGrant)
+	mux.HandleFunc("POST /grant/token-exchange", s.handleTokenExchangeGrant)
+
+	mux.HandleFunc("GET /tokens", s.handleTokens)
+
+	// Tools for looking at a token you already hold.
+	mux.HandleFunc("GET /tools", s.handleTools)
+	mux.HandleFunc("GET /tools/{tool}", s.handleToolForm)
+	mux.HandleFunc("POST /tools/introspect", s.handleIntrospect)
+	mux.HandleFunc("POST /tools/verify", s.handleVerify)
+	mux.HandleFunc("POST /userinfo", s.handleUserInfo)
+
+	// The page is always served; without a gRPC address it says what to pass to
+	// get the rest of it.
+	mux.HandleFunc("GET /admin", s.handleAdmin)
+	if s.admin != nil {
+		mux.HandleFunc("POST /admin/client/create", s.handleAdminCreateClient)
+		mux.HandleFunc("POST /admin/client/update", s.handleAdminUpdateClient)
+		mux.HandleFunc("POST /admin/client/delete", s.handleAdminDeleteClient)
+		mux.HandleFunc("POST /admin/password/create", s.handleAdminCreatePassword)
+		mux.HandleFunc("POST /admin/password/update", s.handleAdminUpdatePassword)
+		mux.HandleFunc("POST /admin/password/verify", s.handleAdminVerifyPassword)
+		mux.HandleFunc("POST /admin/password/delete", s.handleAdminDeletePassword)
+		mux.HandleFunc("POST /admin/connector/create", s.handleAdminCreateConnector)
+		mux.HandleFunc("POST /admin/connector/delete", s.handleAdminDeleteConnector)
+		mux.HandleFunc("POST /admin/identity/delete", s.handleAdminDeleteIdentity)
+		mux.HandleFunc("POST /admin/session/delete", s.handleAdminDeleteSession)
+		mux.HandleFunc("POST /admin/session/terminate", s.handleAdminTerminateSessions)
+		mux.HandleFunc("POST /admin/session/terminate-connector", s.handleAdminTerminateByConnector)
+		mux.HandleFunc("GET /admin/client/{id}", s.handleAdminClientDetail)
+		mux.HandleFunc("GET /admin/connector/{id}", s.handleAdminConnectorDetail)
+		mux.HandleFunc("GET /admin/user/{connector}/{user}", s.handleAdminUserDetail)
+		mux.HandleFunc("POST /admin/connector/update", s.handleAdminUpdateConnector)
+		mux.HandleFunc("POST /admin/consent/revoke", s.handleAdminRevokeConsent)
+		mux.HandleFunc("POST /admin/webauthn/delete", s.handleAdminDeleteWebAuthn)
+		mux.HandleFunc("POST /admin/mfa/reset", s.handleAdminResetMFA)
+		mux.HandleFunc("POST /admin/mfa/secret/delete", s.handleAdminDeleteMFASecret)
+		mux.HandleFunc("POST /admin/refresh/revoke", s.handleAdminRevokeRefresh)
+	}
+
+	return mux
+}
+
+// Run starts the HTTP(S) server with graceful shutdown on SIGINT/SIGTERM.
+func (s *Server) Run(listenAddr, tlsCert, tlsKey string) error {
+	u, err := url.Parse(listenAddr)
+	if err != nil {
+		return fmt.Errorf("parse listen address: %v", err)
+	}
+
+	// Shutdown waits for handlers to return and does not cancel their contexts, so
+	// a response that never ends on its own — the event stream — would hold it open
+	// forever. Deriving every request from a context cancelled below is what lets
+	// those handlers notice and finish.
+	baseCtx, cancelRequests := context.WithCancel(context.Background())
+	defer cancelRequests()
+
+	srv := &http.Server{
+		Addr:        u.Host,
+		Handler:     s.routes(),
+		BaseContext: func(net.Listener) context.Context { return baseCtx },
+	}
+
+	ctx, stop := signal.NotifyContext(context.Background(), os.Interrupt, syscall.SIGTERM)
+	defer stop()
+
+	errCh := make(chan error, 1)
+	go func() {
+		log.Printf("listening on %s", listenAddr)
+		switch u.Scheme {
+		case "http":
+			errCh <- srv.ListenAndServe()
+		case "https":
+			errCh <- srv.ListenAndServeTLS(tlsCert, tlsKey)
+		default:
+			errCh <- fmt.Errorf("listen address %q is not using http or https", listenAddr)
+		}
+	}()
+
+	select {
+	case err := <-errCh:
+		return err
+	case <-ctx.Done():
+		log.Println("shutting down...")
+		if s.admin != nil {
+			s.admin.close()
+		}
+
+		// Cut the long-lived handlers loose, then give the rest a moment to drain.
+		// The deadline matters: a second interrupt will not help, because
+		// NotifyContext has already taken the signal away from the default handler.
+		cancelRequests()
+
+		shutdownCtx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+		defer cancel()
+		return srv.Shutdown(shutdownCtx)
+	}
+}
diff --git a/examples/example-app/server/static/app.js b/examples/example-app/server/static/app.js
new file mode 100644
index 0000000000..53d3898aab
--- /dev/null
+++ b/examples/example-app/server/static/app.js
@@ -0,0 +1,377 @@
+(function() {
+    const crossClientInput = document.getElementById("cross_client_input");
+    const crossClientList = document.getElementById("cross-client-list");
+    const addClientBtn = document.getElementById("add-cross-client");
+    const scopesList = document.getElementById("scopes-list");
+    const customScopeInput = document.getElementById("custom_scope_input");
+    const addCustomScopeBtn = document.getElementById("add-custom-scope");
+
+    // Default scopes that should be checked by default
+    const defaultScopes = ["openid", "profile", "email", "offline_access"];
+
+    // The script is loaded on every page; only the index has these controls.
+    if (scopesList) {
+        scopesList.querySelectorAll('input[type="checkbox"]').forEach(cb => {
+            if (defaultScopes.includes(cb.value)) {
+                cb.checked = true;
+            }
+        });
+    }
+
+    function addCrossClient(value) {
+        const trimmed = value.trim();
+        if (!trimmed) return;
+
+        const chip = document.createElement("div");
+        chip.className = "chip";
+
+        const text = document.createElement("span");
+        text.textContent = trimmed;
+
+        const hidden = document.createElement("input");
+        hidden.type = "hidden";
+        hidden.name = "cross_client";
+        hidden.value = trimmed;
+
+        const remove = document.createElement("button");
+        remove.type = "button";
+        remove.textContent = "×";
+        remove.onclick = () => crossClientList.removeChild(chip);
+
+        chip.append(text, hidden, remove);
+        crossClientList.appendChild(chip);
+    }
+
+    function addCustomScope(scope) {
+        const trimmed = scope.trim();
+        if (!trimmed || !scopesList) return;
+
+        // Check if scope already exists
+        const existingCheckboxes = scopesList.querySelectorAll('input[type="checkbox"]');
+        for (const cb of existingCheckboxes) {
+            if (cb.value === trimmed) {
+                cb.checked = true;
+                return;
+            }
+        }
+
+        // Add new scope checkbox
+        const scopeItem = document.createElement("div");
+        scopeItem.className = "scope-item";
+
+        const checkbox = document.createElement("input");
+        checkbox.type = "checkbox";
+        checkbox.name = "extra_scopes";
+        checkbox.value = trimmed;
+        checkbox.id = "scope_custom_" + trimmed;
+        checkbox.checked = true;
+
+        const label = document.createElement("label");
+        label.htmlFor = checkbox.id;
+        label.textContent = trimmed;
+
+        scopeItem.append(checkbox, label);
+        scopesList.appendChild(scopeItem);
+    }
+
+    addClientBtn?.addEventListener("click", () => {
+        addCrossClient(crossClientInput.value);
+        crossClientInput.value = "";
+        crossClientInput.focus();
+    });
+
+    crossClientInput?.addEventListener("keydown", (e) => {
+        if (e.key === "Enter") {
+            e.preventDefault();
+            addCrossClient(crossClientInput.value);
+            crossClientInput.value = "";
+        }
+    });
+
+    addCustomScopeBtn?.addEventListener("click", () => {
+        addCustomScope(customScopeInput.value);
+        customScopeInput.value = "";
+        customScopeInput.focus();
+    });
+
+    customScopeInput?.addEventListener("keydown", (e) => {
+        if (e.key === "Enter") {
+            e.preventDefault();
+            addCustomScope(customScopeInput.value);
+            customScopeInput.value = "";
+        }
+    });
+
+    // Scope pickers on the flow forms take custom scopes too.
+    document.querySelectorAll(".add-custom-scope").forEach(function (btn) {
+        var wrap = btn.closest(".form-control");
+        var input = wrap && wrap.querySelector(".custom-scope-input");
+        var list = wrap && wrap.querySelector(".scopes-list");
+        if (!input || !list) return;
+
+        var add = function () {
+            var value = input.value.trim();
+            if (!value) return;
+
+            var existing = list.querySelector('input[value="' + value + '"]');
+            if (existing) {
+                existing.checked = true;
+            } else {
+                var item = document.createElement("div");
+                item.className = "scope-item";
+                var box = document.createElement("input");
+                box.type = "checkbox";
+                box.name = "scopes";
+                box.value = value;
+                box.checked = true;
+                box.id = "scope_custom_" + value;
+                var label = document.createElement("label");
+                label.htmlFor = box.id;
+                label.textContent = value;
+                item.append(box, label);
+                list.appendChild(item);
+            }
+            input.value = "";
+            input.focus();
+        };
+
+        btn.addEventListener("click", add);
+        input.addEventListener("keydown", function (e) {
+            if (e.key === "Enter") {
+                e.preventDefault();
+                add();
+            }
+        });
+    });
+
+    // Device Grant Login Handler
+    const deviceGrantBtn = document.getElementById("device-grant-btn");
+    deviceGrantBtn?.addEventListener("click", async () => {
+        deviceGrantBtn.disabled = true;
+        deviceGrantBtn.textContent = "Loading...";
+
+        try {
+            // Collect form data similar to regular login
+            const form = document.getElementById("login-form");
+            const formData = new FormData(form);
+
+            // Get selected scopes
+            const scopes = formData.getAll("extra_scopes");
+
+            // Get cross-client values
+            const crossClients = formData.getAll("cross_client");
+
+            // Get connector_id if specified
+            const connectorId = formData.get("connector_id") || "";
+
+            // Initiate device flow with options
+            const response = await fetch('/device/login', {
+                method: 'POST',
+                headers: {
+                    'Content-Type': 'application/json',
+                },
+                body: JSON.stringify({
+                    scopes: scopes,
+                    cross_clients: crossClients,
+                    connector_id: connectorId
+                })
+            });
+
+            if (response.ok) {
+                // Redirect to device flow page
+                window.location.href = '/device';
+            } else {
+                const errorText = await response.text();
+                alert('Failed to start device flow: ' + errorText);
+            }
+        } catch (error) {
+            alert('Error starting device flow: ' + error.message);
+        } finally {
+            deviceGrantBtn.disabled = false;
+            deviceGrantBtn.textContent = "Device code";
+        }
+    });
+})();
+
+
+// JSON syntax highlighting. Claims and API responses are read, not skimmed:
+// telling a key from a value from a number is most of what makes a blob of
+// JSON legible at a glance.
+(function () {
+    function escapeHTML(text) {
+        return text.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
+    }
+
+    function highlight(text) {
+        return escapeHTML(text).replace(
+            /("(\\u[\da-fA-F]{4}|\\[^u]|[^\\"])*"(\s*:)?|\b(true|false|null)\b|-?\b\d+(\.\d+)?([eE][+-]?\d+)?\b)/g,
+            function (match) {
+                var cls = "json-number";
+                if (/^"/.test(match)) {
+                    cls = /:$/.test(match) ? "json-key" : "json-string";
+                } else if (/true|false/.test(match)) {
+                    cls = "json-boolean";
+                } else if (/null/.test(match)) {
+                    cls = "json-null";
+                }
+                return '<span class="' + cls + '">' + match + "</span>";
+            },
+        );
+    }
+
+    document.querySelectorAll("pre.json").forEach(function (el) {
+        var text = el.textContent;
+        try {
+            // Reject anything that is not JSON rather than colouring it wrongly:
+            // these blocks also carry error text from the provider.
+            JSON.parse(text);
+        } catch (e) {
+            return;
+        }
+        el.innerHTML = highlight(text);
+    });
+
+    // A JWT is three base64 segments; colouring the dots apart is enough to see
+    // where the header ends and the signature begins.
+    document.querySelectorAll("pre.token[data-jwt]").forEach(function (el) {
+        var parts = el.textContent.trim().split(".");
+        if (parts.length !== 3) return;
+        el.innerHTML =
+            '<span class="jwt-header">' + escapeHTML(parts[0]) + "</span>." +
+            '<span class="jwt-payload">' + escapeHTML(parts[1]) + "</span>." +
+            '<span class="jwt-signature">' + escapeHTML(parts[2]) + "</span>";
+    });
+})();
+
+// "Use my access token" and friends fill the field they sit under, so trying a
+// tool against a different one of your tokens is a click rather than a paste.
+document.querySelectorAll(".fill-token").forEach(function (btn) {
+    btn.addEventListener("click", function () {
+        var control = btn.closest(".form-control");
+        var field = control && control.querySelector("textarea");
+        if (!field) return;
+        field.value = btn.getAttribute("data-token");
+        field.focus();
+    });
+});
+
+// List fields — redirect URIs, trusted peers, allowed connectors — are lists in
+// the API, so the form collects them as one value each rather than as lines of
+// text somebody has to split.
+document.querySelectorAll(".chip-add").forEach(function (btn) {
+    var control = btn.closest(".form-control");
+    var list = control && control.querySelector(".chips");
+    var input = control && control.querySelector(".chip-input");
+    if (!list || !input) return;
+
+    var add = function () {
+        var value = input.value.trim();
+        if (!value) return;
+
+        var chip = document.createElement("span");
+        chip.className = "chip";
+
+        var text = document.createElement("span");
+        text.textContent = value;
+
+        var hidden = document.createElement("input");
+        hidden.type = "hidden";
+        hidden.name = list.getAttribute("data-name");
+        hidden.value = value;
+
+        var remove = document.createElement("button");
+        remove.type = "button";
+        remove.className = "chip-remove";
+        remove.textContent = "×";
+        remove.addEventListener("click", function () { chip.remove(); });
+
+        chip.append(text, hidden, remove);
+        list.appendChild(chip);
+        input.value = "";
+        input.focus();
+    };
+
+    btn.addEventListener("click", add);
+    input.addEventListener("keydown", function (e) {
+        if (e.key === "Enter") {
+            e.preventDefault();
+            add();
+        }
+    });
+});
+
+document.querySelectorAll(".chip-remove").forEach(function (btn) {
+    btn.addEventListener("click", function () {
+        var chip = btn.closest(".chip");
+        if (chip) chip.remove();
+    });
+});
+
+// Back-channel logout arrives over an event stream rather than on the next page
+// load, because when it arrives is the whole point: a push that only surfaces
+// when you reload is indistinguishable from the prompt=none check this app
+// already runs on every load.
+(function () {
+    if (!window.EventSource) return;
+
+    // Only where the notice has something to say. A stream is a connection held
+    // open for as long as the page lives, and a browser allows six of them per
+    // host, so opening one from every page — the admin screens included — is how
+    // you starve the rest of the site of connections.
+    if (!document.getElementById("signed-in-card")) return;
+
+    const stream = new EventSource("/events");
+
+    // Release the connection as the page goes away rather than waiting for the
+    // browser to notice, so a reload does not briefly hold two.
+    window.addEventListener("pagehide", function () {
+        stream.close();
+    });
+
+    stream.addEventListener("backchannel-logout", function (event) {
+        let notice = {};
+        try {
+            notice = JSON.parse(event.data);
+        } catch (e) {
+            return;
+        }
+
+        const container = document.querySelector(".container");
+        if (!container || document.getElementById("backchannel-banner")) return;
+
+        // The session is over, so the page must stop showing one. Leaving the
+        // signed-in card up next to a notice saying you are signed out is the
+        // page contradicting itself.
+        document.getElementById("signed-in-card")?.remove();
+        document.getElementById("signed-out-card")?.removeAttribute("hidden");
+
+        const card = document.createElement("div");
+        card.className = "card";
+        card.id = "backchannel-banner";
+
+        const title = document.createElement("div");
+        title.className = "card-title";
+        title.textContent = "Signed out by back-channel logout";
+
+        const hint = document.createElement("p");
+        hint.className = "hint";
+        const at = notice.at ? new Date(notice.at).toLocaleTimeString() : "just now";
+        hint.textContent =
+            "dex pushed a logout token to this app at " + at +
+            ". Nothing was loaded here to find that out" +
+            (notice.sid ? " — session " + notice.sid : "") + ".";
+
+        const actions = document.createElement("div");
+        actions.className = "form-actions";
+
+        const dismiss = document.createElement("button");
+        dismiss.type = "button";
+        dismiss.className = "button button-secondary";
+        dismiss.textContent = "Dismiss";
+        dismiss.addEventListener("click", function () { card.remove(); });
+
+        actions.append(dismiss);
+        card.append(title, hint, actions);
+        container.insertBefore(card, container.querySelector(".card"));
+    });
+})();
diff --git a/examples/example-app/server/static/device.js b/examples/example-app/server/static/device.js
new file mode 100644
index 0000000000..5091c763f1
--- /dev/null
+++ b/examples/example-app/server/static/device.js
@@ -0,0 +1,84 @@
+(function() {
+    const deviceCode = document.getElementById("device-code")?.value;
+    const pollInterval = parseInt(document.getElementById("poll-interval")?.value || "5", 10);
+    const verificationURL = document.getElementById("verification-url")?.textContent;
+    const userCode = document.getElementById("user-code")?.textContent;
+    const statusText = document.getElementById("status-text");
+    const errorMessage = document.getElementById("error-message");
+    const openAuthBtn = document.getElementById("open-auth-btn");
+
+    let pollTimer = null;
+
+    openAuthBtn?.addEventListener("click", () => {
+        if (verificationURL && userCode) {
+            const url = verificationURL + "?user_code=" + encodeURIComponent(userCode);
+            window.open(url, "_blank", "width=600,height=800");
+        }
+    });
+
+    async function pollForToken() {
+        try {
+            const response = await fetch('/device/poll', {
+                method: 'POST',
+                headers: {
+                    'Content-Type': 'application/json',
+                },
+                body: JSON.stringify({device_code: deviceCode})
+            });
+
+            const data = await response.json();
+
+            if (response.ok && data.status === 'complete') {
+                statusText.textContent = "Authentication successful! Redirecting...";
+                stopPolling();
+                window.location.href = '/device/result';
+            } else if (response.ok && data.status === 'pending') {
+                statusText.textContent = "Waiting for authentication...";
+            } else {
+                const errorText = data.error_description || data.error || 'Unknown error';
+
+                if (data.error === 'no_device_flow') {
+                    showError('This browser has no device flow in progress. Start one from the home page.');
+                    stopPolling();
+                } else if (data.error === 'expired_token' || data.error === 'access_denied') {
+                    showError(data.error === 'expired_token' ?
+                        'The device code has expired. Please start over.' :
+                        'Authentication was denied.');
+                    stopPolling();
+                }
+            }
+        } catch (error) {
+            console.error('Polling error:', error);
+        }
+    }
+
+    function showError(message) {
+        errorMessage.textContent = message;
+        errorMessage.style.display = 'block';
+
+        // Hide the status indicator (contains spinner and status text)
+        const statusIndicator = document.querySelector('.status-indicator');
+        if (statusIndicator) {
+            statusIndicator.style.display = 'none';
+        }
+    }
+
+    function startPolling() {
+        pollForToken();
+        pollTimer = setInterval(pollForToken, pollInterval * 1000);
+    }
+
+    function stopPolling() {
+        if (pollTimer) {
+            clearInterval(pollTimer);
+            pollTimer = null;
+        }
+    }
+
+    if (deviceCode) {
+        startPolling();
+    }
+
+    window.addEventListener('beforeunload', stopPolling);
+})();
+
diff --git a/examples/example-app/server/static/dex-glyph-color.svg b/examples/example-app/server/static/dex-glyph-color.svg
new file mode 100644
index 0000000000..5852a5f348
--- /dev/null
+++ b/examples/example-app/server/static/dex-glyph-color.svg
@@ -0,0 +1,20 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- Generator: Adobe Illustrator 17.0.0, SVG Export Plug-In . SVG Version: 6.00 Build 0)  -->
+<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">
+<svg version="1.1" id="Layer_1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px"
+	 width="112px" height="109px" viewBox="0 0 112 109" enable-background="new 0 0 112 109" xml:space="preserve">
+<g>
+	<path fill="#449FD8" d="M88.345,51.574c7.588-3.55,12.764-10.49,14.175-18.53C96.396,19.395,84.663,9.054,70.094,4.851
+		c4.923,7.133,7.272,15.583,6.771,24.17C83.311,34.466,87.716,42.55,88.345,51.574z M27.27,38.542
+		c-8.207-1.045-16.333,1.973-21.858,8.054C3.23,61.683,7.869,76.84,18.099,88.158c-0.527-8.64,1.856-17.306,6.831-24.483
+		C22.19,55.048,23.32,45.944,27.27,38.542z M33.01,76.928c-2.997,8.079-1.755,17.193,3.642,24.215
+		c12.155,4.943,26.051,5.146,38.643-0.035c-7.818-2.516-14.886-7.518-19.887-14.731C47.233,86.23,39.124,83.032,33.01,76.928z
+		 M63.122,22.202C61.615,14.044,56.069,6.819,47.892,3.47C33.778,5.711,20.745,13.966,12.76,26.631
+		c8.115-2.487,16.74-2.178,24.529,0.639C44.816,22.008,54.043,20.144,63.122,22.202z M85.891,66.457
+		c-3.086,7.399-8.722,13.188-15.678,16.61c6.194,5.604,14.805,7.758,22.852,5.834c9.054-9.587,13.884-22.198,13.9-35.009
+		C101.549,60.198,94.131,64.67,85.891,66.457z"/>
+	<g>
+		<circle fill="#F04D5C" cx="56.035" cy="53.892" r="15.972"/>
+	</g>
+</g>
+</svg>
diff --git a/examples/example-app/server/static/style.css b/examples/example-app/server/static/style.css
new file mode 100644
index 0000000000..ce3be3a2b9
--- /dev/null
+++ b/examples/example-app/server/static/style.css
@@ -0,0 +1,664 @@
+:root {
+    --fg: #1a1a1a;
+    --muted: #6b7280;
+    --border: #e1e4e8;
+    --accent: #2f6fb0;
+    --bad: #b3261e;
+    --surface: #fff;
+    --page: #f4f5f7;
+}
+
+* {
+    box-sizing: border-box;
+}
+
+body {
+    background-color: var(--page);
+    color: var(--fg);
+    font-family: -apple-system, system-ui, "Segoe UI", Roboto, Helvetica, Arial, sans-serif;
+    line-height: 1.5;
+    margin: 0;
+    padding: 32px 16px 64px;
+}
+
+.container {
+    margin: 0 auto;
+    max-width: 640px;
+}
+
+.logo-link {
+    display: block;
+    text-align: center;
+}
+
+.logo {
+    height: auto;
+    width: 140px;
+}
+
+.nav {
+    display: flex;
+    gap: 20px;
+    justify-content: center;
+    margin: 16px 0 24px;
+}
+
+.nav a {
+    color: var(--muted);
+    font-size: 14px;
+    text-decoration: none;
+}
+
+.nav a:hover {
+    color: var(--accent);
+    text-decoration: underline;
+}
+
+.card {
+    background: var(--surface);
+    border: 1px solid var(--border);
+    border-radius: 10px;
+    margin-bottom: 16px;
+    padding: 20px;
+}
+
+.card-title {
+    font-size: 15px;
+    font-weight: 600;
+    margin-bottom: 12px;
+}
+
+.hint {
+    color: var(--muted);
+    font-size: 13px;
+    margin: 6px 0;
+}
+
+.verdict {
+    background: #f4f5f7;
+    border-left: 3px solid var(--accent);
+    font-size: 13px;
+    margin: 12px 0;
+    padding: 8px 12px;
+}
+
+.verdict-bad {
+    border-left-color: var(--bad);
+    color: var(--bad);
+}
+
+/* Label/value pairs. */
+.kv {
+    display: grid;
+    font-size: 13px;
+    gap: 6px 16px;
+    grid-template-columns: 140px minmax(0, 1fr);
+}
+
+.kv .k {
+    color: var(--muted);
+}
+
+.kv .v {
+    overflow-wrap: anywhere;
+}
+
+.mono {
+    font-family: ui-monospace, SFMono-Regular, Menlo, Consolas, monospace;
+    font-size: 12.5px;
+}
+
+.small {
+    font-size: 12px;
+}
+
+.user-code code {
+    font-size: 20px;
+    letter-spacing: 0.08em;
+}
+
+pre.token,
+pre.json {
+    background: #f7f8fa;
+    border: 1px solid var(--border);
+    border-radius: 6px;
+    font-family: ui-monospace, SFMono-Regular, Menlo, Consolas, monospace;
+    font-size: 12px;
+    margin: 8px 0;
+    max-height: 320px;
+    overflow: auto;
+    overflow-wrap: anywhere;
+    padding: 10px;
+    white-space: pre-wrap;
+}
+
+.row {
+    display: flex;
+    flex-wrap: wrap;
+    gap: 8px;
+    margin-top: 12px;
+}
+
+.stack {
+    margin-top: 12px;
+}
+
+.button {
+    background: var(--surface);
+    border: 1px solid var(--border);
+    border-radius: 8px;
+    color: var(--fg);
+    cursor: pointer;
+    display: inline-block;
+    font: inherit;
+    font-size: 14px;
+    font-weight: 600;
+    padding: 8px 14px;
+    text-decoration: none;
+}
+
+.button:hover {
+    border-color: #b0b5bd;
+}
+
+.button-primary {
+    background: var(--accent);
+    border-color: var(--accent);
+    color: #fff;
+}
+
+.button-primary:hover {
+    filter: brightness(0.94);
+}
+
+.button-secondary {
+    color: var(--muted);
+}
+
+.button-small {
+    font-size: 13px;
+    padding: 6px 10px;
+}
+
+.field {
+    display: flex;
+    flex-direction: column;
+    gap: 6px;
+    margin-bottom: 12px;
+}
+
+.field > label {
+    font-size: 14px;
+    font-weight: 600;
+}
+
+textarea,
+select,
+input[type="text"],
+input[type="email"],
+input[type="password"] {
+    border: 1px solid var(--border);
+    border-radius: 6px;
+    font: inherit;
+    font-size: 14px;
+    padding: 8px 10px;
+    width: 100%;
+}
+
+textarea {
+    font-family: ui-monospace, SFMono-Regular, Menlo, Consolas, monospace;
+    font-size: 12px;
+    resize: vertical;
+}
+
+.checkbox {
+    align-items: center;
+    display: flex;
+    font-size: 14px;
+    font-weight: 400;
+    gap: 8px;
+}
+
+.checkbox input {
+    width: auto;
+}
+
+.advanced {
+    border: 1px solid var(--border);
+    border-radius: 8px;
+    margin-top: 12px;
+    padding: 12px;
+}
+
+.advanced summary {
+    cursor: pointer;
+    font-size: 14px;
+    font-weight: 600;
+}
+
+.advanced .field {
+    margin-top: 12px;
+}
+
+.scopes-list {
+    display: flex;
+    flex-wrap: wrap;
+    gap: 6px 14px;
+}
+
+.scope-item {
+    align-items: center;
+    display: flex;
+    font-size: 13px;
+    gap: 6px;
+}
+
+.scope-item input {
+    width: auto;
+}
+
+.inline-input {
+    display: flex;
+    gap: 8px;
+}
+
+.chip {
+    align-items: center;
+    background: #f4f5f7;
+    border: 1px solid var(--border);
+    border-radius: 6px;
+    display: inline-flex;
+    font-size: 13px;
+    gap: 6px;
+    margin: 4px 4px 0 0;
+    padding: 3px 8px;
+}
+
+.chip button {
+    background: none;
+    border: 0;
+    cursor: pointer;
+    font-size: 14px;
+    line-height: 1;
+    padding: 0;
+}
+
+.table {
+    border-collapse: collapse;
+    font-size: 13px;
+    margin-bottom: 12px;
+    width: 100%;
+}
+
+.table th {
+    border-bottom: 1px solid var(--border);
+    color: var(--muted);
+    font-weight: 600;
+    padding: 6px 8px 6px 0;
+    text-align: left;
+}
+
+.table td {
+    border-bottom: 1px solid var(--border);
+    padding: 8px 8px 8px 0;
+    vertical-align: top;
+}
+
+/* The last row's rule and the following section's rule would otherwise sit one
+   pixel apart and read as a double line. */
+.table tr:last-child td {
+    border-bottom: 0;
+}
+
+.row-actions {
+    display: flex;
+    gap: 6px;
+}
+
+.row-actions form {
+    margin: 0;
+}
+
+.mfa-device {
+    white-space: nowrap;
+}
+
+.tag {
+    background: #f4f5f7;
+    border: 1px solid var(--border);
+    border-radius: 4px;
+    font-size: 11px;
+    padding: 1px 5px;
+}
+
+@media (max-width: 480px) {
+    .kv {
+        grid-template-columns: minmax(0, 1fr);
+    }
+}
+
+/* Flow lists. The front page offers flows, not their parameters: six grants'
+   worth of inputs on one screen is a wall with no way to tell which fields
+   belong together, and most of them are irrelevant to what you came to do. */
+.flows {
+    list-style: none;
+    margin: 0;
+    padding: 0;
+}
+
+.flow {
+    align-items: center;
+    border-top: 1px solid var(--border);
+    display: flex;
+    gap: 16px;
+    justify-content: space-between;
+    padding: 12px 0;
+}
+
+.flow:first-child {
+    border-top: 0;
+    padding-top: 4px;
+}
+
+.flow-text {
+    min-width: 0;
+}
+
+.flow-name {
+    font-size: 14px;
+    font-weight: 600;
+}
+
+.flow-desc {
+    color: var(--muted);
+    font-size: 13px;
+}
+
+.flow form {
+    margin: 0;
+}
+
+/* Forms. One label column, so every field on a page lines up whatever its
+   control is. */
+.form {
+    margin-top: 16px;
+}
+
+.form-row {
+    display: grid;
+    gap: 4px 16px;
+    grid-template-columns: 150px minmax(0, 1fr);
+    margin-bottom: 14px;
+}
+
+.form-row > label {
+    font-size: 13px;
+    font-weight: 600;
+    padding-top: 8px;
+}
+
+/* Tokens and lists get the full width; identifiers do not need it. */
+.form-row--wide {
+    grid-template-columns: minmax(0, 1fr);
+}
+
+.form-row--wide > label {
+    padding-top: 0;
+}
+
+.form-control {
+    display: flex;
+    flex-direction: column;
+    gap: 4px;
+    max-width: 420px;
+}
+
+.form-row--wide .form-control {
+    max-width: none;
+}
+
+.form-control .hint {
+    margin: 0;
+}
+
+.form-actions {
+    display: flex;
+    gap: 8px;
+    margin-top: 16px;
+}
+
+.req {
+    color: var(--muted);
+    font-weight: 400;
+}
+
+.subhead {
+    border-top: 1px solid var(--border);
+    font-size: 14px;
+    font-weight: 600;
+    margin-top: 16px;
+    padding-top: 16px;
+}
+
+.note {
+    background: #fff8e6;
+    border-left: 3px solid #d9a441;
+    font-size: 13px;
+    margin: 12px 0;
+    padding: 8px 12px;
+}
+
+@media (max-width: 560px) {
+    .form-row {
+        grid-template-columns: minmax(0, 1fr);
+    }
+
+    .form-row > label {
+        padding-top: 0;
+    }
+
+    .flow {
+        align-items: flex-start;
+        flex-direction: column;
+        gap: 8px;
+    }
+}
+
+/* Syntax colours. Enough contrast to separate the parts, not so much that the
+   block becomes a Christmas tree. */
+.json-key {
+    color: #2f6fb0;
+}
+
+.json-string {
+    color: #227a4b;
+}
+
+.json-number {
+    color: #a2540d;
+}
+
+.json-boolean,
+.json-null {
+    color: #8250df;
+}
+
+.jwt-header {
+    color: #b3261e;
+}
+
+.jwt-payload {
+    color: #2f6fb0;
+}
+
+.jwt-signature {
+    color: #227a4b;
+}
+
+pre.code {
+    background: #f7f8fa;
+    border: 1px solid var(--border);
+    border-radius: 6px;
+    font-family: ui-monospace, SFMono-Regular, Menlo, Consolas, monospace;
+    font-size: 12px;
+    margin: 4px 0;
+    padding: 10px;
+    white-space: pre-wrap;
+}
+
+/* Section tabs on the API page. */
+.tabs {
+    border-bottom: 1px solid var(--border);
+    display: flex;
+    flex-wrap: wrap;
+    gap: 4px;
+    margin-bottom: 16px;
+}
+
+.tab {
+    border-bottom: 2px solid transparent;
+    color: var(--muted);
+    font-size: 14px;
+    font-weight: 600;
+    padding: 6px 10px;
+    text-decoration: none;
+}
+
+.tab:hover {
+    color: var(--fg);
+}
+
+.tab--current {
+    border-bottom-color: var(--accent);
+    color: var(--fg);
+}
+
+/* Row actions sit in a column of their own so the buttons line up down the
+   table instead of wherever the text before them happens to end. */
+.table .actions-col {
+    text-align: right;
+    white-space: nowrap;
+    width: 1%;
+}
+
+.table .row-actions {
+    display: flex;
+    gap: 6px;
+    justify-content: flex-end;
+}
+
+.table .button-small {
+    line-height: 1.2;
+}
+
+/* The flow list starts far enough below the heading to read as a list under it
+   rather than a first row of it. */
+.card-title + .flows,
+.card-title + .hint + .flows {
+    margin-top: 16px;
+}
+
+.card .table {
+    display: block;
+    overflow-x: auto;
+}
+
+/* An object's header: what it is on the left, the way back on the right. */
+.detail-head {
+    align-items: flex-start;
+    display: flex;
+    gap: 16px;
+    justify-content: space-between;
+}
+
+.detail-head .card-title {
+    margin-bottom: 2px;
+    overflow-wrap: anywhere;
+}
+
+.detail-head .hint {
+    margin: 0;
+}
+
+.table a {
+    color: var(--fg);
+}
+
+.table a:hover {
+    color: var(--accent);
+}
+
+/* A label column sized for "Redirect URIs" cannot hold
+   "device_authorization_endpoint" — the metadata page names its own fields, so
+   it gets a column wide enough for them and labels that wrap rather than run
+   into their values. */
+.kv .k {
+    overflow-wrap: anywhere;
+}
+
+.kv--metadata {
+    grid-template-columns: minmax(0, 280px) minmax(0, 1fr);
+}
+
+@media (max-width: 620px) {
+    .kv--metadata {
+        grid-template-columns: minmax(0, 1fr);
+    }
+}
+
+/* Grant types are URNs; side by side they wrap to one per line, so they get a
+   grid with cells wide enough to hold one. */
+.scopes-list--grid {
+    display: grid;
+    gap: 6px 16px;
+    grid-template-columns: repeat(auto-fill, minmax(260px, 1fr));
+}
+
+.chips {
+    display: flex;
+    flex-wrap: wrap;
+    gap: 4px;
+}
+
+.chips:empty {
+    display: none;
+}
+
+.chip-remove {
+    background: none;
+    border: 0;
+    cursor: pointer;
+    font-size: 14px;
+    line-height: 1;
+    padding: 0;
+}
+
+/* One authenticator per block, so its keys and its actions read as belonging
+   to it rather than to the section. */
+.mfa-device {
+    border: 1px solid var(--border);
+    border-radius: 8px;
+    margin-bottom: 12px;
+    padding: 12px;
+}
+
+.mfa-device .subhead {
+    border-top: 0;
+    margin-top: 0;
+    padding-top: 0;
+}
+
+.mfa-reset {
+    border-top: 1px solid var(--border);
+    margin-top: 16px;
+    padding-top: 16px;
+}
+
+/* Metadata names are long and fixed; values are lists. A column for the name
+   and pills for the values beats a two-column grid that has to fit both. */
+.meta-name {
+    color: var(--muted);
+    white-space: nowrap;
+    width: 1%;
+}
+
diff --git a/examples/example-app/server/subject.go b/examples/example-app/server/subject.go
new file mode 100644
index 0000000000..4c72120359
--- /dev/null
+++ b/examples/example-app/server/subject.go
@@ -0,0 +1,37 @@
+package server
+
+import "encoding/base64"
+
+// idTokenSubject builds the sub claim dex issues for a user.
+//
+// dex's API is inconsistent about which identifier it takes: sessions are keyed
+// by the ID the connector gave the user, refresh tokens by the sub claim. Rather
+// than ask for a value nobody has to hand, the app derives one from the other.
+//
+// The sub is base64url of a two-field protobuf message — user_id then conn_id,
+// both length-delimited strings — which is small enough to encode here and
+// avoids the example depending on dex's internals for it.
+func idTokenSubject(userID, connectorID string) string {
+	var buf []byte
+	buf = appendProtoString(buf, 1, userID)
+	buf = appendProtoString(buf, 2, connectorID)
+	return base64.RawURLEncoding.EncodeToString(buf)
+}
+
+// appendProtoString writes one length-delimited protobuf string field.
+func appendProtoString(buf []byte, field int, value string) []byte {
+	if value == "" {
+		return buf
+	}
+	buf = appendVarint(buf, uint64(field)<<3|2) // wire type 2: length-delimited
+	buf = appendVarint(buf, uint64(len(value)))
+	return append(buf, value...)
+}
+
+func appendVarint(buf []byte, v uint64) []byte {
+	for v >= 0x80 {
+		buf = append(buf, byte(v)|0x80)
+		v >>= 7
+	}
+	return append(buf, byte(v))
+}
diff --git a/examples/example-app/server/subject_test.go b/examples/example-app/server/subject_test.go
new file mode 100644
index 0000000000..6db15e8bce
--- /dev/null
+++ b/examples/example-app/server/subject_test.go
@@ -0,0 +1,23 @@
+package server
+
+import "testing"
+
+// The subject the app derives has to be byte for byte what dex puts in a token,
+// or the refresh listing it feeds asks about a user who does not exist. These
+// are subs taken from tokens dex issued.
+func TestIDTokenSubject(t *testing.T) {
+	tests := []struct {
+		userID      string
+		connectorID string
+		want        string
+	}{
+		{"0-385-28089-0", "mock", "Cg0wLTM4NS0yODA4OS0wEgRtb2Nr"},
+		{"08a8684b-db88-4b73-90a9-3cd1661f5466", "local", "CiQwOGE4Njg0Yi1kYjg4LTRiNzMtOTBhOS0zY2QxNjYxZjU0NjYSBWxvY2Fs"},
+	}
+
+	for _, tc := range tests {
+		if got := idTokenSubject(tc.userID, tc.connectorID); got != tc.want {
+			t.Errorf("idTokenSubject(%q, %q) = %q, want %q", tc.userID, tc.connectorID, got, tc.want)
+		}
+	}
+}
diff --git a/examples/example-app/server/templates/admin.html b/examples/example-app/server/templates/admin.html
new file mode 100644
index 0000000000..84bdd7c2ba
--- /dev/null
+++ b/examples/example-app/server/templates/admin.html
@@ -0,0 +1,673 @@
+{{define "content"}}
+<div class="card">
+    <div class="card-title">dex gRPC API</div>
+    <p class="hint">
+        The API that manages dex itself. It is a separate endpoint from the OpenID
+        Connect one, and tokens from that one do not authenticate against it.
+    </p>
+    <div class="kv">
+        {{if .Version}}<div class="k">Server</div><div class="v mono">{{.Version}}</div>{{end}}
+        {{if .Issuer}}<div class="k">Issuer</div><div class="v mono">{{.Issuer}}</div>{{end}}
+    </div>
+    {{if .Notice}}<p class="verdict">{{.Notice}}</p>{{end}}
+    {{if .Error}}<p class="verdict verdict-bad">{{.Error}}</p>{{end}}
+</div>
+
+{{if not .Configured}}
+<div class="card">
+    <div class="card-title">Not connected</div>
+    <p class="hint">This app was started without a gRPC address, so it has nothing to talk to. Two things are needed.</p>
+
+    <div class="form-row form-row--wide">
+        <label>In dex</label>
+        <div class="form-control">
+            <pre class="code">grpc:
+  addr: 127.0.0.1:5557</pre>
+            <small class="hint">Plaintext is fine on a loopback address; add tlsCert, tlsKey and tlsClientCA for anything else.</small>
+        </div>
+    </div>
+
+    <div class="form-row form-row--wide">
+        <label>In this app</label>
+        <div class="form-control">
+            <pre class="code">--grpc-addr 127.0.0.1:5557</pre>
+            <small class="hint">With certificates: --grpc-ca, --grpc-client-cert and --grpc-client-key.</small>
+        </div>
+    </div>
+</div>
+{{else}}
+
+<div class="card">
+    <nav class="tabs">
+        {{range .Sections}}
+        <a href="/admin?section={{.ID}}" class="tab{{if .Current}} tab--current{{end}}">{{.Label}}</a>
+        {{end}}
+    </nav>
+
+    {{if eq .Section "clients"}}
+    {{if .Clients}}
+    <table class="table">
+        <tr><th>ID</th><th>Name</th><th>Redirects</th><th class="actions-col"></th></tr>
+        {{range .Clients}}
+        <tr>
+            <td><a href="/admin/client/{{.ID}}" class="mono">{{.ID}}</a>{{if .Public}} <span class="tag">public</span>{{end}}</td>
+            <td>{{.Name}}</td>
+            <td class="small">{{len .RedirectURIs}}</td>
+            <td class="actions-col">
+                <div class="row-actions">
+                    <a href="/admin/client/{{.ID}}" class="button button-small">Open</a>
+                    <form action="/admin/client/delete" method="post">
+                        <input type="hidden" name="section" value="clients">
+                        <input type="hidden" name="id" value="{{.ID}}">
+                        <button type="submit" class="button button-small">Delete</button>
+                    </form>
+                </div>
+            </td>
+        </tr>
+        {{end}}
+    </table>
+    {{else}}
+    <p class="hint">ListClients returns nothing. Clients from a static config are not stored, and so are not listed.</p>
+    {{end}}
+
+    {{if not .Mode}}
+    <div class="form-actions">
+        <a href="/admin?section=clients&amp;mode=create" class="button button-primary">Create a client</a>
+    </div>
+    {{end}}
+
+    {{if eq .Mode "create"}}
+    <div class="subhead">CreateClient</div>
+    <form action="/admin/client/create" method="post" class="form">
+        <input type="hidden" name="section" value="clients">
+        <div class="form-row">
+            <label for="c_id">Client ID <span class="req" title="required">*</span></label>
+            <div class="form-control"><input id="c_id" type="text" name="id" required autocomplete="off"></div>
+        </div>
+        <div class="form-row">
+            <label for="c_name">Name</label>
+            <div class="form-control"><input id="c_name" type="text" name="name" autocomplete="off"></div>
+        </div>
+        <div class="form-row">
+            <label for="c_secret">Secret</label>
+            <div class="form-control">
+                <input id="c_secret" type="text" name="secret" autocomplete="off">
+                <small class="hint">Leave empty for a public client.</small>
+            </div>
+        </div>
+        <div class="form-row">
+            <label for="c_logo">Logo URL</label>
+            <div class="form-control"><input id="c_logo" type="text" name="logo_url" autocomplete="off"></div>
+        </div>
+        <div class="form-row form-row--wide">
+            <label for="redirect_uris_input">Redirect URIs</label>
+            <div class="form-control">
+                <div class="chips" data-name="redirect_uris">
+                </div>
+                <div class="inline-input">
+                    <input type="text" id="redirect_uris_input" class="chip-input" autocomplete="off">
+                    <button type="button" class="button button-small chip-add">Add</button>
+                </div>
+                <small class="hint">Where dex may send the browser back to.</small>
+            </div>
+        </div>
+        <div class="form-row form-row--wide">
+            <label for="trusted_peers_input">Trusted peers</label>
+            <div class="form-control">
+                <div class="chips" data-name="trusted_peers">
+                </div>
+                <div class="inline-input">
+                    <input type="text" id="trusted_peers_input" class="chip-input" autocomplete="off">
+                    <button type="button" class="button button-small chip-add">Add</button>
+                </div>
+                <small class="hint">Clients allowed to ask for tokens with this one as the audience.</small>
+            </div>
+        </div>
+        <div class="form-row form-row--wide">
+            <label for="allowed_connectors_input">Allowed connectors</label>
+            <div class="form-control">
+                <div class="chips" data-name="allowed_connectors">
+                </div>
+                <div class="inline-input">
+                    <input type="text" id="allowed_connectors_input" class="chip-input" autocomplete="off">
+                    <button type="button" class="button button-small chip-add">Add</button>
+                </div>
+                <small class="hint">Empty means every connector.</small>
+            </div>
+        </div>
+        <div class="form-row form-row--wide">
+            <label for="sso_shared_with_input">SSO shared with</label>
+            <div class="form-control">
+                <div class="chips" data-name="sso_shared_with">
+                </div>
+                <div class="inline-input">
+                    <input type="text" id="sso_shared_with_input" class="chip-input" autocomplete="off">
+                    <button type="button" class="button button-small chip-add">Add</button>
+                </div>
+                <small class="hint">Which clients may reuse this one's session. * for all.</small>
+            </div>
+        </div>
+        <div class="form-row form-row--wide">
+            <label for="post_logout_redirect_uris_input">Post-logout redirect URIs</label>
+            <div class="form-control">
+                <div class="chips" data-name="post_logout_redirect_uris">
+                </div>
+                <div class="inline-input">
+                    <input type="text" id="post_logout_redirect_uris_input" class="chip-input" autocomplete="off">
+                    <button type="button" class="button button-small chip-add">Add</button>
+                </div>
+                <small class="hint">Where the browser may be sent after logging out. Anything not listed is refused.</small>
+            </div>
+        </div>
+        <div class="form-row form-row--wide">
+            <label for="c_backchannel_logout_uri">Back-channel logout URI</label>
+            <div class="form-control">
+                <input type="text" id="c_backchannel_logout_uri" name="backchannel_logout_uri" placeholder="https://app.example.com/backchannel-logout" autocomplete="off">
+                <small class="hint">Where dex POSTs a logout token when a session ends. Empty means this client is never told.</small>
+            </div>
+        </div>
+        <div class="form-row">
+            <label for="c_refresh_token_lifetime">Refresh token lifetime</label>
+            <div class="form-control">
+                <select id="c_refresh_token_lifetime" name="refresh_token_lifetime">
+                    <option value="standalone">standalone</option>
+                    <option value="session">session</option>
+                </select>
+                <small class="hint">standalone tokens outlive the browser session, which is what keeps a CLI signed in. session tokens stop refreshing the moment that session ends.</small>
+            </div>
+        </div>
+        <div class="form-row">
+            <label for="c_public">Public</label>
+            <div class="form-control">
+                <label class="checkbox"><input id="c_public" type="checkbox" name="public" value="1"> no client secret</label>
+            </div>
+        </div>
+        <div class="form-actions">
+            <button type="submit" class="button button-primary">Create</button>
+            <a href="/admin?section=clients" class="button button-secondary">Cancel</a>
+        </div>
+    </form>
+    {{end}}
+
+    {{with .EditClient}}
+    <div class="subhead">UpdateClient — {{.ID}}</div>
+    <form action="/admin/client/update" method="post" class="form">
+        <input type="hidden" name="section" value="clients">
+        <input type="hidden" name="id" value="{{.ID}}">
+        <div class="form-row">
+            <label for="cu_name">Name</label>
+            <div class="form-control">
+                <input id="cu_name" type="text" name="name" value="{{.Name}}" autocomplete="off">
+                <small class="hint">Fields left empty stay as they are.</small>
+            </div>
+        </div>
+        <div class="form-row">
+            <label for="cu_logo">Logo URL</label>
+            <div class="form-control"><input id="cu_logo" type="text" name="logo_url" value="{{.LogoURL}}" autocomplete="off"></div>
+        </div>
+        <div class="form-row form-row--wide">
+            <label for="redirect_uris_input">Redirect URIs</label>
+            <div class="form-control">
+                <div class="chips" data-name="redirect_uris">
+                {{range .RedirectURIs}}<span class="chip"><span>{{.}}</span><input type="hidden" name="redirect_uris" value="{{.}}"><button type="button" class="chip-remove">&times;</button></span>{{end}}
+                </div>
+                <div class="inline-input">
+                    <input type="text" id="redirect_uris_input" class="chip-input" autocomplete="off">
+                    <button type="button" class="button button-small chip-add">Add</button>
+                </div>
+                <small class="hint">Where dex may send the browser back to.</small>
+            </div>
+        </div>
+        <div class="form-row form-row--wide">
+            <label for="trusted_peers_input">Trusted peers</label>
+            <div class="form-control">
+                <div class="chips" data-name="trusted_peers">
+                {{range .TrustedPeers}}<span class="chip"><span>{{.}}</span><input type="hidden" name="trusted_peers" value="{{.}}"><button type="button" class="chip-remove">&times;</button></span>{{end}}
+                </div>
+                <div class="inline-input">
+                    <input type="text" id="trusted_peers_input" class="chip-input" autocomplete="off">
+                    <button type="button" class="button button-small chip-add">Add</button>
+                </div>
+                <small class="hint">Clients allowed to ask for tokens with this one as the audience.</small>
+            </div>
+        </div>
+        <div class="form-row form-row--wide">
+            <label for="allowed_connectors_input">Allowed connectors</label>
+            <div class="form-control">
+                <div class="chips" data-name="allowed_connectors">
+                {{range .AllowedConnectors}}<span class="chip"><span>{{.}}</span><input type="hidden" name="allowed_connectors" value="{{.}}"><button type="button" class="chip-remove">&times;</button></span>{{end}}
+                </div>
+                <div class="inline-input">
+                    <input type="text" id="allowed_connectors_input" class="chip-input" autocomplete="off">
+                    <button type="button" class="button button-small chip-add">Add</button>
+                </div>
+                <small class="hint">Empty means every connector.</small>
+            </div>
+        </div>
+        <div class="form-row form-row--wide">
+            <label for="sso_shared_with_input">SSO shared with</label>
+            <div class="form-control">
+                <div class="chips" data-name="sso_shared_with">
+                {{range .SSOSharedWith}}<span class="chip"><span>{{.}}</span><input type="hidden" name="sso_shared_with" value="{{.}}"><button type="button" class="chip-remove">&times;</button></span>{{end}}
+                </div>
+                <div class="inline-input">
+                    <input type="text" id="sso_shared_with_input" class="chip-input" autocomplete="off">
+                    <button type="button" class="button button-small chip-add">Add</button>
+                </div>
+                <small class="hint">Which clients may reuse this one's session. * for all.</small>
+            </div>
+        </div>
+        <div class="form-row form-row--wide">
+            <label for="post_logout_redirect_uris_input">Post-logout redirect URIs</label>
+            <div class="form-control">
+                <div class="chips" data-name="post_logout_redirect_uris">
+                {{range .PostLogoutRedirectURIs}}<span class="chip"><span>{{.}}</span><input type="hidden" name="post_logout_redirect_uris" value="{{.}}"><button type="button" class="chip-remove">&times;</button></span>{{end}}
+                </div>
+                <div class="inline-input">
+                    <input type="text" id="post_logout_redirect_uris_input" class="chip-input" autocomplete="off">
+                    <button type="button" class="button button-small chip-add">Add</button>
+                </div>
+                <small class="hint">Where the browser may be sent after logging out. Anything not listed is refused.</small>
+            </div>
+        </div>
+        <div class="form-row form-row--wide">
+            <label for="e_backchannel_logout_uri">Back-channel logout URI</label>
+            <div class="form-control">
+                <input type="text" id="e_backchannel_logout_uri" name="backchannel_logout_uri" value="{{.BackchannelLogoutURI}}" placeholder="https://app.example.com/backchannel-logout" autocomplete="off">
+                <small class="hint">Clearing the box removes it, and dex stops sending this client logout tokens.</small>
+            </div>
+        </div>
+        <div class="form-row">
+            <label for="e_refresh_token_lifetime">Refresh token lifetime</label>
+            <div class="form-control">
+                <select id="e_refresh_token_lifetime" name="refresh_token_lifetime">
+                    <option value="standalone"{{if ne .RefreshTokenLifetime "session"}} selected{{end}}>standalone</option>
+                    <option value="session"{{if eq .RefreshTokenLifetime "session"}} selected{{end}}>session</option>
+                </select>
+                <small class="hint">Switching to session ends this client's refresh tokens with the browser session they came from.</small>
+            </div>
+        </div>
+        <p class="note">
+            UpdateClient carries no secret and no public flag, so neither can be
+            changed: dex expects a client that needs a new secret to be replaced.
+        </p>
+        <div class="form-actions">
+            <button type="submit" class="button button-primary">Update</button>
+            <a href="/admin?section=clients" class="button button-secondary">Cancel</a>
+        </div>
+    </form>
+    {{end}}
+    {{end}}
+
+    {{if eq .Section "passwords"}}
+    {{if .Passwords}}
+    <table class="table">
+        <tr><th>Email</th><th>Username</th><th>User ID</th><th class="actions-col"></th></tr>
+        {{range .Passwords}}
+        <tr>
+            <td class="mono">{{.Email}}</td>
+            <td>{{.Username}}</td>
+            <td class="mono small">{{.UserID}}</td>
+            <td class="actions-col">
+                <div class="row-actions">
+                    <a href="/admin?section=passwords&amp;mode=edit&amp;edit={{.Email}}" class="button button-small">Edit</a>
+                    <form action="/admin/password/delete" method="post">
+                        <input type="hidden" name="section" value="passwords">
+                        <input type="hidden" name="email" value="{{.Email}}">
+                        <button type="submit" class="button button-small">Delete</button>
+                    </form>
+                </div>
+            </td>
+        </tr>
+        {{end}}
+    </table>
+    {{else}}
+    <p class="hint">ListPasswords returns nothing. Users from staticPasswords are not stored, and so are not listed.</p>
+    {{end}}
+
+    {{if not .Mode}}
+    <div class="form-actions">
+        <a href="/admin?section=passwords&amp;mode=create" class="button button-primary">Create a password</a>
+        <a href="/admin?section=passwords&amp;mode=verify" class="button">Verify a password</a>
+    </div>
+    {{end}}
+
+    {{if eq .Mode "create"}}
+    <div class="subhead">CreatePassword</div>
+    <form action="/admin/password/create" method="post" class="form">
+        <input type="hidden" name="section" value="passwords">
+        <div class="form-row">
+            <label for="p_email">Email <span class="req" title="required">*</span></label>
+            <div class="form-control"><input id="p_email" type="email" name="email" required autocomplete="off"></div>
+        </div>
+        <div class="form-row">
+            <label for="p_username">Username</label>
+            <div class="form-control"><input id="p_username" type="text" name="username" autocomplete="off"></div>
+        </div>
+        <div class="form-row">
+            <label for="p_userid">User ID</label>
+            <div class="form-control">
+                <input id="p_userid" type="text" name="user_id" autocomplete="off">
+                <small class="hint">What the connector calls this user; the sub claim is built from it.</small>
+            </div>
+        </div>
+        <div class="form-row">
+            <label for="p_password">Password <span class="req" title="required">*</span></label>
+            <div class="form-control">
+                <input id="p_password" type="password" name="password" required autocomplete="off">
+                <small class="hint">The API takes a bcrypt hash; this page hashes what you type.</small>
+            </div>
+        </div>
+        <div class="form-actions">
+            <button type="submit" class="button button-primary">Create</button>
+            <a href="/admin?section=passwords" class="button button-secondary">Cancel</a>
+        </div>
+    </form>
+    {{end}}
+
+    {{with .EditPassword}}
+    <div class="subhead">UpdatePassword — {{.Email}}</div>
+    <form action="/admin/password/update" method="post" class="form">
+        <input type="hidden" name="section" value="passwords">
+        <input type="hidden" name="email" value="{{.Email}}">
+        <div class="form-row">
+            <label for="pu_username">Username</label>
+            <div class="form-control"><input id="pu_username" type="text" name="username" value="{{.Username}}" autocomplete="off"></div>
+        </div>
+        <div class="form-row">
+            <label for="pu_password">New password</label>
+            <div class="form-control">
+                <input id="pu_password" type="password" name="password" autocomplete="off">
+                <small class="hint">Leave empty to change only the username.</small>
+            </div>
+        </div>
+        <p class="note">
+            A password entry holds four things and no more: email, username, user
+            ID and the hash. UpdatePassword carries only the username and the hash,
+            and looks the entry up by its email — so the email and the user ID are
+            fixed once created. Claims like groups are not stored here at all; they
+            come from the connector.
+        </p>
+        <div class="form-actions">
+            <button type="submit" class="button button-primary">Update</button>
+            <a href="/admin?section=passwords" class="button button-secondary">Cancel</a>
+        </div>
+    </form>
+    {{end}}
+
+    {{if eq .Mode "verify"}}
+    <div class="subhead">VerifyPassword</div>
+    <form action="/admin/password/verify" method="post" class="form">
+        <input type="hidden" name="section" value="passwords">
+        <div class="form-row">
+            <label for="pv_email">Email <span class="req" title="required">*</span></label>
+            <div class="form-control"><input id="pv_email" type="email" name="email" required autocomplete="off"></div>
+        </div>
+        <div class="form-row">
+            <label for="pv_password">Password <span class="req" title="required">*</span></label>
+            <div class="form-control">
+                <input id="pv_password" type="password" name="password" required autocomplete="off">
+                <small class="hint">Checks a password without issuing anything.</small>
+            </div>
+        </div>
+        <div class="form-actions">
+            <button type="submit" class="button button-primary">Verify</button>
+            <a href="/admin?section=passwords" class="button button-secondary">Cancel</a>
+        </div>
+    </form>
+    {{end}}
+    {{end}}
+
+    {{if eq .Section "connectors"}}
+    {{if .Connectors}}
+    <table class="table">
+        <tr><th>ID</th><th>Type</th><th>Name</th><th class="actions-col"></th></tr>
+        {{range .Connectors}}
+        <tr>
+            <td><a href="/admin/connector/{{.ID}}" class="mono">{{.ID}}</a></td>
+            <td class="mono small">{{.Type}}</td>
+            <td>{{.Name}}</td>
+            <td class="actions-col">
+                <div class="row-actions">
+                    <a href="/admin/connector/{{.ID}}" class="button button-small">Open</a>
+                    <form action="/admin/connector/delete" method="post">
+                        <input type="hidden" name="section" value="connectors">
+                        <input type="hidden" name="id" value="{{.ID}}">
+                        <button type="submit" class="button button-small">Delete</button>
+                    </form>
+                </div>
+            </td>
+        </tr>
+        {{end}}
+    </table>
+    {{else}}
+    <p class="hint">ListConnectors returns nothing. Connectors from the config file are not stored, and so are not listed.</p>
+    {{end}}
+
+    {{if not .Mode}}
+    <div class="form-actions">
+        <a href="/admin?section=connectors&amp;mode=create" class="button button-primary">Create a connector</a>
+        <a href="/admin?section=connectors&amp;mode=terminate" class="button">Terminate a connector's sessions</a>
+    </div>
+    {{end}}
+
+    {{if eq .Mode "terminate"}}
+    <div class="subhead">TerminateSessionsByConnector</div>
+    <form action="/admin/session/terminate-connector" method="post" class="form">
+        <input type="hidden" name="section" value="connectors">
+        <input type="hidden" name="back" value="/admin?section=connectors">
+        <div class="form-row">
+            <label for="tc_conn">Connector <span class="req" title="required">*</span></label>
+            <div class="form-control">
+                <input id="tc_conn" type="text" name="connector_id" required autocomplete="off">
+                <small class="hint">Ends every session that came through it, for every user — for a connector being retired or one you no longer trust.</small>
+            </div>
+        </div>
+        <div class="form-actions">
+            <button type="submit" class="button button-primary">Terminate</button>
+            <a href="/admin?section=connectors" class="button button-secondary">Cancel</a>
+        </div>
+    </form>
+    {{end}}
+
+    {{if eq .Mode "create"}}
+    <div class="subhead">CreateConnector</div>
+    <form action="/admin/connector/create" method="post" class="form">
+        <input type="hidden" name="section" value="connectors">
+        <div class="form-row">
+            <label for="n_id">ID <span class="req" title="required">*</span></label>
+            <div class="form-control"><input id="n_id" type="text" name="id" required autocomplete="off"></div>
+        </div>
+        <div class="form-row">
+            <label for="n_type">Type <span class="req" title="required">*</span></label>
+            <div class="form-control">
+                <select id="n_type" name="type" required>
+                    {{range $.ConnectorTypes}}<option value="{{.}}">{{.}}</option>{{end}}
+                </select>
+            </div>
+        </div>
+        <div class="form-row">
+            <label for="n_name">Name <span class="req" title="required">*</span></label>
+            <div class="form-control"><input id="n_name" type="text" name="name" required autocomplete="off"></div>
+        </div>
+        <div class="form-row form-row--wide">
+            <label for="n_config">Config</label>
+            <div class="form-control">
+                <textarea id="n_config" name="config" rows="5" placeholder='{"issuer": "https://accounts.google.com", "clientID": "..."}'></textarea>
+                <small class="hint">The connector's own JSON configuration — the same keys the config file takes for this type.</small>
+            </div>
+        </div>
+        <div class="form-row form-row--wide">
+            <label>Grant types</label>
+            <div class="form-control">
+                <div class="scopes-list scopes-list--grid">
+                    {{range $.ConnectorGrantTypes}}
+                    <div class="scope-item">
+                        <input type="checkbox" name="grant_types" value="{{.Value}}" id="ng_{{.Label}}">
+                        <label for="ng_{{.Label}}" title="{{.Value}}">{{.Label}}</label>
+                    </div>
+                    {{end}}
+                </div>
+                <small class="hint">Nothing ticked leaves the connector unrestricted.</small>
+            </div>
+        </div>
+        <div class="form-actions">
+            <button type="submit" class="button button-primary">Create</button>
+            <a href="/admin?section=connectors" class="button button-secondary">Cancel</a>
+        </div>
+    </form>
+    {{end}}
+    {{end}}
+
+    {{if eq .Section "identities"}}
+    {{if .Identities}}
+    <table class="table">
+        <tr><th>User</th><th>Connector</th><th>Groups</th><th>MFA</th><th class="actions-col"></th></tr>
+        {{range .Identities}}
+        <tr>
+            <td>
+                <a href="/admin/user/{{.ConnectorID}}/{{.UserID}}">{{if .Email}}{{.Email}}{{else}}{{.UserID}}{{end}}</a>
+                <div class="mono small hint">{{.UserID}}</div>
+            </td>
+            <td class="mono small">{{.ConnectorID}}</td>
+            <td class="small">{{len .Groups}}</td>
+            <td class="small">{{len .MFADevices}}</td>
+            <td class="actions-col">
+                <div class="row-actions">
+                    <a href="/admin/user/{{.ConnectorID}}/{{.UserID}}" class="button button-small">Open</a>
+                </div>
+            </td>
+        </tr>
+        {{end}}
+    </table>
+    <p class="hint">
+        Counts rather than contents: a user with forty groups would otherwise be the
+        whole table. Everything about one — claims, consents, factors — is on its page.
+    </p>
+    {{else}}
+    <p class="hint">
+        ListUserIdentities returns nothing. An identity appears once someone signs
+        in through a connector — and the method itself needs dex started with
+        <code>DEX_API_SESSIONS_IDENTITIES_CRUD=true</code>.
+    </p>
+    {{end}}
+    {{end}}
+
+    {{if eq .Section "discovery"}}
+    <p class="hint">What dex reports about itself through GetDiscovery.</p>
+    <table class="table">
+        {{range .Endpoints}}
+        <tr><td class="mono small meta-name">{{.Name}}</td><td class="mono small">{{.Value}}</td></tr>
+        {{end}}
+        {{range .Capabilities}}
+        <tr>
+            <td class="mono small meta-name">{{.Name}}</td>
+            <td class="mono small">{{range .Values}}{{.}}<br>{{end}}</td>
+        </tr>
+        {{end}}
+    </table>
+    {{end}}
+
+    {{if eq .Section "sessions"}}
+    <p class="hint">
+        Pick a user from the Users tab, or name one here. Sessions are keyed by the
+        ID the connector gave the user; refresh tokens by the sub claim, which the
+        app derives from that ID and the connector. Listing sessions needs dex
+        started with <code>DEX_API_SESSIONS_IDENTITIES_CRUD=true</code>.
+    </p>
+    <form action="/admin" method="get" class="form">
+        <input type="hidden" name="section" value="sessions">
+        <div class="form-row">
+            <label for="s_user">User ID</label>
+            <div class="form-control"><input id="s_user" type="text" name="user_id" value="{{.UserID}}" autocomplete="off"></div>
+        </div>
+        <div class="form-row">
+            <label for="s_conn">Connector</label>
+            <div class="form-control">
+                <input id="s_conn" type="text" name="connector_id" value="{{.ConnectorID}}" autocomplete="off">
+                <small class="hint">Needed for the refresh tokens.</small>
+            </div>
+        </div>
+        <div class="form-actions"><button type="submit" class="button button-primary">List</button></div>
+    </form>
+
+    {{if .UserID}}
+    <div class="subhead">Sessions</div>
+    {{if .Sessions}}
+    <table class="table">
+        <tr><th>Session</th><th>Connector</th><th>From</th><th>Device</th><th>Started</th><th>Expires</th><th class="actions-col"></th></tr>
+        {{range .Sessions}}
+        <tr>
+            <td class="mono small">{{.ID}}</td>
+            <td class="mono small">{{.ConnectorID}}</td>
+            <td class="mono small">{{.IPAddress}}</td>
+            <td class="mono small">{{.UserAgent}}</td>
+            <td class="small">{{.Created}}</td>
+            <td class="small">{{.Expires}}</td>
+            <td class="actions-col">
+                <div class="row-actions">
+                    <form action="/admin/session/delete" method="post">
+                        <input type="hidden" name="section" value="sessions">
+                        <input type="hidden" name="list_user_id" value="{{$.UserID}}">
+                        <input type="hidden" name="list_connector_id" value="{{$.ConnectorID}}">
+                        <input type="hidden" name="session_id" value="{{.ID}}">
+                        <button type="submit" class="button button-small">Delete</button>
+                    </form>
+                </div>
+            </td>
+        </tr>
+        {{end}}
+    </table>
+    {{else}}
+    <p class="hint">No sessions for this user.</p>
+    {{end}}
+    {{end}}
+
+    {{if and .UserID .ConnectorID}}
+    <div class="subhead">Refresh tokens</div>
+    {{if .RefreshTokens}}
+    <table class="table">
+        <tr><th>Client</th><th>Created</th><th>Last used</th><th class="actions-col"></th></tr>
+        {{range .RefreshTokens}}
+        <tr>
+            <td class="mono">{{.ClientID}}</td>
+            <td class="small">{{.Created}}</td>
+            <td class="small">{{.LastUsed}}</td>
+            <td class="actions-col">
+                <div class="row-actions">
+                    <form action="/admin/refresh/revoke" method="post">
+                        <input type="hidden" name="section" value="sessions">
+                        <input type="hidden" name="list_user_id" value="{{$.UserID}}">
+                        <input type="hidden" name="list_connector_id" value="{{$.ConnectorID}}">
+                        <input type="hidden" name="user_id" value="{{$.UserID}}">
+                        <input type="hidden" name="connector_id" value="{{$.ConnectorID}}">
+                        <input type="hidden" name="client_id" value="{{.ClientID}}">
+                        <button type="submit" class="button button-small">Revoke</button>
+                    </form>
+                </div>
+            </td>
+        </tr>
+        {{end}}
+    </table>
+    <p class="hint">Revoke one, then let this app refresh: the sign-in ends. That is the pair worth trying together.</p>
+    {{else}}
+    <p class="hint">No refresh tokens for this user. They are issued only when offline_access is requested.</p>
+    {{end}}
+    {{end}}
+
+    {{if .UserID}}
+    <div class="subhead">TerminateSessionsByUser</div>
+    <form action="/admin/session/terminate" method="post" class="form">
+        <input type="hidden" name="section" value="sessions">
+        <input type="hidden" name="list_user_id" value="{{.UserID}}">
+        <input type="hidden" name="list_connector_id" value="{{.ConnectorID}}">
+        <input type="hidden" name="user_id" value="{{.UserID}}">
+        <p class="hint">Ends every session this user has, whatever connector they came through.</p>
+        <div class="form-actions"><button type="submit" class="button">Terminate all sessions</button></div>
+    </form>
+    {{end}}
+
+    {{end}}
+</div>
+{{end}}
+{{end}}
diff --git a/examples/example-app/server/templates/detail.html b/examples/example-app/server/templates/detail.html
new file mode 100644
index 0000000000..a14ff9fe27
--- /dev/null
+++ b/examples/example-app/server/templates/detail.html
@@ -0,0 +1,233 @@
+{{define "content"}}
+<div class="card">
+    <div class="detail-head">
+        <div>
+            <div class="card-title">{{.Title}}</div>
+            <div class="hint">{{.Kind}}</div>
+        </div>
+        <a href="{{.BackURL}}" class="button button-secondary">Back</a>
+    </div>
+    {{if .Error}}<p class="verdict verdict-bad">{{.Error}}</p>{{end}}
+</div>
+
+{{with .Client}}
+<div class="card">
+    <div class="card-title">Client</div>
+    <div class="kv">
+        <div class="k">ID</div><div class="v mono">{{.ID}}</div>
+        <div class="k">Name</div><div class="v">{{if .Name}}{{.Name}}{{else}}<span class="hint">not set</span>{{end}}</div>
+        <div class="k">Type</div><div class="v">{{if .Public}}public — no secret{{else}}confidential{{end}}</div>
+        {{if .Secret}}<div class="k">Secret</div><div class="v mono">{{.Secret}}</div>{{end}}
+        <div class="k">Logo URL</div><div class="v mono">{{if .LogoURL}}{{.LogoURL}}{{else}}<span class="hint">not set</span>{{end}}</div>
+        <div class="k">Redirect URIs</div>
+        <div class="v mono">{{range .RedirectURIs}}{{.}}<br>{{else}}<span class="hint">none</span>{{end}}</div>
+        <div class="k">Trusted peers</div>
+        <div class="v mono">{{range .TrustedPeers}}{{.}}<br>{{else}}<span class="hint">none</span>{{end}}</div>
+        <div class="k">Allowed connectors</div>
+        <div class="v mono">{{range .AllowedConnectors}}{{.}}<br>{{else}}<span class="hint">all</span>{{end}}</div>
+        <div class="k">SSO shared with</div>
+        <div class="v mono">{{range .SSOSharedWith}}{{.}}<br>{{else}}<span class="hint">the sessions default</span>{{end}}</div>
+        <div class="k">Post-logout redirect URIs</div>
+        <div class="v mono">{{range .PostLogoutRedirectURIs}}{{.}}<br>{{else}}<span class="hint">none — logout cannot redirect back</span>{{end}}</div>
+        <div class="k">Back-channel logout URI</div>
+        <div class="v mono">{{if .BackchannelLogoutURI}}{{.BackchannelLogoutURI}}{{else}}<span class="hint">not set — this client is not notified when a session ends</span>{{end}}</div>
+        <div class="k">Refresh token lifetime</div>
+        <div class="v mono">{{if eq .RefreshTokenLifetime "session"}}session — refreshing stops when the browser session ends{{else}}standalone — refresh tokens outlive the browser session{{end}}</div>
+    </div>
+    <div class="form-actions">
+        <a href="/admin?section=clients&amp;mode=edit&amp;edit={{.ID}}" class="button button-primary">Edit</a>
+    </div>
+    <p class="note">
+        The API's UpdateClient does not carry a secret or the public flag, so
+        neither can be changed here: dex expects a client that needs a new secret
+        to be deleted and created again.
+    </p>
+</div>
+{{end}}
+
+{{with .Connector}}
+<div class="card">
+    <div class="card-title">Connector</div>
+    <div class="kv">
+        <div class="k">ID</div><div class="v mono">{{.ID}}</div>
+        <div class="k">Type</div><div class="v mono">{{.Type}}</div>
+        <div class="k">Name</div><div class="v">{{.Name}}</div>
+        <div class="k">Grant types</div>
+        <div class="v mono">{{range .GrantTypes}}{{.}}<br>{{else}}<span class="hint">unrestricted</span>{{end}}</div>
+    </div>
+</div>
+
+<div class="card">
+    <div class="card-title">Configuration</div>
+    {{if .Config}}<pre class="json">{{.Config}}</pre>{{else}}<p class="hint">No configuration stored.</p>{{end}}
+</div>
+
+<div class="card">
+    <div class="card-title">UpdateConnector</div>
+    <form action="/admin/connector/update" method="post" class="form">
+        <input type="hidden" name="id" value="{{.ID}}">
+        <input type="hidden" name="back" value="/admin/connector/{{.ID}}">
+        <div class="form-row">
+            <label for="u_type">Type</label>
+            <div class="form-control"><input id="u_type" type="text" name="type" value="{{.Type}}" autocomplete="off"></div>
+        </div>
+        <div class="form-row">
+            <label for="u_name">Name</label>
+            <div class="form-control"><input id="u_name" type="text" name="name" value="{{.Name}}" autocomplete="off"></div>
+        </div>
+        <div class="form-row form-row--wide">
+            <label for="u_config">Config</label>
+            <div class="form-control">
+                <textarea id="u_config" name="config" rows="8">{{.Config}}</textarea>
+                <small class="hint">Left empty, the stored configuration is kept.</small>
+            </div>
+        </div>
+        <div class="form-row form-row--wide">
+            <label>Grant types</label>
+            <div class="form-control">
+                <select name="grant_mode">
+                    <option value="">Leave as they are</option>
+                    <option value="any">No restriction</option>
+                    <option value="restrict">Only those ticked</option>
+                </select>
+                <div class="scopes-list scopes-list--grid">
+                    {{range $g := $.ConnectorGrantTypes}}
+                    <div class="scope-item">
+                        <input type="checkbox" name="grant_types" value="{{$g.Value}}" id="cg_{{$g.Label}}">
+                        <label for="cg_{{$g.Label}}" title="{{$g.Value}}">{{$g.Label}}</label>
+                    </div>
+                    {{end}}
+                </div>
+            </div>
+        </div>
+        <div class="form-actions">
+            <button type="submit" class="button button-primary">Update</button>
+            <a href="/admin?section=connectors" class="button button-secondary">Cancel</a>
+        </div>
+    </form>
+</div>
+{{end}}
+
+{{with .Identity}}
+<div class="card">
+    <div class="card-title">Identity</div>
+    <div class="kv">
+        <div class="k">User ID</div><div class="v mono">{{.UserID}}</div>
+        <div class="k">Connector</div><div class="v mono">{{.ConnectorID}}</div>
+        <div class="k">Email</div><div class="v">{{.Email}}{{if .EmailVerified}} (verified){{else}} (not verified){{end}}</div>
+        <div class="k">Username</div><div class="v">{{if .Username}}{{.Username}}{{else}}<span class="hint">not set</span>{{end}}</div>
+        <div class="k">Groups</div>
+        <div class="v">{{range .Groups}}{{.}}<br>{{else}}<span class="hint">none</span>{{end}}</div>
+        {{if .Created}}<div class="k">First seen</div><div class="v">{{.Created}}</div>{{end}}
+        {{if .LastLogin}}<div class="k">Last sign-in</div><div class="v">{{.LastLogin}}</div>{{end}}
+    </div>
+    <p class="note">
+        None of this is editable: it is what the connector said about the user at
+        their last sign-in, and dex re-records it at the next one. For the local
+        connector, the entry behind it is on the Passwords tab.
+    </p>
+</div>
+
+<div class="card">
+    <div class="card-title">Consents</div>
+    {{if .Consents}}
+    <table class="table">
+        <tr><th>Client</th><th>Scopes</th><th class="actions-col"></th></tr>
+        {{range .Consents}}
+        <tr>
+            <td class="mono">{{.ClientID}}</td>
+            <td class="small">{{range .Scopes}}{{.}} {{end}}</td>
+            <td class="actions-col">
+                <div class="row-actions">
+                    <form action="/admin/consent/revoke" method="post">
+                        <input type="hidden" name="user_id" value="{{$.Identity.UserID}}">
+                        <input type="hidden" name="connector_id" value="{{$.Identity.ConnectorID}}">
+                        <input type="hidden" name="client_id" value="{{.ClientID}}">
+                        <input type="hidden" name="back" value="/admin/user/{{$.Identity.ConnectorID}}/{{$.Identity.UserID}}">
+                        <button type="submit" class="button button-small">Revoke</button>
+                    </form>
+                </div>
+            </td>
+        </tr>
+        {{end}}
+    </table>
+    <p class="hint">Revoking one puts the consent screen back in front of the user for that client.</p>
+    {{else}}
+    <p class="hint">Nothing approved yet, or the client skips the consent screen.</p>
+    {{end}}
+</div>
+
+<div class="card">
+    <div class="card-title">Multi-factor</div>
+    {{if .MFADevices}}
+    {{range .MFADevices}}
+    <div class="mfa-device">
+        <div class="subhead">{{.AuthenticatorID}}</div>
+        <div class="kv">
+            <div class="k">Secret</div><div class="v">{{if .HasSecret}}enrolled{{else}}<span class="hint">none</span>{{end}}</div>
+            <div class="k">Keys</div><div class="v">{{len .Credentials}}</div>
+        </div>
+
+        {{if .Credentials}}
+        <table class="table">
+            <tr><th>Key</th><th>Transport</th><th>Uses</th><th>Registered</th><th class="actions-col"></th></tr>
+            {{range .Credentials}}
+            <tr>
+                <td>
+                    {{if .DisplayName}}{{.DisplayName}}{{else}}<span class="hint">unnamed</span>{{end}}
+                    <div class="mono small hint">{{.ID}}</div>
+                </td>
+                <td class="small">{{range .Transport}}{{.}} {{else}}<span class="hint">unknown</span>{{end}}</td>
+                <td class="small">{{.SignCount}}</td>
+                <td class="small">{{.Created}}</td>
+                <td class="actions-col">
+                    <div class="row-actions">
+                        <form action="/admin/webauthn/delete" method="post">
+                            <input type="hidden" name="user_id" value="{{$.Identity.UserID}}">
+                            <input type="hidden" name="connector_id" value="{{$.Identity.ConnectorID}}">
+                            <input type="hidden" name="credential_id" value="{{.ID}}">
+                            <input type="hidden" name="back" value="/admin/user/{{$.Identity.ConnectorID}}/{{$.Identity.UserID}}">
+                            <button type="submit" class="button button-small">Delete</button>
+                        </form>
+                    </div>
+                </td>
+            </tr>
+            {{end}}
+        </table>
+        {{end}}
+
+        {{if .HasSecret}}
+        <form action="/admin/mfa/secret/delete" method="post">
+            <input type="hidden" name="user_id" value="{{$.Identity.UserID}}">
+            <input type="hidden" name="connector_id" value="{{$.Identity.ConnectorID}}">
+            <input type="hidden" name="authenticator_id" value="{{.AuthenticatorID}}">
+            <input type="hidden" name="back" value="/admin/user/{{$.Identity.ConnectorID}}/{{$.Identity.UserID}}">
+            <div class="form-actions"><button type="submit" class="button button-small">Delete this secret</button></div>
+        </form>
+        {{end}}
+    </div>
+    {{end}}
+
+    <div class="mfa-reset">
+        <form action="/admin/mfa/reset" method="post">
+            <input type="hidden" name="user_id" value="{{.UserID}}">
+            <input type="hidden" name="connector_id" value="{{.ConnectorID}}">
+            <input type="hidden" name="back" value="/admin/user/{{.ConnectorID}}/{{.UserID}}">
+            <p class="hint">Clears every factor above at once; the user enrols again on their next sign-in.</p>
+            <div class="form-actions"><button type="submit" class="button">Reset all MFA</button></div>
+        </form>
+    </div>
+    {{else}}
+    <p class="hint">Nothing enrolled.</p>
+    {{end}}
+</div>
+
+<div class="card">
+    <div class="card-title">Sessions</div>
+    <p class="hint">Sessions and refresh tokens for this user are on the Sessions tab.</p>
+    <div class="form-actions">
+        <a href="/admin?section=sessions&amp;user_id={{.UserID}}&amp;connector_id={{.ConnectorID}}" class="button">Open them</a>
+    </div>
+</div>
+{{end}}
+{{end}}
diff --git a/examples/example-app/server/templates/device.html b/examples/example-app/server/templates/device.html
new file mode 100644
index 0000000000..98181835b3
--- /dev/null
+++ b/examples/example-app/server/templates/device.html
@@ -0,0 +1,25 @@
+{{define "content"}}
+<div class="card">
+    <div class="card-title">Device code flow</div>
+    <p class="hint">
+        Enter the code at the verification URL. This page polls the token endpoint
+        every {{.PollInterval}}s until the provider says the code has been approved.
+    </p>
+    <div class="kv">
+        <div class="k">Verification URL</div>
+        <div class="v mono"><code id="verification-url">{{.VerificationURI}}</code></div>
+        <div class="k">User code</div>
+        <div class="v mono user-code"><code id="user-code">{{.UserCode}}</code></div>
+    </div>
+    <div class="row">
+        <button type="button" id="open-auth-btn" class="button button-primary">Open the verification page</button>
+        <a href="/" class="button button-secondary">Cancel</a>
+    </div>
+    <p id="status-text" class="hint">Waiting for authorization…</p>
+    <p id="error-message" class="verdict verdict-bad" style="display: none;"></p>
+
+    <input type="hidden" id="device-code" value="{{.DeviceCode}}">
+    <input type="hidden" id="poll-interval" value="{{.PollInterval}}">
+</div>
+<script src="/static/device.js"></script>
+{{end}}
diff --git a/examples/example-app/server/templates/form.html b/examples/example-app/server/templates/form.html
new file mode 100644
index 0000000000..fdfa83bfb6
--- /dev/null
+++ b/examples/example-app/server/templates/form.html
@@ -0,0 +1,52 @@
+{{define "content"}}
+<div class="card">
+    <div class="card-title">{{.Title}}</div>
+    {{if .Description}}<p class="hint">{{.Description}}</p>{{end}}
+    {{if .Note}}<p class="note">{{.Note}}</p>{{end}}
+
+    <form action="{{.Action}}" method="post" class="form">
+        {{range .Fields}}
+        <div class="form-row{{if .Wide}} form-row--wide{{end}}">
+            <label for="f_{{.Name}}">{{.Label}}{{if .Required}} <span class="req" title="required">*</span>{{end}}</label>
+            <div class="form-control">
+                {{if eq .Type "scopes"}}
+                <div class="scopes-list">
+                    {{range .Options}}
+                    <div class="scope-item">
+                        <input type="checkbox" name="scopes" value="{{.Value}}" id="scope_{{.Value}}"{{if .Selected}} checked{{end}}>
+                        <label for="scope_{{.Value}}">{{.Value}}</label>
+                    </div>
+                    {{end}}
+                </div>
+                <div class="inline-input">
+                    <input type="text" class="custom-scope-input" placeholder="custom-scope">
+                    <button type="button" class="button button-small add-custom-scope">Add</button>
+                </div>
+                {{else if eq .Type "textarea"}}
+                <textarea id="f_{{.Name}}" name="{{.Name}}" rows="4" placeholder="{{.Placeholder}}"{{if .Required}} required{{end}}>{{.Value}}</textarea>
+                {{if .Options}}
+                <div class="row">
+                    {{range .Options}}
+                    <button type="button" class="button button-small fill-token" data-token="{{.Value}}">Use my {{.Label}}</button>
+                    {{end}}
+                </div>
+                {{end}}
+                {{else if eq .Type "select"}}
+                <select id="f_{{.Name}}" name="{{.Name}}">
+                    {{range .Options}}<option value="{{.Value}}">{{.Label}}</option>{{end}}
+                </select>
+                {{else}}
+                <input id="f_{{.Name}}" type="{{.Type}}" name="{{.Name}}" value="{{.Value}}" placeholder="{{.Placeholder}}" autocomplete="off"{{if .Required}} required{{end}}>
+                {{end}}
+                {{if .Hint}}<small class="hint">{{.Hint}}</small>{{end}}
+            </div>
+        </div>
+        {{end}}
+
+        <div class="form-actions">
+            <button type="submit" class="button button-primary">{{.Submit}}</button>
+            <a href="/" class="button button-secondary">Cancel</a>
+        </div>
+    </form>
+</div>
+{{end}}
diff --git a/examples/example-app/server/templates/index.html b/examples/example-app/server/templates/index.html
new file mode 100644
index 0000000000..f20abfae19
--- /dev/null
+++ b/examples/example-app/server/templates/index.html
@@ -0,0 +1,149 @@
+{{define "content"}}
+{{if .User}}
+<div class="card" id="signed-in-card">
+    <div class="card-title">Signed in</div>
+    <div class="kv">
+        {{if .User.Name}}<div class="k">Name</div><div class="v">{{.User.Name}}</div>{{end}}
+        {{if .User.Email}}<div class="k">Email</div><div class="v">{{.User.Email}}</div>{{end}}
+        <div class="k">Subject</div><div class="v mono">{{.User.Subject}}</div>
+        {{if .User.SessionID}}<div class="k">Session (sid)</div><div class="v mono">{{.User.SessionID}}</div>{{end}}
+        {{with .Token}}
+        <div class="k">Access token</div><div class="v mono">{{.AccessToken}}</div>
+        {{if .Expiry}}<div class="k">Expires</div><div class="v">{{.Expiry}}{{if .Expired}} — expired, refreshing on next load{{end}}</div>{{end}}
+        <div class="k">Refresh token</div><div class="v">{{if .RefreshToken}}held{{else}}none — request offline_access to get one{{end}}</div>
+        {{end}}
+    </div>
+    <div class="form-actions">
+        <a href="/tools" class="button">Inspect tokens</a>
+        <a href="/logout" class="button button-secondary">Log out</a>
+    </div>
+    {{if .SessionCheck}}
+    <p class="hint">Re-checked with the provider every {{.SessionCheck}} using prompt=none, so signing out of dex elsewhere ends this session too.</p>
+    {{end}}
+</div>
+{{end}}
+{{/* Rendered whichever way round, so a back-channel logout can swap the two
+     without the page having to build markup the template already owns. */}}
+<div class="card" id="signed-out-card"{{if .User}} hidden{{end}}>
+    <div class="card-title">Not signed in</div>
+    <p class="hint">
+        The example client for <b>dex</b>. Pick a flow to run it and see what comes back.
+        Configuration for each one is in the
+        <a href="https://github.com/dexidp/dex/blob/master/examples/example-app/README.md" target="_blank" rel="noopener">README</a>.
+    </p>
+</div>
+
+<div class="card">
+    <div class="card-title">Flows through the browser</div>
+    <ul class="flows">
+        <li class="flow">
+            <div class="flow-text">
+                <div class="flow-name">Authorization code{{if .PKCE}} with PKCE{{end}}</div>
+                <div class="flow-desc">The one web applications use. Redirects to dex and comes back with a code.</div>
+            </div>
+            <form action="/login" method="post" id="login-form">
+                <button type="submit" class="button button-primary">Run</button>
+            </form>
+        </li>
+        {{if .DeviceSupported}}
+        <li class="flow">
+            <div class="flow-text">
+                <div class="flow-name">Device code</div>
+                <div class="flow-desc">For input-constrained devices: shows a code to type in elsewhere while this page polls.</div>
+            </div>
+            <button type="button" id="device-grant-btn" class="button button-primary">Run</button>
+        </li>
+        {{end}}
+    </ul>
+
+    <details class="advanced">
+        <summary>Authorization request options</summary>
+        <p class="hint">These apply to both flows above.</p>
+        <div class="form-row form-row--wide">
+            <label>Scopes</label>
+            <div class="form-control">
+                <div class="scopes-list" id="scopes-list">
+                    {{range .ScopesSupported}}
+                    <div class="scope-item">
+                        <input type="checkbox" name="extra_scopes" value="{{.}}" id="scope_{{.}}" form="login-form">
+                        <label for="scope_{{.}}">{{.}}</label>
+                    </div>
+                    {{end}}
+                </div>
+                {{if eq (len .ScopesSupported) 0}}
+                <small class="hint">The provider advertises no scopes — add them by hand.</small>
+                {{end}}
+                <div class="inline-input">
+                    <input type="text" id="custom_scope_input" placeholder="custom-scope">
+                    <button type="button" id="add-custom-scope" class="button button-small">Add</button>
+                </div>
+                <small class="hint">openid is always requested. offline_access is what gets you a refresh token.</small>
+            </div>
+        </div>
+        <div class="form-row">
+            <label for="cross_client_input">Cross-client audience</label>
+            <div class="form-control">
+                <div id="cross-client-list"></div>
+                <div class="inline-input">
+                    <input type="text" id="cross_client_input" placeholder="other-client-id">
+                    <button type="button" id="add-cross-client" class="button button-small">Add</button>
+                </div>
+                <small class="hint">Sent as audience:server:client_id:&lt;id&gt;, which asks dex for a token another client will accept.</small>
+            </div>
+        </div>
+        <div class="form-row">
+            <label for="connector_id">Connector</label>
+            <div class="form-control">
+                <input type="text" id="connector_id" name="connector_id" placeholder="connector id" form="login-form">
+                <small class="hint">Skips dex's connector selection screen.</small>
+            </div>
+        </div>
+    </details>
+</div>
+
+<div class="card">
+    <div class="card-title">Flows without a browser</div>
+    <p class="hint">These call the token endpoint directly. Each one asks for its own parameters.</p>
+    <ul class="flows">
+        {{if .ClientCredentialsSupported}}
+        <li class="flow">
+            <div class="flow-text">
+                <div class="flow-name">Client credentials</div>
+                <div class="flow-desc">A token for this application itself, with no user involved.</div>
+            </div>
+            <a href="/grant/client-credentials" class="button">Open</a>
+        </li>
+        {{end}}
+        {{if .RefreshSupported}}
+        <li class="flow">
+            <div class="flow-text">
+                <div class="flow-name">Refresh</div>
+                <div class="flow-desc">Redeems a refresh token for a new set.</div>
+            </div>
+            <a href="/grant/refresh" class="button">Open</a>
+        </li>
+        {{end}}
+        {{if .TokenExchangeSupported}}
+        <li class="flow">
+            <div class="flow-text">
+                <div class="flow-name">Token exchange</div>
+                <div class="flow-desc">RFC 8693. Trades a token from a connector for one issued by dex.</div>
+            </div>
+            <a href="/grant/token-exchange" class="button">Open</a>
+        </li>
+        {{end}}
+        {{if .PasswordSupported}}
+        <li class="flow">
+            <div class="flow-text">
+                <div class="flow-name">Password <span class="tag">deprecated</span></div>
+                <div class="flow-desc">Sends a username and password to the token endpoint.</div>
+            </div>
+            <a href="/grant/password" class="button">Open</a>
+        </li>
+        {{end}}
+    </ul>
+    {{if not (or .ClientCredentialsSupported .RefreshSupported .TokenExchangeSupported .PasswordSupported)}}
+    <p class="hint">The provider advertises none of these grants. oauth2.grantTypes in dex's config decides.</p>
+    {{end}}
+</div>
+{{end}}
diff --git a/examples/example-app/server/templates/layout.html b/examples/example-app/server/templates/layout.html
new file mode 100644
index 0000000000..d48bab4b1e
--- /dev/null
+++ b/examples/example-app/server/templates/layout.html
@@ -0,0 +1,23 @@
+{{define "page"}}
+<!DOCTYPE html>
+<html lang="en">
+<head>
+    <meta charset="UTF-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <title>Example App</title>
+    <link rel="stylesheet" href="/static/style.css">
+</head>
+<body>
+    <div class="container">
+        <a href="/" class="logo-link"><img class="logo" src="/static/dex-glyph-color.svg" alt="Dex"></a>
+        <nav class="nav">
+            <a href="/">Flows</a>
+            <a href="/tools">Token tools</a>
+            <a href="/admin">gRPC API</a>
+        </nav>
+        {{template "content" .}}
+    </div>
+    <script src="/static/app.js"></script>
+</body>
+</html>
+{{end}}
diff --git a/examples/example-app/server/templates/result.html b/examples/example-app/server/templates/result.html
new file mode 100644
index 0000000000..423d82940c
--- /dev/null
+++ b/examples/example-app/server/templates/result.html
@@ -0,0 +1,12 @@
+{{define "content"}}
+<div class="card">
+    <div class="card-title">{{.Title}}</div>
+    {{if .Verdict}}<p class="verdict">{{.Verdict}}</p>{{end}}
+    <pre class="json">{{.Body}}</pre>
+    <div class="row">
+        {{if .LastGrant}}<a href="/tokens" class="button">Back to the {{.LastGrant}} tokens</a>{{end}}
+        <a href="/tools" class="button">Token tools</a>
+        <a href="/" class="button button-secondary">Home</a>
+    </div>
+</div>
+{{end}}
diff --git a/examples/example-app/server/templates/token.html b/examples/example-app/server/templates/token.html
new file mode 100644
index 0000000000..f33b4f5b4a
--- /dev/null
+++ b/examples/example-app/server/templates/token.html
@@ -0,0 +1,74 @@
+{{define "content"}}
+<div class="card">
+    <div class="card-title">{{.Grant}} grant</div>
+    <div class="kv">
+        {{if .ExpiresIn}}<div class="k">Expires in</div><div class="v">{{.ExpiresIn}}</div>{{end}}
+        {{if .IssuedTokenType}}<div class="k">Issued token type</div><div class="v mono">{{.IssuedTokenType}}</div>{{end}}
+    </div>
+    <div class="row">
+        <a href="/tools" class="button">Token tools</a>
+        <a href="/" class="button button-secondary">Back</a>
+    </div>
+</div>
+
+{{if .IDToken}}
+<div class="card">
+    <div class="card-title">ID token</div>
+    <pre class="token" data-jwt>{{.IDToken}}</pre>
+    <a href="{{.IDTokenJWTLink}}" target="_blank" rel="noopener" class="hint">Open in jwt.io</a>
+</div>
+{{end}}
+
+{{if .AccessToken}}
+<div class="card">
+    <div class="card-title">Access token</div>
+    <pre class="token" data-jwt>{{.AccessToken}}</pre>
+    <a href="{{.AccessTokenJWTLink}}" target="_blank" rel="noopener" class="hint">Open in jwt.io</a>
+    <div class="row">
+        <form action="/userinfo" method="post">
+            <input type="hidden" name="access_token" value="{{.AccessToken}}">
+            <button type="submit" class="button button-small">Call UserInfo</button>
+        </form>
+        <form action="/tools/introspect" method="post">
+            <input type="hidden" name="token" value="{{.AccessToken}}">
+            <input type="hidden" name="token_type_hint" value="access_token">
+            <button type="submit" class="button button-small">Introspect</button>
+        </form>
+    </div>
+</div>
+{{end}}
+
+{{if .RefreshToken}}
+<div class="card">
+    <div class="card-title">Refresh token</div>
+    <pre class="token">{{.RefreshToken}}</pre>
+    <form action="/grant/refresh" method="post">
+        <input type="hidden" name="refresh_token" value="{{.RefreshToken}}">
+        <button type="submit" class="button button-small">Redeem it now</button>
+    </form>
+</div>
+{{end}}
+
+{{if .Claims}}
+<div class="card">
+    <div class="card-title">Claims</div>
+    <pre class="json">{{.Claims}}</pre>
+</div>
+{{end}}
+
+{{if .RawResponse}}
+<div class="card">
+    <div class="card-title">Token endpoint response</div>
+    <pre class="json">{{.RawResponse}}</pre>
+</div>
+{{end}}
+
+{{if .PublicKeyPEM}}
+<div class="card">
+    <details>
+        <summary>Issuer public key</summary>
+        <pre class="token">{{.PublicKeyPEM}}</pre>
+    </details>
+</div>
+{{end}}
+{{end}}
diff --git a/examples/example-app/server/templates/tools.html b/examples/example-app/server/templates/tools.html
new file mode 100644
index 0000000000..99e2933ab0
--- /dev/null
+++ b/examples/example-app/server/templates/tools.html
@@ -0,0 +1,41 @@
+{{define "content"}}
+<div class="card">
+    <div class="card-title">Token tools</div>
+    <p class="hint">
+        Two of these answer questions that sound alike and are not:
+        introspection asks dex whether it still honours a token, verification checks
+        the signature and lifetime for yourself. A revoked token passes verification
+        and fails introspection.
+    </p>
+    <ul class="flows">
+        <li class="flow">
+            <div class="flow-text">
+                <div class="flow-name">Introspection</div>
+                <div class="flow-desc">Ask dex whether a token is still active.</div>
+            </div>
+            <a href="/tools/introspect" class="button">Open</a>
+        </li>
+        <li class="flow">
+            <div class="flow-text">
+                <div class="flow-name">Local verification</div>
+                <div class="flow-desc">Check a JWT's signature and claims against the issuer's keys.</div>
+            </div>
+            <a href="/tools/verify" class="button">Open</a>
+        </li>
+        <li class="flow">
+            <div class="flow-text">
+                <div class="flow-name">UserInfo</div>
+                <div class="flow-desc">Fetch claims with an access token.</div>
+            </div>
+            <a href="/tools/userinfo" class="button">Open</a>
+        </li>
+        <li class="flow">
+            <div class="flow-text">
+                <div class="flow-name">Refresh</div>
+                <div class="flow-desc">Redeem a refresh token for a new set.</div>
+            </div>
+            <a href="/grant/refresh" class="button">Open</a>
+        </li>
+    </ul>
+</div>
+{{end}}
diff --git a/examples/example-app/server/token.go b/examples/example-app/server/token.go
new file mode 100644
index 0000000000..6aee20dfb8
--- /dev/null
+++ b/examples/example-app/server/token.go
@@ -0,0 +1,196 @@
+package server
+
+import (
+	"bytes"
+	"crypto/rsa"
+	"crypto/x509"
+	"encoding/base64"
+	"encoding/json"
+	"encoding/pem"
+	"fmt"
+	"math/big"
+	"net/http"
+	"net/url"
+	"strings"
+	"time"
+
+	"golang.org/x/oauth2"
+)
+
+// renderToken shows the result of a grant that produced a token through the
+// oauth2 library.
+func (s *Server) renderToken(w http.ResponseWriter, r *http.Request, grant string, token *oauth2.Token) {
+	rawID, _ := token.Extra("id_token").(string)
+	s.sessions.RememberTokens(s.session(w, r), grant, token, rawID)
+
+	data := TokenPageData{
+		LogoURI:      dexLogoDataURI,
+		AdminEnabled: s.admin != nil,
+		Grant:        grant,
+		AccessToken:  token.AccessToken,
+		RefreshToken: token.RefreshToken,
+		RedirectURL:  s.redirectURI,
+		PublicKeyPEM: s.fetchPublicKeyPEM(),
+	}
+
+	if rawIDToken, ok := token.Extra("id_token").(string); ok {
+		data.IDToken = rawIDToken
+		data.IDTokenJWTLink = jwtIOLink(rawIDToken)
+		data.Claims, _ = decodeJWTClaims(rawIDToken)
+	}
+	if data.AccessToken != "" {
+		data.AccessTokenJWTLink = jwtIOLink(data.AccessToken)
+		if data.Claims == "" {
+			// A grant without an ID token — client credentials, token exchange
+			// — still says who the token is for, in the access token itself.
+			data.Claims, _ = decodeJWTClaims(data.AccessToken)
+		}
+	}
+	if !token.Expiry.IsZero() {
+		data.ExpiresIn = time.Until(token.Expiry).Round(time.Second).String()
+	}
+
+	s.renderer.RenderTokenPage(w, data)
+}
+
+// renderRawToken shows the result of a grant whose response the app reads
+// directly, because it does not have the shape the oauth2 library expects.
+func (s *Server) renderRawToken(w http.ResponseWriter, r *http.Request, grant string, body []byte) {
+	var resp struct {
+		AccessToken     string `json:"access_token"`
+		IDToken         string `json:"id_token"`
+		RefreshToken    string `json:"refresh_token"`
+		IssuedTokenType string `json:"issued_token_type"`
+		ExpiresIn       int    `json:"expires_in"`
+	}
+	if err := json.Unmarshal(body, &resp); err != nil {
+		http.Error(w, fmt.Sprintf("token response is not JSON: %v", err), http.StatusInternalServerError)
+		return
+	}
+
+	data := TokenPageData{
+		LogoURI:         dexLogoDataURI,
+		AdminEnabled:    s.admin != nil,
+		Grant:           grant,
+		AccessToken:     resp.AccessToken,
+		IDToken:         resp.IDToken,
+		RefreshToken:    resp.RefreshToken,
+		IssuedTokenType: resp.IssuedTokenType,
+		RedirectURL:     s.redirectURI,
+		PublicKeyPEM:    s.fetchPublicKeyPEM(),
+		RawResponse:     indentJSON(body),
+	}
+	if resp.ExpiresIn > 0 {
+		data.ExpiresIn = (time.Duration(resp.ExpiresIn) * time.Second).String()
+	}
+
+	remembered := (&oauth2.Token{AccessToken: resp.AccessToken, RefreshToken: resp.RefreshToken}).
+		WithExtra(map[string]any{"id_token": resp.IDToken})
+	s.sessions.RememberTokens(s.session(w, r), grant, remembered, resp.IDToken)
+	if data.IDToken != "" {
+		data.IDTokenJWTLink = jwtIOLink(data.IDToken)
+		data.Claims, _ = decodeJWTClaims(data.IDToken)
+	}
+	if data.AccessToken != "" {
+		data.AccessTokenJWTLink = jwtIOLink(data.AccessToken)
+		if data.Claims == "" {
+			data.Claims, _ = decodeJWTClaims(data.AccessToken)
+		}
+	}
+
+	s.renderer.RenderTokenPage(w, data)
+}
+
+// decodeJWTClaims pretty-prints a JWT payload without verifying it: this is for
+// looking at a token, and the verify tool is what says whether to believe it.
+func decodeJWTClaims(token string) (string, bool) {
+	parts := strings.Split(token, ".")
+	if len(parts) != 3 {
+		return "", false
+	}
+	payload, err := base64.RawURLEncoding.DecodeString(parts[1])
+	if err != nil {
+		return "", false
+	}
+	return indentJSON(payload), true
+}
+
+func indentJSON(raw []byte) string {
+	buf := new(bytes.Buffer)
+	if err := json.Indent(buf, raw, "", "  "); err != nil {
+		return string(raw)
+	}
+	return buf.String()
+}
+
+// jwtIOLink creates a jwt.io debugger URL for the given token.
+func jwtIOLink(token string) string {
+	return "https://jwt.io/#debugger-io?token=" + url.QueryEscape(token)
+}
+
+// fetchPublicKeyPEM fetches the provider's JWKS and returns the first RSA public key as PEM.
+func (s *Server) fetchPublicKeyPEM() string {
+	if s.jwksURL == "" {
+		return ""
+	}
+
+	resp, err := s.client.Get(s.jwksURL)
+	if err != nil {
+		return ""
+	}
+	defer resp.Body.Close()
+
+	var jwks struct {
+		Keys []json.RawMessage `json:"keys"`
+	}
+	if err := json.NewDecoder(resp.Body).Decode(&jwks); err != nil || len(jwks.Keys) == 0 {
+		return ""
+	}
+
+	var key struct {
+		N   string `json:"n"`
+		E   string `json:"e"`
+		Kty string `json:"kty"`
+	}
+	if err := json.Unmarshal(jwks.Keys[0], &key); err != nil || key.Kty != "RSA" {
+		return ""
+	}
+
+	nBytes, err1 := base64.RawURLEncoding.DecodeString(key.N)
+	eBytes, err2 := base64.RawURLEncoding.DecodeString(key.E)
+	if err1 != nil || err2 != nil {
+		return ""
+	}
+
+	var eInt int
+	for _, b := range eBytes {
+		eInt = eInt<<8 | int(b)
+	}
+
+	pubKey := &rsa.PublicKey{
+		N: new(big.Int).SetBytes(nBytes),
+		E: eInt,
+	}
+
+	pubKeyBytes, err := x509.MarshalPKIXPublicKey(pubKey)
+	if err != nil {
+		return ""
+	}
+
+	return string(pem.EncodeToMemory(&pem.Block{
+		Type:  "PUBLIC KEY",
+		Bytes: pubKeyBytes,
+	}))
+}
+
+// handleTokens re-renders the last tokens this browser was given. Without it a
+// tool result is a dead end: the page holding the tokens you were working with
+// is gone, and nothing in the app can bring it back.
+func (s *Server) handleTokens(w http.ResponseWriter, r *http.Request) {
+	sess := s.session(w, r)
+	if sess.LastTokens == nil {
+		http.Redirect(w, r, "/", http.StatusFound)
+		return
+	}
+	s.renderToken(w, r, sess.LastGrant, sess.LastTokens)
+}
diff --git a/examples/example-app/server/tools.go b/examples/example-app/server/tools.go
new file mode 100644
index 0000000000..6e91ead6d7
--- /dev/null
+++ b/examples/example-app/server/tools.go
@@ -0,0 +1,171 @@
+package server
+
+import (
+	"encoding/json"
+	"fmt"
+	"io"
+	"net/http"
+	"net/url"
+	"strings"
+	"time"
+
+	"github.com/coreos/go-oidc/v3/oidc"
+)
+
+// handleTools renders the page for looking at tokens you already hold.
+func (s *Server) handleTools(w http.ResponseWriter, r *http.Request) {
+	s.renderer.RenderToolsPage(w, ToolsPageData{
+		LogoURI:      dexLogoDataURI,
+		AdminEnabled: s.admin != nil,
+	})
+}
+
+// handleIntrospect asks the provider what it thinks of a token.
+//
+// This is the answer the app cannot work out for itself: an access token can
+// look perfectly valid and still have been revoked, and only the issuer knows.
+func (s *Server) handleIntrospect(w http.ResponseWriter, r *http.Request) {
+	if err := r.ParseForm(); err != nil {
+		http.Error(w, fmt.Sprintf("failed to parse form: %v", err), http.StatusBadRequest)
+		return
+	}
+
+	token := strings.TrimSpace(r.FormValue("token"))
+	if token == "" {
+		http.Error(w, "token is required", http.StatusBadRequest)
+		return
+	}
+
+	form := url.Values{"token": {token}}
+	if hint := r.FormValue("token_type_hint"); hint != "" {
+		form.Set("token_type_hint", hint)
+	}
+
+	req, err := http.NewRequestWithContext(r.Context(), http.MethodPost, s.introspectURL, strings.NewReader(form.Encode()))
+	if err != nil {
+		http.Error(w, err.Error(), http.StatusInternalServerError)
+		return
+	}
+	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+	req.SetBasicAuth(url.QueryEscape(s.clientID), url.QueryEscape(s.clientSecret))
+
+	resp, err := s.client.Do(req)
+	if err != nil {
+		http.Error(w, fmt.Sprintf("introspection request failed: %v", err), http.StatusBadGateway)
+		return
+	}
+	defer resp.Body.Close()
+
+	body, err := io.ReadAll(resp.Body)
+	if err != nil {
+		http.Error(w, err.Error(), http.StatusInternalServerError)
+		return
+	}
+	if resp.StatusCode != http.StatusOK {
+		s.renderResult(w, r, "Introspection", fmt.Sprintf("%s: %s", resp.Status, strings.TrimSpace(string(body))), "")
+		return
+	}
+
+	var result struct {
+		Active bool `json:"active"`
+	}
+	_ = json.Unmarshal(body, &result)
+
+	verdict := "The provider says this token is active."
+	if !result.Active {
+		verdict = "The provider says this token is not active — expired, revoked, or never issued by it."
+	}
+
+	s.renderResult(w, r, "Introspection", indentJSON(body), verdict)
+}
+
+// handleVerify checks a token's signature and claims locally, the way a
+// resource server would: fetch the issuer's keys, verify, then look at what the
+// token says. It is deliberately separate from introspection — this answers
+// "was this signed by the issuer and is it still within its lifetime", not "is
+// the issuer still honouring it".
+func (s *Server) handleVerify(w http.ResponseWriter, r *http.Request) {
+	if err := r.ParseForm(); err != nil {
+		http.Error(w, fmt.Sprintf("failed to parse form: %v", err), http.StatusBadRequest)
+		return
+	}
+
+	raw := strings.TrimSpace(r.FormValue("token"))
+	if raw == "" {
+		http.Error(w, "token is required", http.StatusBadRequest)
+		return
+	}
+
+	ctx := oidc.ClientContext(r.Context(), s.client)
+
+	// Skipping the audience check keeps the tool useful for tokens issued to
+	// another client — the claims below still show who the audience is.
+	verifier := s.provider.Verifier(&oidc.Config{SkipClientIDCheck: true})
+	idToken, err := verifier.Verify(ctx, raw)
+	if err != nil {
+		claims, _ := decodeJWTClaims(raw)
+		s.renderResult(w, r, "Local verification", claims, "Signature or claims rejected: "+err.Error())
+		return
+	}
+
+	claims, _ := decodeJWTClaims(raw)
+	verdict := fmt.Sprintf("Signature valid. Issued by %s for %v, expires %s.",
+		idToken.Issuer, idToken.Audience, idToken.Expiry.Format(time.RFC3339))
+	if idToken.Audience != nil && !containsScope(idToken.Audience, s.clientID) {
+		verdict += " Note: this application is not in the audience."
+	}
+
+	s.renderResult(w, r, "Local verification", claims, verdict)
+}
+
+// handleUserInfo calls the provider's UserInfo endpoint with an access token.
+func (s *Server) handleUserInfo(w http.ResponseWriter, r *http.Request) {
+	if err := r.ParseForm(); err != nil {
+		http.Error(w, fmt.Sprintf("failed to parse form: %v", err), http.StatusBadRequest)
+		return
+	}
+
+	accessToken := strings.TrimSpace(r.FormValue("access_token"))
+	if accessToken == "" {
+		http.Error(w, "access_token is required", http.StatusBadRequest)
+		return
+	}
+	if s.userInfoURL == "" {
+		http.Error(w, "the provider does not advertise a userinfo endpoint", http.StatusBadRequest)
+		return
+	}
+
+	req, err := http.NewRequestWithContext(r.Context(), http.MethodGet, s.userInfoURL, nil)
+	if err != nil {
+		http.Error(w, err.Error(), http.StatusInternalServerError)
+		return
+	}
+	req.Header.Set("Authorization", "Bearer "+accessToken)
+
+	resp, err := s.client.Do(req)
+	if err != nil {
+		http.Error(w, fmt.Sprintf("userinfo request failed: %v", err), http.StatusBadGateway)
+		return
+	}
+	defer resp.Body.Close()
+
+	body, _ := io.ReadAll(resp.Body)
+	if resp.StatusCode != http.StatusOK {
+		s.renderResult(w, r, "UserInfo", fmt.Sprintf("%s: %s", resp.Status, strings.TrimSpace(string(body))), "")
+		return
+	}
+
+	s.renderResult(w, r, "UserInfo", indentJSON(body), "")
+}
+
+// renderResult shows the output of a tool.
+func (s *Server) renderResult(w http.ResponseWriter, r *http.Request, title, body, verdict string) {
+	s.renderer.RenderResultPage(w, ResultPageData{
+		LogoURI:      dexLogoDataURI,
+		AdminEnabled: s.admin != nil,
+		Title:        title,
+		Verdict:      verdict,
+		Body:         body,
+		LastGrant:    s.session(w, r).LastGrant,
+	})
+}
diff --git a/examples/example-app/server/transport.go b/examples/example-app/server/transport.go
new file mode 100644
index 0000000000..a262667fbf
--- /dev/null
+++ b/examples/example-app/server/transport.go
@@ -0,0 +1,83 @@
+package server
+
+import (
+	"crypto/tls"
+	"crypto/x509"
+	"fmt"
+	"log"
+	"net"
+	"net/http"
+	"net/http/httputil"
+	"os"
+	"time"
+)
+
+// newHTTPClient creates an *http.Client with optional custom root CAs and debug logging.
+func newHTTPClient(rootCAs string, debug bool) (*http.Client, error) {
+	var client *http.Client
+
+	if rootCAs != "" {
+		tlsConfig := &tls.Config{RootCAs: x509.NewCertPool()}
+		rootCABytes, err := os.ReadFile(rootCAs)
+		if err != nil {
+			return nil, fmt.Errorf("failed to read root-ca: %v", err)
+		}
+		if !tlsConfig.RootCAs.AppendCertsFromPEM(rootCABytes) {
+			return nil, fmt.Errorf("no certs found in root CA file %q", rootCAs)
+		}
+		client = &http.Client{
+			Transport: &http.Transport{
+				TLSClientConfig: tlsConfig,
+				Proxy:           http.ProxyFromEnvironment,
+				DialContext: (&net.Dialer{
+					Timeout:   30 * time.Second,
+					KeepAlive: 30 * time.Second,
+				}).DialContext,
+				TLSHandshakeTimeout:   10 * time.Second,
+				ExpectContinueTimeout: 1 * time.Second,
+			},
+		}
+	}
+
+	if debug {
+		if client == nil {
+			client = &http.Client{
+				Transport: debugTransport{http.DefaultTransport},
+			}
+		} else {
+			client.Transport = debugTransport{client.Transport}
+		}
+	}
+
+	if client == nil {
+		client = http.DefaultClient
+	}
+
+	return client, nil
+}
+
+// debugTransport wraps an http.RoundTripper and logs full request/response details.
+type debugTransport struct {
+	t http.RoundTripper
+}
+
+func (d debugTransport) RoundTrip(req *http.Request) (*http.Response, error) {
+	reqDump, err := httputil.DumpRequest(req, true)
+	if err != nil {
+		return nil, err
+	}
+	log.Printf("%s", reqDump)
+
+	resp, err := d.t.RoundTrip(req)
+	if err != nil {
+		return nil, err
+	}
+
+	respDump, err := httputil.DumpResponse(resp, true)
+	if err != nil {
+		resp.Body.Close()
+		return nil, err
+	}
+	log.Printf("%s", respDump)
+	return resp, nil
+}
diff --git a/examples/example-app/session/session.go b/examples/example-app/session/session.go
new file mode 100644
index 0000000000..7d02cb78a6
--- /dev/null
+++ b/examples/example-app/session/session.go
@@ -0,0 +1,385 @@
+// Package session keeps the example app's own state: who is signed in to this
+// application, and what it is waiting for from the provider.
+package session
+
+import (
+	"crypto/rand"
+	"encoding/base64"
+	"net/http"
+	"sync"
+	"time"
+
+	"golang.org/x/oauth2"
+)
+
+// CookieName is the app's session cookie. It identifies the browser, not the
+// user: a session exists from the first request, before anyone signs in, so
+// that a login can be tied to the browser that started it.
+const CookieName = "example_app_session"
+
+// ttl is how long an idle session is kept. The app is a demo; the number only
+// has to be long enough that nobody loses a session mid-experiment.
+const ttl = 12 * time.Hour
+
+// UserClaims holds basic user identity claims from an ID token.
+type UserClaims struct {
+	Subject           string `json:"sub"`
+	Name              string `json:"name"`
+	Email             string `json:"email"`
+	PreferredUsername string `json:"preferred_username"`
+
+	// SessionID is the "sid" claim: the provider's session this token was issued
+	// under. The app keeps it so a back-channel logout token, which carries the
+	// same value, can be matched to the browser it is about.
+	SessionID string `json:"sid"`
+}
+
+// PendingAuth is one authorization the app has started and not yet finished.
+// Everything in it belongs to a single authorization request: reusing any of it
+// across requests is what the state and PKCE parameters exist to prevent.
+type PendingAuth struct {
+	State        string
+	Nonce        string
+	CodeVerifier string
+	// Silent marks a prompt=none request, whose failure is an answer ("no
+	// session at the provider") rather than an error to show the user.
+	Silent  bool
+	Created time.Time
+}
+
+// Device is a device authorization this browser started. It lives on the
+// session for the same reason everything else here does: two people trying the
+// device flow at once should not share one user code.
+type Device struct {
+	DeviceCode      string
+	UserCode        string
+	VerificationURI string
+	PollInterval    int
+	Token           *oauth2.Token
+}
+
+// Session is one browser's state.
+type Session struct {
+	ID string
+
+	// Claims and Token are the result of the last completed sign-in.
+	Claims  *UserClaims
+	Token   *oauth2.Token
+	IDToken string
+
+	// Device is the device authorization in progress, if any.
+	Device *Device
+
+	// LastTokens is whatever the last flow produced, sign-in or not. Client
+	// credentials and token exchange do not sign anyone in, and a tool that
+	// forgets the tokens you just fetched is a tool you have to run twice.
+	LastTokens  *oauth2.Token
+	LastIDToken string
+	LastGrant   string
+
+	// LastProviderCheck is when the app last confirmed with the provider that
+	// the session there still exists. Without it the app would keep showing a
+	// user who signed out of the provider in another tab.
+	LastProviderCheck time.Time
+
+	// watchers are open SSE streams for this session, notified when a logout
+	// token arrives for it.
+	watchers []chan Notice
+
+	pending map[string]*PendingAuth
+	expires time.Time
+}
+
+// SignedIn reports whether this browser has completed a sign-in.
+func (s *Session) SignedIn() bool { return s.Claims != nil }
+
+// Store keeps sessions for the process. A demo app has no reason to persist
+// them, but it does have a reason to keep them apart: one global session would
+// mean every browser hitting this app shares one identity.
+type Store struct {
+	mu       sync.Mutex
+	sessions map[string]*Session
+}
+
+// NewStore returns an empty in-memory store.
+func NewStore() *Store {
+	return &Store{sessions: make(map[string]*Session)}
+}
+
+// FromRequest returns the session for this browser, creating one and setting
+// the cookie if the request carries none. The returned session is the store's
+// own: the methods below change it in place.
+func (st *Store) FromRequest(w http.ResponseWriter, r *http.Request, secure bool) *Session {
+	st.mu.Lock()
+	defer st.mu.Unlock()
+
+	st.sweepLocked()
+
+	if c, err := r.Cookie(CookieName); err == nil {
+		if s, ok := st.sessions[c.Value]; ok {
+			s.expires = time.Now().Add(ttl)
+			return s
+		}
+	}
+
+	s := &Session{
+		ID:      randomString(),
+		pending: make(map[string]*PendingAuth),
+		expires: time.Now().Add(ttl),
+	}
+	st.sessions[s.ID] = s
+
+	http.SetCookie(w, &http.Cookie{
+		Name:     CookieName,
+		Value:    s.ID,
+		Path:     "/",
+		HttpOnly: true,
+		Secure:   secure,
+		SameSite: http.SameSiteLaxMode,
+		MaxAge:   int(ttl.Seconds()),
+	})
+
+	return s
+}
+
+// SignIn records a completed sign-in.
+func (st *Store) SignIn(s *Session, claims *UserClaims, token *oauth2.Token, rawIDToken string) {
+	st.mu.Lock()
+	defer st.mu.Unlock()
+
+	s.Claims = claims
+	s.Token = token
+	if rawIDToken != "" {
+		s.IDToken = rawIDToken
+	}
+	s.LastProviderCheck = time.Now()
+	s.expires = time.Now().Add(ttl)
+}
+
+// Confirm records that the provider still knows this user, without touching the
+// tokens the app is holding. A silent check asks for the scopes it needs to
+// identify someone, not the ones the sign-in asked for, so the tokens it comes
+// back with are narrower — overwriting with them loses the refresh token the
+// original flow was given.
+func (st *Store) Confirm(s *Session, claims *UserClaims) {
+	st.mu.Lock()
+	defer st.mu.Unlock()
+
+	if claims != nil {
+		s.Claims = claims
+	}
+	s.LastProviderCheck = time.Now()
+	s.expires = time.Now().Add(ttl)
+}
+
+// SignOut drops what the app knows about the user and returns the last ID
+// token, which RP-initiated logout sends back to the provider as a hint.
+func (st *Store) SignOut(s *Session) string {
+	st.mu.Lock()
+	defer st.mu.Unlock()
+
+	return signOutLocked(s)
+}
+
+// Notice is what a browser watching its session is told when a logout token
+// ends it. It travels to the page over SSE, which is the only way an application
+// can show a back channel doing its job: a message that waits for the next page
+// load proves nothing, since a page load is exactly when the app's own
+// prompt=none check would have noticed anyway.
+type Notice struct {
+	At        time.Time `json:"at"`
+	SessionID string    `json:"sid,omitempty"`
+}
+
+// Watch returns a channel carrying notices for one session, and a function that
+// stops watching. Every open page gets its own.
+func (st *Store) Watch(sessionID string) (<-chan Notice, func()) {
+	st.mu.Lock()
+	defer st.mu.Unlock()
+
+	ch := make(chan Notice, 1)
+	if s, ok := st.sessions[sessionID]; ok {
+		s.watchers = append(s.watchers, ch)
+	}
+
+	return ch, func() {
+		st.mu.Lock()
+		defer st.mu.Unlock()
+
+		s, ok := st.sessions[sessionID]
+		if !ok {
+			return
+		}
+		for i, w := range s.watchers {
+			if w == ch {
+				s.watchers = append(s.watchers[:i], s.watchers[i+1:]...)
+				break
+			}
+		}
+	}
+}
+
+// SignOutByBackchannel ends every session the provider's logout token is about
+// and returns how many it ended. A token carrying a sid names one session, which
+// is the precise case; matching on the subject alone is the fallback for a
+// provider that sends only sub, and ends every session that user has here.
+//
+// Any page watching an ended session is told at once.
+func (st *Store) SignOutByBackchannel(sid, subject string) int {
+	st.mu.Lock()
+	defer st.mu.Unlock()
+
+	now := time.Now()
+	matched := 0
+	for _, s := range st.sessions {
+		if s.Claims == nil {
+			continue
+		}
+
+		switch {
+		case sid != "" && s.Claims.SessionID != "":
+			if s.Claims.SessionID != sid {
+				continue
+			}
+		case subject != "":
+			if s.Claims.Subject != subject {
+				continue
+			}
+		default:
+			continue
+		}
+
+		// Read the sid before signing out, which drops the claims it lives on.
+		notice := Notice{At: now, SessionID: s.Claims.SessionID}
+		signOutLocked(s)
+		matched++
+
+		// Non-blocking: a page that has not drained its last notice is already
+		// being told, and a wedged reader must not stall the logout.
+		for _, w := range s.watchers {
+			select {
+			case w <- notice:
+			default:
+			}
+		}
+	}
+	return matched
+}
+
+// signOutLocked clears the user from a session. Callers hold the store's lock.
+func signOutLocked(s *Session) string {
+	idToken := s.IDToken
+	s.Claims = nil
+	s.Token = nil
+	s.IDToken = ""
+	// The tools prefill from the last flow's result. Keeping it past a sign-out
+	// would put a signed-out user's access token back on screen, which reads as
+	// the app inventing tokens.
+	s.LastTokens = nil
+	s.LastIDToken = ""
+	s.LastGrant = ""
+	s.Device = nil
+	// LastProviderCheck deliberately survives: it records when the provider was
+	// last asked, and signing out here does not make that answer any older.
+	// Clearing it would send the next page load straight back into a check,
+	// which is a redirect loop when the answer is "no session".
+	return idToken
+}
+
+// StartAuth records an authorization the app is about to send the browser off
+// to complete, and returns it. Each one carries its own state and PKCE
+// verifier.
+func (st *Store) StartAuth(s *Session, silent bool) *PendingAuth {
+	st.mu.Lock()
+	defer st.mu.Unlock()
+
+	// Anything still pending from a much earlier request was abandoned.
+	for state, p := range s.pending {
+		if time.Since(p.Created) > 10*time.Minute {
+			delete(s.pending, state)
+		}
+	}
+
+	p := &PendingAuth{
+		State:        randomString(),
+		Nonce:        randomString(),
+		CodeVerifier: oauth2.GenerateVerifier(),
+		Silent:       silent,
+		Created:      time.Now(),
+	}
+	s.pending[p.State] = p
+	return p
+}
+
+// TakeAuth returns the pending authorization matching a callback's state
+// parameter and forgets it, so a state cannot be replayed. A miss means the
+// callback did not come from a request this browser started.
+func (st *Store) TakeAuth(s *Session, state string) (*PendingAuth, bool) {
+	st.mu.Lock()
+	defer st.mu.Unlock()
+
+	p, ok := s.pending[state]
+	if ok {
+		delete(s.pending, state)
+	}
+	return p, ok
+}
+
+// RememberTokens keeps the result of the last flow so the tools can offer it
+// and the token page can be reached again.
+func (st *Store) RememberTokens(s *Session, grant string, token *oauth2.Token, rawIDToken string) {
+	st.mu.Lock()
+	defer st.mu.Unlock()
+
+	s.LastTokens = token
+	s.LastIDToken = rawIDToken
+	s.LastGrant = grant
+	s.expires = time.Now().Add(ttl)
+}
+
+// StartDevice records a device authorization for this browser.
+func (st *Store) StartDevice(s *Session, d *Device) {
+	st.mu.Lock()
+	defer st.mu.Unlock()
+
+	s.Device = d
+	s.expires = time.Now().Add(ttl)
+}
+
+// SetDeviceToken attaches the token a device authorization ended with.
+func (st *Store) SetDeviceToken(s *Session, token *oauth2.Token) {
+	st.mu.Lock()
+	defer st.mu.Unlock()
+
+	if s.Device != nil {
+		s.Device.Token = token
+	}
+}
+
+// MarkChecked records that the provider was just asked about the session,
+// whatever the answer, so a failing check cannot spin.
+func (st *Store) MarkChecked(s *Session) {
+	st.mu.Lock()
+	defer st.mu.Unlock()
+
+	s.LastProviderCheck = time.Now()
+}
+
+// sweepLocked drops expired sessions. Called on the way in, which is often
+// enough for a process that only serves a handful of browsers.
+func (st *Store) sweepLocked() {
+	now := time.Now()
+	for id, s := range st.sessions {
+		if now.After(s.expires) {
+			delete(st.sessions, id)
+		}
+	}
+}
+
+func randomString() string {
+	b := make([]byte, 24)
+	if _, err := rand.Read(b); err != nil {
+		panic("example-app: out of randomness: " + err.Error())
+	}
+	return base64.RawURLEncoding.EncodeToString(b)
+}
diff --git a/examples/example-app/templates.go b/examples/example-app/templates.go
deleted file mode 100644
index a9425ead27..0000000000
--- a/examples/example-app/templates.go
+++ /dev/null
@@ -1,110 +0,0 @@
-package main
-
-import (
-	"html/template"
-	"log"
-	"net/http"
-)
-
-var indexTmpl = template.Must(template.New("index.html").Parse(`<html>
-  <head>
-    <style>
-form  { display: table;      }
-p     { display: table-row;  }
-label { display: table-cell; }
-input { display: table-cell; }
-    </style>
-  </head>
-  <body>
-    <form action="/login" method="post">
-      <p>
-        <label> Authenticate for: </label>
-        <input type="text" name="cross_client" placeholder="list of client-ids">
-      </p>
-      <p>
-        <label>Extra scopes: </label>
-        <input type="text" name="extra_scopes" placeholder="list of scopes">
-      </p>
-      <p>
-        <label>Connector ID: </label>
-        <input type="text" name="connector_id" placeholder="connector id">
-      </p>
-      <p>
-        <label>Request offline access: </label>
-        <input type="checkbox" name="offline_access" value="yes" checked>
-      </p>
-      <p>
-	    <input type="submit" value="Login">
-      </p>
-    </form>
-  </body>
-</html>`))
-
-func renderIndex(w http.ResponseWriter) {
-	renderTemplate(w, indexTmpl, nil)
-}
-
-type tokenTmplData struct {
-	IDToken      string
-	AccessToken  string
-	RefreshToken string
-	RedirectURL  string
-	Claims       string
-}
-
-var tokenTmpl = template.Must(template.New("token.html").Parse(`<html>
-  <head>
-    <style>
-/* make pre wrap */
-pre {
- white-space: pre-wrap;       /* css-3 */
- white-space: -moz-pre-wrap;  /* Mozilla, since 1999 */
- white-space: -pre-wrap;      /* Opera 4-6 */
- white-space: -o-pre-wrap;    /* Opera 7 */
- word-wrap: break-word;       /* Internet Explorer 5.5+ */
-}
-    </style>
-  </head>
-  <body>
-    <p> ID Token: <pre><code>{{ .IDToken }}</code></pre></p>
-    <p> Access Token: <pre><code>{{ .AccessToken }}</code></pre></p>
-    <p> Claims: <pre><code>{{ .Claims }}</code></pre></p>
-	{{ if .RefreshToken }}
-    <p> Refresh Token: <pre><code>{{ .RefreshToken }}</code></pre></p>
-	<form action="{{ .RedirectURL }}" method="post">
-	  <input type="hidden" name="refresh_token" value="{{ .RefreshToken }}">
-	  <input type="submit" value="Redeem refresh token">
-    </form>
-	{{ end }}
-  </body>
-</html>
-`))
-
-func renderToken(w http.ResponseWriter, redirectURL, idToken, accessToken, refreshToken, claims string) {
-	renderTemplate(w, tokenTmpl, tokenTmplData{
-		IDToken:      idToken,
-		AccessToken:  accessToken,
-		RefreshToken: refreshToken,
-		RedirectURL:  redirectURL,
-		Claims:       claims,
-	})
-}
-
-func renderTemplate(w http.ResponseWriter, tmpl *template.Template, data interface{}) {
-	err := tmpl.Execute(w, data)
-	if err == nil {
-		return
-	}
-
-	switch err := err.(type) {
-	case *template.Error:
-		// An ExecError guarantees that Execute has not written to the underlying reader.
-		log.Printf("Error rendering template %s: %s", tmpl.Name(), err)
-
-		// TODO(ericchiang): replace with better internal server error.
-		http.Error(w, "Internal server error", http.StatusInternalServerError)
-	default:
-		// An error with the underlying write, such as the connection being
-		// dropped. Ignore for now.
-	}
-}
diff --git a/examples/go.mod b/examples/go.mod
index d66c118a7f..3cd54c4828 100644
--- a/examples/go.mod
+++ b/examples/go.mod
@@ -1,25 +1,27 @@
 module github.com/dexidp/dex/examples
 
-go 1.17
+go 1.25.0
 
 require (
-	github.com/coreos/go-oidc/v3 v3.1.0
-	github.com/dexidp/dex/api/v2 v2.0.0
-	github.com/spf13/cobra v1.3.0
-	golang.org/x/oauth2 v0.0.0-20211104180415-d3ed0bb246c8
-	google.golang.org/grpc v1.43.0
+	github.com/coreos/go-oidc/v3 v3.20.0
+	github.com/dexidp/dex/api/v2 v2.4.0
+	github.com/spf13/cobra v1.10.2
+	golang.org/x/crypto v0.54.0
+	golang.org/x/oauth2 v0.36.0
+	google.golang.org/grpc v1.83.0
 )
 
 require (
-	github.com/golang/protobuf v1.5.2 // indirect
-	github.com/inconshreveable/mousetrap v1.0.0 // indirect
-	github.com/spf13/pflag v1.0.5 // indirect
-	golang.org/x/crypto v0.0.0-20220112180741-5e0467b6c7ce // indirect
-	golang.org/x/net v0.0.0-20220114011407-0dd24b26b47d // indirect
-	golang.org/x/sys v0.0.0-20220114195835-da31bd327af9 // indirect
-	golang.org/x/text v0.3.7 // indirect
-	google.golang.org/appengine v1.6.7 // indirect
-	google.golang.org/genproto v0.0.0-20220114231437-d2e6a121cae0 // indirect
-	google.golang.org/protobuf v1.27.1 // indirect
-	gopkg.in/square/go-jose.v2 v2.6.0 // indirect
+	github.com/go-jose/go-jose/v4 v4.1.4 // indirect
+	github.com/inconshreveable/mousetrap v1.1.0 // indirect
+	github.com/spf13/pflag v1.0.9 // indirect
+	golang.org/x/net v0.56.0 // indirect
+	golang.org/x/sys v0.47.0 // indirect
+	golang.org/x/text v0.40.0 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20260526163538-3dc84a4a5aaa // indirect
+	google.golang.org/protobuf v1.36.11 // indirect
 )
+
+// The example lives in this repository, so it demonstrates this repository's
+// API rather than the last published version of it.
+replace github.com/dexidp/dex/api/v2 => ../api/v2
diff --git a/examples/go.sum b/examples/go.sum
index 7907afde92..80bac09741 100644
--- a/examples/go.sum
+++ b/examples/go.sum
@@ -1,788 +1,56 @@
-cloud.google.com/go v0.26.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
-cloud.google.com/go v0.34.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
-cloud.google.com/go v0.38.0/go.mod h1:990N+gfupTy94rShfmMCWGDn0LpTmnzTp2qbd1dvSRU=
-cloud.google.com/go v0.44.1/go.mod h1:iSa0KzasP4Uvy3f1mN/7PiObzGgflwredwwASm/v6AU=
-cloud.google.com/go v0.44.2/go.mod h1:60680Gw3Yr4ikxnPRS/oxxkBccT6SA1yMk63TGekxKY=
-cloud.google.com/go v0.45.1/go.mod h1:RpBamKRgapWJb87xiFSdk4g1CME7QZg3uwTez+TSTjc=
-cloud.google.com/go v0.46.3/go.mod h1:a6bKKbmY7er1mI7TEI4lsAkts/mkhTSZK8w33B4RAg0=
-cloud.google.com/go v0.50.0/go.mod h1:r9sluTvynVuxRIOHXQEHMFffphuXHOMZMycpNR5e6To=
-cloud.google.com/go v0.52.0/go.mod h1:pXajvRH/6o3+F9jDHZWQ5PbGhn+o8w9qiu/CffaVdO4=
-cloud.google.com/go v0.53.0/go.mod h1:fp/UouUEsRkN6ryDKNW/Upv/JBKnv6WDthjR6+vze6M=
-cloud.google.com/go v0.54.0/go.mod h1:1rq2OEkV3YMf6n/9ZvGWI3GWw0VoqH/1x2nd8Is/bPc=
-cloud.google.com/go v0.56.0/go.mod h1:jr7tqZxxKOVYizybht9+26Z/gUq7tiRzu+ACVAMbKVk=
-cloud.google.com/go v0.57.0/go.mod h1:oXiQ6Rzq3RAkkY7N6t3TcE6jE+CIBBbA36lwQ1JyzZs=
-cloud.google.com/go v0.62.0/go.mod h1:jmCYTdRCQuc1PHIIJ/maLInMho30T/Y0M4hTdTShOYc=
-cloud.google.com/go v0.65.0/go.mod h1:O5N8zS7uWy9vkA9vayVHs65eM1ubvY4h553ofrNHObY=
-cloud.google.com/go v0.72.0/go.mod h1:M+5Vjvlc2wnp6tjzE102Dw08nGShTscUx2nZMufOKPI=
-cloud.google.com/go v0.74.0/go.mod h1:VV1xSbzvo+9QJOxLDaJfTjx5e+MePCpCWwvftOeQmWk=
-cloud.google.com/go v0.78.0/go.mod h1:QjdrLG0uq+YwhjoVOLsS1t7TW8fs36kLs4XO5R5ECHg=
-cloud.google.com/go v0.79.0/go.mod h1:3bzgcEeQlzbuEAYu4mrWhKqWjmpprinYgKJLgKHnbb8=
-cloud.google.com/go v0.81.0/go.mod h1:mk/AM35KwGk/Nm2YSeZbxXdrNK3KZOYHmLkOqC2V6E0=
-cloud.google.com/go v0.83.0/go.mod h1:Z7MJUsANfY0pYPdw0lbnivPx4/vhy/e2FEkSkF7vAVY=
-cloud.google.com/go v0.84.0/go.mod h1:RazrYuxIK6Kb7YrzzhPoLmCVzl7Sup4NrbKPg8KHSUM=
-cloud.google.com/go v0.87.0/go.mod h1:TpDYlFy7vuLzZMMZ+B6iRiELaY7z/gJPaqbMx6mlWcY=
-cloud.google.com/go v0.90.0/go.mod h1:kRX0mNRHe0e2rC6oNakvwQqzyDmg57xJ+SZU1eT2aDQ=
-cloud.google.com/go v0.93.3/go.mod h1:8utlLll2EF5XMAV15woO4lSbWQlk8rer9aLOfLh7+YI=
-cloud.google.com/go v0.94.1/go.mod h1:qAlAugsXlC+JWO+Bke5vCtc9ONxjQT3drlTTnAplMW4=
-cloud.google.com/go v0.97.0/go.mod h1:GF7l59pYBVlXQIBLx3a761cZ41F9bBH3JUlihCt2Udc=
-cloud.google.com/go v0.98.0/go.mod h1:ua6Ush4NALrHk5QXDWnjvZHN93OuF0HfuEPq9I1X0cM=
-cloud.google.com/go v0.99.0/go.mod h1:w0Xx2nLzqWJPuozYQX+hFfCSI8WioryfRDzkoI/Y2ZA=
-cloud.google.com/go/bigquery v1.0.1/go.mod h1:i/xbL2UlR5RvWAURpBYZTtm/cXjCha9lbfbpx4poX+o=
-cloud.google.com/go/bigquery v1.3.0/go.mod h1:PjpwJnslEMmckchkHFfq+HTD2DmtT67aNFKH1/VBDHE=
-cloud.google.com/go/bigquery v1.4.0/go.mod h1:S8dzgnTigyfTmLBfrtrhyYhwRxG72rYxvftPBK2Dvzc=
-cloud.google.com/go/bigquery v1.5.0/go.mod h1:snEHRnqQbz117VIFhE8bmtwIDY80NLUZUMb4Nv6dBIg=
-cloud.google.com/go/bigquery v1.7.0/go.mod h1://okPTzCYNXSlb24MZs83e2Do+h+VXtc4gLoIoXIAPc=
-cloud.google.com/go/bigquery v1.8.0/go.mod h1:J5hqkt3O0uAFnINi6JXValWIb1v0goeZM77hZzJN/fQ=
-cloud.google.com/go/datastore v1.0.0/go.mod h1:LXYbyblFSglQ5pkeyhO+Qmw7ukd3C+pD7TKLgZqpHYE=
-cloud.google.com/go/datastore v1.1.0/go.mod h1:umbIZjpQpHh4hmRpGhH4tLFup+FVzqBi1b3c64qFpCk=
-cloud.google.com/go/firestore v1.6.1/go.mod h1:asNXNOzBdyVQmEU+ggO8UPodTkEVFW5Qx+rwHnAz+EY=
-cloud.google.com/go/pubsub v1.0.1/go.mod h1:R0Gpsv3s54REJCy4fxDixWD93lHJMoZTyQ2kNxGRt3I=
-cloud.google.com/go/pubsub v1.1.0/go.mod h1:EwwdRX2sKPjnvnqCa270oGRyludottCI76h+R3AArQw=
-cloud.google.com/go/pubsub v1.2.0/go.mod h1:jhfEVHT8odbXTkndysNHCcx0awwzvfOlguIAii9o8iA=
-cloud.google.com/go/pubsub v1.3.1/go.mod h1:i+ucay31+CNRpDW4Lu78I4xXG+O1r/MAHgjpRVR+TSU=
-cloud.google.com/go/storage v1.0.0/go.mod h1:IhtSnM/ZTZV8YYJWCY8RULGVqBDmpoyjwiyrjsg+URw=
-cloud.google.com/go/storage v1.5.0/go.mod h1:tpKbwo567HUNpVclU5sGELwQWBDZ8gh0ZeosJ0Rtdos=
-cloud.google.com/go/storage v1.6.0/go.mod h1:N7U0C8pVQ/+NIKOBQyamJIeKQKkZ+mxpohlUTyfDhBk=
-cloud.google.com/go/storage v1.8.0/go.mod h1:Wv1Oy7z6Yz3DshWRJFhqM/UCfaWIRTdp0RXyy7KQOVs=
-cloud.google.com/go/storage v1.10.0/go.mod h1:FLPqc6j+Ki4BU591ie1oL6qBQGu2Bl/tZ9ullr3+Kg0=
-dmitri.shuralyov.com/gpu/mtl v0.0.0-20190408044501-666a987793e9/go.mod h1:H6x//7gZCb22OMCxBHrMx7a5I7Hp++hsVxbQ4BYO7hU=
-github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
-github.com/BurntSushi/xgb v0.0.0-20160522181843-27f122750802/go.mod h1:IVnqGOEym/WlBOVXweHU+Q+/VP0lqqI8lqeDx9IjBqo=
-github.com/DataDog/datadog-go v3.2.0+incompatible/go.mod h1:LButxg5PwREeZtORoXG3tL4fMGNddJ+vMq1mwgfaqoQ=
-github.com/OneOfOne/xxhash v1.2.2/go.mod h1:HSdplMjZKSmBqAxg5vPj2TmRDmfkzw+cTzAElWljhcU=
-github.com/alecthomas/template v0.0.0-20160405071501-a0175ee3bccc/go.mod h1:LOuyumcjzFXgccqObfd/Ljyb9UuFJ6TxHnclSeseNhc=
-github.com/alecthomas/template v0.0.0-20190718012654-fb15b899a751/go.mod h1:LOuyumcjzFXgccqObfd/Ljyb9UuFJ6TxHnclSeseNhc=
-github.com/alecthomas/units v0.0.0-20151022065526-2efee857e7cf/go.mod h1:ybxpYRFXyAe+OPACYpWeL0wqObRcbAqCMya13uyzqw0=
-github.com/alecthomas/units v0.0.0-20190717042225-c3de453c63f4/go.mod h1:ybxpYRFXyAe+OPACYpWeL0wqObRcbAqCMya13uyzqw0=
-github.com/antihax/optional v1.0.0/go.mod h1:uupD/76wgC+ih3iEmQUL+0Ugr19nfwCT1kdvxnR2qWY=
-github.com/armon/circbuf v0.0.0-20150827004946-bbbad097214e/go.mod h1:3U/XgcO3hCbHZ8TKRvWD2dDTCfh9M9ya+I9JpbB7O8o=
-github.com/armon/go-metrics v0.0.0-20180917152333-f0300d1749da/go.mod h1:Q73ZrmVTwzkszR9V5SSuryQ31EELlFMUz1kKyl939pY=
-github.com/armon/go-metrics v0.3.10/go.mod h1:4O98XIr/9W0sxpJ8UaYkvjk10Iff7SnFrb4QAOwNTFc=
-github.com/armon/go-radix v0.0.0-20180808171621-7fddfc383310/go.mod h1:ufUuZ+zHj4x4TnLV4JWEpy2hxWSpsRywHrMgIH9cCH8=
-github.com/armon/go-radix v1.0.0/go.mod h1:ufUuZ+zHj4x4TnLV4JWEpy2hxWSpsRywHrMgIH9cCH8=
-github.com/beorn7/perks v0.0.0-20180321164747-3a771d992973/go.mod h1:Dwedo/Wpr24TaqPxmxbtue+5NUziq4I4S80YR8gNf3Q=
-github.com/beorn7/perks v1.0.0/go.mod h1:KWe93zE9D1o94FZ5RNwFwVgaQK1VOXiVxmqh+CedLV8=
-github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw=
-github.com/bgentry/speakeasy v0.1.0/go.mod h1:+zsyZBPWlz7T6j88CTgSN5bM796AkVf0kBD4zp0CCIs=
-github.com/census-instrumentation/opencensus-proto v0.2.1/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU=
-github.com/census-instrumentation/opencensus-proto v0.3.0/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU=
-github.com/cespare/xxhash v1.1.0/go.mod h1:XrSqR1VqqWfGrhpAt58auRo0WTKS1nRRg3ghfAqPWnc=
-github.com/cespare/xxhash/v2 v2.1.1/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
-github.com/cespare/xxhash/v2 v2.1.2/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
-github.com/chzyer/logex v1.1.10/go.mod h1:+Ywpsq7O8HXn0nuIou7OrIPyXbp3wmkHB+jjWRnGsAI=
-github.com/chzyer/readline v0.0.0-20180603132655-2972be24d48e/go.mod h1:nSuG5e5PlCu98SY8svDHJxuZscDgtXS6KTTbou5AhLI=
-github.com/chzyer/test v0.0.0-20180213035817-a1ea475d72b1/go.mod h1:Q3SI9o4m/ZMnBNeIyt5eFwwo7qiLfzFZmjNmxjkiQlU=
-github.com/circonus-labs/circonus-gometrics v2.3.1+incompatible/go.mod h1:nmEj6Dob7S7YxXgwXpfOuvO54S+tGdZdw9fuRZt25Ag=
-github.com/circonus-labs/circonusllhist v0.1.3/go.mod h1:kMXHVDlOchFAehlya5ePtbp5jckzBHf4XRpQvBOLI+I=
-github.com/client9/misspell v0.3.4/go.mod h1:qj6jICC3Q7zFZvVWo7KLAzC3yx5G7kyvSDkc90ppPyw=
-github.com/cncf/udpa/go v0.0.0-20191209042840-269d4d468f6f/go.mod h1:M8M6+tZqaGXZJjfX53e64911xZQV5JYwmTeXPW+k8Sc=
-github.com/cncf/udpa/go v0.0.0-20200629203442-efcf912fb354/go.mod h1:WmhPx2Nbnhtbo57+VJT5O0JRkEi1Wbu0z5j0R8u5Hbk=
-github.com/cncf/udpa/go v0.0.0-20201120205902-5459f2c99403/go.mod h1:WmhPx2Nbnhtbo57+VJT5O0JRkEi1Wbu0z5j0R8u5Hbk=
-github.com/cncf/udpa/go v0.0.0-20210930031921-04548b0d99d4/go.mod h1:6pvJx4me5XPnfI9Z40ddWsdw2W/uZgQLFXToKeRcDiI=
-github.com/cncf/xds/go v0.0.0-20210312221358-fbca930ec8ed/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
-github.com/cncf/xds/go v0.0.0-20210805033703-aa0b78936158/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
-github.com/cncf/xds/go v0.0.0-20210922020428-25de7278fc84/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
-github.com/cncf/xds/go v0.0.0-20211001041855-01bcc9b48dfe/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
-github.com/cncf/xds/go v0.0.0-20211011173535-cb28da3451f1/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
-github.com/cncf/xds/go v0.0.0-20211130200136-a8f946100490/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
-github.com/coreos/go-oidc/v3 v3.1.0 h1:6avEvcdvTa1qYsOZ6I5PRkSYHzpTNWgKYmaJfaYbrRw=
-github.com/coreos/go-oidc/v3 v3.1.0/go.mod h1:rEJ/idjfUyfkBit1eI1fvyr+64/g9dcKpAm8MJMesvo=
-github.com/coreos/go-semver v0.3.0/go.mod h1:nnelYz7RCh+5ahJtPPxZlU+153eP4D4r3EedlOD2RNk=
-github.com/coreos/go-systemd/v22 v22.3.2/go.mod h1:Y58oyj3AT4RCenI/lSvhwexgC+NSVTIJ3seZv2GcEnc=
-github.com/cpuguy83/go-md2man/v2 v2.0.1/go.mod h1:tgQtvFlXSQOSOSIRvRPT7W67SCa46tRHOmNcaadrF8o=
-github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
-github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/dexidp/dex/api/v2 v2.0.0 h1:bvge1sRmzVzWPWp4WlMzS04lcNQA+jFzHqKV3066bRw=
-github.com/dexidp/dex/api/v2 v2.0.0/go.mod h1:k5arBJT1QYvpsEY3sEd0NXJp3hKWKuUUfzJ3BlcqPdM=
-github.com/envoyproxy/go-control-plane v0.9.0/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4=
-github.com/envoyproxy/go-control-plane v0.9.1-0.20191026205805-5f8ba28d4473/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4=
-github.com/envoyproxy/go-control-plane v0.9.4/go.mod h1:6rpuAdCZL397s3pYoYcLgu1mIlRU8Am5FuJP05cCM98=
-github.com/envoyproxy/go-control-plane v0.9.7/go.mod h1:cwu0lG7PUMfa9snN8LXBig5ynNVH9qI8YYLbd1fK2po=
-github.com/envoyproxy/go-control-plane v0.9.9-0.20201210154907-fd9021fe5dad/go.mod h1:cXg6YxExXjJnVBQHBLXeUAgxn2UodCpnH306RInaBQk=
-github.com/envoyproxy/go-control-plane v0.9.9-0.20210217033140-668b12f5399d/go.mod h1:cXg6YxExXjJnVBQHBLXeUAgxn2UodCpnH306RInaBQk=
-github.com/envoyproxy/go-control-plane v0.9.9-0.20210512163311-63b5d3c536b0/go.mod h1:hliV/p42l8fGbc6Y9bQ70uLwIvmJyVE5k4iMKlh8wCQ=
-github.com/envoyproxy/go-control-plane v0.9.10-0.20210907150352-cf90f659a021/go.mod h1:AFq3mo9L8Lqqiid3OhADV3RfLJnjiw63cSpi+fDTRC0=
-github.com/envoyproxy/go-control-plane v0.10.1/go.mod h1:AY7fTTXNdv/aJ2O5jwpxAPOWUZ7hQAEvzN5Pf27BkQQ=
-github.com/envoyproxy/protoc-gen-validate v0.1.0/go.mod h1:iSmxcyjqTsJpI2R4NaDN7+kN2VEUnK/pcBlmesArF7c=
-github.com/envoyproxy/protoc-gen-validate v0.6.2/go.mod h1:2t7qjJNvHPx8IjnBOzl9E9/baC+qXE/TeeyBRzgJDws=
-github.com/fatih/color v1.7.0/go.mod h1:Zm6kSWBoL9eyXnKyktHP6abPY2pDugNf5KwzbycvMj4=
-github.com/fatih/color v1.9.0/go.mod h1:eQcE1qtQxscV5RaZvpXrrb8Drkc3/DdQ+uUYCNjL+zU=
-github.com/fatih/color v1.13.0/go.mod h1:kLAiJbzzSOZDVNGyDpeOxJ47H46qBXwg5ILebYFFOfk=
-github.com/fsnotify/fsnotify v1.5.1/go.mod h1:T3375wBYaZdLLcVNkcVbzGHY7f1l/uK5T5Ai1i3InKU=
-github.com/ghodss/yaml v1.0.0/go.mod h1:4dBDuWmgqj2HViK6kFavaiC9ZROes6MMH2rRYeMEF04=
-github.com/go-gl/glfw v0.0.0-20190409004039-e6da0acd62b1/go.mod h1:vR7hzQXu2zJy9AVAgeJqvqgH9Q5CA+iKCZ2gyEVpxRU=
-github.com/go-gl/glfw/v3.3/glfw v0.0.0-20191125211704-12ad95a8df72/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8=
-github.com/go-gl/glfw/v3.3/glfw v0.0.0-20200222043503-6f7a984d4dc4/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8=
-github.com/go-kit/kit v0.8.0/go.mod h1:xBxKIO96dXMWWy0MnWVtmwkA9/13aqxPnvrjFYMA2as=
-github.com/go-kit/kit v0.9.0/go.mod h1:xBxKIO96dXMWWy0MnWVtmwkA9/13aqxPnvrjFYMA2as=
-github.com/go-logfmt/logfmt v0.3.0/go.mod h1:Qt1PoO58o5twSAckw1HlFXLmHsOX5/0LbT9GBnD5lWE=
-github.com/go-logfmt/logfmt v0.4.0/go.mod h1:3RMwSq7FuexP4Kalkev3ejPJsZTpXXBr9+V4qmtdjCk=
-github.com/go-stack/stack v1.8.0/go.mod h1:v0f6uXyyMGvRgIKkXu+yp6POWl0qKG85gN/melR3HDY=
-github.com/godbus/dbus/v5 v5.0.4/go.mod h1:xhWf0FNVPg57R7Z0UbKHbJfkEywrmjJnf7w5xrFpKfA=
-github.com/gogo/protobuf v1.1.1/go.mod h1:r8qH/GZQm5c6nD/R0oafs1akxWv10x8SbQlK7atdtwQ=
-github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q=
-github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b/go.mod h1:SBH7ygxi8pfUlaOkMMuAQtPIUF8ecWP5IEl/CR7VP2Q=
-github.com/golang/groupcache v0.0.0-20190702054246-869f871628b6/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
-github.com/golang/groupcache v0.0.0-20191227052852-215e87163ea7/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
-github.com/golang/groupcache v0.0.0-20200121045136-8c9f03a8e57e/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
-github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
-github.com/golang/mock v1.1.1/go.mod h1:oTYuIxOrZwtPieC+H1uAHpcLFnEyAGVDL/k47Jfbm0A=
-github.com/golang/mock v1.2.0/go.mod h1:oTYuIxOrZwtPieC+H1uAHpcLFnEyAGVDL/k47Jfbm0A=
-github.com/golang/mock v1.3.1/go.mod h1:sBzyDLLjw3U8JLTeZvSv8jJB+tU5PVekmnlKIyFUx0Y=
-github.com/golang/mock v1.4.0/go.mod h1:UOMv5ysSaYNkG+OFQykRIcU/QvvxJf3p21QfJ2Bt3cw=
-github.com/golang/mock v1.4.1/go.mod h1:UOMv5ysSaYNkG+OFQykRIcU/QvvxJf3p21QfJ2Bt3cw=
-github.com/golang/mock v1.4.3/go.mod h1:UOMv5ysSaYNkG+OFQykRIcU/QvvxJf3p21QfJ2Bt3cw=
-github.com/golang/mock v1.4.4/go.mod h1:l3mdAwkq5BuhzHwde/uurv3sEJeZMXNpwsxVWU71h+4=
-github.com/golang/mock v1.5.0/go.mod h1:CWnOUgYIOo4TcNZ0wHX3YZCqsaM1I1Jvs6v3mP3KVu8=
-github.com/golang/mock v1.6.0/go.mod h1:p6yTPP+5HYm5mzsMV8JkE6ZKdX+/wYM6Hr+LicevLPs=
-github.com/golang/protobuf v1.2.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
-github.com/golang/protobuf v1.3.1/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
-github.com/golang/protobuf v1.3.2/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
-github.com/golang/protobuf v1.3.3/go.mod h1:vzj43D7+SQXF/4pzW/hwtAqwc6iTitCiVSaWz5lYuqw=
-github.com/golang/protobuf v1.3.4/go.mod h1:vzj43D7+SQXF/4pzW/hwtAqwc6iTitCiVSaWz5lYuqw=
-github.com/golang/protobuf v1.3.5/go.mod h1:6O5/vntMXwX2lRkT1hjjk0nAC1IDOTvTlVgjlRvqsdk=
-github.com/golang/protobuf v1.4.0-rc.1/go.mod h1:ceaxUfeHdC40wWswd/P6IGgMaK3YpKi5j83Wpe3EHw8=
-github.com/golang/protobuf v1.4.0-rc.1.0.20200221234624-67d41d38c208/go.mod h1:xKAWHe0F5eneWXFV3EuXVDTCmh+JuBKY0li0aMyXATA=
-github.com/golang/protobuf v1.4.0-rc.2/go.mod h1:LlEzMj4AhA7rCAGe4KMBDvJI+AwstrUpVNzEA03Pprs=
-github.com/golang/protobuf v1.4.0-rc.4.0.20200313231945-b860323f09d0/go.mod h1:WU3c8KckQ9AFe+yFwt9sWVRKCVIyN9cPHBJSNnbL67w=
-github.com/golang/protobuf v1.4.0/go.mod h1:jodUvKwWbYaEsadDk5Fwe5c77LiNKVO9IDvqG2KuDX0=
-github.com/golang/protobuf v1.4.1/go.mod h1:U8fpvMrcmy5pZrNK1lt4xCsGvpyWQ/VVv6QDs8UjoX8=
-github.com/golang/protobuf v1.4.2/go.mod h1:oDoupMAO8OvCJWAcko0GGGIgR6R6ocIYbsSw735rRwI=
-github.com/golang/protobuf v1.4.3/go.mod h1:oDoupMAO8OvCJWAcko0GGGIgR6R6ocIYbsSw735rRwI=
-github.com/golang/protobuf v1.5.0/go.mod h1:FsONVRAS9T7sI+LIUmWTfcYkHO4aIWwzhcaSAoJOfIk=
-github.com/golang/protobuf v1.5.1/go.mod h1:DopwsBzvsk0Fs44TXzsVbJyPhcCPeIwnvohx4u74HPM=
-github.com/golang/protobuf v1.5.2 h1:ROPKBNFfQgOUMifHyP+KYbvpjbdoFNs+aK7DXlji0Tw=
-github.com/golang/protobuf v1.5.2/go.mod h1:XVQd3VNwM+JqD3oG2Ue2ip4fOMUkwXdXDdiuN0vRsmY=
-github.com/golang/snappy v0.0.3/go.mod h1:/XxbfmMg8lxefKM7IXC3fBNl/7bRcc72aCRzEWrmP2Q=
-github.com/google/btree v0.0.0-20180813153112-4030bb1f1f0c/go.mod h1:lNA+9X1NB3Zf8V7Ke586lFgjr2dZNuvo3lPJSGZ5JPQ=
-github.com/google/btree v1.0.0/go.mod h1:lNA+9X1NB3Zf8V7Ke586lFgjr2dZNuvo3lPJSGZ5JPQ=
-github.com/google/go-cmp v0.2.0/go.mod h1:oXzfMopK8JAjlY9xF4vHSVASa0yLyX7SntLO5aqRK0M=
-github.com/google/go-cmp v0.3.0/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
-github.com/google/go-cmp v0.3.1/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
-github.com/google/go-cmp v0.4.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/go-cmp v0.4.1/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/go-cmp v0.5.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/go-cmp v0.5.1/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/go-cmp v0.5.2/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/go-cmp v0.5.3/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/go-cmp v0.5.4/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/go-cmp v0.5.6 h1:BKbKCqvP6I+rmFHt06ZmyQtvB8xAkWdhFyr0ZUNZcxQ=
-github.com/google/go-cmp v0.5.6/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
-github.com/google/martian v2.1.0+incompatible/go.mod h1:9I4somxYTbIHy5NJKHRl3wXiIaQGbYVAs8BPL6v8lEs=
-github.com/google/martian/v3 v3.0.0/go.mod h1:y5Zk1BBys9G+gd6Jrk0W3cC1+ELVxBWuIGO+w/tUAp0=
-github.com/google/martian/v3 v3.1.0/go.mod h1:y5Zk1BBys9G+gd6Jrk0W3cC1+ELVxBWuIGO+w/tUAp0=
-github.com/google/martian/v3 v3.2.1/go.mod h1:oBOf6HBosgwRXnUGWUB05QECsc6uvmMiJ3+6W4l/CUk=
-github.com/google/pprof v0.0.0-20181206194817-3ea8567a2e57/go.mod h1:zfwlbNMJ+OItoe0UupaVj+oy1omPYYDuagoSzA8v9mc=
-github.com/google/pprof v0.0.0-20190515194954-54271f7e092f/go.mod h1:zfwlbNMJ+OItoe0UupaVj+oy1omPYYDuagoSzA8v9mc=
-github.com/google/pprof v0.0.0-20191218002539-d4f498aebedc/go.mod h1:ZgVRPoUq/hfqzAqh7sHMqb3I9Rq5C59dIz2SbBwJ4eM=
-github.com/google/pprof v0.0.0-20200212024743-f11f1df84d12/go.mod h1:ZgVRPoUq/hfqzAqh7sHMqb3I9Rq5C59dIz2SbBwJ4eM=
-github.com/google/pprof v0.0.0-20200229191704-1ebb73c60ed3/go.mod h1:ZgVRPoUq/hfqzAqh7sHMqb3I9Rq5C59dIz2SbBwJ4eM=
-github.com/google/pprof v0.0.0-20200430221834-fc25d7d30c6d/go.mod h1:ZgVRPoUq/hfqzAqh7sHMqb3I9Rq5C59dIz2SbBwJ4eM=
-github.com/google/pprof v0.0.0-20200708004538-1a94d8640e99/go.mod h1:ZgVRPoUq/hfqzAqh7sHMqb3I9Rq5C59dIz2SbBwJ4eM=
-github.com/google/pprof v0.0.0-20201023163331-3e6fc7fc9c4c/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
-github.com/google/pprof v0.0.0-20201203190320-1bf35d6f28c2/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
-github.com/google/pprof v0.0.0-20210122040257-d980be63207e/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
-github.com/google/pprof v0.0.0-20210226084205-cbba55b83ad5/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
-github.com/google/pprof v0.0.0-20210601050228-01bbb1931b22/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
-github.com/google/pprof v0.0.0-20210609004039-a478d1d731e9/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
-github.com/google/pprof v0.0.0-20210720184732-4bb14d4b1be1/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
-github.com/google/renameio v0.1.0/go.mod h1:KWCgfxg9yswjAJkECMjeO8J8rahYeXnNhOm40UhjYkI=
-github.com/google/uuid v1.1.2/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
-github.com/googleapis/gax-go/v2 v2.0.4/go.mod h1:0Wqv26UfaUD9n4G6kQubkQ+KchISgw+vpHVxEJEs9eg=
-github.com/googleapis/gax-go/v2 v2.0.5/go.mod h1:DWXyrwAJ9X0FpwwEdw+IPEYBICEFu5mhpdKc/us6bOk=
-github.com/googleapis/gax-go/v2 v2.1.0/go.mod h1:Q3nei7sK6ybPYH7twZdmQpAd1MKb7pfu6SK+H1/DsU0=
-github.com/googleapis/gax-go/v2 v2.1.1/go.mod h1:hddJymUZASv3XPyGkUpKj8pPO47Rmb0eJc8R6ouapiM=
-github.com/grpc-ecosystem/grpc-gateway v1.16.0/go.mod h1:BDjrQk3hbvj6Nolgz8mAMFbcEtjT1g+wF4CSlocrBnw=
-github.com/hashicorp/consul/api v1.11.0/go.mod h1:XjsvQN+RJGWI2TWy1/kqaE16HrR2J/FWgkYjdZQsX9M=
-github.com/hashicorp/consul/sdk v0.8.0/go.mod h1:GBvyrGALthsZObzUGsfgHZQDXjg4lOjagTIwIR1vPms=
-github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
-github.com/hashicorp/go-cleanhttp v0.5.0/go.mod h1:JpRdi6/HCYpAwUzNwuwqhbovhLtngrth3wmdIIUrZ80=
-github.com/hashicorp/go-cleanhttp v0.5.1/go.mod h1:JpRdi6/HCYpAwUzNwuwqhbovhLtngrth3wmdIIUrZ80=
-github.com/hashicorp/go-cleanhttp v0.5.2/go.mod h1:kO/YDlP8L1346E6Sodw+PrpBSV4/SoxCXGY6BqNFT48=
-github.com/hashicorp/go-hclog v0.12.0/go.mod h1:whpDNt7SSdeAju8AWKIWsul05p54N/39EeqMAyrmvFQ=
-github.com/hashicorp/go-hclog v1.0.0/go.mod h1:whpDNt7SSdeAju8AWKIWsul05p54N/39EeqMAyrmvFQ=
-github.com/hashicorp/go-immutable-radix v1.0.0/go.mod h1:0y9vanUI8NX6FsYoO3zeMjhV/C5i9g4Q3DwcSNZ4P60=
-github.com/hashicorp/go-immutable-radix v1.3.1/go.mod h1:0y9vanUI8NX6FsYoO3zeMjhV/C5i9g4Q3DwcSNZ4P60=
-github.com/hashicorp/go-msgpack v0.5.3/go.mod h1:ahLV/dePpqEmjfWmKiqvPkv/twdG7iPBM1vqhUKIvfM=
-github.com/hashicorp/go-multierror v1.0.0/go.mod h1:dHtQlpGsu+cZNNAkkCN/P3hoUDHhCYQXV3UM06sGGrk=
-github.com/hashicorp/go-multierror v1.1.0/go.mod h1:spPvp8C1qA32ftKqdAHm4hHTbPw+vmowP0z+KUhOZdA=
-github.com/hashicorp/go-retryablehttp v0.5.3/go.mod h1:9B5zBasrRhHXnJnui7y6sL7es7NDiJgTc6Er0maI1Xs=
-github.com/hashicorp/go-rootcerts v1.0.2/go.mod h1:pqUvnprVnM5bf7AOirdbb01K4ccR319Vf4pU3K5EGc8=
-github.com/hashicorp/go-sockaddr v1.0.0/go.mod h1:7Xibr9yA9JjQq1JpNB2Vw7kxv8xerXegt+ozgdvDeDU=
-github.com/hashicorp/go-syslog v1.0.0/go.mod h1:qPfqrKkXGihmCqbJM2mZgkZGvKG1dFdvsLplgctolz4=
-github.com/hashicorp/go-uuid v1.0.0/go.mod h1:6SBZvOh/SIDV7/2o3Jml5SYk/TvGqwFJ/bN7x4byOro=
-github.com/hashicorp/go-uuid v1.0.1/go.mod h1:6SBZvOh/SIDV7/2o3Jml5SYk/TvGqwFJ/bN7x4byOro=
-github.com/hashicorp/golang-lru v0.5.0/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8=
-github.com/hashicorp/golang-lru v0.5.1/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8=
-github.com/hashicorp/golang-lru v0.5.4/go.mod h1:iADmTwqILo4mZ8BN3D2Q6+9jd8WM5uGBxy+E8yxSoD4=
-github.com/hashicorp/hcl v1.0.0/go.mod h1:E5yfLk+7swimpb2L/Alb/PJmXilQ/rhwaUYs4T20WEQ=
-github.com/hashicorp/logutils v1.0.0/go.mod h1:QIAnNjmIWmVIIkWDTG1z5v++HQmx9WQRO+LraFDTW64=
-github.com/hashicorp/mdns v1.0.1/go.mod h1:4gW7WsVCke5TE7EPeYliwHlRUyBtfCwuFwuMg2DmyNY=
-github.com/hashicorp/mdns v1.0.4/go.mod h1:mtBihi+LeNXGtG8L9dX59gAEa12BDtBQSp4v/YAJqrc=
-github.com/hashicorp/memberlist v0.2.2/go.mod h1:MS2lj3INKhZjWNqd3N0m3J+Jxf3DAOnAH9VT3Sh9MUE=
-github.com/hashicorp/memberlist v0.3.0/go.mod h1:MS2lj3INKhZjWNqd3N0m3J+Jxf3DAOnAH9VT3Sh9MUE=
-github.com/hashicorp/serf v0.9.5/go.mod h1:UWDWwZeL5cuWDJdl0C6wrvrUwEqtQ4ZKBKKENpqIUyk=
-github.com/hashicorp/serf v0.9.6/go.mod h1:TXZNMjZQijwlDvp+r0b63xZ45H7JmCmgg4gpTwn9UV4=
-github.com/iancoleman/strcase v0.2.0/go.mod h1:iwCmte+B7n89clKwxIoIXy/HfoL7AsD47ZCWhYzw7ho=
-github.com/ianlancetaylor/demangle v0.0.0-20181102032728-5e5cf60278f6/go.mod h1:aSSvb/t6k1mPoxDqO4vJh6VOCGPwU4O0C2/Eqndh1Sc=
-github.com/ianlancetaylor/demangle v0.0.0-20200824232613-28f6c0f3b639/go.mod h1:aSSvb/t6k1mPoxDqO4vJh6VOCGPwU4O0C2/Eqndh1Sc=
-github.com/inconshreveable/mousetrap v1.0.0 h1:Z8tu5sraLXCXIcARxBp/8cbvlwVa7Z1NHg9XEKhtSvM=
-github.com/inconshreveable/mousetrap v1.0.0/go.mod h1:PxqpIevigyE2G7u3NXJIT2ANytuPF1OarO4DADm73n8=
-github.com/json-iterator/go v1.1.6/go.mod h1:+SdeFBvtyEkXs7REEP0seUULqWtbJapLOCVDaaPEHmU=
-github.com/json-iterator/go v1.1.9/go.mod h1:KdQUCv79m/52Kvf8AW2vK1V8akMuk1QjK/uOdHXbAo4=
-github.com/json-iterator/go v1.1.11/go.mod h1:KdQUCv79m/52Kvf8AW2vK1V8akMuk1QjK/uOdHXbAo4=
-github.com/json-iterator/go v1.1.12/go.mod h1:e30LSqwooZae/UwlEbR2852Gd8hjQvJoHmT4TnhNGBo=
-github.com/jstemmer/go-junit-report v0.0.0-20190106144839-af01ea7f8024/go.mod h1:6v2b51hI/fHJwM22ozAgKL4VKDeJcHhJFhtBdhmNjmU=
-github.com/jstemmer/go-junit-report v0.9.1/go.mod h1:Brl9GWCQeLvo8nXZwPNNblvFj/XSXhF0NWZEnDohbsk=
-github.com/julienschmidt/httprouter v1.2.0/go.mod h1:SYymIcj16QtmaHHD7aYtjjsJG7VTCxuUUipMqKk8s4w=
-github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI2bnpBCr8=
-github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck=
-github.com/konsorten/go-windows-terminal-sequences v1.0.1/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ=
-github.com/kr/fs v0.1.0/go.mod h1:FFnZGqtBN9Gxj7eW1uZ42v5BccTP0vu6NEaFoC2HwRg=
-github.com/kr/logfmt v0.0.0-20140226030751-b84e30acd515/go.mod h1:+0opPa2QZZtGFBFZlji/RkVcI2GknAs/DXo4wKdlNEc=
-github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
-github.com/kr/pretty v0.2.0/go.mod h1:ipq/a2n7PKx3OHsz4KJII5eveXtPO4qwEXGdVfWzfnI=
-github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
-github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
-github.com/lyft/protoc-gen-star v0.5.3/go.mod h1:V0xaHgaf5oCCqmcxYcWiDfTiKsZsRc87/1qhoTACD8w=
-github.com/magiconair/properties v1.8.5/go.mod h1:y3VJvCyxH9uVvJTWEGAELF3aiYNyPKd5NZ3oSwXrF60=
-github.com/mattn/go-colorable v0.0.9/go.mod h1:9vuHe8Xs5qXnSaW/c/ABM9alt+Vo+STaOChaDxuIBZU=
-github.com/mattn/go-colorable v0.1.4/go.mod h1:U0ppj6V5qS13XJ6of8GYAs25YV2eR4EVcfRqFIhoBtE=
-github.com/mattn/go-colorable v0.1.6/go.mod h1:u6P/XSegPjTcexA+o6vUJrdnUu04hMope9wVRipJSqc=
-github.com/mattn/go-colorable v0.1.9/go.mod h1:u6P/XSegPjTcexA+o6vUJrdnUu04hMope9wVRipJSqc=
-github.com/mattn/go-colorable v0.1.12/go.mod h1:u5H1YNBxpqRaxsYJYSkiCWKzEfiAb1Gb520KVy5xxl4=
-github.com/mattn/go-isatty v0.0.3/go.mod h1:M+lRXTBqGeGNdLjl/ufCoiOlB5xdOkqRJdNxMWT7Zi4=
-github.com/mattn/go-isatty v0.0.8/go.mod h1:Iq45c/XA43vh69/j3iqttzPXn0bhXyGjM0Hdxcsrc5s=
-github.com/mattn/go-isatty v0.0.10/go.mod h1:qgIWMr58cqv1PHHyhnkY9lrL7etaEgOFcMEpPG5Rm84=
-github.com/mattn/go-isatty v0.0.11/go.mod h1:PhnuNfih5lzO57/f3n+odYbM4JtupLOxQOAqxQCu2WE=
-github.com/mattn/go-isatty v0.0.12/go.mod h1:cbi8OIDigv2wuxKPP5vlRcQ1OAZbq2CE4Kysco4FUpU=
-github.com/mattn/go-isatty v0.0.14/go.mod h1:7GGIvUiUoEMVVmxf/4nioHXj79iQHKdU27kJ6hsGG94=
-github.com/matttproud/golang_protobuf_extensions v1.0.1/go.mod h1:D8He9yQNgCq6Z5Ld7szi9bcBfOoFv/3dc6xSMkL2PC0=
-github.com/miekg/dns v1.0.14/go.mod h1:W1PPwlIAgtquWBMBEV9nkV9Cazfe8ScdGz/Lj7v3Nrg=
-github.com/miekg/dns v1.1.26/go.mod h1:bPDLeHnStXmXAq1m/Ch/hvfNHr14JKNPMBo3VZKjuso=
-github.com/miekg/dns v1.1.41/go.mod h1:p6aan82bvRIyn+zDIv9xYNUpwa73JcSh9BKwknJysuI=
-github.com/mitchellh/cli v1.1.0/go.mod h1:xcISNoH86gajksDmfB23e/pu+B+GeFRMYmoHXxx3xhI=
-github.com/mitchellh/go-homedir v1.1.0/go.mod h1:SfyaCUpYCn1Vlf4IUYiD9fPX4A5wJrkLzIz1N1q0pr0=
-github.com/mitchellh/go-testing-interface v1.0.0/go.mod h1:kRemZodwjscx+RGhAo8eIhFbs2+BFgRtFPeD/KE+zxI=
-github.com/mitchellh/mapstructure v0.0.0-20160808181253-ca63d7c062ee/go.mod h1:FVVH3fgwuzCH5S8UJGiWEs2h04kUh9fWfEaFds41c1Y=
-github.com/mitchellh/mapstructure v1.1.2/go.mod h1:FVVH3fgwuzCH5S8UJGiWEs2h04kUh9fWfEaFds41c1Y=
-github.com/mitchellh/mapstructure v1.4.3/go.mod h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RRV2QTWOzhPopBRo=
-github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
-github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
-github.com/modern-go/reflect2 v0.0.0-20180701023420-4b7aa43c6742/go.mod h1:bx2lNnkwVCuqBIxFjflWJWanXIb3RllmbCylyMrvgv0=
-github.com/modern-go/reflect2 v1.0.1/go.mod h1:bx2lNnkwVCuqBIxFjflWJWanXIb3RllmbCylyMrvgv0=
-github.com/modern-go/reflect2 v1.0.2/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk=
-github.com/mwitkow/go-conntrack v0.0.0-20161129095857-cc309e4a2223/go.mod h1:qRWi+5nqEBWmkhHvq77mSJWrCKwh8bxhgT7d/eI7P4U=
-github.com/pascaldekloe/goe v0.0.0-20180627143212-57f6aae5913c/go.mod h1:lzWF7FIEvWOWxwDKqyGYQf6ZUaNfKdP144TG7ZOy1lc=
-github.com/pascaldekloe/goe v0.1.0/go.mod h1:lzWF7FIEvWOWxwDKqyGYQf6ZUaNfKdP144TG7ZOy1lc=
-github.com/pelletier/go-toml v1.9.4/go.mod h1:u1nR/EPcESfeI/szUZKdtJ0xRNbUoANCkoOuaOx1Y+c=
-github.com/pkg/errors v0.8.0/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
-github.com/pkg/errors v0.8.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
-github.com/pkg/sftp v1.10.1/go.mod h1:lYOWFsE0bwd1+KfKJaKeuokY15vzFx25BLbzYYoAxZI=
-github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
-github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
-github.com/posener/complete v1.1.1/go.mod h1:em0nMJCgc9GFtwrmVmEMR/ZL6WyhyjMBndrE9hABlRI=
-github.com/posener/complete v1.2.3/go.mod h1:WZIdtGGp+qx0sLrYKtIRAruyNpv6hFCicSgv7Sy7s/s=
-github.com/prometheus/client_golang v0.9.1/go.mod h1:7SWBe2y4D6OKWSNQJUaRYU/AaXPKyh/dDVn+NZz0KFw=
-github.com/prometheus/client_golang v1.0.0/go.mod h1:db9x61etRT2tGnBNRi70OPL5FsnadC4Ky3P0J6CfImo=
-github.com/prometheus/client_golang v1.4.0/go.mod h1:e9GMxYsXl05ICDXkRhurwBS4Q3OK1iX/F2sw+iXX5zU=
-github.com/prometheus/client_model v0.0.0-20180712105110-5c3871d89910/go.mod h1:MbSGuTsp3dbXC40dX6PRTWyKYBIrTGTE9sqQNg2J8bo=
-github.com/prometheus/client_model v0.0.0-20190129233127-fd36f4220a90/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
-github.com/prometheus/client_model v0.0.0-20190812154241-14fe0d1b01d4/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
-github.com/prometheus/client_model v0.2.0/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
-github.com/prometheus/common v0.4.1/go.mod h1:TNfzLD0ON7rHzMJeJkieUDPYmFC7Snx/y86RQel1bk4=
-github.com/prometheus/common v0.9.1/go.mod h1:yhUN8i9wzaXS3w1O07YhxHEBxD+W35wd8bs7vj7HSQ4=
-github.com/prometheus/procfs v0.0.0-20181005140218-185b4288413d/go.mod h1:c3At6R/oaqEKCNdg8wHV1ftS6bRYblBhIjjI8uT2IGk=
-github.com/prometheus/procfs v0.0.2/go.mod h1:TjEm7ze935MbeOT/UhFTIMYKhuLP4wbCsTZCD3I8kEA=
-github.com/prometheus/procfs v0.0.8/go.mod h1:7Qr8sr6344vo1JqZ6HhLceV9o3AJ1Ff+GxbHq6oeK9A=
-github.com/rogpeppe/fastuuid v1.2.0/go.mod h1:jVj6XXZzXRy/MSR5jhDC/2q6DgLz+nrA6LYCDYWNEvQ=
-github.com/rogpeppe/go-internal v1.3.0/go.mod h1:M8bDsm7K2OlrFYOpmOWEs/qY81heoFRclV5y23lUDJ4=
+github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=
+github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
+github.com/coreos/go-oidc/v3 v3.20.0 h1:EtE0WIBHk03N+DqGkY4+UONzzZHk7amKt6IyNd7OsZE=
+github.com/coreos/go-oidc/v3 v3.20.0/go.mod h1:DYCf24+ncYi+XkIH97GY1+dqoRlbaSI26KVTCI9SrY4=
+github.com/cpuguy83/go-md2man/v2 v2.0.6/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g=
+github.com/go-jose/go-jose/v4 v4.1.4 h1:moDMcTHmvE6Groj34emNPLs/qtYXRVcd6S7NHbHz3kA=
+github.com/go-jose/go-jose/v4 v4.1.4/go.mod h1:x4oUasVrzR7071A4TnHLGSPpNOm2a21K9Kf04k1rs08=
+github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI=
+github.com/go-logr/logr v1.4.3/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
+github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=
+github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE=
+github.com/golang/protobuf v1.5.4 h1:i7eJL8qZTpSEXOPTxNKhASYpMn+8e5Q6AdndVa1dWek=
+github.com/golang/protobuf v1.5.4/go.mod h1:lnTiLA8Wa4RWRcIUkrtSVa5nRhsEGBg48fD6rSs7xps=
+github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
+github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
+github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
+github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
+github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8=
+github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
 github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
-github.com/ryanuber/columnize v0.0.0-20160712163229-9b3edd62028f/go.mod h1:sm1tb6uqfes/u+d4ooFouqFdy9/2g9QGwK3SQygK0Ts=
-github.com/sagikazarmark/crypt v0.3.0/go.mod h1:uD/D+6UF4SrIR1uGEv7bBNkNqLGqUr43MRiaGWX1Nig=
-github.com/sean-/seed v0.0.0-20170313163322-e2103e2c3529/go.mod h1:DxrIzT+xaE7yg65j358z/aeFdxmN0P9QXhEzd20vsDc=
-github.com/sirupsen/logrus v1.2.0/go.mod h1:LxeOpSwHxABJmUn/MG1IvRgCAasNZTLOkJPxbbu5VWo=
-github.com/sirupsen/logrus v1.4.2/go.mod h1:tLMulIdttU9McNUspp0xgXVQah82FyeX6MwdIuYE2rE=
-github.com/spaolacci/murmur3 v0.0.0-20180118202830-f09979ecbc72/go.mod h1:JwIasOWyU6f++ZhiEuf87xNszmSA2myDM2Kzu9HwQUA=
-github.com/spf13/afero v1.3.3/go.mod h1:5KUK8ByomD5Ti5Artl0RtHeI5pTF7MIDuXL3yY520V4=
-github.com/spf13/afero v1.6.0/go.mod h1:Ai8FlHk4v/PARR026UzYexafAt9roJ7LcLMAmO6Z93I=
-github.com/spf13/cast v1.4.1/go.mod h1:Qx5cxh0v+4UWYiBimWS+eyWzqEqokIECu5etghLkUJE=
-github.com/spf13/cobra v1.3.0 h1:R7cSvGu+Vv+qX0gW5R/85dx2kmmJT5z5NM8ifdYjdn0=
-github.com/spf13/cobra v1.3.0/go.mod h1:BrRVncBjOJa/eUcVVm9CE+oC6as8k+VYr4NY7WCi9V4=
-github.com/spf13/jwalterweatherman v1.1.0/go.mod h1:aNWZUN0dPAAO/Ljvb5BEdw96iTZ0EXowPYD95IqWIGo=
-github.com/spf13/pflag v1.0.5 h1:iy+VFUOCP1a+8yFto/drg2CJ5u0yRoB7fZw3DKv/JXA=
-github.com/spf13/pflag v1.0.5/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
-github.com/spf13/viper v1.10.0/go.mod h1:SoyBPwAtKDzypXNDFKN5kzH7ppppbGZtls1UpIy5AsM=
-github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
-github.com/stretchr/objx v0.1.1/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
-github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
-github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
-github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
-github.com/stretchr/testify v1.5.1/go.mod h1:5W2xD1RspED5o8YsWQXVCued0rvSQ+mT+I5cxcmMvtA=
-github.com/stretchr/testify v1.6.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
-github.com/stretchr/testify v1.7.0 h1:nwc3DEeHmmLAfoZucVR881uASk0Mfjw8xYJ99tb5CcY=
-github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
-github.com/subosito/gotenv v1.2.0/go.mod h1:N0PQaV/YGNqwC0u51sEeR/aUtSLEXKX9iv69rRypqCw=
-github.com/tv42/httpunix v0.0.0-20150427012821-b75d8614f926/go.mod h1:9ESjWnEqriFuLhtthL60Sar/7RFoluCcXsuvEwTV5KM=
-github.com/yuin/goldmark v1.1.25/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
-github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
-github.com/yuin/goldmark v1.1.32/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
-github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
-github.com/yuin/goldmark v1.3.5/go.mod h1:mwnBkeHKe2W/ZEtQ+71ViKU8L12m81fl3OWwC1Zlc8k=
-go.etcd.io/etcd/api/v3 v3.5.1/go.mod h1:cbVKeC6lCfl7j/8jBhAK6aIYO9XOjdptoxU/nLQcPvs=
-go.etcd.io/etcd/client/pkg/v3 v3.5.1/go.mod h1:IJHfcCEKxYu1Os13ZdwCwIUTUVGYTSAM3YSwc9/Ac1g=
-go.etcd.io/etcd/client/v2 v2.305.1/go.mod h1:pMEacxZW7o8pg4CrFE7pquyCJJzZvkvdD2RibOCCCGs=
-go.opencensus.io v0.21.0/go.mod h1:mSImk1erAIZhrmZN+AvHh14ztQfjbGwt4TtuofqLduU=
-go.opencensus.io v0.22.0/go.mod h1:+kGneAE2xo2IficOXnaByMWTGM9T73dGwxeWcUqIpI8=
-go.opencensus.io v0.22.2/go.mod h1:yxeiOL68Rb0Xd1ddK5vPZ/oVn4vY4Ynel7k9FzqtOIw=
-go.opencensus.io v0.22.3/go.mod h1:yxeiOL68Rb0Xd1ddK5vPZ/oVn4vY4Ynel7k9FzqtOIw=
-go.opencensus.io v0.22.4/go.mod h1:yxeiOL68Rb0Xd1ddK5vPZ/oVn4vY4Ynel7k9FzqtOIw=
-go.opencensus.io v0.22.5/go.mod h1:5pWMHQbX5EPX2/62yrJeAkowc+lfs/XD7Uxpq3pI6kk=
-go.opencensus.io v0.23.0/go.mod h1:XItmlyltB5F7CS4xOC1DcqMoFqwtC6OG2xF7mCv7P7E=
-go.opentelemetry.io/proto/otlp v0.7.0/go.mod h1:PqfVotwruBrMGOCsRd/89rSnXhoiJIqeYNgFYFoEGnI=
-go.uber.org/atomic v1.7.0/go.mod h1:fEN4uk6kAWBTFdckzkM89CLk9XfWZrxpCo0nPH17wJc=
-go.uber.org/multierr v1.6.0/go.mod h1:cdWPpRnG4AhwMwsgIHip0KRBQjJy5kYEpYjJxpXp9iU=
-go.uber.org/zap v1.17.0/go.mod h1:MXVU+bhUf/A7Xi2HNOnopQOrmycQ5Ih87HtOu4q5SSo=
-golang.org/x/crypto v0.0.0-20180904163835-0709b304e793/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
-golang.org/x/crypto v0.0.0-20181029021203-45a5f77698d3/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
-golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
-golang.org/x/crypto v0.0.0-20190510104115-cbcb75029529/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
-golang.org/x/crypto v0.0.0-20190605123033-f99c8df09eb5/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
-golang.org/x/crypto v0.0.0-20190820162420-60c769a6c586/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
-golang.org/x/crypto v0.0.0-20190923035154-9ee001bba392/go.mod h1:/lpIB1dKB+9EgE3H3cr1v9wB50oz8l4C4h62xy7jSTY=
-golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
-golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
-golang.org/x/crypto v0.0.0-20210817164053-32db794688a5/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
-golang.org/x/crypto v0.0.0-20220112180741-5e0467b6c7ce h1:Roh6XWxHFKrPgC/EQhVubSAGQ6Ozk6IdxHSzt1mR0EI=
-golang.org/x/crypto v0.0.0-20220112180741-5e0467b6c7ce/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
-golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
-golang.org/x/exp v0.0.0-20190306152737-a1d7652674e8/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
-golang.org/x/exp v0.0.0-20190510132918-efd6b22b2522/go.mod h1:ZjyILWgesfNpC6sMxTJOJm9Kp84zZh5NQWvqDGG3Qr8=
-golang.org/x/exp v0.0.0-20190829153037-c13cbed26979/go.mod h1:86+5VVa7VpoJ4kLfm080zCjGlMRFzhUhsZKEZO7MGek=
-golang.org/x/exp v0.0.0-20191030013958-a1ab85dbe136/go.mod h1:JXzH8nQsPlswgeRAPE3MuO9GYsAcnJvJ4vnMwN/5qkY=
-golang.org/x/exp v0.0.0-20191129062945-2f5052295587/go.mod h1:2RIsYlXP63K8oxa1u096TMicItID8zy7Y6sNkU49FU4=
-golang.org/x/exp v0.0.0-20191227195350-da58074b4299/go.mod h1:2RIsYlXP63K8oxa1u096TMicItID8zy7Y6sNkU49FU4=
-golang.org/x/exp v0.0.0-20200119233911-0405dc783f0a/go.mod h1:2RIsYlXP63K8oxa1u096TMicItID8zy7Y6sNkU49FU4=
-golang.org/x/exp v0.0.0-20200207192155-f17229e696bd/go.mod h1:J/WKrq2StrnmMY6+EHIKF9dgMWnmCNThgcyBT1FY9mM=
-golang.org/x/exp v0.0.0-20200224162631-6cc2880d07d6/go.mod h1:3jZMyOhIsHpP37uCMkUooju7aAi5cS1Q23tOzKc+0MU=
-golang.org/x/image v0.0.0-20190227222117-0694c2d4d067/go.mod h1:kZ7UVZpmo3dzQBMxlp+ypCbDeSB+sBbTgSJuh5dn5js=
-golang.org/x/image v0.0.0-20190802002840-cff245a6509b/go.mod h1:FeLwcggjj3mMvU+oOTbSwawSJRM1uh48EjtB4UJZlP0=
-golang.org/x/lint v0.0.0-20181026193005-c67002cb31c3/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
-golang.org/x/lint v0.0.0-20190227174305-5b3e6a55c961/go.mod h1:wehouNa3lNwaWXcvxsM5YxQ5yQlVC4a0KAMCusXpPoU=
-golang.org/x/lint v0.0.0-20190301231843-5614ed5bae6f/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
-golang.org/x/lint v0.0.0-20190313153728-d0100b6bd8b3/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
-golang.org/x/lint v0.0.0-20190409202823-959b441ac422/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
-golang.org/x/lint v0.0.0-20190909230951-414d861bb4ac/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
-golang.org/x/lint v0.0.0-20190930215403-16217165b5de/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
-golang.org/x/lint v0.0.0-20191125180803-fdd1cda4f05f/go.mod h1:5qLYkcX4OjUUV8bRuDixDT3tpyyb+LUpUlRWLxfhWrs=
-golang.org/x/lint v0.0.0-20200130185559-910be7a94367/go.mod h1:3xt1FjdF8hUf6vQPIChWIBhFzV8gjjsPE/fR3IyQdNY=
-golang.org/x/lint v0.0.0-20200302205851-738671d3881b/go.mod h1:3xt1FjdF8hUf6vQPIChWIBhFzV8gjjsPE/fR3IyQdNY=
-golang.org/x/lint v0.0.0-20201208152925-83fdc39ff7b5/go.mod h1:3xt1FjdF8hUf6vQPIChWIBhFzV8gjjsPE/fR3IyQdNY=
-golang.org/x/lint v0.0.0-20210508222113-6edffad5e616/go.mod h1:3xt1FjdF8hUf6vQPIChWIBhFzV8gjjsPE/fR3IyQdNY=
-golang.org/x/mobile v0.0.0-20190312151609-d3739f865fa6/go.mod h1:z+o9i4GpDbdi3rU15maQ/Ox0txvL9dWGYEHz965HBQE=
-golang.org/x/mobile v0.0.0-20190719004257-d2bd2a29d028/go.mod h1:E/iHnbuqvinMTCcRqshq8CkpyQDoeVncDDYHnLhea+o=
-golang.org/x/mod v0.0.0-20190513183733-4bf6d317e70e/go.mod h1:mXi4GBBbnImb6dmsKGUJ2LatrhH/nqhxcFungHvyanc=
-golang.org/x/mod v0.1.0/go.mod h1:0QHyrYULN0/3qlju5TqG8bIK38QM8yzMo5ekMj3DlcY=
-golang.org/x/mod v0.1.1-0.20191105210325-c90efee705ee/go.mod h1:QqPTAvyqsEbceGzBzNggFXnrqF1CaUcvgkdR5Ot7KZg=
-golang.org/x/mod v0.1.1-0.20191107180719-034126e5016b/go.mod h1:QqPTAvyqsEbceGzBzNggFXnrqF1CaUcvgkdR5Ot7KZg=
-golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
-golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
-golang.org/x/mod v0.4.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
-golang.org/x/mod v0.4.1/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
-golang.org/x/mod v0.4.2/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
-golang.org/x/mod v0.5.0/go.mod h1:5OXOZSfqPIIbmVBIIKWRFfZjPR0E5r58TLhUjH0a2Ro=
-golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
-golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
-golang.org/x/net v0.0.0-20181023162649-9b4f9f5ad519/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
-golang.org/x/net v0.0.0-20181114220301-adae6a3d119a/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
-golang.org/x/net v0.0.0-20190108225652-1e06a53dbb7e/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
-golang.org/x/net v0.0.0-20190213061140-3a22650c66bd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
-golang.org/x/net v0.0.0-20190311183353-d8887717615a/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
-golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
-golang.org/x/net v0.0.0-20190501004415-9ce7a6920f09/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
-golang.org/x/net v0.0.0-20190503192946-f4e77d36d62c/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
-golang.org/x/net v0.0.0-20190603091049-60506f45cf65/go.mod h1:HSz+uSET+XFnRR8LxR5pz3Of3rY3CfYBVs4xY44aLks=
-golang.org/x/net v0.0.0-20190613194153-d28f0bde5980/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20190628185345-da137c7871d7/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20190724013045-ca1201d0de80/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20190923162816-aa69164e4478/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20191209160850-c0dbc17a3553/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20200114155413-6afb5195e5aa/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20200202094626-16171245cfb2/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20200222125558-5a598a2470a0/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20200301022130-244492dfa37a/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20200324143707-d3edc9973b7e/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
-golang.org/x/net v0.0.0-20200501053045-e0ff5e5a1de5/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
-golang.org/x/net v0.0.0-20200505041828-1ed23360d12c/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
-golang.org/x/net v0.0.0-20200506145744-7e3656a0809f/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
-golang.org/x/net v0.0.0-20200513185701-a91f0712d120/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
-golang.org/x/net v0.0.0-20200520182314-0ba52f642ac2/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
-golang.org/x/net v0.0.0-20200625001655-4c5254603344/go.mod h1:/O7V0waA8r7cgGh81Ro3o1hOxt32SMVPicZroKQ2sZA=
-golang.org/x/net v0.0.0-20200707034311-ab3426394381/go.mod h1:/O7V0waA8r7cgGh81Ro3o1hOxt32SMVPicZroKQ2sZA=
-golang.org/x/net v0.0.0-20200822124328-c89045814202/go.mod h1:/O7V0waA8r7cgGh81Ro3o1hOxt32SMVPicZroKQ2sZA=
-golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
-golang.org/x/net v0.0.0-20201031054903-ff519b6c9102/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
-golang.org/x/net v0.0.0-20201110031124-69a78807bb2b/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
-golang.org/x/net v0.0.0-20201209123823-ac852fbbde11/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
-golang.org/x/net v0.0.0-20210119194325-5f4716e94777/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
-golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
-golang.org/x/net v0.0.0-20210316092652-d523dce5a7f4/go.mod h1:RBQZq4jEuRlivfhVLdyRGr576XBO4/greRjx4P4O3yc=
-golang.org/x/net v0.0.0-20210405180319-a5a99cb37ef4/go.mod h1:p54w0d4576C0XHj96bSt6lcn1PtDYWL6XObtHCRCNQM=
-golang.org/x/net v0.0.0-20210410081132-afb366fc7cd1/go.mod h1:9tjilg8BloeKEkVJvy7fQ90B1CfIiPueXVOjqfkSzI8=
-golang.org/x/net v0.0.0-20210503060351-7fd8e65b6420/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
-golang.org/x/net v0.0.0-20210813160813-60bc85c4be6d/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
-golang.org/x/net v0.0.0-20211112202133-69e39bad7dc2/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
-golang.org/x/net v0.0.0-20220114011407-0dd24b26b47d h1:1n1fc535VhN8SYtD4cDUyNlfpAF2ROMM9+11equK3hs=
-golang.org/x/net v0.0.0-20220114011407-0dd24b26b47d/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
-golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
-golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
-golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
-golang.org/x/oauth2 v0.0.0-20191202225959-858c2ad4c8b6/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
-golang.org/x/oauth2 v0.0.0-20200107190931-bf48bf16ab8d/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
-golang.org/x/oauth2 v0.0.0-20200902213428-5d25da1a8d43/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
-golang.org/x/oauth2 v0.0.0-20201109201403-9fd604954f58/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
-golang.org/x/oauth2 v0.0.0-20201208152858-08078c50e5b5/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
-golang.org/x/oauth2 v0.0.0-20210218202405-ba52d332ba99/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
-golang.org/x/oauth2 v0.0.0-20210220000619-9bb904979d93/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
-golang.org/x/oauth2 v0.0.0-20210313182246-cd4f82c27b84/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
-golang.org/x/oauth2 v0.0.0-20210514164344-f6687ab2804c/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
-golang.org/x/oauth2 v0.0.0-20210628180205-a41e5a781914/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
-golang.org/x/oauth2 v0.0.0-20210805134026-6f1e6394065a/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
-golang.org/x/oauth2 v0.0.0-20210819190943-2bc19b11175f/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
-golang.org/x/oauth2 v0.0.0-20211005180243-6b3c2da341f1/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
-golang.org/x/oauth2 v0.0.0-20211104180415-d3ed0bb246c8 h1:RerP+noqYHUQ8CMRcPlC2nvTa4dcBIjegkuWdcUDuqg=
-golang.org/x/oauth2 v0.0.0-20211104180415-d3ed0bb246c8/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
-golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20181221193216-37e7f081c4d4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20190227155943-e225da77a7e6/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20200317015054-43a5402ce75a/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20200625203802-6e8e738ad208/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20201207232520-09787c993a3a/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20210220032951-036812b2e83c/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sys v0.0.0-20180823144017-11551d06cbcc/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
-golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
-golang.org/x/sys v0.0.0-20180905080454-ebe1bf3edb33/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
-golang.org/x/sys v0.0.0-20181026203630-95b1ffbd15a5/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
-golang.org/x/sys v0.0.0-20181116152217-5ac8a444bdc5/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
-golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
-golang.org/x/sys v0.0.0-20190222072716-a9d3bda3a223/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
-golang.org/x/sys v0.0.0-20190312061237-fead79001313/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20190422165155-953cdadca894/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20190502145724-3ef323f4f1fd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20190507160741-ecd444e8653b/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20190606165138-5da285871e9c/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20190624142023-c5567b49c5d0/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20190726091711-fc99dfbffb4e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20190922100055-0a153f010e69/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20190924154521-2837fb4f24fe/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20191001151750-bb3f8db39f24/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20191008105621-543471e840be/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20191026070338-33540a1f6037/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20191204072324-ce4227a45e2e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20191228213918-04cbcbbfeed8/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200113162924-86b910548bc1/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200116001909-b77594299b42/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200122134326-e047566fdf82/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200124204421-9fbb57f87de9/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200202164722-d101bd2416d5/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200212091648-12a6c2dcc1e4/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200223170610-d5e6a3e2c0ae/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200302150141-5c8b2ff67527/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200323222414-85ca7c5b95cd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200331124033-c3d80250170d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200501052902-10377860bb8e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200511232937-7e40ca221e25/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200515095857-1151b9dac4a9/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200523222454-059865788121/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200803210538-64077c9b5642/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200905004654-be1d3432aa8f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20201201145000-ef89a241ccb3/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210104204734-6f8348627aad/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210119212857-b64e53b001e4/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210220050731-9a76102bfb43/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210303074136-134d130e1a04/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210305230114-8fe3ee5dd75b/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210315160823-c6e025ad8005/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210320140829-1e4c9ba3b0c4/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210330210617-4fbd30eecc44/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210403161142-5e06dd20ab57/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210423082822-04245dca01da/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210510120138-977fb7262007/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20210514084401-e8d321eab015/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20210603125802-9665404d3644/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20210616094352-59db8d763f22/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20210630005230-0f9fa26af87c/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20210806184541-e5e7981a1069/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20210816183151-1e6c022a8912/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20210823070655-63515b42dcdf/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20210908233432-aa78b53d3365/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20210927094055-39ccf1dd6fa6/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20211007075335-d3039528d8ac/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20211124211545-fe61309f8881/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20211205182925-97ca703d548d/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220114195835-da31bd327af9 h1:XfKQ4OlFl8okEOr5UvAqFRVj8pY/4yfcXrddB8qAbU0=
-golang.org/x/sys v0.0.0-20220114195835-da31bd327af9/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
-golang.org/x/text v0.0.0-20170915032832-14c0d48ead0c/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
-golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
-golang.org/x/text v0.3.1-0.20180807135948-17ff2d5776d2/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
-golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk=
-golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
-golang.org/x/text v0.3.4/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
-golang.org/x/text v0.3.5/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
-golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
-golang.org/x/text v0.3.7 h1:olpwvP2KacW1ZWvsR7uQhoyTYvKAupfQrRGBFM352Gk=
-golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
-golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
-golang.org/x/time v0.0.0-20190308202827-9d24e82272b4/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
-golang.org/x/time v0.0.0-20191024005414-555d28b269f0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
-golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
-golang.org/x/tools v0.0.0-20190114222345-bf090417da8b/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
-golang.org/x/tools v0.0.0-20190226205152-f727befe758c/go.mod h1:9Yl7xja0Znq3iFh3HoIrodX9oNMXvdceNzlUR8zjMvY=
-golang.org/x/tools v0.0.0-20190311212946-11955173bddd/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
-golang.org/x/tools v0.0.0-20190312151545-0bb0c0a6e846/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
-golang.org/x/tools v0.0.0-20190312170243-e65039ee4138/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
-golang.org/x/tools v0.0.0-20190425150028-36563e24a262/go.mod h1:RgjU9mgBXZiqYHBnxXauZ1Gv1EHHAz9KjViQ78xBX0Q=
-golang.org/x/tools v0.0.0-20190506145303-2d16b83fe98c/go.mod h1:RgjU9mgBXZiqYHBnxXauZ1Gv1EHHAz9KjViQ78xBX0Q=
-golang.org/x/tools v0.0.0-20190524140312-2c0ae7006135/go.mod h1:RgjU9mgBXZiqYHBnxXauZ1Gv1EHHAz9KjViQ78xBX0Q=
-golang.org/x/tools v0.0.0-20190606124116-d0a3d012864b/go.mod h1:/rFqwRUd4F7ZHNgwSSTFct+R/Kf4OFW1sUzUTQQTgfc=
-golang.org/x/tools v0.0.0-20190621195816-6e04913cbbac/go.mod h1:/rFqwRUd4F7ZHNgwSSTFct+R/Kf4OFW1sUzUTQQTgfc=
-golang.org/x/tools v0.0.0-20190628153133-6cdbf07be9d0/go.mod h1:/rFqwRUd4F7ZHNgwSSTFct+R/Kf4OFW1sUzUTQQTgfc=
-golang.org/x/tools v0.0.0-20190816200558-6889da9d5479/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
-golang.org/x/tools v0.0.0-20190907020128-2ca718005c18/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
-golang.org/x/tools v0.0.0-20190911174233-4f2ddba30aff/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
-golang.org/x/tools v0.0.0-20191012152004-8de300cfc20a/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
-golang.org/x/tools v0.0.0-20191113191852-77e3bb0ad9e7/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
-golang.org/x/tools v0.0.0-20191115202509-3a792d9c32b2/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
-golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
-golang.org/x/tools v0.0.0-20191125144606-a911d9008d1f/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
-golang.org/x/tools v0.0.0-20191130070609-6e064ea0cf2d/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
-golang.org/x/tools v0.0.0-20191216173652-a0e659d51361/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
-golang.org/x/tools v0.0.0-20191227053925-7b8e75db28f4/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
-golang.org/x/tools v0.0.0-20200117161641-43d50277825c/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
-golang.org/x/tools v0.0.0-20200122220014-bf1340f18c4a/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
-golang.org/x/tools v0.0.0-20200130002326-2f3ba24bd6e7/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
-golang.org/x/tools v0.0.0-20200204074204-1cc6d1ef6c74/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
-golang.org/x/tools v0.0.0-20200207183749-b753a1ba74fa/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
-golang.org/x/tools v0.0.0-20200212150539-ea181f53ac56/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
-golang.org/x/tools v0.0.0-20200224181240-023911ca70b2/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
-golang.org/x/tools v0.0.0-20200227222343-706bc42d1f0d/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
-golang.org/x/tools v0.0.0-20200304193943-95d2e580d8eb/go.mod h1:o4KQGtdN14AW+yjsvvwRTJJuXz8XRtIHtEnmAXLyFUw=
-golang.org/x/tools v0.0.0-20200312045724-11d5b4c81c7d/go.mod h1:o4KQGtdN14AW+yjsvvwRTJJuXz8XRtIHtEnmAXLyFUw=
-golang.org/x/tools v0.0.0-20200331025713-a30bf2db82d4/go.mod h1:Sl4aGygMT6LrqrWclx+PTx3U+LnKx/seiNR+3G19Ar8=
-golang.org/x/tools v0.0.0-20200501065659-ab2804fb9c9d/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
-golang.org/x/tools v0.0.0-20200512131952-2bc93b1c0c88/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
-golang.org/x/tools v0.0.0-20200515010526-7d3b6ebf133d/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
-golang.org/x/tools v0.0.0-20200618134242-20370b0cb4b2/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
-golang.org/x/tools v0.0.0-20200619180055-7c47624df98f/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
-golang.org/x/tools v0.0.0-20200729194436-6467de6f59a7/go.mod h1:njjCfa9FT2d7l9Bc6FUM5FLjQPp3cFF28FI3qnDFljA=
-golang.org/x/tools v0.0.0-20200804011535-6c149bb5ef0d/go.mod h1:njjCfa9FT2d7l9Bc6FUM5FLjQPp3cFF28FI3qnDFljA=
-golang.org/x/tools v0.0.0-20200825202427-b303f430e36d/go.mod h1:njjCfa9FT2d7l9Bc6FUM5FLjQPp3cFF28FI3qnDFljA=
-golang.org/x/tools v0.0.0-20200904185747-39188db58858/go.mod h1:Cj7w3i3Rnn0Xh82ur9kSqwfTHTeVxaDqrfMjpcNT6bE=
-golang.org/x/tools v0.0.0-20201110124207-079ba7bd75cd/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
-golang.org/x/tools v0.0.0-20201201161351-ac6f37ff4c2a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
-golang.org/x/tools v0.0.0-20201208233053-a543418bbed2/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
-golang.org/x/tools v0.0.0-20210105154028-b0ab187a4818/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
-golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
-golang.org/x/tools v0.1.0/go.mod h1:xkSsbof2nBLbhDlRMhhhyNLN/zl3eTqcnHD5viDpcZ0=
-golang.org/x/tools v0.1.1/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
-golang.org/x/tools v0.1.2/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
-golang.org/x/tools v0.1.3/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
-golang.org/x/tools v0.1.4/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
-golang.org/x/tools v0.1.5/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
-golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1 h1:go1bK/D/BFZV2I8cIQd1NKEZ+0owSTG1fDTci4IqFcE=
-golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-google.golang.org/api v0.4.0/go.mod h1:8k5glujaEP+g9n7WNsDg8QP6cUVNI86fCNMcbazEtwE=
-google.golang.org/api v0.7.0/go.mod h1:WtwebWUNSVBH/HAw79HIFXZNqEvBhG+Ra+ax0hx3E3M=
-google.golang.org/api v0.8.0/go.mod h1:o4eAsZoiT+ibD93RtjEohWalFOjRDx6CVaqeizhEnKg=
-google.golang.org/api v0.9.0/go.mod h1:o4eAsZoiT+ibD93RtjEohWalFOjRDx6CVaqeizhEnKg=
-google.golang.org/api v0.13.0/go.mod h1:iLdEw5Ide6rF15KTC1Kkl0iskquN2gFfn9o9XIsbkAI=
-google.golang.org/api v0.14.0/go.mod h1:iLdEw5Ide6rF15KTC1Kkl0iskquN2gFfn9o9XIsbkAI=
-google.golang.org/api v0.15.0/go.mod h1:iLdEw5Ide6rF15KTC1Kkl0iskquN2gFfn9o9XIsbkAI=
-google.golang.org/api v0.17.0/go.mod h1:BwFmGc8tA3vsd7r/7kR8DY7iEEGSU04BFxCo5jP/sfE=
-google.golang.org/api v0.18.0/go.mod h1:BwFmGc8tA3vsd7r/7kR8DY7iEEGSU04BFxCo5jP/sfE=
-google.golang.org/api v0.19.0/go.mod h1:BwFmGc8tA3vsd7r/7kR8DY7iEEGSU04BFxCo5jP/sfE=
-google.golang.org/api v0.20.0/go.mod h1:BwFmGc8tA3vsd7r/7kR8DY7iEEGSU04BFxCo5jP/sfE=
-google.golang.org/api v0.22.0/go.mod h1:BwFmGc8tA3vsd7r/7kR8DY7iEEGSU04BFxCo5jP/sfE=
-google.golang.org/api v0.24.0/go.mod h1:lIXQywCXRcnZPGlsd8NbLnOjtAoL6em04bJ9+z0MncE=
-google.golang.org/api v0.28.0/go.mod h1:lIXQywCXRcnZPGlsd8NbLnOjtAoL6em04bJ9+z0MncE=
-google.golang.org/api v0.29.0/go.mod h1:Lcubydp8VUV7KeIHD9z2Bys/sm/vGKnG1UHuDBSrHWM=
-google.golang.org/api v0.30.0/go.mod h1:QGmEvQ87FHZNiUVJkT14jQNYJ4ZJjdRF23ZXz5138Fc=
-google.golang.org/api v0.35.0/go.mod h1:/XrVsuzM0rZmrsbjJutiuftIzeuTQcEeaYcSk/mQ1dg=
-google.golang.org/api v0.36.0/go.mod h1:+z5ficQTmoYpPn8LCUNVpK5I7hwkpjbcgqA7I34qYtE=
-google.golang.org/api v0.40.0/go.mod h1:fYKFpnQN0DsDSKRVRcQSDQNtqWPfM9i+zNPxepjRCQ8=
-google.golang.org/api v0.41.0/go.mod h1:RkxM5lITDfTzmyKFPt+wGrCJbVfniCr2ool8kTBzRTU=
-google.golang.org/api v0.43.0/go.mod h1:nQsDGjRXMo4lvh5hP0TKqF244gqhGcr/YSIykhUk/94=
-google.golang.org/api v0.47.0/go.mod h1:Wbvgpq1HddcWVtzsVLyfLp8lDg6AA241LmgIL59tHXo=
-google.golang.org/api v0.48.0/go.mod h1:71Pr1vy+TAZRPkPs/xlCf5SsU8WjuAWv1Pfjbtukyy4=
-google.golang.org/api v0.50.0/go.mod h1:4bNT5pAuq5ji4SRZm+5QIkjny9JAyVD/3gaSihNefaw=
-google.golang.org/api v0.51.0/go.mod h1:t4HdrdoNgyN5cbEfm7Lum0lcLDLiise1F8qDKX00sOU=
-google.golang.org/api v0.54.0/go.mod h1:7C4bFFOvVDGXjfDTAsgGwDgAxRDeQ4X8NvUedIt6z3k=
-google.golang.org/api v0.55.0/go.mod h1:38yMfeP1kfjsl8isn0tliTjIb1rJXcQi4UXlbqivdVE=
-google.golang.org/api v0.56.0/go.mod h1:38yMfeP1kfjsl8isn0tliTjIb1rJXcQi4UXlbqivdVE=
-google.golang.org/api v0.57.0/go.mod h1:dVPlbZyBo2/OjBpmvNdpn2GRm6rPy75jyU7bmhdrMgI=
-google.golang.org/api v0.59.0/go.mod h1:sT2boj7M9YJxZzgeZqXogmhfmRWDtPzT31xkieUbuZU=
-google.golang.org/api v0.61.0/go.mod h1:xQRti5UdCmoCEqFxcz93fTl338AVqDgyaDRuOZ3hg9I=
-google.golang.org/api v0.62.0/go.mod h1:dKmwPCydfsad4qCH08MSdgWjfHOyfpd4VtDGgRFdavw=
-google.golang.org/appengine v1.1.0/go.mod h1:EbEs0AVv82hx2wNQdGPgUI5lhzA/G0D9YwlJXL52JkM=
-google.golang.org/appengine v1.4.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
-google.golang.org/appengine v1.5.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
-google.golang.org/appengine v1.6.1/go.mod h1:i06prIuMbXzDqacNJfV5OdTW448YApPu5ww/cMBSeb0=
-google.golang.org/appengine v1.6.5/go.mod h1:8WjMMxjGQR8xUklV/ARdw2HLXBOI7O7uCIDZVag1xfc=
-google.golang.org/appengine v1.6.6/go.mod h1:8WjMMxjGQR8xUklV/ARdw2HLXBOI7O7uCIDZVag1xfc=
-google.golang.org/appengine v1.6.7 h1:FZR1q0exgwxzPzp/aF+VccGrSfxfPpkBqjIIEq3ru6c=
-google.golang.org/appengine v1.6.7/go.mod h1:8WjMMxjGQR8xUklV/ARdw2HLXBOI7O7uCIDZVag1xfc=
-google.golang.org/genproto v0.0.0-20180817151627-c66870c02cf8/go.mod h1:JiN7NxoALGmiZfu7CAH4rXhgtRTLTxftemlI0sWmxmc=
-google.golang.org/genproto v0.0.0-20190307195333-5fe7a883aa19/go.mod h1:VzzqZJRnGkLBvHegQrXjBqPurQTc5/KpmUdxsrq26oE=
-google.golang.org/genproto v0.0.0-20190418145605-e7d98fc518a7/go.mod h1:VzzqZJRnGkLBvHegQrXjBqPurQTc5/KpmUdxsrq26oE=
-google.golang.org/genproto v0.0.0-20190425155659-357c62f0e4bb/go.mod h1:VzzqZJRnGkLBvHegQrXjBqPurQTc5/KpmUdxsrq26oE=
-google.golang.org/genproto v0.0.0-20190502173448-54afdca5d873/go.mod h1:VzzqZJRnGkLBvHegQrXjBqPurQTc5/KpmUdxsrq26oE=
-google.golang.org/genproto v0.0.0-20190801165951-fa694d86fc64/go.mod h1:DMBHOl98Agz4BDEuKkezgsaosCRResVns1a3J2ZsMNc=
-google.golang.org/genproto v0.0.0-20190819201941-24fa4b261c55/go.mod h1:DMBHOl98Agz4BDEuKkezgsaosCRResVns1a3J2ZsMNc=
-google.golang.org/genproto v0.0.0-20190911173649-1774047e7e51/go.mod h1:IbNlFCBrqXvoKpeg0TB2l7cyZUmoaFKYIwrEpbDKLA8=
-google.golang.org/genproto v0.0.0-20191108220845-16a3f7862a1a/go.mod h1:n3cpQtvxv34hfy77yVDNjmbRyujviMdxYliBSkLhpCc=
-google.golang.org/genproto v0.0.0-20191115194625-c23dd37a84c9/go.mod h1:n3cpQtvxv34hfy77yVDNjmbRyujviMdxYliBSkLhpCc=
-google.golang.org/genproto v0.0.0-20191216164720-4f79533eabd1/go.mod h1:n3cpQtvxv34hfy77yVDNjmbRyujviMdxYliBSkLhpCc=
-google.golang.org/genproto v0.0.0-20191230161307-f3c370f40bfb/go.mod h1:n3cpQtvxv34hfy77yVDNjmbRyujviMdxYliBSkLhpCc=
-google.golang.org/genproto v0.0.0-20200115191322-ca5a22157cba/go.mod h1:n3cpQtvxv34hfy77yVDNjmbRyujviMdxYliBSkLhpCc=
-google.golang.org/genproto v0.0.0-20200122232147-0452cf42e150/go.mod h1:n3cpQtvxv34hfy77yVDNjmbRyujviMdxYliBSkLhpCc=
-google.golang.org/genproto v0.0.0-20200204135345-fa8e72b47b90/go.mod h1:GmwEX6Z4W5gMy59cAlVYjN9JhxgbQH6Gn+gFDQe2lzA=
-google.golang.org/genproto v0.0.0-20200212174721-66ed5ce911ce/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
-google.golang.org/genproto v0.0.0-20200224152610-e50cd9704f63/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
-google.golang.org/genproto v0.0.0-20200228133532-8c2c7df3a383/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
-google.golang.org/genproto v0.0.0-20200305110556-506484158171/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
-google.golang.org/genproto v0.0.0-20200312145019-da6875a35672/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
-google.golang.org/genproto v0.0.0-20200331122359-1ee6d9798940/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
-google.golang.org/genproto v0.0.0-20200430143042-b979b6f78d84/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
-google.golang.org/genproto v0.0.0-20200511104702-f5ebc3bea380/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
-google.golang.org/genproto v0.0.0-20200513103714-09dca8ec2884/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
-google.golang.org/genproto v0.0.0-20200515170657-fc4c6c6a6587/go.mod h1:YsZOwe1myG/8QRHRsmBRE1LrgQY60beZKjly0O1fX9U=
-google.golang.org/genproto v0.0.0-20200526211855-cb27e3aa2013/go.mod h1:NbSheEEYHJ7i3ixzK3sjbqSGDJWnxyFXZblF3eUsNvo=
-google.golang.org/genproto v0.0.0-20200618031413-b414f8b61790/go.mod h1:jDfRM7FcilCzHH/e9qn6dsT145K34l5v+OpcnNgKAAA=
-google.golang.org/genproto v0.0.0-20200729003335-053ba62fc06f/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
-google.golang.org/genproto v0.0.0-20200804131852-c06518451d9c/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
-google.golang.org/genproto v0.0.0-20200825200019-8632dd797987/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
-google.golang.org/genproto v0.0.0-20200904004341-0bd0a958aa1d/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
-google.golang.org/genproto v0.0.0-20201109203340-2640f1f9cdfb/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
-google.golang.org/genproto v0.0.0-20201201144952-b05cb90ed32e/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
-google.golang.org/genproto v0.0.0-20201210142538-e3217bee35cc/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
-google.golang.org/genproto v0.0.0-20201214200347-8c77b98c765d/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
-google.golang.org/genproto v0.0.0-20210222152913-aa3ee6e6a81c/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
-google.golang.org/genproto v0.0.0-20210303154014-9728d6b83eeb/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
-google.golang.org/genproto v0.0.0-20210310155132-4ce2db91004e/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
-google.golang.org/genproto v0.0.0-20210319143718-93e7006c17a6/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
-google.golang.org/genproto v0.0.0-20210402141018-6c239bbf2bb1/go.mod h1:9lPAdzaEmUacj36I+k7YKbEc5CXzPIeORRgDAUOu28A=
-google.golang.org/genproto v0.0.0-20210513213006-bf773b8c8384/go.mod h1:P3QM42oQyzQSnHPnZ/vqoCdDmzH28fzWByN9asMeM8A=
-google.golang.org/genproto v0.0.0-20210602131652-f16073e35f0c/go.mod h1:UODoCrxHCcBojKKwX1terBiRUaqAsFqJiF615XL43r0=
-google.golang.org/genproto v0.0.0-20210604141403-392c879c8b08/go.mod h1:UODoCrxHCcBojKKwX1terBiRUaqAsFqJiF615XL43r0=
-google.golang.org/genproto v0.0.0-20210608205507-b6d2f5bf0d7d/go.mod h1:UODoCrxHCcBojKKwX1terBiRUaqAsFqJiF615XL43r0=
-google.golang.org/genproto v0.0.0-20210624195500-8bfb893ecb84/go.mod h1:SzzZ/N+nwJDaO1kznhnlzqS8ocJICar6hYhVyhi++24=
-google.golang.org/genproto v0.0.0-20210713002101-d411969a0d9a/go.mod h1:AxrInvYm1dci+enl5hChSFPOmmUF1+uAa/UsgNRWd7k=
-google.golang.org/genproto v0.0.0-20210716133855-ce7ef5c701ea/go.mod h1:AxrInvYm1dci+enl5hChSFPOmmUF1+uAa/UsgNRWd7k=
-google.golang.org/genproto v0.0.0-20210728212813-7823e685a01f/go.mod h1:ob2IJxKrgPT52GcgX759i1sleT07tiKowYBGbczaW48=
-google.golang.org/genproto v0.0.0-20210805201207-89edb61ffb67/go.mod h1:ob2IJxKrgPT52GcgX759i1sleT07tiKowYBGbczaW48=
-google.golang.org/genproto v0.0.0-20210813162853-db860fec028c/go.mod h1:cFeNkxwySK631ADgubI+/XFU/xp8FD5KIVV4rj8UC5w=
-google.golang.org/genproto v0.0.0-20210821163610-241b8fcbd6c8/go.mod h1:eFjDcFEctNawg4eG61bRv87N7iHBWyVhJu7u1kqDUXY=
-google.golang.org/genproto v0.0.0-20210828152312-66f60bf46e71/go.mod h1:eFjDcFEctNawg4eG61bRv87N7iHBWyVhJu7u1kqDUXY=
-google.golang.org/genproto v0.0.0-20210831024726-fe130286e0e2/go.mod h1:eFjDcFEctNawg4eG61bRv87N7iHBWyVhJu7u1kqDUXY=
-google.golang.org/genproto v0.0.0-20210903162649-d08c68adba83/go.mod h1:eFjDcFEctNawg4eG61bRv87N7iHBWyVhJu7u1kqDUXY=
-google.golang.org/genproto v0.0.0-20210909211513-a8c4777a87af/go.mod h1:eFjDcFEctNawg4eG61bRv87N7iHBWyVhJu7u1kqDUXY=
-google.golang.org/genproto v0.0.0-20210924002016-3dee208752a0/go.mod h1:5CzLGKJ67TSI2B9POpiiyGha0AjJvZIUgRMt1dSmuhc=
-google.golang.org/genproto v0.0.0-20211008145708-270636b82663/go.mod h1:5CzLGKJ67TSI2B9POpiiyGha0AjJvZIUgRMt1dSmuhc=
-google.golang.org/genproto v0.0.0-20211028162531-8db9c33dc351/go.mod h1:5CzLGKJ67TSI2B9POpiiyGha0AjJvZIUgRMt1dSmuhc=
-google.golang.org/genproto v0.0.0-20211118181313-81c1377c94b1/go.mod h1:5CzLGKJ67TSI2B9POpiiyGha0AjJvZIUgRMt1dSmuhc=
-google.golang.org/genproto v0.0.0-20211129164237-f09f9a12af12/go.mod h1:5CzLGKJ67TSI2B9POpiiyGha0AjJvZIUgRMt1dSmuhc=
-google.golang.org/genproto v0.0.0-20211203200212-54befc351ae9/go.mod h1:5CzLGKJ67TSI2B9POpiiyGha0AjJvZIUgRMt1dSmuhc=
-google.golang.org/genproto v0.0.0-20211206160659-862468c7d6e0/go.mod h1:5CzLGKJ67TSI2B9POpiiyGha0AjJvZIUgRMt1dSmuhc=
-google.golang.org/genproto v0.0.0-20211208223120-3a66f561d7aa/go.mod h1:5CzLGKJ67TSI2B9POpiiyGha0AjJvZIUgRMt1dSmuhc=
-google.golang.org/genproto v0.0.0-20220114231437-d2e6a121cae0 h1:aCsSLXylHWFno0r4S3joLpiaWayvqd2Mn4iSvx4WZZc=
-google.golang.org/genproto v0.0.0-20220114231437-d2e6a121cae0/go.mod h1:5CzLGKJ67TSI2B9POpiiyGha0AjJvZIUgRMt1dSmuhc=
-google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c=
-google.golang.org/grpc v1.20.1/go.mod h1:10oTOabMzJvdu6/UiuZezV6QK5dSlG84ov/aaiqXj38=
-google.golang.org/grpc v1.21.1/go.mod h1:oYelfM1adQP15Ek0mdvEgi9Df8B9CZIaU1084ijfRaM=
-google.golang.org/grpc v1.23.0/go.mod h1:Y5yQAOtifL1yxbo5wqy6BxZv8vAUGQwXBOALyacEbxg=
-google.golang.org/grpc v1.25.1/go.mod h1:c3i+UQWmh7LiEpx4sFZnkU36qjEYZ0imhYfXVyQciAY=
-google.golang.org/grpc v1.26.0/go.mod h1:qbnxyOmOxrQa7FizSgH+ReBfzJrCY1pSN7KXBS8abTk=
-google.golang.org/grpc v1.27.0/go.mod h1:qbnxyOmOxrQa7FizSgH+ReBfzJrCY1pSN7KXBS8abTk=
-google.golang.org/grpc v1.27.1/go.mod h1:qbnxyOmOxrQa7FizSgH+ReBfzJrCY1pSN7KXBS8abTk=
-google.golang.org/grpc v1.28.0/go.mod h1:rpkK4SK4GF4Ach/+MFLZUBavHOvF2JJB5uozKKal+60=
-google.golang.org/grpc v1.29.1/go.mod h1:itym6AZVZYACWQqET3MqgPpjcuV5QH3BxFS3IjizoKk=
-google.golang.org/grpc v1.30.0/go.mod h1:N36X2cJ7JwdamYAgDz+s+rVMFjt3numwzf/HckM8pak=
-google.golang.org/grpc v1.31.0/go.mod h1:N36X2cJ7JwdamYAgDz+s+rVMFjt3numwzf/HckM8pak=
-google.golang.org/grpc v1.31.1/go.mod h1:N36X2cJ7JwdamYAgDz+s+rVMFjt3numwzf/HckM8pak=
-google.golang.org/grpc v1.33.1/go.mod h1:fr5YgcSWrqhRRxogOsw7RzIpsmvOZ6IcH4kBYTpR3n0=
-google.golang.org/grpc v1.33.2/go.mod h1:JMHMWHQWaTccqQQlmk3MJZS+GWXOdAesneDmEnv2fbc=
-google.golang.org/grpc v1.34.0/go.mod h1:WotjhfgOW/POjDeRt8vscBtXq+2VjORFy659qA51WJ8=
-google.golang.org/grpc v1.35.0/go.mod h1:qjiiYl8FncCW8feJPdyg3v6XW24KsRHe+dy9BAGRRjU=
-google.golang.org/grpc v1.36.0/go.mod h1:qjiiYl8FncCW8feJPdyg3v6XW24KsRHe+dy9BAGRRjU=
-google.golang.org/grpc v1.36.1/go.mod h1:qjiiYl8FncCW8feJPdyg3v6XW24KsRHe+dy9BAGRRjU=
-google.golang.org/grpc v1.37.0/go.mod h1:NREThFqKR1f3iQ6oBuvc5LadQuXVGo9rkm5ZGrQdJfM=
-google.golang.org/grpc v1.37.1/go.mod h1:NREThFqKR1f3iQ6oBuvc5LadQuXVGo9rkm5ZGrQdJfM=
-google.golang.org/grpc v1.38.0/go.mod h1:NREThFqKR1f3iQ6oBuvc5LadQuXVGo9rkm5ZGrQdJfM=
-google.golang.org/grpc v1.39.0/go.mod h1:PImNr+rS9TWYb2O4/emRugxiyHZ5JyHW5F+RPnDzfrE=
-google.golang.org/grpc v1.39.1/go.mod h1:PImNr+rS9TWYb2O4/emRugxiyHZ5JyHW5F+RPnDzfrE=
-google.golang.org/grpc v1.40.0/go.mod h1:ogyxbiOoUXAkP+4+xa6PZSE9DZgIHtSpzjDTB9KAK34=
-google.golang.org/grpc v1.40.1/go.mod h1:ogyxbiOoUXAkP+4+xa6PZSE9DZgIHtSpzjDTB9KAK34=
-google.golang.org/grpc v1.42.0/go.mod h1:k+4IHHFw41K8+bbowsex27ge2rCb65oeWqe4jJ590SU=
-google.golang.org/grpc v1.43.0 h1:Eeu7bZtDZ2DpRCsLhUlcrLnvYaMK1Gz86a+hMVvELmM=
-google.golang.org/grpc v1.43.0/go.mod h1:k+4IHHFw41K8+bbowsex27ge2rCb65oeWqe4jJ590SU=
-google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.1.0/go.mod h1:6Kw0yEErY5E/yWrBtf03jp27GLLJujG4z/JK95pnjjw=
-google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8=
-google.golang.org/protobuf v0.0.0-20200221191635-4d8936d0db64/go.mod h1:kwYJMbMJ01Woi6D6+Kah6886xMZcty6N08ah7+eCXa0=
-google.golang.org/protobuf v0.0.0-20200228230310-ab0ca4ff8a60/go.mod h1:cfTl7dwQJ+fmap5saPgwCLgHXTUD7jkjRqWcaiX5VyM=
-google.golang.org/protobuf v1.20.1-0.20200309200217-e05f789c0967/go.mod h1:A+miEFZTKqfCUM6K7xSMQL9OKL/b6hQv+e19PK+JZNE=
-google.golang.org/protobuf v1.21.0/go.mod h1:47Nbq4nVaFHyn7ilMalzfO3qCViNmqZ2kzikPIcrTAo=
-google.golang.org/protobuf v1.22.0/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
-google.golang.org/protobuf v1.23.0/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
-google.golang.org/protobuf v1.23.1-0.20200526195155-81db48ad09cc/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
-google.golang.org/protobuf v1.24.0/go.mod h1:r/3tXBNzIEhYS9I1OUVjXDlt8tc493IdKGjtUeSXeh4=
-google.golang.org/protobuf v1.25.0/go.mod h1:9JNX74DMeImyA3h4bdi1ymwjUzf21/xIlbajtzgsN7c=
-google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw=
-google.golang.org/protobuf v1.26.0/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
-google.golang.org/protobuf v1.27.1 h1:SnqbnDw1V7RiZcXPx5MEeqPv2s79L9i7BJUlG/+RurQ=
-google.golang.org/protobuf v1.27.1/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
-gopkg.in/alecthomas/kingpin.v2 v2.2.6/go.mod h1:FMv+mEhP44yOT+4EoQTLFTRgOQ1FBLkstjWtayDeSgw=
+github.com/spf13/cobra v1.10.2 h1:DMTTonx5m65Ic0GOoRY2c16WCbHxOOw6xxezuLaBpcU=
+github.com/spf13/cobra v1.10.2/go.mod h1:7C1pvHqHw5A4vrJfjNwvOdzYu0Gml16OCs2GRiTUUS4=
+github.com/spf13/pflag v1.0.9 h1:9exaQaMOCwffKiiiYk6/BndUBv+iRViNW+4lEMi0PvY=
+github.com/spf13/pflag v1.0.9/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
+go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ64=
+go.opentelemetry.io/auto/sdk v1.2.1/go.mod h1:KRTj+aOaElaLi+wW1kO/DZRXwkF4C5xPbEe3ZiIhN7Y=
+go.opentelemetry.io/otel v1.44.0 h1:JjwHmHpA4iZ3wBxluu2fbbE7j4kqlE8jXyAyPXH7HqU=
+go.opentelemetry.io/otel v1.44.0/go.mod h1:BMgjTHL9WPRlRjL2oZCBTL4whCGtXch2H4BhOPIAyYc=
+go.opentelemetry.io/otel/metric v1.44.0 h1:1w0gILTcHdr3YI+ixLyjemwrVnsMURbTZFrSYCdDdmc=
+go.opentelemetry.io/otel/metric v1.44.0/go.mod h1:8O7hanEPBNgEMmybD3s2VBKcgWOCsA6tzHBPODAiquo=
+go.opentelemetry.io/otel/sdk v1.44.0 h1:nHYwb9lK+fJPU/dnT6s7W7Z8itMWyqrnVfbheVYrZ58=
+go.opentelemetry.io/otel/sdk v1.44.0/go.mod h1:Osuydd3Se74nqjAKxid74N5eC+jfEqfTegHRnq58oK0=
+go.opentelemetry.io/otel/sdk/metric v1.44.0 h1:3LlKgI+VjbVsjNRFZJZAJ30WjXC5VkNRks6si09iEfI=
+go.opentelemetry.io/otel/sdk/metric v1.44.0/go.mod h1:5B5pMARnXxKhltooO4xUuCBorl65a4EpnTalObqOigA=
+go.opentelemetry.io/otel/trace v1.44.0 h1:jxF5CsGYCe74MCRx2X4g7WsY/VBKRqqpNvXlX/6gtIk=
+go.opentelemetry.io/otel/trace v1.44.0/go.mod h1:oLl1jrMQAVo6v3GAggN+1VH9VIz9iUSvW53sW1Q8PIE=
+go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
+golang.org/x/crypto v0.54.0 h1:YLIA59K4fiNzHzjnZt2tUJQjQtUWfWbeHBqKtk3eScw=
+golang.org/x/crypto v0.54.0/go.mod h1:KWL8ny2AZdGR2cWmzeHrp2azQPGogOv+HeQaVEXC2dk=
+golang.org/x/net v0.56.0 h1:Rw8j/hFzGvJUZwNBXnAtf5sVDVt+65SK2C7IxCxZt5o=
+golang.org/x/net v0.56.0/go.mod h1:D3Ku6r+V6JROoZK144D2XfMHFcMq/0zSfLelVTCFKec=
+golang.org/x/oauth2 v0.36.0 h1:peZ/1z27fi9hUOFCAZaHyrpWG5lwe0RJEEEeH0ThlIs=
+golang.org/x/oauth2 v0.36.0/go.mod h1:YDBUJMTkDnJS+A4BP4eZBjCqtokkg1hODuPjwiGPO7Q=
+golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=
+golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
+golang.org/x/text v0.40.0 h1:Ub2Z6/xjgF1WrYQz2nuITOEegKFtiIy+rieRJ5lHZKs=
+golang.org/x/text v0.40.0/go.mod h1:hpnzDAfGV753zIKo+wk3u1bVKCGPbrnF7+7LBF/UHVY=
+gonum.org/v1/gonum v0.17.0 h1:VbpOemQlsSMrYmn7T2OUvQ4dqxQXU+ouZFQsZOx50z4=
+gonum.org/v1/gonum v0.17.0/go.mod h1:El3tOrEuMpv2UdMrbNlKEh9vd86bmQ6vqIcDwxEOc1E=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20260526163538-3dc84a4a5aaa h1:mZHHdPZl0dbGHCflZgAq/Q468DWVFcU2whhB2KAo8fk=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20260526163538-3dc84a4a5aaa/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8=
+google.golang.org/grpc v1.83.0 h1:JeNZEKJFbQxArAMl+hiytHauacDNqJUllNfmIMmpqnQ=
+google.golang.org/grpc v1.83.0/go.mod h1:kDyl6SKsiHKt0uylY5gtn5cEjkrIOhQOGDgIc4JGwzQ=
+google.golang.org/protobuf v1.36.11 h1:fV6ZwhNocDyBLK0dj+fg8ektcVegBBuEolpbTQyBNVE=
+google.golang.org/protobuf v1.36.11/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
-gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
-gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
-gopkg.in/errgo.v2 v2.1.0/go.mod h1:hNsd1EY+bozCKY1Ytp96fpM3vjJbqLJn88ws8XvfDNI=
-gopkg.in/ini.v1 v1.66.2/go.mod h1:pNLf8WUiyNEtQjuu5G5vTm06TEv9tsIgeAvK8hOrP4k=
-gopkg.in/square/go-jose.v2 v2.5.1/go.mod h1:M9dMgbHiYLoDGQrXy7OpJDJWiKiU//h+vD76mk0e1AI=
-gopkg.in/square/go-jose.v2 v2.6.0 h1:NGk74WTnPKBNUhNzQX7PYcTLUjoq7mzKk2OKbvwk2iI=
-gopkg.in/square/go-jose.v2 v2.6.0/go.mod h1:M9dMgbHiYLoDGQrXy7OpJDJWiKiU//h+vD76mk0e1AI=
-gopkg.in/yaml.v2 v2.2.1/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
-gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
-gopkg.in/yaml.v2 v2.2.3/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
-gopkg.in/yaml.v2 v2.2.4/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
-gopkg.in/yaml.v2 v2.2.5/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
-gopkg.in/yaml.v2 v2.2.8/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
-gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
-gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
-gopkg.in/yaml.v3 v3.0.0-20210107192922-496545a6307b h1:h8qDotaEPuJATrMmW04NCwg7v22aHH28wwpauUhK9Oo=
-gopkg.in/yaml.v3 v3.0.0-20210107192922-496545a6307b/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
-honnef.co/go/tools v0.0.0-20190102054323-c2f93a96b099/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
-honnef.co/go/tools v0.0.0-20190106161140-3f1c8253044a/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
-honnef.co/go/tools v0.0.0-20190418001031-e561f6794a2a/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
-honnef.co/go/tools v0.0.0-20190523083050-ea95bdfd59fc/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
-honnef.co/go/tools v0.0.1-2019.2.3/go.mod h1:a3bituU0lyd329TUQxRnasdCoJDkEUEAqEt0JzvZhAg=
-honnef.co/go/tools v0.0.1-2020.1.3/go.mod h1:X/FiERA/W4tHapMX5mGpAtMSVEeEUOyHaw9vFzvIQ3k=
-honnef.co/go/tools v0.0.1-2020.1.4/go.mod h1:X/FiERA/W4tHapMX5mGpAtMSVEeEUOyHaw9vFzvIQ3k=
-rsc.io/binaryregexp v0.2.0/go.mod h1:qTv7/COck+e2FymRvadv62gMdZztPaShugOCi3I+8D8=
-rsc.io/quote/v3 v3.1.0/go.mod h1:yEA65RcK8LyAZtP9Kv3t0HmxON59tX3rD+tICJqUlj0=
-rsc.io/sampler v1.3.0/go.mod h1:T1hPZKmBbMNahiBKFy5HrXp6adAjACjK9JXDnKaTXpA=
diff --git a/examples/grpc-client/README.md b/examples/grpc-client/README.md
index 59629e0590..6a78df9199 100644
--- a/examples/grpc-client/README.md
+++ b/examples/grpc-client/README.md
@@ -50,6 +50,9 @@ Running the gRPC client will cause the following API calls to be made to the ser
 2. ListPasswords
 3. VerifyPassword
 4. DeletePassword
+5. CreateClient
+6. ListClients
+7. DeleteClient
 
 ## Cleaning up
 
diff --git a/examples/grpc-client/client.go b/examples/grpc-client/client.go
index fb8d4aaf06..7bbbac6494 100644
--- a/examples/grpc-client/client.go
+++ b/examples/grpc-client/client.go
@@ -58,7 +58,7 @@ func createPassword(cli api.DexClient) error {
 
 	// Create password.
 	if resp, err := cli.CreatePassword(context.TODO(), createReq); err != nil || resp.AlreadyExists {
-		if resp != nil &&  resp.AlreadyExists {
+		if resp != nil && resp.AlreadyExists {
 			return fmt.Errorf("Password %s already exists", createReq.Password.Email)
 		}
 		return fmt.Errorf("failed to create password: %v", err)
@@ -125,6 +125,57 @@ func createPassword(cli api.DexClient) error {
 	return nil
 }
 
+func createAndListClients(cli api.DexClient) error {
+	client := &api.Client{
+		Id:           "example-client",
+		Secret:       "example-secret",
+		RedirectUris: []string{"http://localhost:8080/callback"},
+		TrustedPeers: []string{},
+		Public:       false,
+		Name:         "Example Client",
+		LogoUrl:      "http://example.com/logo.png",
+	}
+
+	createReq := &api.CreateClientReq{
+		Client: client,
+	}
+
+	if resp, err := cli.CreateClient(context.TODO(), createReq); err != nil || resp.AlreadyExists {
+		if resp != nil && resp.AlreadyExists {
+			log.Printf("Client %s already exists", createReq.Client.Id)
+		} else {
+			return fmt.Errorf("failed to create client: %v", err)
+		}
+	} else {
+		log.Printf("Created client with ID %s", createReq.Client.Id)
+	}
+
+	listResp, err := cli.ListClients(context.TODO(), &api.ListClientReq{})
+	if err != nil {
+		return fmt.Errorf("failed to list clients: %v", err)
+	}
+
+	log.Print("Listing Clients:\n")
+	for _, client := range listResp.Clients {
+		log.Printf("ID: %s, Name: %s, Public: %t, RedirectURIs: %v",
+			client.Id, client.Name, client.Public, client.RedirectUris)
+	}
+
+	deleteReq := &api.DeleteClientReq{
+		Id: client.Id,
+	}
+
+	if resp, err := cli.DeleteClient(context.TODO(), deleteReq); err != nil || resp.NotFound {
+		if resp != nil && resp.NotFound {
+			return fmt.Errorf("Client %s not found", deleteReq.Id)
+		}
+		return fmt.Errorf("failed to delete client: %v", err)
+	}
+	log.Printf("Deleted client with ID %s", deleteReq.Id)
+
+	return nil
+}
+
 func main() {
 	caCrt := flag.String("ca-crt", "", "CA certificate")
 	clientCrt := flag.String("client-crt", "", "Client certificate")
@@ -143,4 +194,8 @@ func main() {
 	if err := createPassword(client); err != nil {
 		log.Fatalf("testPassword failed: %v", err)
 	}
+
+	if err := createAndListClients(client); err != nil {
+		log.Fatalf("testClients failed: %v", err)
+	}
 }
diff --git a/examples/k8s/dex.yaml b/examples/k8s/dex.yaml
index 89ac40b223..c20d268774 100644
--- a/examples/k8s/dex.yaml
+++ b/examples/k8s/dex.yaml
@@ -23,7 +23,7 @@ spec:
     spec:
       serviceAccountName: dex # This is created below
       containers:
-      - image: ghcr.io/dexidp/dex:v2.30.0
+      - image: ghcr.io/dexidp/dex:v2.32.0
         name: dex
         command: ["/usr/local/bin/dex", "serve", "/etc/dex/cfg/config.yaml"]
 
@@ -106,6 +106,12 @@ data:
       # bcrypt hash of the string "password": $(echo password | htpasswd -BinC 10 admin | cut -d: -f2)
       hash: "$2a$10$2b2cU8CPhOTaGrs1HRQuAueS7JTT5ZHsHSzYiFPm1leZck7Mc8T4W"
       username: "admin"
+      name: "Admin User"
+      emailVerified: true
+      preferredUsername: "admin"
+      groups:
+      - "team-a"
+      - "team-a/admins"
       userID: "08a8684b-db88-4b73-90a9-3cd1661f5466"
 ---
 apiVersion: v1
diff --git a/examples/ldap/config-ldap.yaml b/examples/ldap/config-ldap.yaml
index 05d1661826..49a7e25fff 100644
--- a/examples/ldap/config-ldap.yaml
+++ b/examples/ldap/config-ldap.yaml
@@ -59,6 +59,19 @@ connectors:
       # The group name should be the "cn" value.
       nameAttr: cn
 
+    # Optional Kerberos (SPNEGO) SSO. When enabled, Dex will challenge with
+    # WWW-Authenticate: Negotiate on GET and skip the password form on success.
+    #kerberos:
+    #  enabled: true
+    #  keytabPath: /etc/dex/krb5.keytab
+    #  expectedRealm: EXAMPLE.COM
+    #  usernameFromPrincipal: sAMAccountName # or userPrincipalName or localpart
+    #  fallbackToPassword: false
+    #  # Optional gokrb5 service settings — leave empty to use library defaults.
+    #  spn: HTTP/dex.example.com           # service principal name expected in tickets
+    #  keytabPrincipal: HTTP/dex.example.com@EXAMPLE.COM # explicit principal to load from the keytab
+    #  maxClockSkew: 300                   # tolerated clock skew, seconds (default 300)
+
 staticClients:
 - id: example-app
   redirectURIs:
diff --git a/examples/oidc-conformance/config.yaml.tmpl b/examples/oidc-conformance/config.yaml.tmpl
new file mode 100644
index 0000000000..1f89afc64b
--- /dev/null
+++ b/examples/oidc-conformance/config.yaml.tmpl
@@ -0,0 +1,36 @@
+# Dex configuration for OIDC Conformance Testing.
+# See https://dexidp.io/docs/development/oidc-certification/
+#
+# This template is processed by run.sh which replaces ISSUER_URL and ALIAS
+# with actual values before starting Dex.
+
+issuer: ISSUER_URL/dex
+
+storage:
+  type: sqlite3
+  config:
+    file: examples/oidc-conformance/dex.db
+
+web:
+  http: 0.0.0.0:5556
+
+enablePasswordDB: true
+
+staticPasswords:
+- email: "admin@example.com"
+  # bcrypt hash of the string "password"
+  hash: "$2a$10$2b2cU8CPhOTaGrs1HRQuAueS7JTT5ZHsHSzYiFPm1leZck7Mc8T4W"
+  username: "admin"
+
+staticClients:
+  - id: first_client
+    secret: 89d6205220381728e85c4cf5
+    redirectURIs:
+      - https://www.certification.openid.net/test/a/ALIAS/callback
+    name: First client
+
+  - id: second_client
+    secret: 51c612288018fd384b05d6ad
+    redirectURIs:
+      - https://www.certification.openid.net/test/a/ALIAS/callback
+    name: Second client
diff --git a/examples/oidc-conformance/run.sh b/examples/oidc-conformance/run.sh
new file mode 100755
index 0000000000..702928bd18
--- /dev/null
+++ b/examples/oidc-conformance/run.sh
@@ -0,0 +1,147 @@
+#!/usr/bin/env bash
+#
+# OIDC Conformance Test Runner
+#
+# Starts Dex with a test configuration and exposes it via a public tunnel
+# for use with https://www.certification.openid.net/
+#
+# Usage:
+#   ./run.sh                         # uses cloudflared (default)
+#   ./run.sh --tunnel ngrok          # uses ngrok
+#   ./run.sh --url https://my.url    # uses a pre-existing public URL (no tunnel)
+#   ./run.sh --alias my-dex          # custom alias for the test plan (default: dex)
+#
+# Prerequisites:
+#   - Dex binary in PATH or ../../bin/dex
+#   - ngrok or cloudflared installed (unless --url is provided)
+
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+ROOT_DIR="$(cd "$SCRIPT_DIR/../.." && pwd)"
+DEX_PORT=5556
+TUNNEL_TYPE="cloudflared"
+PUBLIC_URL=""
+ALIAS="dex"
+
+while [[ $# -gt 0 ]]; do
+    case $1 in
+        --tunnel)  TUNNEL_TYPE="$2"; shift 2 ;;
+        --url)     PUBLIC_URL="$2"; shift 2 ;;
+        --alias)   ALIAS="$2"; shift 2 ;;
+        -h|--help)
+            sed -n '2,/^$/p' "$0" | sed 's/^# \?//'
+            exit 0
+            ;;
+        *) echo "Unknown option: $1"; exit 1 ;;
+    esac
+done
+
+# Find dex binary.
+DEX_BIN=""
+for candidate in "dex" "$ROOT_DIR/bin/dex"; do
+    if command -v "$candidate" &>/dev/null || [[ -x "$candidate" ]]; then
+        DEX_BIN="$candidate"
+        break
+    fi
+done
+if [[ -z "$DEX_BIN" ]]; then
+    echo "Error: dex binary not found. Run 'make build' first or install dex."
+    exit 1
+fi
+
+cleanup() {
+    echo ""
+    echo "Shutting down..."
+    kill "${TUNNEL_PID:-}" "${DEX_PID:-}" 2>/dev/null || true
+    rm -f "${CONFIG_FILE:-}"
+    wait 2>/dev/null
+}
+trap cleanup EXIT
+
+# Start tunnel if no URL provided.
+TUNNEL_PID=""
+if [[ -z "$PUBLIC_URL" ]]; then
+    case "$TUNNEL_TYPE" in
+        ngrok)
+            if ! command -v ngrok &>/dev/null; then
+                echo "Error: ngrok not found. Install it from https://ngrok.com/ or use --url."
+                exit 1
+            fi
+            ngrok http "$DEX_PORT" --log=stdout --log-level=warn &>/dev/null &
+            TUNNEL_PID=$!
+            echo "Waiting for ngrok tunnel..."
+            sleep 3
+            PUBLIC_URL=$(curl -s http://localhost:4040/api/tunnels | grep -o '"public_url":"https://[^"]*' | head -1 | cut -d'"' -f4)
+            if [[ -z "$PUBLIC_URL" ]]; then
+                echo "Error: failed to get ngrok public URL. Is ngrok running?"
+                exit 1
+            fi
+            ;;
+        cloudflared)
+            if ! command -v cloudflared &>/dev/null; then
+                echo "Error: cloudflared not found. Install it from https://developers.cloudflare.com/cloudflare-one/connections/connect-networks/downloads/"
+                exit 1
+            fi
+            CLOUDFLARED_LOG=$(mktemp)
+            cloudflared tunnel --url "http://localhost:$DEX_PORT" --no-autoupdate 2>"$CLOUDFLARED_LOG" &
+            TUNNEL_PID=$!
+            echo "Waiting for cloudflared tunnel..."
+            for _ in $(seq 1 30); do
+                PUBLIC_URL=$(grep -o 'https://[^ ]*\.trycloudflare\.com' "$CLOUDFLARED_LOG" | head -1) && break
+                sleep 1
+            done
+            rm -f "$CLOUDFLARED_LOG"
+            if [[ -z "$PUBLIC_URL" ]]; then
+                echo "Error: failed to get cloudflared URL."
+                exit 1
+            fi
+            ;;
+        *)
+            echo "Error: unknown tunnel type '$TUNNEL_TYPE'. Use 'ngrok' or 'cloudflared'."
+            exit 1
+            ;;
+    esac
+fi
+
+PUBLIC_URL="${PUBLIC_URL%/}"
+echo "Public URL: $PUBLIC_URL"
+
+# Generate config from template.
+CONFIG_FILE=$(mktemp)
+sed -e "s|ISSUER_URL|$PUBLIC_URL|g" -e "s|ALIAS|$ALIAS|g" "$SCRIPT_DIR/config.yaml.tmpl" > "$CONFIG_FILE"
+
+echo "Starting Dex on port $DEX_PORT..."
+"$DEX_BIN" serve "$CONFIG_FILE" &
+DEX_PID=$!
+sleep 2
+
+DISCOVERY_URL="$PUBLIC_URL/dex/.well-known/openid-configuration"
+
+echo ""
+echo "============================================================"
+echo "  OIDC Conformance Test Setup Ready"
+echo "============================================================"
+echo ""
+echo "  Discovery URL: $DISCOVERY_URL"
+echo "  Alias:         $ALIAS"
+echo ""
+echo "  Client 1: id=first_client  secret=89d6205220381728e85c4cf5"
+echo "  Client 2: id=second_client secret=51c612288018fd384b05d6ad"
+echo ""
+echo "  Steps:"
+echo "  1. Open https://www.certification.openid.net/"
+echo "  2. Log in with Google or GitLab"
+echo "  3. Create a new test plan:"
+echo "     - Plan: OpenID Connect Core: Basic Certification Profile"
+echo "     - Server metadata: discovery"
+echo "     - Client registration: static_client"
+echo "     - Alias: $ALIAS"
+echo "     - Discovery URL: $DISCOVERY_URL"
+echo "     - Enter both client credentials above"
+echo "  4. Run tests and follow instructions"
+echo ""
+echo "  Press Ctrl+C to stop."
+echo "============================================================"
+
+wait "$DEX_PID"
diff --git a/flake.lock b/flake.lock
deleted file mode 100644
index b67b61d98b..0000000000
--- a/flake.lock
+++ /dev/null
@@ -1,42 +0,0 @@
-{
-  "nodes": {
-    "flake-utils": {
-      "locked": {
-        "lastModified": 1659877975,
-        "narHash": "sha256-zllb8aq3YO3h8B/U0/J1WBgAL8EX5yWf5pMj3G0NAmc=",
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "rev": "c0e246b9b83f637f4681389ecabcb2681b4f3af0",
-        "type": "github"
-      },
-      "original": {
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "type": "github"
-      }
-    },
-    "nixpkgs": {
-      "locked": {
-        "lastModified": 1662019588,
-        "narHash": "sha256-oPEjHKGGVbBXqwwL+UjsveJzghWiWV0n9ogo1X6l4cw=",
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "2da64a81275b68fdad38af669afeda43d401e94b",
-        "type": "github"
-      },
-      "original": {
-        "id": "nixpkgs",
-        "ref": "nixos-unstable",
-        "type": "indirect"
-      }
-    },
-    "root": {
-      "inputs": {
-        "flake-utils": "flake-utils",
-        "nixpkgs": "nixpkgs"
-      }
-    }
-  },
-  "root": "root",
-  "version": 7
-}
diff --git a/flake.nix b/flake.nix
deleted file mode 100644
index 155ebf99e3..0000000000
--- a/flake.nix
+++ /dev/null
@@ -1,27 +0,0 @@
-{
-  description = "OpenID Connect (OIDC) identity and OAuth 2.0 provider with pluggable connectors";
-
-  inputs = {
-    nixpkgs.url = "nixpkgs/nixos-unstable";
-    flake-utils.url = "github:numtide/flake-utils";
-  };
-
-  outputs = { self, nixpkgs, flake-utils, ... }:
-    flake-utils.lib.eachDefaultSystem (
-      system:
-        let
-          pkgs = nixpkgs.legacyPackages.${system};
-          buildDeps = with pkgs; [ git go_1_19 gnumake ];
-          devDeps = with pkgs;
-            buildDeps ++ [
-              golangci-lint
-              gotestsum
-              protobuf
-              protoc-gen-go
-              protoc-gen-go-grpc
-              kind
-            ];
-        in
-          { devShell = pkgs.mkShell { buildInputs = devDeps; }; }
-    );
-}
diff --git a/go.mod b/go.mod
index d15823aa1b..d791224c2e 100644
--- a/go.mod
+++ b/go.mod
@@ -1,95 +1,158 @@
 module github.com/dexidp/dex
 
-go 1.19
+go 1.25.8
 
 require (
-	entgo.io/ent v0.11.2
-	github.com/AppsFlyer/go-sundheit v0.5.0
+	cloud.google.com/go/compute/metadata v0.9.0
+	entgo.io/ent v0.14.6
+	github.com/AppsFlyer/go-sundheit v0.6.0
 	github.com/Masterminds/semver v1.5.0
-	github.com/Masterminds/sprig/v3 v3.2.2
-	github.com/beevik/etree v1.1.0
-	github.com/coreos/go-oidc/v3 v3.3.0
-	github.com/dexidp/dex/api/v2 v2.1.0
-	github.com/felixge/httpsnoop v1.0.3
+	github.com/Masterminds/sprig/v3 v3.3.0
+	github.com/beevik/etree v1.7.0
+	github.com/coreos/go-oidc/v3 v3.19.0
+	github.com/dexidp/dex/api/v2 v2.4.0
+	github.com/fsnotify/fsnotify v1.10.1
 	github.com/ghodss/yaml v1.0.0
-	github.com/go-ldap/ldap/v3 v3.4.4
-	github.com/go-sql-driver/mysql v1.6.0
-	github.com/gorilla/handlers v1.5.1
-	github.com/gorilla/mux v1.8.0
+	github.com/go-jose/go-jose/v4 v4.1.4
+	github.com/go-ldap/ldap/v3 v3.4.14
+	github.com/go-sql-driver/mysql v1.10.0
+	github.com/go-webauthn/webauthn v0.17.4
+	github.com/google/cel-go v0.30.0
+	github.com/google/uuid v1.6.0
+	github.com/gorilla/handlers v1.5.2
+	github.com/gorilla/mux v1.8.1
 	github.com/grpc-ecosystem/go-grpc-prometheus v1.2.0
+	github.com/jcmturner/goidentity/v6 v6.0.1
+	github.com/jcmturner/gokrb5/v8 v8.4.4
 	github.com/kylelemons/godebug v1.1.0
-	github.com/lib/pq v1.10.5
+	github.com/lib/pq v1.12.3
 	github.com/mattermost/xml-roundtrip-validator v0.1.0
-	github.com/mattn/go-sqlite3 v1.14.15
-	github.com/oklog/run v1.1.0
+	github.com/mattn/go-sqlite3 v1.14.48
+	github.com/oklog/run v1.2.0
+	github.com/openbao/openbao/api/v2 v2.6.0
 	github.com/pkg/errors v0.9.1
-	github.com/prometheus/client_golang v1.13.0
-	github.com/russellhaering/goxmldsig v1.2.0
-	github.com/sirupsen/logrus v1.9.0
-	github.com/spf13/cobra v1.5.0
-	github.com/stretchr/testify v1.8.0
-	go.etcd.io/etcd/client/pkg/v3 v3.5.4
-	go.etcd.io/etcd/client/v3 v3.5.4
-	golang.org/x/crypto v0.0.0-20220622213112-05595931fe9d
-	golang.org/x/net v0.0.0-20220826154423-83b083e8dc8b
-	golang.org/x/oauth2 v0.0.0-20220822191816-0ebed06d0094
-	google.golang.org/api v0.94.0
-	google.golang.org/grpc v1.49.0
-	google.golang.org/protobuf v1.28.1
-	gopkg.in/square/go-jose.v2 v2.6.0
+	github.com/pquerna/otp v1.5.0
+	github.com/prometheus/client_golang v1.24.1
+	github.com/russellhaering/goxmldsig v1.6.0
+	github.com/spf13/cobra v1.10.2
+	github.com/stretchr/testify v1.11.1
+	go.etcd.io/etcd/client/pkg/v3 v3.6.13
+	go.etcd.io/etcd/client/v3 v3.6.13
+	golang.org/x/crypto v0.54.0
+	golang.org/x/exp v0.0.0-20240823005443-9b4947da3948
+	golang.org/x/net v0.57.0
+	golang.org/x/oauth2 v0.36.0
+	google.golang.org/api v0.291.0
+	google.golang.org/grpc v1.82.1
+	google.golang.org/protobuf v1.36.11
 )
 
 require (
-	ariga.io/atlas v0.5.1-0.20220717122844-8593d7eb1a8e // indirect
-	cloud.google.com/go/compute v1.7.0 // indirect
-	github.com/Azure/go-ntlmssp v0.0.0-20220621081337-cb9428e4ac1e // indirect
+	ariga.io/atlas v0.36.2-0.20250730182955-2c6300d0a3e1 // indirect
+	cel.dev/expr v0.25.1 // indirect
+	cloud.google.com/go/auth v0.22.0 // indirect
+	cloud.google.com/go/auth/oauth2adapt v0.2.8 // indirect
+	dario.cat/mergo v1.0.1 // indirect
+	filippo.io/edwards25519 v1.2.0 // indirect
+	github.com/Azure/go-ntlmssp v0.1.1 // indirect
 	github.com/Masterminds/goutils v1.1.1 // indirect
-	github.com/Masterminds/semver/v3 v3.1.1 // indirect
-	github.com/agext/levenshtein v1.2.1 // indirect
-	github.com/apparentlymart/go-textseg/v13 v13.0.0 // indirect
+	github.com/Masterminds/semver/v3 v3.3.0 // indirect
+	github.com/agext/levenshtein v1.2.3 // indirect
+	github.com/antlr4-go/antlr/v4 v4.13.1 // indirect
+	github.com/apparentlymart/go-textseg/v15 v15.0.0 // indirect
 	github.com/beorn7/perks v1.0.1 // indirect
-	github.com/cespare/xxhash/v2 v2.1.2 // indirect
-	github.com/coreos/go-semver v0.3.0 // indirect
-	github.com/coreos/go-systemd/v22 v22.3.2 // indirect
-	github.com/davecgh/go-spew v1.1.1 // indirect
-	github.com/go-asn1-ber/asn1-ber v1.5.4 // indirect
+	github.com/bmatcuk/doublestar v1.3.4 // indirect
+	github.com/boombuler/barcode v1.0.1-0.20190219062509-6c824513bacc // indirect
+	github.com/cenkalti/backoff/v5 v5.0.3 // indirect
+	github.com/cespare/xxhash/v2 v2.3.0 // indirect
+	github.com/clipperhouse/displaywidth v0.6.2 // indirect
+	github.com/clipperhouse/stringish v0.1.1 // indirect
+	github.com/clipperhouse/uax29/v2 v2.3.0 // indirect
+	github.com/coreos/go-semver v0.3.1 // indirect
+	github.com/coreos/go-systemd/v22 v22.5.0 // indirect
+	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
+	github.com/fatih/color v1.19.0 // indirect
+	github.com/felixge/httpsnoop v1.0.4 // indirect
+	github.com/fxamacker/cbor/v2 v2.9.2 // indirect
+	github.com/go-asn1-ber/asn1-ber v1.5.8 // indirect
+	github.com/go-logr/logr v1.4.3 // indirect
+	github.com/go-logr/stdr v1.2.2 // indirect
 	github.com/go-openapi/inflect v0.19.0 // indirect
+	github.com/go-viper/mapstructure/v2 v2.5.0 // indirect
+	github.com/go-webauthn/x v0.2.6 // indirect
 	github.com/gogo/protobuf v1.3.2 // indirect
-	github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
-	github.com/golang/protobuf v1.5.2 // indirect
-	github.com/google/go-cmp v0.5.8 // indirect
-	github.com/google/uuid v1.3.0 // indirect
-	github.com/googleapis/enterprise-certificate-proxy v0.1.0 // indirect
-	github.com/googleapis/gax-go/v2 v2.4.0 // indirect
-	github.com/hashicorp/hcl/v2 v2.10.0 // indirect
-	github.com/huandu/xstrings v1.3.1 // indirect
-	github.com/imdario/mergo v0.3.11 // indirect
-	github.com/inconshreveable/mousetrap v1.0.0 // indirect
-	github.com/jonboulle/clockwork v0.2.2 // indirect
-	github.com/matttproud/golang_protobuf_extensions v1.0.1 // indirect
-	github.com/mitchellh/copystructure v1.0.0 // indirect
-	github.com/mitchellh/go-wordwrap v0.0.0-20150314170334-ad45545899c7 // indirect
-	github.com/mitchellh/reflectwalk v1.0.0 // indirect
-	github.com/pmezard/go-difflib v1.0.0 // indirect
-	github.com/prometheus/client_model v0.2.0 // indirect
-	github.com/prometheus/common v0.37.0 // indirect
-	github.com/prometheus/procfs v0.8.0 // indirect
-	github.com/shopspring/decimal v1.2.0 // indirect
-	github.com/spf13/cast v1.4.1 // indirect
-	github.com/spf13/pflag v1.0.5 // indirect
-	github.com/zclconf/go-cty v1.8.0 // indirect
-	go.etcd.io/etcd/api/v3 v3.5.4 // indirect
-	go.opencensus.io v0.23.0 // indirect
-	go.uber.org/atomic v1.7.0 // indirect
-	go.uber.org/multierr v1.6.0 // indirect
-	go.uber.org/zap v1.17.0 // indirect
-	golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4 // indirect
-	golang.org/x/sys v0.0.0-20220728004956-3c1f35247d10 // indirect
-	golang.org/x/text v0.3.7 // indirect
-	google.golang.org/appengine v1.6.7 // indirect
-	google.golang.org/genproto v0.0.0-20220624142145-8cd45d7dbd1f // indirect
+	github.com/golang-jwt/jwt/v5 v5.3.1 // indirect
+	github.com/golang/protobuf v1.5.4 // indirect
+	github.com/google/go-cmp v0.7.0 // indirect
+	github.com/google/go-tpm v0.9.8 // indirect
+	github.com/google/s2a-go v0.1.9 // indirect
+	github.com/googleapis/enterprise-certificate-proxy v0.3.19 // indirect
+	github.com/googleapis/gax-go/v2 v2.23.0 // indirect
+	github.com/grpc-ecosystem/grpc-gateway/v2 v2.26.3 // indirect
+	github.com/hashicorp/errwrap v1.1.0 // indirect
+	github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
+	github.com/hashicorp/go-multierror v1.1.1 // indirect
+	github.com/hashicorp/go-retryablehttp v0.7.8 // indirect
+	github.com/hashicorp/go-secure-stdlib/parseutil v0.2.0 // indirect
+	github.com/hashicorp/go-secure-stdlib/strutil v0.1.2 // indirect
+	github.com/hashicorp/go-sockaddr v1.0.7 // indirect
+	github.com/hashicorp/go-uuid v1.0.3 // indirect
+	github.com/hashicorp/hcl v1.0.1-vault-7 // indirect
+	github.com/hashicorp/hcl/v2 v2.18.1 // indirect
+	github.com/huandu/xstrings v1.5.0 // indirect
+	github.com/inconshreveable/mousetrap v1.1.0 // indirect
+	github.com/jcmturner/aescts/v2 v2.0.0 // indirect
+	github.com/jcmturner/dnsutils/v2 v2.0.0 // indirect
+	github.com/jcmturner/gofork v1.7.6 // indirect
+	github.com/jcmturner/rpc/v2 v2.0.3 // indirect
+	github.com/jonboulle/clockwork v0.5.0 // indirect
+	github.com/mattn/go-colorable v0.1.15 // indirect
+	github.com/mattn/go-isatty v0.0.22 // indirect
+	github.com/mattn/go-runewidth v0.0.19 // indirect
+	github.com/mitchellh/copystructure v1.2.0 // indirect
+	github.com/mitchellh/go-wordwrap v1.0.1 // indirect
+	github.com/mitchellh/mapstructure v1.5.0 // indirect
+	github.com/mitchellh/reflectwalk v1.0.2 // indirect
+	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
+	github.com/olekukonko/cat v0.0.0-20250911104152-50322a0618f6 // indirect
+	github.com/olekukonko/errors v1.1.0 // indirect
+	github.com/olekukonko/ll v0.1.4-0.20260115111900-9e59c2286df0 // indirect
+	github.com/olekukonko/tablewriter v1.1.3 // indirect
+	github.com/philhofer/fwd v1.2.0 // indirect
+	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
+	github.com/prometheus/client_model v0.6.2 // indirect
+	github.com/prometheus/common v0.70.1 // indirect
+	github.com/prometheus/procfs v0.21.1 // indirect
+	github.com/ryanuber/go-glob v1.0.0 // indirect
+	github.com/shopspring/decimal v1.4.0 // indirect
+	github.com/spf13/cast v1.7.0 // indirect
+	github.com/spf13/pflag v1.0.9 // indirect
+	github.com/tinylib/msgp v1.6.4 // indirect
+	github.com/x448/float16 v0.8.4 // indirect
+	github.com/zclconf/go-cty v1.14.4 // indirect
+	github.com/zclconf/go-cty-yaml v1.1.0 // indirect
+	go.etcd.io/etcd/api/v3 v3.6.13 // indirect
+	go.opentelemetry.io/auto/sdk v1.2.1 // indirect
+	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.67.0 // indirect
+	go.opentelemetry.io/otel v1.44.0 // indirect
+	go.opentelemetry.io/otel/metric v1.44.0 // indirect
+	go.opentelemetry.io/otel/trace v1.44.0 // indirect
+	go.uber.org/multierr v1.11.0 // indirect
+	go.uber.org/zap v1.27.0 // indirect
+	go.yaml.in/yaml/v3 v3.0.4 // indirect
+	golang.org/x/mod v0.37.0 // indirect
+	golang.org/x/sync v0.22.0 // indirect
+	golang.org/x/sys v0.47.0 // indirect
+	golang.org/x/text v0.40.0 // indirect
+	golang.org/x/time v0.15.0 // indirect
+	golang.org/x/tools v0.47.0 // indirect
+	golang.org/x/tools/go/packages/packagestest v0.1.1-deprecated // indirect
+	google.golang.org/genproto/googleapis/api v0.0.0-20260630182238-925bb5da69e7 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20260724162435-b2f20204f0df // indirect
 	gopkg.in/yaml.v2 v2.4.0 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 )
 
 replace github.com/dexidp/dex/api/v2 => ./api/v2
+
+tool entgo.io/ent/cmd/ent
diff --git a/go.sum b/go.sum
index 27fdbb8eea..ea24ba1d10 100644
--- a/go.sum
+++ b/go.sum
@@ -1,923 +1,415 @@
-ariga.io/atlas v0.5.1-0.20220717122844-8593d7eb1a8e h1:/r1xGMwmLg4LZ2V3/wWui9TtM3+STh1fp5ExSVRNFZo=
-ariga.io/atlas v0.5.1-0.20220717122844-8593d7eb1a8e/go.mod h1:ofVetkJqlaWle3mvYmaS2uyFGFcc7dSq436tmxa/Mzk=
-cloud.google.com/go v0.26.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
-cloud.google.com/go v0.34.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
-cloud.google.com/go v0.38.0/go.mod h1:990N+gfupTy94rShfmMCWGDn0LpTmnzTp2qbd1dvSRU=
-cloud.google.com/go v0.44.1/go.mod h1:iSa0KzasP4Uvy3f1mN/7PiObzGgflwredwwASm/v6AU=
-cloud.google.com/go v0.44.2/go.mod h1:60680Gw3Yr4ikxnPRS/oxxkBccT6SA1yMk63TGekxKY=
-cloud.google.com/go v0.45.1/go.mod h1:RpBamKRgapWJb87xiFSdk4g1CME7QZg3uwTez+TSTjc=
-cloud.google.com/go v0.46.3/go.mod h1:a6bKKbmY7er1mI7TEI4lsAkts/mkhTSZK8w33B4RAg0=
-cloud.google.com/go v0.50.0/go.mod h1:r9sluTvynVuxRIOHXQEHMFffphuXHOMZMycpNR5e6To=
-cloud.google.com/go v0.52.0/go.mod h1:pXajvRH/6o3+F9jDHZWQ5PbGhn+o8w9qiu/CffaVdO4=
-cloud.google.com/go v0.53.0/go.mod h1:fp/UouUEsRkN6ryDKNW/Upv/JBKnv6WDthjR6+vze6M=
-cloud.google.com/go v0.54.0/go.mod h1:1rq2OEkV3YMf6n/9ZvGWI3GWw0VoqH/1x2nd8Is/bPc=
-cloud.google.com/go v0.56.0/go.mod h1:jr7tqZxxKOVYizybht9+26Z/gUq7tiRzu+ACVAMbKVk=
-cloud.google.com/go v0.57.0/go.mod h1:oXiQ6Rzq3RAkkY7N6t3TcE6jE+CIBBbA36lwQ1JyzZs=
-cloud.google.com/go v0.62.0/go.mod h1:jmCYTdRCQuc1PHIIJ/maLInMho30T/Y0M4hTdTShOYc=
-cloud.google.com/go v0.65.0/go.mod h1:O5N8zS7uWy9vkA9vayVHs65eM1ubvY4h553ofrNHObY=
-cloud.google.com/go v0.72.0/go.mod h1:M+5Vjvlc2wnp6tjzE102Dw08nGShTscUx2nZMufOKPI=
-cloud.google.com/go v0.74.0/go.mod h1:VV1xSbzvo+9QJOxLDaJfTjx5e+MePCpCWwvftOeQmWk=
-cloud.google.com/go v0.78.0/go.mod h1:QjdrLG0uq+YwhjoVOLsS1t7TW8fs36kLs4XO5R5ECHg=
-cloud.google.com/go v0.79.0/go.mod h1:3bzgcEeQlzbuEAYu4mrWhKqWjmpprinYgKJLgKHnbb8=
-cloud.google.com/go v0.81.0/go.mod h1:mk/AM35KwGk/Nm2YSeZbxXdrNK3KZOYHmLkOqC2V6E0=
-cloud.google.com/go v0.83.0/go.mod h1:Z7MJUsANfY0pYPdw0lbnivPx4/vhy/e2FEkSkF7vAVY=
-cloud.google.com/go v0.84.0/go.mod h1:RazrYuxIK6Kb7YrzzhPoLmCVzl7Sup4NrbKPg8KHSUM=
-cloud.google.com/go v0.87.0/go.mod h1:TpDYlFy7vuLzZMMZ+B6iRiELaY7z/gJPaqbMx6mlWcY=
-cloud.google.com/go v0.90.0/go.mod h1:kRX0mNRHe0e2rC6oNakvwQqzyDmg57xJ+SZU1eT2aDQ=
-cloud.google.com/go v0.93.3/go.mod h1:8utlLll2EF5XMAV15woO4lSbWQlk8rer9aLOfLh7+YI=
-cloud.google.com/go v0.94.1/go.mod h1:qAlAugsXlC+JWO+Bke5vCtc9ONxjQT3drlTTnAplMW4=
-cloud.google.com/go v0.97.0/go.mod h1:GF7l59pYBVlXQIBLx3a761cZ41F9bBH3JUlihCt2Udc=
-cloud.google.com/go v0.99.0/go.mod h1:w0Xx2nLzqWJPuozYQX+hFfCSI8WioryfRDzkoI/Y2ZA=
-cloud.google.com/go v0.100.2/go.mod h1:4Xra9TjzAeYHrl5+oeLlzbM2k3mjVhZh4UqTZ//w99A=
-cloud.google.com/go v0.102.0/go.mod h1:oWcCzKlqJ5zgHQt9YsaeTY9KzIvjyy0ArmiBUgpQ+nc=
-cloud.google.com/go/bigquery v1.0.1/go.mod h1:i/xbL2UlR5RvWAURpBYZTtm/cXjCha9lbfbpx4poX+o=
-cloud.google.com/go/bigquery v1.3.0/go.mod h1:PjpwJnslEMmckchkHFfq+HTD2DmtT67aNFKH1/VBDHE=
-cloud.google.com/go/bigquery v1.4.0/go.mod h1:S8dzgnTigyfTmLBfrtrhyYhwRxG72rYxvftPBK2Dvzc=
-cloud.google.com/go/bigquery v1.5.0/go.mod h1:snEHRnqQbz117VIFhE8bmtwIDY80NLUZUMb4Nv6dBIg=
-cloud.google.com/go/bigquery v1.7.0/go.mod h1://okPTzCYNXSlb24MZs83e2Do+h+VXtc4gLoIoXIAPc=
-cloud.google.com/go/bigquery v1.8.0/go.mod h1:J5hqkt3O0uAFnINi6JXValWIb1v0goeZM77hZzJN/fQ=
-cloud.google.com/go/compute v0.1.0/go.mod h1:GAesmwr110a34z04OlxYkATPBEfVhkymfTBXtfbBFow=
-cloud.google.com/go/compute v1.3.0/go.mod h1:cCZiE1NHEtai4wiufUhW8I8S1JKkAnhnQJWM7YD99wM=
-cloud.google.com/go/compute v1.5.0/go.mod h1:9SMHyhJlzhlkJqrPAc839t2BZFTSk6Jdj6mkzQJeu0M=
-cloud.google.com/go/compute v1.6.0/go.mod h1:T29tfhtVbq1wvAPo0E3+7vhgmkOYeXjhFvz/FMzPu0s=
-cloud.google.com/go/compute v1.6.1/go.mod h1:g85FgpzFvNULZ+S8AYq87axRKuf2Kh7deLqV/jJ3thU=
-cloud.google.com/go/compute v1.7.0 h1:v/k9Eueb8aAJ0vZuxKMrgm6kPhCLZU9HxFU+AFDs9Uk=
-cloud.google.com/go/compute v1.7.0/go.mod h1:435lt8av5oL9P3fv1OEzSbSUe+ybHXGMPQHHZWZxy9U=
-cloud.google.com/go/datastore v1.0.0/go.mod h1:LXYbyblFSglQ5pkeyhO+Qmw7ukd3C+pD7TKLgZqpHYE=
-cloud.google.com/go/datastore v1.1.0/go.mod h1:umbIZjpQpHh4hmRpGhH4tLFup+FVzqBi1b3c64qFpCk=
-cloud.google.com/go/iam v0.3.0/go.mod h1:XzJPvDayI+9zsASAFO68Hk07u3z+f+JrT2xXNdp4bnY=
-cloud.google.com/go/pubsub v1.0.1/go.mod h1:R0Gpsv3s54REJCy4fxDixWD93lHJMoZTyQ2kNxGRt3I=
-cloud.google.com/go/pubsub v1.1.0/go.mod h1:EwwdRX2sKPjnvnqCa270oGRyludottCI76h+R3AArQw=
-cloud.google.com/go/pubsub v1.2.0/go.mod h1:jhfEVHT8odbXTkndysNHCcx0awwzvfOlguIAii9o8iA=
-cloud.google.com/go/pubsub v1.3.1/go.mod h1:i+ucay31+CNRpDW4Lu78I4xXG+O1r/MAHgjpRVR+TSU=
-cloud.google.com/go/storage v1.0.0/go.mod h1:IhtSnM/ZTZV8YYJWCY8RULGVqBDmpoyjwiyrjsg+URw=
-cloud.google.com/go/storage v1.5.0/go.mod h1:tpKbwo567HUNpVclU5sGELwQWBDZ8gh0ZeosJ0Rtdos=
-cloud.google.com/go/storage v1.6.0/go.mod h1:N7U0C8pVQ/+NIKOBQyamJIeKQKkZ+mxpohlUTyfDhBk=
-cloud.google.com/go/storage v1.8.0/go.mod h1:Wv1Oy7z6Yz3DshWRJFhqM/UCfaWIRTdp0RXyy7KQOVs=
-cloud.google.com/go/storage v1.10.0/go.mod h1:FLPqc6j+Ki4BU591ie1oL6qBQGu2Bl/tZ9ullr3+Kg0=
-cloud.google.com/go/storage v1.22.1/go.mod h1:S8N1cAStu7BOeFfE8KAQzmyyLkK8p/vmRq6kuBTW58Y=
-dmitri.shuralyov.com/gpu/mtl v0.0.0-20190408044501-666a987793e9/go.mod h1:H6x//7gZCb22OMCxBHrMx7a5I7Hp++hsVxbQ4BYO7hU=
-entgo.io/ent v0.11.2 h1:UM2/BUhF2FfsxPHRxLjQbhqJNaDdVlOwNIAMLs2jyto=
-entgo.io/ent v0.11.2/go.mod h1:YGHEQnmmIUgtD5b1ICD5vg74dS3npkNnmC5K+0J+IHU=
-github.com/AppsFlyer/go-sundheit v0.5.0 h1:/VxpyigCfJrq1r97mn9HPiAB2qrhcTFHwNIIDr15CZM=
-github.com/AppsFlyer/go-sundheit v0.5.0/go.mod h1:2ZM0BnfqT/mljBQO224VbL5XH06TgWuQ6Cn+cTtCpTY=
-github.com/Azure/go-ntlmssp v0.0.0-20220621081337-cb9428e4ac1e h1:NeAW1fUYUEWhft7pkxDf6WoUvEZJ/uOKsvtpjLnn8MU=
-github.com/Azure/go-ntlmssp v0.0.0-20220621081337-cb9428e4ac1e/go.mod h1:chxPXzSsl7ZWRAuOIE23GDNzjWuZquvFlgA8xmpunjU=
-github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
-github.com/BurntSushi/xgb v0.0.0-20160522181843-27f122750802/go.mod h1:IVnqGOEym/WlBOVXweHU+Q+/VP0lqqI8lqeDx9IjBqo=
+ariga.io/atlas v0.36.2-0.20250730182955-2c6300d0a3e1 h1:NPPfBaVZgz4LKBCIc0FbMogCjvXN+yGf7CZwotOwJo8=
+ariga.io/atlas v0.36.2-0.20250730182955-2c6300d0a3e1/go.mod h1:Ex5l1xHsnWQUc3wYnrJ9gD7RUEzG76P7ZRQp8wNr0wc=
+cel.dev/expr v0.25.1 h1:1KrZg61W6TWSxuNZ37Xy49ps13NUovb66QLprthtwi4=
+cel.dev/expr v0.25.1/go.mod h1:hrXvqGP6G6gyx8UAHSHJ5RGk//1Oj5nXQ2NI02Nrsg4=
+cloud.google.com/go/auth v0.22.0 h1:Xp9wAKkLoeaYb5pYZZoQGz4E9sdPxIbzS3gywZE3ciQ=
+cloud.google.com/go/auth v0.22.0/go.mod h1:M9o2Oz+YI2jAfxewJgb1vyI3vceHF+eohmxyzmrl+9s=
+cloud.google.com/go/auth/oauth2adapt v0.2.8 h1:keo8NaayQZ6wimpNSmW5OPc283g65QNIiLpZnkHRbnc=
+cloud.google.com/go/auth/oauth2adapt v0.2.8/go.mod h1:XQ9y31RkqZCcwJWNSx2Xvric3RrU88hAYYbjDWYDL+c=
+cloud.google.com/go/compute/metadata v0.9.0 h1:pDUj4QMoPejqq20dK0Pg2N4yG9zIkYGdBtwLoEkH9Zs=
+cloud.google.com/go/compute/metadata v0.9.0/go.mod h1:E0bWwX5wTnLPedCKqk3pJmVgCBSM6qQI1yTBdEb3C10=
+dario.cat/mergo v1.0.1 h1:Ra4+bf83h2ztPIQYNP99R6m+Y7KfnARDfID+a+vLl4s=
+dario.cat/mergo v1.0.1/go.mod h1:uNxQE+84aUszobStD9th8a29P2fMDhsBdgRYvZOxGmk=
+entgo.io/ent v0.14.6 h1:/f2696BpwuWAEEG6PVGWflg6+Inrpq4pRWuNlWz/Skk=
+entgo.io/ent v0.14.6/go.mod h1:z46QBUdGC+BATwsedbDuREfSS0oSCV+csdEYlL4p73s=
+filippo.io/edwards25519 v1.2.0 h1:crnVqOiS4jqYleHd9vaKZ+HKtHfllngJIiOpNpoJsjo=
+filippo.io/edwards25519 v1.2.0/go.mod h1:xzAOLCNug/yB62zG1bQ8uziwrIqIuxhctzJT18Q77mc=
+github.com/AppsFlyer/go-sundheit v0.6.0 h1:d2hBvCjBSb2lUsEWGfPigr4MCOt04sxB+Rppl0yUMSk=
+github.com/AppsFlyer/go-sundheit v0.6.0/go.mod h1:LDdBHD6tQBtmHsdW+i1GwdTt6Wqc0qazf5ZEJVTbTME=
+github.com/Azure/go-ntlmssp v0.1.1 h1:l+FM/EEMb0U9QZE7mKNEDw5Mu3mFiaa2GKOoTSsNDPw=
+github.com/Azure/go-ntlmssp v0.1.1/go.mod h1:NYqdhxd/8aAct/s4qSYZEerdPuH1liG2/X9DiVTbhpk=
 github.com/DATA-DOG/go-sqlmock v1.5.0 h1:Shsta01QNfFxHCfpW6YH2STWB0MudeXXEWMr20OEh60=
+github.com/DATA-DOG/go-sqlmock v1.5.0/go.mod h1:f/Ixk793poVmq4qj/V1dPUg2JEAKC73Q5eFN3EC/SaM=
 github.com/Masterminds/goutils v1.1.1 h1:5nUrii3FMTL5diU80unEVvNevw1nH4+ZV4DSLVJLSYI=
 github.com/Masterminds/goutils v1.1.1/go.mod h1:8cTjp+g8YejhMuvIA5y2vz3BpJxksy863GQaJW2MFNU=
 github.com/Masterminds/semver v1.5.0 h1:H65muMkzWKEuNDnfl9d70GUjFniHKHRbFPGBuZ3QEww=
 github.com/Masterminds/semver v1.5.0/go.mod h1:MB6lktGJrhw8PrUyiEoblNEGEQ+RzHPF078ddwwvV3Y=
-github.com/Masterminds/semver/v3 v3.1.1 h1:hLg3sBzpNErnxhQtUy/mmLR2I9foDujNK030IGemrRc=
-github.com/Masterminds/semver/v3 v3.1.1/go.mod h1:VPu/7SZ7ePZ3QOrcuXROw5FAcLl4a0cBrbBpGY/8hQs=
-github.com/Masterminds/sprig/v3 v3.2.2 h1:17jRggJu518dr3QaafizSXOjKYp94wKfABxUmyxvxX8=
-github.com/Masterminds/sprig/v3 v3.2.2/go.mod h1:UoaO7Yp8KlPnJIYWTFkMaqPUYKTfGFPhxNuwnnxkKlk=
-github.com/OneOfOne/xxhash v1.2.2/go.mod h1:HSdplMjZKSmBqAxg5vPj2TmRDmfkzw+cTzAElWljhcU=
-github.com/agext/levenshtein v1.2.1 h1:QmvMAjj2aEICytGiWzmxoE0x2KZvE0fvmqMOfy2tjT8=
-github.com/agext/levenshtein v1.2.1/go.mod h1:JEDfjyjHDjOF/1e4FlBE/PkbqA9OfWu2ki2W0IB5558=
-github.com/alecthomas/template v0.0.0-20160405071501-a0175ee3bccc/go.mod h1:LOuyumcjzFXgccqObfd/Ljyb9UuFJ6TxHnclSeseNhc=
-github.com/alecthomas/template v0.0.0-20190718012654-fb15b899a751/go.mod h1:LOuyumcjzFXgccqObfd/Ljyb9UuFJ6TxHnclSeseNhc=
-github.com/alecthomas/units v0.0.0-20151022065526-2efee857e7cf/go.mod h1:ybxpYRFXyAe+OPACYpWeL0wqObRcbAqCMya13uyzqw0=
-github.com/alecthomas/units v0.0.0-20190717042225-c3de453c63f4/go.mod h1:ybxpYRFXyAe+OPACYpWeL0wqObRcbAqCMya13uyzqw0=
-github.com/alecthomas/units v0.0.0-20190924025748-f65c72e2690d/go.mod h1:rBZYJk541a8SKzHPHnH3zbiI+7dagKZ0cgpgrD7Fyho=
-github.com/antihax/optional v1.0.0/go.mod h1:uupD/76wgC+ih3iEmQUL+0Ugr19nfwCT1kdvxnR2qWY=
-github.com/apparentlymart/go-dump v0.0.0-20180507223929-23540a00eaa3/go.mod h1:oL81AME2rN47vu18xqj1S1jPIPuN7afo62yKTNn3XMM=
-github.com/apparentlymart/go-textseg v1.0.0/go.mod h1:z96Txxhf3xSFMPmb5X/1W05FF/Nj9VFpLOpjS5yuumk=
-github.com/apparentlymart/go-textseg/v13 v13.0.0 h1:Y+KvPE1NYz0xl601PVImeQfFyEy6iT90AvPUL1NNfNw=
-github.com/apparentlymart/go-textseg/v13 v13.0.0/go.mod h1:ZK2fH7c4NqDTLtiYLvIkEghdlcqw7yxLeM89kiTRPUo=
-github.com/beevik/etree v1.1.0 h1:T0xke/WvNtMoCqgzPhkX2r4rjY3GDZFi+FjpRZY2Jbs=
-github.com/beevik/etree v1.1.0/go.mod h1:r8Aw8JqVegEf0w2fDnATrX9VpkMcyFeM0FhwO62wh+A=
-github.com/beorn7/perks v0.0.0-20180321164747-3a771d992973/go.mod h1:Dwedo/Wpr24TaqPxmxbtue+5NUziq4I4S80YR8gNf3Q=
-github.com/beorn7/perks v1.0.0/go.mod h1:KWe93zE9D1o94FZ5RNwFwVgaQK1VOXiVxmqh+CedLV8=
+github.com/Masterminds/semver/v3 v3.3.0 h1:B8LGeaivUe71a5qox1ICM/JLl0NqZSW5CHyL+hmvYS0=
+github.com/Masterminds/semver/v3 v3.3.0/go.mod h1:4V+yj/TJE1HU9XfppCwVMZq3I84lprf4nC11bSS5beM=
+github.com/Masterminds/sprig/v3 v3.3.0 h1:mQh0Yrg1XPo6vjYXgtf5OtijNAKJRNcTdOOGZe3tPhs=
+github.com/Masterminds/sprig/v3 v3.3.0/go.mod h1:Zy1iXRYNqNLUolqCpL4uhk6SHUMAOSCzdgBfDb35Lz0=
+github.com/agext/levenshtein v1.2.3 h1:YB2fHEn0UJagG8T1rrWknE3ZQzWM06O8AMAatNn7lmo=
+github.com/agext/levenshtein v1.2.3/go.mod h1:JEDfjyjHDjOF/1e4FlBE/PkbqA9OfWu2ki2W0IB5558=
+github.com/alexbrainman/sspi v0.0.0-20250919150558-7d374ff0d59e h1:4dAU9FXIyQktpoUAgOJK3OTFc/xug0PCXYCqU0FgDKI=
+github.com/alexbrainman/sspi v0.0.0-20250919150558-7d374ff0d59e/go.mod h1:cEWa1LVoE5KvSD9ONXsZrj0z6KqySlCCNKHlLzbqAt4=
+github.com/antlr4-go/antlr/v4 v4.13.1 h1:SqQKkuVZ+zWkMMNkjy5FZe5mr5WURWnlpmOuzYWrPrQ=
+github.com/antlr4-go/antlr/v4 v4.13.1/go.mod h1:GKmUxMtwp6ZgGwZSva4eWPC5mS6vUAmOABFgjdkM7Nw=
+github.com/apparentlymart/go-textseg/v15 v15.0.0 h1:uYvfpb3DyLSCGWnctWKGj857c6ew1u1fNQOlOtuGxQY=
+github.com/apparentlymart/go-textseg/v15 v15.0.0/go.mod h1:K8XmNZdhEBkdlyDdvbmmsvpAG721bKi0joRfFdHIWJ4=
+github.com/beevik/etree v1.7.0 h1:xjBk9O4p4x7D1YajePjfLzdaFC4/uYUENA7P0pv6gXA=
+github.com/beevik/etree v1.7.0/go.mod h1:bh4zJxiIr62SOf9pRzN7UUYaEDa9HEKafK25+sLc0Gc=
 github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
 github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw=
-github.com/census-instrumentation/opencensus-proto v0.2.1/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU=
-github.com/cespare/xxhash v1.1.0/go.mod h1:XrSqR1VqqWfGrhpAt58auRo0WTKS1nRRg3ghfAqPWnc=
-github.com/cespare/xxhash/v2 v2.1.1/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
-github.com/cespare/xxhash/v2 v2.1.2 h1:YRXhKfTDauu4ajMg1TPgFO5jnlC2HCbmLXMcTG5cbYE=
-github.com/cespare/xxhash/v2 v2.1.2/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
-github.com/chzyer/logex v1.1.10/go.mod h1:+Ywpsq7O8HXn0nuIou7OrIPyXbp3wmkHB+jjWRnGsAI=
-github.com/chzyer/readline v0.0.0-20180603132655-2972be24d48e/go.mod h1:nSuG5e5PlCu98SY8svDHJxuZscDgtXS6KTTbou5AhLI=
-github.com/chzyer/test v0.0.0-20180213035817-a1ea475d72b1/go.mod h1:Q3SI9o4m/ZMnBNeIyt5eFwwo7qiLfzFZmjNmxjkiQlU=
-github.com/client9/misspell v0.3.4/go.mod h1:qj6jICC3Q7zFZvVWo7KLAzC3yx5G7kyvSDkc90ppPyw=
-github.com/cncf/udpa/go v0.0.0-20191209042840-269d4d468f6f/go.mod h1:M8M6+tZqaGXZJjfX53e64911xZQV5JYwmTeXPW+k8Sc=
-github.com/cncf/udpa/go v0.0.0-20200629203442-efcf912fb354/go.mod h1:WmhPx2Nbnhtbo57+VJT5O0JRkEi1Wbu0z5j0R8u5Hbk=
-github.com/cncf/udpa/go v0.0.0-20201120205902-5459f2c99403/go.mod h1:WmhPx2Nbnhtbo57+VJT5O0JRkEi1Wbu0z5j0R8u5Hbk=
-github.com/cncf/udpa/go v0.0.0-20210930031921-04548b0d99d4/go.mod h1:6pvJx4me5XPnfI9Z40ddWsdw2W/uZgQLFXToKeRcDiI=
-github.com/cncf/xds/go v0.0.0-20210312221358-fbca930ec8ed/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
-github.com/cncf/xds/go v0.0.0-20210805033703-aa0b78936158/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
-github.com/cncf/xds/go v0.0.0-20210922020428-25de7278fc84/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
-github.com/cncf/xds/go v0.0.0-20211001041855-01bcc9b48dfe/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
-github.com/cncf/xds/go v0.0.0-20211011173535-cb28da3451f1/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
-github.com/coreos/go-oidc/v3 v3.3.0 h1:Y1LV3mP+QT3MEycATZpAiwfyN+uxZLqVbAHJUuOJEe4=
-github.com/coreos/go-oidc/v3 v3.3.0/go.mod h1:eHUXhZtXPQLgEaDrOVTgwbgmz1xGOkJNye6h3zkD2Pw=
-github.com/coreos/go-semver v0.3.0 h1:wkHLiw0WNATZnSG7epLsujiMCgPAc9xhjJ4tgnAxmfM=
-github.com/coreos/go-semver v0.3.0/go.mod h1:nnelYz7RCh+5ahJtPPxZlU+153eP4D4r3EedlOD2RNk=
-github.com/coreos/go-systemd/v22 v22.3.2 h1:D9/bQk5vlXQFZ6Kwuu6zaiXJ9oTPe68++AzAJc1DzSI=
-github.com/coreos/go-systemd/v22 v22.3.2/go.mod h1:Y58oyj3AT4RCenI/lSvhwexgC+NSVTIJ3seZv2GcEnc=
-github.com/cpuguy83/go-md2man/v2 v2.0.2/go.mod h1:tgQtvFlXSQOSOSIRvRPT7W67SCa46tRHOmNcaadrF8o=
-github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
+github.com/bmatcuk/doublestar v1.3.4 h1:gPypJ5xD31uhX6Tf54sDPUOBXTqKH4c9aPY66CyQrS0=
+github.com/bmatcuk/doublestar v1.3.4/go.mod h1:wiQtGV+rzVYxB7WIlirSN++5HPtPlXEo9MEoZQC/PmE=
+github.com/boombuler/barcode v1.0.1-0.20190219062509-6c824513bacc h1:biVzkmvwrH8WK8raXaxBx6fRVTlJILwEwQGL1I/ByEI=
+github.com/boombuler/barcode v1.0.1-0.20190219062509-6c824513bacc/go.mod h1:paBWMcWSl3LHKBqUq+rly7CNSldXjb2rDl3JlRe0mD8=
+github.com/cenkalti/backoff/v5 v5.0.3 h1:ZN+IMa753KfX5hd8vVaMixjnqRZ3y8CuJKRKj1xcsSM=
+github.com/cenkalti/backoff/v5 v5.0.3/go.mod h1:rkhZdG3JZukswDf7f0cwqPNk4K0sa+F97BxZthm/crw=
+github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=
+github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
+github.com/clipperhouse/displaywidth v0.6.2 h1:ZDpTkFfpHOKte4RG5O/BOyf3ysnvFswpyYrV7z2uAKo=
+github.com/clipperhouse/displaywidth v0.6.2/go.mod h1:R+kHuzaYWFkTm7xoMmK1lFydbci4X2CicfbGstSGg0o=
+github.com/clipperhouse/stringish v0.1.1 h1:+NSqMOr3GR6k1FdRhhnXrLfztGzuG+VuFDfatpWHKCs=
+github.com/clipperhouse/stringish v0.1.1/go.mod h1:v/WhFtE1q0ovMta2+m+UbpZ+2/HEXNWYXQgCt4hdOzA=
+github.com/clipperhouse/uax29/v2 v2.3.0 h1:SNdx9DVUqMoBuBoW3iLOj4FQv3dN5mDtuqwuhIGpJy4=
+github.com/clipperhouse/uax29/v2 v2.3.0/go.mod h1:Wn1g7MK6OoeDT0vL+Q0SQLDz/KpfsVRgg6W7ihQeh4g=
+github.com/coreos/go-oidc/v3 v3.19.0 h1:F/xyOi3x1UnG1U27YVnM1N6bHiL1K2upi6U/0qr8r+I=
+github.com/coreos/go-oidc/v3 v3.19.0/go.mod h1:DYCf24+ncYi+XkIH97GY1+dqoRlbaSI26KVTCI9SrY4=
+github.com/coreos/go-semver v0.3.1 h1:yi21YpKnrx1gt5R+la8n5WgS0kCrsPp33dmEyHReZr4=
+github.com/coreos/go-semver v0.3.1/go.mod h1:irMmmIw/7yzSRPWryHsK7EYSg09caPQL03VsM8rvUec=
+github.com/coreos/go-systemd/v22 v22.5.0 h1:RrqgGjYQKalulkV8NGVIfkXQf6YYmOyiJKk8iXXhfZs=
+github.com/coreos/go-systemd/v22 v22.5.0/go.mod h1:Y58oyj3AT4RCenI/lSvhwexgC+NSVTIJ3seZv2GcEnc=
+github.com/cpuguy83/go-md2man/v2 v2.0.6/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/dustin/go-humanize v1.0.0/go.mod h1:HtrtbFcZ19U5GC7JDqmcUSB87Iq5E25KnS6fMYU6eOk=
-github.com/envoyproxy/go-control-plane v0.9.0/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4=
-github.com/envoyproxy/go-control-plane v0.9.1-0.20191026205805-5f8ba28d4473/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4=
-github.com/envoyproxy/go-control-plane v0.9.4/go.mod h1:6rpuAdCZL397s3pYoYcLgu1mIlRU8Am5FuJP05cCM98=
-github.com/envoyproxy/go-control-plane v0.9.7/go.mod h1:cwu0lG7PUMfa9snN8LXBig5ynNVH9qI8YYLbd1fK2po=
-github.com/envoyproxy/go-control-plane v0.9.9-0.20201210154907-fd9021fe5dad/go.mod h1:cXg6YxExXjJnVBQHBLXeUAgxn2UodCpnH306RInaBQk=
-github.com/envoyproxy/go-control-plane v0.9.9-0.20210217033140-668b12f5399d/go.mod h1:cXg6YxExXjJnVBQHBLXeUAgxn2UodCpnH306RInaBQk=
-github.com/envoyproxy/go-control-plane v0.9.9-0.20210512163311-63b5d3c536b0/go.mod h1:hliV/p42l8fGbc6Y9bQ70uLwIvmJyVE5k4iMKlh8wCQ=
-github.com/envoyproxy/go-control-plane v0.9.10-0.20210907150352-cf90f659a021/go.mod h1:AFq3mo9L8Lqqiid3OhADV3RfLJnjiw63cSpi+fDTRC0=
-github.com/envoyproxy/go-control-plane v0.10.2-0.20220325020618-49ff273808a1/go.mod h1:KJwIaB5Mv44NWtYuAOFCVOjcI94vtpEz2JU/D2v6IjE=
-github.com/envoyproxy/protoc-gen-validate v0.1.0/go.mod h1:iSmxcyjqTsJpI2R4NaDN7+kN2VEUnK/pcBlmesArF7c=
-github.com/felixge/httpsnoop v1.0.1/go.mod h1:m8KPJKqk1gH5J9DgRY2ASl2lWCfGKXixSwevea8zH2U=
-github.com/felixge/httpsnoop v1.0.3 h1:s/nj+GCswXYzN5v2DpNMuMQYe+0DDwt5WVCU6CWBdXk=
-github.com/felixge/httpsnoop v1.0.3/go.mod h1:m8KPJKqk1gH5J9DgRY2ASl2lWCfGKXixSwevea8zH2U=
+github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1VwoXQT9A3Wy9MM3WgvqSxFWenqJduM=
+github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/fatih/color v1.19.0 h1:Zp3PiM21/9Ld6FzSKyL5c/BULoe/ONr9KlbYVOfG8+w=
+github.com/fatih/color v1.19.0/go.mod h1:zNk67I0ZUT1bEGsSGyCZYZNrHuTkJJB+r6Q9VuMi0LE=
+github.com/felixge/httpsnoop v1.0.4 h1:NFTV2Zj1bL4mc9sqWACXbQFVBBg2W3GPvqp8/ESS2Wg=
+github.com/felixge/httpsnoop v1.0.4/go.mod h1:m8KPJKqk1gH5J9DgRY2ASl2lWCfGKXixSwevea8zH2U=
 github.com/fortytw2/leaktest v1.3.0 h1:u8491cBMTQ8ft8aeV+adlcytMZylmA5nnwwkRZjI8vw=
 github.com/fortytw2/leaktest v1.3.0/go.mod h1:jDsjWgpAGjm2CA7WthBh/CdZYEPF31XHquHwclZch5g=
+github.com/frankban/quicktest v1.14.6 h1:7Xjx+VpznH+oBnejlPUj8oUpdxnVs4f8XU8WnHkI4W8=
+github.com/frankban/quicktest v1.14.6/go.mod h1:4ptaffx2x8+WTWXmUCuVU6aPUX1/Mz7zb5vbUoiM6w0=
+github.com/fsnotify/fsnotify v1.10.1 h1:b0/UzAf9yR5rhf3RPm9gf3ehBPpf0oZKIjtpKrx59Ho=
+github.com/fsnotify/fsnotify v1.10.1/go.mod h1:TLheqan6HD6GBK6PrDWyDPBaEV8LspOxvPSjC+bVfgo=
+github.com/fxamacker/cbor/v2 v2.9.2 h1:X4Ksno9+x3cz0TZv69ec1hxP/+tymuR8PXQJyDwfh78=
+github.com/fxamacker/cbor/v2 v2.9.2/go.mod h1:vM4b+DJCtHn+zz7h3FFp/hDAI9WNWCsZj23V5ytsSxQ=
 github.com/ghodss/yaml v1.0.0 h1:wQHKEahhL6wmXdzwWG11gIVCkOv05bNOh+Rxn0yngAk=
 github.com/ghodss/yaml v1.0.0/go.mod h1:4dBDuWmgqj2HViK6kFavaiC9ZROes6MMH2rRYeMEF04=
-github.com/go-asn1-ber/asn1-ber v1.5.4 h1:vXT6d/FNDiELJnLb6hGNa309LMsrCoYFvpwHDF0+Y1A=
-github.com/go-asn1-ber/asn1-ber v1.5.4/go.mod h1:hEBeB/ic+5LoWskz+yKT7vGhhPYkProFKoKdwZRWMe0=
-github.com/go-gl/glfw v0.0.0-20190409004039-e6da0acd62b1/go.mod h1:vR7hzQXu2zJy9AVAgeJqvqgH9Q5CA+iKCZ2gyEVpxRU=
-github.com/go-gl/glfw/v3.3/glfw v0.0.0-20191125211704-12ad95a8df72/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8=
-github.com/go-gl/glfw/v3.3/glfw v0.0.0-20200222043503-6f7a984d4dc4/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8=
-github.com/go-kit/kit v0.8.0/go.mod h1:xBxKIO96dXMWWy0MnWVtmwkA9/13aqxPnvrjFYMA2as=
-github.com/go-kit/kit v0.9.0/go.mod h1:xBxKIO96dXMWWy0MnWVtmwkA9/13aqxPnvrjFYMA2as=
-github.com/go-kit/log v0.1.0/go.mod h1:zbhenjAZHb184qTLMA9ZjW7ThYL0H2mk7Q6pNt4vbaY=
-github.com/go-kit/log v0.2.0/go.mod h1:NwTd00d/i8cPZ3xOwwiv2PO5MOcx78fFErGNcVmBjv0=
-github.com/go-ldap/ldap/v3 v3.4.4 h1:qPjipEpt+qDa6SI/h1fzuGWoRUY+qqQ9sOZq67/PYUs=
-github.com/go-ldap/ldap/v3 v3.4.4/go.mod h1:fe1MsuN5eJJ1FeLT/LEBVdWfNWKh459R7aXgXtJC+aI=
-github.com/go-logfmt/logfmt v0.3.0/go.mod h1:Qt1PoO58o5twSAckw1HlFXLmHsOX5/0LbT9GBnD5lWE=
-github.com/go-logfmt/logfmt v0.4.0/go.mod h1:3RMwSq7FuexP4Kalkev3ejPJsZTpXXBr9+V4qmtdjCk=
-github.com/go-logfmt/logfmt v0.5.0/go.mod h1:wCYkCAKZfumFQihp8CzCvQ3paCTfi41vtzG1KdI/P7A=
-github.com/go-logfmt/logfmt v0.5.1/go.mod h1:WYhtIu8zTZfxdn5+rREduYbwxfcBr/Vr6KEVveWlfTs=
+github.com/go-asn1-ber/asn1-ber v1.5.8 h1:H9AZkK22UOmfX8J84ubyaZxKJZ3FMHVwn8swoMML7iQ=
+github.com/go-asn1-ber/asn1-ber v1.5.8/go.mod h1:hEBeB/ic+5LoWskz+yKT7vGhhPYkProFKoKdwZRWMe0=
+github.com/go-jose/go-jose/v4 v4.1.4 h1:moDMcTHmvE6Groj34emNPLs/qtYXRVcd6S7NHbHz3kA=
+github.com/go-jose/go-jose/v4 v4.1.4/go.mod h1:x4oUasVrzR7071A4TnHLGSPpNOm2a21K9Kf04k1rs08=
+github.com/go-ldap/ldap/v3 v3.4.14 h1:D6PYdEgsaVzsXyr6w/yDC06Ria4uUhWm+Rb+er8lfAs=
+github.com/go-ldap/ldap/v3 v3.4.14/go.mod h1:S4eJUMUNjDkE0ZJtIZdybwyb03sGGLW6gxXT1Hs8VKA=
+github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
+github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI=
+github.com/go-logr/logr v1.4.3/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
+github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=
+github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE=
 github.com/go-openapi/inflect v0.19.0 h1:9jCH9scKIbHeV9m12SmPilScz6krDxKRasNNSNPXu/4=
 github.com/go-openapi/inflect v0.19.0/go.mod h1:lHpZVlpIQqLyKwJ4N+YSc9hchQy/i12fJykb83CRBH4=
-github.com/go-sql-driver/mysql v1.6.0 h1:BCTh4TKNUYmOmMUcQ3IipzF5prigylS7XXjEkfCHuOE=
-github.com/go-sql-driver/mysql v1.6.0/go.mod h1:DCzpHaOWr8IXmIStZouvnhqoel9Qv2LBy8hT2VhHyBg=
-github.com/go-stack/stack v1.8.0/go.mod h1:v0f6uXyyMGvRgIKkXu+yp6POWl0qKG85gN/melR3HDY=
-github.com/go-test/deep v1.0.3 h1:ZrJSEWsXzPOxaZnFteGEfooLba+ju3FYIbOrS+rQd68=
-github.com/go-test/deep v1.0.3/go.mod h1:wGDj63lr65AM2AQyKZd/NYHGb0R+1RLqB8NKt3aSFNA=
+github.com/go-sql-driver/mysql v1.10.0 h1:Q+1LV8DkHJvSYAdR83XzuhDaTykuDx0l6fkXxoWCWfw=
+github.com/go-sql-driver/mysql v1.10.0/go.mod h1:M+cqaI7+xxXGG9swrdeUIoPG3Y3KCkF0pZej+SK+nWk=
+github.com/go-test/deep v1.1.1 h1:0r/53hagsehfO4bzD2Pgr/+RgHqhmf+k1Bpse2cTu1U=
+github.com/go-test/deep v1.1.1/go.mod h1:5C2ZWiW0ErCdrYzpqxLbTX7MG14M9iiw8DgHncVwcsE=
+github.com/go-viper/mapstructure/v2 v2.5.0 h1:vM5IJoUAy3d7zRSVtIwQgBj7BiWtMPfmPEgAXnvj1Ro=
+github.com/go-viper/mapstructure/v2 v2.5.0/go.mod h1:oJDH3BJKyqBA2TXFhDsKDGDTlndYOZ6rGS0BRZIxGhM=
+github.com/go-webauthn/webauthn v0.17.4 h1:KFTSz3R2RYDiUn/0cDi3XTJgFenSG74eKTTHlqWhlxk=
+github.com/go-webauthn/webauthn v0.17.4/go.mod h1:pZk63EE/BdztlmyS4Yc+9H5g4a8blNlbtGmdHQHbZX8=
+github.com/go-webauthn/x v0.2.6 h1:TEyDuQAIiEgYpx60nKiBJIX/5nSUC8LxNbH+uf5U9uk=
+github.com/go-webauthn/x v0.2.6/go.mod h1:45bA7YEqyQhRcQJ/TiBb46Ww8yqHBGvgEhQ3WWF0aDo=
 github.com/godbus/dbus/v5 v5.0.4/go.mod h1:xhWf0FNVPg57R7Z0UbKHbJfkEywrmjJnf7w5xrFpKfA=
-github.com/gogo/protobuf v1.1.1/go.mod h1:r8qH/GZQm5c6nD/R0oafs1akxWv10x8SbQlK7atdtwQ=
 github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q=
 github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q=
-github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b/go.mod h1:SBH7ygxi8pfUlaOkMMuAQtPIUF8ecWP5IEl/CR7VP2Q=
-github.com/golang/groupcache v0.0.0-20190702054246-869f871628b6/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
-github.com/golang/groupcache v0.0.0-20191227052852-215e87163ea7/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
-github.com/golang/groupcache v0.0.0-20200121045136-8c9f03a8e57e/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
-github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da h1:oI5xCqsCo564l8iNU+DwB5epxmsaqB+rhGL0m5jtYqE=
-github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
-github.com/golang/mock v1.1.1/go.mod h1:oTYuIxOrZwtPieC+H1uAHpcLFnEyAGVDL/k47Jfbm0A=
-github.com/golang/mock v1.2.0/go.mod h1:oTYuIxOrZwtPieC+H1uAHpcLFnEyAGVDL/k47Jfbm0A=
-github.com/golang/mock v1.3.1/go.mod h1:sBzyDLLjw3U8JLTeZvSv8jJB+tU5PVekmnlKIyFUx0Y=
-github.com/golang/mock v1.4.0/go.mod h1:UOMv5ysSaYNkG+OFQykRIcU/QvvxJf3p21QfJ2Bt3cw=
-github.com/golang/mock v1.4.1/go.mod h1:UOMv5ysSaYNkG+OFQykRIcU/QvvxJf3p21QfJ2Bt3cw=
-github.com/golang/mock v1.4.3/go.mod h1:UOMv5ysSaYNkG+OFQykRIcU/QvvxJf3p21QfJ2Bt3cw=
-github.com/golang/mock v1.4.4/go.mod h1:l3mdAwkq5BuhzHwde/uurv3sEJeZMXNpwsxVWU71h+4=
-github.com/golang/mock v1.5.0/go.mod h1:CWnOUgYIOo4TcNZ0wHX3YZCqsaM1I1Jvs6v3mP3KVu8=
-github.com/golang/mock v1.6.0/go.mod h1:p6yTPP+5HYm5mzsMV8JkE6ZKdX+/wYM6Hr+LicevLPs=
-github.com/golang/protobuf v1.1.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
-github.com/golang/protobuf v1.2.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
-github.com/golang/protobuf v1.3.1/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
-github.com/golang/protobuf v1.3.2/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
-github.com/golang/protobuf v1.3.3/go.mod h1:vzj43D7+SQXF/4pzW/hwtAqwc6iTitCiVSaWz5lYuqw=
-github.com/golang/protobuf v1.3.4/go.mod h1:vzj43D7+SQXF/4pzW/hwtAqwc6iTitCiVSaWz5lYuqw=
-github.com/golang/protobuf v1.3.5/go.mod h1:6O5/vntMXwX2lRkT1hjjk0nAC1IDOTvTlVgjlRvqsdk=
-github.com/golang/protobuf v1.4.0-rc.1/go.mod h1:ceaxUfeHdC40wWswd/P6IGgMaK3YpKi5j83Wpe3EHw8=
-github.com/golang/protobuf v1.4.0-rc.1.0.20200221234624-67d41d38c208/go.mod h1:xKAWHe0F5eneWXFV3EuXVDTCmh+JuBKY0li0aMyXATA=
-github.com/golang/protobuf v1.4.0-rc.2/go.mod h1:LlEzMj4AhA7rCAGe4KMBDvJI+AwstrUpVNzEA03Pprs=
-github.com/golang/protobuf v1.4.0-rc.4.0.20200313231945-b860323f09d0/go.mod h1:WU3c8KckQ9AFe+yFwt9sWVRKCVIyN9cPHBJSNnbL67w=
-github.com/golang/protobuf v1.4.0/go.mod h1:jodUvKwWbYaEsadDk5Fwe5c77LiNKVO9IDvqG2KuDX0=
-github.com/golang/protobuf v1.4.1/go.mod h1:U8fpvMrcmy5pZrNK1lt4xCsGvpyWQ/VVv6QDs8UjoX8=
-github.com/golang/protobuf v1.4.2/go.mod h1:oDoupMAO8OvCJWAcko0GGGIgR6R6ocIYbsSw735rRwI=
-github.com/golang/protobuf v1.4.3/go.mod h1:oDoupMAO8OvCJWAcko0GGGIgR6R6ocIYbsSw735rRwI=
-github.com/golang/protobuf v1.5.0/go.mod h1:FsONVRAS9T7sI+LIUmWTfcYkHO4aIWwzhcaSAoJOfIk=
-github.com/golang/protobuf v1.5.1/go.mod h1:DopwsBzvsk0Fs44TXzsVbJyPhcCPeIwnvohx4u74HPM=
-github.com/golang/protobuf v1.5.2 h1:ROPKBNFfQgOUMifHyP+KYbvpjbdoFNs+aK7DXlji0Tw=
-github.com/golang/protobuf v1.5.2/go.mod h1:XVQd3VNwM+JqD3oG2Ue2ip4fOMUkwXdXDdiuN0vRsmY=
-github.com/golang/snappy v0.0.3/go.mod h1:/XxbfmMg8lxefKM7IXC3fBNl/7bRcc72aCRzEWrmP2Q=
-github.com/google/btree v0.0.0-20180813153112-4030bb1f1f0c/go.mod h1:lNA+9X1NB3Zf8V7Ke586lFgjr2dZNuvo3lPJSGZ5JPQ=
-github.com/google/btree v1.0.0/go.mod h1:lNA+9X1NB3Zf8V7Ke586lFgjr2dZNuvo3lPJSGZ5JPQ=
-github.com/google/go-cmp v0.2.0/go.mod h1:oXzfMopK8JAjlY9xF4vHSVASa0yLyX7SntLO5aqRK0M=
-github.com/google/go-cmp v0.3.0/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
-github.com/google/go-cmp v0.3.1/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
-github.com/google/go-cmp v0.4.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/go-cmp v0.4.1/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/go-cmp v0.5.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/go-cmp v0.5.1/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/go-cmp v0.5.2/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/go-cmp v0.5.3/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/go-cmp v0.5.4/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/go-cmp v0.5.6/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/go-cmp v0.5.7/go.mod h1:n+brtR0CgQNWTVd5ZUFpTBC8YFBDLK/h/bpaJ8/DtOE=
-github.com/google/go-cmp v0.5.8 h1:e6P7q2lk1O+qJJb4BtCQXlK8vWEO8V1ZeuEdJNOqZyg=
-github.com/google/go-cmp v0.5.8/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
-github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
-github.com/google/martian v2.1.0+incompatible/go.mod h1:9I4somxYTbIHy5NJKHRl3wXiIaQGbYVAs8BPL6v8lEs=
-github.com/google/martian/v3 v3.0.0/go.mod h1:y5Zk1BBys9G+gd6Jrk0W3cC1+ELVxBWuIGO+w/tUAp0=
-github.com/google/martian/v3 v3.1.0/go.mod h1:y5Zk1BBys9G+gd6Jrk0W3cC1+ELVxBWuIGO+w/tUAp0=
-github.com/google/martian/v3 v3.2.1/go.mod h1:oBOf6HBosgwRXnUGWUB05QECsc6uvmMiJ3+6W4l/CUk=
-github.com/google/pprof v0.0.0-20181206194817-3ea8567a2e57/go.mod h1:zfwlbNMJ+OItoe0UupaVj+oy1omPYYDuagoSzA8v9mc=
-github.com/google/pprof v0.0.0-20190515194954-54271f7e092f/go.mod h1:zfwlbNMJ+OItoe0UupaVj+oy1omPYYDuagoSzA8v9mc=
-github.com/google/pprof v0.0.0-20191218002539-d4f498aebedc/go.mod h1:ZgVRPoUq/hfqzAqh7sHMqb3I9Rq5C59dIz2SbBwJ4eM=
-github.com/google/pprof v0.0.0-20200212024743-f11f1df84d12/go.mod h1:ZgVRPoUq/hfqzAqh7sHMqb3I9Rq5C59dIz2SbBwJ4eM=
-github.com/google/pprof v0.0.0-20200229191704-1ebb73c60ed3/go.mod h1:ZgVRPoUq/hfqzAqh7sHMqb3I9Rq5C59dIz2SbBwJ4eM=
-github.com/google/pprof v0.0.0-20200430221834-fc25d7d30c6d/go.mod h1:ZgVRPoUq/hfqzAqh7sHMqb3I9Rq5C59dIz2SbBwJ4eM=
-github.com/google/pprof v0.0.0-20200708004538-1a94d8640e99/go.mod h1:ZgVRPoUq/hfqzAqh7sHMqb3I9Rq5C59dIz2SbBwJ4eM=
-github.com/google/pprof v0.0.0-20201023163331-3e6fc7fc9c4c/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
-github.com/google/pprof v0.0.0-20201203190320-1bf35d6f28c2/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
-github.com/google/pprof v0.0.0-20210122040257-d980be63207e/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
-github.com/google/pprof v0.0.0-20210226084205-cbba55b83ad5/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
-github.com/google/pprof v0.0.0-20210601050228-01bbb1931b22/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
-github.com/google/pprof v0.0.0-20210609004039-a478d1d731e9/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
-github.com/google/pprof v0.0.0-20210720184732-4bb14d4b1be1/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
-github.com/google/renameio v0.1.0/go.mod h1:KWCgfxg9yswjAJkECMjeO8J8rahYeXnNhOm40UhjYkI=
-github.com/google/uuid v1.1.1/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
-github.com/google/uuid v1.1.2/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
-github.com/google/uuid v1.3.0 h1:t6JiXgmwXMjEs8VusXIJk2BXHsn+wx8BZdTaoZ5fu7I=
-github.com/google/uuid v1.3.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
-github.com/googleapis/enterprise-certificate-proxy v0.0.0-20220520183353-fd19c99a87aa/go.mod h1:17drOmN3MwGY7t0e+Ei9b45FFGA3fBs3x36SsCg1hq8=
-github.com/googleapis/enterprise-certificate-proxy v0.1.0 h1:zO8WHNx/MYiAKJ3d5spxZXZE6KHmIQGQcAzwUzV7qQw=
-github.com/googleapis/enterprise-certificate-proxy v0.1.0/go.mod h1:17drOmN3MwGY7t0e+Ei9b45FFGA3fBs3x36SsCg1hq8=
-github.com/googleapis/gax-go/v2 v2.0.4/go.mod h1:0Wqv26UfaUD9n4G6kQubkQ+KchISgw+vpHVxEJEs9eg=
-github.com/googleapis/gax-go/v2 v2.0.5/go.mod h1:DWXyrwAJ9X0FpwwEdw+IPEYBICEFu5mhpdKc/us6bOk=
-github.com/googleapis/gax-go/v2 v2.1.0/go.mod h1:Q3nei7sK6ybPYH7twZdmQpAd1MKb7pfu6SK+H1/DsU0=
-github.com/googleapis/gax-go/v2 v2.1.1/go.mod h1:hddJymUZASv3XPyGkUpKj8pPO47Rmb0eJc8R6ouapiM=
-github.com/googleapis/gax-go/v2 v2.2.0/go.mod h1:as02EH8zWkzwUoLbBaFeQ+arQaj/OthfcblKl4IGNaM=
-github.com/googleapis/gax-go/v2 v2.3.0/go.mod h1:b8LNqSzNabLiUpXKkY7HAR5jr6bIT99EXz9pXxye9YM=
-github.com/googleapis/gax-go/v2 v2.4.0 h1:dS9eYAjhrE2RjmzYw2XAPvcXfmcQLtFEQWn0CR82awk=
-github.com/googleapis/gax-go/v2 v2.4.0/go.mod h1:XOTVJ59hdnfJLIP/dh8n5CGryZR2LxK9wbMD5+iXC6c=
-github.com/googleapis/go-type-adapters v1.0.0/go.mod h1:zHW75FOG2aur7gAO2B+MLby+cLsWGBF62rFAi7WjWO4=
-github.com/gorilla/handlers v1.5.1 h1:9lRY6j8DEeeBT10CvO9hGW0gmky0BprnvDI5vfhUHH4=
-github.com/gorilla/handlers v1.5.1/go.mod h1:t8XrUpc4KVXb7HGyJ4/cEnwQiaxrX/hz1Zv/4g96P1Q=
-github.com/gorilla/mux v1.8.0 h1:i40aqfkR1h2SlN9hojwV5ZA91wcXFOvkdNIeFDP5koI=
-github.com/gorilla/mux v1.8.0/go.mod h1:DVbg23sWSpFRCP0SfiEN6jmj59UnW/n46BH5rLB71So=
+github.com/golang-jwt/jwt/v5 v5.3.1 h1:kYf81DTWFe7t+1VvL7eS+jKFVWaUnK9cB1qbwn63YCY=
+github.com/golang-jwt/jwt/v5 v5.3.1/go.mod h1:fxCRLWMO43lRc8nhHWY6LGqRcf+1gQWArsqaEUEa5bE=
+github.com/golang/protobuf v1.5.4 h1:i7eJL8qZTpSEXOPTxNKhASYpMn+8e5Q6AdndVa1dWek=
+github.com/golang/protobuf v1.5.4/go.mod h1:lnTiLA8Wa4RWRcIUkrtSVa5nRhsEGBg48fD6rSs7xps=
+github.com/google/cel-go v0.30.0 h1:ll54AkzKunWkBn9wSoiUXbFZXYZTkdJGNXTBXUoolGo=
+github.com/google/cel-go v0.30.0/go.mod h1:X0bD6iVNR8pkROSOoHVdgTkzmRcosof7WQqCD6wcMc8=
+github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
+github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
+github.com/google/go-tpm v0.9.8 h1:slArAR9Ft+1ybZu0lBwpSmpwhRXaa85hWtMinMyRAWo=
+github.com/google/go-tpm v0.9.8/go.mod h1:h9jEsEECg7gtLis0upRBQU+GhYVH6jMjrFxI8u6bVUY=
+github.com/google/go-tpm-tools v0.3.13-0.20230620182252-4639ecce2aba h1:qJEJcuLzH5KDR0gKc0zcktin6KSAwL7+jWKBYceddTc=
+github.com/google/go-tpm-tools v0.3.13-0.20230620182252-4639ecce2aba/go.mod h1:EFYHy8/1y2KfgTAsx7Luu7NGhoxtuVHnNo8jE7FikKc=
+github.com/google/s2a-go v0.1.9 h1:LGD7gtMgezd8a/Xak7mEWL0PjoTQFvpRudN895yqKW0=
+github.com/google/s2a-go v0.1.9/go.mod h1:YA0Ei2ZQL3acow2O62kdp9UlnvMmU7kA6Eutn0dXayM=
+github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
+github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
+github.com/googleapis/enterprise-certificate-proxy v0.3.19 h1:mMOE7DN2+p76/EdIrmAy9B9bH+yC4563vmnJ34QR8i4=
+github.com/googleapis/enterprise-certificate-proxy v0.3.19/go.mod h1:rSEsBUemEBZEexP2y6jPp16LUmUbjmSbcPMQizR0o4k=
+github.com/googleapis/gax-go/v2 v2.23.0 h1:Tchl7qkvE7Ip3y+ztvNufYFvkfqTe7NfLTYGIdJRLuE=
+github.com/googleapis/gax-go/v2 v2.23.0/go.mod h1:rBQKOVJCdb8IFEzg+FCwlt1LP/xMDGuqUXhUG+XMXEg=
+github.com/gorilla/handlers v1.5.2 h1:cLTUSsNkgcwhgRqvCNmdbRWG0A3N4F+M2nWKdScwyEE=
+github.com/gorilla/handlers v1.5.2/go.mod h1:dX+xVpaxdSw+q0Qek8SSsl3dfMk3jNddUkMzo0GtH0w=
+github.com/gorilla/mux v1.8.1 h1:TuBL49tXwgrFYWhqrNgrUNEY92u81SPhu7sTdzQEiWY=
+github.com/gorilla/mux v1.8.1/go.mod h1:AKf9I4AEqPTmMytcMc0KkNouC66V3BtZ4qD5fmWSiMQ=
+github.com/gorilla/securecookie v1.1.1 h1:miw7JPhV+b/lAHSXz4qd/nN9jRiAFV5FwjeKyCS8BvQ=
+github.com/gorilla/securecookie v1.1.1/go.mod h1:ra0sb63/xPlUeL+yeDciTfxMRAA+MP+HVt/4epWDjd4=
+github.com/gorilla/sessions v1.2.1 h1:DHd3rPN5lE3Ts3D8rKkQ8x/0kqfeNmBAaiSi+o7FsgI=
+github.com/gorilla/sessions v1.2.1/go.mod h1:dk2InVEVJ0sfLlnXv9EAgkf6ecYs/i80K/zI+bUmuGM=
 github.com/grpc-ecosystem/go-grpc-prometheus v1.2.0 h1:Ovs26xHkKqVztRpIrF/92BcuyuQ/YW4NSIpoGtfXNho=
 github.com/grpc-ecosystem/go-grpc-prometheus v1.2.0/go.mod h1:8NvIoxWQoOIhqOTXgfV/d3M/q6VIi02HzZEHgUlZvzk=
-github.com/grpc-ecosystem/grpc-gateway v1.16.0/go.mod h1:BDjrQk3hbvj6Nolgz8mAMFbcEtjT1g+wF4CSlocrBnw=
-github.com/hashicorp/golang-lru v0.5.0/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8=
-github.com/hashicorp/golang-lru v0.5.1/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8=
-github.com/hashicorp/hcl/v2 v2.10.0 h1:1S1UnuhDGlv3gRFV4+0EdwB+znNP5HmcGbIqwnSCByg=
-github.com/hashicorp/hcl/v2 v2.10.0/go.mod h1:FwWsfWEjyV/CMj8s/gqAuiviY72rJ1/oayI9WftqcKg=
-github.com/huandu/xstrings v1.3.1 h1:4jgBlKK6tLKFvO8u5pmYjG91cqytmDCDvGh7ECVFfFs=
-github.com/huandu/xstrings v1.3.1/go.mod h1:y5/lhBue+AyNmUVz9RLU9xbLR0o4KIIExikq4ovT0aE=
-github.com/ianlancetaylor/demangle v0.0.0-20181102032728-5e5cf60278f6/go.mod h1:aSSvb/t6k1mPoxDqO4vJh6VOCGPwU4O0C2/Eqndh1Sc=
-github.com/ianlancetaylor/demangle v0.0.0-20200824232613-28f6c0f3b639/go.mod h1:aSSvb/t6k1mPoxDqO4vJh6VOCGPwU4O0C2/Eqndh1Sc=
-github.com/imdario/mergo v0.3.11 h1:3tnifQM4i+fbajXKBHXWEH+KvNHqojZ778UH75j3bGA=
-github.com/imdario/mergo v0.3.11/go.mod h1:jmQim1M+e3UYxmgPu/WyfjB3N3VflVyUjjjwH0dnCYA=
-github.com/inconshreveable/mousetrap v1.0.0 h1:Z8tu5sraLXCXIcARxBp/8cbvlwVa7Z1NHg9XEKhtSvM=
-github.com/inconshreveable/mousetrap v1.0.0/go.mod h1:PxqpIevigyE2G7u3NXJIT2ANytuPF1OarO4DADm73n8=
-github.com/jonboulle/clockwork v0.2.2 h1:UOGuzwb1PwsrDAObMuhUnj0p5ULPj8V/xJ7Kx9qUBdQ=
-github.com/jonboulle/clockwork v0.2.2/go.mod h1:Pkfl5aHPm1nk2H9h0bjmnJD/BcgbGXUBGnn1kMkgxc8=
-github.com/jpillora/backoff v1.0.0/go.mod h1:J/6gKK9jxlEcS3zixgDgUAsiuZ7yrSoa/FX5e0EB2j4=
-github.com/json-iterator/go v1.1.6/go.mod h1:+SdeFBvtyEkXs7REEP0seUULqWtbJapLOCVDaaPEHmU=
-github.com/json-iterator/go v1.1.10/go.mod h1:KdQUCv79m/52Kvf8AW2vK1V8akMuk1QjK/uOdHXbAo4=
-github.com/json-iterator/go v1.1.11/go.mod h1:KdQUCv79m/52Kvf8AW2vK1V8akMuk1QjK/uOdHXbAo4=
-github.com/json-iterator/go v1.1.12/go.mod h1:e30LSqwooZae/UwlEbR2852Gd8hjQvJoHmT4TnhNGBo=
-github.com/jstemmer/go-junit-report v0.0.0-20190106144839-af01ea7f8024/go.mod h1:6v2b51hI/fHJwM22ozAgKL4VKDeJcHhJFhtBdhmNjmU=
-github.com/jstemmer/go-junit-report v0.9.1/go.mod h1:Brl9GWCQeLvo8nXZwPNNblvFj/XSXhF0NWZEnDohbsk=
-github.com/julienschmidt/httprouter v1.2.0/go.mod h1:SYymIcj16QtmaHHD7aYtjjsJG7VTCxuUUipMqKk8s4w=
-github.com/julienschmidt/httprouter v1.3.0/go.mod h1:JR6WtHb+2LUe8TCKY3cZOxFyyO8IZAc4RVcycCCAKdM=
+github.com/grpc-ecosystem/grpc-gateway/v2 v2.26.3 h1:5ZPtiqj0JL5oKWmcsq4VMaAW5ukBEgSGXEN89zeH1Jo=
+github.com/grpc-ecosystem/grpc-gateway/v2 v2.26.3/go.mod h1:ndYquD05frm2vACXE1nsccT4oJzjhw2arTS2cpUD1PI=
+github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
+github.com/hashicorp/errwrap v1.1.0 h1:OxrOeh75EUXMY8TBjag2fzXGZ40LB6IKw45YeGUDY2I=
+github.com/hashicorp/errwrap v1.1.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
+github.com/hashicorp/go-cleanhttp v0.5.2 h1:035FKYIWjmULyFRBKPs8TBQoi0x6d9G4xc9neXJWAZQ=
+github.com/hashicorp/go-cleanhttp v0.5.2/go.mod h1:kO/YDlP8L1346E6Sodw+PrpBSV4/SoxCXGY6BqNFT48=
+github.com/hashicorp/go-hclog v1.6.3 h1:Qr2kF+eVWjTiYmU7Y31tYlP1h0q/X3Nl3tPGdaB11/k=
+github.com/hashicorp/go-hclog v1.6.3/go.mod h1:W4Qnvbt70Wk/zYJryRzDRU/4r0kIg0PVHBcfoyhpF5M=
+github.com/hashicorp/go-multierror v1.1.1 h1:H5DkEtf6CXdFp0N0Em5UCwQpXMWke8IA0+lD48awMYo=
+github.com/hashicorp/go-multierror v1.1.1/go.mod h1:iw975J/qwKPdAO1clOe2L8331t/9/fmwbPZ6JB6eMoM=
+github.com/hashicorp/go-retryablehttp v0.7.8 h1:ylXZWnqa7Lhqpk0L1P1LzDtGcCR0rPVUrx/c8Unxc48=
+github.com/hashicorp/go-retryablehttp v0.7.8/go.mod h1:rjiScheydd+CxvumBsIrFKlx3iS0jrZ7LvzFGFmuKbw=
+github.com/hashicorp/go-secure-stdlib/parseutil v0.2.0 h1:U+kC2dOhMFQctRfhK0gRctKAPTloZdMU5ZJxaesJ/VM=
+github.com/hashicorp/go-secure-stdlib/parseutil v0.2.0/go.mod h1:Ll013mhdmsVDuoIXVfBtvgGJsXDYkTw1kooNcoCXuE0=
+github.com/hashicorp/go-secure-stdlib/strutil v0.1.2 h1:kes8mmyCpxJsI7FTwtzRqEy9CdjCtrXrXGuOpxEA7Ts=
+github.com/hashicorp/go-secure-stdlib/strutil v0.1.2/go.mod h1:Gou2R9+il93BqX25LAKCLuM+y9U2T4hlwvT1yprcna4=
+github.com/hashicorp/go-sockaddr v1.0.7 h1:G+pTkSO01HpR5qCxg7lxfsFEZaG+C0VssTy/9dbT+Fw=
+github.com/hashicorp/go-sockaddr v1.0.7/go.mod h1:FZQbEYa1pxkQ7WLpyXJ6cbjpT8q0YgQaK/JakXqGyWw=
+github.com/hashicorp/go-uuid v1.0.2/go.mod h1:6SBZvOh/SIDV7/2o3Jml5SYk/TvGqwFJ/bN7x4byOro=
+github.com/hashicorp/go-uuid v1.0.3 h1:2gKiV6YVmrJ1i2CKKa9obLvRieoRGviZFL26PcT/Co8=
+github.com/hashicorp/go-uuid v1.0.3/go.mod h1:6SBZvOh/SIDV7/2o3Jml5SYk/TvGqwFJ/bN7x4byOro=
+github.com/hashicorp/hcl v1.0.1-vault-7 h1:ag5OxFVy3QYTFTJODRzTKVZ6xvdfLLCA1cy/Y6xGI0I=
+github.com/hashicorp/hcl v1.0.1-vault-7/go.mod h1:XYhtn6ijBSAj6n4YqAaf7RBPS4I06AItNorpy+MoQNM=
+github.com/hashicorp/hcl/v2 v2.18.1 h1:6nxnOJFku1EuSawSD81fuviYUV8DxFr3fp2dUi3ZYSo=
+github.com/hashicorp/hcl/v2 v2.18.1/go.mod h1:ThLC89FV4p9MPW804KVbe/cEXoQ8NZEh+JtMeeGErHE=
+github.com/huandu/xstrings v1.5.0 h1:2ag3IFq9ZDANvthTwTiqSSZLjDc+BedvHPAp5tJy2TI=
+github.com/huandu/xstrings v1.5.0/go.mod h1:y5/lhBue+AyNmUVz9RLU9xbLR0o4KIIExikq4ovT0aE=
+github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8=
+github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
+github.com/jcmturner/aescts/v2 v2.0.0 h1:9YKLH6ey7H4eDBXW8khjYslgyqG2xZikXP0EQFKrle8=
+github.com/jcmturner/aescts/v2 v2.0.0/go.mod h1:AiaICIRyfYg35RUkr8yESTqvSy7csK90qZ5xfvvsoNs=
+github.com/jcmturner/dnsutils/v2 v2.0.0 h1:lltnkeZGL0wILNvrNiVCR6Ro5PGU/SeBvVO/8c/iPbo=
+github.com/jcmturner/dnsutils/v2 v2.0.0/go.mod h1:b0TnjGOvI/n42bZa+hmXL+kFJZsFT7G4t3HTlQ184QM=
+github.com/jcmturner/gofork v1.7.6 h1:QH0l3hzAU1tfT3rZCnW5zXl+orbkNMMRGJfdJjHVETg=
+github.com/jcmturner/gofork v1.7.6/go.mod h1:1622LH6i/EZqLloHfE7IeZ0uEJwMSUyQ/nDd82IeqRo=
+github.com/jcmturner/goidentity/v6 v6.0.1 h1:VKnZd2oEIMorCTsFBnJWbExfNN7yZr3EhJAxwOkZg6o=
+github.com/jcmturner/goidentity/v6 v6.0.1/go.mod h1:X1YW3bgtvwAXju7V3LCIMpY0Gbxyjn/mY9zx4tFonSg=
+github.com/jcmturner/gokrb5/v8 v8.4.4 h1:x1Sv4HaTpepFkXbt2IkL29DXRf8sOfZXo8eRKh687T8=
+github.com/jcmturner/gokrb5/v8 v8.4.4/go.mod h1:1btQEpgT6k+unzCwX1KdWMEwPPkkgBtP+F6aCACiMrs=
+github.com/jcmturner/rpc/v2 v2.0.3 h1:7FXXj8Ti1IaVFpSAziCZWNzbNuZmnvw/i6CqLNdWfZY=
+github.com/jcmturner/rpc/v2 v2.0.3/go.mod h1:VUJYCIDm3PVOEHw8sgt091/20OJjskO/YJki3ELg/Hc=
+github.com/jonboulle/clockwork v0.5.0 h1:Hyh9A8u51kptdkR+cqRpT1EebBwTn1oK9YfGYbdFz6I=
+github.com/jonboulle/clockwork v0.5.0/go.mod h1:3mZlmanh0g2NDKO5TWZVJAfofYk64M7XN3SzBPjZF60=
 github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI2bnpBCr8=
 github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck=
-github.com/konsorten/go-windows-terminal-sequences v1.0.1/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ=
-github.com/konsorten/go-windows-terminal-sequences v1.0.3/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ=
-github.com/kr/logfmt v0.0.0-20140226030751-b84e30acd515/go.mod h1:+0opPa2QZZtGFBFZlji/RkVcI2GknAs/DXo4wKdlNEc=
+github.com/klauspost/compress v1.19.1 h1:VsB4HPswih7mmZ8WleSFQ75c/Ui1M4trX5oAsJnhSlk=
+github.com/klauspost/compress v1.19.1/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ=
 github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
-github.com/kr/pretty v0.2.1/go.mod h1:ipq/a2n7PKx3OHsz4KJII5eveXtPO4qwEXGdVfWzfnI=
-github.com/kr/pretty v0.3.0 h1:WgNl7dwNpEZ6jJ9k1snq4pZsg7DOEN8hP9Xw0Tsjwk0=
-github.com/kr/pretty v0.3.0/go.mod h1:640gp4NfQd8pI5XOwp5fnNeVWj67G7CFk/SaSQn7NBk=
+github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
+github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
 github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
 github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
 github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
 github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
-github.com/kylelemons/godebug v0.0.0-20170820004349-d65d576e9348/go.mod h1:B69LEHPfb2qLo0BaaOLcbitczOKLWTsrBG9LczfCD4k=
 github.com/kylelemons/godebug v1.1.0 h1:RPNrshWIDI6G2gRW9EHilWtl7Z6Sb1BR0xunSBf0SNc=
 github.com/kylelemons/godebug v1.1.0/go.mod h1:9/0rRGxNHcop5bhtWyNeEfOS8JIWk580+fNqagV/RAw=
-github.com/lib/pq v1.10.5 h1:J+gdV2cUmX7ZqL2B0lFcW0m+egaHC2V3lpO8nWxyYiQ=
-github.com/lib/pq v1.10.5/go.mod h1:AlVN5x4E4T544tWzH6hKfbfQvm3HdbOxrmggDNAPY9o=
+github.com/lib/pq v1.12.3 h1:tTWxr2YLKwIvK90ZXEw8GP7UFHtcbTtty8zsI+YjrfQ=
+github.com/lib/pq v1.12.3/go.mod h1:/p+8NSbOcwzAEI7wiMXFlgydTwcgTr3OSKMsD2BitpA=
 github.com/mattermost/xml-roundtrip-validator v0.1.0 h1:RXbVD2UAl7A7nOTR4u7E3ILa4IbtvKBHw64LDsmu9hU=
 github.com/mattermost/xml-roundtrip-validator v0.1.0/go.mod h1:qccnGMcpgwcNaBnxqpJpWWUiPNr5H3O8eDgGV9gT5To=
-github.com/mattn/go-sqlite3 v1.14.15 h1:vfoHhTN1af61xCRSWzFIWzx2YskyMTwHLrExkBOjvxI=
-github.com/mattn/go-sqlite3 v1.14.15/go.mod h1:2eHXhiwb8IkHr+BDWZGa96P6+rkvnG63S2DGjv9HUNg=
-github.com/matttproud/golang_protobuf_extensions v1.0.1 h1:4hp9jkHxhMHkqkrB3Ix0jegS5sx/RkqARlsWZ6pIwiU=
-github.com/matttproud/golang_protobuf_extensions v1.0.1/go.mod h1:D8He9yQNgCq6Z5Ld7szi9bcBfOoFv/3dc6xSMkL2PC0=
-github.com/mitchellh/copystructure v1.0.0 h1:Laisrj+bAB6b/yJwB5Bt3ITZhGJdqmxquMKeZ+mmkFQ=
-github.com/mitchellh/copystructure v1.0.0/go.mod h1:SNtv71yrdKgLRyLFxmLdkAbkKEFWgYaq1OVrnRcwhnw=
-github.com/mitchellh/go-wordwrap v0.0.0-20150314170334-ad45545899c7 h1:DpOJ2HYzCv8LZP15IdmG+YdwD2luVPHITV96TkirNBM=
-github.com/mitchellh/go-wordwrap v0.0.0-20150314170334-ad45545899c7/go.mod h1:ZXFpozHsX6DPmq2I0TCekCxypsnAUbP2oI0UX1GXzOo=
-github.com/mitchellh/reflectwalk v1.0.0 h1:9D+8oIskB4VJBN5SFlmc27fSlIBZaov1Wpk/IfikLNY=
-github.com/mitchellh/reflectwalk v1.0.0/go.mod h1:mSTlrgnPZtwu0c4WaC2kGObEpuNDbx0jmZXqmk4esnw=
-github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
-github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
-github.com/modern-go/reflect2 v0.0.0-20180701023420-4b7aa43c6742/go.mod h1:bx2lNnkwVCuqBIxFjflWJWanXIb3RllmbCylyMrvgv0=
-github.com/modern-go/reflect2 v1.0.1/go.mod h1:bx2lNnkwVCuqBIxFjflWJWanXIb3RllmbCylyMrvgv0=
-github.com/modern-go/reflect2 v1.0.2/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk=
-github.com/mwitkow/go-conntrack v0.0.0-20161129095857-cc309e4a2223/go.mod h1:qRWi+5nqEBWmkhHvq77mSJWrCKwh8bxhgT7d/eI7P4U=
-github.com/mwitkow/go-conntrack v0.0.0-20190716064945-2f068394615f/go.mod h1:qRWi+5nqEBWmkhHvq77mSJWrCKwh8bxhgT7d/eI7P4U=
-github.com/oklog/run v1.1.0 h1:GEenZ1cK0+q0+wsJew9qUg/DyD8k3JzYsZAi5gYi2mA=
-github.com/oklog/run v1.1.0/go.mod h1:sVPdnTZT1zYwAJeCMu2Th4T21pA3FPOQRfWjQlk7DVU=
-github.com/pkg/diff v0.0.0-20210226163009-20ebb0f2a09e/go.mod h1:pJLUxLENpZxwdsKMEsNbx1VGcRFpLqf3715MtcvvzbA=
-github.com/pkg/errors v0.8.0/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
+github.com/mattn/go-colorable v0.1.15 h1:+u9SLTRGnXv73cEsnsmoZBom+dMU88B2M0aDcWy0/jY=
+github.com/mattn/go-colorable v0.1.15/go.mod h1:6LmQG8QLFO4G5z1gPvYEzlUgJ2wF+stgPZH1UqBm1s8=
+github.com/mattn/go-isatty v0.0.22 h1:j8l17JJ9i6VGPUFUYoTUKPSgKe/83EYU2zBC7YNKMw4=
+github.com/mattn/go-isatty v0.0.22/go.mod h1:ZXfXG4SQHsB/w3ZeOYbR0PrPwLy+n6xiMrJlRFqopa4=
+github.com/mattn/go-runewidth v0.0.19 h1:v++JhqYnZuu5jSKrk9RbgF5v4CGUjqRfBm05byFGLdw=
+github.com/mattn/go-runewidth v0.0.19/go.mod h1:XBkDxAl56ILZc9knddidhrOlY5R/pDhgLpndooCuJAs=
+github.com/mattn/go-sqlite3 v1.14.48 h1:7XHIgl0a8HwOaiK4E47ozLkST78rR9+OtNGx27D/TFs=
+github.com/mattn/go-sqlite3 v1.14.48/go.mod h1:6JTjA44L93a0QCyJef5YvlPoKXntQPjzWv5gtm9sB6w=
+github.com/mitchellh/copystructure v1.2.0 h1:vpKXTN4ewci03Vljg/q9QvCGUDttBOGBIa15WveJJGw=
+github.com/mitchellh/copystructure v1.2.0/go.mod h1:qLl+cE2AmVv+CoeAwDPye/v+N2HKCj9FbZEVFJRxO9s=
+github.com/mitchellh/go-wordwrap v1.0.1 h1:TLuKupo69TCn6TQSyGxwI1EblZZEsQ0vMlAFQflz0v0=
+github.com/mitchellh/go-wordwrap v1.0.1/go.mod h1:R62XHJLzvMFRBbcrT7m7WgmE1eOyTSsCt+hzestvNj0=
+github.com/mitchellh/mapstructure v1.5.0 h1:jeMsZIYE/09sWLaz43PL7Gy6RuMjD2eJVyuac5Z2hdY=
+github.com/mitchellh/mapstructure v1.5.0/go.mod h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RRV2QTWOzhPopBRo=
+github.com/mitchellh/reflectwalk v1.0.2 h1:G2LzWKi524PWgd3mLHV8Y5k7s6XUvT0Gef6zxSIeXaQ=
+github.com/mitchellh/reflectwalk v1.0.2/go.mod h1:mSTlrgnPZtwu0c4WaC2kGObEpuNDbx0jmZXqmk4esnw=
+github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq1c1nUAm88MOHcQC9l5mIlSMApZMrHA=
+github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=
+github.com/oklog/run v1.2.0 h1:O8x3yXwah4A73hJdlrwo/2X6J62gE5qTMusH0dvz60E=
+github.com/oklog/run v1.2.0/go.mod h1:mgDbKRSwPhJfesJ4PntqFUbKQRZ50NgmZTSPlFA0YFk=
+github.com/olekukonko/cat v0.0.0-20250911104152-50322a0618f6 h1:zrbMGy9YXpIeTnGj4EljqMiZsIcE09mmF8XsD5AYOJc=
+github.com/olekukonko/cat v0.0.0-20250911104152-50322a0618f6/go.mod h1:rEKTHC9roVVicUIfZK7DYrdIoM0EOr8mK1Hj5s3JjH0=
+github.com/olekukonko/errors v1.1.0 h1:RNuGIh15QdDenh+hNvKrJkmxxjV4hcS50Db478Ou5sM=
+github.com/olekukonko/errors v1.1.0/go.mod h1:ppzxA5jBKcO1vIpCXQ9ZqgDh8iwODz6OXIGKU8r5m4Y=
+github.com/olekukonko/ll v0.1.4-0.20260115111900-9e59c2286df0 h1:jrYnow5+hy3WRDCBypUFvVKNSPPCdqgSXIE9eJDD8LM=
+github.com/olekukonko/ll v0.1.4-0.20260115111900-9e59c2286df0/go.mod h1:b52bVQRRPObe+yyBl0TxNfhesL0nedD4Cht0/zx55Ew=
+github.com/olekukonko/tablewriter v1.1.3 h1:VSHhghXxrP0JHl+0NnKid7WoEmd9/urKRJLysb70nnA=
+github.com/olekukonko/tablewriter v1.1.3/go.mod h1:9VU0knjhmMkXjnMKrZ3+L2JhhtsQ/L38BbL3CRNE8tM=
+github.com/openbao/openbao/api/v2 v2.6.0 h1:KvfspAaL9bab9hI8jFYkV2cgtSrwWtaG+k9AUTHWU4M=
+github.com/openbao/openbao/api/v2 v2.6.0/go.mod h1:H4IWiH+2rgF/TbrsUbsfrMyGoqojkLqxPCRLENSMnSo=
+github.com/philhofer/fwd v1.2.0 h1:e6DnBTl7vGY+Gz322/ASL4Gyp1FspeMvx1RNDoToZuM=
+github.com/philhofer/fwd v1.2.0/go.mod h1:RqIHx9QI14HlwKwm98g9Re5prTQ6LdeRQn+gXJFxsJM=
 github.com/pkg/errors v0.8.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
 github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
-github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
-github.com/prometheus/client_golang v0.9.1/go.mod h1:7SWBe2y4D6OKWSNQJUaRYU/AaXPKyh/dDVn+NZz0KFw=
-github.com/prometheus/client_golang v1.0.0/go.mod h1:db9x61etRT2tGnBNRi70OPL5FsnadC4Ky3P0J6CfImo=
-github.com/prometheus/client_golang v1.7.1/go.mod h1:PY5Wy2awLA44sXw4AOSfFBetzPP4j5+D6mVACh+pe2M=
-github.com/prometheus/client_golang v1.11.0/go.mod h1:Z6t4BnS23TR94PD6BsDNk8yVqroYurpAkEiz0P2BEV0=
-github.com/prometheus/client_golang v1.11.1/go.mod h1:Z6t4BnS23TR94PD6BsDNk8yVqroYurpAkEiz0P2BEV0=
-github.com/prometheus/client_golang v1.12.1/go.mod h1:3Z9XVyYiZYEO+YQWt3RD2R3jrbd179Rt297l4aS6nDY=
-github.com/prometheus/client_golang v1.13.0 h1:b71QUfeo5M8gq2+evJdTPfZhYMAU0uKPkyPJ7TPsloU=
-github.com/prometheus/client_golang v1.13.0/go.mod h1:vTeo+zgvILHsnnj/39Ou/1fPN5nJFOEMgftOUOmlvYQ=
-github.com/prometheus/client_model v0.0.0-20180712105110-5c3871d89910/go.mod h1:MbSGuTsp3dbXC40dX6PRTWyKYBIrTGTE9sqQNg2J8bo=
-github.com/prometheus/client_model v0.0.0-20190129233127-fd36f4220a90/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
-github.com/prometheus/client_model v0.0.0-20190812154241-14fe0d1b01d4/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
-github.com/prometheus/client_model v0.2.0 h1:uq5h0d+GuxiXLJLNABMgp2qUWDPiLvgCzz2dUR+/W/M=
-github.com/prometheus/client_model v0.2.0/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
-github.com/prometheus/common v0.4.1/go.mod h1:TNfzLD0ON7rHzMJeJkieUDPYmFC7Snx/y86RQel1bk4=
-github.com/prometheus/common v0.10.0/go.mod h1:Tlit/dnDKsSWFlCLTWaA1cyBgKHSMdTB80sz/V91rCo=
-github.com/prometheus/common v0.26.0/go.mod h1:M7rCNAaPfAosfx8veZJCuw84e35h3Cfd9VFqTh1DIvc=
-github.com/prometheus/common v0.32.1/go.mod h1:vu+V0TpY+O6vW9J44gczi3Ap/oXXR10b+M/gUGO4Hls=
-github.com/prometheus/common v0.37.0 h1:ccBbHCgIiT9uSoFY0vX8H3zsNR5eLt17/RQLUvn8pXE=
-github.com/prometheus/common v0.37.0/go.mod h1:phzohg0JFMnBEFGxTDbfu3QyL5GI8gTQJFhYO5B3mfA=
-github.com/prometheus/procfs v0.0.0-20181005140218-185b4288413d/go.mod h1:c3At6R/oaqEKCNdg8wHV1ftS6bRYblBhIjjI8uT2IGk=
-github.com/prometheus/procfs v0.0.2/go.mod h1:TjEm7ze935MbeOT/UhFTIMYKhuLP4wbCsTZCD3I8kEA=
-github.com/prometheus/procfs v0.1.3/go.mod h1:lV6e/gmhEcM9IjHGsFOCxxuZ+z1YqCvr4OA4YeYWdaU=
-github.com/prometheus/procfs v0.6.0/go.mod h1:cz+aTbrPOrUb4q7XlbU9ygM+/jj0fzG6c1xBZuNvfVA=
-github.com/prometheus/procfs v0.7.3/go.mod h1:cz+aTbrPOrUb4q7XlbU9ygM+/jj0fzG6c1xBZuNvfVA=
-github.com/prometheus/procfs v0.8.0 h1:ODq8ZFEaYeCaZOJlZZdJA2AbQR98dSHSM1KW/You5mo=
-github.com/prometheus/procfs v0.8.0/go.mod h1:z7EfXMXOkbkqb9IINtpCn86r/to3BnA0uaxHdg830/4=
-github.com/rogpeppe/fastuuid v1.2.0/go.mod h1:jVj6XXZzXRy/MSR5jhDC/2q6DgLz+nrA6LYCDYWNEvQ=
-github.com/rogpeppe/go-internal v1.3.0/go.mod h1:M8bDsm7K2OlrFYOpmOWEs/qY81heoFRclV5y23lUDJ4=
-github.com/rogpeppe/go-internal v1.6.1/go.mod h1:xXDCJY+GAPziupqXw64V24skbSoqbTEfhy4qGm1nDQc=
-github.com/rogpeppe/go-internal v1.8.0 h1:FCbCCtXNOY3UtUuHUYaghJg4y7Fd14rXifAYUAtL9R8=
-github.com/rogpeppe/go-internal v1.8.0/go.mod h1:WmiCO8CzOY8rg0OYDC4/i/2WRWAB6poM+XZ2dLUbcbE=
-github.com/russellhaering/goxmldsig v1.2.0 h1:Y6GTTc9Un5hCxSzVz4UIWQ/zuVwDvzJk80guqzwx6Vg=
-github.com/russellhaering/goxmldsig v1.2.0/go.mod h1:gM4MDENBQf7M+V824SGfyIUVFWydB7n0KkEubVJl+Tw=
+github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRIccs7FGNTlIRMkT8wgtp5eCXdBlqhYGL6U=
+github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/pquerna/otp v1.5.0 h1:NMMR+WrmaqXU4EzdGJEE1aUUI0AMRzsp96fFFWNPwxs=
+github.com/pquerna/otp v1.5.0/go.mod h1:dkJfzwRKNiegxyNb54X/3fLwhCynbMspSyWKnvi1AEg=
+github.com/prometheus/client_golang v1.24.1 h1:JnJkREXzWxUdCuPFpIWZiPispT9xVV59uiuyR2bPlnU=
+github.com/prometheus/client_golang v1.24.1/go.mod h1:F+oSRECHg4sse5ucfYpYDeIv/hu68Zo0uoHKetWnzcE=
+github.com/prometheus/client_model v0.6.2 h1:oBsgwpGs7iVziMvrGhE53c/GrLUsZdHnqNwqPLxwZyk=
+github.com/prometheus/client_model v0.6.2/go.mod h1:y3m2F6Gdpfy6Ut/GBsUqTWZqCUvMVzSfMLjcu6wAwpE=
+github.com/prometheus/common v0.70.1 h1:1HvjP4D5oL3t8RsPlwxA9onvvStjtIHYE5XuuwOi/PY=
+github.com/prometheus/common v0.70.1/go.mod h1:VdFUQDMZK3VLkurFUVhia6uys/0suUp86TJz5qbJRhc=
+github.com/prometheus/procfs v0.21.1 h1:GljZCt+zSTS+NZq88cyQ1LjZ+RCHp3uVuabBWA5+OJI=
+github.com/prometheus/procfs v0.21.1/go.mod h1:aB55Cww9pdSJVHk0hUf0inxWyyjPogFIjmHKYgMKmtY=
+github.com/rogpeppe/go-internal v1.14.1 h1:UQB4HGPB6osV0SQTLymcB4TgvyWu6ZyliaW0tI/otEQ=
+github.com/rogpeppe/go-internal v1.14.1/go.mod h1:MaRKkUm5W0goXpeCfT7UZI6fk/L7L7so1lCWt35ZSgc=
+github.com/russellhaering/goxmldsig v1.6.0 h1:8fdWXEPh2k/NZNQBPFNoVfS3JmzS4ZprY/sAOpKQLks=
+github.com/russellhaering/goxmldsig v1.6.0/go.mod h1:TrnaquDcYxWXfJrOjeMBTX4mLBeYAqaHEyUeWPxZlBM=
 github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
-github.com/sergi/go-diff v1.0.0 h1:Kpca3qRNrduNnOQeazBd0ysaKrUJiIuISHxogkT9RPQ=
-github.com/sergi/go-diff v1.0.0/go.mod h1:0CfEIISq7TuYL3j771MWULgwwjU+GofnZX9QAmXWZgo=
-github.com/shopspring/decimal v1.2.0 h1:abSATXmQEYyShuxI4/vyW3tV1MrKAJzCZ/0zLUXYbsQ=
-github.com/shopspring/decimal v1.2.0/go.mod h1:DKyhrW/HYNuLGql+MJL6WCR6knT2jwCFRcu2hWCYk4o=
-github.com/sirupsen/logrus v1.2.0/go.mod h1:LxeOpSwHxABJmUn/MG1IvRgCAasNZTLOkJPxbbu5VWo=
-github.com/sirupsen/logrus v1.4.2/go.mod h1:tLMulIdttU9McNUspp0xgXVQah82FyeX6MwdIuYE2rE=
-github.com/sirupsen/logrus v1.6.0/go.mod h1:7uNnSEd1DgxDLC74fIahvMZmmYsHGZGEOFrfsX/uA88=
-github.com/sirupsen/logrus v1.9.0 h1:trlNQbNUG3OdDrDil03MCb1H2o9nJ1x4/5LYw7byDE0=
-github.com/sirupsen/logrus v1.9.0/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ=
-github.com/spaolacci/murmur3 v0.0.0-20180118202830-f09979ecbc72/go.mod h1:JwIasOWyU6f++ZhiEuf87xNszmSA2myDM2Kzu9HwQUA=
-github.com/spf13/cast v1.3.1/go.mod h1:Qx5cxh0v+4UWYiBimWS+eyWzqEqokIECu5etghLkUJE=
-github.com/spf13/cast v1.4.1 h1:s0hze+J0196ZfEMTs80N7UlFt0BDuQ7Q+JDnHiMWKdA=
-github.com/spf13/cast v1.4.1/go.mod h1:Qx5cxh0v+4UWYiBimWS+eyWzqEqokIECu5etghLkUJE=
-github.com/spf13/cobra v1.5.0 h1:X+jTBEBqF0bHN+9cSMgmfuvv2VHJ9ezmFNf9Y/XstYU=
-github.com/spf13/cobra v1.5.0/go.mod h1:dWXEIy2H428czQCjInthrTRUg7yKbok+2Qi/yBIJoUM=
-github.com/spf13/pflag v1.0.2/go.mod h1:DYY7MBk1bdzusC3SYhjObp+wFpr4gzcvqqNjLnInEg4=
-github.com/spf13/pflag v1.0.5 h1:iy+VFUOCP1a+8yFto/drg2CJ5u0yRoB7fZw3DKv/JXA=
-github.com/spf13/pflag v1.0.5/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
+github.com/ryanuber/go-glob v1.0.0 h1:iQh3xXAumdQ+4Ufa5b25cRpC5TYKlno6hsv6Cb3pkBk=
+github.com/ryanuber/go-glob v1.0.0/go.mod h1:807d1WSdnB0XRJzKNil9Om6lcp/3a0v4qIHxIXzX/Yc=
+github.com/sergi/go-diff v1.3.1 h1:xkr+Oxo4BOQKmkn/B9eMK0g5Kg/983T9DqqPHwYqD+8=
+github.com/sergi/go-diff v1.3.1/go.mod h1:aMJSSKb2lpPvRNec0+w3fl7LP9IOFzdc9Pa4NFbPK1I=
+github.com/shopspring/decimal v1.4.0 h1:bxl37RwXBklmTi0C79JfXCEBD1cqqHt0bbgBAGFp81k=
+github.com/shopspring/decimal v1.4.0/go.mod h1:gawqmDU56v4yIKSwfBSFip1HdCCXN8/+DMd9qYNcwME=
+github.com/spf13/cast v1.7.0 h1:ntdiHjuueXFgm5nzDRdOS4yfT43P5Fnud6DH50rz/7w=
+github.com/spf13/cast v1.7.0/go.mod h1:ancEpBxwJDODSW/UG4rDrAqiKolqNNh2DX3mk86cAdo=
+github.com/spf13/cobra v1.10.2 h1:DMTTonx5m65Ic0GOoRY2c16WCbHxOOw6xxezuLaBpcU=
+github.com/spf13/cobra v1.10.2/go.mod h1:7C1pvHqHw5A4vrJfjNwvOdzYu0Gml16OCs2GRiTUUS4=
+github.com/spf13/pflag v1.0.9 h1:9exaQaMOCwffKiiiYk6/BndUBv+iRViNW+4lEMi0PvY=
+github.com/spf13/pflag v1.0.9/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
-github.com/stretchr/objx v0.1.1/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/objx v0.2.0/go.mod h1:qt09Ya8vawLte6SNmTgCsAVtYtaKzEcn8ATUoHMkEqE=
-github.com/stretchr/objx v0.4.0 h1:M2gUjqZET1qApGOWNSnZ49BAIMX4F/1plDv3+l31EJ4=
 github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw=
-github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
+github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo=
+github.com/stretchr/objx v0.5.2 h1:xuMeJ0Sdp5ZMRXx/aWO6RZxdr3beISkG5/G/aIRr3pY=
+github.com/stretchr/objx v0.5.2/go.mod h1:FRsXN1f5AsAjCGJKqEizvkpNtU+EGNCLh3NxZ/8L+MA=
 github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
 github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
-github.com/stretchr/testify v1.5.1/go.mod h1:5W2xD1RspED5o8YsWQXVCued0rvSQ+mT+I5cxcmMvtA=
 github.com/stretchr/testify v1.6.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
-github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
-github.com/stretchr/testify v1.7.2/go.mod h1:R6va5+xMeoiuVRoj+gSkQ7d3FALtqAAGI1FQKckRals=
-github.com/stretchr/testify v1.8.0 h1:pSgiaMZlXftHpm5L7V1+rVB+AZJydKsMxsQBIJw4PKk=
 github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
-github.com/vmihailenco/msgpack v3.3.3+incompatible/go.mod h1:fy3FlTQTDXWkZ7Bh6AcGMlsjHatGryHQYUTf1ShIgkk=
-github.com/vmihailenco/msgpack/v4 v4.3.12/go.mod h1:gborTTJjAo/GWTqqRjrLCn9pgNN+NXzzngzBKDPIqw4=
-github.com/vmihailenco/tagparser v0.1.1/go.mod h1:OeAg3pn3UbLjkWt+rN9oFYB6u/cQgqMEUPoW2WPyhdI=
-github.com/yuin/goldmark v1.1.25/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
+github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
+github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
+github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
+github.com/tinylib/msgp v1.6.4 h1:mOwYbyYDLPj35mkA2BjjYejgJk9BuHxDdvRnb6v2ZcQ=
+github.com/tinylib/msgp v1.6.4/go.mod h1:RSp0LW9oSxFut3KzESt5Voq4GVWyS+PSulT77roAqEA=
+github.com/x448/float16 v0.8.4 h1:qLwI1I70+NjRFUR3zs1JPUCgaCXSh3SW62uAKT1mSBM=
+github.com/x448/float16 v0.8.4/go.mod h1:14CWIYCyZA/cWjXOioeEpHeN/83MdbZDRQHoFcYsOfg=
 github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
-github.com/yuin/goldmark v1.1.32/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
 github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
-github.com/yuin/goldmark v1.3.5/go.mod h1:mwnBkeHKe2W/ZEtQ+71ViKU8L12m81fl3OWwC1Zlc8k=
-github.com/zclconf/go-cty v1.2.0/go.mod h1:hOPWgoHbaTUnI5k4D2ld+GRpFJSCe6bCM7m1q/N4PQ8=
-github.com/zclconf/go-cty v1.8.0 h1:s4AvqaeQzJIu3ndv4gVIhplVD0krU+bgrcLSVUnaWuA=
-github.com/zclconf/go-cty v1.8.0/go.mod h1:vVKLxnk3puL4qRAv72AO+W99LUD4da90g3uUAzyuvAk=
-github.com/zclconf/go-cty-debug v0.0.0-20191215020915-b22d67c1ba0b/go.mod h1:ZRKQfBXbGkpdV6QMzT3rU1kSTAnfu1dO8dPKjYprgj8=
-go.etcd.io/etcd/api/v3 v3.5.4 h1:OHVyt3TopwtUQ2GKdd5wu3PmmipR4FTwCqoEjSyRdIc=
-go.etcd.io/etcd/api/v3 v3.5.4/go.mod h1:5GB2vv4A4AOn3yk7MftYGHkUfGtDHnEraIjym4dYz5A=
-go.etcd.io/etcd/client/pkg/v3 v3.5.4 h1:lrneYvz923dvC14R54XcA7FXoZ3mlGZAgmwhfm7HqOg=
-go.etcd.io/etcd/client/pkg/v3 v3.5.4/go.mod h1:IJHfcCEKxYu1Os13ZdwCwIUTUVGYTSAM3YSwc9/Ac1g=
-go.etcd.io/etcd/client/v3 v3.5.4 h1:p83BUL3tAYS0OT/r0qglgc3M1JjhM0diV8DSWAhVXv4=
-go.etcd.io/etcd/client/v3 v3.5.4/go.mod h1:ZaRkVgBZC+L+dLCjTcF1hRXpgZXQPOvnA/Ak/gq3kiY=
-go.opencensus.io v0.21.0/go.mod h1:mSImk1erAIZhrmZN+AvHh14ztQfjbGwt4TtuofqLduU=
-go.opencensus.io v0.22.0/go.mod h1:+kGneAE2xo2IficOXnaByMWTGM9T73dGwxeWcUqIpI8=
-go.opencensus.io v0.22.2/go.mod h1:yxeiOL68Rb0Xd1ddK5vPZ/oVn4vY4Ynel7k9FzqtOIw=
-go.opencensus.io v0.22.3/go.mod h1:yxeiOL68Rb0Xd1ddK5vPZ/oVn4vY4Ynel7k9FzqtOIw=
-go.opencensus.io v0.22.4/go.mod h1:yxeiOL68Rb0Xd1ddK5vPZ/oVn4vY4Ynel7k9FzqtOIw=
-go.opencensus.io v0.22.5/go.mod h1:5pWMHQbX5EPX2/62yrJeAkowc+lfs/XD7Uxpq3pI6kk=
-go.opencensus.io v0.23.0 h1:gqCw0LfLxScz8irSi8exQc7fyQ0fKQU/qnC/X8+V/1M=
-go.opencensus.io v0.23.0/go.mod h1:XItmlyltB5F7CS4xOC1DcqMoFqwtC6OG2xF7mCv7P7E=
-go.opentelemetry.io/proto/otlp v0.7.0/go.mod h1:PqfVotwruBrMGOCsRd/89rSnXhoiJIqeYNgFYFoEGnI=
-go.uber.org/atomic v1.7.0 h1:ADUqmZGgLDDfbSL9ZmPxKTybcoEYHgpYfELNoN+7hsw=
-go.uber.org/atomic v1.7.0/go.mod h1:fEN4uk6kAWBTFdckzkM89CLk9XfWZrxpCo0nPH17wJc=
-go.uber.org/multierr v1.6.0 h1:y6IPFStTAIT5Ytl7/XYmHvzXQ7S3g/IeZW9hyZ5thw4=
-go.uber.org/multierr v1.6.0/go.mod h1:cdWPpRnG4AhwMwsgIHip0KRBQjJy5kYEpYjJxpXp9iU=
-go.uber.org/zap v1.17.0 h1:MTjgFu6ZLKvY6Pvaqk97GlxNBuMpV4Hy/3P6tRGlI2U=
-go.uber.org/zap v1.17.0/go.mod h1:MXVU+bhUf/A7Xi2HNOnopQOrmycQ5Ih87HtOu4q5SSo=
-golang.org/x/crypto v0.0.0-20180904163835-0709b304e793/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
+github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
+github.com/zclconf/go-cty v1.14.4 h1:uXXczd9QDGsgu0i/QFR/hzI5NYCHLf6NQw/atrbnhq8=
+github.com/zclconf/go-cty v1.14.4/go.mod h1:VvMs5i0vgZdhYawQNq5kePSpLAoz8u1xvZgrPIxfnZE=
+github.com/zclconf/go-cty-yaml v1.1.0 h1:nP+jp0qPHv2IhUVqmQSzjvqAWcObN0KBkUl2rWBdig0=
+github.com/zclconf/go-cty-yaml v1.1.0/go.mod h1:9YLUH4g7lOhVWqUbctnVlZ5KLpg7JAprQNgxSZ1Gyxs=
+go.etcd.io/etcd/api/v3 v3.6.13 h1:AvHPZv15LYEe7tZDyFglv7xnbiuF6GMZpZqKpIzXTt0=
+go.etcd.io/etcd/api/v3 v3.6.13/go.mod h1:X9+3gaKwzjlOxzo6TZ2u3b7HcHBcAL+Ph7EBPjI/VWk=
+go.etcd.io/etcd/client/pkg/v3 v3.6.13 h1:7QeMOisYByx8dBA7/CKcwCaPWfjb5C0xpmrIov/8WyY=
+go.etcd.io/etcd/client/pkg/v3 v3.6.13/go.mod h1:Dn2zUBOCu/6xYcd6iAjB7LgoY16OTQjDZfWHLwvuQj4=
+go.etcd.io/etcd/client/v3 v3.6.13 h1:0E+9ZYGpMsi9KlOJVoCdONh9PUDawKDTy5mSNY8wOEI=
+go.etcd.io/etcd/client/v3 v3.6.13/go.mod h1:rtVI3vwobljb8xlTGcp1Yhz7hBIuBWULXwB848kqJGw=
+go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ64=
+go.opentelemetry.io/auto/sdk v1.2.1/go.mod h1:KRTj+aOaElaLi+wW1kO/DZRXwkF4C5xPbEe3ZiIhN7Y=
+go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.67.0 h1:yI1/OhfEPy7J9eoa6Sj051C7n5dvpj0QX8g4sRchg04=
+go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.67.0/go.mod h1:NoUCKYWK+3ecatC4HjkRktREheMeEtrXoQxrqYFeHSc=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.67.0 h1:OyrsyzuttWTSur2qN/Lm0m2a8yqyIjUVBZcxFPuXq2o=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.67.0/go.mod h1:C2NGBr+kAB4bk3xtMXfZ94gqFDtg/GkI7e9zqGh5Beg=
+go.opentelemetry.io/otel v1.44.0 h1:JjwHmHpA4iZ3wBxluu2fbbE7j4kqlE8jXyAyPXH7HqU=
+go.opentelemetry.io/otel v1.44.0/go.mod h1:BMgjTHL9WPRlRjL2oZCBTL4whCGtXch2H4BhOPIAyYc=
+go.opentelemetry.io/otel/metric v1.44.0 h1:1w0gILTcHdr3YI+ixLyjemwrVnsMURbTZFrSYCdDdmc=
+go.opentelemetry.io/otel/metric v1.44.0/go.mod h1:8O7hanEPBNgEMmybD3s2VBKcgWOCsA6tzHBPODAiquo=
+go.opentelemetry.io/otel/sdk v1.44.0 h1:nHYwb9lK+fJPU/dnT6s7W7Z8itMWyqrnVfbheVYrZ58=
+go.opentelemetry.io/otel/sdk v1.44.0/go.mod h1:Osuydd3Se74nqjAKxid74N5eC+jfEqfTegHRnq58oK0=
+go.opentelemetry.io/otel/sdk/metric v1.44.0 h1:3LlKgI+VjbVsjNRFZJZAJ30WjXC5VkNRks6si09iEfI=
+go.opentelemetry.io/otel/sdk/metric v1.44.0/go.mod h1:5B5pMARnXxKhltooO4xUuCBorl65a4EpnTalObqOigA=
+go.opentelemetry.io/otel/trace v1.44.0 h1:jxF5CsGYCe74MCRx2X4g7WsY/VBKRqqpNvXlX/6gtIk=
+go.opentelemetry.io/otel/trace v1.44.0/go.mod h1:oLl1jrMQAVo6v3GAggN+1VH9VIz9iUSvW53sW1Q8PIE=
+go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
+go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE=
+go.uber.org/mock v0.6.0 h1:hyF9dfmbgIX5EfOdasqLsWD6xqpNZlXblLB/Dbnwv3Y=
+go.uber.org/mock v0.6.0/go.mod h1:KiVJ4BqZJaMj4svdfmHM0AUx4NJYO8ZNpPnZn1Z+BBU=
+go.uber.org/multierr v1.11.0 h1:blXXJkSxSSfBVBlC76pxqeO+LN3aDfLQo+309xJstO0=
+go.uber.org/multierr v1.11.0/go.mod h1:20+QtiLqy0Nd6FdQB9TLXag12DsQkrbs3htMFfDN80Y=
+go.uber.org/zap v1.27.0 h1:aJMhYGrd5QSmlpLMr2MftRKl7t8J8PTZPA732ud/XR8=
+go.uber.org/zap v1.27.0/go.mod h1:GB2qFLM7cTU87MWRP2mPIjqfIDnGu+VIO4V/SdhGo2E=
+go.yaml.in/yaml/v2 v2.4.4 h1:tuyd0P+2Ont/d6e2rl3be67goVK4R6deVxCUX5vyPaQ=
+go.yaml.in/yaml/v2 v2.4.4/go.mod h1:gMZqIpDtDqOfM0uNfy0SkpRhvUryYH0Z6wdMYcacYXQ=
+go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc=
+go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
-golang.org/x/crypto v0.0.0-20190426145343-a29dc8fdc734/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
-golang.org/x/crypto v0.0.0-20190510104115-cbcb75029529/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
-golang.org/x/crypto v0.0.0-20190605123033-f99c8df09eb5/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
-golang.org/x/crypto v0.0.0-20200414173820-0848c9571904/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
 golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
-golang.org/x/crypto v0.0.0-20220622213112-05595931fe9d h1:sK3txAijHtOK88l68nt020reeT1ZdKLIYetKl95FzVY=
-golang.org/x/crypto v0.0.0-20220622213112-05595931fe9d/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
-golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
-golang.org/x/exp v0.0.0-20190306152737-a1d7652674e8/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
-golang.org/x/exp v0.0.0-20190510132918-efd6b22b2522/go.mod h1:ZjyILWgesfNpC6sMxTJOJm9Kp84zZh5NQWvqDGG3Qr8=
-golang.org/x/exp v0.0.0-20190829153037-c13cbed26979/go.mod h1:86+5VVa7VpoJ4kLfm080zCjGlMRFzhUhsZKEZO7MGek=
-golang.org/x/exp v0.0.0-20191030013958-a1ab85dbe136/go.mod h1:JXzH8nQsPlswgeRAPE3MuO9GYsAcnJvJ4vnMwN/5qkY=
-golang.org/x/exp v0.0.0-20191129062945-2f5052295587/go.mod h1:2RIsYlXP63K8oxa1u096TMicItID8zy7Y6sNkU49FU4=
-golang.org/x/exp v0.0.0-20191227195350-da58074b4299/go.mod h1:2RIsYlXP63K8oxa1u096TMicItID8zy7Y6sNkU49FU4=
-golang.org/x/exp v0.0.0-20200119233911-0405dc783f0a/go.mod h1:2RIsYlXP63K8oxa1u096TMicItID8zy7Y6sNkU49FU4=
-golang.org/x/exp v0.0.0-20200207192155-f17229e696bd/go.mod h1:J/WKrq2StrnmMY6+EHIKF9dgMWnmCNThgcyBT1FY9mM=
-golang.org/x/exp v0.0.0-20200224162631-6cc2880d07d6/go.mod h1:3jZMyOhIsHpP37uCMkUooju7aAi5cS1Q23tOzKc+0MU=
-golang.org/x/image v0.0.0-20190227222117-0694c2d4d067/go.mod h1:kZ7UVZpmo3dzQBMxlp+ypCbDeSB+sBbTgSJuh5dn5js=
-golang.org/x/image v0.0.0-20190802002840-cff245a6509b/go.mod h1:FeLwcggjj3mMvU+oOTbSwawSJRM1uh48EjtB4UJZlP0=
-golang.org/x/lint v0.0.0-20181026193005-c67002cb31c3/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
-golang.org/x/lint v0.0.0-20190227174305-5b3e6a55c961/go.mod h1:wehouNa3lNwaWXcvxsM5YxQ5yQlVC4a0KAMCusXpPoU=
-golang.org/x/lint v0.0.0-20190301231843-5614ed5bae6f/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
-golang.org/x/lint v0.0.0-20190313153728-d0100b6bd8b3/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
-golang.org/x/lint v0.0.0-20190409202823-959b441ac422/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
-golang.org/x/lint v0.0.0-20190909230951-414d861bb4ac/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
-golang.org/x/lint v0.0.0-20190930215403-16217165b5de/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
-golang.org/x/lint v0.0.0-20191125180803-fdd1cda4f05f/go.mod h1:5qLYkcX4OjUUV8bRuDixDT3tpyyb+LUpUlRWLxfhWrs=
-golang.org/x/lint v0.0.0-20200130185559-910be7a94367/go.mod h1:3xt1FjdF8hUf6vQPIChWIBhFzV8gjjsPE/fR3IyQdNY=
-golang.org/x/lint v0.0.0-20200302205851-738671d3881b/go.mod h1:3xt1FjdF8hUf6vQPIChWIBhFzV8gjjsPE/fR3IyQdNY=
-golang.org/x/lint v0.0.0-20201208152925-83fdc39ff7b5/go.mod h1:3xt1FjdF8hUf6vQPIChWIBhFzV8gjjsPE/fR3IyQdNY=
-golang.org/x/lint v0.0.0-20210508222113-6edffad5e616/go.mod h1:3xt1FjdF8hUf6vQPIChWIBhFzV8gjjsPE/fR3IyQdNY=
-golang.org/x/mobile v0.0.0-20190312151609-d3739f865fa6/go.mod h1:z+o9i4GpDbdi3rU15maQ/Ox0txvL9dWGYEHz965HBQE=
-golang.org/x/mobile v0.0.0-20190719004257-d2bd2a29d028/go.mod h1:E/iHnbuqvinMTCcRqshq8CkpyQDoeVncDDYHnLhea+o=
-golang.org/x/mod v0.0.0-20190513183733-4bf6d317e70e/go.mod h1:mXi4GBBbnImb6dmsKGUJ2LatrhH/nqhxcFungHvyanc=
-golang.org/x/mod v0.1.0/go.mod h1:0QHyrYULN0/3qlju5TqG8bIK38QM8yzMo5ekMj3DlcY=
-golang.org/x/mod v0.1.1-0.20191105210325-c90efee705ee/go.mod h1:QqPTAvyqsEbceGzBzNggFXnrqF1CaUcvgkdR5Ot7KZg=
-golang.org/x/mod v0.1.1-0.20191107180719-034126e5016b/go.mod h1:QqPTAvyqsEbceGzBzNggFXnrqF1CaUcvgkdR5Ot7KZg=
+golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
+golang.org/x/crypto v0.6.0/go.mod h1:OFC/31mSvZgRz0V1QTNCzfAI1aIRzbiufJtkMIlEp58=
+golang.org/x/crypto v0.54.0 h1:YLIA59K4fiNzHzjnZt2tUJQjQtUWfWbeHBqKtk3eScw=
+golang.org/x/crypto v0.54.0/go.mod h1:KWL8ny2AZdGR2cWmzeHrp2azQPGogOv+HeQaVEXC2dk=
+golang.org/x/exp v0.0.0-20240823005443-9b4947da3948 h1:kx6Ds3MlpiUHKj7syVnbp57++8WpuKPcR5yjLBjvLEA=
+golang.org/x/exp v0.0.0-20240823005443-9b4947da3948/go.mod h1:akd2r19cwCdwSwWeIdzYQGa/EZZyqcOdwWiwj5L5eKQ=
 golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
-golang.org/x/mod v0.4.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
-golang.org/x/mod v0.4.1/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
-golang.org/x/mod v0.4.2/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
-golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4 h1:6zppjxzCulZykYSLyVDYbneBfbaBIQPYMevg0bEwv2s=
 golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
-golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
-golang.org/x/net v0.0.0-20180811021610-c39426892332/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
-golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
-golang.org/x/net v0.0.0-20181114220301-adae6a3d119a/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
-golang.org/x/net v0.0.0-20190108225652-1e06a53dbb7e/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
-golang.org/x/net v0.0.0-20190213061140-3a22650c66bd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
-golang.org/x/net v0.0.0-20190311183353-d8887717615a/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
+golang.org/x/mod v0.37.0 h1:vF1DjpVEshcIqoEaauuHebaLk1O1forxjxBaVn884JQ=
+golang.org/x/mod v0.37.0/go.mod h1:m8S8VeM9r4dzDwjrKO0a1sZP3YjeMamRRlD+fmR2Q/0=
 golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
-golang.org/x/net v0.0.0-20190501004415-9ce7a6920f09/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
-golang.org/x/net v0.0.0-20190503192946-f4e77d36d62c/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
-golang.org/x/net v0.0.0-20190603091049-60506f45cf65/go.mod h1:HSz+uSET+XFnRR8LxR5pz3Of3rY3CfYBVs4xY44aLks=
-golang.org/x/net v0.0.0-20190613194153-d28f0bde5980/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20190628185345-da137c7871d7/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20190724013045-ca1201d0de80/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20191209160850-c0dbc17a3553/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20200114155413-6afb5195e5aa/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20200202094626-16171245cfb2/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20200222125558-5a598a2470a0/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20200301022130-244492dfa37a/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20200324143707-d3edc9973b7e/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
-golang.org/x/net v0.0.0-20200501053045-e0ff5e5a1de5/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
-golang.org/x/net v0.0.0-20200506145744-7e3656a0809f/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
-golang.org/x/net v0.0.0-20200513185701-a91f0712d120/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
-golang.org/x/net v0.0.0-20200520182314-0ba52f642ac2/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
-golang.org/x/net v0.0.0-20200625001655-4c5254603344/go.mod h1:/O7V0waA8r7cgGh81Ro3o1hOxt32SMVPicZroKQ2sZA=
-golang.org/x/net v0.0.0-20200707034311-ab3426394381/go.mod h1:/O7V0waA8r7cgGh81Ro3o1hOxt32SMVPicZroKQ2sZA=
-golang.org/x/net v0.0.0-20200822124328-c89045814202/go.mod h1:/O7V0waA8r7cgGh81Ro3o1hOxt32SMVPicZroKQ2sZA=
 golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
-golang.org/x/net v0.0.0-20201031054903-ff519b6c9102/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
-golang.org/x/net v0.0.0-20201110031124-69a78807bb2b/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
-golang.org/x/net v0.0.0-20201209123823-ac852fbbde11/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
-golang.org/x/net v0.0.0-20210119194325-5f4716e94777/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
 golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
-golang.org/x/net v0.0.0-20210316092652-d523dce5a7f4/go.mod h1:RBQZq4jEuRlivfhVLdyRGr576XBO4/greRjx4P4O3yc=
-golang.org/x/net v0.0.0-20210405180319-a5a99cb37ef4/go.mod h1:p54w0d4576C0XHj96bSt6lcn1PtDYWL6XObtHCRCNQM=
-golang.org/x/net v0.0.0-20210503060351-7fd8e65b6420/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
-golang.org/x/net v0.0.0-20210525063256-abc453219eb5/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
-golang.org/x/net v0.0.0-20211112202133-69e39bad7dc2/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
-golang.org/x/net v0.0.0-20220127200216-cd36cc0744dd/go.mod h1:CfG3xpIq0wQ8r1q4Su4UZFWDARRcnwPjda9FqA0JpMk=
-golang.org/x/net v0.0.0-20220225172249-27dd8689420f/go.mod h1:CfG3xpIq0wQ8r1q4Su4UZFWDARRcnwPjda9FqA0JpMk=
-golang.org/x/net v0.0.0-20220325170049-de3da57026de/go.mod h1:CfG3xpIq0wQ8r1q4Su4UZFWDARRcnwPjda9FqA0JpMk=
-golang.org/x/net v0.0.0-20220412020605-290c469a71a5/go.mod h1:CfG3xpIq0wQ8r1q4Su4UZFWDARRcnwPjda9FqA0JpMk=
-golang.org/x/net v0.0.0-20220425223048-2871e0cb64e4/go.mod h1:CfG3xpIq0wQ8r1q4Su4UZFWDARRcnwPjda9FqA0JpMk=
-golang.org/x/net v0.0.0-20220607020251-c690dde0001d/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
-golang.org/x/net v0.0.0-20220624214902-1bab6f366d9e/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
-golang.org/x/net v0.0.0-20220826154423-83b083e8dc8b h1:ZmngSVLe/wycRns9MKikG9OWIEjGcGAkacif7oYQaUY=
-golang.org/x/net v0.0.0-20220826154423-83b083e8dc8b/go.mod h1:YDH+HFinaLZZlnHAfSS6ZXJJ9M9t4Dl22yv3iI2vPwk=
-golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
-golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
-golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
-golang.org/x/oauth2 v0.0.0-20191202225959-858c2ad4c8b6/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
-golang.org/x/oauth2 v0.0.0-20200107190931-bf48bf16ab8d/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
-golang.org/x/oauth2 v0.0.0-20200902213428-5d25da1a8d43/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
-golang.org/x/oauth2 v0.0.0-20201109201403-9fd604954f58/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
-golang.org/x/oauth2 v0.0.0-20201208152858-08078c50e5b5/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
-golang.org/x/oauth2 v0.0.0-20210218202405-ba52d332ba99/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
-golang.org/x/oauth2 v0.0.0-20210220000619-9bb904979d93/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
-golang.org/x/oauth2 v0.0.0-20210313182246-cd4f82c27b84/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
-golang.org/x/oauth2 v0.0.0-20210514164344-f6687ab2804c/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
-golang.org/x/oauth2 v0.0.0-20210628180205-a41e5a781914/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
-golang.org/x/oauth2 v0.0.0-20210805134026-6f1e6394065a/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
-golang.org/x/oauth2 v0.0.0-20210819190943-2bc19b11175f/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
-golang.org/x/oauth2 v0.0.0-20211104180415-d3ed0bb246c8/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
-golang.org/x/oauth2 v0.0.0-20220223155221-ee480838109b/go.mod h1:DAh4E804XQdzx2j+YRIaUnCqCV2RuMz24cGBJ5QYIrc=
-golang.org/x/oauth2 v0.0.0-20220309155454-6242fa91716a/go.mod h1:DAh4E804XQdzx2j+YRIaUnCqCV2RuMz24cGBJ5QYIrc=
-golang.org/x/oauth2 v0.0.0-20220411215720-9780585627b5/go.mod h1:DAh4E804XQdzx2j+YRIaUnCqCV2RuMz24cGBJ5QYIrc=
-golang.org/x/oauth2 v0.0.0-20220608161450-d0670ef3b1eb/go.mod h1:jaDAt6Dkxork7LmZnYtzbRWj0W47D86a3TGe0YHBvmE=
-golang.org/x/oauth2 v0.0.0-20220822191816-0ebed06d0094 h1:2o1E+E8TpNLklK9nHiPiK1uzIYrIHt+cQx3ynCwq9V8=
-golang.org/x/oauth2 v0.0.0-20220822191816-0ebed06d0094/go.mod h1:h4gKUeWbJ4rQPri7E0u6Gs4e9Ri2zaLxzw5DI5XGrYg=
-golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20181221193216-37e7f081c4d4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20190227155943-e225da77a7e6/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
+golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
+golang.org/x/net v0.7.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
+golang.org/x/net v0.57.0 h1:K5+3DljvIuDG9/Jv9rvyMywYNFCQ9RSUY6OOTTkT+tE=
+golang.org/x/net v0.57.0/go.mod h1:KpXc8iv+r3XplLAG/f7Jsf9RPszJzdR0f58q9vGOuEU=
+golang.org/x/oauth2 v0.36.0 h1:peZ/1z27fi9hUOFCAZaHyrpWG5lwe0RJEEEeH0ThlIs=
+golang.org/x/oauth2 v0.36.0/go.mod h1:YDBUJMTkDnJS+A4BP4eZBjCqtokkg1hODuPjwiGPO7Q=
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20200317015054-43a5402ce75a/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20200625203802-6e8e738ad208/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20201207232520-09787c993a3a/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20210220032951-036812b2e83c/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20220601150217-0de741cfad7f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
-golang.org/x/sys v0.0.0-20180905080454-ebe1bf3edb33/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
-golang.org/x/sys v0.0.0-20181116152217-5ac8a444bdc5/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.22.0 h1:SZjpbeLmrCk4xhRSZFNZW5gFUeCeFgjekvI/+gfScek=
+golang.org/x/sync v0.22.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
-golang.org/x/sys v0.0.0-20190312061237-fead79001313/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20190422165155-953cdadca894/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20190502145724-3ef323f4f1fd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20190502175342-a43fa875dd82/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20190507160741-ecd444e8653b/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20190606165138-5da285871e9c/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20190624142023-c5567b49c5d0/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20190726091711-fc99dfbffb4e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20191001151750-bb3f8db39f24/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20191204072324-ce4227a45e2e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20191228213918-04cbcbbfeed8/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200106162015-b016eb3dc98e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200113162924-86b910548bc1/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200122134326-e047566fdf82/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200202164722-d101bd2416d5/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200212091648-12a6c2dcc1e4/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200223170610-d5e6a3e2c0ae/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200302150141-5c8b2ff67527/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200323222414-85ca7c5b95cd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200331124033-c3d80250170d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200501052902-10377860bb8e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200511232937-7e40ca221e25/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200515095857-1151b9dac4a9/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200523222454-059865788121/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200615200032-f1bc736245b1/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200625212154-ddb9806d33ae/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200803210538-64077c9b5642/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200905004654-be1d3432aa8f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20201201145000-ef89a241ccb3/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210104204734-6f8348627aad/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210119212857-b64e53b001e4/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210124154548-22da62e12c0c/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210220050731-9a76102bfb43/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210305230114-8fe3ee5dd75b/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210315160823-c6e025ad8005/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210320140829-1e4c9ba3b0c4/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210330210617-4fbd30eecc44/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210403161142-5e06dd20ab57/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210423082822-04245dca01da/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210510120138-977fb7262007/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20210514084401-e8d321eab015/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20210603081109-ebe580a85c40/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20210603125802-9665404d3644/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20210616094352-59db8d763f22/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20210630005230-0f9fa26af87c/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20210806184541-e5e7981a1069/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20210823070655-63515b42dcdf/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20210908233432-aa78b53d3365/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20211124211545-fe61309f8881/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20211210111614-af8b64212486/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20211216021012-1d35b9e2eb4e/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220114195835-da31bd327af9/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220128215802-99c3d69c2c27/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220209214540-3681064d5158/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220227234510-4e6760a101f9/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220328115105-d36c6a25d886/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220412211240-33da011f77ad/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220502124256-b6088ccd6cba/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220503163025-988cb79eb6c6/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220610221304-9f5ed59c137d/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220624220833-87e55d714810/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220728004956-3c1f35247d10 h1:WIoqL4EROvwiPdUtaip4VcDdpZ4kha7wBWZrbVKCIZg=
-golang.org/x/sys v0.0.0-20220728004956-3c1f35247d10/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=
+golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
-golang.org/x/text v0.0.0-20170915032832-14c0d48ead0c/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
+golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
-golang.org/x/text v0.3.1-0.20180807135948-17ff2d5776d2/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
-golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
-golang.org/x/text v0.3.4/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
-golang.org/x/text v0.3.5/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
-golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
-golang.org/x/text v0.3.7 h1:olpwvP2KacW1ZWvsR7uQhoyTYvKAupfQrRGBFM352Gk=
 golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
-golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
-golang.org/x/time v0.0.0-20190308202827-9d24e82272b4/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
-golang.org/x/time v0.0.0-20191024005414-555d28b269f0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
+golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
+golang.org/x/text v0.40.0 h1:Ub2Z6/xjgF1WrYQz2nuITOEegKFtiIy+rieRJ5lHZKs=
+golang.org/x/text v0.40.0/go.mod h1:hpnzDAfGV753zIKo+wk3u1bVKCGPbrnF7+7LBF/UHVY=
+golang.org/x/time v0.15.0 h1:bbrp8t3bGUeFOx08pvsMYRTCVSMk89u4tKbNOZbp88U=
+golang.org/x/time v0.15.0/go.mod h1:Y4YMaQmXwGQZoFaVFk4YpCt4FLQMYKZe9oeV/f4MSno=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
-golang.org/x/tools v0.0.0-20190114222345-bf090417da8b/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
-golang.org/x/tools v0.0.0-20190226205152-f727befe758c/go.mod h1:9Yl7xja0Znq3iFh3HoIrodX9oNMXvdceNzlUR8zjMvY=
-golang.org/x/tools v0.0.0-20190311212946-11955173bddd/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
-golang.org/x/tools v0.0.0-20190312151545-0bb0c0a6e846/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
-golang.org/x/tools v0.0.0-20190312170243-e65039ee4138/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
-golang.org/x/tools v0.0.0-20190425150028-36563e24a262/go.mod h1:RgjU9mgBXZiqYHBnxXauZ1Gv1EHHAz9KjViQ78xBX0Q=
-golang.org/x/tools v0.0.0-20190506145303-2d16b83fe98c/go.mod h1:RgjU9mgBXZiqYHBnxXauZ1Gv1EHHAz9KjViQ78xBX0Q=
-golang.org/x/tools v0.0.0-20190524140312-2c0ae7006135/go.mod h1:RgjU9mgBXZiqYHBnxXauZ1Gv1EHHAz9KjViQ78xBX0Q=
-golang.org/x/tools v0.0.0-20190606124116-d0a3d012864b/go.mod h1:/rFqwRUd4F7ZHNgwSSTFct+R/Kf4OFW1sUzUTQQTgfc=
-golang.org/x/tools v0.0.0-20190621195816-6e04913cbbac/go.mod h1:/rFqwRUd4F7ZHNgwSSTFct+R/Kf4OFW1sUzUTQQTgfc=
-golang.org/x/tools v0.0.0-20190628153133-6cdbf07be9d0/go.mod h1:/rFqwRUd4F7ZHNgwSSTFct+R/Kf4OFW1sUzUTQQTgfc=
-golang.org/x/tools v0.0.0-20190816200558-6889da9d5479/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
-golang.org/x/tools v0.0.0-20190911174233-4f2ddba30aff/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
-golang.org/x/tools v0.0.0-20191012152004-8de300cfc20a/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
-golang.org/x/tools v0.0.0-20191113191852-77e3bb0ad9e7/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
-golang.org/x/tools v0.0.0-20191115202509-3a792d9c32b2/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
-golang.org/x/tools v0.0.0-20191125144606-a911d9008d1f/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
-golang.org/x/tools v0.0.0-20191130070609-6e064ea0cf2d/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
-golang.org/x/tools v0.0.0-20191216173652-a0e659d51361/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
-golang.org/x/tools v0.0.0-20191227053925-7b8e75db28f4/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
-golang.org/x/tools v0.0.0-20200117161641-43d50277825c/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
-golang.org/x/tools v0.0.0-20200122220014-bf1340f18c4a/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
-golang.org/x/tools v0.0.0-20200130002326-2f3ba24bd6e7/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
-golang.org/x/tools v0.0.0-20200204074204-1cc6d1ef6c74/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
-golang.org/x/tools v0.0.0-20200207183749-b753a1ba74fa/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
-golang.org/x/tools v0.0.0-20200212150539-ea181f53ac56/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
-golang.org/x/tools v0.0.0-20200224181240-023911ca70b2/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
-golang.org/x/tools v0.0.0-20200227222343-706bc42d1f0d/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
-golang.org/x/tools v0.0.0-20200304193943-95d2e580d8eb/go.mod h1:o4KQGtdN14AW+yjsvvwRTJJuXz8XRtIHtEnmAXLyFUw=
-golang.org/x/tools v0.0.0-20200312045724-11d5b4c81c7d/go.mod h1:o4KQGtdN14AW+yjsvvwRTJJuXz8XRtIHtEnmAXLyFUw=
-golang.org/x/tools v0.0.0-20200331025713-a30bf2db82d4/go.mod h1:Sl4aGygMT6LrqrWclx+PTx3U+LnKx/seiNR+3G19Ar8=
-golang.org/x/tools v0.0.0-20200501065659-ab2804fb9c9d/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
-golang.org/x/tools v0.0.0-20200512131952-2bc93b1c0c88/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
-golang.org/x/tools v0.0.0-20200515010526-7d3b6ebf133d/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
-golang.org/x/tools v0.0.0-20200618134242-20370b0cb4b2/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
 golang.org/x/tools v0.0.0-20200619180055-7c47624df98f/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
-golang.org/x/tools v0.0.0-20200729194436-6467de6f59a7/go.mod h1:njjCfa9FT2d7l9Bc6FUM5FLjQPp3cFF28FI3qnDFljA=
-golang.org/x/tools v0.0.0-20200804011535-6c149bb5ef0d/go.mod h1:njjCfa9FT2d7l9Bc6FUM5FLjQPp3cFF28FI3qnDFljA=
-golang.org/x/tools v0.0.0-20200825202427-b303f430e36d/go.mod h1:njjCfa9FT2d7l9Bc6FUM5FLjQPp3cFF28FI3qnDFljA=
-golang.org/x/tools v0.0.0-20200904185747-39188db58858/go.mod h1:Cj7w3i3Rnn0Xh82ur9kSqwfTHTeVxaDqrfMjpcNT6bE=
-golang.org/x/tools v0.0.0-20201110124207-079ba7bd75cd/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
-golang.org/x/tools v0.0.0-20201201161351-ac6f37ff4c2a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
-golang.org/x/tools v0.0.0-20201208233053-a543418bbed2/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
-golang.org/x/tools v0.0.0-20210105154028-b0ab187a4818/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
 golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
-golang.org/x/tools v0.1.0/go.mod h1:xkSsbof2nBLbhDlRMhhhyNLN/zl3eTqcnHD5viDpcZ0=
-golang.org/x/tools v0.1.1/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
-golang.org/x/tools v0.1.2/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
-golang.org/x/tools v0.1.3/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
-golang.org/x/tools v0.1.4/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
-golang.org/x/tools v0.1.5/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
+golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
+golang.org/x/tools v0.47.0 h1:7Kn5x/d1svx/PzryTsqeoZN4TZwqeH5pGWjefhLi/1Q=
+golang.org/x/tools v0.47.0/go.mod h1:dFHnyTvFWY212G+h7ZY4Vsp/K3U4/7W9TyVaAul8uCA=
+golang.org/x/tools/go/expect v0.1.0-deprecated h1:jY2C5HGYR5lqex3gEniOQL0r7Dq5+VGVgY1nudX5lXY=
+golang.org/x/tools/go/expect v0.1.0-deprecated/go.mod h1:eihoPOH+FgIqa3FpoTwguz/bVUSGBlGQU67vpBeOrBY=
+golang.org/x/tools/go/packages/packagestest v0.1.1-deprecated h1:1h2MnaIAIXISqTFKdENegdpAgUXz6NrPEsbIeWaBRvM=
+golang.org/x/tools/go/packages/packagestest v0.1.1-deprecated/go.mod h1:RVAQXBGNv1ib0J382/DPCRS/BPnsGebyM1Gj5VSDpG8=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-golang.org/x/xerrors v0.0.0-20220411194840-2f41105eb62f/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-golang.org/x/xerrors v0.0.0-20220517211312-f3a8303e98df/go.mod h1:K8+ghG5WaK9qNqU5K3HdILfMLy1f3aNYFI/wnl100a8=
-golang.org/x/xerrors v0.0.0-20220609144429-65e65417b02f h1:uF6paiQQebLeSXkrTqHqz0MXhXXS1KgF41eUdBNvxK0=
-golang.org/x/xerrors v0.0.0-20220609144429-65e65417b02f/go.mod h1:K8+ghG5WaK9qNqU5K3HdILfMLy1f3aNYFI/wnl100a8=
-google.golang.org/api v0.4.0/go.mod h1:8k5glujaEP+g9n7WNsDg8QP6cUVNI86fCNMcbazEtwE=
-google.golang.org/api v0.7.0/go.mod h1:WtwebWUNSVBH/HAw79HIFXZNqEvBhG+Ra+ax0hx3E3M=
-google.golang.org/api v0.8.0/go.mod h1:o4eAsZoiT+ibD93RtjEohWalFOjRDx6CVaqeizhEnKg=
-google.golang.org/api v0.9.0/go.mod h1:o4eAsZoiT+ibD93RtjEohWalFOjRDx6CVaqeizhEnKg=
-google.golang.org/api v0.13.0/go.mod h1:iLdEw5Ide6rF15KTC1Kkl0iskquN2gFfn9o9XIsbkAI=
-google.golang.org/api v0.14.0/go.mod h1:iLdEw5Ide6rF15KTC1Kkl0iskquN2gFfn9o9XIsbkAI=
-google.golang.org/api v0.15.0/go.mod h1:iLdEw5Ide6rF15KTC1Kkl0iskquN2gFfn9o9XIsbkAI=
-google.golang.org/api v0.17.0/go.mod h1:BwFmGc8tA3vsd7r/7kR8DY7iEEGSU04BFxCo5jP/sfE=
-google.golang.org/api v0.18.0/go.mod h1:BwFmGc8tA3vsd7r/7kR8DY7iEEGSU04BFxCo5jP/sfE=
-google.golang.org/api v0.19.0/go.mod h1:BwFmGc8tA3vsd7r/7kR8DY7iEEGSU04BFxCo5jP/sfE=
-google.golang.org/api v0.20.0/go.mod h1:BwFmGc8tA3vsd7r/7kR8DY7iEEGSU04BFxCo5jP/sfE=
-google.golang.org/api v0.22.0/go.mod h1:BwFmGc8tA3vsd7r/7kR8DY7iEEGSU04BFxCo5jP/sfE=
-google.golang.org/api v0.24.0/go.mod h1:lIXQywCXRcnZPGlsd8NbLnOjtAoL6em04bJ9+z0MncE=
-google.golang.org/api v0.28.0/go.mod h1:lIXQywCXRcnZPGlsd8NbLnOjtAoL6em04bJ9+z0MncE=
-google.golang.org/api v0.29.0/go.mod h1:Lcubydp8VUV7KeIHD9z2Bys/sm/vGKnG1UHuDBSrHWM=
-google.golang.org/api v0.30.0/go.mod h1:QGmEvQ87FHZNiUVJkT14jQNYJ4ZJjdRF23ZXz5138Fc=
-google.golang.org/api v0.35.0/go.mod h1:/XrVsuzM0rZmrsbjJutiuftIzeuTQcEeaYcSk/mQ1dg=
-google.golang.org/api v0.36.0/go.mod h1:+z5ficQTmoYpPn8LCUNVpK5I7hwkpjbcgqA7I34qYtE=
-google.golang.org/api v0.40.0/go.mod h1:fYKFpnQN0DsDSKRVRcQSDQNtqWPfM9i+zNPxepjRCQ8=
-google.golang.org/api v0.41.0/go.mod h1:RkxM5lITDfTzmyKFPt+wGrCJbVfniCr2ool8kTBzRTU=
-google.golang.org/api v0.43.0/go.mod h1:nQsDGjRXMo4lvh5hP0TKqF244gqhGcr/YSIykhUk/94=
-google.golang.org/api v0.47.0/go.mod h1:Wbvgpq1HddcWVtzsVLyfLp8lDg6AA241LmgIL59tHXo=
-google.golang.org/api v0.48.0/go.mod h1:71Pr1vy+TAZRPkPs/xlCf5SsU8WjuAWv1Pfjbtukyy4=
-google.golang.org/api v0.50.0/go.mod h1:4bNT5pAuq5ji4SRZm+5QIkjny9JAyVD/3gaSihNefaw=
-google.golang.org/api v0.51.0/go.mod h1:t4HdrdoNgyN5cbEfm7Lum0lcLDLiise1F8qDKX00sOU=
-google.golang.org/api v0.54.0/go.mod h1:7C4bFFOvVDGXjfDTAsgGwDgAxRDeQ4X8NvUedIt6z3k=
-google.golang.org/api v0.55.0/go.mod h1:38yMfeP1kfjsl8isn0tliTjIb1rJXcQi4UXlbqivdVE=
-google.golang.org/api v0.56.0/go.mod h1:38yMfeP1kfjsl8isn0tliTjIb1rJXcQi4UXlbqivdVE=
-google.golang.org/api v0.57.0/go.mod h1:dVPlbZyBo2/OjBpmvNdpn2GRm6rPy75jyU7bmhdrMgI=
-google.golang.org/api v0.61.0/go.mod h1:xQRti5UdCmoCEqFxcz93fTl338AVqDgyaDRuOZ3hg9I=
-google.golang.org/api v0.63.0/go.mod h1:gs4ij2ffTRXwuzzgJl/56BdwJaA194ijkfn++9tDuPo=
-google.golang.org/api v0.67.0/go.mod h1:ShHKP8E60yPsKNw/w8w+VYaj9H6buA5UqDp8dhbQZ6g=
-google.golang.org/api v0.70.0/go.mod h1:Bs4ZM2HGifEvXwd50TtW70ovgJffJYw2oRCOFU/SkfA=
-google.golang.org/api v0.71.0/go.mod h1:4PyU6e6JogV1f9eA4voyrTY2batOLdgZ5qZ5HOCc4j8=
-google.golang.org/api v0.74.0/go.mod h1:ZpfMZOVRMywNyvJFeqL9HRWBgAuRfSjJFpe9QtRRyDs=
-google.golang.org/api v0.75.0/go.mod h1:pU9QmyHLnzlpar1Mjt4IbapUCy8J+6HD6GeELN69ljA=
-google.golang.org/api v0.78.0/go.mod h1:1Sg78yoMLOhlQTeF+ARBoytAcH1NNyyl390YMy6rKmw=
-google.golang.org/api v0.80.0/go.mod h1:xY3nI94gbvBrE0J6NHXhxOmW97HG7Khjkku6AFB3Hyg=
-google.golang.org/api v0.84.0/go.mod h1:NTsGnUFJMYROtiquksZHBWtHfeMC7iYthki7Eq3pa8o=
-google.golang.org/api v0.94.0 h1:KtKM9ru3nzQioV1HLlUf1cR7vMYJIpgls5VhAYQXIwA=
-google.golang.org/api v0.94.0/go.mod h1:eADj+UBuxkh5zlrSntJghuNeg8HwQ1w5lTKkuqaETEI=
-google.golang.org/appengine v1.1.0/go.mod h1:EbEs0AVv82hx2wNQdGPgUI5lhzA/G0D9YwlJXL52JkM=
-google.golang.org/appengine v1.4.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
-google.golang.org/appengine v1.5.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
-google.golang.org/appengine v1.6.1/go.mod h1:i06prIuMbXzDqacNJfV5OdTW448YApPu5ww/cMBSeb0=
-google.golang.org/appengine v1.6.5/go.mod h1:8WjMMxjGQR8xUklV/ARdw2HLXBOI7O7uCIDZVag1xfc=
-google.golang.org/appengine v1.6.6/go.mod h1:8WjMMxjGQR8xUklV/ARdw2HLXBOI7O7uCIDZVag1xfc=
-google.golang.org/appengine v1.6.7 h1:FZR1q0exgwxzPzp/aF+VccGrSfxfPpkBqjIIEq3ru6c=
-google.golang.org/appengine v1.6.7/go.mod h1:8WjMMxjGQR8xUklV/ARdw2HLXBOI7O7uCIDZVag1xfc=
-google.golang.org/genproto v0.0.0-20180817151627-c66870c02cf8/go.mod h1:JiN7NxoALGmiZfu7CAH4rXhgtRTLTxftemlI0sWmxmc=
-google.golang.org/genproto v0.0.0-20190307195333-5fe7a883aa19/go.mod h1:VzzqZJRnGkLBvHegQrXjBqPurQTc5/KpmUdxsrq26oE=
-google.golang.org/genproto v0.0.0-20190418145605-e7d98fc518a7/go.mod h1:VzzqZJRnGkLBvHegQrXjBqPurQTc5/KpmUdxsrq26oE=
-google.golang.org/genproto v0.0.0-20190425155659-357c62f0e4bb/go.mod h1:VzzqZJRnGkLBvHegQrXjBqPurQTc5/KpmUdxsrq26oE=
-google.golang.org/genproto v0.0.0-20190502173448-54afdca5d873/go.mod h1:VzzqZJRnGkLBvHegQrXjBqPurQTc5/KpmUdxsrq26oE=
-google.golang.org/genproto v0.0.0-20190801165951-fa694d86fc64/go.mod h1:DMBHOl98Agz4BDEuKkezgsaosCRResVns1a3J2ZsMNc=
-google.golang.org/genproto v0.0.0-20190819201941-24fa4b261c55/go.mod h1:DMBHOl98Agz4BDEuKkezgsaosCRResVns1a3J2ZsMNc=
-google.golang.org/genproto v0.0.0-20190911173649-1774047e7e51/go.mod h1:IbNlFCBrqXvoKpeg0TB2l7cyZUmoaFKYIwrEpbDKLA8=
-google.golang.org/genproto v0.0.0-20191108220845-16a3f7862a1a/go.mod h1:n3cpQtvxv34hfy77yVDNjmbRyujviMdxYliBSkLhpCc=
-google.golang.org/genproto v0.0.0-20191115194625-c23dd37a84c9/go.mod h1:n3cpQtvxv34hfy77yVDNjmbRyujviMdxYliBSkLhpCc=
-google.golang.org/genproto v0.0.0-20191216164720-4f79533eabd1/go.mod h1:n3cpQtvxv34hfy77yVDNjmbRyujviMdxYliBSkLhpCc=
-google.golang.org/genproto v0.0.0-20191230161307-f3c370f40bfb/go.mod h1:n3cpQtvxv34hfy77yVDNjmbRyujviMdxYliBSkLhpCc=
-google.golang.org/genproto v0.0.0-20200115191322-ca5a22157cba/go.mod h1:n3cpQtvxv34hfy77yVDNjmbRyujviMdxYliBSkLhpCc=
-google.golang.org/genproto v0.0.0-20200122232147-0452cf42e150/go.mod h1:n3cpQtvxv34hfy77yVDNjmbRyujviMdxYliBSkLhpCc=
-google.golang.org/genproto v0.0.0-20200204135345-fa8e72b47b90/go.mod h1:GmwEX6Z4W5gMy59cAlVYjN9JhxgbQH6Gn+gFDQe2lzA=
-google.golang.org/genproto v0.0.0-20200212174721-66ed5ce911ce/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
-google.golang.org/genproto v0.0.0-20200224152610-e50cd9704f63/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
-google.golang.org/genproto v0.0.0-20200228133532-8c2c7df3a383/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
-google.golang.org/genproto v0.0.0-20200305110556-506484158171/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
-google.golang.org/genproto v0.0.0-20200312145019-da6875a35672/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
-google.golang.org/genproto v0.0.0-20200331122359-1ee6d9798940/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
-google.golang.org/genproto v0.0.0-20200430143042-b979b6f78d84/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
-google.golang.org/genproto v0.0.0-20200511104702-f5ebc3bea380/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
-google.golang.org/genproto v0.0.0-20200513103714-09dca8ec2884/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
-google.golang.org/genproto v0.0.0-20200515170657-fc4c6c6a6587/go.mod h1:YsZOwe1myG/8QRHRsmBRE1LrgQY60beZKjly0O1fX9U=
-google.golang.org/genproto v0.0.0-20200526211855-cb27e3aa2013/go.mod h1:NbSheEEYHJ7i3ixzK3sjbqSGDJWnxyFXZblF3eUsNvo=
-google.golang.org/genproto v0.0.0-20200618031413-b414f8b61790/go.mod h1:jDfRM7FcilCzHH/e9qn6dsT145K34l5v+OpcnNgKAAA=
-google.golang.org/genproto v0.0.0-20200729003335-053ba62fc06f/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
-google.golang.org/genproto v0.0.0-20200804131852-c06518451d9c/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
-google.golang.org/genproto v0.0.0-20200825200019-8632dd797987/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
-google.golang.org/genproto v0.0.0-20200904004341-0bd0a958aa1d/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
-google.golang.org/genproto v0.0.0-20201109203340-2640f1f9cdfb/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
-google.golang.org/genproto v0.0.0-20201201144952-b05cb90ed32e/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
-google.golang.org/genproto v0.0.0-20201210142538-e3217bee35cc/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
-google.golang.org/genproto v0.0.0-20201214200347-8c77b98c765d/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
-google.golang.org/genproto v0.0.0-20210222152913-aa3ee6e6a81c/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
-google.golang.org/genproto v0.0.0-20210303154014-9728d6b83eeb/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
-google.golang.org/genproto v0.0.0-20210310155132-4ce2db91004e/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
-google.golang.org/genproto v0.0.0-20210319143718-93e7006c17a6/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
-google.golang.org/genproto v0.0.0-20210329143202-679c6ae281ee/go.mod h1:9lPAdzaEmUacj36I+k7YKbEc5CXzPIeORRgDAUOu28A=
-google.golang.org/genproto v0.0.0-20210402141018-6c239bbf2bb1/go.mod h1:9lPAdzaEmUacj36I+k7YKbEc5CXzPIeORRgDAUOu28A=
-google.golang.org/genproto v0.0.0-20210513213006-bf773b8c8384/go.mod h1:P3QM42oQyzQSnHPnZ/vqoCdDmzH28fzWByN9asMeM8A=
-google.golang.org/genproto v0.0.0-20210602131652-f16073e35f0c/go.mod h1:UODoCrxHCcBojKKwX1terBiRUaqAsFqJiF615XL43r0=
-google.golang.org/genproto v0.0.0-20210604141403-392c879c8b08/go.mod h1:UODoCrxHCcBojKKwX1terBiRUaqAsFqJiF615XL43r0=
-google.golang.org/genproto v0.0.0-20210608205507-b6d2f5bf0d7d/go.mod h1:UODoCrxHCcBojKKwX1terBiRUaqAsFqJiF615XL43r0=
-google.golang.org/genproto v0.0.0-20210624195500-8bfb893ecb84/go.mod h1:SzzZ/N+nwJDaO1kznhnlzqS8ocJICar6hYhVyhi++24=
-google.golang.org/genproto v0.0.0-20210713002101-d411969a0d9a/go.mod h1:AxrInvYm1dci+enl5hChSFPOmmUF1+uAa/UsgNRWd7k=
-google.golang.org/genproto v0.0.0-20210716133855-ce7ef5c701ea/go.mod h1:AxrInvYm1dci+enl5hChSFPOmmUF1+uAa/UsgNRWd7k=
-google.golang.org/genproto v0.0.0-20210728212813-7823e685a01f/go.mod h1:ob2IJxKrgPT52GcgX759i1sleT07tiKowYBGbczaW48=
-google.golang.org/genproto v0.0.0-20210805201207-89edb61ffb67/go.mod h1:ob2IJxKrgPT52GcgX759i1sleT07tiKowYBGbczaW48=
-google.golang.org/genproto v0.0.0-20210813162853-db860fec028c/go.mod h1:cFeNkxwySK631ADgubI+/XFU/xp8FD5KIVV4rj8UC5w=
-google.golang.org/genproto v0.0.0-20210821163610-241b8fcbd6c8/go.mod h1:eFjDcFEctNawg4eG61bRv87N7iHBWyVhJu7u1kqDUXY=
-google.golang.org/genproto v0.0.0-20210828152312-66f60bf46e71/go.mod h1:eFjDcFEctNawg4eG61bRv87N7iHBWyVhJu7u1kqDUXY=
-google.golang.org/genproto v0.0.0-20210831024726-fe130286e0e2/go.mod h1:eFjDcFEctNawg4eG61bRv87N7iHBWyVhJu7u1kqDUXY=
-google.golang.org/genproto v0.0.0-20210903162649-d08c68adba83/go.mod h1:eFjDcFEctNawg4eG61bRv87N7iHBWyVhJu7u1kqDUXY=
-google.golang.org/genproto v0.0.0-20210909211513-a8c4777a87af/go.mod h1:eFjDcFEctNawg4eG61bRv87N7iHBWyVhJu7u1kqDUXY=
-google.golang.org/genproto v0.0.0-20210924002016-3dee208752a0/go.mod h1:5CzLGKJ67TSI2B9POpiiyGha0AjJvZIUgRMt1dSmuhc=
-google.golang.org/genproto v0.0.0-20211118181313-81c1377c94b1/go.mod h1:5CzLGKJ67TSI2B9POpiiyGha0AjJvZIUgRMt1dSmuhc=
-google.golang.org/genproto v0.0.0-20211206160659-862468c7d6e0/go.mod h1:5CzLGKJ67TSI2B9POpiiyGha0AjJvZIUgRMt1dSmuhc=
-google.golang.org/genproto v0.0.0-20211208223120-3a66f561d7aa/go.mod h1:5CzLGKJ67TSI2B9POpiiyGha0AjJvZIUgRMt1dSmuhc=
-google.golang.org/genproto v0.0.0-20211221195035-429b39de9b1c/go.mod h1:5CzLGKJ67TSI2B9POpiiyGha0AjJvZIUgRMt1dSmuhc=
-google.golang.org/genproto v0.0.0-20220126215142-9970aeb2e350/go.mod h1:5CzLGKJ67TSI2B9POpiiyGha0AjJvZIUgRMt1dSmuhc=
-google.golang.org/genproto v0.0.0-20220207164111-0872dc986b00/go.mod h1:5CzLGKJ67TSI2B9POpiiyGha0AjJvZIUgRMt1dSmuhc=
-google.golang.org/genproto v0.0.0-20220218161850-94dd64e39d7c/go.mod h1:kGP+zUP2Ddo0ayMi4YuN7C3WZyJvGLZRh8Z5wnAqvEI=
-google.golang.org/genproto v0.0.0-20220222213610-43724f9ea8cf/go.mod h1:kGP+zUP2Ddo0ayMi4YuN7C3WZyJvGLZRh8Z5wnAqvEI=
-google.golang.org/genproto v0.0.0-20220304144024-325a89244dc8/go.mod h1:kGP+zUP2Ddo0ayMi4YuN7C3WZyJvGLZRh8Z5wnAqvEI=
-google.golang.org/genproto v0.0.0-20220310185008-1973136f34c6/go.mod h1:kGP+zUP2Ddo0ayMi4YuN7C3WZyJvGLZRh8Z5wnAqvEI=
-google.golang.org/genproto v0.0.0-20220324131243-acbaeb5b85eb/go.mod h1:hAL49I2IFola2sVEjAn7MEwsja0xp51I0tlGAf9hz4E=
-google.golang.org/genproto v0.0.0-20220407144326-9054f6ed7bac/go.mod h1:8w6bsBMX6yCPbAVTeqQHvzxW0EIFigd5lZyahWgyfDo=
-google.golang.org/genproto v0.0.0-20220413183235-5e96e2839df9/go.mod h1:8w6bsBMX6yCPbAVTeqQHvzxW0EIFigd5lZyahWgyfDo=
-google.golang.org/genproto v0.0.0-20220414192740-2d67ff6cf2b4/go.mod h1:8w6bsBMX6yCPbAVTeqQHvzxW0EIFigd5lZyahWgyfDo=
-google.golang.org/genproto v0.0.0-20220421151946-72621c1f0bd3/go.mod h1:8w6bsBMX6yCPbAVTeqQHvzxW0EIFigd5lZyahWgyfDo=
-google.golang.org/genproto v0.0.0-20220429170224-98d788798c3e/go.mod h1:8w6bsBMX6yCPbAVTeqQHvzxW0EIFigd5lZyahWgyfDo=
-google.golang.org/genproto v0.0.0-20220505152158-f39f71e6c8f3/go.mod h1:RAyBrSAP7Fh3Nc84ghnVLDPuV51xc9agzmm4Ph6i0Q4=
-google.golang.org/genproto v0.0.0-20220518221133-4f43b3371335/go.mod h1:RAyBrSAP7Fh3Nc84ghnVLDPuV51xc9agzmm4Ph6i0Q4=
-google.golang.org/genproto v0.0.0-20220523171625-347a074981d8/go.mod h1:RAyBrSAP7Fh3Nc84ghnVLDPuV51xc9agzmm4Ph6i0Q4=
-google.golang.org/genproto v0.0.0-20220608133413-ed9918b62aac/go.mod h1:KEWEmljWE5zPzLBa/oHl6DaEt9LmfH6WtH1OHIvleBA=
-google.golang.org/genproto v0.0.0-20220616135557-88e70c0c3a90/go.mod h1:KEWEmljWE5zPzLBa/oHl6DaEt9LmfH6WtH1OHIvleBA=
-google.golang.org/genproto v0.0.0-20220624142145-8cd45d7dbd1f h1:hJ/Y5SqPXbarffmAsApliUlcvMU+wScNGfyop4bZm8o=
-google.golang.org/genproto v0.0.0-20220624142145-8cd45d7dbd1f/go.mod h1:KEWEmljWE5zPzLBa/oHl6DaEt9LmfH6WtH1OHIvleBA=
-google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c=
-google.golang.org/grpc v1.20.1/go.mod h1:10oTOabMzJvdu6/UiuZezV6QK5dSlG84ov/aaiqXj38=
-google.golang.org/grpc v1.21.1/go.mod h1:oYelfM1adQP15Ek0mdvEgi9Df8B9CZIaU1084ijfRaM=
-google.golang.org/grpc v1.23.0/go.mod h1:Y5yQAOtifL1yxbo5wqy6BxZv8vAUGQwXBOALyacEbxg=
-google.golang.org/grpc v1.25.1/go.mod h1:c3i+UQWmh7LiEpx4sFZnkU36qjEYZ0imhYfXVyQciAY=
-google.golang.org/grpc v1.26.0/go.mod h1:qbnxyOmOxrQa7FizSgH+ReBfzJrCY1pSN7KXBS8abTk=
-google.golang.org/grpc v1.27.0/go.mod h1:qbnxyOmOxrQa7FizSgH+ReBfzJrCY1pSN7KXBS8abTk=
-google.golang.org/grpc v1.27.1/go.mod h1:qbnxyOmOxrQa7FizSgH+ReBfzJrCY1pSN7KXBS8abTk=
-google.golang.org/grpc v1.28.0/go.mod h1:rpkK4SK4GF4Ach/+MFLZUBavHOvF2JJB5uozKKal+60=
-google.golang.org/grpc v1.29.1/go.mod h1:itym6AZVZYACWQqET3MqgPpjcuV5QH3BxFS3IjizoKk=
-google.golang.org/grpc v1.30.0/go.mod h1:N36X2cJ7JwdamYAgDz+s+rVMFjt3numwzf/HckM8pak=
-google.golang.org/grpc v1.31.0/go.mod h1:N36X2cJ7JwdamYAgDz+s+rVMFjt3numwzf/HckM8pak=
-google.golang.org/grpc v1.31.1/go.mod h1:N36X2cJ7JwdamYAgDz+s+rVMFjt3numwzf/HckM8pak=
-google.golang.org/grpc v1.33.1/go.mod h1:fr5YgcSWrqhRRxogOsw7RzIpsmvOZ6IcH4kBYTpR3n0=
-google.golang.org/grpc v1.33.2/go.mod h1:JMHMWHQWaTccqQQlmk3MJZS+GWXOdAesneDmEnv2fbc=
-google.golang.org/grpc v1.34.0/go.mod h1:WotjhfgOW/POjDeRt8vscBtXq+2VjORFy659qA51WJ8=
-google.golang.org/grpc v1.35.0/go.mod h1:qjiiYl8FncCW8feJPdyg3v6XW24KsRHe+dy9BAGRRjU=
-google.golang.org/grpc v1.36.0/go.mod h1:qjiiYl8FncCW8feJPdyg3v6XW24KsRHe+dy9BAGRRjU=
-google.golang.org/grpc v1.36.1/go.mod h1:qjiiYl8FncCW8feJPdyg3v6XW24KsRHe+dy9BAGRRjU=
-google.golang.org/grpc v1.37.0/go.mod h1:NREThFqKR1f3iQ6oBuvc5LadQuXVGo9rkm5ZGrQdJfM=
-google.golang.org/grpc v1.37.1/go.mod h1:NREThFqKR1f3iQ6oBuvc5LadQuXVGo9rkm5ZGrQdJfM=
-google.golang.org/grpc v1.38.0/go.mod h1:NREThFqKR1f3iQ6oBuvc5LadQuXVGo9rkm5ZGrQdJfM=
-google.golang.org/grpc v1.39.0/go.mod h1:PImNr+rS9TWYb2O4/emRugxiyHZ5JyHW5F+RPnDzfrE=
-google.golang.org/grpc v1.39.1/go.mod h1:PImNr+rS9TWYb2O4/emRugxiyHZ5JyHW5F+RPnDzfrE=
-google.golang.org/grpc v1.40.0/go.mod h1:ogyxbiOoUXAkP+4+xa6PZSE9DZgIHtSpzjDTB9KAK34=
-google.golang.org/grpc v1.40.1/go.mod h1:ogyxbiOoUXAkP+4+xa6PZSE9DZgIHtSpzjDTB9KAK34=
-google.golang.org/grpc v1.44.0/go.mod h1:k+4IHHFw41K8+bbowsex27ge2rCb65oeWqe4jJ590SU=
-google.golang.org/grpc v1.45.0/go.mod h1:lN7owxKUQEqMfSyQikvvk5tf/6zMPsrK+ONuO11+0rQ=
-google.golang.org/grpc v1.46.0/go.mod h1:vN9eftEi1UMyUsIF80+uQXhHjbXYbm0uXoFCACuMGWk=
-google.golang.org/grpc v1.46.2/go.mod h1:vN9eftEi1UMyUsIF80+uQXhHjbXYbm0uXoFCACuMGWk=
-google.golang.org/grpc v1.47.0/go.mod h1:vN9eftEi1UMyUsIF80+uQXhHjbXYbm0uXoFCACuMGWk=
-google.golang.org/grpc v1.49.0 h1:WTLtQzmQori5FUH25Pq4WT22oCsv8USpQ+F6rqtsmxw=
-google.golang.org/grpc v1.49.0/go.mod h1:ZgQEeidpAuNRZ8iRrlBKXZQP1ghovWIVhdJRyCDK+GI=
-google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.1.0/go.mod h1:6Kw0yEErY5E/yWrBtf03jp27GLLJujG4z/JK95pnjjw=
-google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8=
-google.golang.org/protobuf v0.0.0-20200221191635-4d8936d0db64/go.mod h1:kwYJMbMJ01Woi6D6+Kah6886xMZcty6N08ah7+eCXa0=
-google.golang.org/protobuf v0.0.0-20200228230310-ab0ca4ff8a60/go.mod h1:cfTl7dwQJ+fmap5saPgwCLgHXTUD7jkjRqWcaiX5VyM=
-google.golang.org/protobuf v1.20.1-0.20200309200217-e05f789c0967/go.mod h1:A+miEFZTKqfCUM6K7xSMQL9OKL/b6hQv+e19PK+JZNE=
-google.golang.org/protobuf v1.21.0/go.mod h1:47Nbq4nVaFHyn7ilMalzfO3qCViNmqZ2kzikPIcrTAo=
-google.golang.org/protobuf v1.22.0/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
-google.golang.org/protobuf v1.23.0/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
-google.golang.org/protobuf v1.23.1-0.20200526195155-81db48ad09cc/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
-google.golang.org/protobuf v1.24.0/go.mod h1:r/3tXBNzIEhYS9I1OUVjXDlt8tc493IdKGjtUeSXeh4=
-google.golang.org/protobuf v1.25.0/go.mod h1:9JNX74DMeImyA3h4bdi1ymwjUzf21/xIlbajtzgsN7c=
-google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw=
-google.golang.org/protobuf v1.26.0/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
-google.golang.org/protobuf v1.27.1/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
-google.golang.org/protobuf v1.28.0/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I=
-google.golang.org/protobuf v1.28.1 h1:d0NfwRgPtno5B1Wa6L2DAG+KivqkdutMf1UhdNx175w=
-google.golang.org/protobuf v1.28.1/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I=
-gopkg.in/alecthomas/kingpin.v2 v2.2.6/go.mod h1:FMv+mEhP44yOT+4EoQTLFTRgOQ1FBLkstjWtayDeSgw=
+gonum.org/v1/gonum v0.17.0 h1:VbpOemQlsSMrYmn7T2OUvQ4dqxQXU+ouZFQsZOx50z4=
+gonum.org/v1/gonum v0.17.0/go.mod h1:El3tOrEuMpv2UdMrbNlKEh9vd86bmQ6vqIcDwxEOc1E=
+google.golang.org/api v0.291.0 h1:wfPbbY+mr9c7wZLqqzrHJLft/q8iFKREd6IgTBUene0=
+google.golang.org/api v0.291.0/go.mod h1:at7kwWbuonglBFEBoeMDAV1bguHqL3qf0BHFsv3coa0=
+google.golang.org/genproto v0.0.0-20260319201613-d00831a3d3e7 h1:XzmzkmB14QhVhgnawEVsOn6OFsnpyxNPRY9QV01dNB0=
+google.golang.org/genproto v0.0.0-20260319201613-d00831a3d3e7/go.mod h1:L43LFes82YgSonw6iTXTxXUX1OlULt4AQtkik4ULL/I=
+google.golang.org/genproto/googleapis/api v0.0.0-20260630182238-925bb5da69e7 h1:jQ9p21COKWjP3VwuFrNRiiOTMh3mPpN45R7SLrH/HUU=
+google.golang.org/genproto/googleapis/api v0.0.0-20260630182238-925bb5da69e7/go.mod h1:KqHwBx2upmfa1XSi1WuRvC+2VGCLtooKkfmyvRbUmqA=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20260724162435-b2f20204f0df h1:O3ig1i5WDDzsVzRp+cCdgelT9vXnlnOFdlEeFtL4HCc=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20260724162435-b2f20204f0df/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8=
+google.golang.org/grpc v1.82.1 h1:NnAxzGRA0677vCa4BUkOAnO5+FfQqVl9iUXeD0IqcGE=
+google.golang.org/grpc v1.82.1/go.mod h1:yzTZ1TB1Z3SG+LIYaI+WiE8D5+PZ3ArnrSp8zF3+/ZA=
+google.golang.org/protobuf v1.36.11 h1:fV6ZwhNocDyBLK0dj+fg8ektcVegBBuEolpbTQyBNVE=
+google.golang.org/protobuf v1.36.11/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
-gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
-gopkg.in/errgo.v2 v2.1.0/go.mod h1:hNsd1EY+bozCKY1Ytp96fpM3vjJbqLJn88ws8XvfDNI=
-gopkg.in/square/go-jose.v2 v2.6.0 h1:NGk74WTnPKBNUhNzQX7PYcTLUjoq7mzKk2OKbvwk2iI=
-gopkg.in/square/go-jose.v2 v2.6.0/go.mod h1:M9dMgbHiYLoDGQrXy7OpJDJWiKiU//h+vD76mk0e1AI=
-gopkg.in/yaml.v2 v2.2.1/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
-gopkg.in/yaml.v2 v2.2.3/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
-gopkg.in/yaml.v2 v2.2.4/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
-gopkg.in/yaml.v2 v2.2.5/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
-gopkg.in/yaml.v2 v2.2.8/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
-gopkg.in/yaml.v2 v2.3.0/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY=
 gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
 gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
-gopkg.in/yaml.v3 v3.0.0-20210107192922-496545a6307b/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
-honnef.co/go/tools v0.0.0-20190102054323-c2f93a96b099/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
-honnef.co/go/tools v0.0.0-20190106161140-3f1c8253044a/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
-honnef.co/go/tools v0.0.0-20190418001031-e561f6794a2a/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
-honnef.co/go/tools v0.0.0-20190523083050-ea95bdfd59fc/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
-honnef.co/go/tools v0.0.1-2019.2.3/go.mod h1:a3bituU0lyd329TUQxRnasdCoJDkEUEAqEt0JzvZhAg=
-honnef.co/go/tools v0.0.1-2020.1.3/go.mod h1:X/FiERA/W4tHapMX5mGpAtMSVEeEUOyHaw9vFzvIQ3k=
-honnef.co/go/tools v0.0.1-2020.1.4/go.mod h1:X/FiERA/W4tHapMX5mGpAtMSVEeEUOyHaw9vFzvIQ3k=
-rsc.io/binaryregexp v0.2.0/go.mod h1:qTv7/COck+e2FymRvadv62gMdZztPaShugOCi3I+8D8=
-rsc.io/quote/v3 v3.1.0/go.mod h1:yEA65RcK8LyAZtP9Kv3t0HmxON59tX3rD+tICJqUlj0=
-rsc.io/sampler v1.3.0/go.mod h1:T1hPZKmBbMNahiBKFy5HrXp6adAjACjK9JXDnKaTXpA=
-sigs.k8s.io/yaml v1.2.0/go.mod h1:yfXDCHCao9+ENCvLSE62v9VSji2MKu5jeNfTrofGhJc=
diff --git a/pkg/cel/cel.go b/pkg/cel/cel.go
new file mode 100644
index 0000000000..8dd686ba72
--- /dev/null
+++ b/pkg/cel/cel.go
@@ -0,0 +1,232 @@
+package cel
+
+import (
+	"context"
+	"fmt"
+	"reflect"
+
+	"github.com/google/cel-go/cel"
+	"github.com/google/cel-go/checker"
+	"github.com/google/cel-go/common/types/ref"
+	"github.com/google/cel-go/ext"
+
+	"github.com/dexidp/dex/pkg/cel/library"
+)
+
+// EnvironmentVersion represents the version of the CEL environment.
+// New variables, functions, or libraries are introduced in new versions.
+type EnvironmentVersion uint32
+
+const (
+	// EnvironmentV1 is the initial CEL environment.
+	EnvironmentV1 EnvironmentVersion = 1
+)
+
+// CompilationResult holds a compiled CEL program ready for evaluation.
+type CompilationResult struct {
+	Program    cel.Program
+	OutputType *cel.Type
+	Expression string
+
+	ast *cel.Ast
+}
+
+// CompilerOption configures a Compiler.
+type CompilerOption func(*compilerConfig)
+
+type compilerConfig struct {
+	costBudget uint64
+	version    EnvironmentVersion
+}
+
+func defaultCompilerConfig() *compilerConfig {
+	return &compilerConfig{
+		costBudget: DefaultCostBudget,
+		version:    EnvironmentV1,
+	}
+}
+
+// WithCostBudget sets a custom cost budget for expression evaluation.
+func WithCostBudget(budget uint64) CompilerOption {
+	return func(cfg *compilerConfig) {
+		cfg.costBudget = budget
+	}
+}
+
+// WithVersion sets the target environment version for the compiler.
+// Defaults to the latest version. Specifying an older version ensures
+// that only functions/types available at that version are used.
+func WithVersion(v EnvironmentVersion) CompilerOption {
+	return func(cfg *compilerConfig) {
+		cfg.version = v
+	}
+}
+
+// Compiler compiles CEL expressions against a specific environment.
+type Compiler struct {
+	env *cel.Env
+	cfg *compilerConfig
+}
+
+// NewCompiler creates a new CEL compiler with the specified variable
+// declarations and options.
+//
+// All custom Dex libraries are automatically included.
+// The environment is configured with cost limits and safe defaults.
+func NewCompiler(variables []VariableDeclaration, opts ...CompilerOption) (*Compiler, error) {
+	cfg := defaultCompilerConfig()
+	for _, opt := range opts {
+		opt(cfg)
+	}
+
+	envOpts := make([]cel.EnvOption, 0, 8+len(variables))
+	envOpts = append(envOpts,
+		cel.DefaultUTCTimeZone(true),
+
+		// Standard extension libraries (same set as Kubernetes)
+		ext.Strings(),
+		ext.Encoders(),
+		ext.Lists(),
+		ext.Sets(),
+		ext.Math(),
+
+		// Native Go types for typed variable access.
+		// This gives compile-time field checking: identity.emial → error at config load.
+		ext.NativeTypes(
+			ext.ParseStructTags(true),
+			reflect.TypeOf(IdentityVal{}),
+			reflect.TypeOf(RequestVal{}),
+		),
+
+		// Custom Dex libraries
+		cel.Lib(&library.Email{}),
+		cel.Lib(&library.Groups{}),
+
+		// Presence tests like has(field) and 'key' in map are O(1) hash
+		// lookups on map(string, dyn) variables, so they should not count
+		// toward the cost budget. Without this, expressions with multiple
+		// 'in' checks (e.g. "'admin' in identity.groups") would accumulate
+		// inflated cost estimates. This matches Kubernetes CEL behavior
+		// where presence tests are free for CRD validation rules.
+		cel.CostEstimatorOptions(
+			checker.PresenceTestHasCost(false),
+		),
+	)
+
+	for _, v := range variables {
+		envOpts = append(envOpts, cel.Variable(v.Name, v.Type))
+	}
+
+	env, err := cel.NewEnv(envOpts...)
+	if err != nil {
+		return nil, fmt.Errorf("failed to create CEL environment: %w", err)
+	}
+
+	return &Compiler{env: env, cfg: cfg}, nil
+}
+
+// CompileBool compiles a CEL expression that must evaluate to bool.
+func (c *Compiler) CompileBool(expression string) (*CompilationResult, error) {
+	return c.compile(expression, cel.BoolType)
+}
+
+// CompileString compiles a CEL expression that must evaluate to string.
+func (c *Compiler) CompileString(expression string) (*CompilationResult, error) {
+	return c.compile(expression, cel.StringType)
+}
+
+// CompileStringList compiles a CEL expression that must evaluate to list(string).
+func (c *Compiler) CompileStringList(expression string) (*CompilationResult, error) {
+	return c.compile(expression, cel.ListType(cel.StringType))
+}
+
+// Compile compiles a CEL expression with any output type.
+func (c *Compiler) Compile(expression string) (*CompilationResult, error) {
+	return c.compile(expression, nil)
+}
+
+func (c *Compiler) compile(expression string, expectedType *cel.Type) (*CompilationResult, error) {
+	if len(expression) > MaxExpressionLength {
+		return nil, fmt.Errorf("expression exceeds maximum length of %d characters", MaxExpressionLength)
+	}
+
+	ast, issues := c.env.Compile(expression)
+	if issues != nil && issues.Err() != nil {
+		return nil, fmt.Errorf("CEL compilation failed: %w", issues.Err())
+	}
+
+	if expectedType != nil && !ast.OutputType().IsEquivalentType(expectedType) {
+		return nil, fmt.Errorf(
+			"expected expression output type %s, got %s",
+			expectedType, ast.OutputType(),
+		)
+	}
+
+	// Estimate cost at compile time and reject expressions that are too expensive.
+	costEst, err := c.env.EstimateCost(ast, &defaultCostEstimator{})
+	if err != nil {
+		return nil, fmt.Errorf("CEL cost estimation failed: %w", err)
+	}
+
+	if costEst.Max > c.cfg.costBudget {
+		return nil, fmt.Errorf(
+			"CEL expression estimated cost %d exceeds budget %d",
+			costEst.Max, c.cfg.costBudget,
+		)
+	}
+
+	prog, err := c.env.Program(ast,
+		cel.EvalOptions(cel.OptOptimize),
+		cel.CostLimit(c.cfg.costBudget),
+	)
+	if err != nil {
+		return nil, fmt.Errorf("CEL program creation failed: %w", err)
+	}
+
+	return &CompilationResult{
+		Program:    prog,
+		OutputType: ast.OutputType(),
+		Expression: expression,
+		ast:        ast,
+	}, nil
+}
+
+// Eval evaluates a compiled program against the given variables.
+func Eval(ctx context.Context, result *CompilationResult, variables map[string]any) (ref.Val, error) {
+	out, _, err := result.Program.ContextEval(ctx, variables)
+	if err != nil {
+		return nil, fmt.Errorf("CEL evaluation failed: %w", err)
+	}
+
+	return out, nil
+}
+
+// EvalBool is a convenience function that evaluates and asserts bool output.
+func EvalBool(ctx context.Context, result *CompilationResult, variables map[string]any) (bool, error) {
+	out, err := Eval(ctx, result, variables)
+	if err != nil {
+		return false, err
+	}
+
+	v, ok := out.Value().(bool)
+	if !ok {
+		return false, fmt.Errorf("expected bool result, got %T", out.Value())
+	}
+
+	return v, nil
+}
+
+// EvalString is a convenience function that evaluates and asserts string output.
+func EvalString(ctx context.Context, result *CompilationResult, variables map[string]any) (string, error) {
+	out, err := Eval(ctx, result, variables)
+	if err != nil {
+		return "", err
+	}
+
+	v, ok := out.Value().(string)
+	if !ok {
+		return "", fmt.Errorf("expected string result, got %T", out.Value())
+	}
+
+	return v, nil
+}
diff --git a/pkg/cel/cel_test.go b/pkg/cel/cel_test.go
new file mode 100644
index 0000000000..b211f344b4
--- /dev/null
+++ b/pkg/cel/cel_test.go
@@ -0,0 +1,280 @@
+package cel_test
+
+import (
+	"context"
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/dexidp/dex/connector"
+	dexcel "github.com/dexidp/dex/pkg/cel"
+)
+
+func TestCompileBool(t *testing.T) {
+	compiler, err := dexcel.NewCompiler(nil)
+	require.NoError(t, err)
+
+	tests := map[string]struct {
+		expr    string
+		wantErr bool
+	}{
+		"true literal": {
+			expr: "true",
+		},
+		"comparison": {
+			expr: "1 == 1",
+		},
+		"string type mismatch": {
+			expr:    "'hello'",
+			wantErr: true,
+		},
+		"int type mismatch": {
+			expr:    "42",
+			wantErr: true,
+		},
+	}
+
+	for name, tc := range tests {
+		t.Run(name, func(t *testing.T) {
+			result, err := compiler.CompileBool(tc.expr)
+			if tc.wantErr {
+				assert.Error(t, err)
+				assert.Nil(t, result)
+			} else {
+				assert.NoError(t, err)
+				assert.NotNil(t, result)
+			}
+		})
+	}
+}
+
+func TestCompileString(t *testing.T) {
+	compiler, err := dexcel.NewCompiler(nil)
+	require.NoError(t, err)
+
+	tests := map[string]struct {
+		expr    string
+		wantErr bool
+	}{
+		"string literal": {
+			expr: "'hello'",
+		},
+		"string concatenation": {
+			expr: "'hello' + ' ' + 'world'",
+		},
+		"bool type mismatch": {
+			expr:    "true",
+			wantErr: true,
+		},
+	}
+
+	for name, tc := range tests {
+		t.Run(name, func(t *testing.T) {
+			result, err := compiler.CompileString(tc.expr)
+			if tc.wantErr {
+				assert.Error(t, err)
+			} else {
+				assert.NoError(t, err)
+				assert.NotNil(t, result)
+			}
+		})
+	}
+}
+
+func TestCompileStringList(t *testing.T) {
+	compiler, err := dexcel.NewCompiler(nil)
+	require.NoError(t, err)
+
+	result, err := compiler.CompileStringList("['a', 'b', 'c']")
+	assert.NoError(t, err)
+	assert.NotNil(t, result)
+
+	_, err = compiler.CompileStringList("'not a list'")
+	assert.Error(t, err)
+}
+
+func TestCompile(t *testing.T) {
+	compiler, err := dexcel.NewCompiler(nil)
+	require.NoError(t, err)
+
+	// Compile accepts any type
+	result, err := compiler.Compile("true")
+	assert.NoError(t, err)
+	assert.NotNil(t, result)
+
+	result, err = compiler.Compile("'hello'")
+	assert.NoError(t, err)
+	assert.NotNil(t, result)
+
+	result, err = compiler.Compile("42")
+	assert.NoError(t, err)
+	assert.NotNil(t, result)
+}
+
+func TestCompileErrors(t *testing.T) {
+	compiler, err := dexcel.NewCompiler(nil)
+	require.NoError(t, err)
+
+	tests := map[string]struct {
+		expr string
+	}{
+		"syntax error": {
+			expr: "1 +",
+		},
+		"undefined variable": {
+			expr: "undefined_var",
+		},
+		"undefined function": {
+			expr: "undefinedFunc()",
+		},
+	}
+
+	for name, tc := range tests {
+		t.Run(name, func(t *testing.T) {
+			_, err := compiler.Compile(tc.expr)
+			assert.Error(t, err)
+		})
+	}
+}
+
+func TestCompileRejectsUnknownFields(t *testing.T) {
+	vars := dexcel.IdentityVariables()
+	compiler, err := dexcel.NewCompiler(vars)
+	require.NoError(t, err)
+
+	// Typo in field name: should fail at compile time with ObjectType
+	_, err = compiler.CompileBool("identity.emial == 'test@example.com'")
+	assert.Error(t, err)
+	assert.Contains(t, err.Error(), "compilation failed")
+
+	// Type mismatch: comparing string field to int should fail at compile time
+	_, err = compiler.CompileBool("identity.email == 123")
+	assert.Error(t, err)
+	assert.Contains(t, err.Error(), "compilation failed")
+
+	// Valid field: should compile fine
+	_, err = compiler.CompileBool("identity.email == 'test@example.com'")
+	assert.NoError(t, err)
+}
+
+func TestMaxExpressionLength(t *testing.T) {
+	compiler, err := dexcel.NewCompiler(nil)
+	require.NoError(t, err)
+
+	longExpr := "'" + strings.Repeat("a", dexcel.MaxExpressionLength) + "'"
+	_, err = compiler.Compile(longExpr)
+	assert.Error(t, err)
+	assert.Contains(t, err.Error(), "maximum length")
+}
+
+func TestEvalBool(t *testing.T) {
+	vars := dexcel.IdentityVariables()
+	compiler, err := dexcel.NewCompiler(vars)
+	require.NoError(t, err)
+
+	tests := map[string]struct {
+		expr     string
+		identity dexcel.IdentityVal
+		want     bool
+	}{
+		"email endsWith": {
+			expr:     "identity.email.endsWith('@example.com')",
+			identity: dexcel.IdentityVal{Email: "user@example.com"},
+			want:     true,
+		},
+		"email endsWith false": {
+			expr:     "identity.email.endsWith('@example.com')",
+			identity: dexcel.IdentityVal{Email: "user@other.com"},
+			want:     false,
+		},
+		"email_verified": {
+			expr:     "identity.email_verified == true",
+			identity: dexcel.IdentityVal{EmailVerified: true},
+			want:     true,
+		},
+		"group membership": {
+			expr:     "identity.groups.exists(g, g == 'admin')",
+			identity: dexcel.IdentityVal{Groups: []string{"admin", "dev"}},
+			want:     true,
+		},
+	}
+
+	for name, tc := range tests {
+		t.Run(name, func(t *testing.T) {
+			prog, err := compiler.CompileBool(tc.expr)
+			require.NoError(t, err)
+
+			result, err := dexcel.EvalBool(context.Background(), prog, map[string]any{
+				"identity": tc.identity,
+			})
+			require.NoError(t, err)
+			assert.Equal(t, tc.want, result)
+		})
+	}
+}
+
+func TestEvalString(t *testing.T) {
+	vars := dexcel.IdentityVariables()
+	compiler, err := dexcel.NewCompiler(vars)
+	require.NoError(t, err)
+
+	// With ObjectType, identity.email is typed as string, so CompileString works.
+	prog, err := compiler.CompileString("identity.email")
+	require.NoError(t, err)
+
+	result, err := dexcel.EvalString(context.Background(), prog, map[string]any{
+		"identity": dexcel.IdentityVal{Email: "user@example.com"},
+	})
+	require.NoError(t, err)
+	assert.Equal(t, "user@example.com", result)
+}
+
+func TestEvalWithIdentityAndRequest(t *testing.T) {
+	vars := append(dexcel.IdentityVariables(), dexcel.RequestVariables()...)
+	compiler, err := dexcel.NewCompiler(vars)
+	require.NoError(t, err)
+
+	prog, err := compiler.CompileBool(
+		`identity.email.endsWith('@example.com') && 'admin' in identity.groups && request.connector_id == 'okta'`,
+	)
+	require.NoError(t, err)
+
+	identity := dexcel.IdentityFromConnector(connector.Identity{
+		UserID:   "123",
+		Username: "john",
+		Email:    "john@example.com",
+		Groups:   []string{"admin", "dev"},
+	})
+	request := dexcel.RequestFromContext(dexcel.RequestContext{
+		ClientID:    "my-app",
+		ConnectorID: "okta",
+		Scopes:      []string{"openid", "email"},
+	})
+
+	result, err := dexcel.EvalBool(context.Background(), prog, map[string]any{
+		"identity": identity,
+		"request":  request,
+	})
+	require.NoError(t, err)
+	assert.True(t, result)
+}
+
+func TestNewCompilerWithVariables(t *testing.T) {
+	// Claims variable — remains map(string, dyn)
+	compiler, err := dexcel.NewCompiler(dexcel.ClaimsVariable())
+	require.NoError(t, err)
+
+	// claims.email returns dyn from map access, use Compile (not CompileString)
+	prog, err := compiler.Compile("claims.email")
+	require.NoError(t, err)
+
+	result, err := dexcel.EvalString(context.Background(), prog, map[string]any{
+		"claims": map[string]any{
+			"email": "test@example.com",
+		},
+	})
+	require.NoError(t, err)
+	assert.Equal(t, "test@example.com", result)
+}
diff --git a/pkg/cel/cost.go b/pkg/cel/cost.go
new file mode 100644
index 0000000000..d7a09102b1
--- /dev/null
+++ b/pkg/cel/cost.go
@@ -0,0 +1,105 @@
+package cel
+
+import (
+	"fmt"
+
+	"github.com/google/cel-go/checker"
+)
+
+// DefaultCostBudget is the default cost budget for a single expression
+// evaluation. Aligned with Kubernetes defaults: enough for typical identity
+// operations but prevents runaway expressions.
+const DefaultCostBudget uint64 = 10_000_000
+
+// MaxExpressionLength is the maximum length of a CEL expression string.
+const MaxExpressionLength = 10_240
+
+// DefaultStringMaxLength is the estimated max length of string values
+// (emails, usernames, group names, etc.) used for compile-time cost estimation.
+const DefaultStringMaxLength = 256
+
+// DefaultListMaxLength is the estimated max length of list values
+// (groups, scopes) used for compile-time cost estimation.
+const DefaultListMaxLength = 100
+
+// CostEstimate holds the estimated cost range for a compiled expression.
+type CostEstimate struct {
+	Min uint64
+	Max uint64
+}
+
+// EstimateCost returns the estimated cost range for a compiled expression.
+// This is computed statically at compile time without evaluating the expression.
+func (c *Compiler) EstimateCost(result *CompilationResult) (CostEstimate, error) {
+	costEst, err := c.env.EstimateCost(result.ast, &defaultCostEstimator{})
+	if err != nil {
+		return CostEstimate{}, fmt.Errorf("CEL cost estimation failed: %w", err)
+	}
+
+	return CostEstimate{Min: costEst.Min, Max: costEst.Max}, nil
+}
+
+// defaultCostEstimator provides size hints for compile-time cost estimation.
+// Without these hints, the CEL cost estimator assumes unbounded sizes for
+// variables, leading to wildly overestimated max costs.
+type defaultCostEstimator struct{}
+
+func (defaultCostEstimator) EstimateSize(element checker.AstNode) *checker.SizeEstimate {
+	// Provide size hints for map(string, dyn) variables: identity, request, claims.
+	// Without these, the estimator assumes lists/strings can be infinitely large.
+	if element.Path() == nil {
+		return nil
+	}
+
+	path := element.Path()
+	if len(path) == 0 {
+		return nil
+	}
+
+	root := path[0]
+
+	switch root {
+	case "identity", "request", "claims":
+		// Nested field access (e.g. identity.email, identity.groups)
+		if len(path) >= 2 {
+			field := path[1]
+			switch field {
+			case "groups", "scopes":
+				// list(string) fields
+				return &checker.SizeEstimate{Min: 0, Max: DefaultListMaxLength}
+			case "email_verified":
+				// bool field — size is always 1
+				return &checker.SizeEstimate{Min: 1, Max: 1}
+			default:
+				// string fields (email, username, user_id, client_id, etc.)
+				return &checker.SizeEstimate{Min: 0, Max: DefaultStringMaxLength}
+			}
+		}
+		// The map itself: number of keys
+		return &checker.SizeEstimate{Min: 0, Max: 20}
+	}
+
+	return nil
+}
+
+func (defaultCostEstimator) EstimateCallCost(function, overloadID string, target *checker.AstNode, args []checker.AstNode) *checker.CallEstimate {
+	switch function {
+	case "dex.emailDomain", "dex.emailLocalPart":
+		// Simple string split — O(n) where n is string length, bounded.
+		return &checker.CallEstimate{
+			CostEstimate: checker.CostEstimate{Min: 1, Max: 2},
+		}
+	case "dex.groupMatches":
+		// Iterates over groups list and matches each against a pattern.
+		return &checker.CallEstimate{
+			CostEstimate: checker.CostEstimate{Min: 1, Max: DefaultListMaxLength},
+		}
+	case "dex.groupFilter":
+		// Builds a set from allowed list, then iterates groups.
+		return &checker.CallEstimate{
+			CostEstimate: checker.CostEstimate{Min: 1, Max: 2 * DefaultListMaxLength},
+		}
+	}
+
+	return nil
+}
diff --git a/pkg/cel/cost_test.go b/pkg/cel/cost_test.go
new file mode 100644
index 0000000000..9a068be406
--- /dev/null
+++ b/pkg/cel/cost_test.go
@@ -0,0 +1,137 @@
+package cel_test
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	dexcel "github.com/dexidp/dex/pkg/cel"
+)
+
+func TestEstimateCost(t *testing.T) {
+	vars := dexcel.IdentityVariables()
+	compiler, err := dexcel.NewCompiler(vars)
+	require.NoError(t, err)
+
+	tests := map[string]struct {
+		expr string
+	}{
+		"simple bool": {
+			expr: "true",
+		},
+		"string comparison": {
+			expr: "identity.email == 'test@example.com'",
+		},
+		"group membership": {
+			expr: "identity.groups.exists(g, g == 'admin')",
+		},
+	}
+
+	for name, tc := range tests {
+		t.Run(name, func(t *testing.T) {
+			prog, err := compiler.Compile(tc.expr)
+			require.NoError(t, err)
+
+			est, err := compiler.EstimateCost(prog)
+			require.NoError(t, err)
+			assert.True(t, est.Max >= est.Min, "max cost should be >= min cost")
+			assert.True(t, est.Max <= dexcel.DefaultCostBudget,
+				"estimated max cost %d should be within default budget %d", est.Max, dexcel.DefaultCostBudget)
+		})
+	}
+}
+
+func TestCompileTimeCostAcceptsSimpleExpressions(t *testing.T) {
+	vars := append(dexcel.IdentityVariables(), dexcel.RequestVariables()...)
+	compiler, err := dexcel.NewCompiler(vars)
+	require.NoError(t, err)
+
+	tests := map[string]string{
+		"literal":         "true",
+		"email endsWith":  "identity.email.endsWith('@example.com')",
+		"group check":     "'admin' in identity.groups",
+		"emailDomain":     `dex.emailDomain(identity.email)`,
+		"groupMatches":    `dex.groupMatches(identity.groups, "team:*")`,
+		"groupFilter":     `dex.groupFilter(identity.groups, ["admin", "dev"])`,
+		"combined policy": `identity.email.endsWith('@example.com') && 'admin' in identity.groups`,
+		"complex policy": `identity.email.endsWith('@example.com') &&
+			identity.groups.exists(g, g == 'admin') &&
+			request.connector_id == 'okta' &&
+			request.scopes.exists(s, s == 'openid')`,
+		"filter+map chain": `identity.groups
+			.filter(g, g.startsWith('team:'))
+			.map(g, g.replace('team:', ''))
+			.size() > 0`,
+	}
+
+	for name, expr := range tests {
+		t.Run(name, func(t *testing.T) {
+			_, err := compiler.Compile(expr)
+			assert.NoError(t, err, "expression should compile within default budget")
+		})
+	}
+}
+
+func TestCompileTimeCostRejection(t *testing.T) {
+	vars := append(dexcel.IdentityVariables(), dexcel.RequestVariables()...)
+
+	tests := map[string]struct {
+		budget uint64
+		expr   string
+	}{
+		"simple exists exceeds tiny budget": {
+			budget: 1,
+			expr:   "identity.groups.exists(g, g == 'admin')",
+		},
+		"endsWith exceeds tiny budget": {
+			budget: 2,
+			expr:   "identity.email.endsWith('@example.com')",
+		},
+		"nested comprehension over groups exceeds moderate budget": {
+			// Two nested iterations over groups: O(n^2) where n=100 → ~280K
+			budget: 10_000,
+			expr: `identity.groups.exists(g1,
+				identity.groups.exists(g2,
+					g1 != g2 && g1.startsWith(g2)
+				)
+			)`,
+		},
+		"cross-variable comprehension exceeds moderate budget": {
+			// filter groups then check each against scopes: O(n*m) → ~162K
+			budget: 10_000,
+			expr: `identity.groups
+				.filter(g, g.startsWith('team:'))
+				.exists(g, request.scopes.exists(s, s == g))`,
+		},
+		"chained filter+map+filter+map exceeds small budget": {
+			budget: 1000,
+			expr: `identity.groups
+				.filter(g, g.startsWith('team:'))
+				.map(g, g.replace('team:', ''))
+				.filter(g, g.size() > 3)
+				.map(g, g.upperAscii())
+				.size() > 0`,
+		},
+		"many independent exists exceeds small budget": {
+			budget: 5000,
+			expr: `identity.groups.exists(g, g.contains('a')) &&
+				identity.groups.exists(g, g.contains('b')) &&
+				identity.groups.exists(g, g.contains('c')) &&
+				identity.groups.exists(g, g.contains('d')) &&
+				identity.groups.exists(g, g.contains('e'))`,
+		},
+	}
+
+	for name, tc := range tests {
+		t.Run(name, func(t *testing.T) {
+			compiler, err := dexcel.NewCompiler(vars, dexcel.WithCostBudget(tc.budget))
+			require.NoError(t, err)
+
+			_, err = compiler.Compile(tc.expr)
+			assert.Error(t, err)
+			assert.Contains(t, err.Error(), "estimated cost")
+			assert.Contains(t, err.Error(), "exceeds budget")
+		})
+	}
+}
diff --git a/pkg/cel/doc.go b/pkg/cel/doc.go
new file mode 100644
index 0000000000..64c1dbd303
--- /dev/null
+++ b/pkg/cel/doc.go
@@ -0,0 +1,5 @@
+// Package cel provides a safe, sandboxed CEL (Common Expression Language)
+// environment for policy evaluation, claim mapping, and token customization
+// in Dex. It includes cost budgets, Kubernetes-grade compatibility guarantees,
+// and a curated set of extension libraries.
+package cel
diff --git a/pkg/cel/library/doc.go b/pkg/cel/library/doc.go
new file mode 100644
index 0000000000..1452d2b939
--- /dev/null
+++ b/pkg/cel/library/doc.go
@@ -0,0 +1,4 @@
+// Package library provides custom CEL function libraries for Dex.
+// Each library implements the cel.Library interface and can be registered
+// in a CEL environment.
+package library
diff --git a/pkg/cel/library/email.go b/pkg/cel/library/email.go
new file mode 100644
index 0000000000..38fe0dee94
--- /dev/null
+++ b/pkg/cel/library/email.go
@@ -0,0 +1,73 @@
+package library
+
+import (
+	"strings"
+
+	"github.com/google/cel-go/cel"
+	"github.com/google/cel-go/common/types"
+	"github.com/google/cel-go/common/types/ref"
+)
+
+// Email provides email-related CEL functions.
+//
+// Functions (V1):
+//
+//	dex.emailDomain(email: string) -> string
+//	  Returns the domain portion of an email address.
+//	  Example: dex.emailDomain("user@example.com") == "example.com"
+//
+//	dex.emailLocalPart(email: string) -> string
+//	  Returns the local part of an email address.
+//	  Example: dex.emailLocalPart("user@example.com") == "user"
+type Email struct{}
+
+func (Email) CompileOptions() []cel.EnvOption {
+	return []cel.EnvOption{
+		cel.Function("dex.emailDomain",
+			cel.Overload("dex_email_domain_string",
+				[]*cel.Type{cel.StringType},
+				cel.StringType,
+				cel.UnaryBinding(emailDomainImpl),
+			),
+		),
+		cel.Function("dex.emailLocalPart",
+			cel.Overload("dex_email_local_part_string",
+				[]*cel.Type{cel.StringType},
+				cel.StringType,
+				cel.UnaryBinding(emailLocalPartImpl),
+			),
+		),
+	}
+}
+
+func (Email) ProgramOptions() []cel.ProgramOption {
+	return nil
+}
+
+func emailDomainImpl(arg ref.Val) ref.Val {
+	email, ok := arg.Value().(string)
+	if !ok {
+		return types.NewErr("dex.emailDomain: expected string argument")
+	}
+
+	_, domain, found := strings.Cut(email, "@")
+	if !found {
+		return types.String("")
+	}
+
+	return types.String(domain)
+}
+
+func emailLocalPartImpl(arg ref.Val) ref.Val {
+	email, ok := arg.Value().(string)
+	if !ok {
+		return types.NewErr("dex.emailLocalPart: expected string argument")
+	}
+
+	localPart, _, found := strings.Cut(email, "@")
+	if !found {
+		return types.String(email)
+	}
+
+	return types.String(localPart)
+}
diff --git a/pkg/cel/library/email_test.go b/pkg/cel/library/email_test.go
new file mode 100644
index 0000000000..d13e73a1dd
--- /dev/null
+++ b/pkg/cel/library/email_test.go
@@ -0,0 +1,106 @@
+package library_test
+
+import (
+	"context"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	dexcel "github.com/dexidp/dex/pkg/cel"
+)
+
+func TestEmailDomain(t *testing.T) {
+	compiler, err := dexcel.NewCompiler(nil)
+	require.NoError(t, err)
+
+	tests := map[string]struct {
+		expr string
+		want string
+	}{
+		"standard email": {
+			expr: `dex.emailDomain("user@example.com")`,
+			want: "example.com",
+		},
+		"subdomain": {
+			expr: `dex.emailDomain("admin@sub.domain.org")`,
+			want: "sub.domain.org",
+		},
+		"no at sign": {
+			expr: `dex.emailDomain("nodomain")`,
+			want: "",
+		},
+		"empty string": {
+			expr: `dex.emailDomain("")`,
+			want: "",
+		},
+		"multiple at signs": {
+			expr: `dex.emailDomain("user@name@example.com")`,
+			want: "name@example.com",
+		},
+	}
+
+	for name, tc := range tests {
+		t.Run(name, func(t *testing.T) {
+			prog, err := compiler.CompileString(tc.expr)
+			require.NoError(t, err)
+
+			result, err := dexcel.EvalString(context.Background(), prog, map[string]any{})
+			require.NoError(t, err)
+			assert.Equal(t, tc.want, result)
+		})
+	}
+}
+
+func TestEmailLocalPart(t *testing.T) {
+	compiler, err := dexcel.NewCompiler(nil)
+	require.NoError(t, err)
+
+	tests := map[string]struct {
+		expr string
+		want string
+	}{
+		"standard email": {
+			expr: `dex.emailLocalPart("user@example.com")`,
+			want: "user",
+		},
+		"no at sign": {
+			expr: `dex.emailLocalPart("justuser")`,
+			want: "justuser",
+		},
+		"empty string": {
+			expr: `dex.emailLocalPart("")`,
+			want: "",
+		},
+		"multiple at signs": {
+			expr: `dex.emailLocalPart("user@name@example.com")`,
+			want: "user",
+		},
+	}
+
+	for name, tc := range tests {
+		t.Run(name, func(t *testing.T) {
+			prog, err := compiler.CompileString(tc.expr)
+			require.NoError(t, err)
+
+			result, err := dexcel.EvalString(context.Background(), prog, map[string]any{})
+			require.NoError(t, err)
+			assert.Equal(t, tc.want, result)
+		})
+	}
+}
+
+func TestEmailDomainWithIdentityVariable(t *testing.T) {
+	vars := dexcel.IdentityVariables()
+	compiler, err := dexcel.NewCompiler(vars)
+	require.NoError(t, err)
+
+	prog, err := compiler.CompileString(`dex.emailDomain(identity.email)`)
+	require.NoError(t, err)
+
+	result, err := dexcel.EvalString(context.Background(), prog, map[string]any{
+		"identity": dexcel.IdentityVal{Email: "admin@corp.example.com"},
+	})
+	require.NoError(t, err)
+	assert.Equal(t, "corp.example.com", result)
+}
diff --git a/pkg/cel/library/groups.go b/pkg/cel/library/groups.go
new file mode 100644
index 0000000000..fd7f3603f1
--- /dev/null
+++ b/pkg/cel/library/groups.go
@@ -0,0 +1,123 @@
+package library
+
+import (
+	"path"
+
+	"github.com/google/cel-go/cel"
+	"github.com/google/cel-go/common/types"
+	"github.com/google/cel-go/common/types/ref"
+	"github.com/google/cel-go/common/types/traits"
+)
+
+// Groups provides group-related CEL functions.
+//
+// Functions (V1):
+//
+//	dex.groupMatches(groups: list(string), pattern: string) -> list(string)
+//	  Returns groups matching a glob pattern.
+//	  Example: dex.groupMatches(["team:dev", "team:ops", "admin"], "team:*")
+//
+//	dex.groupFilter(groups: list(string), allowed: list(string)) -> list(string)
+//	  Returns only groups present in the allowed list.
+//	  Example: dex.groupFilter(["admin", "dev", "ops"], ["admin", "ops"])
+type Groups struct{}
+
+func (Groups) CompileOptions() []cel.EnvOption {
+	return []cel.EnvOption{
+		cel.Function("dex.groupMatches",
+			cel.Overload("dex_group_matches_list_string",
+				[]*cel.Type{cel.ListType(cel.StringType), cel.StringType},
+				cel.ListType(cel.StringType),
+				cel.BinaryBinding(groupMatchesImpl),
+			),
+		),
+		cel.Function("dex.groupFilter",
+			cel.Overload("dex_group_filter_list_list",
+				[]*cel.Type{cel.ListType(cel.StringType), cel.ListType(cel.StringType)},
+				cel.ListType(cel.StringType),
+				cel.BinaryBinding(groupFilterImpl),
+			),
+		),
+	}
+}
+
+func (Groups) ProgramOptions() []cel.ProgramOption {
+	return nil
+}
+
+func groupMatchesImpl(lhs, rhs ref.Val) ref.Val {
+	groupList, ok := lhs.(traits.Lister)
+	if !ok {
+		return types.NewErr("dex.groupMatches: expected list(string) as first argument")
+	}
+
+	pattern, ok := rhs.Value().(string)
+	if !ok {
+		return types.NewErr("dex.groupMatches: expected string pattern as second argument")
+	}
+
+	iter := groupList.Iterator()
+	var matched []ref.Val
+
+	for iter.HasNext() == types.True {
+		item := iter.Next()
+
+		group, ok := item.Value().(string)
+		if !ok {
+			continue
+		}
+
+		ok, err := path.Match(pattern, group)
+		if err != nil {
+			return types.NewErr("dex.groupMatches: invalid pattern %q: %v", pattern, err)
+		}
+		if ok {
+			matched = append(matched, types.String(group))
+		}
+	}
+
+	return types.NewRefValList(types.DefaultTypeAdapter, matched)
+}
+
+func groupFilterImpl(lhs, rhs ref.Val) ref.Val {
+	groupList, ok := lhs.(traits.Lister)
+	if !ok {
+		return types.NewErr("dex.groupFilter: expected list(string) as first argument")
+	}
+
+	allowedList, ok := rhs.(traits.Lister)
+	if !ok {
+		return types.NewErr("dex.groupFilter: expected list(string) as second argument")
+	}
+
+	allowed := make(map[string]struct{})
+	iter := allowedList.Iterator()
+	for iter.HasNext() == types.True {
+		item := iter.Next()
+
+		s, ok := item.Value().(string)
+		if !ok {
+			continue
+		}
+
+		allowed[s] = struct{}{}
+	}
+
+	var filtered []ref.Val
+	iter = groupList.Iterator()
+
+	for iter.HasNext() == types.True {
+		item := iter.Next()
+
+		group, ok := item.Value().(string)
+		if !ok {
+			continue
+		}
+
+		if _, exists := allowed[group]; exists {
+			filtered = append(filtered, types.String(group))
+		}
+	}
+
+	return types.NewRefValList(types.DefaultTypeAdapter, filtered)
+}
diff --git a/pkg/cel/library/groups_test.go b/pkg/cel/library/groups_test.go
new file mode 100644
index 0000000000..70a68fb211
--- /dev/null
+++ b/pkg/cel/library/groups_test.go
@@ -0,0 +1,141 @@
+package library_test
+
+import (
+	"context"
+	"reflect"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	dexcel "github.com/dexidp/dex/pkg/cel"
+)
+
+func TestGroupMatches(t *testing.T) {
+	vars := dexcel.IdentityVariables()
+	compiler, err := dexcel.NewCompiler(vars)
+	require.NoError(t, err)
+
+	tests := map[string]struct {
+		expr   string
+		groups []string
+		want   []string
+	}{
+		"wildcard pattern": {
+			expr:   `dex.groupMatches(identity.groups, "team:*")`,
+			groups: []string{"team:dev", "team:ops", "admin"},
+			want:   []string{"team:dev", "team:ops"},
+		},
+		"exact match": {
+			expr:   `dex.groupMatches(identity.groups, "admin")`,
+			groups: []string{"team:dev", "admin", "user"},
+			want:   []string{"admin"},
+		},
+		"no matches": {
+			expr:   `dex.groupMatches(identity.groups, "nonexistent")`,
+			groups: []string{"team:dev", "admin"},
+			want:   []string{},
+		},
+		"question mark pattern": {
+			expr:   `dex.groupMatches(identity.groups, "team?")`,
+			groups: []string{"teamA", "teamB", "teams-long"},
+			want:   []string{"teamA", "teamB"},
+		},
+		"match all": {
+			expr:   `dex.groupMatches(identity.groups, "*")`,
+			groups: []string{"a", "b", "c"},
+			want:   []string{"a", "b", "c"},
+		},
+	}
+
+	for name, tc := range tests {
+		t.Run(name, func(t *testing.T) {
+			prog, err := compiler.CompileStringList(tc.expr)
+			require.NoError(t, err)
+
+			out, err := dexcel.Eval(context.Background(), prog, map[string]any{
+				"identity": dexcel.IdentityVal{Groups: tc.groups},
+			})
+			require.NoError(t, err)
+
+			nativeVal, err := out.ConvertToNative(reflect.TypeOf([]string{}))
+			require.NoError(t, err)
+
+			got, ok := nativeVal.([]string)
+			require.True(t, ok, "expected []string, got %T", nativeVal)
+			assert.Equal(t, tc.want, got)
+		})
+	}
+}
+
+func TestGroupMatchesInvalidPattern(t *testing.T) {
+	vars := dexcel.IdentityVariables()
+	compiler, err := dexcel.NewCompiler(vars)
+	require.NoError(t, err)
+
+	prog, err := compiler.CompileStringList(`dex.groupMatches(identity.groups, "[invalid")`)
+	require.NoError(t, err)
+
+	_, err = dexcel.Eval(context.Background(), prog, map[string]any{
+		"identity": dexcel.IdentityVal{Groups: []string{"admin"}},
+	})
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "invalid pattern")
+}
+
+func TestGroupFilter(t *testing.T) {
+	vars := dexcel.IdentityVariables()
+	compiler, err := dexcel.NewCompiler(vars)
+	require.NoError(t, err)
+
+	tests := map[string]struct {
+		expr   string
+		groups []string
+		want   []string
+	}{
+		"filter to allowed": {
+			expr:   `dex.groupFilter(identity.groups, ["admin", "ops"])`,
+			groups: []string{"admin", "dev", "ops"},
+			want:   []string{"admin", "ops"},
+		},
+		"no overlap": {
+			expr:   `dex.groupFilter(identity.groups, ["marketing"])`,
+			groups: []string{"admin", "dev"},
+			want:   []string{},
+		},
+		"all allowed": {
+			expr:   `dex.groupFilter(identity.groups, ["a", "b", "c"])`,
+			groups: []string{"a", "b", "c"},
+			want:   []string{"a", "b", "c"},
+		},
+		"empty allowed list": {
+			expr:   `dex.groupFilter(identity.groups, [])`,
+			groups: []string{"admin", "dev"},
+			want:   []string{},
+		},
+		"preserves order": {
+			expr:   `dex.groupFilter(identity.groups, ["z", "a"])`,
+			groups: []string{"a", "b", "z"},
+			want:   []string{"a", "z"},
+		},
+	}
+
+	for name, tc := range tests {
+		t.Run(name, func(t *testing.T) {
+			prog, err := compiler.CompileStringList(tc.expr)
+			require.NoError(t, err)
+
+			out, err := dexcel.Eval(context.Background(), prog, map[string]any{
+				"identity": dexcel.IdentityVal{Groups: tc.groups},
+			})
+			require.NoError(t, err)
+
+			nativeVal, err := out.ConvertToNative(reflect.TypeOf([]string{}))
+			require.NoError(t, err)
+
+			got, ok := nativeVal.([]string)
+			require.True(t, ok, "expected []string, got %T", nativeVal)
+			assert.Equal(t, tc.want, got)
+		})
+	}
+}
diff --git a/pkg/cel/types.go b/pkg/cel/types.go
new file mode 100644
index 0000000000..4e65792290
--- /dev/null
+++ b/pkg/cel/types.go
@@ -0,0 +1,109 @@
+package cel
+
+import (
+	"github.com/google/cel-go/cel"
+
+	"github.com/dexidp/dex/connector"
+)
+
+// VariableDeclaration declares a named variable and its CEL type
+// that will be available in expressions.
+type VariableDeclaration struct {
+	Name string
+	Type *cel.Type
+}
+
+// IdentityVal is the CEL native type for the identity variable.
+// Fields are typed so that the CEL compiler rejects unknown field access
+// (e.g. identity.emial) at config load time rather than at evaluation time.
+type IdentityVal struct {
+	UserID            string   `cel:"user_id"`
+	Username          string   `cel:"username"`
+	PreferredUsername string   `cel:"preferred_username"`
+	Email             string   `cel:"email"`
+	EmailVerified     bool     `cel:"email_verified"`
+	Groups            []string `cel:"groups"`
+}
+
+// RequestVal is the CEL native type for the request variable.
+type RequestVal struct {
+	ClientID    string   `cel:"client_id"`
+	ConnectorID string   `cel:"connector_id"`
+	Scopes      []string `cel:"scopes"`
+	RedirectURI string   `cel:"redirect_uri"`
+}
+
+// identityTypeName is the CEL type name for IdentityVal.
+// Derived by ext.NativeTypes as simplePkgAlias(pkgPath) + "." + structName.
+const identityTypeName = "cel.IdentityVal"
+
+// requestTypeName is the CEL type name for RequestVal.
+const requestTypeName = "cel.RequestVal"
+
+// IdentityVariables provides the 'identity' variable with typed fields.
+//
+//	identity.user_id            — string
+//	identity.username           — string
+//	identity.preferred_username — string
+//	identity.email              — string
+//	identity.email_verified     — bool
+//	identity.groups             — list(string)
+func IdentityVariables() []VariableDeclaration {
+	return []VariableDeclaration{
+		{Name: "identity", Type: cel.ObjectType(identityTypeName)},
+	}
+}
+
+// RequestVariables provides the 'request' variable with typed fields.
+//
+//	request.client_id     — string
+//	request.connector_id  — string
+//	request.scopes        — list(string)
+//	request.redirect_uri  — string
+func RequestVariables() []VariableDeclaration {
+	return []VariableDeclaration{
+		{Name: "request", Type: cel.ObjectType(requestTypeName)},
+	}
+}
+
+// ClaimsVariable provides a 'claims' map for raw upstream claims.
+// Claims remain map(string, dyn) because their shape is genuinely
+// unknown — they carry arbitrary upstream IdP data.
+//
+//	claims — map(string, dyn)
+func ClaimsVariable() []VariableDeclaration {
+	return []VariableDeclaration{
+		{Name: "claims", Type: cel.MapType(cel.StringType, cel.DynType)},
+	}
+}
+
+// IdentityFromConnector converts a connector.Identity to a CEL-compatible IdentityVal.
+func IdentityFromConnector(id connector.Identity) IdentityVal {
+	return IdentityVal{
+		UserID:            id.UserID,
+		Username:          id.Username,
+		PreferredUsername: id.PreferredUsername,
+		Email:             id.Email,
+		EmailVerified:     id.EmailVerified,
+		Groups:            id.Groups,
+	}
+}
+
+// RequestContext represents the authentication/token request context
+// available as the 'request' variable in CEL expressions.
+type RequestContext struct {
+	ClientID    string
+	ConnectorID string
+	Scopes      []string
+	RedirectURI string
+}
+
+// RequestFromContext converts a RequestContext to a CEL-compatible RequestVal.
+func RequestFromContext(rc RequestContext) RequestVal {
+	return RequestVal{
+		ClientID:    rc.ClientID,
+		ConnectorID: rc.ConnectorID,
+		Scopes:      rc.Scopes,
+		RedirectURI: rc.RedirectURI,
+	}
+}
diff --git a/pkg/featureflags/doc.go b/pkg/featureflags/doc.go
new file mode 100644
index 0000000000..2703329361
--- /dev/null
+++ b/pkg/featureflags/doc.go
@@ -0,0 +1,3 @@
+// Package featureflags provides a mechanism for toggling experimental or
+// optional Dex features via environment variables (DEX_<FLAG_NAME>).
+package featureflags
diff --git a/pkg/featureflags/flag.go b/pkg/featureflags/flag.go
new file mode 100644
index 0000000000..98729ac9ed
--- /dev/null
+++ b/pkg/featureflags/flag.go
@@ -0,0 +1,33 @@
+package featureflags
+
+import (
+	"os"
+	"strconv"
+	"strings"
+)
+
+type flag struct {
+	Name    string
+	Default bool
+}
+
+func (f *flag) env() string {
+	return "DEX_" + strings.ToUpper(f.Name)
+}
+
+func (f *flag) Enabled() bool {
+	raw := os.Getenv(f.env())
+	if raw == "" {
+		return f.Default
+	}
+
+	res, err := strconv.ParseBool(raw)
+	if err != nil {
+		return f.Default
+	}
+	return res
+}
+
+func newFlag(s string, d bool) *flag {
+	return &flag{Name: s, Default: d}
+}
diff --git a/pkg/featureflags/set.go b/pkg/featureflags/set.go
new file mode 100644
index 0000000000..a63da72ce0
--- /dev/null
+++ b/pkg/featureflags/set.go
@@ -0,0 +1,30 @@
+package featureflags
+
+var (
+	// EntEnabled enables experimental ent-based engine for the database storages.
+	// https://entgo.io/
+	EntEnabled = newFlag("ent_enabled", false)
+
+	// ExpandEnv can enable or disable env expansion in the config which can be useful in environments where, e.g.,
+	// $ sign is a part of the password for LDAP user.
+	ExpandEnv = newFlag("expand_env", true)
+
+	// APIConnectorsCRUD allows CRUD operations on connectors through the gRPC API
+	APIConnectorsCRUD = newFlag("api_connectors_crud", false)
+
+	// ContinueOnConnectorFailure allows the server to start even if some connectors fail to initialize.
+	ContinueOnConnectorFailure = newFlag("continue_on_connector_failure", true)
+
+	// ConfigDisallowUnknownFields enables to forbid unknown fields in the config while unmarshaling.
+	ConfigDisallowUnknownFields = newFlag("config_disallow_unknown_fields", false)
+
+	// ClientCredentialGrantEnabledByDefault enables the client_credentials grant type by default
+	// without requiring explicit configuration in oauth2.grantTypes.
+	ClientCredentialGrantEnabledByDefault = newFlag("client_credential_grant_enabled_by_default", false)
+
+	// SessionsEnabled enables experimental auth sessions support.
+	SessionsEnabled = newFlag("sessions_enabled", false)
+
+	// APISessionsIdentitiesCRUD allows CRUD operations on auth sessions and user identities through the gRPC API.
+	APISessionsIdentitiesCRUD = newFlag("api_sessions_identities_crud", false)
+)
diff --git a/pkg/groups/doc.go b/pkg/groups/doc.go
new file mode 100644
index 0000000000..f1a21d02b8
--- /dev/null
+++ b/pkg/groups/doc.go
@@ -0,0 +1,2 @@
+// Package groups contains helper functions related to groups.
+package groups
diff --git a/pkg/groups/groups.go b/pkg/groups/groups.go
index 5dde65ab83..d31a5dee3b 100644
--- a/pkg/groups/groups.go
+++ b/pkg/groups/groups.go
@@ -1,4 +1,3 @@
-// Package groups contains helper functions related to groups
 package groups
 
 // Filter filters out any groups of given that are not in required. Thus it may
diff --git a/pkg/httpclient/doc.go b/pkg/httpclient/doc.go
new file mode 100644
index 0000000000..3d028a3a1f
--- /dev/null
+++ b/pkg/httpclient/doc.go
@@ -0,0 +1,3 @@
+// Package httpclient provides a configurable HTTP client constructor with
+// support for custom CA certificates, root CAs, and TLS settings.
+package httpclient
diff --git a/pkg/httpclient/httpclient.go b/pkg/httpclient/httpclient.go
new file mode 100644
index 0000000000..671e0e7754
--- /dev/null
+++ b/pkg/httpclient/httpclient.go
@@ -0,0 +1,64 @@
+package httpclient
+
+import (
+	"crypto/tls"
+	"crypto/x509"
+	"encoding/base64"
+	"fmt"
+	"net"
+	"net/http"
+	"os"
+	"time"
+)
+
+func extractCAs(input []string) [][]byte {
+	result := make([][]byte, 0, len(input))
+	for _, ca := range input {
+		if ca == "" {
+			continue
+		}
+
+		pemData, err := os.ReadFile(ca)
+		if err != nil {
+			pemData, err = base64.StdEncoding.DecodeString(ca)
+			if err != nil {
+				pemData = []byte(ca)
+			}
+		}
+
+		result = append(result, pemData)
+	}
+	return result
+}
+
+func NewHTTPClient(rootCAs []string, insecureSkipVerify bool) (*http.Client, error) {
+	pool, err := x509.SystemCertPool()
+	if err != nil {
+		return nil, err
+	}
+
+	tlsConfig := tls.Config{RootCAs: pool, InsecureSkipVerify: insecureSkipVerify}
+	for index, rootCABytes := range extractCAs(rootCAs) {
+		if !tlsConfig.RootCAs.AppendCertsFromPEM(rootCABytes) {
+			return nil, fmt.Errorf("rootCAs.%d is not in PEM format, certificate must be "+
+				"a PEM encoded string, a base64 encoded bytes that contain PEM encoded string, "+
+				"or a path to a PEM encoded certificate", index)
+		}
+	}
+
+	return &http.Client{
+		Transport: &http.Transport{
+			TLSClientConfig: &tlsConfig,
+			Proxy:           http.ProxyFromEnvironment,
+			DialContext: (&net.Dialer{
+				Timeout:   30 * time.Second,
+				KeepAlive: 30 * time.Second,
+				DualStack: true,
+			}).DialContext,
+			MaxIdleConns:          100,
+			IdleConnTimeout:       90 * time.Second,
+			TLSHandshakeTimeout:   10 * time.Second,
+			ExpectContinueTimeout: 1 * time.Second,
+		},
+	}, nil
+}
diff --git a/pkg/httpclient/httpclient_test.go b/pkg/httpclient/httpclient_test.go
new file mode 100644
index 0000000000..6f561c1030
--- /dev/null
+++ b/pkg/httpclient/httpclient_test.go
@@ -0,0 +1,83 @@
+package httpclient_test
+
+import (
+	"crypto/tls"
+	"encoding/base64"
+	"fmt"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+
+	"github.com/dexidp/dex/pkg/httpclient"
+)
+
+func TestRootCAs(t *testing.T) {
+	ts, err := NewLocalHTTPSTestServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		fmt.Fprint(w, "Hello, client")
+	}))
+	assert.Nil(t, err)
+	defer ts.Close()
+
+	runTest := func(name string, certs []string) {
+		t.Run(name, func(t *testing.T) {
+			rootCAs := certs
+			testClient, err := httpclient.NewHTTPClient(rootCAs, false)
+			assert.Nil(t, err)
+
+			res, err := testClient.Get(ts.URL)
+			assert.Nil(t, err)
+
+			greeting, err := io.ReadAll(res.Body)
+			res.Body.Close()
+			assert.Nil(t, err)
+
+			assert.Equal(t, "Hello, client", string(greeting))
+		})
+	}
+
+	runTest("From file", []string{"testdata/rootCA.pem"})
+
+	content, err := os.ReadFile("testdata/rootCA.pem")
+	assert.NoError(t, err)
+	runTest("From string", []string{string(content)})
+
+	contentStr := base64.StdEncoding.EncodeToString(content)
+	runTest("From bytes", []string{contentStr})
+}
+
+func TestInsecureSkipVerify(t *testing.T) {
+	ts, err := NewLocalHTTPSTestServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		fmt.Fprint(w, "Hello, client")
+	}))
+	assert.Nil(t, err)
+	defer ts.Close()
+
+	insecureSkipVerify := true
+
+	testClient, err := httpclient.NewHTTPClient(nil, insecureSkipVerify)
+	assert.Nil(t, err)
+
+	res, err := testClient.Get(ts.URL)
+	assert.Nil(t, err)
+
+	greeting, err := io.ReadAll(res.Body)
+	res.Body.Close()
+	assert.Nil(t, err)
+
+	assert.Equal(t, "Hello, client", string(greeting))
+}
+
+func NewLocalHTTPSTestServer(handler http.Handler) (*httptest.Server, error) {
+	ts := httptest.NewUnstartedServer(handler)
+	cert, err := tls.LoadX509KeyPair("testdata/server.crt", "testdata/server.key")
+	if err != nil {
+		return nil, err
+	}
+	ts.TLS = &tls.Config{Certificates: []tls.Certificate{cert}}
+	ts.StartTLS()
+	return ts, nil
+}
diff --git a/pkg/httpclient/readme.md b/pkg/httpclient/readme.md
new file mode 100644
index 0000000000..cc26252293
--- /dev/null
+++ b/pkg/httpclient/readme.md
@@ -0,0 +1,44 @@
+# Regenerate testdata
+
+### server.csr.cnf
+
+```
+[req]
+default_bits = 2048
+prompt = no
+default_md = sha256
+distinguished_name = dn
+
+[dn]
+C=US
+ST=RandomState
+L=RandomCity
+O=RandomOrganization
+OU=RandomOrganizationUnit
+emailAddress=hello@example.com
+CN = localhost
+```
+
+and
+
+### v3.ext
+```
+authorityKeyIdentifier=keyid,issuer
+basicConstraints=CA:FALSE
+keyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment
+subjectAltName = @alt_names
+
+[alt_names]
+DNS.1 = localhost
+IP.1 = 127.0.0.1
+```
+
+### Then enter the following commands:
+
+`openssl genrsa -out rootCA.key 2048`
+
+`openssl req -x509 -new -nodes -key rootCA.key -sha256 -days 3650 -out rootCA.pem -config server.csr.cnf`
+
+`openssl req -new -sha256 -nodes -out server.csr -newkey rsa:2048 -keyout server.key -config server.csr.cnf`
+
+`openssl x509 -req -in server.csr -CA rootCA.pem -CAkey rootCA.key -CAcreateserial -out server.crt -days 3650 -sha256 -extfile v3.ext`
diff --git a/pkg/httpclient/testdata/rootCA.key b/pkg/httpclient/testdata/rootCA.key
new file mode 100644
index 0000000000..9c4eeee12a
--- /dev/null
+++ b/pkg/httpclient/testdata/rootCA.key
@@ -0,0 +1,27 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIIEowIBAAKCAQEA4dB5aQCjCmMsW71u9F0WNm1TYjXQBZ4p7oNT+BQwCc/MZ2xc
+5NexS2O86nbRkw5jwyfAAMSMKRr9s2FluVTHqiln78rg+XUgmrmNT3ZroLmW6QL6
+Ca8dbMPky+tQclZsvMd3HAeCyyrs4pf7wM1AyUJD7H0xAlVD1fsohkg7jhBFUfV+
+q2VMMdnsaV5vFrW/2vPBWz1SNPW/Xm+Ilny7xg9njQLcPMNtVtF+7EPB6sxD6qrj
+BC+Kj5zQ3bZOfdrh7yy63dbh/Kh+3NScgO+k+x92HlAjRIvj5y4KrbGZl7CmOth5
+y7fPywApVbDfZRWJChI1PVflOyDdnC+vhMLbHQIDAQABAoIBAEmjrrQrXP/6L3EL
+aa+O27uME3Enk1sBpTL+6Ncx3iiU91eS4whNvqeTMvxTGy0VuDrgL6EQd5TAFJP2
+4zF5EFPRhO+R/aPcKnHKqOaM+7RCUZBTRC78SGA70dUeO/HNdVBqy9D8Mg8HRJDw
+d0z8om//iB8LBHx6SdDyQtjnnWRKFTzQRurBBoyLe2vPMFtINKtNUkahjc8HE4GO
+aIv1LICJUzf4ZnkntKd5cFHZ42R2Tmfj0Y9G9DyJbuSA3+0u5IhYB39Uy6jFxLi8
+I5PoIVhgYZ0aivsVBIviShwQ9kgv6807YBxt22eSNovBDrSp+cAnIF9+p0b3MnkU
+aCHSiBECgYEA84lssi6AqfCEsSiQMSM9kMCXJ4KQI/l7pmrIA50+V5HSEby9lg2Y
+N6XJ4V4q46t8FcZBjmMvzn9fwiPMRw5e995cVNBQ31a1FX/1Hy6RNtEiLZRnkHI5
+WznY9IxQ+c9JXJeFY1sO0BfO0TS3WvOf1rwqOb92q+cQaItnPQ+4Ya8CgYEA7V7e
+IqW3PpO4H+c5hH9egM0BjAxH71C9YpYzZpF9uiPIkuMnJ8nm9bB6RiuDaYCxvrfE
+A0h/SQewoYJKL4OfKGjrbG7U4zLMZHIWlf8Za55Zik5BNjvgBqFFrrSgLUGxdRTX
+N0+TlWlW1bvJblWpdjIbJbg/6kCU98TzK852fvMCgYAWYa/apElw1MjtGyQ9T9bN
+odWCbQ5gMAJ8Jd4h7uaW17DtrmHiE3fEzXjDPItGhzENMz49HsJ7ANvFFNMmSJzT
+vNzRcp+sFuTnh+34Iqh32DqC49usu8KnrqZQu0CJ5NICL26z1d+DolyAf47GThOH
+gZ2D1yPJ4p9wbDddtj8kwwKBgCFKB68mPG+rOcxHmjppvnAj0A66/i+izBySYf0F
+dHNxZ0SqVKhw2VIlgNBsc86M/OB5VyT6utccG/paklrdg6mgJTwcwwBl9GI12dMJ
+ZqBAIeCSnvSjKwTjAynALSKLrv5zgMdCArmWf1YUMuilXNG1rzb4AwawLfQdi9jd
+6KJfAoGBALFl6ldywl3sGPk9K2xCDYYhb1TNQyheA5YvoZzZ6XCo1q0Lbwy/FamZ
+0TSWkoEmGB/Hck3HgtZDRo3CTI1vYfbpAtgI7oD1NA1zMaLulNQxKjH3iVvyb+R7
+ZcIT7EVPZgkUwr0bsp22yVDekh/CHoB6FZPCyoAb8WnfJfooTBzB
+-----END RSA PRIVATE KEY-----
diff --git a/pkg/httpclient/testdata/rootCA.pem b/pkg/httpclient/testdata/rootCA.pem
new file mode 100644
index 0000000000..c03bdac0c0
--- /dev/null
+++ b/pkg/httpclient/testdata/rootCA.pem
@@ -0,0 +1,23 @@
+-----BEGIN CERTIFICATE-----
+MIID1jCCAr4CCQCG4JBeSi6cDjANBgkqhkiG9w0BAQsFADCBrDELMAkGA1UEBhMC
+VVMxFDASBgNVBAgMC1JhbmRvbVN0YXRlMRMwEQYDVQQHDApSYW5kb21DaXR5MRsw
+GQYDVQQKDBJSYW5kb21Pcmdhbml6YXRpb24xHzAdBgNVBAsMFlJhbmRvbU9yZ2Fu
+aXphdGlvblVuaXQxIDAeBgkqhkiG9w0BCQEWEWhlbGxvQGV4YW1wbGUuY29tMRIw
+EAYDVQQDDAlsb2NhbGhvc3QwHhcNMjIxMDA3MjIwNjQwWhcNMzIxMDA0MjIwNjQw
+WjCBrDELMAkGA1UEBhMCVVMxFDASBgNVBAgMC1JhbmRvbVN0YXRlMRMwEQYDVQQH
+DApSYW5kb21DaXR5MRswGQYDVQQKDBJSYW5kb21Pcmdhbml6YXRpb24xHzAdBgNV
+BAsMFlJhbmRvbU9yZ2FuaXphdGlvblVuaXQxIDAeBgkqhkiG9w0BCQEWEWhlbGxv
+QGV4YW1wbGUuY29tMRIwEAYDVQQDDAlsb2NhbGhvc3QwggEiMA0GCSqGSIb3DQEB
+AQUAA4IBDwAwggEKAoIBAQDh0HlpAKMKYyxbvW70XRY2bVNiNdAFninug1P4FDAJ
+z8xnbFzk17FLY7zqdtGTDmPDJ8AAxIwpGv2zYWW5VMeqKWfvyuD5dSCauY1Pdmug
+uZbpAvoJrx1sw+TL61ByVmy8x3ccB4LLKuzil/vAzUDJQkPsfTECVUPV+yiGSDuO
+EEVR9X6rZUwx2expXm8Wtb/a88FbPVI09b9eb4iWfLvGD2eNAtw8w21W0X7sQ8Hq
+zEPqquMEL4qPnNDdtk592uHvLLrd1uH8qH7c1JyA76T7H3YeUCNEi+PnLgqtsZmX
+sKY62HnLt8/LAClVsN9lFYkKEjU9V+U7IN2cL6+EwtsdAgMBAAEwDQYJKoZIhvcN
+AQELBQADggEBAN6g0qit/3R2X+KdR0LgRXF/h4qQFgcV6cxnhRAmLIDNJlxKSHqN
+IE5+bxzCbkblzGfr/jNPqW0s+yaN4CyMgKNYSzkLBPE4FF+19Uv+dyYfFms3mDJ7
+0rGjS5bCscThWhpaSw20LcwQcr/+X+/fGzJ01dVFK1UOjBKg4d4dMwxklbIkZqIq
+siRW0GMy26mgVZ/BSjeh5kEjs6h6H3cJsGl7xYT+BI7wnxHwGeT9tkBgiyT5FwaS
+vtdZkBpQ9q8f7FwsEm3woLHdWuOnrtUtVpY/oc6WFGdROQdGzjSk0D3kHs9YhueC
+GSzZKrqX+TSIgpPrLYNHX4uxlo5TAwP/5GM=
+-----END CERTIFICATE-----
diff --git a/pkg/httpclient/testdata/rootCA.srl b/pkg/httpclient/testdata/rootCA.srl
new file mode 100644
index 0000000000..214ae68bf1
--- /dev/null
+++ b/pkg/httpclient/testdata/rootCA.srl
@@ -0,0 +1 @@
+C1B35F0051A641BB
diff --git a/pkg/httpclient/testdata/server.crt b/pkg/httpclient/testdata/server.crt
new file mode 100644
index 0000000000..9b0f12ec58
--- /dev/null
+++ b/pkg/httpclient/testdata/server.crt
@@ -0,0 +1,29 @@
+-----BEGIN CERTIFICATE-----
+MIIE5TCCA82gAwIBAgIJAMGzXwBRpkG7MA0GCSqGSIb3DQEBCwUAMIGsMQswCQYD
+VQQGEwJVUzEUMBIGA1UECAwLUmFuZG9tU3RhdGUxEzARBgNVBAcMClJhbmRvbUNp
+dHkxGzAZBgNVBAoMElJhbmRvbU9yZ2FuaXphdGlvbjEfMB0GA1UECwwWUmFuZG9t
+T3JnYW5pemF0aW9uVW5pdDEgMB4GCSqGSIb3DQEJARYRaGVsbG9AZXhhbXBsZS5j
+b20xEjAQBgNVBAMMCWxvY2FsaG9zdDAeFw0yMjEwMDcyMjA3MDhaFw0zMjEwMDQy
+MjA3MDhaMIGsMQswCQYDVQQGEwJVUzEUMBIGA1UECAwLUmFuZG9tU3RhdGUxEzAR
+BgNVBAcMClJhbmRvbUNpdHkxGzAZBgNVBAoMElJhbmRvbU9yZ2FuaXphdGlvbjEf
+MB0GA1UECwwWUmFuZG9tT3JnYW5pemF0aW9uVW5pdDEgMB4GCSqGSIb3DQEJARYR
+aGVsbG9AZXhhbXBsZS5jb20xEjAQBgNVBAMMCWxvY2FsaG9zdDCCASIwDQYJKoZI
+hvcNAQEBBQADggEPADCCAQoCggEBAMuKdpXP87Q7Kg3iafXzvBuVIyV1K5UmMYiN
+koztkC5XrCzHaQRS/CoIb7/nUqmtAxx7RL0jzhZ93zBN4HY/Zcnrd9tXoPPxi0mG
+ZZWfFU6nN8nOkMHWzEbHVBmhxpfGtwmLcajQ4HrK1TZwJUn6GqclHQRy/gjxkiw5
+KPqzfVOVlA6ht4KdKstKazQkWZ5gdWT4d8yrEy/IT4oaW05xALBMQ7YGjkzWKsSF
+6ygXI7xqF9rg9jCnUsPYg4f8ut3N0c00KjsfKOOj2dF/ZyjedQ5c0u4hHmxSo3Ka
+0ZTmIrMfbVXgGjxRG2HZXLpPvQKoCf/fOX8Irdr+lahFVKASxN0CAwEAAaOCAQYw
+ggECMIHLBgNVHSMEgcMwgcChgbKkga8wgawxCzAJBgNVBAYTAlVTMRQwEgYDVQQI
+DAtSYW5kb21TdGF0ZTETMBEGA1UEBwwKUmFuZG9tQ2l0eTEbMBkGA1UECgwSUmFu
+ZG9tT3JnYW5pemF0aW9uMR8wHQYDVQQLDBZSYW5kb21Pcmdhbml6YXRpb25Vbml0
+MSAwHgYJKoZIhvcNAQkBFhFoZWxsb0BleGFtcGxlLmNvbTESMBAGA1UEAwwJbG9j
+YWxob3N0ggkAhuCQXkounA4wCQYDVR0TBAIwADALBgNVHQ8EBAMCBPAwGgYDVR0R
+BBMwEYIJbG9jYWxob3N0hwR/AAABMA0GCSqGSIb3DQEBCwUAA4IBAQCWmh5ebpkm
+v2B1yQgarSCSSkLZ5DZSAJjrPgW2IJqCW2q2D1HworbW1Yn5jqrM9FKGnJfjCyve
+zBB5AOlGp+0bsZGgMRMCavgv4QhTThXUoJqqHcfEu4wHndcgrqSadxmV5aisSR4u
+gXnjW43o3akby+h1K40RR3vVkpzPaoC3/bgk7WVpfpPiP32E24a01gETozRb/of/
+ATN3JBe0xh+e63CrPX1sago5+u3UETIoOr0fW8M/gU9GApmJiFAXwHag6j54hLCG
+23EtVDwmlarG8Pj+i0yru8s22QqzAJi5E0OwR4aB8tqicLKYBVfzyLCOielIBUrK
+OkuFKp+VjxQX
+-----END CERTIFICATE-----
diff --git a/pkg/httpclient/testdata/server.csr b/pkg/httpclient/testdata/server.csr
new file mode 100644
index 0000000000..f422a853c3
--- /dev/null
+++ b/pkg/httpclient/testdata/server.csr
@@ -0,0 +1,18 @@
+-----BEGIN CERTIFICATE REQUEST-----
+MIIC8jCCAdoCAQAwgawxCzAJBgNVBAYTAlVTMRQwEgYDVQQIDAtSYW5kb21TdGF0
+ZTETMBEGA1UEBwwKUmFuZG9tQ2l0eTEbMBkGA1UECgwSUmFuZG9tT3JnYW5pemF0
+aW9uMR8wHQYDVQQLDBZSYW5kb21Pcmdhbml6YXRpb25Vbml0MSAwHgYJKoZIhvcN
+AQkBFhFoZWxsb0BleGFtcGxlLmNvbTESMBAGA1UEAwwJbG9jYWxob3N0MIIBIjAN
+BgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAy4p2lc/ztDsqDeJp9fO8G5UjJXUr
+lSYxiI2SjO2QLlesLMdpBFL8Kghvv+dSqa0DHHtEvSPOFn3fME3gdj9lyet321eg
+8/GLSYZllZ8VTqc3yc6QwdbMRsdUGaHGl8a3CYtxqNDgesrVNnAlSfoapyUdBHL+
+CPGSLDko+rN9U5WUDqG3gp0qy0prNCRZnmB1ZPh3zKsTL8hPihpbTnEAsExDtgaO
+TNYqxIXrKBcjvGoX2uD2MKdSw9iDh/y63c3RzTQqOx8o46PZ0X9nKN51DlzS7iEe
+bFKjcprRlOYisx9tVeAaPFEbYdlcuk+9AqgJ/985fwit2v6VqEVUoBLE3QIDAQAB
+oAAwDQYJKoZIhvcNAQELBQADggEBADjuujIFoDJllR6Xo/w7j5vfNOeHO5GSgxF2
+XnuuDOI9Tomi7vURFZNbz3VAYiehpxRxYqLwFoQUwFtux2qRuGyg0P9fP1iQXPUE
+QUfFXmvB80uf2bG4lkbUwnmlZLFOEwhGZyPxpvsrxp2Ei2ppkUopCkzOMsSk3m0X
+MC50ZsTHOxfkA3r1WmS7oE2c0p0Fvyx+UJw0URAXFvDS1X0ONgww3FxqbBbm9W37
+5N4FZzGAK6j1wzuynKKXrn20YDCANXYH55PZyupfCeSZT0H0AZifWL7rz/G9uqme
+RzbIYc/CNQQTympjinBegQdVeB3yjVNZIvpGOuPSKQqhwFtmDFo=
+-----END CERTIFICATE REQUEST-----
diff --git a/pkg/httpclient/testdata/server.csr.cnf b/pkg/httpclient/testdata/server.csr.cnf
new file mode 100644
index 0000000000..6ff57d1a35
--- /dev/null
+++ b/pkg/httpclient/testdata/server.csr.cnf
@@ -0,0 +1,14 @@
+[req]
+default_bits = 2048
+prompt = no
+default_md = sha256
+distinguished_name = dn
+
+[dn]
+C=US
+ST=RandomState
+L=RandomCity
+O=RandomOrganization
+OU=RandomOrganizationUnit
+emailAddress=hello@example.com
+CN = localhost
diff --git a/pkg/httpclient/testdata/server.key b/pkg/httpclient/testdata/server.key
new file mode 100644
index 0000000000..9708e1e6ea
--- /dev/null
+++ b/pkg/httpclient/testdata/server.key
@@ -0,0 +1,28 @@
+-----BEGIN PRIVATE KEY-----
+MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQDLinaVz/O0OyoN
+4mn187wblSMldSuVJjGIjZKM7ZAuV6wsx2kEUvwqCG+/51KprQMce0S9I84Wfd8w
+TeB2P2XJ63fbV6Dz8YtJhmWVnxVOpzfJzpDB1sxGx1QZocaXxrcJi3Go0OB6ytU2
+cCVJ+hqnJR0Ecv4I8ZIsOSj6s31TlZQOobeCnSrLSms0JFmeYHVk+HfMqxMvyE+K
+GltOcQCwTEO2Bo5M1irEhesoFyO8ahfa4PYwp1LD2IOH/LrdzdHNNCo7Hyjjo9nR
+f2co3nUOXNLuIR5sUqNymtGU5iKzH21V4Bo8URth2Vy6T70CqAn/3zl/CK3a/pWo
+RVSgEsTdAgMBAAECggEAU6cxu7q+54kVbKVsdThaTF/MFR4F7oPHAd9lpuQQSOuh
+iLngMHXGy6OyAgYZlEDWMYN8KdwoXFgZPaoUIaVGuWk8Vnq6XOgeHfbNk2PRhwT0
+yc1K80/Lnx9XMj2p+EEkgxi7eu12BSGN5ZTLzo6rG50GQwjb3WMjd2d6rybL0GjC
+wg2arcBk3sSMYmvZOqlAsaQmtgwkJhvhVkVfEQSD3VKF7g0dh/h3LIPyM0Ff4M67
+KpLMPPwzUJ/0Z4ewAP06mMKUA86R93M+dWs2eh1oBGnRkVQdhCJLXJpuGHZ6BTiB
+Ry0AeorHfnVXPbtpUeAq6m5/BBl6qX0ooB08BIFwAQKBgQDqJpTZS/ZzqL6Kcs14
+MyFu+7DungSxQ5oK9ju7EFSosanSk4UEa/lw992kM6nsIMwgSVQgba5zKcVMeSmk
+AVbpznegQD1BYCwOGwbGvkJ8jbhPy+WLbbRjWT/E6AItZgUK+fyTIcNvSehcQqsT
+fhgWsK7ueZCmLQfVhK1AxtvY3QKBgQDeiKuo8plsH/7IxDn7KVHBOHKPC2ZPzg03
+i7La6zomiRckwwPnhicRSYsjtfCCW6Ms+uzjTEItgFM+5PdrXheeku+z/sExRtZu
+emqPqDomixlXDRQ6RN3gnBSk4RU+ROB1u1uBLWXqRz8Gp2zJGRxhHfYt2zefBv4w
+/cIuPC3cAQKBgD2UsAkGJWb9tj8LOmama+CYaUwYWvuT3+uKHuNvxBQpxZQQICet
+jgjb53rL66Cib4z+PBXbQsoe7jjSlNUBVS5gkq2et31+IZgEG6AhYbMIQrUZ1uD4
+lTybuF289vWhoynj3T2E37VhJq89CWky/HrbNOabKiPKLAlHv5kNs7wxAoGBANEJ
+XQbU7J2O6Iy7FyQBSlTQq3wHX1Iz4mJ9DcNrFzK/sEfOEMrZT7WDefpPm984KW3F
+P+S766ZGVuxLtMbcmh9RM23HLr8VJbSdtZ/AjO9L1r/Y/1lE+49TzmibLpNRq++r
+0WbkuEl8J44ek6fLuMbZmDi3JeZycTCgDlnUGdgBAoGAYdliovtURZCm46t1uE3F
+idCLCXCccjkt1hcNGNjck/b0trHA7wOEqICIguoWDlEBTc0PDvHEq6PfKyqptGkj
+AgaZTMF/aZiGqlT7VRpBuzxM/uV5xzCg+i2ViaW/p3xq0z2PRljVZiEfe5aWcjiM
+ouTtnC3TgmcjhTgGmb48QQE=
+-----END PRIVATE KEY-----
diff --git a/pkg/httpclient/testdata/v3.ext b/pkg/httpclient/testdata/v3.ext
new file mode 100644
index 0000000000..68e35be863
--- /dev/null
+++ b/pkg/httpclient/testdata/v3.ext
@@ -0,0 +1,8 @@
+authorityKeyIdentifier=keyid,issuer
+basicConstraints=CA:FALSE
+keyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment
+subjectAltName = @alt_names
+
+[alt_names]
+DNS.1 = localhost
+IP.1 = 127.0.0.1
diff --git a/pkg/log/deprecated.go b/pkg/log/deprecated.go
deleted file mode 100644
index f20e8b4cb8..0000000000
--- a/pkg/log/deprecated.go
+++ /dev/null
@@ -1,5 +0,0 @@
-package log
-
-func Deprecated(logger Logger, f string, args ...interface{}) {
-	logger.Warnf("Deprecated: "+f, args...)
-}
diff --git a/pkg/log/logger.go b/pkg/log/logger.go
deleted file mode 100644
index 4f3cdd3851..0000000000
--- a/pkg/log/logger.go
+++ /dev/null
@@ -1,18 +0,0 @@
-// Package log provides a logger interface for logger libraries
-// so that dex does not depend on any of them directly.
-// It also includes a default implementation using Logrus (used by dex previously).
-package log
-
-// Logger serves as an adapter interface for logger libraries
-// so that dex does not depend on any of them directly.
-type Logger interface {
-	Debug(args ...interface{})
-	Info(args ...interface{})
-	Warn(args ...interface{})
-	Error(args ...interface{})
-
-	Debugf(format string, args ...interface{})
-	Infof(format string, args ...interface{})
-	Warnf(format string, args ...interface{})
-	Errorf(format string, args ...interface{})
-}
diff --git a/scripts/git-diff b/scripts/git-diff
deleted file mode 100755
index 302ac2ce3e..0000000000
--- a/scripts/git-diff
+++ /dev/null
@@ -1,7 +0,0 @@
-#!/bin/bash -e
-
-DIFF=$( git diff . )
-if [ "$DIFF" != "" ]; then
-    echo "$DIFF" >&2
-    exit 1
-fi
diff --git a/scripts/git-version b/scripts/git-version
index 936641cb0b..a78a2716d0 100755
--- a/scripts/git-version
+++ b/scripts/git-version
@@ -1,15 +1,42 @@
 #!/bin/sh -e
-# Since this script will be run in a rkt container, use "/bin/sh" instead of "/bin/bash"
 
 # parse the current git commit hash
-COMMIT=`git rev-parse HEAD`
+COMMIT=`git rev-parse --short=8 HEAD`
 
-# check if the current commit has a matching tag
-TAG=$(git describe --exact-match --abbrev=0 --tags ${COMMIT} 2> /dev/null || true)
+# check if the current commit has a matching tag (filter for v* tags, excluding api/)
+TAG=$(git describe --exact-match --abbrev=0 --tags --match="v[0-9]*" 2> /dev/null || true)
 
 # use the matching tag as the version, if available
 if [ -z "$TAG" ]; then
-    VERSION=$COMMIT
+    # No exact tag on current commit, find the last version tag and bump minor version
+    # Get all tags matching v[0-9]*, sort them, and take the last one
+    LAST_TAG=$(git tag --list "v[0-9]*" --sort=-version:refname | head -1)
+
+    if [ -z "$LAST_TAG" ]; then
+        # No tags found, use v0.1.0 as fallback
+        BASE_VERSION="v0.1.0"
+    else
+        # Parse the last tag and bump minor version
+        # Remove 'v' prefix
+        TAG_WITHOUT_V="${LAST_TAG#v}"
+
+        # Split version into parts (major.minor.patch)
+        MAJOR=$(echo "$TAG_WITHOUT_V" | cut -d. -f1)
+        MINOR=$(echo "$TAG_WITHOUT_V" | cut -d. -f2)
+        PATCH=$(echo "$TAG_WITHOUT_V" | cut -d. -f3)
+
+        # Bump minor version
+        MINOR=$((MINOR + 1))
+
+        # Construct base version with bumped minor
+        BASE_VERSION="v${MAJOR}.${MINOR}.0"
+    fi
+
+    # Get commit timestamp in YYYYMMDDhhmmss format
+    TIMESTAMP=$(git log -1 --format=%ci HEAD | sed 's/[-: ]//g' | cut -c1-14)
+
+    # Construct pseudo-version
+    VERSION="${BASE_VERSION}-${TIMESTAMP}-${COMMIT}"
 else
     VERSION=$TAG
 fi
diff --git a/scripts/update-gomplate b/scripts/update-gomplate
new file mode 100755
index 0000000000..4f8d59fd3f
--- /dev/null
+++ b/scripts/update-gomplate
@@ -0,0 +1,53 @@
+#!/bin/sh -e
+# Script to check for a new gomplate version and update it in Dockerfile
+
+GOMPLATE_REPO="hairyhenderson/gomplate"
+DOCKERFILE="${1:-.}/Dockerfile"
+
+# Check if Dockerfile exists
+if [ ! -f "$DOCKERFILE" ]; then
+    echo "Error: Dockerfile not found at $DOCKERFILE"
+    exit 1
+fi
+
+# Get the latest release version from GitHub
+echo "Checking for the latest gomplate version on GitHub..."
+LATEST_VERSION=$(curl -s "https://api.github.com/repos/${GOMPLATE_REPO}/releases/latest" | grep -o '"tag_name": "[^"]*"' | head -1 | cut -d'"' -f4)
+
+if [ -z "$LATEST_VERSION" ]; then
+    echo "Error: Could not fetch the latest version from GitHub"
+    exit 1
+fi
+
+echo "Latest gomplate version: $LATEST_VERSION"
+
+# Get the current version from Dockerfile
+CURRENT_VERSION=$(grep 'ENV GOMPLATE_VERSION' "$DOCKERFILE" | sed 's/.*GOMPLATE_VERSION=//;s/[[:space:]]*$//')
+
+echo "Current gomplate version in Dockerfile: $CURRENT_VERSION"
+
+# Check if versions are different
+if [ "$LATEST_VERSION" = "$CURRENT_VERSION" ]; then
+    echo "✓ Already on the latest version ($LATEST_VERSION)"
+    exit 0
+fi
+
+echo "✓ New version available: $LATEST_VERSION"
+echo "Updating Dockerfile..."
+
+# Update the Dockerfile - use a more specific pattern to avoid multiple replacements
+sed -i '' "s/ENV GOMPLATE_VERSION=.*/ENV GOMPLATE_VERSION=${LATEST_VERSION}/" "$DOCKERFILE"
+
+if grep -q "ENV GOMPLATE_VERSION=${LATEST_VERSION}" "$DOCKERFILE"; then
+    echo "✓ Successfully updated Dockerfile to version $LATEST_VERSION"
+    echo ""
+    echo "Changes made:"
+    echo "  - GOMPLATE_VERSION: $CURRENT_VERSION → $LATEST_VERSION"
+else
+    echo "Error: Failed to update Dockerfile"
+    exit 1
+fi
+
+
+
+
diff --git a/server/api.go b/server/api.go
deleted file mode 100644
index a68742b3cc..0000000000
--- a/server/api.go
+++ /dev/null
@@ -1,368 +0,0 @@
-package server
-
-import (
-	"context"
-	"errors"
-	"fmt"
-
-	"golang.org/x/crypto/bcrypt"
-
-	"github.com/dexidp/dex/api/v2"
-	"github.com/dexidp/dex/pkg/log"
-	"github.com/dexidp/dex/server/internal"
-	"github.com/dexidp/dex/storage"
-)
-
-// apiVersion increases every time a new call is added to the API. Clients should use this info
-// to determine if the server supports specific features.
-const apiVersion = 2
-
-const (
-	// recCost is the recommended bcrypt cost, which balances hash strength and
-	// efficiency.
-	recCost = 12
-
-	// upBoundCost is a sane upper bound on bcrypt cost determined by benchmarking:
-	// high enough to ensure secure encryption, low enough to not put unnecessary
-	// load on a dex server.
-	upBoundCost = 16
-)
-
-// NewAPI returns a server which implements the gRPC API interface.
-func NewAPI(s storage.Storage, logger log.Logger, version string) api.DexServer {
-	return dexAPI{
-		s:       s,
-		logger:  logger,
-		version: version,
-	}
-}
-
-type dexAPI struct {
-	api.UnimplementedDexServer
-
-	s       storage.Storage
-	logger  log.Logger
-	version string
-}
-
-func (d dexAPI) CreateClient(ctx context.Context, req *api.CreateClientReq) (*api.CreateClientResp, error) {
-	if req.Client == nil {
-		return nil, errors.New("no client supplied")
-	}
-
-	if req.Client.Id == "" {
-		req.Client.Id = storage.NewID()
-	}
-	if req.Client.Secret == "" && !req.Client.Public {
-		req.Client.Secret = storage.NewID() + storage.NewID()
-	}
-
-	c := storage.Client{
-		ID:           req.Client.Id,
-		Secret:       req.Client.Secret,
-		RedirectURIs: req.Client.RedirectUris,
-		TrustedPeers: req.Client.TrustedPeers,
-		Public:       req.Client.Public,
-		Name:         req.Client.Name,
-		LogoURL:      req.Client.LogoUrl,
-	}
-	if err := d.s.CreateClient(c); err != nil {
-		if err == storage.ErrAlreadyExists {
-			return &api.CreateClientResp{AlreadyExists: true}, nil
-		}
-		d.logger.Errorf("api: failed to create client: %v", err)
-		return nil, fmt.Errorf("create client: %v", err)
-	}
-
-	return &api.CreateClientResp{
-		Client: req.Client,
-	}, nil
-}
-
-func (d dexAPI) UpdateClient(ctx context.Context, req *api.UpdateClientReq) (*api.UpdateClientResp, error) {
-	if req.Id == "" {
-		return nil, errors.New("update client: no client ID supplied")
-	}
-
-	err := d.s.UpdateClient(req.Id, func(old storage.Client) (storage.Client, error) {
-		if req.RedirectUris != nil {
-			old.RedirectURIs = req.RedirectUris
-		}
-		if req.TrustedPeers != nil {
-			old.TrustedPeers = req.TrustedPeers
-		}
-		if req.Name != "" {
-			old.Name = req.Name
-		}
-		if req.LogoUrl != "" {
-			old.LogoURL = req.LogoUrl
-		}
-		return old, nil
-	})
-	if err != nil {
-		if err == storage.ErrNotFound {
-			return &api.UpdateClientResp{NotFound: true}, nil
-		}
-		d.logger.Errorf("api: failed to update the client: %v", err)
-		return nil, fmt.Errorf("update client: %v", err)
-	}
-	return &api.UpdateClientResp{}, nil
-}
-
-func (d dexAPI) DeleteClient(ctx context.Context, req *api.DeleteClientReq) (*api.DeleteClientResp, error) {
-	err := d.s.DeleteClient(req.Id)
-	if err != nil {
-		if err == storage.ErrNotFound {
-			return &api.DeleteClientResp{NotFound: true}, nil
-		}
-		d.logger.Errorf("api: failed to delete client: %v", err)
-		return nil, fmt.Errorf("delete client: %v", err)
-	}
-	return &api.DeleteClientResp{}, nil
-}
-
-// checkCost returns an error if the hash provided does not meet lower or upper
-// bound cost requirements.
-func checkCost(hash []byte) error {
-	actual, err := bcrypt.Cost(hash)
-	if err != nil {
-		return fmt.Errorf("parsing bcrypt hash: %v", err)
-	}
-	if actual < bcrypt.DefaultCost {
-		return fmt.Errorf("given hash cost = %d does not meet minimum cost requirement = %d", actual, bcrypt.DefaultCost)
-	}
-	if actual > upBoundCost {
-		return fmt.Errorf("given hash cost = %d is above upper bound cost = %d, recommended cost = %d", actual, upBoundCost, recCost)
-	}
-	return nil
-}
-
-func (d dexAPI) CreatePassword(ctx context.Context, req *api.CreatePasswordReq) (*api.CreatePasswordResp, error) {
-	if req.Password == nil {
-		return nil, errors.New("no password supplied")
-	}
-	if req.Password.UserId == "" {
-		return nil, errors.New("no user ID supplied")
-	}
-	if req.Password.Hash != nil {
-		if err := checkCost(req.Password.Hash); err != nil {
-			return nil, err
-		}
-	} else {
-		return nil, errors.New("no hash of password supplied")
-	}
-
-	p := storage.Password{
-		Email:    req.Password.Email,
-		Hash:     req.Password.Hash,
-		Username: req.Password.Username,
-		UserID:   req.Password.UserId,
-	}
-	if err := d.s.CreatePassword(p); err != nil {
-		if err == storage.ErrAlreadyExists {
-			return &api.CreatePasswordResp{AlreadyExists: true}, nil
-		}
-		d.logger.Errorf("api: failed to create password: %v", err)
-		return nil, fmt.Errorf("create password: %v", err)
-	}
-
-	return &api.CreatePasswordResp{}, nil
-}
-
-func (d dexAPI) UpdatePassword(ctx context.Context, req *api.UpdatePasswordReq) (*api.UpdatePasswordResp, error) {
-	if req.Email == "" {
-		return nil, errors.New("no email supplied")
-	}
-	if req.NewHash == nil && req.NewUsername == "" {
-		return nil, errors.New("nothing to update")
-	}
-
-	if req.NewHash != nil {
-		if err := checkCost(req.NewHash); err != nil {
-			return nil, err
-		}
-	}
-
-	updater := func(old storage.Password) (storage.Password, error) {
-		if req.NewHash != nil {
-			old.Hash = req.NewHash
-		}
-
-		if req.NewUsername != "" {
-			old.Username = req.NewUsername
-		}
-
-		return old, nil
-	}
-
-	if err := d.s.UpdatePassword(req.Email, updater); err != nil {
-		if err == storage.ErrNotFound {
-			return &api.UpdatePasswordResp{NotFound: true}, nil
-		}
-		d.logger.Errorf("api: failed to update password: %v", err)
-		return nil, fmt.Errorf("update password: %v", err)
-	}
-
-	return &api.UpdatePasswordResp{}, nil
-}
-
-func (d dexAPI) DeletePassword(ctx context.Context, req *api.DeletePasswordReq) (*api.DeletePasswordResp, error) {
-	if req.Email == "" {
-		return nil, errors.New("no email supplied")
-	}
-
-	err := d.s.DeletePassword(req.Email)
-	if err != nil {
-		if err == storage.ErrNotFound {
-			return &api.DeletePasswordResp{NotFound: true}, nil
-		}
-		d.logger.Errorf("api: failed to delete password: %v", err)
-		return nil, fmt.Errorf("delete password: %v", err)
-	}
-	return &api.DeletePasswordResp{}, nil
-}
-
-func (d dexAPI) GetVersion(ctx context.Context, req *api.VersionReq) (*api.VersionResp, error) {
-	return &api.VersionResp{
-		Server: d.version,
-		Api:    apiVersion,
-	}, nil
-}
-
-func (d dexAPI) ListPasswords(ctx context.Context, req *api.ListPasswordReq) (*api.ListPasswordResp, error) {
-	passwordList, err := d.s.ListPasswords()
-	if err != nil {
-		d.logger.Errorf("api: failed to list passwords: %v", err)
-		return nil, fmt.Errorf("list passwords: %v", err)
-	}
-
-	passwords := make([]*api.Password, 0, len(passwordList))
-	for _, password := range passwordList {
-		p := api.Password{
-			Email:    password.Email,
-			Username: password.Username,
-			UserId:   password.UserID,
-		}
-		passwords = append(passwords, &p)
-	}
-
-	return &api.ListPasswordResp{
-		Passwords: passwords,
-	}, nil
-}
-
-func (d dexAPI) VerifyPassword(ctx context.Context, req *api.VerifyPasswordReq) (*api.VerifyPasswordResp, error) {
-	if req.Email == "" {
-		return nil, errors.New("no email supplied")
-	}
-
-	if req.Password == "" {
-		return nil, errors.New("no password to verify supplied")
-	}
-
-	password, err := d.s.GetPassword(req.Email)
-	if err != nil {
-		if err == storage.ErrNotFound {
-			return &api.VerifyPasswordResp{
-				NotFound: true,
-			}, nil
-		}
-		d.logger.Errorf("api: there was an error retrieving the password: %v", err)
-		return nil, fmt.Errorf("verify password: %v", err)
-	}
-
-	if err := bcrypt.CompareHashAndPassword(password.Hash, []byte(req.Password)); err != nil {
-		d.logger.Infof("api: password check failed: %v", err)
-		return &api.VerifyPasswordResp{
-			Verified: false,
-		}, nil
-	}
-	return &api.VerifyPasswordResp{
-		Verified: true,
-	}, nil
-}
-
-func (d dexAPI) ListRefresh(ctx context.Context, req *api.ListRefreshReq) (*api.ListRefreshResp, error) {
-	id := new(internal.IDTokenSubject)
-	if err := internal.Unmarshal(req.UserId, id); err != nil {
-		d.logger.Errorf("api: failed to unmarshal ID Token subject: %v", err)
-		return nil, err
-	}
-
-	offlineSessions, err := d.s.GetOfflineSessions(id.UserId, id.ConnId)
-	if err != nil {
-		if err == storage.ErrNotFound {
-			// This means that this user-client pair does not have a refresh token yet.
-			// An empty list should be returned instead of an error.
-			return &api.ListRefreshResp{}, nil
-		}
-		d.logger.Errorf("api: failed to list refresh tokens %t here : %v", err == storage.ErrNotFound, err)
-		return nil, err
-	}
-
-	refreshTokenRefs := make([]*api.RefreshTokenRef, 0, len(offlineSessions.Refresh))
-	for _, session := range offlineSessions.Refresh {
-		r := api.RefreshTokenRef{
-			Id:        session.ID,
-			ClientId:  session.ClientID,
-			CreatedAt: session.CreatedAt.Unix(),
-			LastUsed:  session.LastUsed.Unix(),
-		}
-		refreshTokenRefs = append(refreshTokenRefs, &r)
-	}
-
-	return &api.ListRefreshResp{
-		RefreshTokens: refreshTokenRefs,
-	}, nil
-}
-
-func (d dexAPI) RevokeRefresh(ctx context.Context, req *api.RevokeRefreshReq) (*api.RevokeRefreshResp, error) {
-	id := new(internal.IDTokenSubject)
-	if err := internal.Unmarshal(req.UserId, id); err != nil {
-		d.logger.Errorf("api: failed to unmarshal ID Token subject: %v", err)
-		return nil, err
-	}
-
-	var (
-		refreshID string
-		notFound  bool
-	)
-	updater := func(old storage.OfflineSessions) (storage.OfflineSessions, error) {
-		refreshRef := old.Refresh[req.ClientId]
-		if refreshRef == nil || refreshRef.ID == "" {
-			d.logger.Errorf("api: refresh token issued to client %q for user %q not found for deletion", req.ClientId, id.UserId)
-			notFound = true
-			return old, storage.ErrNotFound
-		}
-
-		refreshID = refreshRef.ID
-
-		// Remove entry from Refresh list of the OfflineSession object.
-		delete(old.Refresh, req.ClientId)
-
-		return old, nil
-	}
-
-	if err := d.s.UpdateOfflineSessions(id.UserId, id.ConnId, updater); err != nil {
-		if err == storage.ErrNotFound {
-			return &api.RevokeRefreshResp{NotFound: true}, nil
-		}
-		d.logger.Errorf("api: failed to update offline session object: %v", err)
-		return nil, err
-	}
-
-	if notFound {
-		return &api.RevokeRefreshResp{NotFound: true}, nil
-	}
-
-	// Delete the refresh token from the storage
-	//
-	// TODO(ericchiang): we don't have any good recourse if this call fails.
-	// Consider garbage collection of refresh tokens with no associated ref.
-	if err := d.s.DeleteRefresh(refreshID); err != nil {
-		d.logger.Errorf("failed to delete refresh token: %v", err)
-		return nil, err
-	}
-
-	return &api.RevokeRefreshResp{}, nil
-}
diff --git a/server/api_test.go b/server/api_test.go
deleted file mode 100644
index 01c59cf875..0000000000
--- a/server/api_test.go
+++ /dev/null
@@ -1,509 +0,0 @@
-package server
-
-import (
-	"context"
-	"net"
-	"os"
-	"testing"
-	"time"
-
-	"github.com/sirupsen/logrus"
-	"google.golang.org/grpc"
-	"google.golang.org/grpc/credentials/insecure"
-
-	"github.com/dexidp/dex/api/v2"
-	"github.com/dexidp/dex/pkg/log"
-	"github.com/dexidp/dex/server/internal"
-	"github.com/dexidp/dex/storage"
-	"github.com/dexidp/dex/storage/memory"
-)
-
-// apiClient is a test gRPC client. When constructed, it runs a server in
-// the background to exercise the serialization and network configuration
-// instead of just this package's server implementation.
-type apiClient struct {
-	// Embedded gRPC client to talk to the server.
-	api.DexClient
-	// Close releases resources associated with this client, including shutting
-	// down the background server.
-	Close func()
-}
-
-// newAPI constructs a gRCP client connected to a backing server.
-func newAPI(s storage.Storage, logger log.Logger, t *testing.T) *apiClient {
-	l, err := net.Listen("tcp", "127.0.0.1:0")
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	serv := grpc.NewServer()
-	api.RegisterDexServer(serv, NewAPI(s, logger, "test"))
-	go serv.Serve(l)
-
-	// Dial will retry automatically if the serv.Serve() goroutine
-	// hasn't started yet.
-	conn, err := grpc.Dial(l.Addr().String(), grpc.WithTransportCredentials(insecure.NewCredentials()))
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	return &apiClient{
-		DexClient: api.NewDexClient(conn),
-		Close: func() {
-			conn.Close()
-			serv.Stop()
-			l.Close()
-		},
-	}
-}
-
-// Attempts to create, update and delete a test Password
-func TestPassword(t *testing.T) {
-	logger := &logrus.Logger{
-		Out:       os.Stderr,
-		Formatter: &logrus.TextFormatter{DisableColors: true},
-		Level:     logrus.DebugLevel,
-	}
-
-	s := memory.New(logger)
-	client := newAPI(s, logger, t)
-	defer client.Close()
-
-	ctx := context.Background()
-	email := "test@example.com"
-	p := api.Password{
-		Email: email,
-		// bcrypt hash of the value "test1" with cost 10
-		Hash:     []byte("$2a$10$XVMN/Fid.Ks4CXgzo8fpR.iU1khOMsP5g9xQeXuBm1wXjRX8pjUtO"),
-		Username: "test",
-		UserId:   "test123",
-	}
-
-	createReq := api.CreatePasswordReq{
-		Password: &p,
-	}
-
-	if resp, err := client.CreatePassword(ctx, &createReq); err != nil || resp.AlreadyExists {
-		if resp.AlreadyExists {
-			t.Fatalf("Unable to create password since %s already exists", createReq.Password.Email)
-		}
-		t.Fatalf("Unable to create password: %v", err)
-	}
-
-	// Attempt to create a password that already exists.
-	if resp, _ := client.CreatePassword(ctx, &createReq); !resp.AlreadyExists {
-		t.Fatalf("Created password %s twice", createReq.Password.Email)
-	}
-
-	// Attempt to verify valid password and email
-	goodVerifyReq := &api.VerifyPasswordReq{
-		Email:    email,
-		Password: "test1",
-	}
-	goodVerifyResp, err := client.VerifyPassword(ctx, goodVerifyReq)
-	if err != nil {
-		t.Fatalf("Unable to run verify password we expected to be valid for correct email: %v", err)
-	}
-	if !goodVerifyResp.Verified {
-		t.Fatalf("verify password failed for password expected to be valid for correct email. expected %t, found %t", true, goodVerifyResp.Verified)
-	}
-	if goodVerifyResp.NotFound {
-		t.Fatalf("verify password failed to return not found response. expected %t, found %t", false, goodVerifyResp.NotFound)
-	}
-
-	// Check not found response for valid password with wrong email
-	badEmailVerifyReq := &api.VerifyPasswordReq{
-		Email:    "somewrongaddress@email.com",
-		Password: "test1",
-	}
-	badEmailVerifyResp, err := client.VerifyPassword(ctx, badEmailVerifyReq)
-	if err != nil {
-		t.Fatalf("Unable to run verify password for incorrect email: %v", err)
-	}
-	if badEmailVerifyResp.Verified {
-		t.Fatalf("verify password passed for password expected to be not found. expected %t, found %t", false, badEmailVerifyResp.Verified)
-	}
-	if !badEmailVerifyResp.NotFound {
-		t.Fatalf("expected not found response for verify password with bad email. expected %t, found %t", true, badEmailVerifyResp.NotFound)
-	}
-
-	// Check that wrong password fails
-	badPassVerifyReq := &api.VerifyPasswordReq{
-		Email:    email,
-		Password: "wrong_password",
-	}
-	badPassVerifyResp, err := client.VerifyPassword(ctx, badPassVerifyReq)
-	if err != nil {
-		t.Fatalf("Unable to run verify password for password we expected to be invalid: %v", err)
-	}
-	if badPassVerifyResp.Verified {
-		t.Fatalf("verify password passed for password we expected to fail. expected %t, found %t", false, badPassVerifyResp.Verified)
-	}
-	if badPassVerifyResp.NotFound {
-		t.Fatalf("did not expect expected not found response for verify password with bad email. expected %t, found %t", false, badPassVerifyResp.NotFound)
-	}
-
-	updateReq := api.UpdatePasswordReq{
-		Email:       email,
-		NewUsername: "test1",
-	}
-
-	if _, err := client.UpdatePassword(ctx, &updateReq); err != nil {
-		t.Fatalf("Unable to update password: %v", err)
-	}
-
-	pass, err := s.GetPassword(updateReq.Email)
-	if err != nil {
-		t.Fatalf("Unable to retrieve password: %v", err)
-	}
-
-	if pass.Username != updateReq.NewUsername {
-		t.Fatalf("UpdatePassword failed. Expected username %s retrieved %s", updateReq.NewUsername, pass.Username)
-	}
-
-	deleteReq := api.DeletePasswordReq{
-		Email: "test@example.com",
-	}
-
-	if _, err := client.DeletePassword(ctx, &deleteReq); err != nil {
-		t.Fatalf("Unable to delete password: %v", err)
-	}
-}
-
-// Ensures checkCost returns expected values
-func TestCheckCost(t *testing.T) {
-	logger := &logrus.Logger{
-		Out:       os.Stderr,
-		Formatter: &logrus.TextFormatter{DisableColors: true},
-		Level:     logrus.DebugLevel,
-	}
-
-	s := memory.New(logger)
-	client := newAPI(s, logger, t)
-	defer client.Close()
-
-	tests := []struct {
-		name      string
-		inputHash []byte
-
-		wantErr bool
-	}{
-		{
-			name: "valid cost",
-			// bcrypt hash of the value "test1" with cost 12 (default)
-			inputHash: []byte("$2a$12$M2Ot95Qty1MuQdubh1acWOiYadJDzeVg3ve4n5b.dgcgPdjCseKx2"),
-		},
-		{
-			name:      "invalid hash",
-			inputHash: []byte(""),
-			wantErr:   true,
-		},
-		{
-			name: "cost below default",
-			// bcrypt hash of the value "test1" with cost 4
-			inputHash: []byte("$2a$04$8bSTbuVCLpKzaqB3BmgI7edDigG5tIQKkjYUu/mEO9gQgIkw9m7eG"),
-			wantErr:   true,
-		},
-		{
-			name: "cost above recommendation",
-			// bcrypt hash of the value "test1" with cost 17
-			inputHash: []byte("$2a$17$tWuZkTxtSmRyWZAGWVHQE.7npdl.TgP8adjzLJD.SyjpFznKBftPe"),
-			wantErr:   true,
-		},
-	}
-
-	for _, tc := range tests {
-		if err := checkCost(tc.inputHash); err != nil {
-			if !tc.wantErr {
-				t.Errorf("%s: %s", tc.name, err)
-			}
-			continue
-		}
-
-		if tc.wantErr {
-			t.Errorf("%s: expected err", tc.name)
-			continue
-		}
-	}
-}
-
-// Attempts to list and revoke an existing refresh token.
-func TestRefreshToken(t *testing.T) {
-	logger := &logrus.Logger{
-		Out:       os.Stderr,
-		Formatter: &logrus.TextFormatter{DisableColors: true},
-		Level:     logrus.DebugLevel,
-	}
-
-	s := memory.New(logger)
-	client := newAPI(s, logger, t)
-	defer client.Close()
-
-	ctx := context.Background()
-
-	// Creating a storage with an existing refresh token and offline session for the user.
-	id := storage.NewID()
-	r := storage.RefreshToken{
-		ID:          id,
-		Token:       "bar",
-		Nonce:       "foo",
-		ClientID:    "client_id",
-		ConnectorID: "client_secret",
-		Scopes:      []string{"openid", "email", "profile"},
-		CreatedAt:   time.Now().UTC().Round(time.Millisecond),
-		LastUsed:    time.Now().UTC().Round(time.Millisecond),
-		Claims: storage.Claims{
-			UserID:        "1",
-			Username:      "jane",
-			Email:         "jane.doe@example.com",
-			EmailVerified: true,
-			Groups:        []string{"a", "b"},
-		},
-		ConnectorData: []byte(`{"some":"data"}`),
-	}
-
-	if err := s.CreateRefresh(r); err != nil {
-		t.Fatalf("create refresh token: %v", err)
-	}
-
-	tokenRef := storage.RefreshTokenRef{
-		ID:        r.ID,
-		ClientID:  r.ClientID,
-		CreatedAt: r.CreatedAt,
-		LastUsed:  r.LastUsed,
-	}
-
-	session := storage.OfflineSessions{
-		UserID:  r.Claims.UserID,
-		ConnID:  r.ConnectorID,
-		Refresh: make(map[string]*storage.RefreshTokenRef),
-	}
-	session.Refresh[tokenRef.ClientID] = &tokenRef
-
-	if err := s.CreateOfflineSessions(session); err != nil {
-		t.Fatalf("create offline session: %v", err)
-	}
-
-	subjectString, err := internal.Marshal(&internal.IDTokenSubject{
-		UserId: r.Claims.UserID,
-		ConnId: r.ConnectorID,
-	})
-	if err != nil {
-		t.Errorf("failed to marshal offline session ID: %v", err)
-	}
-
-	// Testing the api.
-	listReq := api.ListRefreshReq{
-		UserId: subjectString,
-	}
-
-	listResp, err := client.ListRefresh(ctx, &listReq)
-	if err != nil {
-		t.Fatalf("Unable to list refresh tokens for user: %v", err)
-	}
-
-	for _, tok := range listResp.RefreshTokens {
-		if tok.CreatedAt != r.CreatedAt.Unix() {
-			t.Errorf("Expected CreatedAt timestamp %v, got %v", r.CreatedAt.Unix(), tok.CreatedAt)
-		}
-
-		if tok.LastUsed != r.LastUsed.Unix() {
-			t.Errorf("Expected LastUsed timestamp %v, got %v", r.LastUsed.Unix(), tok.LastUsed)
-		}
-	}
-
-	revokeReq := api.RevokeRefreshReq{
-		UserId:   subjectString,
-		ClientId: r.ClientID,
-	}
-
-	resp, err := client.RevokeRefresh(ctx, &revokeReq)
-	if err != nil {
-		t.Fatalf("Unable to revoke refresh tokens for user: %v", err)
-	}
-	if resp.NotFound {
-		t.Errorf("refresh token session wasn't found")
-	}
-
-	// Try to delete again.
-	//
-	// See https://github.com/dexidp/dex/issues/1055
-	resp, err = client.RevokeRefresh(ctx, &revokeReq)
-	if err != nil {
-		t.Fatalf("Unable to revoke refresh tokens for user: %v", err)
-	}
-	if !resp.NotFound {
-		t.Errorf("refresh token session was found")
-	}
-
-	if resp, _ := client.ListRefresh(ctx, &listReq); len(resp.RefreshTokens) != 0 {
-		t.Fatalf("Refresh token returned inspite of revoking it.")
-	}
-}
-
-func TestUpdateClient(t *testing.T) {
-	logger := &logrus.Logger{
-		Out:       os.Stderr,
-		Formatter: &logrus.TextFormatter{DisableColors: true},
-		Level:     logrus.DebugLevel,
-	}
-
-	s := memory.New(logger)
-	client := newAPI(s, logger, t)
-	defer client.Close()
-	ctx := context.Background()
-
-	createClient := func(t *testing.T, clientId string) {
-		resp, err := client.CreateClient(ctx, &api.CreateClientReq{
-			Client: &api.Client{
-				Id:           clientId,
-				Secret:       "",
-				RedirectUris: []string{},
-				TrustedPeers: nil,
-				Public:       true,
-				Name:         "",
-				LogoUrl:      "",
-			},
-		})
-		if err != nil {
-			t.Fatalf("unable to create the client: %v", err)
-		}
-
-		if resp == nil {
-			t.Fatalf("create client returned no response")
-		}
-		if resp.AlreadyExists {
-			t.Error("existing client was found")
-		}
-
-		if resp.Client == nil {
-			t.Fatalf("no client created")
-		}
-	}
-
-	deleteClient := func(t *testing.T, clientId string) {
-		resp, err := client.DeleteClient(ctx, &api.DeleteClientReq{
-			Id: clientId,
-		})
-		if err != nil {
-			t.Fatalf("unable to delete the client: %v", err)
-		}
-		if resp == nil {
-			t.Fatalf("delete client delete client returned no response")
-		}
-	}
-
-	tests := map[string]struct {
-		setup   func(t *testing.T, clientId string)
-		cleanup func(t *testing.T, clientId string)
-		req     *api.UpdateClientReq
-		wantErr bool
-		want    *api.UpdateClientResp
-	}{
-		"update client": {
-			setup:   createClient,
-			cleanup: deleteClient,
-			req: &api.UpdateClientReq{
-				Id:           "test",
-				RedirectUris: []string{"https://redirect"},
-				TrustedPeers: []string{"test"},
-				Name:         "test",
-				LogoUrl:      "https://logout",
-			},
-			wantErr: false,
-			want: &api.UpdateClientResp{
-				NotFound: false,
-			},
-		},
-		"update client without ID": {
-			setup:   createClient,
-			cleanup: deleteClient,
-			req: &api.UpdateClientReq{
-				Id:           "",
-				RedirectUris: nil,
-				TrustedPeers: nil,
-				Name:         "test",
-				LogoUrl:      "test",
-			},
-			wantErr: true,
-			want: &api.UpdateClientResp{
-				NotFound: false,
-			},
-		},
-		"update client which not exists ": {
-			req: &api.UpdateClientReq{
-				Id:           "test",
-				RedirectUris: nil,
-				TrustedPeers: nil,
-				Name:         "test",
-				LogoUrl:      "test",
-			},
-			wantErr: true,
-			want: &api.UpdateClientResp{
-				NotFound: false,
-			},
-		},
-	}
-
-	for name, tc := range tests {
-		t.Run(name, func(t *testing.T) {
-			if tc.setup != nil {
-				tc.setup(t, tc.req.Id)
-			}
-			resp, err := client.UpdateClient(ctx, tc.req)
-			if err != nil && !tc.wantErr {
-				t.Fatalf("failed to update the client: %v", err)
-			}
-
-			if !tc.wantErr {
-				if resp == nil {
-					t.Fatalf("update client response not found")
-				}
-
-				if tc.want.NotFound != resp.NotFound {
-					t.Errorf("expected in response NotFound: %t", tc.want.NotFound)
-				}
-
-				client, err := s.GetClient(tc.req.Id)
-				if err != nil {
-					t.Errorf("no client found in the storage: %v", err)
-				}
-
-				if tc.req.Id != client.ID {
-					t.Errorf("expected stored client with ID: %s, found %s", tc.req.Id, client.ID)
-				}
-				if tc.req.Name != client.Name {
-					t.Errorf("expected stored client with Name: %s, found %s", tc.req.Name, client.Name)
-				}
-				if tc.req.LogoUrl != client.LogoURL {
-					t.Errorf("expected stored client with LogoURL: %s, found %s", tc.req.LogoUrl, client.LogoURL)
-				}
-				for _, redirectURI := range tc.req.RedirectUris {
-					found := find(redirectURI, client.RedirectURIs)
-					if !found {
-						t.Errorf("expected redirect URI: %s", redirectURI)
-					}
-				}
-				for _, peer := range tc.req.TrustedPeers {
-					found := find(peer, client.TrustedPeers)
-					if !found {
-						t.Errorf("expected trusted peer: %s", peer)
-					}
-				}
-			}
-
-			if tc.cleanup != nil {
-				tc.cleanup(t, tc.req.Id)
-			}
-		})
-	}
-}
-
-func find(item string, items []string) bool {
-	for _, i := range items {
-		if item == i {
-			return true
-		}
-	}
-	return false
-}
diff --git a/server/apiserver/api.go b/server/apiserver/api.go
new file mode 100644
index 0000000000..32201383fe
--- /dev/null
+++ b/server/apiserver/api.go
@@ -0,0 +1,84 @@
+package apiserver
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"log/slog"
+	"time"
+
+	"github.com/dexidp/dex/api/v2"
+	"github.com/dexidp/dex/server/backchannel"
+	"github.com/dexidp/dex/server/connectors"
+	"github.com/dexidp/dex/server/discovery"
+	"github.com/dexidp/dex/server/tokens"
+	"github.com/dexidp/dex/storage"
+)
+
+// apiVersion increases every time a new call is added to the API. Clients should use this info
+// to determine if the server supports specific features.
+const apiVersion = 4
+
+// NewAPI returns a server which implements the gRPC API interface. It takes only
+// the narrow dependencies it needs — the connector cache to invalidate on
+// connector CRUD, the discovery handler to serve the same document as HTTP, and
+// the back-channel notifier to tell relying parties about the sessions it ends —
+// rather than the whole Server.
+func NewAPI(s storage.Storage, logger *slog.Logger, version string, conns *connectors.Cache, disc *discovery.Handler, bc *backchannel.Notifier) api.DexServer {
+	apiLogger := logger.With("component", "api")
+	return dexAPI{
+		s:           s,
+		logger:      apiLogger,
+		version:     version,
+		connectors:  conns,
+		discovery:   disc,
+		backchannel: bc,
+		refresh:     tokens.NewRefreshStore(s, time.Now, apiLogger),
+	}
+}
+
+type dexAPI struct {
+	api.UnimplementedDexServer
+
+	s           storage.Storage
+	logger      *slog.Logger
+	version     string
+	connectors  *connectors.Cache
+	discovery   *discovery.Handler
+	backchannel *backchannel.Notifier
+	refresh     *tokens.RefreshStore
+}
+
+func (d dexAPI) GetVersion(ctx context.Context, req *api.VersionReq) (*api.VersionResp, error) {
+	return &api.VersionResp{
+		Server: d.version,
+		Api:    apiVersion,
+	}, nil
+}
+
+func (d dexAPI) GetDiscovery(ctx context.Context, req *api.DiscoveryReq) (*api.DiscoveryResp, error) {
+	if d.discovery == nil {
+		return nil, fmt.Errorf("discovery is not configured")
+	}
+	discoveryDoc := d.discovery.Construct(ctx)
+	data, err := json.Marshal(discoveryDoc)
+	if err != nil {
+		return nil, fmt.Errorf("failed to marshal discovery data: %v", err)
+	}
+	resp := api.DiscoveryResp{}
+	err = json.Unmarshal(data, &resp)
+	if err != nil {
+		return nil, fmt.Errorf("failed to unmarshal discovery data: %v", err)
+	}
+	return &resp, nil
+}
+
+// unixOrZero returns the Unix timestamp for t, or 0 when t is the zero value.
+// A naive t.Unix() on a zero time.Time yields -62135596800 (a year-1 epoch),
+// which is a misleading value to expose through the API; callers want 0/unset.
+func unixOrZero(t time.Time) int64 {
+	if t.IsZero() {
+		return 0
+	}
+	return t.Unix()
+}
diff --git a/server/apiserver/api_test.go b/server/apiserver/api_test.go
new file mode 100644
index 0000000000..00abe1d4bf
--- /dev/null
+++ b/server/apiserver/api_test.go
@@ -0,0 +1,1776 @@
+package apiserver
+
+import (
+	"bytes"
+	"log/slog"
+	"net"
+	"slices"
+	"strings"
+	"testing"
+	"time"
+
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/credentials/insecure"
+
+	"github.com/dexidp/dex/api/v2"
+	"github.com/dexidp/dex/server/internal"
+	"github.com/dexidp/dex/storage"
+	"github.com/dexidp/dex/storage/memory"
+)
+
+// apiClient is a test gRPC client. When constructed, it runs a server in
+// the background to exercise the serialization and network configuration
+// instead of just this package's server implementation.
+type apiClient struct {
+	// Embedded gRPC client to talk to the server.
+	api.DexClient
+	// Close releases resources associated with this client, including shutting
+	// down the background server.
+	Close func()
+}
+
+func newLogger(t *testing.T) *slog.Logger {
+	return slog.New(slog.NewTextHandler(t.Output(), &slog.HandlerOptions{Level: slog.LevelDebug}))
+}
+
+// newAPI constructs a gRCP client connected to a backing server.
+func newAPI(t *testing.T, s storage.Storage, logger *slog.Logger) *apiClient {
+	l, err := net.Listen("tcp", "127.0.0.1:0")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	serv := grpc.NewServer()
+	api.RegisterDexServer(serv, NewAPI(s, logger, "test", nil, nil, nil))
+	go serv.Serve(l)
+
+	// NewClient will retry automatically if the serv.Serve() goroutine
+	// hasn't started yet.
+	conn, err := grpc.NewClient(l.Addr().String(), grpc.WithTransportCredentials(insecure.NewCredentials()))
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	return &apiClient{
+		DexClient: api.NewDexClient(conn),
+		Close: func() {
+			conn.Close()
+			serv.Stop()
+			l.Close()
+		},
+	}
+}
+
+// Attempts to create, update and delete a test Password
+func TestPassword(t *testing.T) {
+	logger := newLogger(t)
+	s := memory.New(logger)
+
+	client := newAPI(t, s, logger)
+	defer client.Close()
+
+	ctx := t.Context()
+
+	email := "test@example.com"
+	p := api.Password{
+		Email: email,
+		// bcrypt hash of the value "test1" with cost 10
+		Hash:     []byte("$2a$10$XVMN/Fid.Ks4CXgzo8fpR.iU1khOMsP5g9xQeXuBm1wXjRX8pjUtO"),
+		Username: "test",
+		UserId:   "test123",
+	}
+
+	createReq := api.CreatePasswordReq{
+		Password: &p,
+	}
+
+	if resp, err := client.CreatePassword(ctx, &createReq); err != nil || resp.AlreadyExists {
+		if resp.AlreadyExists {
+			t.Fatalf("Unable to create password since %s already exists", createReq.Password.Email)
+		}
+		t.Fatalf("Unable to create password: %v", err)
+	}
+
+	// Attempt to create a password that already exists.
+	if resp, _ := client.CreatePassword(ctx, &createReq); !resp.AlreadyExists {
+		t.Fatalf("Created password %s twice", createReq.Password.Email)
+	}
+
+	// Attempt to verify valid password and email
+	goodVerifyReq := &api.VerifyPasswordReq{
+		Email:    email,
+		Password: "test1",
+	}
+	goodVerifyResp, err := client.VerifyPassword(ctx, goodVerifyReq)
+	if err != nil {
+		t.Fatalf("Unable to run verify password we expected to be valid for correct email: %v", err)
+	}
+	if !goodVerifyResp.Verified {
+		t.Fatalf("verify password failed for password expected to be valid for correct email. expected %t, found %t", true, goodVerifyResp.Verified)
+	}
+	if goodVerifyResp.NotFound {
+		t.Fatalf("verify password failed to return not found response. expected %t, found %t", false, goodVerifyResp.NotFound)
+	}
+
+	// Check not found response for valid password with wrong email
+	badEmailVerifyReq := &api.VerifyPasswordReq{
+		Email:    "somewrongaddress@email.com",
+		Password: "test1",
+	}
+	badEmailVerifyResp, err := client.VerifyPassword(ctx, badEmailVerifyReq)
+	if err != nil {
+		t.Fatalf("Unable to run verify password for incorrect email: %v", err)
+	}
+	if badEmailVerifyResp.Verified {
+		t.Fatalf("verify password passed for password expected to be not found. expected %t, found %t", false, badEmailVerifyResp.Verified)
+	}
+	if !badEmailVerifyResp.NotFound {
+		t.Fatalf("expected not found response for verify password with bad email. expected %t, found %t", true, badEmailVerifyResp.NotFound)
+	}
+
+	// Check that wrong password fails
+	badPassVerifyReq := &api.VerifyPasswordReq{
+		Email:    email,
+		Password: "wrong_password",
+	}
+	badPassVerifyResp, err := client.VerifyPassword(ctx, badPassVerifyReq)
+	if err != nil {
+		t.Fatalf("Unable to run verify password for password we expected to be invalid: %v", err)
+	}
+	if badPassVerifyResp.Verified {
+		t.Fatalf("verify password passed for password we expected to fail. expected %t, found %t", false, badPassVerifyResp.Verified)
+	}
+	if badPassVerifyResp.NotFound {
+		t.Fatalf("did not expect expected not found response for verify password with bad email. expected %t, found %t", false, badPassVerifyResp.NotFound)
+	}
+
+	updateReq := api.UpdatePasswordReq{
+		Email:       email,
+		NewUsername: "test1",
+	}
+
+	if _, err := client.UpdatePassword(ctx, &updateReq); err != nil {
+		t.Fatalf("Unable to update password: %v", err)
+	}
+
+	pass, err := s.GetPassword(ctx, updateReq.Email)
+	if err != nil {
+		t.Fatalf("Unable to retrieve password: %v", err)
+	}
+
+	if pass.Username != updateReq.NewUsername {
+		t.Fatalf("UpdatePassword failed. Expected username %s retrieved %s", updateReq.NewUsername, pass.Username)
+	}
+
+	deleteReq := api.DeletePasswordReq{
+		Email: "test@example.com",
+	}
+
+	if _, err := client.DeletePassword(ctx, &deleteReq); err != nil {
+		t.Fatalf("Unable to delete password: %v", err)
+	}
+}
+
+// Attempts to list and revoke an existing refresh token.
+func TestRefreshToken(t *testing.T) {
+	logger := newLogger(t)
+	s := memory.New(logger)
+
+	client := newAPI(t, s, logger)
+	defer client.Close()
+
+	ctx := t.Context()
+
+	// Creating a storage with an existing refresh token and offline session for the user.
+	id := storage.NewID()
+	r := storage.RefreshToken{
+		ID:          id,
+		Token:       "bar",
+		Nonce:       "foo",
+		ClientID:    "client_id",
+		ConnectorID: "client_secret",
+		Scopes:      []string{"openid", "email", "profile"},
+		CreatedAt:   time.Now().UTC().Round(time.Millisecond),
+		LastUsed:    time.Now().UTC().Round(time.Millisecond),
+		Claims: storage.Claims{
+			UserID:        "1",
+			Username:      "jane",
+			Email:         "jane.doe@example.com",
+			EmailVerified: true,
+			Groups:        []string{"a", "b"},
+		},
+		ConnectorData: []byte(`{"some":"data"}`),
+	}
+
+	if err := s.CreateRefresh(ctx, r); err != nil {
+		t.Fatalf("create refresh token: %v", err)
+	}
+
+	tokenRef := storage.RefreshTokenRef{
+		ID:        r.ID,
+		ClientID:  r.ClientID,
+		CreatedAt: r.CreatedAt,
+		LastUsed:  r.LastUsed,
+	}
+
+	session := storage.OfflineSessions{
+		UserID:  r.Claims.UserID,
+		ConnID:  r.ConnectorID,
+		Refresh: make(map[string]*storage.RefreshTokenRef),
+	}
+	session.Refresh[tokenRef.ClientID] = &tokenRef
+
+	if err := s.CreateOfflineSessions(ctx, session); err != nil {
+		t.Fatalf("create offline session: %v", err)
+	}
+
+	subjectString, err := internal.Marshal(&internal.IDTokenSubject{
+		UserId: r.Claims.UserID,
+		ConnId: r.ConnectorID,
+	})
+	if err != nil {
+		t.Errorf("failed to marshal offline session ID: %v", err)
+	}
+
+	// Testing the api.
+	listReq := api.ListRefreshReq{
+		UserId: subjectString,
+	}
+
+	listResp, err := client.ListRefresh(ctx, &listReq)
+	if err != nil {
+		t.Fatalf("Unable to list refresh tokens for user: %v", err)
+	}
+
+	for _, tok := range listResp.RefreshTokens {
+		if tok.CreatedAt != r.CreatedAt.Unix() {
+			t.Errorf("Expected CreatedAt timestamp %v, got %v", r.CreatedAt.Unix(), tok.CreatedAt)
+		}
+
+		if tok.LastUsed != r.LastUsed.Unix() {
+			t.Errorf("Expected LastUsed timestamp %v, got %v", r.LastUsed.Unix(), tok.LastUsed)
+		}
+	}
+
+	revokeReq := api.RevokeRefreshReq{
+		UserId:   subjectString,
+		ClientId: r.ClientID,
+	}
+
+	resp, err := client.RevokeRefresh(ctx, &revokeReq)
+	if err != nil {
+		t.Fatalf("Unable to revoke refresh tokens for user: %v", err)
+	}
+	if resp.NotFound {
+		t.Errorf("refresh token session wasn't found")
+	}
+
+	// Try to delete again.
+	//
+	// See https://github.com/dexidp/dex/issues/1055
+	resp, err = client.RevokeRefresh(ctx, &revokeReq)
+	if err != nil {
+		t.Fatalf("Unable to revoke refresh tokens for user: %v", err)
+	}
+	if !resp.NotFound {
+		t.Errorf("refresh token session was found")
+	}
+
+	if resp, _ := client.ListRefresh(ctx, &listReq); len(resp.RefreshTokens) != 0 {
+		t.Fatalf("Refresh token returned in spite of revoking it.")
+	}
+}
+
+func TestUpdateClient(t *testing.T) {
+	logger := newLogger(t)
+	s := memory.New(logger)
+
+	client := newAPI(t, s, logger)
+	defer client.Close()
+
+	ctx := t.Context()
+
+	createClient := func(t *testing.T, clientId string) {
+		resp, err := client.CreateClient(ctx, &api.CreateClientReq{
+			Client: &api.Client{
+				Id:           clientId,
+				Secret:       "",
+				RedirectUris: []string{},
+				TrustedPeers: nil,
+				Public:       true,
+				Name:         "",
+				LogoUrl:      "",
+			},
+		})
+		if err != nil {
+			t.Fatalf("unable to create the client: %v", err)
+		}
+
+		if resp == nil {
+			t.Fatalf("create client returned no response")
+		}
+		if resp.AlreadyExists {
+			t.Error("existing client was found")
+		}
+
+		if resp.Client == nil {
+			t.Fatalf("no client created")
+		}
+	}
+
+	deleteClient := func(t *testing.T, clientId string) {
+		resp, err := client.DeleteClient(ctx, &api.DeleteClientReq{
+			Id: clientId,
+		})
+		if err != nil {
+			t.Fatalf("unable to delete the client: %v", err)
+		}
+		if resp == nil {
+			t.Fatalf("delete client delete client returned no response")
+		}
+	}
+
+	tests := map[string]struct {
+		setup   func(t *testing.T, clientId string)
+		cleanup func(t *testing.T, clientId string)
+		req     *api.UpdateClientReq
+		wantErr bool
+		want    *api.UpdateClientResp
+	}{
+		"update client": {
+			setup:   createClient,
+			cleanup: deleteClient,
+			req: &api.UpdateClientReq{
+				Id:           "test",
+				RedirectUris: []string{"https://redirect"},
+				TrustedPeers: []string{"test"},
+				Name:         "test",
+				LogoUrl:      "https://logout",
+			},
+			wantErr: false,
+			want: &api.UpdateClientResp{
+				NotFound: false,
+			},
+		},
+		"update client without ID": {
+			setup:   createClient,
+			cleanup: deleteClient,
+			req: &api.UpdateClientReq{
+				Id:           "",
+				RedirectUris: nil,
+				TrustedPeers: nil,
+				Name:         "test",
+				LogoUrl:      "test",
+			},
+			wantErr: true,
+			want: &api.UpdateClientResp{
+				NotFound: false,
+			},
+		},
+		"update client which not exists ": {
+			req: &api.UpdateClientReq{
+				Id:           "test",
+				RedirectUris: nil,
+				TrustedPeers: nil,
+				Name:         "test",
+				LogoUrl:      "test",
+			},
+			wantErr: true,
+			want: &api.UpdateClientResp{
+				NotFound: false,
+			},
+		},
+	}
+
+	for name, tc := range tests {
+		t.Run(name, func(t *testing.T) {
+			if tc.setup != nil {
+				tc.setup(t, tc.req.Id)
+			}
+			resp, err := client.UpdateClient(ctx, tc.req)
+			if err != nil && !tc.wantErr {
+				t.Fatalf("failed to update the client: %v", err)
+			}
+
+			if !tc.wantErr {
+				if resp == nil {
+					t.Fatalf("update client response not found")
+				}
+
+				if tc.want.NotFound != resp.NotFound {
+					t.Errorf("expected in response NotFound: %t", tc.want.NotFound)
+				}
+
+				client, err := s.GetClient(ctx, tc.req.Id)
+				if err != nil {
+					t.Errorf("no client found in the storage: %v", err)
+				}
+
+				if tc.req.Id != client.ID {
+					t.Errorf("expected stored client with ID: %s, found %s", tc.req.Id, client.ID)
+				}
+				if tc.req.Name != client.Name {
+					t.Errorf("expected stored client with Name: %s, found %s", tc.req.Name, client.Name)
+				}
+				if tc.req.LogoUrl != client.LogoURL {
+					t.Errorf("expected stored client with LogoURL: %s, found %s", tc.req.LogoUrl, client.LogoURL)
+				}
+				for _, redirectURI := range tc.req.RedirectUris {
+					found := slices.Contains(client.RedirectURIs, redirectURI)
+					if !found {
+						t.Errorf("expected redirect URI: %s", redirectURI)
+					}
+				}
+				for _, peer := range tc.req.TrustedPeers {
+					found := slices.Contains(client.TrustedPeers, peer)
+					if !found {
+						t.Errorf("expected trusted peer: %s", peer)
+					}
+				}
+			}
+
+			if tc.cleanup != nil {
+				tc.cleanup(t, tc.req.Id)
+			}
+		})
+	}
+}
+
+func TestCreateConnector(t *testing.T) {
+	t.Setenv("DEX_API_CONNECTORS_CRUD", "true")
+
+	logger := newLogger(t)
+	s := memory.New(logger)
+
+	client := newAPI(t, s, logger)
+	defer client.Close()
+
+	ctx := t.Context()
+
+	connectorID := "connector123"
+	connectorName := "TestConnector"
+	connectorType := "TestType"
+	connectorConfig := []byte(`{"key": "value"}`)
+
+	createReq := api.CreateConnectorReq{
+		Connector: &api.Connector{
+			Id:     connectorID,
+			Name:   connectorName,
+			Type:   connectorType,
+			Config: connectorConfig,
+		},
+	}
+
+	// Test valid connector creation
+	if resp, err := client.CreateConnector(ctx, &createReq); err != nil || resp.AlreadyExists {
+		if err != nil {
+			t.Fatalf("Unable to create connector: %v", err)
+		} else if resp.AlreadyExists {
+			t.Fatalf("Unable to create connector since %s already exists", connectorID)
+		}
+		t.Fatalf("Unable to create connector: %v", err)
+	}
+
+	// Test creating the same connector again (expecting failure)
+	if resp, _ := client.CreateConnector(ctx, &createReq); !resp.AlreadyExists {
+		t.Fatalf("Created connector %s twice", connectorID)
+	}
+
+	createReq.Connector.Config = []byte("invalid_json")
+
+	// Test invalid JSON config
+	if _, err := client.CreateConnector(ctx, &createReq); err == nil {
+		t.Fatal("Expected an error for invalid JSON config, but none occurred")
+	} else if !strings.Contains(err.Error(), "invalid config supplied") {
+		t.Fatalf("Unexpected error: %v", err)
+	}
+}
+
+func TestUpdateConnector(t *testing.T) {
+	t.Setenv("DEX_API_CONNECTORS_CRUD", "true")
+
+	logger := newLogger(t)
+	s := memory.New(logger)
+
+	client := newAPI(t, s, logger)
+	defer client.Close()
+
+	ctx := t.Context()
+
+	connectorID := "connector123"
+	newConnectorName := "UpdatedConnector"
+	newConnectorType := "UpdatedType"
+	newConnectorConfig := []byte(`{"updated_key": "updated_value"}`)
+
+	// Create a connector for testing
+	createReq := api.CreateConnectorReq{
+		Connector: &api.Connector{
+			Id:     connectorID,
+			Name:   "TestConnector",
+			Type:   "TestType",
+			Config: []byte(`{"key": "value"}`),
+		},
+	}
+	client.CreateConnector(ctx, &createReq)
+
+	updateReq := api.UpdateConnectorReq{
+		Id:        connectorID,
+		NewName:   newConnectorName,
+		NewType:   newConnectorType,
+		NewConfig: newConnectorConfig,
+	}
+
+	// Test valid connector update
+	if _, err := client.UpdateConnector(ctx, &updateReq); err != nil {
+		t.Fatalf("Unable to update connector: %v", err)
+	}
+
+	resp, err := client.ListConnectors(ctx, &api.ListConnectorReq{})
+	if err != nil {
+		t.Fatalf("Unexpected error: %v", err)
+	}
+
+	for _, connector := range resp.Connectors {
+		if connector.Id == connectorID {
+			if connector.Name != newConnectorName {
+				t.Fatal("connector name should have been updated")
+			}
+			if string(connector.Config) != string(newConnectorConfig) {
+				t.Fatal("connector config should have been updated")
+			}
+			if connector.Type != newConnectorType {
+				t.Fatal("connector type should have been updated")
+			}
+		}
+	}
+
+	updateReq.NewConfig = []byte("invalid_json")
+
+	// Test invalid JSON config in update request
+	if _, err := client.UpdateConnector(ctx, &updateReq); err == nil {
+		t.Fatal("Expected an error for invalid JSON config in update, but none occurred")
+	} else if !strings.Contains(err.Error(), "invalid config supplied") {
+		t.Fatalf("Unexpected error: %v", err)
+	}
+}
+
+func TestUpdateConnectorGrantTypes(t *testing.T) {
+	t.Setenv("DEX_API_CONNECTORS_CRUD", "true")
+
+	logger := newLogger(t)
+	s := memory.New(logger)
+
+	client := newAPI(t, s, logger)
+	defer client.Close()
+
+	ctx := t.Context()
+
+	connectorID := "connector-gt"
+
+	// Create a connector without grant types
+	createReq := api.CreateConnectorReq{
+		Connector: &api.Connector{
+			Id:     connectorID,
+			Name:   "TestConnector",
+			Type:   "TestType",
+			Config: []byte(`{"key": "value"}`),
+		},
+	}
+	_, err := client.CreateConnector(ctx, &createReq)
+	if err != nil {
+		t.Fatalf("failed to create connector: %v", err)
+	}
+
+	// Set grant types
+	_, err = client.UpdateConnector(ctx, &api.UpdateConnectorReq{
+		Id:            connectorID,
+		NewGrantTypes: &api.GrantTypes{GrantTypes: []string{"authorization_code", "refresh_token"}},
+	})
+	if err != nil {
+		t.Fatalf("failed to update connector grant types: %v", err)
+	}
+
+	resp, err := client.ListConnectors(ctx, &api.ListConnectorReq{})
+	if err != nil {
+		t.Fatalf("failed to list connectors: %v", err)
+	}
+	for _, c := range resp.Connectors {
+		if c.Id == connectorID {
+			if !slices.Equal(c.GrantTypes, []string{"authorization_code", "refresh_token"}) {
+				t.Fatalf("expected grant types [authorization_code refresh_token], got %v", c.GrantTypes)
+			}
+		}
+	}
+
+	// Clear grant types by passing empty GrantTypes message
+	_, err = client.UpdateConnector(ctx, &api.UpdateConnectorReq{
+		Id:            connectorID,
+		NewGrantTypes: &api.GrantTypes{},
+	})
+	if err != nil {
+		t.Fatalf("failed to clear connector grant types: %v", err)
+	}
+
+	resp, err = client.ListConnectors(ctx, &api.ListConnectorReq{})
+	if err != nil {
+		t.Fatalf("failed to list connectors: %v", err)
+	}
+	for _, c := range resp.Connectors {
+		if c.Id == connectorID {
+			if len(c.GrantTypes) != 0 {
+				t.Fatalf("expected empty grant types after clear, got %v", c.GrantTypes)
+			}
+		}
+	}
+
+	// Reject invalid grant type on update
+	_, err = client.UpdateConnector(ctx, &api.UpdateConnectorReq{
+		Id:            connectorID,
+		NewGrantTypes: &api.GrantTypes{GrantTypes: []string{"bogus"}},
+	})
+	if err == nil {
+		t.Fatal("expected error for invalid grant type, got nil")
+	}
+	if !strings.Contains(err.Error(), `unknown grant type "bogus"`) {
+		t.Fatalf("unexpected error: %v", err)
+	}
+
+	// Reject invalid grant type on create
+	_, err = client.CreateConnector(ctx, &api.CreateConnectorReq{
+		Connector: &api.Connector{
+			Id:         "bad-gt",
+			Name:       "Bad",
+			Type:       "TestType",
+			Config:     []byte(`{}`),
+			GrantTypes: []string{"invalid_type"},
+		},
+	})
+	if err == nil {
+		t.Fatal("expected error for invalid grant type on create, got nil")
+	}
+	if !strings.Contains(err.Error(), `unknown grant type "invalid_type"`) {
+		t.Fatalf("unexpected error: %v", err)
+	}
+}
+
+func TestDeleteConnector(t *testing.T) {
+	t.Setenv("DEX_API_CONNECTORS_CRUD", "true")
+
+	logger := newLogger(t)
+	s := memory.New(logger)
+
+	client := newAPI(t, s, logger)
+	defer client.Close()
+
+	ctx := t.Context()
+
+	connectorID := "connector123"
+
+	// Create a connector for testing
+	createReq := api.CreateConnectorReq{
+		Connector: &api.Connector{
+			Id:     connectorID,
+			Name:   "TestConnector",
+			Type:   "TestType",
+			Config: []byte(`{"key": "value"}`),
+		},
+	}
+	client.CreateConnector(ctx, &createReq)
+
+	deleteReq := api.DeleteConnectorReq{
+		Id: connectorID,
+	}
+
+	// Test valid connector deletion
+	if _, err := client.DeleteConnector(ctx, &deleteReq); err != nil {
+		t.Fatalf("Unable to delete connector: %v", err)
+	}
+
+	// Test non existent connector deletion
+	resp, err := client.DeleteConnector(ctx, &deleteReq)
+	if err != nil {
+		t.Fatalf("Unable to delete connector: %v", err)
+	}
+
+	if !resp.NotFound {
+		t.Fatal("Should return not found")
+	}
+}
+
+func TestListConnectors(t *testing.T) {
+	t.Setenv("DEX_API_CONNECTORS_CRUD", "true")
+
+	logger := newLogger(t)
+	s := memory.New(logger)
+
+	client := newAPI(t, s, logger)
+	defer client.Close()
+
+	ctx := t.Context()
+
+	// Create connectors for testing
+	createReq1 := api.CreateConnectorReq{
+		Connector: &api.Connector{
+			Id:     "connector1",
+			Name:   "Connector1",
+			Type:   "Type1",
+			Config: []byte(`{"key": "value1"}`),
+		},
+	}
+	client.CreateConnector(ctx, &createReq1)
+
+	createReq2 := api.CreateConnectorReq{
+		Connector: &api.Connector{
+			Id:     "connector2",
+			Name:   "Connector2",
+			Type:   "Type2",
+			Config: []byte(`{"key": "value2"}`),
+		},
+	}
+	client.CreateConnector(ctx, &createReq2)
+
+	listReq := api.ListConnectorReq{}
+
+	// Test listing connectors
+	if resp, err := client.ListConnectors(ctx, &listReq); err != nil {
+		t.Fatalf("Unable to list connectors: %v", err)
+	} else if len(resp.Connectors) != 2 { // Check the number of connectors in the response
+		t.Fatalf("Expected 2 connectors, found %d", len(resp.Connectors))
+	}
+}
+
+func TestMissingConnectorsCRUDFeatureFlag(t *testing.T) {
+	logger := newLogger(t)
+	s := memory.New(logger)
+
+	client := newAPI(t, s, logger)
+	defer client.Close()
+
+	ctx := t.Context()
+
+	// Create connectors for testing
+	createReq1 := api.CreateConnectorReq{
+		Connector: &api.Connector{
+			Id:     "connector1",
+			Name:   "Connector1",
+			Type:   "Type1",
+			Config: []byte(`{"key": "value1"}`),
+		},
+	}
+	client.CreateConnector(ctx, &createReq1)
+
+	createReq2 := api.CreateConnectorReq{
+		Connector: &api.Connector{
+			Id:     "connector2",
+			Name:   "Connector2",
+			Type:   "Type2",
+			Config: []byte(`{"key": "value2"}`),
+		},
+	}
+	client.CreateConnector(ctx, &createReq2)
+
+	listReq := api.ListConnectorReq{}
+
+	if _, err := client.ListConnectors(ctx, &listReq); err == nil {
+		t.Fatal("ListConnectors should have returned an error")
+	}
+}
+
+func TestListClients(t *testing.T) {
+	logger := newLogger(t)
+	s := memory.New(logger)
+
+	client := newAPI(t, s, logger)
+	defer client.Close()
+
+	ctx := t.Context()
+
+	// List Clients
+	listResp, err := client.ListClients(ctx, &api.ListClientReq{})
+	if err != nil {
+		t.Fatalf("Unable to list clients: %v", err)
+	}
+	if len(listResp.Clients) != 0 {
+		t.Fatalf("Expected 0 clients, got %d", len(listResp.Clients))
+	}
+
+	client1 := &api.Client{
+		Id:           "client1",
+		Secret:       "secret1",
+		RedirectUris: []string{"http://localhost:8080/callback"},
+		TrustedPeers: []string{"peer1"},
+		Public:       false,
+		Name:         "Test Client 1",
+		LogoUrl:      "http://example.com/logo1.png",
+	}
+
+	client2 := &api.Client{
+		Id:           "client2",
+		Secret:       "secret2",
+		RedirectUris: []string{"http://localhost:8081/callback"},
+		TrustedPeers: []string{"peer2"},
+		Public:       true,
+		Name:         "Test Client 2",
+		LogoUrl:      "http://example.com/logo2.png",
+	}
+
+	_, err = client.CreateClient(ctx, &api.CreateClientReq{Client: client1})
+	if err != nil {
+		t.Fatalf("Unable to create client1: %v", err)
+	}
+
+	_, err = client.CreateClient(ctx, &api.CreateClientReq{Client: client2})
+	if err != nil {
+		t.Fatalf("Unable to create client2: %v", err)
+	}
+
+	listResp, err = client.ListClients(ctx, &api.ListClientReq{})
+	if err != nil {
+		t.Fatalf("Unable to list clients: %v", err)
+	}
+
+	if len(listResp.Clients) != 2 {
+		t.Fatalf("Expected 2 clients, got %d", len(listResp.Clients))
+	}
+
+	clientMap := make(map[string]*api.ClientInfo)
+	for _, c := range listResp.Clients {
+		clientMap[c.Id] = c
+	}
+
+	if c1, exists := clientMap["client1"]; !exists {
+		t.Fatal("client1 not found in list")
+	} else {
+		if c1.Name != "Test Client 1" {
+			t.Errorf("Expected client1 name 'Test Client 1', got '%s'", c1.Name)
+		}
+		if len(c1.RedirectUris) != 1 || c1.RedirectUris[0] != "http://localhost:8080/callback" {
+			t.Errorf("Expected client1 redirect URIs ['http://localhost:8080/callback'], got %v", c1.RedirectUris)
+		}
+		if c1.Public != false {
+			t.Errorf("Expected client1 public false, got %v", c1.Public)
+		}
+		if c1.LogoUrl != "http://example.com/logo1.png" {
+			t.Errorf("Expected client1 logo URL 'http://example.com/logo1.png', got '%s'", c1.LogoUrl)
+		}
+	}
+
+	if c2, exists := clientMap["client2"]; !exists {
+		t.Fatal("client2 not found in list")
+	} else {
+		if c2.Name != "Test Client 2" {
+			t.Errorf("Expected client2 name 'Test Client 2', got '%s'", c2.Name)
+		}
+		if len(c2.RedirectUris) != 1 || c2.RedirectUris[0] != "http://localhost:8081/callback" {
+			t.Errorf("Expected client2 redirect URIs ['http://localhost:8081/callback'], got %v", c2.RedirectUris)
+		}
+		if c2.Public != true {
+			t.Errorf("Expected client2 public true, got %v", c2.Public)
+		}
+		if c2.LogoUrl != "http://example.com/logo2.png" {
+			t.Errorf("Expected client2 logo URL 'http://example.com/logo2.png', got '%s'", c2.LogoUrl)
+		}
+	}
+}
+
+func TestGetAuthSession(t *testing.T) {
+	t.Setenv("DEX_API_SESSIONS_IDENTITIES_CRUD", "true")
+
+	logger := newLogger(t)
+	s := memory.New(logger)
+
+	client := newAPI(t, s, logger)
+	defer client.Close()
+
+	ctx := t.Context()
+
+	now := time.Now().UTC().Round(time.Second)
+	session := storage.AuthSession{
+		UserID:      "user1",
+		ConnectorID: "conn1",
+		ID:          "nonce123", Secret: "nonce123",
+		ClientStates: map[string]*storage.ClientAuthState{
+			"client-a": {
+				AuthenticatedAt:   now,
+				LastActivity:      now,
+				LastTokenIssuedAt: now,
+			},
+		},
+		CreatedAt:      now,
+		LastActivity:   now,
+		IPAddress:      "10.0.0.1",
+		UserAgent:      "TestAgent/1.0",
+		AbsoluteExpiry: now.Add(24 * time.Hour),
+		IdleExpiry:     now.Add(1 * time.Hour),
+	}
+
+	if err := s.CreateAuthSession(ctx, session); err != nil {
+		t.Fatalf("create auth session: %v", err)
+	}
+
+	resp, err := client.GetAuthSession(ctx, &api.GetAuthSessionReq{Id: "nonce123"})
+	if err != nil {
+		t.Fatalf("get auth session: %v", err)
+	}
+
+	if resp.Session.UserId != "user1" {
+		t.Errorf("expected user_id 'user1', got '%s'", resp.Session.UserId)
+	}
+	if resp.Session.IpAddress != "10.0.0.1" {
+		t.Errorf("expected ip_address '10.0.0.1', got '%s'", resp.Session.IpAddress)
+	}
+	if len(resp.Session.ClientStates) != 1 {
+		t.Fatalf("expected 1 client state, got %d", len(resp.Session.ClientStates))
+	}
+	cs := resp.Session.ClientStates[0]
+	if cs.ClientId != "client-a" {
+		t.Errorf("expected client_id 'client-a', got '%s'", cs.ClientId)
+	}
+	if cs.AuthenticatedAt == 0 {
+		t.Error("expected client state to record an authentication")
+	}
+	if resp.Session.Id != "nonce123" {
+		t.Errorf("expected session id 'nonce123', got '%s'", resp.Session.Id)
+	}
+
+	// Not found case.
+	_, err = client.GetAuthSession(ctx, &api.GetAuthSessionReq{Id: "nonexistent"})
+	if err == nil {
+		t.Fatal("expected error for non-existent session")
+	}
+}
+
+func TestListAuthSessions(t *testing.T) {
+	t.Setenv("DEX_API_SESSIONS_IDENTITIES_CRUD", "true")
+
+	logger := newLogger(t)
+	s := memory.New(logger)
+
+	client := newAPI(t, s, logger)
+	defer client.Close()
+
+	ctx := t.Context()
+
+	now := time.Now().UTC().Round(time.Second)
+	for _, sess := range []storage.AuthSession{
+		{UserID: "user1", ConnectorID: "conn1", ID: "n1", Secret: "n1", ClientStates: map[string]*storage.ClientAuthState{}, CreatedAt: now, LastActivity: now, AbsoluteExpiry: now.Add(time.Hour), IdleExpiry: now.Add(time.Hour)},
+		{UserID: "user1", ConnectorID: "conn2", ID: "n2", Secret: "n2", ClientStates: map[string]*storage.ClientAuthState{}, CreatedAt: now, LastActivity: now, AbsoluteExpiry: now.Add(time.Hour), IdleExpiry: now.Add(time.Hour)},
+		{UserID: "user2", ConnectorID: "conn1", ID: "n3", Secret: "n3", ClientStates: map[string]*storage.ClientAuthState{}, CreatedAt: now, LastActivity: now, AbsoluteExpiry: now.Add(time.Hour), IdleExpiry: now.Add(time.Hour)},
+	} {
+		if err := s.CreateAuthSession(ctx, sess); err != nil {
+			t.Fatalf("create auth session: %v", err)
+		}
+	}
+
+	// List all.
+	resp, err := client.ListAuthSessions(ctx, &api.ListAuthSessionsReq{})
+	if err != nil {
+		t.Fatalf("list auth sessions: %v", err)
+	}
+	if len(resp.Sessions) != 3 {
+		t.Fatalf("expected 3 sessions, got %d", len(resp.Sessions))
+	}
+
+	// Filter by user_id.
+	resp, err = client.ListAuthSessions(ctx, &api.ListAuthSessionsReq{UserId: "user1"})
+	if err != nil {
+		t.Fatalf("list auth sessions with filter: %v", err)
+	}
+	if len(resp.Sessions) != 2 {
+		t.Fatalf("expected 2 sessions for user1, got %d", len(resp.Sessions))
+	}
+
+	// Filter by connector_id, and by both: one user signed in through two
+	// connectors is two sessions, and a caller may want either or one of them.
+	resp, err = client.ListAuthSessions(ctx, &api.ListAuthSessionsReq{ConnectorId: "conn1"})
+	if err != nil {
+		t.Fatalf("list auth sessions by connector: %v", err)
+	}
+	if len(resp.Sessions) != 2 {
+		t.Fatalf("expected 2 sessions on conn1, got %d", len(resp.Sessions))
+	}
+
+	resp, err = client.ListAuthSessions(ctx, &api.ListAuthSessionsReq{UserId: "user1", ConnectorId: "conn2"})
+	if err != nil {
+		t.Fatalf("list auth sessions by user and connector: %v", err)
+	}
+	if len(resp.Sessions) != 1 {
+		t.Fatalf("expected 1 session for user1 on conn2, got %d", len(resp.Sessions))
+	}
+}
+
+func TestDeleteAuthSession(t *testing.T) {
+	t.Setenv("DEX_API_SESSIONS_IDENTITIES_CRUD", "true")
+
+	logger := newLogger(t)
+	s := memory.New(logger)
+
+	client := newAPI(t, s, logger)
+	defer client.Close()
+
+	ctx := t.Context()
+
+	now := time.Now().UTC().Round(time.Second)
+
+	// Create session.
+	session := storage.AuthSession{
+		UserID: "user1", ConnectorID: "conn1", ID: "n1", Secret: "n1",
+		ClientStates:   map[string]*storage.ClientAuthState{},
+		CreatedAt:      now,
+		LastActivity:   now,
+		AbsoluteExpiry: now.Add(time.Hour),
+		IdleExpiry:     now.Add(time.Hour),
+	}
+	if err := s.CreateAuthSession(ctx, session); err != nil {
+		t.Fatalf("create auth session: %v", err)
+	}
+
+	// Create refresh token + offline session to verify cascading revocation.
+	refreshID := storage.NewID()
+	if err := s.CreateRefresh(ctx, storage.RefreshToken{
+		ID: refreshID, Token: "tok", Nonce: "n", ClientID: "client1", ConnectorID: "conn1",
+		Scopes: []string{"openid"}, CreatedAt: now, LastUsed: now,
+		Claims: storage.Claims{UserID: "user1", Username: "test", Email: "test@test.com"},
+	}); err != nil {
+		t.Fatalf("create refresh: %v", err)
+	}
+	if err := s.CreateOfflineSessions(ctx, storage.OfflineSessions{
+		UserID: "user1", ConnID: "conn1",
+		Refresh: map[string]*storage.RefreshTokenRef{
+			"client1": {ID: refreshID, ClientID: "client1", CreatedAt: now, LastUsed: now},
+		},
+	}); err != nil {
+		t.Fatalf("create offline sessions: %v", err)
+	}
+
+	// Delete session.
+	resp, err := client.DeleteAuthSession(ctx, &api.DeleteAuthSessionReq{Id: "n1"})
+	if err != nil {
+		t.Fatalf("delete auth session: %v", err)
+	}
+	if resp.NotFound {
+		t.Error("expected session to be found")
+	}
+
+	// Verify session is gone.
+	_, err = s.GetAuthSession(ctx, "n1")
+	if err == nil {
+		t.Error("expected auth session to be deleted")
+	}
+
+	// Verify refresh token was revoked.
+	_, err = s.GetRefresh(ctx, refreshID)
+	if err == nil {
+		t.Error("expected refresh token to be revoked")
+	}
+
+	// Not found case.
+	resp, err = client.DeleteAuthSession(ctx, &api.DeleteAuthSessionReq{Id: "n1"})
+	if err != nil {
+		t.Fatalf("delete auth session: %v", err)
+	}
+	if !resp.NotFound {
+		t.Error("expected not_found for already deleted session")
+	}
+}
+
+func TestTerminateSessionsByConnector(t *testing.T) {
+	t.Setenv("DEX_API_SESSIONS_IDENTITIES_CRUD", "true")
+
+	logger := newLogger(t)
+	s := memory.New(logger)
+
+	client := newAPI(t, s, logger)
+	defer client.Close()
+
+	ctx := t.Context()
+
+	now := time.Now().UTC().Round(time.Second)
+	for _, sess := range []storage.AuthSession{
+		{UserID: "user1", ConnectorID: "target-conn", ID: "n1", Secret: "n1", ClientStates: map[string]*storage.ClientAuthState{}, CreatedAt: now, LastActivity: now, AbsoluteExpiry: now.Add(time.Hour), IdleExpiry: now.Add(time.Hour)},
+		{UserID: "user2", ConnectorID: "target-conn", ID: "n2", Secret: "n2", ClientStates: map[string]*storage.ClientAuthState{}, CreatedAt: now, LastActivity: now, AbsoluteExpiry: now.Add(time.Hour), IdleExpiry: now.Add(time.Hour)},
+		{UserID: "user3", ConnectorID: "other-conn", ID: "n3", Secret: "n3", ClientStates: map[string]*storage.ClientAuthState{}, CreatedAt: now, LastActivity: now, AbsoluteExpiry: now.Add(time.Hour), IdleExpiry: now.Add(time.Hour)},
+	} {
+		if err := s.CreateAuthSession(ctx, sess); err != nil {
+			t.Fatalf("create auth session: %v", err)
+		}
+	}
+
+	resp, err := client.TerminateSessionsByConnector(ctx, &api.TerminateSessionsByConnectorReq{
+		ConnectorId: "target-conn",
+	})
+	if err != nil {
+		t.Fatalf("terminate sessions by connector: %v", err)
+	}
+	if resp.SessionsTerminated != 2 {
+		t.Errorf("expected 2 terminated, got %d", resp.SessionsTerminated)
+	}
+
+	// Verify remaining session is untouched.
+	remaining, err := s.ListAuthSessions(ctx)
+	if err != nil {
+		t.Fatalf("list auth sessions: %v", err)
+	}
+	if len(remaining) != 1 || remaining[0].ConnectorID != "other-conn" {
+		t.Errorf("expected only other-conn session to remain, got %v", remaining)
+	}
+}
+
+func TestTerminateSessionsByUser(t *testing.T) {
+	t.Setenv("DEX_API_SESSIONS_IDENTITIES_CRUD", "true")
+
+	logger := newLogger(t)
+	s := memory.New(logger)
+
+	client := newAPI(t, s, logger)
+	defer client.Close()
+
+	ctx := t.Context()
+
+	now := time.Now().UTC().Round(time.Second)
+	for _, sess := range []storage.AuthSession{
+		{UserID: "target-user", ConnectorID: "conn1", ID: "n1", Secret: "n1", ClientStates: map[string]*storage.ClientAuthState{}, CreatedAt: now, LastActivity: now, AbsoluteExpiry: now.Add(time.Hour), IdleExpiry: now.Add(time.Hour)},
+		{UserID: "target-user", ConnectorID: "conn2", ID: "n2", Secret: "n2", ClientStates: map[string]*storage.ClientAuthState{}, CreatedAt: now, LastActivity: now, AbsoluteExpiry: now.Add(time.Hour), IdleExpiry: now.Add(time.Hour)},
+		{UserID: "other-user", ConnectorID: "conn1", ID: "n3", Secret: "n3", ClientStates: map[string]*storage.ClientAuthState{}, CreatedAt: now, LastActivity: now, AbsoluteExpiry: now.Add(time.Hour), IdleExpiry: now.Add(time.Hour)},
+	} {
+		if err := s.CreateAuthSession(ctx, sess); err != nil {
+			t.Fatalf("create auth session: %v", err)
+		}
+	}
+
+	resp, err := client.TerminateSessionsByUser(ctx, &api.TerminateSessionsByUserReq{
+		UserId: "target-user",
+	})
+	if err != nil {
+		t.Fatalf("terminate sessions by user: %v", err)
+	}
+	if resp.SessionsTerminated != 2 {
+		t.Errorf("expected 2 terminated, got %d", resp.SessionsTerminated)
+	}
+
+	remaining, err := s.ListAuthSessions(ctx)
+	if err != nil {
+		t.Fatalf("list auth sessions: %v", err)
+	}
+	if len(remaining) != 1 || remaining[0].UserID != "other-user" {
+		t.Errorf("expected only other-user session to remain")
+	}
+}
+
+func TestGetUserIdentity(t *testing.T) {
+	t.Setenv("DEX_API_SESSIONS_IDENTITIES_CRUD", "true")
+
+	logger := newLogger(t)
+	s := memory.New(logger)
+
+	client := newAPI(t, s, logger)
+	defer client.Close()
+
+	ctx := t.Context()
+
+	now := time.Now().UTC().Round(time.Second)
+	identity := storage.UserIdentity{
+		UserID:      "user1",
+		ConnectorID: "conn1",
+		Claims: storage.Claims{
+			UserID:        "user1",
+			Username:      "testuser",
+			Email:         "test@example.com",
+			EmailVerified: true,
+			Groups:        []string{"admins"},
+		},
+		Consents: map[string][]string{
+			"client-a": {"openid", "email"},
+		},
+		MFASecrets: map[string]*storage.MFASecret{
+			"totp-1": {AuthenticatorID: "totp-1", Type: "TOTP", Secret: "secret123", Confirmed: true, CreatedAt: now},
+		},
+		WebAuthnCredentials: map[string][]storage.WebAuthnCredential{
+			"webauthn-1": {{CredentialID: []byte("cred1"), AttestationType: "none", DisplayName: "YubiKey", CreatedAt: now}},
+		},
+		CreatedAt: now,
+		LastLogin: now,
+	}
+
+	if err := s.CreateUserIdentity(ctx, identity); err != nil {
+		t.Fatalf("create user identity: %v", err)
+	}
+
+	resp, err := client.GetUserIdentity(ctx, &api.GetUserIdentityReq{
+		UserId: "user1", ConnectorId: "conn1",
+	})
+	if err != nil {
+		t.Fatalf("get user identity: %v", err)
+	}
+
+	if resp.Identity.Email != "test@example.com" {
+		t.Errorf("expected email 'test@example.com', got '%s'", resp.Identity.Email)
+	}
+	if !resp.Identity.EmailVerified {
+		t.Error("expected email_verified true")
+	}
+	if resp.Identity.Username != "testuser" {
+		t.Errorf("expected username 'testuser', got '%s'", resp.Identity.Username)
+	}
+	if len(resp.Identity.Consents) != 1 {
+		t.Fatalf("expected 1 consent entry, got %d", len(resp.Identity.Consents))
+	}
+	if len(resp.Identity.MfaDevices) == 0 {
+		t.Fatal("expected MFA devices")
+	}
+}
+
+func TestListUserIdentities(t *testing.T) {
+	t.Setenv("DEX_API_SESSIONS_IDENTITIES_CRUD", "true")
+
+	logger := newLogger(t)
+	s := memory.New(logger)
+
+	client := newAPI(t, s, logger)
+	defer client.Close()
+
+	ctx := t.Context()
+
+	now := time.Now().UTC().Round(time.Second)
+	for _, id := range []storage.UserIdentity{
+		{UserID: "user1", ConnectorID: "conn1", Claims: storage.Claims{Email: "a@test.com"}, CreatedAt: now, LastLogin: now},
+		{UserID: "user2", ConnectorID: "conn1", Claims: storage.Claims{Email: "b@test.com"}, CreatedAt: now, LastLogin: now},
+	} {
+		if err := s.CreateUserIdentity(ctx, id); err != nil {
+			t.Fatalf("create user identity: %v", err)
+		}
+	}
+
+	resp, err := client.ListUserIdentities(ctx, &api.ListUserIdentitiesReq{})
+	if err != nil {
+		t.Fatalf("list user identities: %v", err)
+	}
+	if len(resp.Identities) != 2 {
+		t.Fatalf("expected 2 identities, got %d", len(resp.Identities))
+	}
+}
+
+func TestDeleteUserIdentity(t *testing.T) {
+	t.Setenv("DEX_API_SESSIONS_IDENTITIES_CRUD", "true")
+
+	logger := newLogger(t)
+	s := memory.New(logger)
+
+	client := newAPI(t, s, logger)
+	defer client.Close()
+
+	ctx := t.Context()
+
+	now := time.Now().UTC().Round(time.Second)
+
+	// Create identity + session + offline sessions + refresh token.
+	if err := s.CreateUserIdentity(ctx, storage.UserIdentity{
+		UserID: "user1", ConnectorID: "conn1",
+		Claims: storage.Claims{Email: "test@test.com"}, CreatedAt: now, LastLogin: now,
+	}); err != nil {
+		t.Fatalf("create user identity: %v", err)
+	}
+	if err := s.CreateAuthSession(ctx, storage.AuthSession{
+		UserID: "user1", ConnectorID: "conn1", ID: "n", Secret: "n",
+		ClientStates: map[string]*storage.ClientAuthState{}, CreatedAt: now, LastActivity: now,
+		AbsoluteExpiry: now.Add(time.Hour), IdleExpiry: now.Add(time.Hour),
+	}); err != nil {
+		t.Fatalf("create auth session: %v", err)
+	}
+	refreshID := storage.NewID()
+	if err := s.CreateRefresh(ctx, storage.RefreshToken{
+		ID: refreshID, Token: "tok", Nonce: "n", ClientID: "c1", ConnectorID: "conn1",
+		Scopes: []string{"openid"}, CreatedAt: now, LastUsed: now,
+		Claims: storage.Claims{UserID: "user1", Email: "test@test.com"},
+	}); err != nil {
+		t.Fatalf("create refresh: %v", err)
+	}
+	if err := s.CreateOfflineSessions(ctx, storage.OfflineSessions{
+		UserID: "user1", ConnID: "conn1",
+		Refresh: map[string]*storage.RefreshTokenRef{
+			"c1": {ID: refreshID, ClientID: "c1", CreatedAt: now, LastUsed: now},
+		},
+	}); err != nil {
+		t.Fatalf("create offline sessions: %v", err)
+	}
+	// Password record linked by the identity's email — must be purged too (GDPR).
+	if err := s.CreatePassword(ctx, storage.Password{
+		Email: "test@test.com", Hash: []byte("$2y$10$XXXXXXXXXXXXXXXXXXXXXX"), Username: "test", UserID: "user1",
+	}); err != nil {
+		t.Fatalf("create password: %v", err)
+	}
+
+	// Delete identity (cascading).
+	resp, err := client.DeleteUserIdentity(ctx, &api.DeleteUserIdentityReq{
+		UserId: "user1", ConnectorId: "conn1",
+	})
+	if err != nil {
+		t.Fatalf("delete user identity: %v", err)
+	}
+	if resp.NotFound {
+		t.Error("expected identity to be found")
+	}
+
+	// Verify everything is deleted.
+	if _, err := s.GetUserIdentity(ctx, "user1", "conn1"); err == nil {
+		t.Error("expected user identity to be deleted")
+	}
+	if _, err := s.GetAuthSession(ctx, "n"); err == nil {
+		t.Error("expected auth session to be deleted")
+	}
+	if _, err := s.GetRefresh(ctx, refreshID); err == nil {
+		t.Error("expected refresh token to be deleted")
+	}
+	if _, err := s.GetOfflineSessions(ctx, "user1", "conn1"); err == nil {
+		t.Error("expected offline sessions to be deleted")
+	}
+	if _, err := s.GetPassword(ctx, "test@test.com"); err == nil {
+		t.Error("expected password record to be deleted")
+	}
+
+	// Not found case.
+	resp, err = client.DeleteUserIdentity(ctx, &api.DeleteUserIdentityReq{
+		UserId: "user1", ConnectorId: "conn1",
+	})
+	if err != nil {
+		t.Fatalf("delete user identity: %v", err)
+	}
+	if !resp.NotFound {
+		t.Error("expected not_found for already deleted identity")
+	}
+}
+
+func TestResetMFA(t *testing.T) {
+	t.Setenv("DEX_API_SESSIONS_IDENTITIES_CRUD", "true")
+
+	logger := newLogger(t)
+	s := memory.New(logger)
+
+	client := newAPI(t, s, logger)
+	defer client.Close()
+
+	ctx := t.Context()
+
+	now := time.Now().UTC().Round(time.Second)
+	if err := s.CreateUserIdentity(ctx, storage.UserIdentity{
+		UserID: "user1", ConnectorID: "conn1",
+		Claims: storage.Claims{Email: "test@test.com"}, CreatedAt: now, LastLogin: now,
+		MFASecrets: map[string]*storage.MFASecret{
+			"totp-1": {AuthenticatorID: "totp-1", Type: "TOTP", Secret: "s", Confirmed: true, CreatedAt: now},
+		},
+		WebAuthnCredentials: map[string][]storage.WebAuthnCredential{
+			"webauthn-1": {{CredentialID: []byte("c1"), CreatedAt: now}},
+		},
+	}); err != nil {
+		t.Fatalf("create user identity: %v", err)
+	}
+
+	resp, err := client.ResetMFA(ctx, &api.ResetMFAReq{
+		UserId: "user1", ConnectorId: "conn1",
+	})
+	if err != nil {
+		t.Fatalf("reset MFA: %v", err)
+	}
+	if resp.NotFound {
+		t.Error("expected identity to be found")
+	}
+
+	// Verify MFA data is cleared.
+	identity, err := s.GetUserIdentity(ctx, "user1", "conn1")
+	if err != nil {
+		t.Fatalf("get user identity: %v", err)
+	}
+	if len(identity.MFASecrets) != 0 {
+		t.Errorf("expected MFASecrets to be cleared, got %d", len(identity.MFASecrets))
+	}
+	if len(identity.WebAuthnCredentials) != 0 {
+		t.Errorf("expected WebAuthnCredentials to be cleared, got %d", len(identity.WebAuthnCredentials))
+	}
+	// Verify other fields are preserved.
+	if identity.Claims.Email != "test@test.com" {
+		t.Errorf("expected email to be preserved, got '%s'", identity.Claims.Email)
+	}
+}
+
+func TestListMFADevices(t *testing.T) {
+	t.Setenv("DEX_API_SESSIONS_IDENTITIES_CRUD", "true")
+
+	logger := newLogger(t)
+	s := memory.New(logger)
+
+	client := newAPI(t, s, logger)
+	defer client.Close()
+
+	ctx := t.Context()
+
+	now := time.Now().UTC().Round(time.Second)
+	if err := s.CreateUserIdentity(ctx, storage.UserIdentity{
+		UserID: "user1", ConnectorID: "conn1",
+		Claims: storage.Claims{Email: "test@test.com"}, CreatedAt: now, LastLogin: now,
+		MFASecrets: map[string]*storage.MFASecret{
+			"totp-1": {AuthenticatorID: "totp-1", Type: "TOTP", Secret: "secret123", Confirmed: true, CreatedAt: now},
+		},
+		WebAuthnCredentials: map[string][]storage.WebAuthnCredential{
+			"webauthn-1": {
+				{CredentialID: []byte("cred1"), PublicKey: []byte("pk1"), DisplayName: "Key1", CreatedAt: now},
+				{CredentialID: []byte("cred2"), PublicKey: []byte("pk2"), DisplayName: "Key2", CreatedAt: now},
+			},
+		},
+	}); err != nil {
+		t.Fatalf("create user identity: %v", err)
+	}
+
+	resp, err := client.ListMFADevices(ctx, &api.ListMFADevicesReq{
+		UserId: "user1", ConnectorId: "conn1",
+	})
+	if err != nil {
+		t.Fatalf("list MFA devices: %v", err)
+	}
+	if len(resp.Devices) != 2 {
+		t.Fatalf("expected 2 device groups, got %d", len(resp.Devices))
+	}
+
+	// Find the TOTP device and verify secret is not exposed.
+	for _, device := range resp.Devices {
+		if device.AuthenticatorId == "totp-1" {
+			if device.MfaSecret == nil {
+				t.Fatal("expected MFA secret for totp-1")
+			}
+			if device.MfaSecret.Type != "TOTP" {
+				t.Errorf("expected type TOTP, got %s", device.MfaSecret.Type)
+			}
+		}
+		if device.AuthenticatorId == "webauthn-1" {
+			if len(device.WebauthnCredentials) != 2 {
+				t.Errorf("expected 2 webauthn credentials, got %d", len(device.WebauthnCredentials))
+			}
+		}
+	}
+}
+
+func TestDeleteWebAuthnCredential(t *testing.T) {
+	t.Setenv("DEX_API_SESSIONS_IDENTITIES_CRUD", "true")
+
+	logger := newLogger(t)
+	s := memory.New(logger)
+
+	client := newAPI(t, s, logger)
+	defer client.Close()
+
+	ctx := t.Context()
+
+	now := time.Now().UTC().Round(time.Second)
+	if err := s.CreateUserIdentity(ctx, storage.UserIdentity{
+		UserID: "user1", ConnectorID: "conn1",
+		Claims: storage.Claims{Email: "test@test.com"}, CreatedAt: now, LastLogin: now,
+		WebAuthnCredentials: map[string][]storage.WebAuthnCredential{
+			"auth-1": {
+				{CredentialID: []byte("cred-to-delete"), DisplayName: "Key1", CreatedAt: now},
+				{CredentialID: []byte("cred-to-keep"), DisplayName: "Key2", CreatedAt: now},
+			},
+		},
+	}); err != nil {
+		t.Fatalf("create user identity: %v", err)
+	}
+
+	// Delete one credential.
+	resp, err := client.DeleteWebAuthnCredential(ctx, &api.DeleteWebAuthnCredentialReq{
+		UserId: "user1", ConnectorId: "conn1", CredentialId: []byte("cred-to-delete"),
+	})
+	if err != nil {
+		t.Fatalf("delete webauthn credential: %v", err)
+	}
+	if resp.NotFound {
+		t.Error("expected credential to be found")
+	}
+
+	// Verify only one credential remains.
+	identity, err := s.GetUserIdentity(ctx, "user1", "conn1")
+	if err != nil {
+		t.Fatalf("get user identity: %v", err)
+	}
+	creds := identity.WebAuthnCredentials["auth-1"]
+	if len(creds) != 1 {
+		t.Fatalf("expected 1 credential remaining, got %d", len(creds))
+	}
+	if !bytes.Equal(creds[0].CredentialID, []byte("cred-to-keep")) {
+		t.Error("wrong credential was deleted")
+	}
+
+	// Not found case.
+	resp, err = client.DeleteWebAuthnCredential(ctx, &api.DeleteWebAuthnCredentialReq{
+		UserId: "user1", ConnectorId: "conn1", CredentialId: []byte("nonexistent"),
+	})
+	if err != nil {
+		t.Fatalf("delete webauthn credential: %v", err)
+	}
+	if !resp.NotFound {
+		t.Error("expected not_found for nonexistent credential")
+	}
+}
+
+func TestDeleteMFASecret(t *testing.T) {
+	t.Setenv("DEX_API_SESSIONS_IDENTITIES_CRUD", "true")
+
+	logger := newLogger(t)
+	s := memory.New(logger)
+
+	client := newAPI(t, s, logger)
+	defer client.Close()
+
+	ctx := t.Context()
+
+	now := time.Now().UTC().Round(time.Second)
+	if err := s.CreateUserIdentity(ctx, storage.UserIdentity{
+		UserID: "user1", ConnectorID: "conn1",
+		Claims: storage.Claims{Email: "test@test.com"}, CreatedAt: now, LastLogin: now,
+		MFASecrets: map[string]*storage.MFASecret{
+			"totp-1": {AuthenticatorID: "totp-1", Type: "TOTP", Secret: "s", Confirmed: true, CreatedAt: now},
+			"totp-2": {AuthenticatorID: "totp-2", Type: "TOTP", Secret: "s2", Confirmed: true, CreatedAt: now},
+		},
+		WebAuthnCredentials: map[string][]storage.WebAuthnCredential{
+			"totp-1": {{CredentialID: []byte("c1"), CreatedAt: now}},
+		},
+	}); err != nil {
+		t.Fatalf("create user identity: %v", err)
+	}
+
+	// Delete totp-1 (should also remove associated webauthn credentials).
+	resp, err := client.DeleteMFASecret(ctx, &api.DeleteMFASecretReq{
+		UserId: "user1", ConnectorId: "conn1", AuthenticatorId: "totp-1",
+	})
+	if err != nil {
+		t.Fatalf("delete MFA secret: %v", err)
+	}
+	if resp.NotFound {
+		t.Error("expected authenticator to be found")
+	}
+
+	identity, err := s.GetUserIdentity(ctx, "user1", "conn1")
+	if err != nil {
+		t.Fatalf("get user identity: %v", err)
+	}
+	if _, ok := identity.MFASecrets["totp-1"]; ok {
+		t.Error("expected totp-1 to be deleted")
+	}
+	if _, ok := identity.MFASecrets["totp-2"]; !ok {
+		t.Error("expected totp-2 to remain")
+	}
+	if _, ok := identity.WebAuthnCredentials["totp-1"]; ok {
+		t.Error("expected webauthn credentials for totp-1 to be deleted")
+	}
+
+	// Not found case.
+	resp, err = client.DeleteMFASecret(ctx, &api.DeleteMFASecretReq{
+		UserId: "user1", ConnectorId: "conn1", AuthenticatorId: "nonexistent",
+	})
+	if err != nil {
+		t.Fatalf("delete MFA secret: %v", err)
+	}
+	if !resp.NotFound {
+		t.Error("expected not_found for nonexistent authenticator")
+	}
+}
+
+func TestRevokeConsent(t *testing.T) {
+	t.Setenv("DEX_API_SESSIONS_IDENTITIES_CRUD", "true")
+
+	logger := newLogger(t)
+	s := memory.New(logger)
+
+	client := newAPI(t, s, logger)
+	defer client.Close()
+
+	ctx := t.Context()
+
+	now := time.Now().UTC().Round(time.Second)
+	if err := s.CreateUserIdentity(ctx, storage.UserIdentity{
+		UserID: "user1", ConnectorID: "conn1",
+		Claims: storage.Claims{Email: "test@test.com"}, CreatedAt: now, LastLogin: now,
+		Consents: map[string][]string{
+			"client-a": {"openid", "email"},
+			"client-b": {"openid"},
+		},
+	}); err != nil {
+		t.Fatalf("create user identity: %v", err)
+	}
+
+	// Revoke consent for client-a.
+	resp, err := client.RevokeConsent(ctx, &api.RevokeConsentReq{
+		UserId: "user1", ConnectorId: "conn1", ClientId: "client-a",
+	})
+	if err != nil {
+		t.Fatalf("revoke consent: %v", err)
+	}
+	if resp.NotFound {
+		t.Error("expected consent to be found")
+	}
+
+	// Verify only client-b consent remains.
+	identity, err := s.GetUserIdentity(ctx, "user1", "conn1")
+	if err != nil {
+		t.Fatalf("get user identity: %v", err)
+	}
+	if _, ok := identity.Consents["client-a"]; ok {
+		t.Error("expected client-a consent to be revoked")
+	}
+	if _, ok := identity.Consents["client-b"]; !ok {
+		t.Error("expected client-b consent to remain")
+	}
+
+	// Not found case.
+	resp, err = client.RevokeConsent(ctx, &api.RevokeConsentReq{
+		UserId: "user1", ConnectorId: "conn1", ClientId: "nonexistent",
+	})
+	if err != nil {
+		t.Fatalf("revoke consent: %v", err)
+	}
+	if !resp.NotFound {
+		t.Error("expected not_found for nonexistent consent")
+	}
+}
+
+func TestMissingSessionsIdentitiesCRUDFeatureFlag(t *testing.T) {
+	logger := newLogger(t)
+	s := memory.New(logger)
+
+	client := newAPI(t, s, logger)
+	defer client.Close()
+
+	ctx := t.Context()
+
+	if _, err := client.GetAuthSession(ctx, &api.GetAuthSessionReq{Id: "s"}); err == nil {
+		t.Error("GetAuthSession should fail without feature flag")
+	}
+	if _, err := client.ListAuthSessions(ctx, &api.ListAuthSessionsReq{}); err == nil {
+		t.Error("ListAuthSessions should fail without feature flag")
+	}
+	if _, err := client.DeleteAuthSession(ctx, &api.DeleteAuthSessionReq{Id: "s"}); err == nil {
+		t.Error("DeleteAuthSession should fail without feature flag")
+	}
+	if _, err := client.TerminateSessionsByConnector(ctx, &api.TerminateSessionsByConnectorReq{ConnectorId: "c"}); err == nil {
+		t.Error("TerminateSessionsByConnector should fail without feature flag")
+	}
+	if _, err := client.TerminateSessionsByUser(ctx, &api.TerminateSessionsByUserReq{UserId: "u"}); err == nil {
+		t.Error("TerminateSessionsByUser should fail without feature flag")
+	}
+	if _, err := client.GetUserIdentity(ctx, &api.GetUserIdentityReq{UserId: "u", ConnectorId: "c"}); err == nil {
+		t.Error("GetUserIdentity should fail without feature flag")
+	}
+	if _, err := client.ListUserIdentities(ctx, &api.ListUserIdentitiesReq{}); err == nil {
+		t.Error("ListUserIdentities should fail without feature flag")
+	}
+	if _, err := client.DeleteUserIdentity(ctx, &api.DeleteUserIdentityReq{UserId: "u", ConnectorId: "c"}); err == nil {
+		t.Error("DeleteUserIdentity should fail without feature flag")
+	}
+	if _, err := client.ResetMFA(ctx, &api.ResetMFAReq{UserId: "u", ConnectorId: "c"}); err == nil {
+		t.Error("ResetMFA should fail without feature flag")
+	}
+	if _, err := client.ListMFADevices(ctx, &api.ListMFADevicesReq{UserId: "u", ConnectorId: "c"}); err == nil {
+		t.Error("ListMFADevices should fail without feature flag")
+	}
+	if _, err := client.DeleteWebAuthnCredential(ctx, &api.DeleteWebAuthnCredentialReq{UserId: "u", ConnectorId: "c", CredentialId: []byte("cred")}); err == nil {
+		t.Error("DeleteWebAuthnCredential should fail without feature flag")
+	}
+	if _, err := client.DeleteMFASecret(ctx, &api.DeleteMFASecretReq{UserId: "u", ConnectorId: "c", AuthenticatorId: "a"}); err == nil {
+		t.Error("DeleteMFASecret should fail without feature flag")
+	}
+	if _, err := client.RevokeConsent(ctx, &api.RevokeConsentReq{UserId: "u", ConnectorId: "c", ClientId: "cl"}); err == nil {
+		t.Error("RevokeConsent should fail without feature flag")
+	}
+}
+
+// TestSessionsIdentitiesZeroTimeConversion verifies that unset time.Time fields
+// serialize to 0 rather than the misleading year-1 epoch (-62135596800) that a
+// naive t.Unix() produces.
+func TestSessionsIdentitiesZeroTimeConversion(t *testing.T) {
+	t.Setenv("DEX_API_SESSIONS_IDENTITIES_CRUD", "true")
+
+	logger := newLogger(t)
+	s := memory.New(logger)
+
+	client := newAPI(t, s, logger)
+	defer client.Close()
+
+	ctx := t.Context()
+
+	now := time.Now().UTC().Round(time.Second)
+
+	// Client authenticated but no token issued yet: LastTokenIssuedAt is zero.
+	if err := s.CreateAuthSession(ctx, storage.AuthSession{
+		UserID: "user1", ConnectorID: "conn1", ID: "n", Secret: "n",
+		ClientStates: map[string]*storage.ClientAuthState{
+			"client-a": {AuthenticatedAt: now, LastActivity: now},
+		},
+		CreatedAt: now, LastActivity: now, AbsoluteExpiry: now.Add(time.Hour), IdleExpiry: now.Add(time.Hour),
+	}); err != nil {
+		t.Fatalf("create auth session: %v", err)
+	}
+
+	sessResp, err := client.GetAuthSession(ctx, &api.GetAuthSessionReq{Id: "n"})
+	if err != nil {
+		t.Fatalf("get auth session: %v", err)
+	}
+	if len(sessResp.Session.ClientStates) != 1 {
+		t.Fatalf("expected 1 client state, got %d", len(sessResp.Session.ClientStates))
+	}
+	if got := sessResp.Session.ClientStates[0].LastTokenIssuedAt; got != 0 {
+		t.Errorf("expected last_token_issued_at 0 for unset time, got %d", got)
+	}
+
+	// Identity that has never logged in and is not blocked: LastLogin and
+	// BlockedUntil are zero.
+	if err := s.CreateUserIdentity(ctx, storage.UserIdentity{
+		UserID: "user1", ConnectorID: "conn1",
+		Claims: storage.Claims{Email: "test@test.com"}, CreatedAt: now,
+	}); err != nil {
+		t.Fatalf("create user identity: %v", err)
+	}
+
+	idResp, err := client.GetUserIdentity(ctx, &api.GetUserIdentityReq{UserId: "user1", ConnectorId: "conn1"})
+	if err != nil {
+		t.Fatalf("get user identity: %v", err)
+	}
+	if got := idResp.Identity.LastLogin; got != 0 {
+		t.Errorf("expected last_login 0 for unset time, got %d", got)
+	}
+	if got := idResp.Identity.BlockedUntil; got != 0 {
+		t.Errorf("expected blocked_until 0 for unset time, got %d", got)
+	}
+}
+
+// TestSessionsIdentitiesValidation verifies that handlers reject requests
+// missing required fields.
+func TestSessionsIdentitiesValidation(t *testing.T) {
+	t.Setenv("DEX_API_SESSIONS_IDENTITIES_CRUD", "true")
+
+	logger := newLogger(t)
+	s := memory.New(logger)
+
+	client := newAPI(t, s, logger)
+	defer client.Close()
+
+	ctx := t.Context()
+
+	if _, err := client.GetAuthSession(ctx, &api.GetAuthSessionReq{}); err == nil {
+		t.Error("GetAuthSession should reject an empty id")
+	}
+	if _, err := client.DeleteAuthSession(ctx, &api.DeleteAuthSessionReq{}); err == nil {
+		t.Error("DeleteAuthSession should reject an empty id")
+	}
+	if _, err := client.TerminateSessionsByConnector(ctx, &api.TerminateSessionsByConnectorReq{}); err == nil {
+		t.Error("TerminateSessionsByConnector should reject empty connector_id")
+	}
+	if _, err := client.TerminateSessionsByUser(ctx, &api.TerminateSessionsByUserReq{}); err == nil {
+		t.Error("TerminateSessionsByUser should reject empty user_id")
+	}
+	if _, err := client.DeleteWebAuthnCredential(ctx, &api.DeleteWebAuthnCredentialReq{UserId: "u", ConnectorId: "c"}); err == nil {
+		t.Error("DeleteWebAuthnCredential should reject empty credential_id")
+	}
+	if _, err := client.DeleteMFASecret(ctx, &api.DeleteMFASecretReq{UserId: "u", ConnectorId: "c"}); err == nil {
+		t.Error("DeleteMFASecret should reject empty authenticator_id")
+	}
+	if _, err := client.RevokeConsent(ctx, &api.RevokeConsentReq{UserId: "u", ConnectorId: "c"}); err == nil {
+		t.Error("RevokeConsent should reject empty client_id")
+	}
+}
diff --git a/server/apiserver/clients.go b/server/apiserver/clients.go
new file mode 100644
index 0000000000..7b08b447da
--- /dev/null
+++ b/server/apiserver/clients.go
@@ -0,0 +1,169 @@
+package apiserver
+
+import (
+	"context"
+	"errors"
+	"fmt"
+
+	"github.com/dexidp/dex/api/v2"
+	"github.com/dexidp/dex/storage"
+)
+
+func (d dexAPI) GetClient(ctx context.Context, req *api.GetClientReq) (*api.GetClientResp, error) {
+	c, err := d.s.GetClient(ctx, req.Id)
+	if err != nil {
+		return nil, err
+	}
+
+	return &api.GetClientResp{
+		Client: &api.Client{
+			Id:                     c.ID,
+			Name:                   c.Name,
+			Secret:                 c.Secret,
+			RedirectUris:           c.RedirectURIs,
+			TrustedPeers:           c.TrustedPeers,
+			Public:                 c.Public,
+			LogoUrl:                c.LogoURL,
+			AllowedConnectors:      c.AllowedConnectors,
+			SsoSharedWith:          c.SSOSharedWith,
+			BackchannelLogoutUri:   c.BackchannelLogoutURI,
+			PostLogoutRedirectUris: c.PostLogoutRedirectURIs,
+			RefreshTokenLifetime:   c.RefreshTokenLifetime,
+		},
+	}, nil
+}
+
+func (d dexAPI) CreateClient(ctx context.Context, req *api.CreateClientReq) (*api.CreateClientResp, error) {
+	if req.Client == nil {
+		return nil, errors.New("no client supplied")
+	}
+
+	if req.Client.Id == "" {
+		req.Client.Id = storage.NewID()
+	}
+	if req.Client.Secret == "" && !req.Client.Public {
+		req.Client.Secret = storage.NewID() + storage.NewID()
+	}
+
+	if err := storage.ValidateRefreshTokenLifetime(req.Client.RefreshTokenLifetime); err != nil {
+		return nil, err
+	}
+
+	c := storage.Client{
+		ID:                     req.Client.Id,
+		Secret:                 req.Client.Secret,
+		RedirectURIs:           req.Client.RedirectUris,
+		TrustedPeers:           req.Client.TrustedPeers,
+		Public:                 req.Client.Public,
+		Name:                   req.Client.Name,
+		LogoURL:                req.Client.LogoUrl,
+		AllowedConnectors:      req.Client.AllowedConnectors,
+		SSOSharedWith:          req.Client.SsoSharedWith,
+		BackchannelLogoutURI:   req.Client.BackchannelLogoutUri,
+		PostLogoutRedirectURIs: req.Client.PostLogoutRedirectUris,
+		RefreshTokenLifetime:   req.Client.RefreshTokenLifetime,
+	}
+	if err := d.s.CreateClient(ctx, c); err != nil {
+		if err == storage.ErrAlreadyExists {
+			return &api.CreateClientResp{AlreadyExists: true}, nil
+		}
+		d.logger.Error("failed to create client", "err", err)
+		return nil, fmt.Errorf("create client: %v", err)
+	}
+
+	return &api.CreateClientResp{
+		Client: req.Client,
+	}, nil
+}
+
+func (d dexAPI) UpdateClient(ctx context.Context, req *api.UpdateClientReq) (*api.UpdateClientResp, error) {
+	if req.Id == "" {
+		return nil, errors.New("update client: no client ID supplied")
+	}
+	if err := storage.ValidateRefreshTokenLifetime(req.GetRefreshTokenLifetime()); err != nil {
+		return nil, err
+	}
+
+	err := d.s.UpdateClient(ctx, req.Id, func(old storage.Client) (storage.Client, error) {
+		if req.RedirectUris != nil {
+			old.RedirectURIs = req.RedirectUris
+		}
+		if req.TrustedPeers != nil {
+			old.TrustedPeers = req.TrustedPeers
+		}
+		if req.Name != "" {
+			old.Name = req.Name
+		}
+		if req.LogoUrl != "" {
+			old.LogoURL = req.LogoUrl
+		}
+		if req.AllowedConnectors != nil {
+			old.AllowedConnectors = req.AllowedConnectors
+		}
+		if req.SsoSharedWith != nil {
+			old.SSOSharedWith = req.SsoSharedWith
+		}
+		// Explicit presence, so that sending an empty string clears the URI rather
+		// than being indistinguishable from not mentioning it.
+		if req.BackchannelLogoutUri != nil {
+			old.BackchannelLogoutURI = req.GetBackchannelLogoutUri()
+		}
+		if req.PostLogoutRedirectUris != nil {
+			old.PostLogoutRedirectURIs = req.PostLogoutRedirectUris
+		}
+		if req.RefreshTokenLifetime != nil {
+			old.RefreshTokenLifetime = req.GetRefreshTokenLifetime()
+		}
+		return old, nil
+	})
+	if err != nil {
+		if err == storage.ErrNotFound {
+			return &api.UpdateClientResp{NotFound: true}, nil
+		}
+		d.logger.Error("failed to update the client", "err", err)
+		return nil, fmt.Errorf("update client: %v", err)
+	}
+	return &api.UpdateClientResp{}, nil
+}
+
+func (d dexAPI) DeleteClient(ctx context.Context, req *api.DeleteClientReq) (*api.DeleteClientResp, error) {
+	err := d.s.DeleteClient(ctx, req.Id)
+	if err != nil {
+		if err == storage.ErrNotFound {
+			return &api.DeleteClientResp{NotFound: true}, nil
+		}
+		d.logger.Error("failed to delete client", "err", err)
+		return nil, fmt.Errorf("delete client: %v", err)
+	}
+	return &api.DeleteClientResp{}, nil
+}
+
+func (d dexAPI) ListClients(ctx context.Context, req *api.ListClientReq) (*api.ListClientResp, error) {
+	clientList, err := d.s.ListClients(ctx)
+	if err != nil {
+		d.logger.Error("failed to list clients", "err", err)
+		return nil, fmt.Errorf("list clients: %v", err)
+	}
+
+	clients := make([]*api.ClientInfo, 0, len(clientList))
+	for _, client := range clientList {
+		c := api.ClientInfo{
+			Id:                     client.ID,
+			Name:                   client.Name,
+			RedirectUris:           client.RedirectURIs,
+			TrustedPeers:           client.TrustedPeers,
+			Public:                 client.Public,
+			LogoUrl:                client.LogoURL,
+			AllowedConnectors:      client.AllowedConnectors,
+			SsoSharedWith:          client.SSOSharedWith,
+			BackchannelLogoutUri:   client.BackchannelLogoutURI,
+			PostLogoutRedirectUris: client.PostLogoutRedirectURIs,
+			RefreshTokenLifetime:   client.RefreshTokenLifetime,
+		}
+		clients = append(clients, &c)
+	}
+
+	return &api.ListClientResp{
+		Clients: clients,
+	}, nil
+}
diff --git a/server/apiserver/connectors.go b/server/apiserver/connectors.go
new file mode 100644
index 0000000000..ed800227ed
--- /dev/null
+++ b/server/apiserver/connectors.go
@@ -0,0 +1,194 @@
+package apiserver
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"strconv"
+
+	"github.com/dexidp/dex/api/v2"
+	"github.com/dexidp/dex/pkg/featureflags"
+	"github.com/dexidp/dex/server/connectors"
+	"github.com/dexidp/dex/storage"
+)
+
+func (d dexAPI) CreateConnector(ctx context.Context, req *api.CreateConnectorReq) (*api.CreateConnectorResp, error) {
+	if !featureflags.APIConnectorsCRUD.Enabled() {
+		return nil, fmt.Errorf("%s feature flag is not enabled", featureflags.APIConnectorsCRUD.Name)
+	}
+
+	if req.Connector == nil {
+		return nil, errors.New("no connector supplied")
+	}
+
+	if req.Connector.Id == "" {
+		return nil, errors.New("no id supplied")
+	}
+
+	if req.Connector.Type == "" {
+		return nil, errors.New("no type supplied")
+	}
+
+	if req.Connector.Name == "" {
+		return nil, errors.New("no name supplied")
+	}
+
+	if len(req.Connector.Config) == 0 {
+		return nil, errors.New("no config supplied")
+	}
+
+	if !json.Valid(req.Connector.Config) {
+		return nil, errors.New("invalid config supplied")
+	}
+
+	for _, gt := range req.Connector.GrantTypes {
+		if !connectors.ConnectorGrantTypes[gt] {
+			return nil, fmt.Errorf("unknown grant type %q", gt)
+		}
+	}
+
+	c := storage.Connector{
+		ID:              req.Connector.Id,
+		Name:            req.Connector.Name,
+		Type:            req.Connector.Type,
+		ResourceVersion: "1",
+		Config:          req.Connector.Config,
+		GrantTypes:      req.Connector.GrantTypes,
+	}
+	if err := d.s.CreateConnector(ctx, c); err != nil {
+		if err == storage.ErrAlreadyExists {
+			return &api.CreateConnectorResp{AlreadyExists: true}, nil
+		}
+		d.logger.Error("api: failed to create connector", "err", err)
+		return nil, fmt.Errorf("create connector: %v", err)
+	}
+
+	// Make sure we don't reuse stale entries in the cache
+	if d.connectors != nil {
+		d.connectors.Close(req.Connector.Id)
+	}
+
+	return &api.CreateConnectorResp{}, nil
+}
+
+func (d dexAPI) UpdateConnector(ctx context.Context, req *api.UpdateConnectorReq) (*api.UpdateConnectorResp, error) {
+	if !featureflags.APIConnectorsCRUD.Enabled() {
+		return nil, fmt.Errorf("%s feature flag is not enabled", featureflags.APIConnectorsCRUD.Name)
+	}
+
+	if req.Id == "" {
+		return nil, errors.New("no email supplied")
+	}
+
+	hasUpdate := len(req.NewConfig) != 0 ||
+		req.NewName != "" ||
+		req.NewType != "" ||
+		req.NewGrantTypes != nil
+	if !hasUpdate {
+		return nil, errors.New("nothing to update")
+	}
+
+	if len(req.NewConfig) != 0 && !json.Valid(req.NewConfig) {
+		return nil, errors.New("invalid config supplied")
+	}
+
+	if req.NewGrantTypes != nil {
+		for _, gt := range req.NewGrantTypes.GrantTypes {
+			if !connectors.ConnectorGrantTypes[gt] {
+				return nil, fmt.Errorf("unknown grant type %q", gt)
+			}
+		}
+	}
+
+	updater := func(old storage.Connector) (storage.Connector, error) {
+		if req.NewType != "" {
+			old.Type = req.NewType
+		}
+
+		if req.NewName != "" {
+			old.Name = req.NewName
+		}
+
+		if len(req.NewConfig) != 0 {
+			old.Config = req.NewConfig
+		}
+
+		if req.NewGrantTypes != nil {
+			old.GrantTypes = req.NewGrantTypes.GrantTypes
+		}
+
+		if rev, err := strconv.Atoi(defaultTo(old.ResourceVersion, "0")); err == nil {
+			old.ResourceVersion = strconv.Itoa(rev + 1)
+		}
+
+		return old, nil
+	}
+
+	if err := d.s.UpdateConnector(ctx, req.Id, updater); err != nil {
+		if err == storage.ErrNotFound {
+			return &api.UpdateConnectorResp{NotFound: true}, nil
+		}
+		d.logger.Error("api: failed to update connector", "err", err)
+		return nil, fmt.Errorf("update connector: %v", err)
+	}
+
+	return &api.UpdateConnectorResp{}, nil
+}
+
+func (d dexAPI) DeleteConnector(ctx context.Context, req *api.DeleteConnectorReq) (*api.DeleteConnectorResp, error) {
+	if !featureflags.APIConnectorsCRUD.Enabled() {
+		return nil, fmt.Errorf("%s feature flag is not enabled", featureflags.APIConnectorsCRUD.Name)
+	}
+
+	if req.Id == "" {
+		return nil, errors.New("no id supplied")
+	}
+
+	err := d.s.DeleteConnector(ctx, req.Id)
+	if err != nil {
+		if err == storage.ErrNotFound {
+			return &api.DeleteConnectorResp{NotFound: true}, nil
+		}
+		d.logger.Error("api: failed to delete connector", "err", err)
+		return nil, fmt.Errorf("delete connector: %v", err)
+	}
+
+	return &api.DeleteConnectorResp{}, nil
+}
+
+func (d dexAPI) ListConnectors(ctx context.Context, req *api.ListConnectorReq) (*api.ListConnectorResp, error) {
+	if !featureflags.APIConnectorsCRUD.Enabled() {
+		return nil, fmt.Errorf("%s feature flag is not enabled", featureflags.APIConnectorsCRUD.Name)
+	}
+
+	connectorList, err := d.s.ListConnectors(ctx)
+	if err != nil {
+		d.logger.Error("api: failed to list connectors", "err", err)
+		return nil, fmt.Errorf("list connectors: %v", err)
+	}
+
+	connectors := make([]*api.Connector, 0, len(connectorList))
+	for _, connector := range connectorList {
+		c := api.Connector{
+			Id:         connector.ID,
+			Name:       connector.Name,
+			Type:       connector.Type,
+			Config:     connector.Config,
+			GrantTypes: connector.GrantTypes,
+		}
+		connectors = append(connectors, &c)
+	}
+
+	return &api.ListConnectorResp{
+		Connectors: connectors,
+	}, nil
+}
+
+func defaultTo[T comparable](v, def T) T {
+	var zeroT T
+	if v == zeroT {
+		return def
+	}
+	return v
+}
diff --git a/server/apiserver/connectors_test.go b/server/apiserver/connectors_test.go
new file mode 100644
index 0000000000..c0e6f2da16
--- /dev/null
+++ b/server/apiserver/connectors_test.go
@@ -0,0 +1,136 @@
+package apiserver
+
+import (
+	"context"
+	"encoding/json"
+	"testing"
+
+	"github.com/dexidp/dex/api/v2"
+	"github.com/dexidp/dex/connector"
+	"github.com/dexidp/dex/connector/mock"
+	"github.com/dexidp/dex/server/connectors"
+	"github.com/dexidp/dex/storage/memory"
+)
+
+func TestConnectorCacheInvalidation(t *testing.T) {
+	t.Setenv("DEX_API_CONNECTORS_CRUD", "true")
+
+	logger := newLogger(t)
+	s := memory.New(logger)
+
+	// Only the connector type this test creates needs to resolve; the config map
+	// is injected, so the API's tests need none of dex's real connectors.
+	conns := connectors.NewCache(s, connectors.Resolver(s, logger, map[string]func() connectors.ConnectorConfig{
+		"mockPassword": func() connectors.ConnectorConfig { return new(mock.PasswordConfig) },
+	}))
+
+	// This test exercises connector-cache invalidation, not discovery, so no
+	// discovery handler is wired (GetDiscovery guards against nil).
+	apiServer := NewAPI(s, logger, "test", conns, nil, nil)
+	ctx := context.Background()
+
+	connID := "mock-conn"
+
+	// 1. Create a connector via API
+	config1 := mock.PasswordConfig{
+		Username: "user",
+		Password: "first-password",
+	}
+	config1Bytes, _ := json.Marshal(config1)
+
+	_, err := apiServer.CreateConnector(ctx, &api.CreateConnectorReq{
+		Connector: &api.Connector{
+			Id:     connID,
+			Type:   "mockPassword",
+			Name:   "Mock",
+			Config: config1Bytes,
+		},
+	})
+	if err != nil {
+		t.Fatalf("failed to create connector: %v", err)
+	}
+
+	// 2. Load it into server cache
+	c1, err := conns.Get(ctx, connID)
+	if err != nil {
+		t.Fatalf("failed to get connector: %v", err)
+	}
+
+	pc1 := c1.Connector.(connector.PasswordConnector)
+	_, valid, err := pc1.Login(ctx, connector.Scopes{}, "user", "first-password")
+	if err != nil || !valid {
+		t.Fatalf("failed to login with first password: %v", err)
+	}
+
+	// 3. Delete it via API
+	_, err = apiServer.DeleteConnector(ctx, &api.DeleteConnectorReq{Id: connID})
+	if err != nil {
+		t.Fatalf("failed to delete connector: %v", err)
+	}
+
+	// 4. Create it again with different password
+	config2 := mock.PasswordConfig{
+		Username: "user",
+		Password: "second-password",
+	}
+	config2Bytes, _ := json.Marshal(config2)
+
+	_, err = apiServer.CreateConnector(ctx, &api.CreateConnectorReq{
+		Connector: &api.Connector{
+			Id:     connID,
+			Type:   "mockPassword",
+			Name:   "Mock",
+			Config: config2Bytes,
+		},
+	})
+	if err != nil {
+		t.Fatalf("failed to create connector: %v", err)
+	}
+
+	// 5. Load it again
+	c2, err := conns.Get(ctx, connID)
+	if err != nil {
+		t.Fatalf("failed to get connector second time: %v", err)
+	}
+
+	pc2 := c2.Connector.(connector.PasswordConnector)
+
+	// If the fix works, it should now use the second password.
+	_, valid2, err := pc2.Login(ctx, connector.Scopes{}, "user", "second-password")
+	if err != nil || !valid2 {
+		t.Errorf("failed to login with second password, cache might still be stale")
+	}
+
+	_, valid1, _ := pc2.Login(ctx, connector.Scopes{}, "user", "first-password")
+	if valid1 {
+		t.Errorf("unexpectedly logged in with first password, cache is definitely stale")
+	}
+
+	// 6. Update it via API with a third password
+	config3 := mock.PasswordConfig{
+		Username: "user",
+		Password: "third-password",
+	}
+	config3Bytes, _ := json.Marshal(config3)
+
+	_, err = apiServer.UpdateConnector(ctx, &api.UpdateConnectorReq{
+		Id:        connID,
+		NewConfig: config3Bytes,
+	})
+	if err != nil {
+		t.Fatalf("failed to update connector: %v", err)
+	}
+
+	// 7. Load it again
+	c3, err := conns.Get(ctx, connID)
+	if err != nil {
+		t.Fatalf("failed to get connector third time: %v", err)
+	}
+
+	pc3 := c3.Connector.(connector.PasswordConnector)
+
+	_, valid3, err := pc3.Login(ctx, connector.Scopes{}, "user", "third-password")
+	if err != nil || !valid3 {
+		t.Errorf("failed to login with third password, UpdateConnector might be missing cache invalidation")
+	}
+}
diff --git a/server/apiserver/doc.go b/server/apiserver/doc.go
new file mode 100644
index 0000000000..a2ab309184
--- /dev/null
+++ b/server/apiserver/doc.go
@@ -0,0 +1,6 @@
+// Package apiserver implements the gRPC management API (api.DexServer): the CRUD
+// and administrative calls for clients, passwords, connectors, refresh tokens,
+// auth sessions, user identities and MFA devices. Each domain lives in its own
+// file. It depends only on storage, the connector cache and a discovery-document
+// builder, not on the whole Server.
+package apiserver
diff --git a/server/apiserver/identities.go b/server/apiserver/identities.go
new file mode 100644
index 0000000000..db96dceba4
--- /dev/null
+++ b/server/apiserver/identities.go
@@ -0,0 +1,151 @@
+package apiserver
+
+import (
+	"context"
+	"errors"
+	"fmt"
+
+	"github.com/dexidp/dex/api/v2"
+	"github.com/dexidp/dex/pkg/featureflags"
+	"github.com/dexidp/dex/storage"
+)
+
+func storageUserIdentityToAPI(u storage.UserIdentity) *api.UserIdentity {
+	consents := make([]*api.ConsentEntry, 0, len(u.Consents))
+	for clientID, scopes := range u.Consents {
+		consents = append(consents, &api.ConsentEntry{
+			ClientId: clientID,
+			Scopes:   scopes,
+		})
+	}
+
+	identity := &api.UserIdentity{
+		UserId:        u.UserID,
+		ConnectorId:   u.ConnectorID,
+		Email:         u.Claims.Email,
+		EmailVerified: u.Claims.EmailVerified,
+		Username:      u.Claims.Username,
+		Groups:        u.Claims.Groups,
+		Consents:      consents,
+		MfaDevices:    storageMFADevicesToAPI(u.MFASecrets, u.WebAuthnCredentials),
+		CreatedAt:     unixOrZero(u.CreatedAt),
+		LastLogin:     unixOrZero(u.LastLogin),
+		BlockedUntil:  unixOrZero(u.BlockedUntil),
+	}
+
+	return identity
+}
+
+func (d dexAPI) GetUserIdentity(ctx context.Context, req *api.GetUserIdentityReq) (*api.GetUserIdentityResp, error) {
+	if !featureflags.APISessionsIdentitiesCRUD.Enabled() {
+		return nil, fmt.Errorf("%s feature flag is not enabled", featureflags.APISessionsIdentitiesCRUD.Name)
+	}
+
+	if req.UserId == "" {
+		return nil, errors.New("no user_id supplied")
+	}
+	if req.ConnectorId == "" {
+		return nil, errors.New("no connector_id supplied")
+	}
+
+	identity, err := d.s.GetUserIdentity(ctx, req.UserId, req.ConnectorId)
+	if err != nil {
+		if errors.Is(err, storage.ErrNotFound) {
+			return nil, storage.ErrNotFound
+		}
+		d.logger.Error("api: failed to get user identity", "err", err)
+		return nil, fmt.Errorf("get user identity: %v", err)
+	}
+
+	return &api.GetUserIdentityResp{
+		Identity: storageUserIdentityToAPI(identity),
+	}, nil
+}
+
+func (d dexAPI) ListUserIdentities(ctx context.Context, req *api.ListUserIdentitiesReq) (*api.ListUserIdentitiesResp, error) {
+	if !featureflags.APISessionsIdentitiesCRUD.Enabled() {
+		return nil, fmt.Errorf("%s feature flag is not enabled", featureflags.APISessionsIdentitiesCRUD.Name)
+	}
+
+	identityList, err := d.s.ListUserIdentities(ctx)
+	if err != nil {
+		d.logger.Error("api: failed to list user identities", "err", err)
+		return nil, fmt.Errorf("list user identities: %v", err)
+	}
+
+	identities := make([]*api.UserIdentity, 0, len(identityList))
+	for _, u := range identityList {
+		identities = append(identities, storageUserIdentityToAPI(u))
+	}
+
+	return &api.ListUserIdentitiesResp{
+		Identities: identities,
+	}, nil
+}
+
+func (d dexAPI) DeleteUserIdentity(ctx context.Context, req *api.DeleteUserIdentityReq) (*api.DeleteUserIdentityResp, error) {
+	if !featureflags.APISessionsIdentitiesCRUD.Enabled() {
+		return nil, fmt.Errorf("%s feature flag is not enabled", featureflags.APISessionsIdentitiesCRUD.Name)
+	}
+
+	if req.UserId == "" {
+		return nil, errors.New("no user_id supplied")
+	}
+	if req.ConnectorId == "" {
+		return nil, errors.New("no connector_id supplied")
+	}
+
+	// Look up the identity first: report not-found cleanly without performing any
+	// cascade, and capture the email needed to purge the linked password record.
+	identity, err := d.s.GetUserIdentity(ctx, req.UserId, req.ConnectorId)
+	if err != nil {
+		if errors.Is(err, storage.ErrNotFound) {
+			return &api.DeleteUserIdentityResp{NotFound: true}, nil
+		}
+		d.logger.Error("api: failed to get user identity during purge", "err", err)
+		return nil, fmt.Errorf("delete user identity: %v", err)
+	}
+
+	// Cascade deletes. A real (non-not-found) failure aborts the purge and returns
+	// an error so the caller is never told a GDPR purge succeeded while data was
+	// left behind.
+
+	// Cascade: delete every session this identity signed in with, telling each
+	// session's relying parties on the way out.
+	if _, err := d.terminateSessions(ctx, func(s storage.AuthSession) bool {
+		return s.UserID == req.UserId && s.ConnectorID == req.ConnectorId
+	}); err != nil {
+		return nil, fmt.Errorf("purge auth sessions: %v", err)
+	}
+
+	// Cascade: revoke all refresh tokens (best-effort). A purge has to take every
+	// credential with it, so the unscoped revoke is the right one here.
+	d.revokeUserRefreshTokens(ctx, req.UserId, req.ConnectorId)
+
+	// Cascade: delete offline sessions.
+	if err := d.s.DeleteOfflineSessions(ctx, req.UserId, req.ConnectorId); err != nil && !errors.Is(err, storage.ErrNotFound) {
+		d.logger.Error("api: failed to delete offline sessions during identity purge", "err", err)
+		return nil, fmt.Errorf("purge offline sessions: %v", err)
+	}
+
+	// Cascade: delete the password record (keyed by email, may not exist for
+	// non-password connectors).
+	if email := identity.Claims.Email; email != "" {
+		if err := d.s.DeletePassword(ctx, email); err != nil && !errors.Is(err, storage.ErrNotFound) {
+			d.logger.Error("api: failed to delete password during identity purge", "err", err)
+			return nil, fmt.Errorf("purge password: %v", err)
+		}
+	}
+
+	// Delete the user identity itself.
+	if err := d.s.DeleteUserIdentity(ctx, req.UserId, req.ConnectorId); err != nil {
+		if errors.Is(err, storage.ErrNotFound) {
+			return &api.DeleteUserIdentityResp{NotFound: true}, nil
+		}
+		d.logger.Error("api: failed to delete user identity", "err", err)
+		return nil, fmt.Errorf("delete user identity: %v", err)
+	}
+
+	d.logger.Info("api: purged user identity", "user_id", req.UserId, "connector_id", req.ConnectorId)
+	return &api.DeleteUserIdentityResp{}, nil
+}
diff --git a/server/apiserver/mfa.go b/server/apiserver/mfa.go
new file mode 100644
index 0000000000..45dac50d83
--- /dev/null
+++ b/server/apiserver/mfa.go
@@ -0,0 +1,195 @@
+package apiserver
+
+import (
+	"bytes"
+	"context"
+	"errors"
+	"fmt"
+	"slices"
+
+	"github.com/dexidp/dex/api/v2"
+	"github.com/dexidp/dex/pkg/featureflags"
+	"github.com/dexidp/dex/storage"
+)
+
+// errIdentityUnchanged signals that an UpdateUserIdentity callback found nothing
+// to change, so the mutation (and its resource-version bump) is skipped.
+var errIdentityUnchanged = errors.New("identity unchanged")
+
+func storageMFADevicesToAPI(secrets map[string]*storage.MFASecret, credentials map[string][]storage.WebAuthnCredential) []*api.MFADeviceInfo {
+	// Collect all authenticator IDs from both maps.
+	authIDs := make(map[string]struct{})
+	for id := range secrets {
+		authIDs[id] = struct{}{}
+	}
+	for id := range credentials {
+		authIDs[id] = struct{}{}
+	}
+
+	devices := make([]*api.MFADeviceInfo, 0, len(authIDs))
+	for authID := range authIDs {
+		device := &api.MFADeviceInfo{
+			AuthenticatorId: authID,
+		}
+
+		if secret, ok := secrets[authID]; ok {
+			device.MfaSecret = &api.MFASecret{
+				AuthenticatorId: secret.AuthenticatorID,
+				Type:            secret.Type,
+				Confirmed:       secret.Confirmed,
+				CreatedAt:       unixOrZero(secret.CreatedAt),
+			}
+		}
+
+		if creds, ok := credentials[authID]; ok {
+			apiCreds := make([]*api.WebAuthnCredential, 0, len(creds))
+			for _, c := range creds {
+				apiCreds = append(apiCreds, &api.WebAuthnCredential{
+					CredentialId:    c.CredentialID,
+					AttestationType: c.AttestationType,
+					Aaguid:          c.AAGUID,
+					SignCount:       c.SignCount,
+					CloneWarning:    c.CloneWarning,
+					Transport:       c.Transport,
+					BackupEligible:  c.BackupEligible,
+					BackupState:     c.BackupState,
+					DisplayName:     c.DisplayName,
+					CreatedAt:       unixOrZero(c.CreatedAt),
+				})
+			}
+			device.WebauthnCredentials = apiCreds
+		}
+
+		devices = append(devices, device)
+	}
+	return devices
+}
+
+func (d dexAPI) ResetMFA(ctx context.Context, req *api.ResetMFAReq) (*api.ResetMFAResp, error) {
+	if !featureflags.APISessionsIdentitiesCRUD.Enabled() {
+		return nil, fmt.Errorf("%s feature flag is not enabled", featureflags.APISessionsIdentitiesCRUD.Name)
+	}
+
+	if req.UserId == "" {
+		return nil, errors.New("no user_id supplied")
+	}
+	if req.ConnectorId == "" {
+		return nil, errors.New("no connector_id supplied")
+	}
+
+	if err := d.s.UpdateUserIdentity(ctx, req.UserId, req.ConnectorId, func(old storage.UserIdentity) (storage.UserIdentity, error) {
+		old.MFASecrets = nil
+		old.WebAuthnCredentials = nil
+		return old, nil
+	}); err != nil {
+		if errors.Is(err, storage.ErrNotFound) {
+			return &api.ResetMFAResp{NotFound: true}, nil
+		}
+		d.logger.Error("api: failed to reset MFA", "err", err)
+		return nil, fmt.Errorf("reset MFA: %v", err)
+	}
+
+	d.logger.Info("api: reset MFA", "user_id", req.UserId, "connector_id", req.ConnectorId)
+	return &api.ResetMFAResp{}, nil
+}
+
+func (d dexAPI) ListMFADevices(ctx context.Context, req *api.ListMFADevicesReq) (*api.ListMFADevicesResp, error) {
+	if !featureflags.APISessionsIdentitiesCRUD.Enabled() {
+		return nil, fmt.Errorf("%s feature flag is not enabled", featureflags.APISessionsIdentitiesCRUD.Name)
+	}
+
+	if req.UserId == "" {
+		return nil, errors.New("no user_id supplied")
+	}
+	if req.ConnectorId == "" {
+		return nil, errors.New("no connector_id supplied")
+	}
+
+	identity, err := d.s.GetUserIdentity(ctx, req.UserId, req.ConnectorId)
+	if err != nil {
+		if errors.Is(err, storage.ErrNotFound) {
+			return nil, storage.ErrNotFound
+		}
+		d.logger.Error("api: failed to get user identity for MFA devices", "err", err)
+		return nil, fmt.Errorf("list MFA devices: %v", err)
+	}
+
+	return &api.ListMFADevicesResp{
+		Devices: storageMFADevicesToAPI(identity.MFASecrets, identity.WebAuthnCredentials),
+	}, nil
+}
+
+func (d dexAPI) DeleteWebAuthnCredential(ctx context.Context, req *api.DeleteWebAuthnCredentialReq) (*api.DeleteWebAuthnCredentialResp, error) {
+	if !featureflags.APISessionsIdentitiesCRUD.Enabled() {
+		return nil, fmt.Errorf("%s feature flag is not enabled", featureflags.APISessionsIdentitiesCRUD.Name)
+	}
+
+	if req.UserId == "" {
+		return nil, errors.New("no user_id supplied")
+	}
+	if req.ConnectorId == "" {
+		return nil, errors.New("no connector_id supplied")
+	}
+	if len(req.CredentialId) == 0 {
+		return nil, errors.New("no credential_id supplied")
+	}
+
+	if err := d.s.UpdateUserIdentity(ctx, req.UserId, req.ConnectorId, func(old storage.UserIdentity) (storage.UserIdentity, error) {
+		for authID, creds := range old.WebAuthnCredentials {
+			for i, cred := range creds {
+				if bytes.Equal(cred.CredentialID, req.CredentialId) {
+					old.WebAuthnCredentials[authID] = slices.Delete(creds, i, i+1)
+					if len(old.WebAuthnCredentials[authID]) == 0 {
+						delete(old.WebAuthnCredentials, authID)
+					}
+					return old, nil
+				}
+			}
+		}
+		return old, errIdentityUnchanged
+	}); err != nil {
+		if errors.Is(err, errIdentityUnchanged) || errors.Is(err, storage.ErrNotFound) {
+			return &api.DeleteWebAuthnCredentialResp{NotFound: true}, nil
+		}
+		d.logger.Error("api: failed to delete WebAuthn credential", "err", err)
+		return nil, fmt.Errorf("delete WebAuthn credential: %v", err)
+	}
+
+	d.logger.Info("api: deleted WebAuthn credential", "user_id", req.UserId, "connector_id", req.ConnectorId)
+	return &api.DeleteWebAuthnCredentialResp{}, nil
+}
+
+func (d dexAPI) DeleteMFASecret(ctx context.Context, req *api.DeleteMFASecretReq) (*api.DeleteMFASecretResp, error) {
+	if !featureflags.APISessionsIdentitiesCRUD.Enabled() {
+		return nil, fmt.Errorf("%s feature flag is not enabled", featureflags.APISessionsIdentitiesCRUD.Name)
+	}
+
+	if req.UserId == "" {
+		return nil, errors.New("no user_id supplied")
+	}
+	if req.ConnectorId == "" {
+		return nil, errors.New("no connector_id supplied")
+	}
+	if req.AuthenticatorId == "" {
+		return nil, errors.New("no authenticator_id supplied")
+	}
+
+	if err := d.s.UpdateUserIdentity(ctx, req.UserId, req.ConnectorId, func(old storage.UserIdentity) (storage.UserIdentity, error) {
+		if _, ok := old.MFASecrets[req.AuthenticatorId]; !ok {
+			return old, errIdentityUnchanged
+		}
+		delete(old.MFASecrets, req.AuthenticatorId)
+		// Also remove associated WebAuthn credentials for the same authenticator.
+		delete(old.WebAuthnCredentials, req.AuthenticatorId)
+		return old, nil
+	}); err != nil {
+		if errors.Is(err, errIdentityUnchanged) || errors.Is(err, storage.ErrNotFound) {
+			return &api.DeleteMFASecretResp{NotFound: true}, nil
+		}
+		d.logger.Error("api: failed to delete MFA secret", "err", err)
+		return nil, fmt.Errorf("delete MFA secret: %v", err)
+	}
+
+	d.logger.Info("api: deleted MFA secret", "user_id", req.UserId, "connector_id", req.ConnectorId)
+	return &api.DeleteMFASecretResp{}, nil
+}
diff --git a/server/apiserver/passwords.go b/server/apiserver/passwords.go
new file mode 100644
index 0000000000..db1c7946be
--- /dev/null
+++ b/server/apiserver/passwords.go
@@ -0,0 +1,151 @@
+package apiserver
+
+import (
+	"context"
+	"errors"
+	"fmt"
+
+	"golang.org/x/crypto/bcrypt"
+
+	"github.com/dexidp/dex/api/v2"
+	"github.com/dexidp/dex/server/passwords"
+	"github.com/dexidp/dex/storage"
+)
+
+func (d dexAPI) CreatePassword(ctx context.Context, req *api.CreatePasswordReq) (*api.CreatePasswordResp, error) {
+	if req.Password == nil {
+		return nil, errors.New("no password supplied")
+	}
+	if req.Password.UserId == "" {
+		return nil, errors.New("no user ID supplied")
+	}
+	if req.Password.Hash != nil {
+		if err := passwords.CheckCost(req.Password.Hash); err != nil {
+			return nil, err
+		}
+	} else {
+		return nil, errors.New("no hash of password supplied")
+	}
+
+	p := storage.Password{
+		Email:    req.Password.Email,
+		Hash:     req.Password.Hash,
+		Username: req.Password.Username,
+		UserID:   req.Password.UserId,
+	}
+	if err := d.s.CreatePassword(ctx, p); err != nil {
+		if err == storage.ErrAlreadyExists {
+			return &api.CreatePasswordResp{AlreadyExists: true}, nil
+		}
+		d.logger.Error("failed to create password", "err", err)
+		return nil, fmt.Errorf("create password: %v", err)
+	}
+
+	return &api.CreatePasswordResp{}, nil
+}
+
+func (d dexAPI) UpdatePassword(ctx context.Context, req *api.UpdatePasswordReq) (*api.UpdatePasswordResp, error) {
+	if req.Email == "" {
+		return nil, errors.New("no email supplied")
+	}
+	if req.NewHash == nil && req.NewUsername == "" {
+		return nil, errors.New("nothing to update")
+	}
+
+	if req.NewHash != nil {
+		if err := passwords.CheckCost(req.NewHash); err != nil {
+			return nil, err
+		}
+	}
+
+	updater := func(old storage.Password) (storage.Password, error) {
+		if req.NewHash != nil {
+			old.Hash = req.NewHash
+		}
+
+		if req.NewUsername != "" {
+			old.Username = req.NewUsername
+		}
+
+		return old, nil
+	}
+
+	if err := d.s.UpdatePassword(ctx, req.Email, updater); err != nil {
+		if err == storage.ErrNotFound {
+			return &api.UpdatePasswordResp{NotFound: true}, nil
+		}
+		d.logger.Error("failed to update password", "err", err)
+		return nil, fmt.Errorf("update password: %v", err)
+	}
+
+	return &api.UpdatePasswordResp{}, nil
+}
+
+func (d dexAPI) DeletePassword(ctx context.Context, req *api.DeletePasswordReq) (*api.DeletePasswordResp, error) {
+	if req.Email == "" {
+		return nil, errors.New("no email supplied")
+	}
+
+	err := d.s.DeletePassword(ctx, req.Email)
+	if err != nil {
+		if err == storage.ErrNotFound {
+			return &api.DeletePasswordResp{NotFound: true}, nil
+		}
+		d.logger.Error("failed to delete password", "err", err)
+		return nil, fmt.Errorf("delete password: %v", err)
+	}
+	return &api.DeletePasswordResp{}, nil
+}
+
+func (d dexAPI) ListPasswords(ctx context.Context, req *api.ListPasswordReq) (*api.ListPasswordResp, error) {
+	passwordList, err := d.s.ListPasswords(ctx)
+	if err != nil {
+		d.logger.Error("failed to list passwords", "err", err)
+		return nil, fmt.Errorf("list passwords: %v", err)
+	}
+
+	passwords := make([]*api.Password, 0, len(passwordList))
+	for _, password := range passwordList {
+		p := api.Password{
+			Email:    password.Email,
+			Username: password.Username,
+			UserId:   password.UserID,
+		}
+		passwords = append(passwords, &p)
+	}
+
+	return &api.ListPasswordResp{
+		Passwords: passwords,
+	}, nil
+}
+
+func (d dexAPI) VerifyPassword(ctx context.Context, req *api.VerifyPasswordReq) (*api.VerifyPasswordResp, error) {
+	if req.Email == "" {
+		return nil, errors.New("no email supplied")
+	}
+
+	if req.Password == "" {
+		return nil, errors.New("no password to verify supplied")
+	}
+
+	password, err := d.s.GetPassword(ctx, req.Email)
+	if err != nil {
+		if err == storage.ErrNotFound {
+			return &api.VerifyPasswordResp{
+				NotFound: true,
+			}, nil
+		}
+		d.logger.Error("there was an error retrieving the password", "err", err)
+		return nil, fmt.Errorf("verify password: %v", err)
+	}
+
+	if err := bcrypt.CompareHashAndPassword(password.Hash, []byte(req.Password)); err != nil {
+		d.logger.Info("password check failed", "err", err)
+		return &api.VerifyPasswordResp{
+			Verified: false,
+		}, nil
+	}
+	return &api.VerifyPasswordResp{
+		Verified: true,
+	}, nil
+}
diff --git a/server/apiserver/refresh.go b/server/apiserver/refresh.go
new file mode 100644
index 0000000000..d07edafa9a
--- /dev/null
+++ b/server/apiserver/refresh.go
@@ -0,0 +1,108 @@
+package apiserver
+
+import (
+	"context"
+
+	"github.com/dexidp/dex/api/v2"
+	"github.com/dexidp/dex/server/internal"
+	"github.com/dexidp/dex/storage"
+)
+
+func (d dexAPI) ListRefresh(ctx context.Context, req *api.ListRefreshReq) (*api.ListRefreshResp, error) {
+	id := new(internal.IDTokenSubject)
+	if err := internal.Unmarshal(req.UserId, id); err != nil {
+		d.logger.Error("failed to unmarshal ID Token subject", "err", err)
+		return nil, err
+	}
+
+	offlineSessions, err := d.s.GetOfflineSessions(ctx, id.UserId, id.ConnId)
+	if err != nil {
+		if err == storage.ErrNotFound {
+			// This means that this user-client pair does not have a refresh token yet.
+			// An empty list should be returned instead of an error.
+			return &api.ListRefreshResp{}, nil
+		}
+		d.logger.Error("failed to list refresh tokens here", "err", err)
+		return nil, err
+	}
+
+	refreshTokenRefs := make([]*api.RefreshTokenRef, 0, len(offlineSessions.Refresh))
+	for _, session := range offlineSessions.Refresh {
+		r := api.RefreshTokenRef{
+			Id:        session.ID,
+			ClientId:  session.ClientID,
+			CreatedAt: session.CreatedAt.Unix(),
+			LastUsed:  session.LastUsed.Unix(),
+		}
+		refreshTokenRefs = append(refreshTokenRefs, &r)
+	}
+
+	return &api.ListRefreshResp{
+		RefreshTokens: refreshTokenRefs,
+	}, nil
+}
+
+func (d dexAPI) RevokeRefresh(ctx context.Context, req *api.RevokeRefreshReq) (*api.RevokeRefreshResp, error) {
+	id := new(internal.IDTokenSubject)
+	if err := internal.Unmarshal(req.UserId, id); err != nil {
+		d.logger.Error("failed to unmarshal ID Token subject", "err", err)
+		return nil, err
+	}
+
+	var (
+		refreshID string
+		notFound  bool
+	)
+	updater := func(old storage.OfflineSessions) (storage.OfflineSessions, error) {
+		refreshRef := old.Refresh[req.ClientId]
+		if refreshRef == nil || refreshRef.ID == "" {
+			d.logger.Error("refresh token issued to client not found for deletion", "client_id", req.ClientId, "user_id", id.UserId)
+			notFound = true
+			return old, storage.ErrNotFound
+		}
+
+		refreshID = refreshRef.ID
+
+		// Remove entry from Refresh list of the OfflineSession object.
+		delete(old.Refresh, req.ClientId)
+
+		return old, nil
+	}
+
+	if err := d.s.UpdateOfflineSessions(ctx, id.UserId, id.ConnId, updater); err != nil {
+		if err == storage.ErrNotFound {
+			return &api.RevokeRefreshResp{NotFound: true}, nil
+		}
+		d.logger.Error("failed to update offline session object", "err", err)
+		return nil, err
+	}
+
+	if notFound {
+		return &api.RevokeRefreshResp{NotFound: true}, nil
+	}
+
+	// Delete the refresh token from the storage
+	//
+	// TODO(ericchiang): we don't have any good recourse if this call fails.
+	// Consider garbage collection of refresh tokens with no associated ref.
+	if err := d.s.DeleteRefresh(ctx, refreshID); err != nil {
+		d.logger.Error("failed to delete refresh token", "err", err)
+		return nil, err
+	}
+
+	return &api.RevokeRefreshResp{}, nil
+}
+
+// revokeUserRefreshTokens revokes all refresh tokens for a user/connector pair
+// and cleans up offline session references. Errors are logged but not returned
+// (best-effort).
+//
+// This is deliberately broader than what RP-initiated logout does. That flow revokes
+// only the client that asked for it, because it has a requesting client to scope to
+// and no mandate to touch anyone else's credentials (see revokeRequestingClient in
+// server/logout). An administrative call has neither: there is no client_id in the
+// request, and ending access is the entire point of the operation. Callers that want
+// one client's token gone use RevokeRefresh.
+func (d dexAPI) revokeUserRefreshTokens(ctx context.Context, userID, connectorID string) {
+	d.refresh.RevokeAll(ctx, userID, connectorID)
+}
diff --git a/server/apiserver/sessions.go b/server/apiserver/sessions.go
new file mode 100644
index 0000000000..acc96dfd3b
--- /dev/null
+++ b/server/apiserver/sessions.go
@@ -0,0 +1,230 @@
+package apiserver
+
+import (
+	"context"
+	"errors"
+	"fmt"
+
+	"github.com/dexidp/dex/api/v2"
+	"github.com/dexidp/dex/pkg/featureflags"
+	"github.com/dexidp/dex/storage"
+)
+
+func storageAuthSessionToAPI(s storage.AuthSession) *api.AuthSession {
+	clientStates := make([]*api.ClientAuthState, 0, len(s.ClientStates))
+	for clientID, state := range s.ClientStates {
+		if state == nil {
+			continue
+		}
+		clientStates = append(clientStates, &api.ClientAuthState{
+			ClientId:          clientID,
+			AuthenticatedAt:   unixOrZero(state.AuthenticatedAt),
+			LastActivity:      unixOrZero(state.LastActivity),
+			LastTokenIssuedAt: unixOrZero(state.LastTokenIssuedAt),
+			ViaSso:            state.ViaSSO,
+		})
+	}
+
+	return &api.AuthSession{
+		Id:             s.ID,
+		UserId:         s.UserID,
+		ConnectorId:    s.ConnectorID,
+		ClientStates:   clientStates,
+		CreatedAt:      unixOrZero(s.CreatedAt),
+		LastActivity:   unixOrZero(s.LastActivity),
+		IpAddress:      s.IPAddress,
+		UserAgent:      s.UserAgent,
+		AbsoluteExpiry: unixOrZero(s.AbsoluteExpiry),
+		IdleExpiry:     unixOrZero(s.IdleExpiry),
+	}
+}
+
+func (d dexAPI) GetAuthSession(ctx context.Context, req *api.GetAuthSessionReq) (*api.GetAuthSessionResp, error) {
+	if !featureflags.APISessionsIdentitiesCRUD.Enabled() {
+		return nil, fmt.Errorf("%s feature flag is not enabled", featureflags.APISessionsIdentitiesCRUD.Name)
+	}
+
+	if req.Id == "" {
+		return nil, errors.New("no id supplied")
+	}
+
+	session, err := d.s.GetAuthSession(ctx, req.Id)
+	if err != nil {
+		if errors.Is(err, storage.ErrNotFound) {
+			return nil, storage.ErrNotFound
+		}
+		d.logger.Error("api: failed to get auth session", "err", err)
+		return nil, fmt.Errorf("get auth session: %v", err)
+	}
+
+	return &api.GetAuthSessionResp{
+		Session: storageAuthSessionToAPI(session),
+	}, nil
+}
+
+func (d dexAPI) ListAuthSessions(ctx context.Context, req *api.ListAuthSessionsReq) (*api.ListAuthSessionsResp, error) {
+	if !featureflags.APISessionsIdentitiesCRUD.Enabled() {
+		return nil, fmt.Errorf("%s feature flag is not enabled", featureflags.APISessionsIdentitiesCRUD.Name)
+	}
+
+	sessionList, err := d.s.ListAuthSessions(ctx)
+	if err != nil {
+		d.logger.Error("api: failed to list auth sessions", "err", err)
+		return nil, fmt.Errorf("list auth sessions: %v", err)
+	}
+
+	sessions := make([]*api.AuthSession, 0, len(sessionList))
+	for _, s := range sessionList {
+		if req.UserId != "" && s.UserID != req.UserId {
+			continue
+		}
+		if req.ConnectorId != "" && s.ConnectorID != req.ConnectorId {
+			continue
+		}
+		sessions = append(sessions, storageAuthSessionToAPI(s))
+	}
+
+	return &api.ListAuthSessionsResp{
+		Sessions: sessions,
+	}, nil
+}
+
+func (d dexAPI) DeleteAuthSession(ctx context.Context, req *api.DeleteAuthSessionReq) (*api.DeleteAuthSessionResp, error) {
+	if !featureflags.APISessionsIdentitiesCRUD.Enabled() {
+		return nil, fmt.Errorf("%s feature flag is not enabled", featureflags.APISessionsIdentitiesCRUD.Name)
+	}
+
+	if req.Id == "" {
+		return nil, errors.New("no id supplied")
+	}
+
+	session, err := d.s.GetAuthSession(ctx, req.Id)
+	if err != nil {
+		if errors.Is(err, storage.ErrNotFound) {
+			return &api.DeleteAuthSessionResp{NotFound: true}, nil
+		}
+		d.logger.Error("api: failed to get auth session", "err", err)
+		return nil, fmt.Errorf("get auth session: %v", err)
+	}
+
+	if d.backchannel != nil {
+		d.backchannel.Notify(ctx, &session)
+	}
+
+	// Revoke every refresh token the user holds on this connector, not just one
+	// client's. See revokeUserRefreshTokens for why the administrative path is
+	// deliberately broader than RP-initiated logout.
+	d.revokeUserRefreshTokens(ctx, session.UserID, session.ConnectorID)
+
+	if err := d.s.DeleteAuthSession(ctx, req.Id); err != nil {
+		if errors.Is(err, storage.ErrNotFound) {
+			return &api.DeleteAuthSessionResp{NotFound: true}, nil
+		}
+		d.logger.Error("api: failed to delete auth session", "err", err)
+		return nil, fmt.Errorf("delete auth session: %v", err)
+	}
+
+	d.logger.Info("api: deleted auth session", "session_id", req.Id, "user_id", session.UserID)
+	return &api.DeleteAuthSessionResp{}, nil
+}
+
+func (d dexAPI) terminateSessions(ctx context.Context, match func(storage.AuthSession) bool) (int64, error) {
+	sessionList, err := d.s.ListAuthSessions(ctx)
+	if err != nil {
+		d.logger.Error("api: failed to list auth sessions", "err", err)
+		return 0, fmt.Errorf("list auth sessions: %v", err)
+	}
+
+	var terminated int64
+	for _, s := range sessionList {
+		if !match(s) {
+			continue
+		}
+
+		if d.backchannel != nil {
+			d.backchannel.Notify(ctx, &s)
+		}
+		d.revokeUserRefreshTokens(ctx, s.UserID, s.ConnectorID)
+
+		if err := d.s.DeleteAuthSession(ctx, s.ID); err != nil {
+			d.logger.Error("api: failed to delete auth session during batch terminate",
+				"session_id", s.ID, "user_id", s.UserID, "err", err)
+			continue
+		}
+		terminated++
+	}
+	return terminated, nil
+}
+
+func (d dexAPI) TerminateSessionsByConnector(ctx context.Context, req *api.TerminateSessionsByConnectorReq) (*api.TerminateSessionsByConnectorResp, error) {
+	if !featureflags.APISessionsIdentitiesCRUD.Enabled() {
+		return nil, fmt.Errorf("%s feature flag is not enabled", featureflags.APISessionsIdentitiesCRUD.Name)
+	}
+
+	if req.ConnectorId == "" {
+		return nil, errors.New("no connector_id supplied")
+	}
+
+	terminated, err := d.terminateSessions(ctx, func(s storage.AuthSession) bool {
+		return s.ConnectorID == req.ConnectorId
+	})
+	if err != nil {
+		return nil, err
+	}
+
+	d.logger.Info("api: terminated sessions by connector", "connector_id", req.ConnectorId, "count", terminated)
+	return &api.TerminateSessionsByConnectorResp{SessionsTerminated: terminated}, nil
+}
+
+func (d dexAPI) TerminateSessionsByUser(ctx context.Context, req *api.TerminateSessionsByUserReq) (*api.TerminateSessionsByUserResp, error) {
+	if !featureflags.APISessionsIdentitiesCRUD.Enabled() {
+		return nil, fmt.Errorf("%s feature flag is not enabled", featureflags.APISessionsIdentitiesCRUD.Name)
+	}
+
+	if req.UserId == "" {
+		return nil, errors.New("no user_id supplied")
+	}
+
+	terminated, err := d.terminateSessions(ctx, func(s storage.AuthSession) bool {
+		return s.UserID == req.UserId
+	})
+	if err != nil {
+		return nil, err
+	}
+
+	d.logger.Info("api: terminated sessions by user", "user_id", req.UserId, "count", terminated)
+	return &api.TerminateSessionsByUserResp{SessionsTerminated: terminated}, nil
+}
+
+func (d dexAPI) RevokeConsent(ctx context.Context, req *api.RevokeConsentReq) (*api.RevokeConsentResp, error) {
+	if !featureflags.APISessionsIdentitiesCRUD.Enabled() {
+		return nil, fmt.Errorf("%s feature flag is not enabled", featureflags.APISessionsIdentitiesCRUD.Name)
+	}
+
+	if req.UserId == "" {
+		return nil, errors.New("no user_id supplied")
+	}
+	if req.ConnectorId == "" {
+		return nil, errors.New("no connector_id supplied")
+	}
+	if req.ClientId == "" {
+		return nil, errors.New("no client_id supplied")
+	}
+
+	if err := d.s.UpdateUserIdentity(ctx, req.UserId, req.ConnectorId, func(old storage.UserIdentity) (storage.UserIdentity, error) {
+		if _, ok := old.Consents[req.ClientId]; !ok {
+			return old, errIdentityUnchanged
+		}
+		delete(old.Consents, req.ClientId)
+		return old, nil
+	}); err != nil {
+		if errors.Is(err, errIdentityUnchanged) || errors.Is(err, storage.ErrNotFound) {
+			return &api.RevokeConsentResp{NotFound: true}, nil
+		}
+		d.logger.Error("api: failed to revoke consent", "err", err)
+		return nil, fmt.Errorf("revoke consent: %v", err)
+	}
+
+	d.logger.Info("api: revoked consent", "user_id", req.UserId, "connector_id", req.ConnectorId, "client_id", req.ClientId)
+	return &api.RevokeConsentResp{}, nil
+}
diff --git a/server/apiserver/sessions_test.go b/server/apiserver/sessions_test.go
new file mode 100644
index 0000000000..62b3bc0192
--- /dev/null
+++ b/server/apiserver/sessions_test.go
@@ -0,0 +1,108 @@
+package apiserver
+
+import (
+	"context"
+	"net/http"
+	"net/http/httptest"
+	"net/url"
+	"strings"
+	"sync"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/require"
+
+	"github.com/dexidp/dex/api/v2"
+	"github.com/dexidp/dex/pkg/featureflags"
+	"github.com/dexidp/dex/server/backchannel"
+	"github.com/dexidp/dex/server/oauth2"
+	"github.com/dexidp/dex/server/signer"
+	"github.com/dexidp/dex/storage"
+	"github.com/dexidp/dex/storage/memory"
+)
+
+// TestTerminateSessionNotifiesRelyingParties: an operator ending a session leaves the
+// relying parties as the only thing keeping the user signed in, so they are told.
+func TestTerminateSessionNotifiesRelyingParties(t *testing.T) {
+	t.Setenv("DEX_"+strings.ToUpper(featureflags.APISessionsIdentitiesCRUD.Name), "true")
+
+	const userID, connectorID, clientID, sessionID = "u1", "mock", "web", "s1"
+
+	tests := []struct {
+		name string
+		call func(context.Context, api.DexServer) error
+	}{
+		{
+			name: "delete one session",
+			call: func(ctx context.Context, d api.DexServer) error {
+				_, err := d.DeleteAuthSession(ctx, &api.DeleteAuthSessionReq{Id: sessionID})
+				return err
+			},
+		},
+		{
+			name: "terminate every session of a user",
+			call: func(ctx context.Context, d api.DexServer) error {
+				_, err := d.TerminateSessionsByUser(ctx, &api.TerminateSessionsByUserReq{
+					UserId: userID,
+				})
+				return err
+			},
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			ctx := t.Context()
+			logger := newLogger(t)
+			s := memory.New(logger)
+
+			var mu sync.Mutex
+			var tokens []string
+			rp := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+				require.NoError(t, r.ParseForm())
+				mu.Lock()
+				tokens = append(tokens, r.PostForm.Get("logout_token"))
+				mu.Unlock()
+			}))
+			defer rp.Close()
+
+			require.NoError(t, s.CreateClient(ctx, storage.Client{
+				ID: clientID, Secret: "secret",
+				RedirectURIs:         []string{"https://example.com/cb"},
+				BackchannelLogoutURI: rp.URL,
+			}))
+			require.NoError(t, s.CreateAuthSession(ctx, storage.AuthSession{
+				ID: sessionID, Secret: "session-secret",
+				UserID: userID, ConnectorID: connectorID,
+				CreatedAt: time.Now(), LastActivity: time.Now(),
+				ClientStates: map[string]*storage.ClientAuthState{clientID: {AuthenticatedAt: time.Now()}},
+			}))
+
+			sign, err := (&signer.MockConfig{}).Open(ctx)
+			require.NoError(t, err)
+
+			d := NewAPI(s, logger, "test", nil, nil, &backchannel.Notifier{
+				Storage: s, Signer: sign, IssuerURL: issuerURL(t), Logger: logger,
+			})
+
+			require.NoError(t, tc.call(ctx, d))
+
+			// Delivery is fire-and-forget, so the call returns before the POST lands.
+			require.Eventually(t, func() bool {
+				mu.Lock()
+				defer mu.Unlock()
+				return len(tokens) == 1
+			}, 2*time.Second, 10*time.Millisecond)
+
+			_, err = s.GetAuthSession(ctx, sessionID)
+			require.ErrorIs(t, err, storage.ErrNotFound)
+		})
+	}
+}
+
+func issuerURL(t *testing.T) oauth2.IssuerURL {
+	t.Helper()
+	u, err := url.Parse("https://dex.example.com")
+	require.NoError(t, err)
+	return oauth2.IssuerURL{URL: *u}
+}
diff --git a/server/authflow/authorize.go b/server/authflow/authorize.go
new file mode 100644
index 0000000000..259e12516e
--- /dev/null
+++ b/server/authflow/authorize.go
@@ -0,0 +1,186 @@
+package authflow
+
+// authorize.go handles the /auth authorization endpoint: parsing the request,
+// selecting a connector, and the browser-facing (HTML/redirect) error surface.
+
+import (
+	"context"
+	"html/template"
+	"net/http"
+	"net/url"
+	"strings"
+
+	conns "github.com/dexidp/dex/server/connectors"
+	"github.com/dexidp/dex/server/oauth2"
+	"github.com/dexidp/dex/server/templates"
+	"github.com/dexidp/dex/storage"
+)
+
+// grantTypeFromAuthRequest determines the grant type from the authorization request parameters.
+func (h *Handler) grantTypeFromAuthRequest(r *http.Request) string {
+	redirectURI := r.Form.Get("redirect_uri")
+	if redirectURI == oauth2.DeviceCallbackURI || strings.HasSuffix(redirectURI, oauth2.DeviceCallbackURI) {
+		return oauth2.GrantTypeDeviceCode
+	}
+	responseType := r.Form.Get("response_type")
+	for _, rt := range strings.Fields(responseType) {
+		if rt == "token" || rt == "id_token" {
+			return oauth2.GrantTypeImplicit
+		}
+	}
+	return oauth2.GrantTypeAuthorizationCode
+}
+
+// handleAuthorization handles the OAuth2 auth endpoint. It is both the entry and
+// the exit of the flow: a fresh request starts login, while a request carrying an
+// auth-request id (req) is the consent step returning to issue the response —
+// issuance is the authorize endpoint's own job.
+func (h *Handler) handleAuthorization(w http.ResponseWriter, r *http.Request) {
+	ctx := r.Context()
+	// Extract the arguments
+	if err := r.ParseForm(); err != nil {
+		h.Logger.ErrorContext(r.Context(), "failed to parse arguments", "err", err)
+
+		h.renderError(r, w, http.StatusBadRequest, ErrMsgInvalidRequest)
+		return
+	}
+
+	// A request with an auth-request id is a step returning to the dispatcher.
+	if r.Form.Get("req") != "" {
+		h.handleContinue(w, r)
+		return
+	}
+
+	connectorID := r.Form.Get("connector_id")
+	allConnectors, err := h.Storage.ListConnectors(ctx)
+	if err != nil {
+		h.Logger.ErrorContext(r.Context(), "failed to get list of connectors", "err", err)
+		h.renderError(r, w, http.StatusInternalServerError, "Failed to retrieve connector list.")
+		return
+	}
+
+	// Determine the grant type from the authorization request to filter connectors.
+	grantType := h.grantTypeFromAuthRequest(r)
+	connectors := make([]storage.Connector, 0, len(allConnectors))
+	for _, c := range allConnectors {
+		if conns.GrantTypeAllowed(c.GrantTypes, grantType) {
+			connectors = append(connectors, c)
+		}
+	}
+
+	// Filter connectors based on the client's allowed connectors list.
+	// client_id is required per RFC 6749 §4.1.1.
+	client, authErr := h.getClientWithAuthError(ctx, r.Form.Get("client_id"))
+	if authErr != nil {
+		h.renderError(r, w, authErr.Status, authErr.Error())
+		return
+	}
+	connectors = conns.Filter(connectors, client.AllowedConnectors)
+
+	if len(connectors) == 0 {
+		h.renderError(r, w, http.StatusBadRequest, "No connectors available for this client.")
+		return
+	}
+
+	// We don't need connector_id any more
+	r.Form.Del("connector_id")
+
+	// Construct a URL with all of the arguments in its query
+	connURL := url.URL{
+		RawQuery: r.Form.Encode(),
+	}
+
+	// Redirect if a client chooses a specific connector_id
+	if connectorID != "" {
+		for _, c := range connectors {
+			if c.ID == connectorID {
+				connURL.Path = h.IssuerURL.AbsPath("/auth", url.PathEscape(c.ID))
+				http.Redirect(w, r, connURL.String(), http.StatusFound)
+				return
+			}
+		}
+		h.renderError(r, w, http.StatusBadRequest, "Connector ID does not match a valid Connector")
+		return
+	}
+
+	if len(connectors) == 1 && !h.AlwaysShowLogin {
+		connURL.Path = h.IssuerURL.AbsPath("/auth", url.PathEscape(connectors[0].ID))
+		http.Redirect(w, r, connURL.String(), http.StatusFound)
+		return
+	}
+
+	// Skip connector selection if a valid session exists, unless prompt=select_account or alwaysShowLogin.
+	if h.Sessions.Enabled() {
+		authReq, _, err := h.parseAuthorizationRequest(r)
+		if err != nil {
+			h.Logger.ErrorContext(r.Context(), "failed to parse authorization request", "err", err)
+
+			switch authErr := err.(type) {
+			case *redirectedAuthErr:
+				authErr.Handler().ServeHTTP(w, r)
+			case *displayedAuthErr:
+				h.renderError(r, w, authErr.Status, err.Error())
+			default:
+				panic("unsupported error type")
+			}
+			return
+		}
+		prompt, err := oauth2.ParsePrompt(authReq.Prompt)
+		if err != nil {
+			// Server error because authReq was validated before saving it to database.
+			h.redirectWithError(w, r, authReq, oauth2.ServerError, "Invalid authentication request")
+			return
+		}
+
+		// Invalid prompts will be validated and properly redirected later
+		if !h.AlwaysShowLogin && !prompt.SelectAccount() {
+			session := h.Sessions.ValidSession(ctx, w, r)
+			if session != nil {
+				for _, c := range connectors {
+					if c.ID != session.ConnectorID {
+						continue
+					}
+					connURL.Path = h.IssuerURL.AbsPath("/auth", url.PathEscape(session.ConnectorID))
+					http.Redirect(w, r, connURL.String(), http.StatusFound)
+					return
+				}
+			}
+		}
+		if prompt.None() {
+			// Cannot authenticate silently with prompt=none.
+			h.redirectWithError(w, r, authReq, oauth2.LoginRequired, "id_token_hint does not match authenticated user")
+			return
+		}
+	}
+
+	connectorInfos := make([]templates.ConnectorInfo, 0, len(connectors))
+	for _, conn := range connectors {
+		connURL.Path = h.IssuerURL.AbsPath("/auth", url.PathEscape(conn.ID))
+		connectorInfos = append(connectorInfos, templates.ConnectorInfo{
+			ID:   conn.ID,
+			Name: conn.Name,
+			Type: conn.Type,
+			URL:  template.URL(connURL.String()),
+		})
+	}
+
+	if err := h.Templates.Login(r, w, connectorInfos); err != nil {
+		h.Logger.ErrorContext(r.Context(), "server template error", "err", err)
+	}
+}
+
+// getClientWithAuthError retrieves a client by ID and returns a displayedAuthErr on failure.
+// Invalid client_id is not treated as a redirect error per RFC 6749 §4.1.2.1.
+// https://datatracker.ietf.org/doc/html/rfc6749#section-4.1.2.1
+func (h *Handler) getClientWithAuthError(ctx context.Context, clientID string) (storage.Client, *displayedAuthErr) {
+	client, err := h.Storage.GetClient(ctx, clientID)
+	if err != nil {
+		if err == storage.ErrNotFound {
+			h.Logger.ErrorContext(ctx, "invalid client_id provided", "client_id", clientID)
+			return storage.Client{}, newDisplayedErr(http.StatusBadRequest, "Invalid client_id provided.")
+		}
+		h.Logger.ErrorContext(ctx, "failed to get client", "client_id", clientID, "err", err)
+		return storage.Client{}, newDisplayedErr(http.StatusInternalServerError, "Database error.")
+	}
+	return client, nil
+}
diff --git a/server/authflow/callback.go b/server/authflow/callback.go
new file mode 100644
index 0000000000..bdc2ee6725
--- /dev/null
+++ b/server/authflow/callback.go
@@ -0,0 +1,114 @@
+package authflow
+
+// callback.go implements the connector callback mechanism: the return leg of
+// redirect-based connectors (OAuth2 callback and SAML POST binding).
+
+import (
+	"errors"
+	"net/http"
+	"net/url"
+
+	"github.com/gorilla/mux"
+
+	"github.com/dexidp/dex/connector"
+	"github.com/dexidp/dex/server/tokens"
+	"github.com/dexidp/dex/storage"
+)
+
+func (h *Handler) handleConnectorCallback(w http.ResponseWriter, r *http.Request) {
+	ctx := r.Context()
+	var authID string
+	switch r.Method {
+	case http.MethodGet: // OAuth2 callback
+		if authID = r.URL.Query().Get("state"); authID == "" {
+			h.renderError(r, w, http.StatusBadRequest, "User session error.")
+			return
+		}
+	case http.MethodPost: // SAML POST binding
+		if authID = r.PostFormValue("RelayState"); authID == "" {
+			h.renderError(r, w, http.StatusBadRequest, "User session error.")
+			return
+		}
+	default:
+		h.renderError(r, w, http.StatusBadRequest, "Method not supported")
+		return
+	}
+
+	authReq, err := h.Storage.GetAuthRequest(ctx, authID)
+	if err != nil {
+		if err == storage.ErrNotFound {
+			h.Logger.ErrorContext(r.Context(), "invalid 'state' parameter provided", "err", err)
+			h.renderError(r, w, http.StatusBadRequest, "Requested resource does not exist.")
+			return
+		}
+		h.Logger.ErrorContext(r.Context(), "failed to get auth request", "err", err)
+		h.renderError(r, w, http.StatusInternalServerError, "Database error.")
+		return
+	}
+
+	connID, err := url.PathUnescape(mux.Vars(r)["connector"])
+	if err != nil {
+		h.Logger.ErrorContext(r.Context(), "failed to parse connector", "err", err)
+		h.renderError(r, w, http.StatusBadRequest, "Requested resource does not exist.")
+		return
+	} else if connID != "" && connID != authReq.ConnectorID {
+		h.Logger.ErrorContext(r.Context(), "connector mismatch: callback triggered for different connector than authentication start", "authentication_start_connector_id", authReq.ConnectorID, "connector_id", connID)
+		h.renderError(r, w, http.StatusBadRequest, "Requested resource does not exist.")
+		return
+	}
+
+	conn, err := h.Connectors.Get(ctx, authReq.ConnectorID)
+	if err != nil {
+		h.Logger.ErrorContext(r.Context(), "failed to get connector", "connector_id", authReq.ConnectorID, "err", err)
+		h.renderError(r, w, http.StatusInternalServerError, "Requested resource does not exist.")
+		return
+	}
+
+	var identity connector.Identity
+	switch conn := conn.Connector.(type) {
+	case connector.CallbackConnector:
+		if r.Method != http.MethodGet {
+			h.Logger.ErrorContext(r.Context(), "SAML request mapped to OAuth2 connector")
+			h.renderError(r, w, http.StatusBadRequest, "Invalid request")
+			return
+		}
+		identity, err = conn.HandleCallback(tokens.ParseScopes(authReq.Scopes), authReq.ConnectorData, r)
+	case connector.SAMLConnector:
+		if r.Method != http.MethodPost {
+			h.Logger.ErrorContext(r.Context(), "OAuth2 request mapped to SAML connector")
+			h.renderError(r, w, http.StatusBadRequest, "Invalid request")
+			return
+		}
+		identity, err = conn.HandlePOST(tokens.ParseScopes(authReq.Scopes), r.PostFormValue("SAMLResponse"), authReq.ID)
+	default:
+		h.renderError(r, w, http.StatusInternalServerError, "Requested resource does not exist.")
+		return
+	}
+
+	if err != nil {
+		h.Logger.ErrorContext(r.Context(), "failed to authenticate", "err", err)
+		var groupsErr *connector.UserNotInRequiredGroupsError
+		if errors.As(err, &groupsErr) {
+			h.renderError(r, w, http.StatusForbidden, ErrMsgNotInRequiredGroups)
+		} else {
+			h.renderError(r, w, http.StatusInternalServerError, ErrMsgAuthenticationFailed)
+		}
+		return
+	}
+
+	authReq, err = h.finalizeLogin(ctx, identity, authReq, conn.Connector)
+	if err != nil {
+		h.Logger.ErrorContext(r.Context(), "failed to finalize login", "err", err)
+		h.renderError(r, w, http.StatusInternalServerError, "Login error.")
+		return
+	}
+
+	// Connector callbacks don't render the remember_me checkbox, so we use the server default.
+	// The password login handler reads r.FormValue("remember_me") from the submitted form instead.
+	rememberMe := h.Sessions.RememberMeDefault()
+	if err := h.Sessions.CreateOrUpdateAuthSession(ctx, r, w, authReq, rememberMe != nil && *rememberMe); err != nil {
+		h.Logger.ErrorContext(ctx, "failed to create/update auth session", "err", err)
+	}
+
+	http.Redirect(w, r, h.buildContinueURL(authReq), http.StatusSeeOther)
+}
diff --git a/server/authflow/dispatch.go b/server/authflow/dispatch.go
new file mode 100644
index 0000000000..02d81d86d6
--- /dev/null
+++ b/server/authflow/dispatch.go
@@ -0,0 +1,113 @@
+package authflow
+
+// dispatch.go is the /auth flow dispatcher. After login and after every step,
+// the browser re-enters /auth carrying an HMAC verifier; the dispatcher inspects
+// the auth request and decides the next step — an MFA factor, the consent screen,
+// or issuing the response. This mirrors hydra's authorize strategy, which routes
+// by which verifier (login/consent) is present. The steps only ever redirect
+// back here, never to one another.
+
+import (
+	"context"
+	"net/http"
+
+	"github.com/dexidp/dex/server/consent"
+	"github.com/dexidp/dex/server/internal"
+	"github.com/dexidp/dex/server/oauth2"
+	"github.com/dexidp/dex/storage"
+)
+
+func (h *Handler) handleContinue(w http.ResponseWriter, r *http.Request) {
+	ctx := r.Context()
+	mac := r.FormValue("hmac")
+	if mac == "" {
+		h.renderError(r, w, http.StatusUnauthorized, "Unauthorized request")
+		return
+	}
+	authReq, err := h.Storage.GetAuthRequest(ctx, r.FormValue("req"))
+	if err != nil {
+		if err == storage.ErrNotFound {
+			h.renderError(r, w, http.StatusBadRequest, "User session error.")
+			return
+		}
+		h.Logger.ErrorContext(ctx, "failed to get auth request", "err", err)
+		h.renderError(r, w, http.StatusInternalServerError, "Database error.")
+		return
+	}
+	if !authReq.LoggedIn {
+		h.Logger.ErrorContext(ctx, "flow dispatcher reached for auth request without an identity")
+		h.renderError(r, w, http.StatusInternalServerError, "Login process not yet finalized.")
+		return
+	}
+
+	// A step returns with the "continue" verifier (login, MFA) or the "approved"
+	// verifier (consent). The latter proves the user just approved, so consent is
+	// resolved for this request even under prompt=consent / ForceApprovalPrompt.
+	consentApproved := internal.VerifyStep(authReq, mac, internal.StepApproved)
+	if !consentApproved && !internal.VerifyStep(authReq, mac, internal.StepContinue) {
+		h.renderError(r, w, http.StatusUnauthorized, "Unauthorized request")
+		return
+	}
+
+	h.dispatch(w, r, authReq, consentApproved)
+}
+
+// dispatch runs the auth request's next step. It is the single place the
+// post-identity decision lives: MFA, then consent, then issuance. Each
+// user-facing step is forbidden under prompt=none, which allows only a silent
+// issue.
+func (h *Handler) dispatch(w http.ResponseWriter, r *http.Request, authReq storage.AuthRequest, consentApproved bool) {
+	ctx := r.Context()
+	prompt, _ := oauth2.ParsePrompt(authReq.Prompt)
+
+	// MFA: if the client requires it and it is not yet satisfied, hand off to the
+	// MFA entry, which resolves the effective chain and picks the factor. The
+	// dispatcher only decides that MFA applies — the requested chain is client
+	// state (client.MFAChain, else the server default), not a query into MFA.
+	if h.MFAEnabled && !authReq.MFAValidated {
+		required, err := h.mfaRequired(ctx, authReq.ClientID)
+		if err != nil {
+			h.Logger.ErrorContext(ctx, "failed to determine MFA requirement", "err", err)
+			h.renderError(r, w, http.StatusInternalServerError, ErrMsgInternalServerError)
+			return
+		}
+		if required {
+			if prompt.None() {
+				h.redirectWithError(w, r, &authReq, oauth2.InteractionRequired, "User interaction required")
+				return
+			}
+			http.Redirect(w, r, h.buildMFAURL(authReq), http.StatusSeeOther)
+			return
+		}
+	}
+
+	// Consent: the "approved" verifier resolves it for this request; otherwise ask
+	// whether it can be skipped from persisted state.
+	if !consentApproved && !consent.Satisfied(ctx, h.Storage, h.SkipApproval, &authReq) {
+		if prompt.None() {
+			h.redirectWithError(w, r, &authReq, oauth2.InteractionRequired, "User interaction required")
+			return
+		}
+		http.Redirect(w, r, h.buildApprovalURL(authReq), http.StatusSeeOther)
+		return
+	}
+
+	// Fully authorized — issue the response.
+	h.writeResponse(w, r, authReq)
+}
+
+// mfaRequired reports whether the client requests any MFA — its own chain, or the
+// server default when the client sets none. This is only the dispatcher's cheap
+// gate; the MFA entry does the precise, provider-aware resolution and, when
+// nothing applies, records MFA as satisfied so control does not return here.
+func (h *Handler) mfaRequired(ctx context.Context, clientID string) (bool, error) {
+	client, err := h.Storage.GetClient(ctx, clientID)
+	if err != nil {
+		return false, err
+	}
+	chain := client.MFAChain
+	if chain == nil {
+		chain = h.DefaultMFAChain
+	}
+	return len(chain) > 0, nil
+}
diff --git a/server/authflow/doc.go b/server/authflow/doc.go
new file mode 100644
index 0000000000..012d906d51
--- /dev/null
+++ b/server/authflow/doc.go
@@ -0,0 +1,20 @@
+// Package authflow implements dex's interactive, browser-facing authorization
+// flow: the /auth authorization endpoint, connector and password login, the
+// session (SSO) shortcut, and the connector callback.
+//
+// The flow is a state machine over a storage.AuthRequest. /auth is the
+// dispatcher (dispatch.go): it parses the request, starts login, and on each
+// return decides the next step from persisted state — hand off to MFA, to the
+// consent screen, or issue the response (response.go). Steps never route to one
+// another; each returns to /auth carrying an HMAC verifier that proves the
+// transition ("continue" after login or a factor, "approved" after consent).
+//
+//	/auth                parse the request; pick a connector, reuse a session, or dispatch the next step
+//	/auth/{c}, .../login connector or password login -> finalizeLogin -> /auth
+//	/callback            connector callback -> finalizeLogin -> /auth
+//
+// The MFA, consent and logout steps live in sibling packages (server/mfa,
+// server/consent, server/logout); they mount their own routes (/mfa, /approval,
+// /logout), and the dispatcher sends users there and back. Shared session state
+// lives in server/session (cookie, SSO, auth-session CRUD).
+package authflow
diff --git a/server/authflow/errors.go b/server/authflow/errors.go
new file mode 100644
index 0000000000..05291c513e
--- /dev/null
+++ b/server/authflow/errors.go
@@ -0,0 +1,30 @@
+package authflow
+
+// Safe error messages for user-facing responses.
+// These messages are intentionally generic to avoid leaking internal details.
+// All actual error details should be logged server-side.
+
+const (
+	// ErrMsgLoginError is a generic login error message shown to users.
+	// Used when authentication fails due to internal server errors.
+	ErrMsgLoginError = "Login error. Please contact your administrator or try again later."
+
+	// ErrMsgAuthenticationFailed is shown when callback/SAML authentication fails.
+	ErrMsgAuthenticationFailed = "Authentication failed. Please contact your administrator or try again later."
+
+	// ErrMsgInternalServerError is a generic internal server error message.
+	ErrMsgInternalServerError = "Internal server error. Please contact your administrator or try again later."
+
+	// ErrMsgDatabaseError is shown when database operations fail.
+	ErrMsgDatabaseError = "A database error occurred. Please try again later."
+
+	// ErrMsgInvalidRequest is shown when request parsing fails.
+	ErrMsgInvalidRequest = "Invalid request. Please try again."
+
+	// ErrMsgMethodNotAllowed is shown when an unsupported HTTP method is used.
+	ErrMsgMethodNotAllowed = "Method not allowed."
+
+	// ErrMsgNotInRequiredGroups is shown when a user authenticates successfully
+	// but is not a member of any of the groups required by the connector.
+	ErrMsgNotInRequiredGroups = "You are not a member of any of the required groups to authenticate."
+)
diff --git a/server/authflow/errors_test.go b/server/authflow/errors_test.go
new file mode 100644
index 0000000000..1688900bd3
--- /dev/null
+++ b/server/authflow/errors_test.go
@@ -0,0 +1,69 @@
+package authflow
+
+import (
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+// TestRenderErrorSafeMessages tests that renderError uses safe messages.
+func TestRenderErrorSafeMessages(t *testing.T) {
+	tests := []struct {
+		name           string
+		statusCode     int
+		message        string
+		expectedInBody []string
+		notInBody      []string
+	}{
+		{
+			name:           "Login error message",
+			statusCode:     http.StatusInternalServerError,
+			message:        ErrMsgLoginError,
+			expectedInBody: []string{"Login error", "administrator"},
+			notInBody:      []string{"stack", "panic", ".go:"},
+		},
+		{
+			name:           "Authentication failed message",
+			statusCode:     http.StatusInternalServerError,
+			message:        ErrMsgAuthenticationFailed,
+			expectedInBody: []string{"Authentication failed", "administrator"},
+			notInBody:      []string{"stack", "panic", ".go:"},
+		},
+		{
+			name:           "Database error message",
+			statusCode:     http.StatusInternalServerError,
+			message:        ErrMsgDatabaseError,
+			expectedInBody: []string{"database error"},
+			notInBody:      []string{"sql:", "connection", "timeout"},
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			_, s := newTestHandler(t, nil)
+
+			rr := httptest.NewRecorder()
+			req := httptest.NewRequest("GET", "/", nil)
+
+			s.renderError(req, rr, tc.statusCode, tc.message)
+
+			resp := rr.Result()
+			defer resp.Body.Close()
+
+			body, _ := io.ReadAll(resp.Body)
+			bodyStr := string(body)
+
+			require.Equal(t, tc.statusCode, resp.StatusCode)
+
+			for _, expected := range tc.expectedInBody {
+				require.Contains(t, bodyStr, expected, "Response should contain: %s", expected)
+			}
+			for _, notExpected := range tc.notInBody {
+				require.NotContains(t, bodyStr, notExpected, "Response should not contain: %s", notExpected)
+			}
+		})
+	}
+}
diff --git a/server/authflow/finalize.go b/server/authflow/finalize.go
new file mode 100644
index 0000000000..33c0bdbeba
--- /dev/null
+++ b/server/authflow/finalize.go
@@ -0,0 +1,152 @@
+package authflow
+
+// finalize.go implements the post-authentication step shared by every login
+// mechanism: it persists the identity onto the AuthRequest, records the offline
+// session and the user identity, then returns the finalized request.
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"time"
+
+	"github.com/dexidp/dex/connector"
+	"github.com/dexidp/dex/server/tokens"
+	"github.com/dexidp/dex/storage"
+)
+
+// finalizeLogin associates the user's identity with the current AuthRequest, then returns
+// the approval page's path.
+func (h *Handler) finalizeLogin(ctx context.Context, identity connector.Identity, authReq storage.AuthRequest, conn connector.Connector) (storage.AuthRequest, error) {
+	// Refuse to complete login for a locked account. BlockedUntil lives on the
+	// persisted UserIdentity, which only exists when the sessions feature is on;
+	// a first-time login (no stored identity yet) cannot be blocked.
+	if h.Sessions.Enabled() {
+		storedIdentity, err := h.Storage.GetUserIdentity(ctx, identity.UserID, authReq.ConnectorID)
+		switch {
+		case err == nil:
+			if !storedIdentity.BlockedUntil.IsZero() && h.Now().Before(storedIdentity.BlockedUntil) {
+				h.Logger.WarnContext(ctx, "login rejected for locked account",
+					"connector_id", authReq.ConnectorID, "user_id", identity.UserID, "blocked_until", storedIdentity.BlockedUntil)
+				return storage.AuthRequest{}, fmt.Errorf("account is locked until %s", storedIdentity.BlockedUntil.Format(time.RFC3339))
+			}
+		case !errors.Is(err, storage.ErrNotFound):
+			return storage.AuthRequest{}, fmt.Errorf("failed to look up user identity: %w", err)
+		}
+	}
+
+	claims := storage.Claims{
+		UserID:            identity.UserID,
+		Username:          identity.Username,
+		PreferredUsername: identity.PreferredUsername,
+		Email:             identity.Email,
+		EmailVerified:     identity.EmailVerified,
+		Groups:            identity.Groups,
+	}
+
+	updater := func(a storage.AuthRequest) (storage.AuthRequest, error) {
+		a.LoggedIn = true
+		a.Claims = claims
+		a.ConnectorData = identity.ConnectorData
+		a.AuthTime = h.Now()
+		return a, nil
+	}
+	if err := h.Storage.UpdateAuthRequest(ctx, authReq.ID, updater); err != nil {
+		return storage.AuthRequest{}, fmt.Errorf("failed to update auth request: %v", err)
+	}
+	// Keep the in-memory copy in sync with what was persisted so later reads
+	// (the next-step decision below) see the identity we just stored.
+	authReq, _ = updater(authReq)
+
+	email := claims.Email
+	if !claims.EmailVerified {
+		email += " (unverified)"
+	}
+
+	h.Logger.InfoContext(ctx, "login successful",
+		"connector_id", authReq.ConnectorID, "user_id", claims.UserID,
+		"username", claims.Username, "preferred_username", claims.PreferredUsername,
+		"email", email, "groups", claims.Groups)
+
+	offlineAccessRequested := false
+	for _, scope := range authReq.Scopes {
+		if scope == tokens.ScopeOfflineAccess {
+			offlineAccessRequested = true
+			break
+		}
+	}
+	_, canRefresh := conn.(connector.RefreshConnector)
+
+	if offlineAccessRequested && canRefresh {
+		// Try to retrieve an existing OfflineSession object for the corresponding user.
+		session, err := h.Storage.GetOfflineSessions(ctx, identity.UserID, authReq.ConnectorID)
+		switch {
+		case err != nil && err == storage.ErrNotFound:
+			offlineSessions := storage.OfflineSessions{
+				UserID:        identity.UserID,
+				ConnID:        authReq.ConnectorID,
+				Refresh:       make(map[string]*storage.RefreshTokenRef),
+				ConnectorData: identity.ConnectorData,
+			}
+
+			// Create a new OfflineSession object for the user and add a reference object for
+			// the newly received refreshtoken.
+			if err := h.Storage.CreateOfflineSessions(ctx, offlineSessions); err != nil {
+				h.Logger.ErrorContext(ctx, "failed to create offline session", "err", err)
+				return storage.AuthRequest{}, err
+			}
+		case err == nil:
+			// Update existing OfflineSession obj with new RefreshTokenRef.
+			if err := h.Storage.UpdateOfflineSessions(ctx, session.UserID, session.ConnID, func(old storage.OfflineSessions) (storage.OfflineSessions, error) {
+				if len(identity.ConnectorData) > 0 {
+					old.ConnectorData = identity.ConnectorData
+				}
+				return old, nil
+			}); err != nil {
+				h.Logger.ErrorContext(ctx, "failed to update offline session", "err", err)
+				return storage.AuthRequest{}, err
+			}
+		default:
+			h.Logger.ErrorContext(ctx, "failed to get offline session", "err", err)
+			return storage.AuthRequest{}, err
+		}
+	}
+
+	// Create or update UserIdentity to persist user claims across sessions.
+	if h.Sessions.Enabled() {
+		now := h.Now()
+
+		_, err := h.Storage.GetUserIdentity(ctx, identity.UserID, authReq.ConnectorID)
+		switch {
+		case err != nil && errors.Is(err, storage.ErrNotFound):
+			ui := storage.UserIdentity{
+				UserID:      identity.UserID,
+				ConnectorID: authReq.ConnectorID,
+				Claims:      claims,
+				Consents:    make(map[string][]string),
+				CreatedAt:   now,
+				LastLogin:   now,
+			}
+			if err := h.Storage.CreateUserIdentity(ctx, ui); err != nil {
+				h.Logger.ErrorContext(ctx, "failed to create user identity", "err", err)
+				return storage.AuthRequest{}, err
+			}
+		case err == nil:
+			if err := h.Storage.UpdateUserIdentity(ctx, identity.UserID, authReq.ConnectorID, func(old storage.UserIdentity) (storage.UserIdentity, error) {
+				old.Claims = claims
+				old.LastLogin = now
+				return old, nil
+			}); err != nil {
+				h.Logger.ErrorContext(ctx, "failed to update user identity", "err", err)
+				return storage.AuthRequest{}, err
+			}
+		default:
+			h.Logger.ErrorContext(ctx, "failed to get user identity", "err", err)
+			return storage.AuthRequest{}, err
+		}
+	}
+
+	// The identity is persisted; return the finalized request so the caller can
+	// create the session and advance the flow.
+	return h.Storage.GetAuthRequest(ctx, authReq.ID)
+}
diff --git a/server/authflow/finalize_test.go b/server/authflow/finalize_test.go
new file mode 100644
index 0000000000..8dea85837c
--- /dev/null
+++ b/server/authflow/finalize_test.go
@@ -0,0 +1,60 @@
+package authflow
+
+import (
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/require"
+
+	"github.com/dexidp/dex/connector"
+	"github.com/dexidp/dex/server/session"
+	"github.com/dexidp/dex/storage"
+)
+
+func TestFinalizeLoginBlockedAccount(t *testing.T) {
+	t.Setenv("DEX_SESSIONS_ENABLED", "true")
+
+	httpServer, server := newTestHandler(t, func(c *testFlowConfig) {
+		c.SessionConfig = &session.Config{AbsoluteLifetime: time.Hour, ValidIfNotUsedFor: time.Hour}
+	})
+	defer httpServer.Close()
+
+	ctx := t.Context()
+
+	ident := connector.Identity{UserID: "user-1", Email: "user@example.com"}
+	authReq := storage.AuthRequest{
+		ID:          "login-req",
+		ClientID:    "example-app",
+		Expiry:      time.Now().Add(time.Hour),
+		ConnectorID: "mock",
+	}
+	require.NoError(t, server.Storage.CreateAuthRequest(ctx, authReq))
+	require.NoError(t, server.Storage.CreateUserIdentity(ctx, storage.UserIdentity{
+		UserID:              "user-1",
+		ConnectorID:         "mock",
+		Claims:              storage.Claims{UserID: "user-1", Email: "user@example.com"},
+		Consents:            map[string][]string{},
+		MFASecrets:          map[string]*storage.MFASecret{},
+		WebAuthnCredentials: map[string][]storage.WebAuthnCredential{},
+		CreatedAt:           time.Now(),
+		LastLogin:           time.Now(),
+		BlockedUntil:        time.Now().Add(time.Hour),
+	}))
+
+	// Blocked: finalizeLogin must reject without marking the request logged in.
+	_, err := server.finalizeLogin(ctx, ident, authReq, nil)
+	require.Error(t, err)
+	require.Contains(t, err.Error(), "locked")
+
+	updated, err := server.Storage.GetAuthRequest(ctx, authReq.ID)
+	require.NoError(t, err)
+	require.False(t, updated.LoggedIn, "blocked account must not be logged in")
+
+	// Clear the block: login should now proceed.
+	require.NoError(t, server.Storage.UpdateUserIdentity(ctx, "user-1", "mock", func(u storage.UserIdentity) (storage.UserIdentity, error) {
+		u.BlockedUntil = time.Time{}
+		return u, nil
+	}))
+	_, err = server.finalizeLogin(ctx, ident, authReq, nil)
+	require.NoError(t, err)
+}
diff --git a/server/authflow/handler.go b/server/authflow/handler.go
new file mode 100644
index 0000000000..c24731d6a9
--- /dev/null
+++ b/server/authflow/handler.go
@@ -0,0 +1,78 @@
+package authflow
+
+import (
+	"log/slog"
+	"net/http"
+	"strings"
+	"time"
+
+	"github.com/dexidp/dex/server/connectors"
+	"github.com/dexidp/dex/server/oauth2"
+	"github.com/dexidp/dex/server/router"
+	"github.com/dexidp/dex/server/session"
+	"github.com/dexidp/dex/server/signer"
+	"github.com/dexidp/dex/server/templates"
+	"github.com/dexidp/dex/server/tokens"
+	"github.com/dexidp/dex/storage"
+)
+
+// Handler serves the interactive login flow (connector selection, connector and
+// password login, the callback) and the /auth dispatcher that decides each next
+// step and issues the response. The /auth endpoint is the flow dispatcher: it
+// starts login, then on each return decides the next step (MFA, consent) or
+// issues. It decides those from persisted state and config alone — it holds no
+// reference to the MFA or consent handlers; each step only redirects back to
+// /auth, never to another step.
+type Handler struct {
+	IssuerURL              oauth2.IssuerURL
+	Connectors             *connectors.Cache
+	Storage                storage.Storage
+	Templates              *templates.Templates
+	Signer                 signer.Signer
+	Now                    func() time.Time
+	Logger                 *slog.Logger
+	AlwaysShowLogin        bool
+	SupportedResponseTypes map[string]bool
+	PKCE                   PKCEConfig
+	AuthRequestsValidFor   time.Duration
+
+	// Sessions owns the session cookie, SSO lookup and auth-session CRUD.
+	Sessions *session.Manager
+	// Issuer mints tokens for the authorization response (see response.go).
+	Issuer *tokens.Issuer
+
+	// MFAEnabled reports whether any authenticator is configured; DefaultMFAChain
+	// is the chain applied to clients that set none. Together they let the
+	// dispatcher gate MFA without the MFA handler — see mfaRequired.
+	MFAEnabled      bool
+	DefaultMFAChain []string
+	// SkipApproval disables the consent screen server-wide (see consent.Satisfied).
+	SkipApproval bool
+}
+
+// Mount registers the login routes. The /auth endpoint is both the entry
+// (login) and the exit (issuance, see response.go). The mfa, consent and logout
+// steps are mounted separately by the server.
+func (h *Handler) Mount(m router.Mux) {
+	m.HandleFunc("/auth", h.handleAuthorization)
+	m.HandleFunc("/auth/{connector}", h.handleConnectorLogin)
+	m.HandleFunc("/auth/{connector}/login", h.handlePasswordLogin)
+	// The bare /callback serves OAuth/OIDC redirects, where X-Remote-* never
+	// belongs, so strip it: a client must not spoof the authproxy connector here.
+	// The /callback/{connector} route is authproxy's own and passes them through.
+	m.HandleFunc("/callback", func(w http.ResponseWriter, r *http.Request) {
+		stripRemoteHeaders(r)
+		h.handleConnectorCallback(w, r)
+	})
+	m.HandleFunc("/callback/{connector}", h.handleConnectorCallback)
+}
+
+// stripRemoteHeaders drops the X-Remote-* request headers the authproxy
+// connector trusts, so they cannot be forged on a route that does not set them.
+func stripRemoteHeaders(r *http.Request) {
+	for key := range r.Header {
+		if strings.HasPrefix(strings.ToLower(key), "x-remote-") {
+			r.Header.Del(key)
+		}
+	}
+}
diff --git a/server/authflow/handler_test.go b/server/authflow/handler_test.go
new file mode 100644
index 0000000000..ed7ccc2b90
--- /dev/null
+++ b/server/authflow/handler_test.go
@@ -0,0 +1,180 @@
+package authflow
+
+import (
+	"crypto/rand"
+	"crypto/rsa"
+	"log/slog"
+	"net/http"
+	"net/http/httptest"
+	"net/url"
+	"testing"
+	"time"
+
+	"github.com/gorilla/mux"
+	"github.com/stretchr/testify/require"
+
+	"github.com/dexidp/dex/connector"
+	"github.com/dexidp/dex/connector/mock"
+	"github.com/dexidp/dex/server/connectors"
+	"github.com/dexidp/dex/server/consent"
+	"github.com/dexidp/dex/server/logout"
+	"github.com/dexidp/dex/server/mfa"
+	"github.com/dexidp/dex/server/oauth2"
+	"github.com/dexidp/dex/server/session"
+	"github.com/dexidp/dex/server/signer"
+	"github.com/dexidp/dex/server/templates"
+	"github.com/dexidp/dex/server/tokens"
+	"github.com/dexidp/dex/storage"
+	"github.com/dexidp/dex/storage/memory"
+	dexweb "github.com/dexidp/dex/web"
+)
+
+func newLogger(t *testing.T) *slog.Logger {
+	return slog.New(slog.NewTextHandler(t.Output(), &slog.HandlerOptions{Level: slog.LevelDebug}))
+}
+
+// testResolveConnector is the connector resolver used by the flow's unit tests.
+// They set connectors in the cache directly; the mock callback connector covers
+// the few paths that open one.
+func testResolveConnector(conn storage.Connector) (connector.Connector, error) {
+	return mock.NewCallbackConnector(nil), nil
+}
+
+// testMux adapts a gorilla router to router.Mux so a Handler can mount its
+// routes (the handlers read path variables with mux.Vars).
+type testMux struct{ r *mux.Router }
+
+func (m testMux) Handle(p string, h http.Handler)         { m.r.Handle(p, h) }
+func (m testMux) HandleFunc(p string, h http.HandlerFunc) { m.r.HandleFunc(p, h) }
+func (m testMux) HandleCORS(p string, h http.HandlerFunc) { m.r.HandleFunc(p, h) }
+func (m testMux) HandlePrefix(p string, h http.Handler) {
+	m.r.PathPrefix(p).Handler(http.StripPrefix(p, h))
+}
+
+// testServer wraps a Handler with the router it is mounted on so tests can both
+// call flow methods directly (promoted from the embedded Handler) and drive it
+// over HTTP via ServeHTTP.
+type testServer struct {
+	*Handler
+	mux http.Handler
+}
+
+func (ts *testServer) ServeHTTP(w http.ResponseWriter, r *http.Request) {
+	ts.mux.ServeHTTP(w, r)
+}
+
+// testFlowConfig bundles the login Config with the raw inputs the server uses to
+// build the shared flow components, so a test can tweak either before assembly.
+type testFlowConfig struct {
+	Handler
+	SessionConfig   *session.Config
+	MFAProviders    map[string]mfa.Provider
+	DefaultMFAChain []string
+	SkipApproval    bool
+}
+
+// newTestHandler builds the login flow and its shared components wired to an
+// httptest server, assembling them exactly as the server package does.
+// updateConfig may tweak the config before the components are built.
+func newTestHandler(t *testing.T, updateConfig func(c *testFlowConfig)) (*httptest.Server, *testServer) {
+	t.Helper()
+	logger := newLogger(t)
+	ctx := t.Context()
+
+	sig, err := signer.NewMockSigner(testKey)
+	require.NoError(t, err)
+
+	store := memory.New(logger)
+
+	var handler http.Handler
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		handler.ServeHTTP(w, r)
+	}))
+	t.Cleanup(srv.Close)
+
+	issuerURL, err := url.Parse(srv.URL)
+	require.NoError(t, err)
+
+	//nolint:dogsled // only the templates are needed here
+	_, _, _, tmpls, err := templates.LoadWebConfig(templates.Config{
+		WebFS:     dexweb.FS(),
+		IssuerURL: srv.URL,
+	})
+	require.NoError(t, err)
+
+	now := func() time.Time { return time.Now() }
+	conns := connectors.NewCache(store, testResolveConnector)
+	issuer := tokens.NewIssuer(store, sig, *issuerURL, 24*time.Hour, now, logger)
+
+	tc := testFlowConfig{
+		Handler: Handler{
+			IssuerURL:              oauth2.IssuerURL{URL: *issuerURL},
+			Connectors:             conns,
+			Storage:                store,
+			Templates:              tmpls,
+			Signer:                 sig,
+			Now:                    now,
+			Logger:                 logger,
+			SupportedResponseTypes: map[string]bool{"code": true, "token": true, "id_token": true},
+			PKCE:                   PKCEConfig{CodeChallengeMethodsSupported: []string{"S256", "plain"}},
+			AuthRequestsValidFor:   24 * time.Hour,
+		},
+		SkipApproval: true,
+	}
+	if updateConfig != nil {
+		updateConfig(&tc)
+	}
+
+	// Assemble the flow the same way the server does: shared infrastructure plus
+	// independent step handlers that hand off by redirect.
+	sessions := &session.Manager{Storage: store, Config: tc.SessionConfig, Now: now, Logger: logger, IssuerURL: oauth2.IssuerURL{URL: *issuerURL}}
+	mfaManager := &mfa.Handler{IssuerURL: oauth2.IssuerURL{URL: *issuerURL}, Storage: store, Templates: tmpls, Logger: logger, MFAProviders: tc.MFAProviders, DefaultMFAChain: tc.DefaultMFAChain, Now: now, Connectors: conns}
+	consentManager := &consent.Handler{IssuerURL: oauth2.IssuerURL{URL: *issuerURL}, Storage: store, Templates: tmpls, Logger: logger, Sessions: sessions, SkipApproval: tc.SkipApproval}
+	logoutManager := &logout.Handler{Storage: store, Templates: tmpls, Logger: logger, Sessions: sessions, Connectors: conns, Issuer: issuer, Signer: sig, IssuerURL: oauth2.IssuerURL{URL: *issuerURL}}
+
+	tc.Sessions = sessions
+	tc.Issuer = issuer
+	tc.Handler.MFAEnabled = len(tc.MFAProviders) > 0
+	tc.Handler.DefaultMFAChain = tc.DefaultMFAChain
+	tc.Handler.SkipApproval = tc.SkipApproval
+
+	h := &tc.Handler
+
+	router := mux.NewRouter()
+	h.Mount(testMux{router})
+	mfaManager.Mount(testMux{router})
+	consentManager.Mount(testMux{router})
+	logoutManager.Mount(testMux{router})
+	handler = router
+
+	for _, id := range []string{"mock", "mock2"} {
+		require.NoError(t, store.CreateConnector(ctx, storage.Connector{
+			ID:              id,
+			Type:            "mockCallback",
+			Name:            "Mock",
+			ResourceVersion: "1",
+		}))
+	}
+
+	return srv, &testServer{Handler: h, mux: router}
+}
+
+// testKey is a throwaway RSA key for the mock signer; the flow's unit tests
+// don't verify signatures, so a freshly generated key is enough.
+var testKey = func() *rsa.PrivateKey {
+	key, err := rsa.GenerateKey(rand.Reader, 2048)
+	if err != nil {
+		panic(err)
+	}
+	return key
+}()
+
+// toResponseTypeSet converts a list of response types to the set form the
+// Handler expects.
+func toResponseTypeSet(types []string) map[string]bool {
+	m := make(map[string]bool, len(types))
+	for _, t := range types {
+		m[t] = true
+	}
+	return m
+}
diff --git a/server/authflow/login.go b/server/authflow/login.go
new file mode 100644
index 0000000000..e0584a7e5c
--- /dev/null
+++ b/server/authflow/login.go
@@ -0,0 +1,225 @@
+package authflow
+
+// login.go is the login entry point: it validates the chosen connector against
+// the client and OIDC prompt/session rules, then kicks off that connector's
+// mechanism (redirect for OAuth2/SAML, the password form for password
+// connectors).
+
+import (
+	"fmt"
+	"maps"
+	"net/http"
+	"net/url"
+
+	"github.com/gorilla/mux"
+
+	"github.com/dexidp/dex/connector"
+	"github.com/dexidp/dex/server/connectors"
+	"github.com/dexidp/dex/server/oauth2"
+	"github.com/dexidp/dex/server/tokens"
+	"github.com/dexidp/dex/storage"
+)
+
+func (h *Handler) handleConnectorLogin(w http.ResponseWriter, r *http.Request) {
+	ctx := r.Context()
+	authReq, hintSubject, err := h.parseAuthorizationRequest(r)
+	if err != nil {
+		h.Logger.ErrorContext(r.Context(), "failed to parse authorization request", "err", err)
+
+		switch authErr := err.(type) {
+		case *redirectedAuthErr:
+			authErr.Handler().ServeHTTP(w, r)
+		case *displayedAuthErr:
+			h.renderError(r, w, authErr.Status, err.Error())
+		default:
+			panic("unsupported error type")
+		}
+
+		return
+	}
+
+	connID, err := url.PathUnescape(mux.Vars(r)["connector"])
+	if err != nil {
+		h.Logger.ErrorContext(r.Context(), "failed to parse connector", "err", err)
+		h.renderError(r, w, http.StatusBadRequest, "Requested resource does not exist")
+		return
+	}
+
+	// Validate that the connector is allowed for this client.
+	client, authErr := h.getClientWithAuthError(ctx, authReq.ClientID)
+	if authErr != nil {
+		h.renderError(r, w, authErr.Status, authErr.Error())
+		return
+	}
+	if !connectors.ConnectorAllowed(client.AllowedConnectors, connID) {
+		h.Logger.ErrorContext(r.Context(), "connector not allowed for client",
+			"connector_id", connID, "client_id", authReq.ClientID)
+		h.renderError(r, w, http.StatusForbidden, "Connector not allowed for this client.")
+		return
+	}
+
+	conn, err := h.Connectors.Get(ctx, connID)
+	if err != nil {
+		h.Logger.ErrorContext(r.Context(), "Failed to get connector", "err", err)
+		h.renderError(r, w, http.StatusBadRequest, "Connector failed to initialize")
+		return
+	}
+
+	// Check if the connector allows the requested grant type.
+	grantType := h.grantTypeFromAuthRequest(r)
+	if !connectors.GrantTypeAllowed(conn.GrantTypes, grantType) {
+		h.Logger.ErrorContext(r.Context(), "connector does not allow requested grant type",
+			"connector_id", connID, "grant_type", grantType)
+		h.renderError(r, w, http.StatusBadRequest, "Requested connector does not support this grant type.")
+		return
+	}
+
+	// Set the connector being used for the login.
+	if authReq.ConnectorID != "" && authReq.ConnectorID != connID {
+		h.Logger.ErrorContext(r.Context(), "mismatched connector ID in auth request",
+			"auth_request_connector_id", authReq.ConnectorID, "connector_id", connID)
+		h.renderError(r, w, http.StatusBadRequest, "Bad connector ID")
+		return
+	}
+
+	authReq.ConnectorID = connID
+
+	// Actually create the auth request
+	authReq.Expiry = h.Now().Add(h.AuthRequestsValidFor)
+	if err := h.Storage.CreateAuthRequest(ctx, *authReq); err != nil {
+		h.Logger.ErrorContext(r.Context(), "failed to create authorization request", "err", err)
+		h.renderError(r, w, http.StatusInternalServerError, "Failed to connect to the database.")
+		return
+	}
+
+	// Handle OIDC prompt parameter and session-based login.
+	prompt, err := oauth2.ParsePrompt(authReq.Prompt)
+	if err != nil {
+		// Server error because authReq was validated before saving it to database.
+		h.redirectWithError(w, r, authReq, oauth2.ServerError, "Invalid authentication request")
+		return
+	}
+	// handle prompt only if sessions are enabled
+	if h.Sessions.Enabled() {
+		// Retrieve the session once for use in both hint and prompt logic.
+		session := h.Sessions.ValidAuthSession(ctx, w, r, authReq)
+
+		// id_token_hint logic (OIDC Core 1.0 3.1.2.1):
+		// When a hint is provided, verify that the session user matches.
+		if hintSubject != "" {
+			if !sessionMatchesHint(session, hintSubject) {
+				// Clear the session if the user is different from the hint.
+				session = nil
+			}
+			if session == nil && prompt.None() {
+				// Cannot authenticate silently with prompt=none.
+				h.redirectWithError(w, r, authReq, oauth2.LoginRequired, "id_token_hint does not match authenticated user")
+				return
+			}
+		}
+
+		// prompt=none: no UI allowed.
+		if prompt.None() {
+			// prompt=none: no UI allowed. advance reports interaction_required if the
+			// session login can't complete silently; a missing session is login_required.
+			if !h.trySessionLoginWithSession(ctx, r, w, authReq, session) {
+				h.redirectWithError(w, r, authReq, oauth2.LoginRequired, "User not authenticated")
+			}
+			return
+		}
+
+		if !prompt.Login() {
+			// Normal flow: try session-based login (skip if prompt=login forces re-auth).
+			if h.trySessionLoginWithSession(ctx, r, w, authReq, session) {
+				return
+			}
+		}
+	}
+
+	scopes := tokens.ParseScopes(authReq.Scopes)
+
+	// Work out where the "Select another login method" link should go.
+	// Include prompt=select_account so that handleAuthorization skips
+	// session-based connector reuse and shows the connector list.
+	backLink := ""
+	if h.Connectors.Len() > 1 {
+		backLinkParams := make(url.Values)
+		maps.Copy(backLinkParams, r.Form)
+		if h.Sessions.Enabled() {
+			backLinkParams.Set("prompt", "select_account")
+		}
+		backLinkURL := url.URL{
+			Path:     h.IssuerURL.AbsPath("/auth"),
+			RawQuery: backLinkParams.Encode(),
+		}
+		backLink = backLinkURL.String()
+	}
+
+	switch r.Method {
+	case http.MethodGet:
+		switch conn := conn.Connector.(type) {
+		case connector.CallbackConnector:
+			// Use the auth request ID as the "state" token.
+			//
+			// TODO(ericchiang): Is this appropriate or should we also be using a nonce?
+			callbackURL, connData, err := conn.LoginURL(scopes, h.IssuerURL.AbsURL("/callback"), authReq.ID)
+			if err != nil {
+				h.Logger.ErrorContext(r.Context(), "connector returned error when creating callback", "connector_id", connID, "err", err)
+				h.renderError(r, w, http.StatusInternalServerError, "Login error.")
+				return
+			}
+			if len(connData) > 0 {
+				updater := func(a storage.AuthRequest) (storage.AuthRequest, error) {
+					a.ConnectorData = connData
+					return a, nil
+				}
+				err := h.Storage.UpdateAuthRequest(ctx, authReq.ID, updater)
+				if err != nil {
+					h.Logger.ErrorContext(r.Context(), "Failed to set connector data on auth request", "connector_id", connID, "err", err)
+					h.renderError(r, w, http.StatusInternalServerError, "Database error.")
+					return
+				}
+			}
+			http.Redirect(w, r, callbackURL, http.StatusFound)
+		case connector.PasswordConnector:
+			loginURL := url.URL{
+				Path: h.IssuerURL.AbsPath("/auth", connID, "login"),
+			}
+			q := loginURL.Query()
+			q.Set("state", authReq.ID)
+			q.Set("back", backLink)
+			loginURL.RawQuery = q.Encode()
+
+			http.Redirect(w, r, loginURL.String(), http.StatusFound)
+		case connector.SAMLConnector:
+			action, value, err := conn.POSTData(scopes, authReq.ID)
+			if err != nil {
+				h.Logger.ErrorContext(r.Context(), "creating SAML data", "err", err)
+				h.renderError(r, w, http.StatusInternalServerError, "Connector Login Error")
+				return
+			}
+
+			// TODO(ericchiang): Don't inline this.
+			fmt.Fprintf(w, `<!DOCTYPE html>
+			  <html lang="en">
+			  <head>
+			    <meta http-equiv="content-type" content="text/html; charset=utf-8">
+			    <title>SAML login</title>
+			  </head>
+			  <body>
+			    <form method="post" action="%s" >
+				    <input type="hidden" name="SAMLRequest" value="%s" />
+				    <input type="hidden" name="RelayState" value="%s" />
+			    </form>
+				<script>
+				    document.forms[0].submit();
+				</script>
+			  </body>
+			  </html>`, action, value, authReq.ID)
+		default:
+			h.renderError(r, w, http.StatusBadRequest, "Requested resource does not exist.")
+		}
+	default:
+		h.renderError(r, w, http.StatusBadRequest, "Unsupported request method.")
+	}
+}
diff --git a/server/authflow/password.go b/server/authflow/password.go
new file mode 100644
index 0000000000..e38d54d8a9
--- /dev/null
+++ b/server/authflow/password.go
@@ -0,0 +1,163 @@
+package authflow
+
+// password.go implements the password-credential login mechanism: the login
+// form and the credential check for password connectors.
+
+import (
+	"net/http"
+	"net/url"
+
+	"github.com/gorilla/mux"
+
+	"github.com/dexidp/dex/connector"
+	"github.com/dexidp/dex/server/tokens"
+	"github.com/dexidp/dex/storage"
+)
+
+func (h *Handler) handlePasswordLogin(w http.ResponseWriter, r *http.Request) {
+	ctx := r.Context()
+	authID := r.URL.Query().Get("state")
+	if authID == "" {
+		h.renderError(r, w, http.StatusBadRequest, "User session error.")
+		return
+	}
+
+	backLink := sanitizeBackLink(r.URL.Query().Get("back"))
+
+	authReq, err := h.Storage.GetAuthRequest(ctx, authID)
+	if err != nil {
+		if err == storage.ErrNotFound {
+			h.Logger.ErrorContext(r.Context(), "invalid 'state' parameter provided", "err", err)
+			h.renderError(r, w, http.StatusBadRequest, "Requested resource does not exist.")
+			return
+		}
+		h.Logger.ErrorContext(r.Context(), "failed to get auth request", "err", err)
+		h.renderError(r, w, http.StatusInternalServerError, "Database error.")
+		return
+	}
+
+	connID, err := url.PathUnescape(mux.Vars(r)["connector"])
+	if err != nil {
+		h.Logger.ErrorContext(r.Context(), "failed to parse connector", "err", err)
+		h.renderError(r, w, http.StatusBadRequest, "Requested resource does not exist")
+		return
+	} else if connID != "" && connID != authReq.ConnectorID {
+		h.Logger.ErrorContext(r.Context(), "connector mismatch: password login triggered for different connector from authentication start", "start_connector_id", authReq.ConnectorID, "password_connector_id", connID)
+		h.renderError(r, w, http.StatusBadRequest, "Requested resource does not exist.")
+		return
+	}
+
+	conn, err := h.Connectors.Get(ctx, authReq.ConnectorID)
+	if err != nil {
+		h.Logger.ErrorContext(r.Context(), "failed to get connector", "connector_id", authReq.ConnectorID, "err", err)
+		h.renderError(r, w, http.StatusInternalServerError, "Connector failed to initialize.")
+		return
+	}
+
+	pwConn, ok := conn.Connector.(connector.PasswordConnector)
+	if !ok {
+		h.Logger.ErrorContext(r.Context(), "expected password connector in handlePasswordLogin()", "password_connector", pwConn)
+		h.renderError(r, w, http.StatusInternalServerError, "Requested resource does not exist.")
+		return
+	}
+
+	rememberMe := h.Sessions.RememberMeDefault()
+
+	switch r.Method {
+	case http.MethodGet:
+		// Before rendering the password form, allow connectors that support SPNEGO to try Kerberos auth.
+		if sp, ok := pwConn.(connector.SPNEGOAware); ok {
+			scopes := tokens.ParseScopes(authReq.Scopes)
+			if ident, handled, err := sp.TrySPNEGO(ctx, scopes, w, r); bool(handled) {
+				if err != nil {
+					// SPNEGO handled the request but reported an error (e.g., LDAP lookup failed
+					// after successful Kerberos auth). Log error details, show generic message to user.
+					h.Logger.ErrorContext(ctx, "SPNEGO authentication error", "err", err)
+					h.renderError(r, w, http.StatusUnauthorized, ErrMsgAuthenticationFailed)
+					return
+				}
+				if ident != nil {
+					authReq, err = h.finalizeLogin(ctx, *ident, authReq, conn.Connector)
+					if err != nil {
+						h.Logger.ErrorContext(ctx, "failed to finalize login", "err", err)
+						h.renderError(r, w, http.StatusInternalServerError, "Login error.")
+						return
+					}
+					http.Redirect(w, r, h.buildContinueURL(authReq), http.StatusSeeOther)
+					return
+				}
+				// handled with no identity typically means the SPNEGO middleware
+				// wrote its own 401 (bare challenge, continuation, or reject); do
+				// not render the password form on top of it.
+				return
+			}
+		}
+		if err := h.Templates.Password(r, w, r.URL.String(), "", usernamePrompt(pwConn), false, backLink, rememberMe); err != nil {
+			h.Logger.ErrorContext(r.Context(), "server template error", "err", err)
+		}
+	case http.MethodPost:
+		username := r.FormValue("login")
+		password := r.FormValue("password")
+		scopes := tokens.ParseScopes(authReq.Scopes)
+
+		identity, ok, err := pwConn.Login(r.Context(), scopes, username, password)
+		if err != nil {
+			h.Logger.ErrorContext(r.Context(), "failed to login user", "err", err)
+			h.renderError(r, w, http.StatusInternalServerError, ErrMsgLoginError)
+			return
+		}
+		if !ok {
+			if err := h.Templates.Password(r, w, r.URL.String(), username, usernamePrompt(pwConn), true, backLink, rememberMe); err != nil {
+				h.Logger.ErrorContext(r.Context(), "server template error", "err", err)
+			}
+			h.Logger.ErrorContext(r.Context(), "failed login attempt: Invalid credentials.", "user", username)
+			return
+		}
+		authReq, err = h.finalizeLogin(r.Context(), identity, authReq, conn.Connector)
+		if err != nil {
+			h.Logger.ErrorContext(r.Context(), "failed to finalize login", "err", err)
+			h.renderError(r, w, http.StatusInternalServerError, "Login error.")
+			return
+		}
+
+		rememberMe := r.FormValue("remember_me") == "on"
+		if err := h.Sessions.CreateOrUpdateAuthSession(ctx, r, w, authReq, rememberMe); err != nil {
+			h.Logger.ErrorContext(ctx, "failed to create/update auth session", "err", err)
+		}
+
+		http.Redirect(w, r, h.buildContinueURL(authReq), http.StatusSeeOther)
+	default:
+		h.renderError(r, w, http.StatusBadRequest, "Unsupported request method.")
+	}
+}
+
+// sanitizeBackLink permits only a same-origin absolute path as the "Select
+// another login method" target. The legitimate value is always a rooted path
+// built from the issuer path (see login.go), so anything that could redirect
+// off-origin — an absolute URL, a scheme-relative "//host" or "/\host" that
+// browsers treat as protocol-relative, or a value that fails to parse — is
+// dropped rather than rendered as a link (open-redirect prevention).
+func sanitizeBackLink(back string) string {
+	if back == "" {
+		return ""
+	}
+	u, err := url.Parse(back)
+	if err != nil || u.IsAbs() || u.Host != "" {
+		return ""
+	}
+	if back[0] != '/' {
+		return ""
+	}
+	if len(back) >= 2 && (back[1] == '/' || back[1] == '\\') {
+		return ""
+	}
+	return back
+}
+
+// Check for username prompt override from connector. Defaults to "Username".
+func usernamePrompt(conn connector.PasswordConnector) string {
+	if attr := conn.Prompt(); attr != "" {
+		return attr
+	}
+	return "Username"
+}
diff --git a/server/authflow/password_test.go b/server/authflow/password_test.go
new file mode 100644
index 0000000000..6be2192a06
--- /dev/null
+++ b/server/authflow/password_test.go
@@ -0,0 +1,23 @@
+package authflow
+
+import "testing"
+
+func TestSanitizeBackLink(t *testing.T) {
+	tests := map[string]string{
+		"":                            "",
+		"/auth?prompt=select_account": "/auth?prompt=select_account",
+		"/dex/auth?client_id=x":       "/dex/auth?client_id=x",
+		"https://evil.example":        "",
+		"http://evil.example/auth":    "",
+		"//evil.example":              "",
+		"/\\evil.example":             "",
+		"javascript:alert(1)":         "",
+		"relative/path":               "", // not rooted
+		"/auth#frag":                  "/auth#frag",
+	}
+	for in, want := range tests {
+		if got := sanitizeBackLink(in); got != want {
+			t.Errorf("sanitizeBackLink(%q) = %q, want %q", in, got, want)
+		}
+	}
+}
diff --git a/server/authflow/render.go b/server/authflow/render.go
new file mode 100644
index 0000000000..e8b31cf8c2
--- /dev/null
+++ b/server/authflow/render.go
@@ -0,0 +1,12 @@
+package authflow
+
+import (
+	"net/http"
+
+	"github.com/dexidp/dex/server/templates"
+)
+
+// renderError renders a user-facing HTML error page.
+func (h *Handler) renderError(r *http.Request, w http.ResponseWriter, status int, description string) {
+	templates.RenderError(h.Templates, h.Logger, r, w, status, description)
+}
diff --git a/server/authflow/request.go b/server/authflow/request.go
new file mode 100644
index 0000000000..4b47887e6f
--- /dev/null
+++ b/server/authflow/request.go
@@ -0,0 +1,384 @@
+package authflow
+
+import (
+	"context"
+	"crypto"
+	"fmt"
+	"net"
+	"net/http"
+	"net/url"
+	"slices"
+	"strconv"
+	"strings"
+
+	"github.com/coreos/go-oidc/v3/oidc"
+
+	conns "github.com/dexidp/dex/server/connectors"
+	"github.com/dexidp/dex/server/oauth2"
+	"github.com/dexidp/dex/server/signer"
+	"github.com/dexidp/dex/server/tokens"
+	"github.com/dexidp/dex/storage"
+)
+
+// request.go parses and validates the OAuth2 /auth authorization request into a
+// storage.AuthRequest, and defines the request-error surface (displayed vs
+// redirected).
+
+// displayedAuthErr is an error that should be displayed to the user as a web page.
+// See RFC 6749 §4.1.2.1: an invalid client_id or redirect_uri is shown, not
+// redirected.
+type displayedAuthErr struct {
+	Status      int
+	Description string
+}
+
+func (err *displayedAuthErr) Error() string { return err.Description }
+
+// newDisplayedErr builds a displayedAuthErr.
+func newDisplayedErr(status int, format string, a ...interface{}) *displayedAuthErr {
+	return &displayedAuthErr{status, fmt.Sprintf(format, a...)}
+}
+
+// redirectedAuthErr is an error reported back to the client by 302 redirect.
+type redirectedAuthErr struct {
+	State       string
+	RedirectURI string
+	Type        string
+	Description string
+}
+
+func (err *redirectedAuthErr) Error() string { return err.Description }
+
+// Handler returns an http.Handler that redirects to the client with the error.
+func (err *redirectedAuthErr) Handler() http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		v := url.Values{}
+		v.Add("state", err.State)
+		v.Add("error", err.Type)
+		if err.Description != "" {
+			v.Add("error_description", err.Description)
+		}
+
+		// Parse the redirect URI to ensure it's valid before redirecting.
+		u, parseErr := url.Parse(err.RedirectURI)
+		if parseErr != nil {
+			http.Error(w, "Invalid redirect URI", http.StatusBadRequest)
+			return
+		}
+
+		query := u.Query()
+		for key, values := range v {
+			for _, value := range values {
+				query.Add(key, value)
+			}
+		}
+		u.RawQuery = query.Encode()
+
+		http.Redirect(w, r, u.String(), http.StatusSeeOther)
+	})
+}
+
+// redirectWithError redirects back to the client with an OAuth2 error response.
+// Used for prompt=none when login or consent is required.
+func (h *Handler) redirectWithError(w http.ResponseWriter, r *http.Request, authReq *storage.AuthRequest, errType, description string) {
+	err := &redirectedAuthErr{State: authReq.State, RedirectURI: authReq.RedirectURI, Type: errType, Description: description}
+	err.Handler().ServeHTTP(w, r)
+}
+
+func validateRedirectURI(client storage.Client, redirectURI string) bool {
+	// Allow named RedirectURIs for both public and non-public clients.
+	// This is required to make PKCE-enabled web apps work when configured as public clients.
+	for _, uri := range client.RedirectURIs {
+		if redirectURI == uri {
+			return true
+		}
+	}
+	// For non-public clients or when RedirectURIs is set, we allow only explicitly named RedirectURIs.
+	if !client.Public || len(client.RedirectURIs) > 0 {
+		return false
+	}
+
+	if redirectURI == oauth2.RedirectURIOOB || redirectURI == oauth2.DeviceCallbackURI {
+		return true
+	}
+
+	// Verify the host is a loopback form ("http://localhost:(port)(path)" etc).
+	u, err := url.Parse(redirectURI)
+	if err != nil {
+		return false
+	}
+	if u.Scheme != "http" {
+		return false
+	}
+	return isHostLocal(u.Host)
+}
+
+func isHostLocal(host string) bool {
+	if host == "localhost" || net.ParseIP(host).IsLoopback() {
+		return true
+	}
+
+	host, _, err := net.SplitHostPort(host)
+	if err != nil {
+		return false
+	}
+
+	return host == "localhost" || net.ParseIP(host).IsLoopback()
+}
+
+func validateConnectorID(connectors []storage.Connector, connectorID string) bool {
+	for _, c := range connectors {
+		if c.ID == connectorID {
+			return true
+		}
+	}
+	return false
+}
+
+// sessionMatchesHint checks whether the session's user identity matches the
+// subject from an id_token_hint by encoding the session's (userID, connectorID)
+// via GenSubject and doing a string comparison.
+func sessionMatchesHint(session *storage.AuthSession, hintSubject string) bool {
+	if session == nil {
+		return false
+	}
+	encoded, err := tokens.GenSubject(session.UserID, session.ConnectorID)
+	if err != nil {
+		return false
+	}
+	return encoded == hintSubject
+}
+
+// PKCEConfig holds PKCE (Proof Key for Code Exchange) settings.
+type PKCEConfig struct {
+	// If true, PKCE is required for all authorization code flows.
+	Enforce bool
+	// Supported code challenge methods. Defaults to ["S256", "plain"].
+	CodeChallengeMethodsSupported []string
+}
+
+// ValidateIDTokenHint verifies the signature and issuer of an id_token_hint.
+// Expired tokens are accepted per OIDC Core 1.0 §3.1.2.1. It returns the verified
+// token so callers can extract Subject, Audience, etc.
+func (h *Handler) validateIDTokenHint(ctx context.Context, hint string) (*oidc.IDToken, error) {
+	verifier := oidc.NewVerifier(h.IssuerURL.String(), &signer.KeySet{Signer: h.Signer}, &oidc.Config{
+		SkipExpiryCheck: true,
+		// SkipClientIDCheck is set because the hint may originate from any client that
+		// Dex issued a token to — the caller does not know the expected audience in advance.
+		// The signature verification via signer.KeySet already guarantees the token was
+		// issued by this server. Dex does the client id check later during session validation.
+		SkipClientIDCheck: true,
+	})
+	return verifier.Verify(ctx, hint)
+}
+
+// Parse parses the initial request from the OAuth2 client. It returns the auth
+// request, the raw subject from id_token_hint (empty if not provided), and any
+// error (a *displayedAuthErr or *redirectedAuthErr).
+func (h *Handler) parseAuthorizationRequest(r *http.Request) (*storage.AuthRequest, string, error) {
+	ctx := r.Context()
+	if err := r.ParseForm(); err != nil {
+		return nil, "", newDisplayedErr(http.StatusBadRequest, "Failed to parse request.")
+	}
+	q := r.Form
+	// r.ParseForm already URL-decodes query values once; decoding redirect_uri a
+	// second time created a normalization differential with the token endpoint.
+	redirectURI := q.Get("redirect_uri")
+
+	clientID := q.Get("client_id")
+	state := q.Get("state")
+	nonce := q.Get("nonce")
+	connectorID := q.Get("connector_id")
+	// Some clients, like the old go-oidc, provide extra whitespace. Tolerate this.
+	scopes := strings.Fields(q.Get("scope"))
+	responseTypes := strings.Fields(q.Get("response_type"))
+
+	codeChallenge := q.Get("code_challenge")
+	codeChallengeMethod := q.Get("code_challenge_method")
+
+	if codeChallengeMethod == "" {
+		codeChallengeMethod = oauth2.PKCEMethodPlain
+	}
+
+	client, err := h.Storage.GetClient(ctx, clientID)
+	if err != nil {
+		if err == storage.ErrNotFound {
+			h.Logger.ErrorContext(ctx, "invalid client_id provided", "client_id", clientID)
+			return nil, "", newDisplayedErr(http.StatusNotFound, "Invalid client_id.")
+		}
+		h.Logger.ErrorContext(ctx, "failed to get client", "err", err)
+		return nil, "", newDisplayedErr(http.StatusInternalServerError, "Database error.")
+	}
+
+	if !validateRedirectURI(client, redirectURI) {
+		h.Logger.ErrorContext(ctx, "unregistered redirect_uri", "redirect_uri", redirectURI, "client_id", clientID)
+		return nil, "", newDisplayedErr(http.StatusBadRequest, "Unregistered redirect_uri.")
+	}
+	if redirectURI == oauth2.DeviceCallbackURI && client.Public {
+		redirectURI = h.IssuerURL.AbsPath(oauth2.DeviceCallbackURI)
+	}
+
+	// From here on out, we want to redirect back to the client with an error.
+	newredirectedAuthErr := func(typ, format string, a ...interface{}) *redirectedAuthErr {
+		return &redirectedAuthErr{state, redirectURI, typ, fmt.Sprintf(format, a...)}
+	}
+
+	if connectorID != "" {
+		connectors, err := h.Storage.ListConnectors(ctx)
+		if err != nil {
+			h.Logger.ErrorContext(ctx, "failed to list connectors", "err", err)
+			return nil, "", newredirectedAuthErr(oauth2.ServerError, "Unable to retrieve connectors")
+		}
+		if !validateConnectorID(connectors, connectorID) {
+			return nil, "", newredirectedAuthErr(oauth2.InvalidRequest, "Invalid ConnectorID")
+		}
+		if !conns.ConnectorAllowed(client.AllowedConnectors, connectorID) {
+			return nil, "", newredirectedAuthErr(oauth2.InvalidRequest, "Connector not allowed for this client")
+		}
+	}
+
+	// dex doesn't support the request parameter and must return request_not_supported.
+	// https://openid.net/specs/openid-connect-core-1_0.html#6.1
+	if q.Get("request") != "" {
+		return nil, "", newredirectedAuthErr(oauth2.RequestNotSupported, "Server does not support request parameter.")
+	}
+
+	if codeChallenge != "" && !slices.Contains(h.PKCE.CodeChallengeMethodsSupported, codeChallengeMethod) {
+		return nil, "", newredirectedAuthErr(oauth2.InvalidRequest, "Unsupported PKCE challenge method (%q).", codeChallengeMethod)
+	}
+
+	// Enforce PKCE if configured.
+	// https://datatracker.ietf.org/doc/html/draft-ietf-oauth-v2-1-12#section-4.1.1
+	if h.PKCE.Enforce && codeChallenge == "" {
+		return nil, "", newredirectedAuthErr(oauth2.InvalidRequest, "PKCE is required. The code_challenge parameter must be provided.")
+	}
+
+	var (
+		unrecognized  []string
+		invalidScopes []string
+	)
+	hasOpenIDScope := false
+	for _, scope := range scopes {
+		switch scope {
+		case tokens.ScopeOpenID:
+			hasOpenIDScope = true
+		case tokens.ScopeOfflineAccess, tokens.ScopeEmail, tokens.ScopeProfile, tokens.ScopeGroups, tokens.ScopeFederatedID:
+		default:
+			peerID, ok := tokens.ParseCrossClientScope(scope)
+			if !ok {
+				unrecognized = append(unrecognized, scope)
+				continue
+			}
+
+			isTrusted, err := tokens.CrossClientTrusted(ctx, h.Storage, clientID, peerID)
+			if err != nil {
+				return nil, "", newredirectedAuthErr(oauth2.ServerError, "Internal server error.")
+			}
+			if !isTrusted {
+				invalidScopes = append(invalidScopes, scope)
+			}
+		}
+	}
+	if !hasOpenIDScope {
+		return nil, "", newredirectedAuthErr(oauth2.InvalidScope, `Missing required scope(s) ["openid"].`)
+	}
+	if len(unrecognized) > 0 {
+		return nil, "", newredirectedAuthErr(oauth2.InvalidScope, "Unrecognized scope(s) %q", unrecognized)
+	}
+	if len(invalidScopes) > 0 {
+		return nil, "", newredirectedAuthErr(oauth2.InvalidScope, "Client can't request scope(s) %q", invalidScopes)
+	}
+
+	var rt struct {
+		code    bool
+		idToken bool
+		token   bool
+	}
+
+	for _, responseType := range responseTypes {
+		switch responseType {
+		case oauth2.ResponseTypeCode:
+			rt.code = true
+		case oauth2.ResponseTypeIDToken:
+			rt.idToken = true
+		case oauth2.ResponseTypeToken:
+			rt.token = true
+		default:
+			return nil, "", newredirectedAuthErr(oauth2.InvalidRequest, "Invalid response type %q", responseType)
+		}
+
+		if !h.SupportedResponseTypes[responseType] {
+			return nil, "", newredirectedAuthErr(oauth2.UnsupportedResponseType, "Unsupported response type %q", responseType)
+		}
+	}
+
+	if len(responseTypes) == 0 {
+		return nil, "", newredirectedAuthErr(oauth2.InvalidRequest, "No response_type provided")
+	}
+
+	if rt.token && !rt.code && !rt.idToken {
+		// "token" can't be provided on its own.
+		// https://openid.net/specs/openid-connect-core-1_0.html#Authentication
+		return nil, "", newredirectedAuthErr(oauth2.InvalidRequest, "Response type 'token' must be provided with type 'id_token' and/or 'code'")
+	}
+	if !rt.code {
+		// Either "id_token token" or "id_token" implies the implicit flow, which
+		// requires a nonce value.
+		// https://openid.net/specs/openid-connect-core-1_0.html#ImplicitAuthRequest
+		if nonce == "" {
+			return nil, "", newredirectedAuthErr(oauth2.InvalidRequest, "Response type 'token' requires a 'nonce' value.")
+		}
+	}
+	if rt.token {
+		if redirectURI == oauth2.RedirectURIOOB {
+			return nil, "", newredirectedAuthErr(oauth2.InvalidRequest, "Cannot use response type 'token' with redirect_uri '%s'.", oauth2.RedirectURIOOB)
+		}
+	}
+
+	prompt, err := oauth2.ParsePrompt(q.Get("prompt"))
+	if err != nil {
+		return nil, "", newredirectedAuthErr(oauth2.InvalidRequest, "Invalid prompt parameter: %v", err)
+	}
+
+	// Parse max_age: -1 means not specified.
+	maxAge := -1
+	if maxAgeStr := q.Get("max_age"); maxAgeStr != "" {
+		v, err := strconv.Atoi(maxAgeStr)
+		if err != nil || v < 0 {
+			return nil, "", newredirectedAuthErr(oauth2.InvalidRequest, "Invalid max_age value %q", maxAgeStr)
+		}
+		maxAge = v
+	}
+
+	// OIDC prompt=consent implies force approval.
+	forceApproval := q.Get("approval_prompt") == "force" || prompt.Consent()
+
+	// Validate id_token_hint if provided (OIDC Core 1.0 §3.1.2.1).
+	var idTokenHintSubject string
+	if hint := q.Get("id_token_hint"); hint != "" {
+		idToken, err := h.validateIDTokenHint(ctx, hint)
+		if err != nil {
+			return nil, "", newredirectedAuthErr(oauth2.InvalidRequest, "Invalid id_token_hint.")
+		}
+		idTokenHintSubject = idToken.Subject
+	}
+
+	return &storage.AuthRequest{
+		ID:                  storage.NewID(),
+		ClientID:            client.ID,
+		State:               state,
+		Nonce:               nonce,
+		ForceApprovalPrompt: forceApproval,
+		Prompt:              prompt.String(),
+		MaxAge:              maxAge,
+		Scopes:              scopes,
+		RedirectURI:         redirectURI,
+		ResponseTypes:       responseTypes,
+		ConnectorID:         connectorID,
+		PKCE: storage.PKCE{
+			CodeChallenge:       codeChallenge,
+			CodeChallengeMethod: codeChallengeMethod,
+		},
+		HMACKey: storage.NewHMACKey(crypto.SHA256),
+	}, idTokenHintSubject, nil
+}
diff --git a/server/oauth2_test.go b/server/authflow/request_test.go
similarity index 51%
rename from server/oauth2_test.go
rename to server/authflow/request_test.go
index 710382aa23..b874a9201e 100644
--- a/server/oauth2_test.go
+++ b/server/authflow/request_test.go
@@ -1,19 +1,25 @@
-package server
+package authflow
 
 import (
-	"context"
 	"crypto/rand"
 	"crypto/rsa"
+	"encoding/json"
+	"log/slog"
 	"net/http"
 	"net/http/httptest"
 	"net/url"
 	"strings"
 	"testing"
+	"time"
 
-	"gopkg.in/square/go-jose.v2"
+	"github.com/go-jose/go-jose/v4"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
 
+	"github.com/dexidp/dex/server/oauth2"
+	"github.com/dexidp/dex/server/signer"
+	"github.com/dexidp/dex/server/tokens"
 	"github.com/dexidp/dex/storage"
-	"github.com/dexidp/dex/storage/memory"
 )
 
 func TestParseAuthorizationRequest(t *testing.T) {
@@ -21,6 +27,7 @@ func TestParseAuthorizationRequest(t *testing.T) {
 		name                   string
 		clients                []storage.Client
 		supportedResponseTypes []string
+		pkce                   PKCEConfig
 
 		usePOST bool
 
@@ -126,7 +133,7 @@ func TestParseAuthorizationRequest(t *testing.T) {
 				"response_type": "code id_token",
 				"scope":         "openid email profile",
 			},
-			expectedError: &redirectedAuthErr{Type: errUnsupportedResponseType},
+			expectedError: &redirectedAuthErr{Type: oauth2.UnsupportedResponseType},
 		},
 		{
 			name: "only token response type",
@@ -143,7 +150,7 @@ func TestParseAuthorizationRequest(t *testing.T) {
 				"response_type": "token",
 				"scope":         "openid email profile",
 			},
-			expectedError: &redirectedAuthErr{Type: errInvalidRequest},
+			expectedError: &redirectedAuthErr{Type: oauth2.InvalidRequest},
 		},
 		{
 			name: "choose connector_id",
@@ -195,7 +202,7 @@ func TestParseAuthorizationRequest(t *testing.T) {
 				"response_type": "code id_token",
 				"scope":         "openid email profile",
 			},
-			expectedError: &redirectedAuthErr{Type: errInvalidRequest},
+			expectedError: &redirectedAuthErr{Type: oauth2.InvalidRequest},
 		},
 		{
 			name: "PKCE code_challenge_method plain",
@@ -267,7 +274,7 @@ func TestParseAuthorizationRequest(t *testing.T) {
 				"code_challenge_method": "invalid_method",
 				"scope":                 "openid email profile",
 			},
-			expectedError: &redirectedAuthErr{Type: errInvalidRequest},
+			expectedError: &redirectedAuthErr{Type: oauth2.InvalidRequest},
 		},
 		{
 			name: "No response type",
@@ -285,18 +292,104 @@ func TestParseAuthorizationRequest(t *testing.T) {
 				"code_challenge_method": "plain",
 				"scope":                 "openid email profile",
 			},
-			expectedError: &redirectedAuthErr{Type: errInvalidRequest},
+			expectedError: &redirectedAuthErr{Type: oauth2.InvalidRequest},
+		},
+		{
+			name: "PKCE enforced, no code_challenge provided",
+			clients: []storage.Client{
+				{
+					ID:           "bar",
+					RedirectURIs: []string{"https://example.com/bar"},
+				},
+			},
+			supportedResponseTypes: []string{"code"},
+			pkce: PKCEConfig{
+				Enforce:                       true,
+				CodeChallengeMethodsSupported: []string{"S256", "plain"},
+			},
+			queryParams: map[string]string{
+				"client_id":     "bar",
+				"redirect_uri":  "https://example.com/bar",
+				"response_type": "code",
+				"scope":         "openid email profile",
+			},
+			expectedError: &redirectedAuthErr{Type: oauth2.InvalidRequest},
+		},
+		{
+			name: "PKCE enforced, code_challenge provided",
+			clients: []storage.Client{
+				{
+					ID:           "bar",
+					RedirectURIs: []string{"https://example.com/bar"},
+				},
+			},
+			supportedResponseTypes: []string{"code"},
+			pkce: PKCEConfig{
+				Enforce:                       true,
+				CodeChallengeMethodsSupported: []string{"S256", "plain"},
+			},
+			queryParams: map[string]string{
+				"client_id":             "bar",
+				"redirect_uri":          "https://example.com/bar",
+				"response_type":         "code",
+				"code_challenge":        "123",
+				"code_challenge_method": "S256",
+				"scope":                 "openid email profile",
+			},
+		},
+		{
+			name: "PKCE only S256 allowed, plain rejected",
+			clients: []storage.Client{
+				{
+					ID:           "bar",
+					RedirectURIs: []string{"https://example.com/bar"},
+				},
+			},
+			supportedResponseTypes: []string{"code"},
+			pkce: PKCEConfig{
+				CodeChallengeMethodsSupported: []string{"S256"},
+			},
+			queryParams: map[string]string{
+				"client_id":             "bar",
+				"redirect_uri":          "https://example.com/bar",
+				"response_type":         "code",
+				"code_challenge":        "123",
+				"code_challenge_method": "plain",
+				"scope":                 "openid email profile",
+			},
+			expectedError: &redirectedAuthErr{Type: oauth2.InvalidRequest},
+		},
+		{
+			name: "PKCE only S256 allowed, S256 accepted",
+			clients: []storage.Client{
+				{
+					ID:           "bar",
+					RedirectURIs: []string{"https://example.com/bar"},
+				},
+			},
+			supportedResponseTypes: []string{"code"},
+			pkce: PKCEConfig{
+				CodeChallengeMethodsSupported: []string{"S256"},
+			},
+			queryParams: map[string]string{
+				"client_id":             "bar",
+				"redirect_uri":          "https://example.com/bar",
+				"response_type":         "code",
+				"code_challenge":        "123",
+				"code_challenge_method": "S256",
+				"scope":                 "openid email profile",
+			},
 		},
 	}
 
 	for _, tc := range tests {
-		func() {
-			ctx, cancel := context.WithCancel(context.Background())
-			defer cancel()
-
-			httpServer, server := newTestServerMultipleConnectors(ctx, t, func(c *Config) {
-				c.SupportedResponseTypes = tc.supportedResponseTypes
+		t.Run(tc.name, func(t *testing.T) {
+			httpServer, server := newTestHandler(t, func(c *testFlowConfig) {
+				c.SupportedResponseTypes = toResponseTypeSet(tc.supportedResponseTypes)
 				c.Storage = storage.WithStaticClients(c.Storage, tc.clients)
+				if len(tc.pkce.CodeChallengeMethodsSupported) > 0 || tc.pkce.Enforce {
+					c.PKCE = tc.pkce
+				}
 			})
 			defer httpServer.Close()
 
@@ -313,7 +406,7 @@ func TestParseAuthorizationRequest(t *testing.T) {
 				req = httptest.NewRequest("GET", httpServer.URL+"/auth?"+params.Encode(), nil)
 			}
 
-			_, err := server.parseAuthorizationRequest(req)
+			_, _, err := server.parseAuthorizationRequest(req)
 			if tc.expectedError == nil {
 				if err != nil {
 					t.Errorf("%s: expected no error", tc.name)
@@ -343,24 +436,7 @@ func TestParseAuthorizationRequest(t *testing.T) {
 					t.Fatalf("%s: unsupported error type", tc.name)
 				}
 			}
-		}()
-	}
-}
-
-const (
-	// at_hash value and access_token returned by Google.
-	googleAccessTokenHash = "piwt8oCH-K2D9pXlaS1Y-w"
-	googleAccessToken     = "ya29.CjHSA1l5WUn8xZ6HanHFzzdHdbXm-14rxnC7JHch9eFIsZkQEGoWzaYG4o7k5f6BnPLj"
-	googleSigningAlg      = jose.RS256
-)
-
-func TestAccessTokenHash(t *testing.T) {
-	atHash, err := accessTokenHash(googleSigningAlg, googleAccessToken)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if atHash != googleAccessTokenHash {
-		t.Errorf("expected %q got %q", googleAccessTokenHash, atHash)
+		})
 	}
 }
 
@@ -420,6 +496,27 @@ func TestValidRedirectURI(t *testing.T) {
 			redirectURI: "http://localhost",
 			wantValid:   true,
 		},
+		{
+			client: storage.Client{
+				Public: true,
+			},
+			redirectURI: "http://127.0.0.1:8080/",
+			wantValid:   true,
+		},
+		{
+			client: storage.Client{
+				Public: true,
+			},
+			redirectURI: "http://127.0.0.1:991/bar",
+			wantValid:   true,
+		},
+		{
+			client: storage.Client{
+				Public: true,
+			},
+			redirectURI: "http://127.0.0.1",
+			wantValid:   true,
+		},
 		// Both Public + RedirectURIs configured: Could e.g. be a PKCE-enabled web app.
 		{
 			client: storage.Client{
@@ -544,86 +641,294 @@ func TestValidRedirectURI(t *testing.T) {
 	}
 }
 
-func TestStorageKeySet(t *testing.T) {
-	s := memory.New(logger)
-	if err := s.UpdateKeys(func(keys storage.Keys) (storage.Keys, error) {
-		keys.SigningKey = &jose.JSONWebKey{
-			Key:       testKey,
-			KeyID:     "testkey",
-			Algorithm: "RS256",
-			Use:       "sig",
-		}
-		keys.SigningKeyPub = &jose.JSONWebKey{
-			Key:       testKey.Public(),
-			KeyID:     "testkey",
-			Algorithm: "RS256",
-			Use:       "sig",
-		}
-		return keys, nil
-	}); err != nil {
-		t.Fatal(err)
-	}
-
+func TestRedirectedAuthErrHandler(t *testing.T) {
 	tests := []struct {
-		name           string
-		tokenGenerator func() (jwt string, err error)
-		wantErr        bool
+		name        string
+		redirectURI string
+		state       string
+		errType     string
+		description string
+		wantStatus  int
+		wantErr     bool
 	}{
 		{
-			name: "valid token",
-			tokenGenerator: func() (string, error) {
-				signer, err := jose.NewSigner(jose.SigningKey{Algorithm: jose.RS256, Key: testKey}, nil)
-				if err != nil {
-					return "", err
-				}
+			name:        "valid redirect uri with error parameters",
+			redirectURI: "https://example.com/callback",
+			state:       "state123",
+			errType:     oauth2.InvalidRequest,
+			description: "Invalid request parameter",
+			wantStatus:  http.StatusSeeOther,
+			wantErr:     false,
+		},
+		{
+			name:        "valid redirect uri with query params",
+			redirectURI: "https://example.com/callback?existing=param&another=value",
+			state:       "state456",
+			errType:     oauth2.AccessDenied,
+			description: "User denied access",
+			wantStatus:  http.StatusSeeOther,
+			wantErr:     false,
+		},
+		{
+			name:        "valid redirect uri without description",
+			redirectURI: "https://example.com/callback",
+			state:       "state789",
+			errType:     oauth2.ServerError,
+			description: "",
+			wantStatus:  http.StatusSeeOther,
+			wantErr:     false,
+		},
+		{
+			name:        "invalid redirect uri",
+			redirectURI: "not a valid url ://",
+			state:       "state",
+			errType:     oauth2.InvalidRequest,
+			description: "Test error",
+			wantStatus:  http.StatusBadRequest,
+			wantErr:     true,
+		},
+	}
 
-				jws, err := signer.Sign([]byte("payload"))
-				if err != nil {
-					return "", err
+	for _, tc := range tests {
+		tc := tc
+		t.Run(tc.name, func(t *testing.T) {
+			err := &redirectedAuthErr{
+				State:       tc.state,
+				RedirectURI: tc.redirectURI,
+				Type:        tc.errType,
+				Description: tc.description,
+			}
+
+			handler := err.Handler()
+			w := httptest.NewRecorder()
+			r := httptest.NewRequest("GET", "/", nil)
+
+			handler.ServeHTTP(w, r)
+
+			if w.Code != tc.wantStatus {
+				t.Errorf("expected status %d, got %d", tc.wantStatus, w.Code)
+			}
+
+			if tc.wantStatus == http.StatusSeeOther {
+				// Verify the redirect location is a valid URL
+				location := w.Header().Get("Location")
+				if location == "" {
+					t.Fatalf("expected Location header, got empty string")
 				}
 
-				return jws.CompactSerialize()
-			},
-			wantErr: false,
-		},
-		{
-			name: "token signed by different key",
-			tokenGenerator: func() (string, error) {
-				key, err := rsa.GenerateKey(rand.Reader, 2048)
-				if err != nil {
-					return "", err
+				// Parse the redirect URL to verify it's valid
+				redirectURL, parseErr := url.Parse(location)
+				if parseErr != nil {
+					t.Fatalf("invalid redirect URL: %v", parseErr)
 				}
 
-				signer, err := jose.NewSigner(jose.SigningKey{Algorithm: jose.RS256, Key: key}, nil)
-				if err != nil {
-					return "", err
+				// Verify error parameters are present in the query string
+				query := redirectURL.Query()
+				if query.Get("state") != tc.state {
+					t.Errorf("expected state %q, got %q", tc.state, query.Get("state"))
+				}
+				if query.Get("error") != tc.errType {
+					t.Errorf("expected error type %q, got %q", tc.errType, query.Get("error"))
+				}
+				if tc.description != "" && query.Get("error_description") != tc.description {
+					t.Errorf("expected error_description %q, got %q", tc.description, query.Get("error_description"))
 				}
 
-				jws, err := signer.Sign([]byte("payload"))
-				if err != nil {
-					return "", err
+				// Verify that existing query parameters are preserved
+				if tc.name == "valid redirect uri with query params" {
+					if query.Get("existing") != "param" {
+						t.Errorf("expected existing parameter 'param', got %q", query.Get("existing"))
+					}
+					if query.Get("another") != "value" {
+						t.Errorf("expected another parameter 'value', got %q", query.Get("another"))
+					}
 				}
+			}
+		})
+	}
+}
 
-				return jws.CompactSerialize()
-			},
-			wantErr: true,
-		},
+// signTestIDToken creates a signed JWT with the given claims using the test key.
+func signTestIDToken(t *testing.T, claims interface{}) string {
+	t.Helper()
+	payload, err := json.Marshal(claims)
+	require.NoError(t, err)
+
+	joseSigner, err := jose.NewSigner(jose.SigningKey{Algorithm: jose.RS256, Key: testKey}, nil)
+	require.NoError(t, err)
+
+	jws, err := joseSigner.Sign(payload)
+	require.NoError(t, err)
+
+	token, err := jws.CompactSerialize()
+	require.NoError(t, err)
+	return token
+}
+
+func TestValidateIDTokenHint(t *testing.T) {
+	sig, err := signer.NewMockSigner(testKey)
+	require.NoError(t, err)
+
+	issuerURL, err := url.Parse("https://issuer.example.com")
+	require.NoError(t, err)
+
+	s := &Handler{
+		Signer:    sig,
+		IssuerURL: oauth2.IssuerURL{URL: *issuerURL},
+		Logger:    slog.Default(),
 	}
 
-	for _, tc := range tests {
-		tc := tc
-		t.Run(tc.name, func(t *testing.T) {
-			jwt, err := tc.tokenGenerator()
-			if err != nil {
-				t.Fatal(err)
-			}
+	now := time.Now()
 
-			keySet := &storageKeySet{s}
+	t.Run("valid hint (not expired)", func(t *testing.T) {
+		token := signTestIDToken(t, tokens.IDTokenClaims{
+			Issuer:  "https://issuer.example.com",
+			Subject: "CgNmb28SA2Jhcg",
+			Expiry:  now.Add(1 * time.Hour).Unix(),
+		})
+		idToken, err := s.validateIDTokenHint(t.Context(), token)
+		require.NoError(t, err)
+		assert.Equal(t, "CgNmb28SA2Jhcg", idToken.Subject)
+	})
 
-			_, err = keySet.VerifySignature(context.Background(), jwt)
-			if (err != nil && !tc.wantErr) || (err == nil && tc.wantErr) {
-				t.Fatalf("wantErr = %v, but got err = %v", tc.wantErr, err)
-			}
+	t.Run("valid hint (expired)", func(t *testing.T) {
+		token := signTestIDToken(t, tokens.IDTokenClaims{
+			Issuer:  "https://issuer.example.com",
+			Subject: "CgNmb28SA2Jhcg",
+			Expiry:  now.Add(-1 * time.Hour).Unix(),
 		})
-	}
+		idToken, err := s.validateIDTokenHint(t.Context(), token)
+		require.NoError(t, err)
+		assert.Equal(t, "CgNmb28SA2Jhcg", idToken.Subject)
+	})
+
+	t.Run("invalid signature", func(t *testing.T) {
+		otherKey, err := rsa.GenerateKey(rand.Reader, 2048)
+		require.NoError(t, err)
+
+		payload, err := json.Marshal(tokens.IDTokenClaims{
+			Issuer:  "https://issuer.example.com",
+			Subject: "CgNmb28SA2Jhcg",
+			Expiry:  now.Add(1 * time.Hour).Unix(),
+		})
+		require.NoError(t, err)
+
+		joseSigner, err := jose.NewSigner(jose.SigningKey{Algorithm: jose.RS256, Key: otherKey}, nil)
+		require.NoError(t, err)
+		jws, err := joseSigner.Sign(payload)
+		require.NoError(t, err)
+		token, err := jws.CompactSerialize()
+		require.NoError(t, err)
+
+		_, err = s.validateIDTokenHint(t.Context(), token)
+		assert.Error(t, err)
+	})
+
+	t.Run("wrong issuer", func(t *testing.T) {
+		token := signTestIDToken(t, tokens.IDTokenClaims{
+			Issuer:  "https://wrong-issuer.example.com",
+			Subject: "CgNmb28SA2Jhcg",
+			Expiry:  now.Add(1 * time.Hour).Unix(),
+		})
+		_, err := s.validateIDTokenHint(t.Context(), token)
+		assert.Error(t, err)
+	})
+
+	t.Run("malformed token", func(t *testing.T) {
+		_, err := s.validateIDTokenHint(t.Context(), "not-a-valid-jwt")
+		assert.Error(t, err)
+	})
+}
+
+func TestSessionMatchesHint(t *testing.T) {
+	// tokens.GenSubject("foo", "bar") == "CgNmb28SA2Jhcg" (from TestGetSubject)
+	assert.True(t, sessionMatchesHint(&storage.AuthSession{UserID: "foo", ConnectorID: "bar"}, "CgNmb28SA2Jhcg"))
+	assert.False(t, sessionMatchesHint(&storage.AuthSession{UserID: "other", ConnectorID: "bar"}, "CgNmb28SA2Jhcg"))
+	assert.False(t, sessionMatchesHint(&storage.AuthSession{UserID: "foo", ConnectorID: "other"}, "CgNmb28SA2Jhcg"))
+	assert.False(t, sessionMatchesHint(nil, "CgNmb28SA2Jhcg"))
+}
+
+func TestParseAuthorizationRequest_IDTokenHint(t *testing.T) {
+	sig, err := signer.NewMockSigner(testKey)
+	require.NoError(t, err)
+
+	now := time.Now()
+
+	t.Run("valid id_token_hint populates subject", func(t *testing.T) {
+		httpServer, server := newTestHandler(t, func(c *testFlowConfig) {
+			c.SupportedResponseTypes = map[string]bool{"code": true}
+			c.Storage = storage.WithStaticClients(c.Storage, []storage.Client{
+				{ID: "foo", RedirectURIs: []string{"https://example.com/foo"}},
+			})
+			c.Signer = sig
+		})
+		defer httpServer.Close()
+
+		token := signTestIDToken(t, tokens.IDTokenClaims{
+			Issuer:  httpServer.URL,
+			Subject: "CgNmb28SA2Jhcg",
+			Expiry:  now.Add(1 * time.Hour).Unix(),
+		})
+
+		params := url.Values{
+			"client_id":     {"foo"},
+			"redirect_uri":  {"https://example.com/foo"},
+			"response_type": {"code"},
+			"scope":         {"openid"},
+			"id_token_hint": {token},
+		}
+		req := httptest.NewRequest("GET", httpServer.URL+"/auth?"+params.Encode(), nil)
+
+		_, hintSubject, err := server.parseAuthorizationRequest(req)
+		require.NoError(t, err)
+		assert.Equal(t, "CgNmb28SA2Jhcg", hintSubject)
+	})
+
+	t.Run("invalid id_token_hint returns error", func(t *testing.T) {
+		httpServer, server := newTestHandler(t, func(c *testFlowConfig) {
+			c.SupportedResponseTypes = map[string]bool{"code": true}
+			c.Storage = storage.WithStaticClients(c.Storage, []storage.Client{
+				{ID: "foo", RedirectURIs: []string{"https://example.com/foo"}},
+			})
+			c.Signer = sig
+		})
+		defer httpServer.Close()
+
+		params := url.Values{
+			"client_id":     {"foo"},
+			"redirect_uri":  {"https://example.com/foo"},
+			"response_type": {"code"},
+			"scope":         {"openid"},
+			"id_token_hint": {"invalid-token"},
+		}
+		req := httptest.NewRequest("GET", httpServer.URL+"/auth?"+params.Encode(), nil)
+
+		_, _, err := server.parseAuthorizationRequest(req)
+		require.Error(t, err)
+		redirectErr, ok := err.(*redirectedAuthErr)
+		require.True(t, ok)
+		assert.Equal(t, oauth2.InvalidRequest, redirectErr.Type)
+	})
+
+	t.Run("no id_token_hint leaves subject empty", func(t *testing.T) {
+		httpServer, server := newTestHandler(t, func(c *testFlowConfig) {
+			c.SupportedResponseTypes = map[string]bool{"code": true}
+			c.Storage = storage.WithStaticClients(c.Storage, []storage.Client{
+				{ID: "foo", RedirectURIs: []string{"https://example.com/foo"}},
+			})
+		})
+		defer httpServer.Close()
+
+		params := url.Values{
+			"client_id":     {"foo"},
+			"redirect_uri":  {"https://example.com/foo"},
+			"response_type": {"code"},
+			"scope":         {"openid"},
+		}
+		req := httptest.NewRequest("GET", httpServer.URL+"/auth?"+params.Encode(), nil)
+
+		_, hintSubject, err := server.parseAuthorizationRequest(req)
+		require.NoError(t, err)
+		assert.Equal(t, "", hintSubject)
+	})
 }
diff --git a/server/authflow/response.go b/server/authflow/response.go
new file mode 100644
index 0000000000..3a63e25273
--- /dev/null
+++ b/server/authflow/response.go
@@ -0,0 +1,241 @@
+package authflow
+
+// response.go writes the authorization response once the dispatcher determines
+// the request is fully authorized: it mints the auth code and, for
+// implicit/hybrid flows, the access and ID tokens, then redirects the browser
+// back to the client (or renders the out-of-band page). This is the issuance
+// half of the authorize endpoint — fosite's WriteAuthorizeResponse.
+
+import (
+	"context"
+	"net/http"
+	"net/url"
+	"slices"
+	"strconv"
+	"time"
+
+	"github.com/dexidp/dex/server/oauth2"
+	"github.com/dexidp/dex/server/tokens"
+	"github.com/dexidp/dex/storage"
+)
+
+// writeResponse issues the authorization response for a completed auth request:
+// it mints the code (and, for implicit/hybrid flows, the tokens) and redirects
+// the browser back to the client, or renders the out-of-band page.
+func (h *Handler) writeResponse(w http.ResponseWriter, r *http.Request, authReq storage.AuthRequest) {
+	h.Sessions.UpdateTokenIssuedAt(r, authReq.ClientID)
+
+	ctx := r.Context()
+	if h.Now().After(authReq.Expiry) {
+		h.renderError(r, w, http.StatusBadRequest, "User session has expired.")
+		return
+	}
+
+	if err := h.Storage.DeleteAuthRequest(ctx, authReq.ID); err != nil {
+		if err != storage.ErrNotFound {
+			h.Logger.ErrorContext(r.Context(), "Failed to delete authorization request", "err", err)
+			h.renderError(r, w, http.StatusInternalServerError, "Internal server error.")
+		} else {
+			h.renderError(r, w, http.StatusBadRequest, "User session error.")
+		}
+		return
+	}
+	u, err := url.Parse(authReq.RedirectURI)
+	if err != nil {
+		h.renderError(r, w, http.StatusInternalServerError, "Invalid redirect URI.")
+		return
+	}
+
+	// Resolved once for the whole response. Every artifact below has to name the
+	// same session, and resolving it is a storage read that can clear a stale
+	// cookie — not something to repeat two or three times while writing one
+	// response.
+	resp := &authResponse{sessionID: h.sessionID(ctx, w, r)}
+	for _, handle := range []responseTypeHandler{
+		h.issueCode,
+		h.issueAccessToken,
+		h.issueIDToken,
+	} {
+		if !handle(ctx, w, r, authReq, resp) {
+			return // the handler already wrote the response (error or OOB)
+		}
+	}
+
+	if resp.implicitOrHybrid {
+		v := url.Values{}
+		if resp.accessToken != "" {
+			v.Set("access_token", resp.accessToken)
+			v.Set("token_type", "bearer")
+			// The hybrid flow with "code token" or "code id_token token" doesn't return an
+			// "expires_in" value. If "code" wasn't provided, indicating the implicit flow,
+			// don't add it.
+			//
+			// https://openid.net/specs/openid-connect-core-1_0.html#HybridAuthResponse
+			if resp.code.ID == "" {
+				v.Set("expires_in", strconv.Itoa(int(resp.idTokenExpiry.Sub(h.Now()).Seconds())))
+			}
+		}
+		v.Set("state", authReq.State)
+		if resp.idToken != "" {
+			v.Set("id_token", resp.idToken)
+		}
+		if resp.code.ID != "" {
+			v.Set("code", resp.code.ID)
+		}
+
+		// Implicit and hybrid flows return their values as part of the fragment.
+		//
+		//   HTTP/1.1 303 See Other
+		//   Location: https://client.example.org/cb#
+		//     access_token=SlAV32hkKG
+		//     &token_type=bearer
+		//     &id_token=eyJ0 ... NiJ9.eyJ1c ... I6IjIifX0.DeWt4Qu ... ZXso
+		//     &expires_in=3600
+		//     &state=af0ifjsldkj
+		//
+		u.Fragment = v.Encode()
+	} else {
+		// The code flow add values to the URL query.
+		//
+		//   HTTP/1.1 303 See Other
+		//   Location: https://client.example.org/cb?
+		//     code=SplxlOBeZQQYbYS6WxSbIA
+		//     &state=af0ifjsldkj
+		//
+		q := u.Query()
+		q.Set("code", resp.code.ID)
+		q.Set("state", authReq.State)
+		u.RawQuery = q.Encode()
+	}
+
+	http.Redirect(w, r, u.String(), http.StatusSeeOther)
+}
+
+// authResponse accumulates the artifacts each response-type handler produces
+// for the authorization response.
+type authResponse struct {
+	// Was the initial request using the implicit or hybrid flow instead of the
+	// "normal" code flow?
+	implicitOrHybrid bool
+
+	// Only present in hybrid or code flow. code.ID == "" if this is not set.
+	code storage.AuthCode
+
+	// Access token, present when response_type includes "token".
+	accessToken string
+
+	// ID token, present when response_type includes "id_token". Only valid for
+	// implicit and hybrid flows.
+	idToken       string
+	idTokenExpiry time.Time
+
+	// sessionID is the browser session everything in this response comes from.
+	sessionID string
+}
+
+// responseTypeHandler produces the response for a single OAuth2 response_type.
+// It self-selects on authReq.ResponseTypes, populates resp, and returns false
+// (after writing an error or OOB page itself) to abort the response.
+type responseTypeHandler func(ctx context.Context, w http.ResponseWriter, r *http.Request, authReq storage.AuthRequest, resp *authResponse) bool
+
+// sessionID names the browser session this response is issued from, or "" when there
+// is none. The browser is on the other end of this request, so its cookie is the
+// answer — a lookup by user would pick whichever session that user has open, which on
+// a second device is somebody else's.
+func (h *Handler) sessionID(ctx context.Context, w http.ResponseWriter, r *http.Request) string {
+	if s := h.Sessions.ValidSession(ctx, w, r); s != nil {
+		return s.ID
+	}
+	return ""
+}
+
+// issueCode handles the "code" response_type: it mints and stores an auth code.
+func (h *Handler) issueCode(ctx context.Context, w http.ResponseWriter, r *http.Request, authReq storage.AuthRequest, resp *authResponse) bool {
+	if !slices.Contains(authReq.ResponseTypes, oauth2.ResponseTypeCode) {
+		return true
+	}
+	resp.code = storage.AuthCode{
+		ID:            storage.NewID(),
+		SessionID:     resp.sessionID,
+		ClientID:      authReq.ClientID,
+		ConnectorID:   authReq.ConnectorID,
+		Nonce:         authReq.Nonce,
+		Scopes:        authReq.Scopes,
+		Claims:        authReq.Claims,
+		Expiry:        h.Now().Add(time.Minute * 30),
+		RedirectURI:   authReq.RedirectURI,
+		ConnectorData: authReq.ConnectorData,
+		PKCE:          authReq.PKCE,
+		AuthTime:      authReq.AuthTime,
+	}
+	if err := h.Storage.CreateAuthCode(ctx, resp.code); err != nil {
+		h.Logger.ErrorContext(r.Context(), "Failed to create auth code", "err", err)
+		h.renderError(r, w, http.StatusInternalServerError, "Internal server error.")
+		return false
+	}
+
+	// Implicit and hybrid flows that try to use the OOB redirect URI are
+	// rejected earlier. If we got here we're using the code flow.
+	if authReq.RedirectURI == oauth2.RedirectURIOOB {
+		if err := h.Templates.OOB(r, w, resp.code.ID); err != nil {
+			h.Logger.ErrorContext(r.Context(), "server template error", "err", err)
+		}
+		return false // OOB fully rendered the response
+	}
+	return true
+}
+
+// issueAccessToken handles the "token" response_type: it signs an access token.
+func (h *Handler) issueAccessToken(ctx context.Context, w http.ResponseWriter, r *http.Request, authReq storage.AuthRequest, resp *authResponse) bool {
+	if !slices.Contains(authReq.ResponseTypes, oauth2.ResponseTypeToken) {
+		return true
+	}
+	resp.implicitOrHybrid = true
+	accessToken, _, err := h.Issuer.SignAccessToken(ctx, tokens.Authorization{
+		Client:      storage.Client{ID: authReq.ClientID},
+		Claims:      authReq.Claims,
+		Scopes:      authReq.Scopes,
+		ConnectorID: authReq.ConnectorID,
+		Nonce:       authReq.Nonce,
+		AuthTime:    authReq.AuthTime,
+		SessionID:   resp.sessionID,
+	})
+	if err != nil {
+		h.Logger.ErrorContext(r.Context(), "failed to create new access token", "err", err)
+		h.writeError(w, oauth2.ServerError, "", http.StatusInternalServerError)
+		return false
+	}
+	resp.accessToken = accessToken
+	return true
+}
+
+// issueIDToken handles the "id_token" response_type. It runs after issueCode and
+// issueAccessToken because the id_token signature binds the code and access token.
+func (h *Handler) issueIDToken(ctx context.Context, w http.ResponseWriter, r *http.Request, authReq storage.AuthRequest, resp *authResponse) bool {
+	if !slices.Contains(authReq.ResponseTypes, oauth2.ResponseTypeIDToken) {
+		return true
+	}
+	resp.implicitOrHybrid = true
+	idToken, idTokenExpiry, err := h.Issuer.SignIDToken(ctx, tokens.Authorization{
+		Client:      storage.Client{ID: authReq.ClientID},
+		Claims:      authReq.Claims,
+		Scopes:      authReq.Scopes,
+		ConnectorID: authReq.ConnectorID,
+		Nonce:       authReq.Nonce,
+		AuthTime:    authReq.AuthTime,
+		SessionID:   resp.sessionID,
+	}, resp.accessToken, resp.code.ID)
+	if err != nil {
+		h.Logger.ErrorContext(r.Context(), "failed to create ID token", "err", err)
+		h.writeError(w, oauth2.ServerError, "", http.StatusInternalServerError)
+		return false
+	}
+	resp.idToken = idToken
+	resp.idTokenExpiry = idTokenExpiry
+	return true
+}
+
+// writeError writes an OAuth2 error response for the token-bearing flows.
+func (h *Handler) writeError(w http.ResponseWriter, typ string, description string, statusCode int) {
+	oauth2.WriteErrorResponse(h.Logger, w, typ, description, statusCode)
+}
diff --git a/server/authflow/sessionlogin.go b/server/authflow/sessionlogin.go
new file mode 100644
index 0000000000..bd0200a7cf
--- /dev/null
+++ b/server/authflow/sessionlogin.go
@@ -0,0 +1,123 @@
+package authflow
+
+import (
+	"context"
+	"net/http"
+	"time"
+
+	"github.com/dexidp/dex/storage"
+)
+
+func (h *Handler) trySessionLogin(ctx context.Context, r *http.Request, w http.ResponseWriter, authReq *storage.AuthRequest) bool {
+	session := h.Sessions.ValidAuthSession(ctx, w, r, authReq)
+	return h.trySessionLoginWithSession(ctx, r, w, authReq, session)
+}
+
+// trySessionLoginWithSession completes the login from an existing session: a
+// direct session for the client, or, failing that, an SSO session shared by
+// another client. SSO sharing is unidirectional — a source sharing with a target
+// does not mean the target shares back. Returns false when no session applies.
+func (h *Handler) trySessionLoginWithSession(ctx context.Context, r *http.Request, w http.ResponseWriter, authReq *storage.AuthRequest, session *storage.AuthSession) bool {
+	if session == nil {
+		return false
+	}
+
+	now := h.Now()
+
+	_, directLogin := session.ClientStates[authReq.ClientID]
+	if !directLogin {
+		// No direct session for this client — try SSO from a sharing client.
+		sourceState := h.Sessions.FindSSO(ctx, session, authReq.ClientID)
+		if sourceState == nil {
+			return false
+		}
+
+		// Create a new client state for the target client via SSO. It carries the
+		// source's authentication time: the user did not authenticate again here.
+		if err := h.Storage.UpdateAuthSession(ctx, session.ID, func(old storage.AuthSession) (storage.AuthSession, error) {
+			if old.ClientStates == nil {
+				old.ClientStates = make(map[string]*storage.ClientAuthState)
+			}
+			old.ClientStates[authReq.ClientID] = &storage.ClientAuthState{
+				AuthenticatedAt: sourceState.AuthenticatedAt,
+				LastActivity:    now,
+				ViaSSO:          true,
+			}
+			old.LastActivity = now
+			old.IdleExpiry = h.Sessions.IdleExpiry(now)
+			return old, nil
+		}); err != nil {
+			h.Logger.ErrorContext(ctx, "session: failed to create SSO client state", "err", err)
+			return false
+		}
+
+		h.Logger.DebugContext(ctx, "session: SSO login from sharing client",
+			"user_id", session.UserID, "connector_id", session.ConnectorID, "client_id", authReq.ClientID)
+	}
+
+	// Load identity from storage (same path for direct and SSO login).
+	ui, err := h.Storage.GetUserIdentity(ctx, session.UserID, session.ConnectorID)
+	if err != nil {
+		h.Logger.ErrorContext(ctx, "session: failed to get user identity", "err", err)
+		return false
+	}
+
+	// Check max_age: if the user's last authentication is too old, force re-auth.
+	if authReq.MaxAge >= 0 {
+		if now.Sub(ui.LastLogin) > time.Duration(authReq.MaxAge)*time.Second {
+			return false
+		}
+	}
+
+	if directLogin {
+		h.Logger.DebugContext(ctx, "session: re-authenticated from session",
+			"session_id", session.ID, "user_id", session.UserID)
+	}
+
+	return h.finishSessionLogin(ctx, r, w, authReq, session, &ui, now)
+}
+
+// finishSessionLogin completes a session-based login (direct or SSO) by updating the auth request
+// with the user's identity, refreshing session activity, and returning the appropriate redirect URL.
+func (h *Handler) finishSessionLogin(ctx context.Context, r *http.Request, w http.ResponseWriter, authReq *storage.AuthRequest, session *storage.AuthSession, ui *storage.UserIdentity, now time.Time) bool {
+	claims := storage.Claims{
+		UserID:            ui.Claims.UserID,
+		Username:          ui.Claims.Username,
+		PreferredUsername: ui.Claims.PreferredUsername,
+		Email:             ui.Claims.Email,
+		EmailVerified:     ui.Claims.EmailVerified,
+		Groups:            ui.Claims.Groups,
+	}
+
+	// Update AuthRequest with stored identity and auth_time from last login.
+	if err := h.Storage.UpdateAuthRequest(ctx, authReq.ID, func(a storage.AuthRequest) (storage.AuthRequest, error) {
+		a.LoggedIn = true
+		a.Claims = claims
+		a.ConnectorID = session.ConnectorID
+		a.AuthTime = ui.LastLogin
+		return a, nil
+	}); err != nil {
+		h.Logger.ErrorContext(ctx, "session: failed to update auth request", "err", err)
+		return false
+	}
+
+	// Update session activity.
+	_ = h.Storage.UpdateAuthSession(ctx, session.ID, func(old storage.AuthSession) (storage.AuthSession, error) {
+		old.LastActivity = now
+		old.IdleExpiry = h.Sessions.IdleExpiry(now)
+		if cs, ok := old.ClientStates[authReq.ClientID]; ok {
+			cs.LastActivity = now
+		}
+		return old, nil
+	})
+
+	// Re-read to get the updated AuthRequest (LoggedIn, Claims, ConnectorID set above),
+	// then let the shared decision pick the next step.
+	updated, err := h.Storage.GetAuthRequest(ctx, authReq.ID)
+	if err != nil {
+		h.Logger.ErrorContext(ctx, "session: failed to get auth request", "err", err)
+		return false
+	}
+	http.Redirect(w, r, h.buildContinueURL(updated), http.StatusSeeOther)
+	return true
+}
diff --git a/server/authflow/sessionlogin_test.go b/server/authflow/sessionlogin_test.go
new file mode 100644
index 0000000000..39da51aa11
--- /dev/null
+++ b/server/authflow/sessionlogin_test.go
@@ -0,0 +1,2049 @@
+package authflow
+
+import (
+	"crypto"
+	"log/slog"
+	"net/http"
+	"net/http/httptest"
+	"net/url"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/dexidp/dex/server/connectors"
+	"github.com/dexidp/dex/server/internal"
+	"github.com/dexidp/dex/server/mfa"
+	"github.com/dexidp/dex/server/oauth2"
+	"github.com/dexidp/dex/server/session"
+	"github.com/dexidp/dex/server/tokens"
+	"github.com/dexidp/dex/storage"
+	"github.com/dexidp/dex/storage/memory"
+)
+
+// sessionTestServer wraps the login Handler together with the standalone consent
+// component. trySessionLogin now hands off to the dispatcher by redirect, so the
+// consent decision happens downstream; the wrapper keeps consent reachable for
+// the few tests that toggle SkipApproval.
+type sessionTestServer struct {
+	*Handler
+}
+
+func newTestSessionServer(t *testing.T) *sessionTestServer {
+	t.Helper()
+
+	now := time.Date(2026, 3, 16, 12, 0, 0, 0, time.UTC)
+	issuerURL, err := url.Parse("https://example.com/dex")
+	require.NoError(t, err)
+
+	sessionCfg := &session.Config{
+		CookieName:        "dex_session",
+		AbsoluteLifetime:  24 * time.Hour,
+		ValidIfNotUsedFor: 1 * time.Hour,
+	}
+	h := &Handler{
+		Storage:   memory.New(nil),
+		Now:       func() time.Time { return now },
+		Logger:    slog.Default(),
+		IssuerURL: oauth2.IssuerURL{URL: *issuerURL},
+	}
+	h.Connectors = connectors.NewCache(h.Storage, testResolveConnector)
+	h.Sessions = &session.Manager{Storage: h.Storage, Config: sessionCfg, Now: h.Now, Logger: slog.Default(), IssuerURL: oauth2.IssuerURL{URL: *issuerURL}}
+	return &sessionTestServer{Handler: h}
+}
+
+func TestSetSessionCookie(t *testing.T) {
+	s := newTestSessionServer(t)
+	w := httptest.NewRecorder()
+
+	s.Sessions.SetCookie(w, "session1", "secret1", false)
+
+	cookies := w.Result().Cookies()
+	require.Len(t, cookies, 1)
+
+	c := cookies[0]
+	assert.Equal(t, "dex_session", c.Name)
+	assert.Equal(t, internal.SessionCookieValue("session1", "secret1", nil), c.Value)
+	assert.Equal(t, "/dex", c.Path)
+	assert.True(t, c.HttpOnly)
+	assert.True(t, c.Secure)
+	assert.Equal(t, http.SameSiteLaxMode, c.SameSite)
+}
+
+func TestSetSessionCookie_HTTP(t *testing.T) {
+	s := newTestSessionServer(t)
+	u, _ := url.Parse("http://localhost:5556/dex")
+	resetSessions(s, &session.Config{CookieName: "dex_session"}, *u)
+	w := httptest.NewRecorder()
+
+	s.Sessions.SetCookie(w, "session1", "secret1", false)
+
+	cookies := w.Result().Cookies()
+	require.Len(t, cookies, 1)
+	assert.False(t, cookies[0].Secure)
+}
+
+func TestClearSessionCookie(t *testing.T) {
+	s := newTestSessionServer(t)
+	w := httptest.NewRecorder()
+
+	s.Sessions.ClearCookie(w)
+
+	cookies := w.Result().Cookies()
+	require.Len(t, cookies, 1)
+	assert.Equal(t, -1, cookies[0].MaxAge)
+	assert.Equal(t, "", cookies[0].Value)
+}
+
+func TestSessionCookieValueRoundtrip(t *testing.T) {
+	tests := []struct {
+		name      string
+		sessionID string
+		secret    string
+	}{
+		{"simple", "session1", "abc123"},
+		{"with special chars", "session@1", "xyz789"},
+		{"unicode", "сессия", "секрет"},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			value := internal.SessionCookieValue(tt.sessionID, tt.secret, nil)
+			gotID, gotSecret, err := internal.ParseSessionCookie(value, nil)
+			require.NoError(t, err)
+			assert.Equal(t, tt.sessionID, gotID)
+			assert.Equal(t, tt.secret, gotSecret)
+		})
+	}
+}
+
+func TestSessionCookieValueEncryptedRoundtrip(t *testing.T) {
+	key := []byte("0123456789abcdef") // 16 bytes = AES-128
+
+	value := internal.SessionCookieValue("session1", "secret1", key)
+	// Encrypted value must differ from unencrypted.
+	unencrypted := internal.SessionCookieValue("session1", "secret1", nil)
+	assert.NotEqual(t, unencrypted, value)
+
+	// Must decrypt correctly.
+	gotID, gotSecret, err := internal.ParseSessionCookie(value, key)
+	require.NoError(t, err)
+	assert.Equal(t, "session1", gotID)
+	assert.Equal(t, "secret1", gotSecret)
+
+	// Wrong key must fail.
+	wrongKey := []byte("abcdef0123456789")
+	_, _, err = internal.ParseSessionCookie(value, wrongKey)
+	assert.Error(t, err)
+
+	// No key must fail (encrypted value isn't valid protobuf).
+	_, _, err = internal.ParseSessionCookie(value, nil)
+	assert.Error(t, err)
+}
+
+func TestParseSessionCookie_Invalid(t *testing.T) {
+	_, _, err := internal.ParseSessionCookie("invalid", nil)
+	assert.Error(t, err)
+	_, _, err = internal.ParseSessionCookie("a.b", nil)
+	assert.Error(t, err)
+}
+
+func TestGetValidAuthSession(t *testing.T) {
+	ctx := t.Context()
+	authReq := &storage.AuthRequest{ConnectorID: "conn1"}
+
+	t.Run("no session config", func(t *testing.T) {
+		s := newTestSessionServer(t)
+		resetSessions(s, nil, url.URL{})
+		r := httptest.NewRequest(http.MethodGet, "/", nil)
+		assert.Nil(t, s.Sessions.ValidAuthSession(ctx, httptest.NewRecorder(), r, authReq))
+	})
+
+	t.Run("no cookie", func(t *testing.T) {
+		s := newTestSessionServer(t)
+		r := httptest.NewRequest(http.MethodGet, "/", nil)
+		assert.Nil(t, s.Sessions.ValidAuthSession(ctx, httptest.NewRecorder(), r, authReq))
+	})
+
+	t.Run("invalid cookie format", func(t *testing.T) {
+		s := newTestSessionServer(t)
+		r := httptest.NewRequest(http.MethodGet, "/", nil)
+		r.AddCookie(&http.Cookie{Name: "dex_session", Value: "invalid-format"})
+		w := httptest.NewRecorder()
+		assert.Nil(t, s.Sessions.ValidAuthSession(ctx, w, r, authReq))
+		// Cookie should be cleared.
+		assert.Equal(t, -1, w.Result().Cookies()[0].MaxAge)
+	})
+
+	t.Run("session not found", func(t *testing.T) {
+		s := newTestSessionServer(t)
+		r := httptest.NewRequest(http.MethodGet, "/", nil)
+		r.AddCookie(&http.Cookie{Name: "dex_session", Value: internal.SessionCookieValue("nonce", "nonce", nil)})
+		w := httptest.NewRecorder()
+		assert.Nil(t, s.Sessions.ValidAuthSession(ctx, w, r, authReq))
+		// Cookie should be cleared.
+		assert.Equal(t, -1, w.Result().Cookies()[0].MaxAge)
+	})
+
+	t.Run("valid session", func(t *testing.T) {
+		s := newTestSessionServer(t)
+		now := s.Now()
+		nonce := "test-nonce"
+
+		session := storage.AuthSession{
+			UserID:      "user1",
+			ConnectorID: "conn1",
+			ID:          nonce, Secret: nonce,
+			ClientStates:   map[string]*storage.ClientAuthState{},
+			CreatedAt:      now.Add(-30 * time.Minute),
+			LastActivity:   now.Add(-5 * time.Minute),
+			IPAddress:      "127.0.0.1",
+			UserAgent:      "test",
+			AbsoluteExpiry: now.Add(24 * time.Hour),
+			IdleExpiry:     now.Add(1 * time.Hour),
+		}
+		require.NoError(t, s.Storage.CreateAuthSession(ctx, session))
+
+		r := httptest.NewRequest(http.MethodGet, "/", nil)
+		r.AddCookie(&http.Cookie{Name: "dex_session", Value: internal.SessionCookieValue(nonce, nonce, nil)})
+
+		result := s.Sessions.ValidAuthSession(ctx, httptest.NewRecorder(), r, authReq)
+		require.NotNil(t, result)
+		assert.Equal(t, "user1", result.UserID)
+		assert.Equal(t, "conn1", result.ConnectorID)
+	})
+
+	t.Run("connector mismatch", func(t *testing.T) {
+		s := newTestSessionServer(t)
+		now := s.Now()
+		nonce := "test-nonce-conn"
+
+		session := storage.AuthSession{
+			UserID:      "user1",
+			ConnectorID: "ldap",
+			ID:          nonce, Secret: nonce,
+			ClientStates:   map[string]*storage.ClientAuthState{},
+			CreatedAt:      now.Add(-30 * time.Minute),
+			LastActivity:   now.Add(-5 * time.Minute),
+			IPAddress:      "127.0.0.1",
+			UserAgent:      "test",
+			AbsoluteExpiry: now.Add(24 * time.Hour),
+			IdleExpiry:     now.Add(1 * time.Hour),
+		}
+		require.NoError(t, s.Storage.CreateAuthSession(ctx, session))
+
+		r := httptest.NewRequest(http.MethodGet, "/", nil)
+		r.AddCookie(&http.Cookie{Name: "dex_session", Value: internal.SessionCookieValue(nonce, nonce, nil)})
+
+		githubReq := &storage.AuthRequest{ConnectorID: "github"}
+		assert.Nil(t, s.Sessions.ValidAuthSession(ctx, httptest.NewRecorder(), r, githubReq))
+	})
+
+	t.Run("nonce mismatch", func(t *testing.T) {
+		s := newTestSessionServer(t)
+		now := s.Now()
+
+		session := storage.AuthSession{
+			UserID:      "user2",
+			ConnectorID: "conn2",
+			ID:          "correct-nonce", Secret: "correct-nonce",
+			ClientStates:   map[string]*storage.ClientAuthState{},
+			CreatedAt:      now.Add(-30 * time.Minute),
+			LastActivity:   now.Add(-5 * time.Minute),
+			IPAddress:      "127.0.0.1",
+			UserAgent:      "test",
+			AbsoluteExpiry: now.Add(24 * time.Hour),
+			IdleExpiry:     now.Add(1 * time.Hour),
+		}
+		require.NoError(t, s.Storage.CreateAuthSession(ctx, session))
+
+		r := httptest.NewRequest(http.MethodGet, "/", nil)
+		r.AddCookie(&http.Cookie{Name: "dex_session", Value: internal.SessionCookieValue("wrong-nonce", "wrong-nonce", nil)})
+
+		conn2Req := &storage.AuthRequest{ConnectorID: "conn2"}
+		w := httptest.NewRecorder()
+		assert.Nil(t, s.Sessions.ValidAuthSession(ctx, w, r, conn2Req))
+		assert.Equal(t, -1, w.Result().Cookies()[0].MaxAge)
+	})
+
+	t.Run("expired absolute lifetime", func(t *testing.T) {
+		s := newTestSessionServer(t)
+		now := s.Now()
+		nonce := "expired-nonce"
+
+		session := storage.AuthSession{
+			UserID:      "user3",
+			ConnectorID: "conn3",
+			ID:          nonce, Secret: nonce,
+			ClientStates:   map[string]*storage.ClientAuthState{},
+			CreatedAt:      now.Add(-25 * time.Hour),
+			LastActivity:   now.Add(-1 * time.Minute),
+			IPAddress:      "127.0.0.1",
+			UserAgent:      "test",
+			AbsoluteExpiry: now.Add(-1 * time.Hour),
+			IdleExpiry:     now.Add(1 * time.Hour),
+		}
+		require.NoError(t, s.Storage.CreateAuthSession(ctx, session))
+
+		r := httptest.NewRequest(http.MethodGet, "/", nil)
+		r.AddCookie(&http.Cookie{Name: "dex_session", Value: internal.SessionCookieValue(nonce, nonce, nil)})
+
+		conn3Req := &storage.AuthRequest{ConnectorID: "conn3"}
+		w := httptest.NewRecorder()
+		assert.Nil(t, s.Sessions.ValidAuthSession(ctx, w, r, conn3Req))
+		assert.Equal(t, -1, w.Result().Cookies()[0].MaxAge)
+
+		// Session should be deleted.
+		_, err := s.Storage.GetAuthSession(ctx, nonce)
+		assert.ErrorIs(t, err, storage.ErrNotFound)
+	})
+
+	t.Run("expired idle timeout", func(t *testing.T) {
+		s := newTestSessionServer(t)
+		now := s.Now()
+		nonce := "idle-nonce"
+
+		session := storage.AuthSession{
+			UserID:      "user4",
+			ConnectorID: "conn4",
+			ID:          nonce, Secret: nonce,
+			ClientStates:   map[string]*storage.ClientAuthState{},
+			CreatedAt:      now.Add(-2 * time.Hour),
+			LastActivity:   now.Add(-2 * time.Hour),
+			IPAddress:      "127.0.0.1",
+			UserAgent:      "test",
+			AbsoluteExpiry: now.Add(22 * time.Hour),
+			IdleExpiry:     now.Add(-1 * time.Hour),
+		}
+		require.NoError(t, s.Storage.CreateAuthSession(ctx, session))
+
+		r := httptest.NewRequest(http.MethodGet, "/", nil)
+		r.AddCookie(&http.Cookie{Name: "dex_session", Value: internal.SessionCookieValue(nonce, nonce, nil)})
+
+		conn4Req := &storage.AuthRequest{ConnectorID: "conn4"}
+		w := httptest.NewRecorder()
+		assert.Nil(t, s.Sessions.ValidAuthSession(ctx, w, r, conn4Req))
+		assert.Equal(t, -1, w.Result().Cookies()[0].MaxAge)
+
+		// Session should be deleted.
+		_, err := s.Storage.GetAuthSession(ctx, nonce)
+		assert.ErrorIs(t, err, storage.ErrNotFound)
+	})
+}
+
+func TestCreateOrUpdateAuthSession(t *testing.T) {
+	ctx := t.Context()
+
+	t.Run("create new session", func(t *testing.T) {
+		s := newTestSessionServer(t)
+		w := httptest.NewRecorder()
+		r := httptest.NewRequest(http.MethodGet, "/", nil)
+
+		authReq := storage.AuthRequest{
+			ID:          "auth-1",
+			ClientID:    "client-1",
+			Claims:      storage.Claims{UserID: "user-1"},
+			ConnectorID: "mock",
+		}
+
+		err := s.Sessions.CreateOrUpdateAuthSession(ctx, r, w, authReq, false)
+		require.NoError(t, err)
+
+		// Cookie should be set.
+		cookies := w.Result().Cookies()
+		require.Len(t, cookies, 1)
+
+		sessionID, secret, err := internal.ParseSessionCookie(cookies[0].Value, nil)
+		require.NoError(t, err)
+		assert.NotEmpty(t, sessionID)
+		assert.NotEmpty(t, secret)
+		assert.NotEqual(t, sessionID, secret, "the published id must not be the proof")
+
+		// Session should exist in storage.
+		session, err := s.Storage.GetAuthSession(ctx, sessionID)
+		require.NoError(t, err)
+		assert.Equal(t, "user-1", session.UserID)
+		assert.Equal(t, "mock", session.ConnectorID)
+		require.Contains(t, session.ClientStates, "client-1")
+		assert.False(t, session.ClientStates["client-1"].AuthenticatedAt.IsZero())
+	})
+
+	t.Run("update existing session", func(t *testing.T) {
+		s := newTestSessionServer(t)
+		now := s.Now()
+		nonce := "existing-nonce"
+
+		existingSession := storage.AuthSession{
+			UserID:      "user-1",
+			ConnectorID: "mock",
+			ID:          nonce, Secret: nonce,
+			ClientStates: map[string]*storage.ClientAuthState{
+				"client-1": {
+					AuthenticatedAt: now.Add(-10 * time.Minute),
+					LastActivity:    now.Add(-10 * time.Minute),
+				},
+			},
+			CreatedAt:      now.Add(-30 * time.Minute),
+			LastActivity:   now.Add(-10 * time.Minute),
+			IPAddress:      "127.0.0.1",
+			UserAgent:      "test",
+			AbsoluteExpiry: now.Add(24 * time.Hour),
+			IdleExpiry:     now.Add(50 * time.Minute),
+		}
+		require.NoError(t, s.Storage.CreateAuthSession(ctx, existingSession))
+
+		w := httptest.NewRecorder()
+		r := httptest.NewRequest(http.MethodGet, "/", nil)
+		// Same browser: it presents the cookie of the session it already has.
+		r.AddCookie(&http.Cookie{Name: "dex_session", Value: internal.SessionCookieValue(nonce, nonce, nil)})
+
+		authReq := storage.AuthRequest{
+			ID:          "auth-2",
+			ClientID:    "client-2",
+			Claims:      storage.Claims{UserID: "user-1"},
+			ConnectorID: "mock",
+		}
+
+		err := s.Sessions.CreateOrUpdateAuthSession(ctx, r, w, authReq, false)
+		require.NoError(t, err)
+
+		// Cookie should name the same session.
+		cookies := w.Result().Cookies()
+		require.Len(t, cookies, 1)
+		gotID, _, err := internal.ParseSessionCookie(cookies[0].Value, nil)
+		require.NoError(t, err)
+		assert.Equal(t, nonce, gotID)
+
+		// Session should have both clients.
+		session, err := s.Storage.GetAuthSession(ctx, nonce)
+		require.NoError(t, err)
+		assert.Len(t, session.ClientStates, 2)
+		assert.Contains(t, session.ClientStates, "client-1")
+		assert.Contains(t, session.ClientStates, "client-2")
+	})
+
+	// The whole point of keying a session by its own id: the cookie decides whether
+	// there is a session to continue, so a second browser starts its own instead of
+	// joining the first and taking its cookie.
+	t.Run("a second browser gets its own session", func(t *testing.T) {
+		s := newTestSessionServer(t)
+
+		authReq := storage.AuthRequest{
+			ID:          "auth-1",
+			ClientID:    "client-1",
+			Claims:      storage.Claims{UserID: "user-1"},
+			ConnectorID: "mock",
+		}
+
+		signIn := func(t *testing.T, r *http.Request) (id, secret string) {
+			t.Helper()
+			w := httptest.NewRecorder()
+			require.NoError(t, s.Sessions.CreateOrUpdateAuthSession(ctx, r, w, authReq, false))
+
+			cookies := w.Result().Cookies()
+			require.Len(t, cookies, 1)
+			id, secret, err := internal.ParseSessionCookie(cookies[0].Value, nil)
+			require.NoError(t, err)
+			return id, secret
+		}
+
+		// Same user, same connector, two browsers — neither carrying a cookie.
+		firstID, firstSecret := signIn(t, httptest.NewRequest(http.MethodGet, "/", nil))
+		secondID, secondSecret := signIn(t, httptest.NewRequest(http.MethodGet, "/", nil))
+
+		assert.NotEqual(t, firstID, secondID, "a browser without a cookie must not join an existing session")
+		assert.NotEqual(t, firstSecret, secondSecret)
+
+		// Both are stored, and neither took the other's cookie.
+		first, err := s.Storage.GetAuthSession(ctx, firstID)
+		require.NoError(t, err, "the first browser's session must survive the second signing in")
+		assert.Equal(t, firstSecret, first.Secret)
+
+		second, err := s.Storage.GetAuthSession(ctx, secondID)
+		require.NoError(t, err)
+		assert.Equal(t, secondSecret, second.Secret)
+
+		// The same browser signing in again continues the session it already has.
+		againID, _ := signIn(t, sessionCookieRequest2(firstID, firstSecret))
+		assert.Equal(t, firstID, againID, "a browser with its cookie must continue its own session")
+
+		sessions, err := s.Storage.ListAuthSessions(ctx)
+		require.NoError(t, err)
+		assert.Len(t, sessions, 2)
+	})
+
+	t.Run("nil session config", func(t *testing.T) {
+		s := newTestSessionServer(t)
+		resetSessions(s, nil, url.URL{})
+		w := httptest.NewRecorder()
+		r := httptest.NewRequest(http.MethodGet, "/", nil)
+
+		err := s.Sessions.CreateOrUpdateAuthSession(ctx, r, w, storage.AuthRequest{}, false)
+		assert.NoError(t, err)
+		assert.Empty(t, w.Result().Cookies())
+	})
+}
+
+// setupSessionLoginFixture creates the necessary storage objects for trySessionLogin tests.
+func setupSessionLoginFixture(t *testing.T, s *sessionTestServer) storage.AuthRequest {
+	t.Helper()
+	ctx := t.Context()
+	now := s.Now()
+
+	require.NoError(t, s.Storage.CreateAuthSession(ctx, storage.AuthSession{
+		UserID:      "user-1",
+		ConnectorID: "mock",
+		ID:          "test-nonce", Secret: "test-nonce",
+		ClientStates: map[string]*storage.ClientAuthState{
+			"client-1": {
+				AuthenticatedAt: now.Add(-1 * time.Minute),
+				LastActivity:    now.Add(-1 * time.Minute),
+			},
+		},
+		CreatedAt:      now.Add(-30 * time.Minute),
+		LastActivity:   now.Add(-1 * time.Minute),
+		IPAddress:      "127.0.0.1",
+		UserAgent:      "test",
+		AbsoluteExpiry: now.Add(24 * time.Hour),
+		IdleExpiry:     now.Add(59 * time.Minute),
+	}))
+
+	require.NoError(t, s.Storage.CreateUserIdentity(ctx, storage.UserIdentity{
+		UserID:      "user-1",
+		ConnectorID: "mock",
+		Claims: storage.Claims{
+			UserID:   "user-1",
+			Username: "testuser",
+			Email:    "test@example.com",
+		},
+		Consents:  map[string][]string{"client-1": {"openid", "email"}},
+		CreatedAt: now.Add(-1 * time.Hour),
+		LastLogin: now.Add(-30 * time.Minute),
+	}))
+
+	authReq := storage.AuthRequest{
+		ID:          storage.NewID(),
+		ClientID:    "client-1",
+		ConnectorID: "mock",
+		Scopes:      []string{"openid", "email"},
+		RedirectURI: "http://localhost/callback",
+		MaxAge:      -1,
+		HMACKey:     storage.NewHMACKey(crypto.SHA256),
+		Expiry:      now.Add(10 * time.Minute),
+	}
+	require.NoError(t, s.Storage.CreateAuthRequest(ctx, authReq))
+	return authReq
+}
+
+// sessionCookieRequest2 is sessionCookieRequest for the tests that care that the
+// two halves of the cookie differ.
+func sessionCookieRequest2(sessionID, secret string) *http.Request {
+	r := httptest.NewRequest(http.MethodGet, "/", nil)
+	r.AddCookie(&http.Cookie{Name: "dex_session", Value: internal.SessionCookieValue(sessionID, secret, nil)})
+	return r
+}
+
+func sessionCookieRequest(sessionID string) *http.Request {
+	r := httptest.NewRequest(http.MethodGet, "/", nil)
+	r.AddCookie(&http.Cookie{Name: "dex_session", Value: internal.SessionCookieValue(sessionID, sessionID, nil)})
+	return r
+}
+
+func TestTrySessionLogin(t *testing.T) {
+	ctx := t.Context()
+
+	t.Run("no session", func(t *testing.T) {
+		s := newTestSessionServer(t)
+		authReq := storage.AuthRequest{ConnectorID: "mock"}
+		r := httptest.NewRequest(http.MethodGet, "/", nil)
+		w := httptest.NewRecorder()
+
+		ok := s.trySessionLogin(ctx, r, w, &authReq)
+		assert.False(t, ok)
+	})
+
+	t.Run("successful login with skipApproval", func(t *testing.T) {
+		s := newTestSessionServer(t)
+		s.SkipApproval = true
+		authReq := setupSessionLoginFixture(t, s)
+
+		r := sessionCookieRequest("test-nonce")
+		w := httptest.NewRecorder()
+
+		ok := s.trySessionLogin(ctx, r, w, &authReq)
+		assert.True(t, ok)
+	})
+
+	t.Run("successful login redirects to approval", func(t *testing.T) {
+		s := newTestSessionServer(t)
+		s.SkipApproval = false
+		authReq := setupSessionLoginFixture(t, s)
+		authReq.ForceApprovalPrompt = true
+
+		require.NoError(t, s.Storage.UpdateAuthRequest(ctx, authReq.ID, func(a storage.AuthRequest) (storage.AuthRequest, error) {
+			a.ForceApprovalPrompt = true
+			return a, nil
+		}))
+
+		r := sessionCookieRequest("test-nonce")
+		w := httptest.NewRecorder()
+
+		ok := s.trySessionLogin(ctx, r, w, &authReq)
+		redirectURL := w.Header().Get("Location")
+		assert.True(t, ok)
+		assert.Contains(t, redirectURL, "/auth?", "session login hands off to the dispatcher")
+		assert.Contains(t, redirectURL, "req="+authReq.ID)
+	})
+
+	t.Run("skips approval when consent already given", func(t *testing.T) {
+		s := newTestSessionServer(t)
+		s.SkipApproval = false
+		authReq := setupSessionLoginFixture(t, s)
+
+		r := sessionCookieRequest("test-nonce")
+		w := httptest.NewRecorder()
+
+		ok := s.trySessionLogin(ctx, r, w, &authReq)
+		assert.True(t, ok)
+	})
+
+	t.Run("connector mismatch returns false", func(t *testing.T) {
+		s := newTestSessionServer(t)
+		authReq := setupSessionLoginFixture(t, s)
+		authReq.ConnectorID = "github"
+
+		r := sessionCookieRequest("test-nonce")
+		w := httptest.NewRecorder()
+
+		ok := s.trySessionLogin(ctx, r, w, &authReq)
+		assert.False(t, ok)
+	})
+
+	t.Run("no client state for requested client", func(t *testing.T) {
+		s := newTestSessionServer(t)
+		authReq := setupSessionLoginFixture(t, s)
+		authReq.ClientID = "unknown-client"
+
+		r := sessionCookieRequest("test-nonce")
+		w := httptest.NewRecorder()
+
+		ok := s.trySessionLogin(ctx, r, w, &authReq)
+		assert.False(t, ok)
+	})
+
+	t.Run("updates session activity", func(t *testing.T) {
+		s := newTestSessionServer(t)
+		s.SkipApproval = true
+		authReq := setupSessionLoginFixture(t, s)
+
+		r := sessionCookieRequest("test-nonce")
+		w := httptest.NewRecorder()
+
+		ok := s.trySessionLogin(ctx, r, w, &authReq)
+		require.True(t, ok)
+
+		session, err := s.Storage.GetAuthSession(ctx, "test-nonce")
+		require.NoError(t, err)
+		assert.Equal(t, s.Now(), session.LastActivity)
+	})
+}
+
+// setupSessionWithIdentity creates an AuthSession, UserIdentity, and AuthRequest in storage
+// for use in trySessionLogin tests. Returns the authReq.
+func setupSessionWithIdentity(t *testing.T, s *sessionTestServer, now time.Time, lastLogin time.Time) storage.AuthRequest {
+	t.Helper()
+	ctx := t.Context()
+	nonce := "test-nonce"
+
+	session := storage.AuthSession{
+		UserID:      "user-1",
+		ConnectorID: "mock",
+		ID:          nonce, Secret: nonce,
+		ClientStates: map[string]*storage.ClientAuthState{
+			"client-1": {
+				AuthenticatedAt: now.Add(-1 * time.Minute),
+				LastActivity:    now.Add(-1 * time.Minute),
+			},
+		},
+		CreatedAt:    now.Add(-30 * time.Minute),
+		LastActivity: now.Add(-1 * time.Minute),
+		IPAddress:    "127.0.0.1",
+		UserAgent:    "test",
+	}
+	require.NoError(t, s.Storage.CreateAuthSession(ctx, session))
+
+	ui := storage.UserIdentity{
+		UserID:      "user-1",
+		ConnectorID: "mock",
+		Claims: storage.Claims{
+			UserID:   "user-1",
+			Username: "testuser",
+			Email:    "test@example.com",
+		},
+		Consents:  make(map[string][]string),
+		CreatedAt: now.Add(-1 * time.Hour),
+		LastLogin: lastLogin,
+	}
+	require.NoError(t, s.Storage.CreateUserIdentity(ctx, ui))
+
+	authReq := storage.AuthRequest{
+		ID:          storage.NewID(),
+		ClientID:    "client-1",
+		ConnectorID: "mock",
+		Scopes:      []string{"openid"},
+		RedirectURI: "http://localhost/callback",
+		MaxAge:      -1,
+		HMACKey:     storage.NewHMACKey(crypto.SHA256),
+		Expiry:      now.Add(10 * time.Minute),
+	}
+	require.NoError(t, s.Storage.CreateAuthRequest(ctx, authReq))
+
+	return authReq
+}
+
+func TestTrySessionLogin_MaxAge(t *testing.T) {
+	ctx := t.Context()
+
+	t.Run("max_age not specified, session reused", func(t *testing.T) {
+		s := newTestSessionServer(t)
+		now := s.Now()
+
+		authReq := setupSessionWithIdentity(t, s, now, now.Add(-2*time.Hour))
+		authReq.MaxAge = -1 // not specified
+
+		r := httptest.NewRequest(http.MethodGet, "/", nil)
+		r.AddCookie(&http.Cookie{Name: "dex_session", Value: internal.SessionCookieValue("test-nonce", "test-nonce", nil)})
+		w := httptest.NewRecorder()
+
+		ok := s.trySessionLogin(ctx, r, w, &authReq)
+		assert.True(t, ok, "session should be reused when max_age is not specified")
+	})
+
+	t.Run("max_age satisfied, session reused", func(t *testing.T) {
+		s := newTestSessionServer(t)
+		now := s.Now()
+
+		// User logged in 10 minutes ago, max_age=3600 (1 hour)
+		authReq := setupSessionWithIdentity(t, s, now, now.Add(-10*time.Minute))
+		authReq.MaxAge = 3600
+
+		r := httptest.NewRequest(http.MethodGet, "/", nil)
+		r.AddCookie(&http.Cookie{Name: "dex_session", Value: internal.SessionCookieValue("test-nonce", "test-nonce", nil)})
+		w := httptest.NewRecorder()
+
+		ok := s.trySessionLogin(ctx, r, w, &authReq)
+		assert.True(t, ok, "session should be reused when max_age is satisfied")
+	})
+
+	t.Run("max_age exceeded, force re-auth", func(t *testing.T) {
+		s := newTestSessionServer(t)
+		now := s.Now()
+
+		// User logged in 2 hours ago, max_age=3600 (1 hour)
+		authReq := setupSessionWithIdentity(t, s, now, now.Add(-2*time.Hour))
+		authReq.MaxAge = 3600
+
+		r := httptest.NewRequest(http.MethodGet, "/", nil)
+		r.AddCookie(&http.Cookie{Name: "dex_session", Value: internal.SessionCookieValue("test-nonce", "test-nonce", nil)})
+		w := httptest.NewRecorder()
+
+		ok := s.trySessionLogin(ctx, r, w, &authReq)
+		assert.False(t, ok, "session should NOT be reused when max_age is exceeded")
+	})
+
+	t.Run("max_age=0, always force re-auth", func(t *testing.T) {
+		s := newTestSessionServer(t)
+		now := s.Now()
+
+		// User logged in 1 second ago, max_age=0
+		authReq := setupSessionWithIdentity(t, s, now, now.Add(-1*time.Second))
+		authReq.MaxAge = 0
+
+		r := httptest.NewRequest(http.MethodGet, "/", nil)
+		r.AddCookie(&http.Cookie{Name: "dex_session", Value: internal.SessionCookieValue("test-nonce", "test-nonce", nil)})
+		w := httptest.NewRecorder()
+
+		ok := s.trySessionLogin(ctx, r, w, &authReq)
+		assert.False(t, ok, "max_age=0 should always force re-authentication")
+	})
+
+	t.Run("auth_time is set from UserIdentity.LastLogin", func(t *testing.T) {
+		s := newTestSessionServer(t)
+		s.SkipApproval = false
+		now := s.Now()
+		lastLogin := now.Add(-10 * time.Minute)
+
+		authReq := setupSessionWithIdentity(t, s, now, lastLogin)
+		authReq.ForceApprovalPrompt = true // force approval so AuthRequest is not deleted
+
+		require.NoError(t, s.Storage.UpdateAuthRequest(ctx, authReq.ID, func(a storage.AuthRequest) (storage.AuthRequest, error) {
+			a.ForceApprovalPrompt = true
+			return a, nil
+		}))
+
+		r := httptest.NewRequest(http.MethodGet, "/", nil)
+		r.AddCookie(&http.Cookie{Name: "dex_session", Value: internal.SessionCookieValue("test-nonce", "test-nonce", nil)})
+		w := httptest.NewRecorder()
+
+		ok := s.trySessionLogin(ctx, r, w, &authReq)
+		redirectURL := w.Header().Get("Location")
+		require.True(t, ok)
+		assert.Contains(t, redirectURL, "/auth?", "session login hands off to the dispatcher")
+
+		// Verify AuthTime was set on the auth request.
+		updated, err := s.Storage.GetAuthRequest(ctx, authReq.ID)
+		require.NoError(t, err)
+		assert.Equal(t, lastLogin.Unix(), updated.AuthTime.Unix())
+	})
+}
+
+func TestTrySessionLoginWithSession_IDTokenHint(t *testing.T) {
+	ctx := t.Context()
+
+	// tokens.GenSubject("user-1", "mock") produces a deterministic subject string.
+	hintSubjectForUser1Mock, err := tokens.GenSubject("user-1", "mock")
+	require.NoError(t, err)
+
+	hintSubjectOther, err := tokens.GenSubject("other-user", "mock")
+	require.NoError(t, err)
+
+	t.Run("hint matches session user - session login succeeds", func(t *testing.T) {
+		s := newTestSessionServer(t)
+		s.SkipApproval = true
+		authReq := setupSessionLoginFixture(t, s)
+
+		session := s.Sessions.ValidAuthSession(ctx, httptest.NewRecorder(), sessionCookieRequest("test-nonce"), &authReq)
+		require.NotNil(t, session)
+
+		// Verify hint matches.
+		assert.True(t, sessionMatchesHint(session, hintSubjectForUser1Mock))
+
+		r := sessionCookieRequest("test-nonce")
+		w := httptest.NewRecorder()
+
+		ok := s.trySessionLoginWithSession(ctx, r, w, &authReq, session)
+		assert.True(t, ok)
+	})
+
+	t.Run("hint does not match session user - session invalidated", func(t *testing.T) {
+		s := newTestSessionServer(t)
+		s.SkipApproval = true
+		authReq := setupSessionLoginFixture(t, s)
+
+		session := s.Sessions.ValidAuthSession(ctx, httptest.NewRecorder(), sessionCookieRequest("test-nonce"), &authReq)
+		require.NotNil(t, session)
+
+		// Verify hint does NOT match.
+		assert.False(t, sessionMatchesHint(session, hintSubjectOther))
+
+		// Simulating the hint mismatch logic from handleConnectorLogin:
+		// when hint doesn't match and prompt is not none, session is set to nil.
+		var nilSession *storage.AuthSession
+		r := sessionCookieRequest("test-nonce")
+		w := httptest.NewRecorder()
+
+		ok := s.trySessionLoginWithSession(ctx, r, w, &authReq, nilSession)
+		assert.False(t, ok, "session login should fail when session is invalidated due to hint mismatch")
+	})
+
+	t.Run("hint with no session - trySessionLoginWithSession returns false", func(t *testing.T) {
+		s := newTestSessionServer(t)
+		s.SkipApproval = true
+		authReq := setupSessionLoginFixture(t, s)
+
+		r := httptest.NewRequest(http.MethodGet, "/", nil)
+		w := httptest.NewRecorder()
+
+		ok := s.trySessionLoginWithSession(ctx, r, w, &authReq, nil)
+		assert.False(t, ok)
+	})
+
+	t.Run("no hint - unchanged behavior", func(t *testing.T) {
+		s := newTestSessionServer(t)
+		s.SkipApproval = true
+		authReq := setupSessionLoginFixture(t, s)
+
+		session := s.Sessions.ValidAuthSession(ctx, httptest.NewRecorder(), sessionCookieRequest("test-nonce"), &authReq)
+		require.NotNil(t, session)
+
+		r := sessionCookieRequest("test-nonce")
+		w := httptest.NewRecorder()
+
+		ok := s.trySessionLoginWithSession(ctx, r, w, &authReq, session)
+		assert.True(t, ok)
+	})
+}
+
+func TestParseAuthRequest_PromptAndMaxAge(t *testing.T) {
+	t.Run("prompt=consent sets ForceApprovalPrompt", func(t *testing.T) {
+		authReq := storage.AuthRequest{
+			Prompt:              "consent",
+			ForceApprovalPrompt: true,
+		}
+		assert.True(t, authReq.ForceApprovalPrompt)
+		assert.Equal(t, "consent", authReq.Prompt)
+	})
+
+	t.Run("max_age default is -1", func(t *testing.T) {
+		authReq := storage.AuthRequest{
+			MaxAge: -1,
+		}
+		assert.Equal(t, -1, authReq.MaxAge)
+	})
+}
+
+func TestClientSharesSessionWith(t *testing.T) {
+	tests := []struct {
+		name           string
+		ssoSharedWith  []string
+		defaultPolicy  string
+		targetClientID string
+		want           bool
+	}{
+		{
+			name:           "nil uses default none",
+			ssoSharedWith:  nil,
+			defaultPolicy:  "none",
+			targetClientID: "client-b",
+			want:           false,
+		},
+		{
+			name:           "nil uses default all",
+			ssoSharedWith:  nil,
+			defaultPolicy:  "all",
+			targetClientID: "client-b",
+			want:           true,
+		},
+		{
+			name:           "nil with empty default",
+			ssoSharedWith:  nil,
+			defaultPolicy:  "",
+			targetClientID: "client-b",
+			want:           false,
+		},
+		{
+			name:           "empty slice means no sharing",
+			ssoSharedWith:  []string{},
+			defaultPolicy:  "all",
+			targetClientID: "client-b",
+			want:           false,
+		},
+		{
+			name:           "wildcard shares with everyone",
+			ssoSharedWith:  []string{"*"},
+			defaultPolicy:  "none",
+			targetClientID: "any-client",
+			want:           true,
+		},
+		{
+			name:           "explicit match",
+			ssoSharedWith:  []string{"client-b", "client-c"},
+			defaultPolicy:  "none",
+			targetClientID: "client-b",
+			want:           true,
+		},
+		{
+			name:           "no match in list",
+			ssoSharedWith:  []string{"client-b", "client-c"},
+			defaultPolicy:  "none",
+			targetClientID: "client-d",
+			want:           false,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			s := newTestSessionServer(t)
+			resetSessions(s, &session.Config{CookieName: "dex_session", AbsoluteLifetime: 24 * time.Hour, ValidIfNotUsedFor: time.Hour, SSOSharedWithDefault: tt.defaultPolicy}, url.URL{})
+
+			client := storage.Client{
+				ID:            "source-client",
+				SSOSharedWith: tt.ssoSharedWith,
+			}
+			got := s.Sessions.ClientSharesWith(client, tt.targetClientID)
+			assert.Equal(t, tt.want, got)
+		})
+	}
+}
+
+func TestFindSSOSession(t *testing.T) {
+	ctx := t.Context()
+
+	t.Run("finds SSO session from sharing client", func(t *testing.T) {
+		s := newTestSessionServer(t)
+		now := s.Now()
+
+		require.NoError(t, s.Storage.CreateClient(ctx, storage.Client{
+			ID:            "client-a",
+			Secret:        "secret",
+			Name:          "Client A",
+			SSOSharedWith: []string{"client-b"},
+		}))
+
+		session := &storage.AuthSession{
+			UserID:      "user-1",
+			ConnectorID: "mock",
+			ClientStates: map[string]*storage.ClientAuthState{
+				"client-a": {
+					AuthenticatedAt: now.Add(-5 * time.Minute),
+					LastActivity:    now.Add(-5 * time.Minute),
+				},
+			},
+		}
+
+		assert.NotNil(t, s.Sessions.FindSSO(ctx, session, "client-b"))
+	})
+
+	t.Run("no SSO when client does not share", func(t *testing.T) {
+		s := newTestSessionServer(t)
+		now := s.Now()
+
+		require.NoError(t, s.Storage.CreateClient(ctx, storage.Client{
+			ID:            "client-a",
+			Secret:        "secret",
+			Name:          "Client A",
+			SSOSharedWith: []string{"client-c"}, // Does not share with client-b
+		}))
+
+		session := &storage.AuthSession{
+			UserID:      "user-1",
+			ConnectorID: "mock",
+			ClientStates: map[string]*storage.ClientAuthState{
+				"client-a": {
+					AuthenticatedAt: now.Add(-5 * time.Minute),
+					LastActivity:    now.Add(-5 * time.Minute),
+				},
+			},
+		}
+
+		assert.Nil(t, s.Sessions.FindSSO(ctx, session, "client-b"))
+	})
+
+	t.Run("wildcard SSO with default all", func(t *testing.T) {
+		s := newTestSessionServer(t)
+		resetSessions(s, &session.Config{CookieName: "dex_session", AbsoluteLifetime: 24 * time.Hour, ValidIfNotUsedFor: time.Hour, SSOSharedWithDefault: "all"}, url.URL{})
+		now := s.Now()
+
+		// Client with nil SSOSharedWith — uses default "all"
+		require.NoError(t, s.Storage.CreateClient(ctx, storage.Client{
+			ID:     "client-a",
+			Secret: "secret",
+			Name:   "Client A",
+			// SSOSharedWith is nil → uses ssoSharedWithDefault="all"
+		}))
+
+		session := &storage.AuthSession{
+			UserID:      "user-1",
+			ConnectorID: "mock",
+			ClientStates: map[string]*storage.ClientAuthState{
+				"client-a": {
+					AuthenticatedAt: now.Add(-5 * time.Minute),
+					LastActivity:    now.Add(-5 * time.Minute),
+				},
+			},
+		}
+
+		assert.NotNil(t, s.Sessions.FindSSO(ctx, session, "client-b"))
+	})
+}
+
+func TestTrySessionLogin_SSO(t *testing.T) {
+	ctx := t.Context()
+
+	t.Run("SSO login from sharing client", func(t *testing.T) {
+		s := newTestSessionServer(t)
+		s.SkipApproval = true
+		now := s.Now()
+
+		// Create source client that shares with target
+		require.NoError(t, s.Storage.CreateClient(ctx, storage.Client{
+			ID:            "client-a",
+			Secret:        "secret",
+			Name:          "Client A",
+			SSOSharedWith: []string{"client-b"},
+		}))
+
+		// Create session with client-a authenticated
+		require.NoError(t, s.Storage.CreateAuthSession(ctx, storage.AuthSession{
+			UserID:      "user-1",
+			ConnectorID: "mock",
+			ID:          "test-nonce", Secret: "test-nonce",
+			ClientStates: map[string]*storage.ClientAuthState{
+				"client-a": {
+					AuthenticatedAt: now.Add(-1 * time.Minute),
+					LastActivity:    now.Add(-1 * time.Minute),
+				},
+			},
+			CreatedAt:      now.Add(-30 * time.Minute),
+			LastActivity:   now.Add(-1 * time.Minute),
+			IPAddress:      "127.0.0.1",
+			UserAgent:      "test",
+			AbsoluteExpiry: now.Add(24 * time.Hour),
+			IdleExpiry:     now.Add(59 * time.Minute),
+		}))
+
+		require.NoError(t, s.Storage.CreateUserIdentity(ctx, storage.UserIdentity{
+			UserID:      "user-1",
+			ConnectorID: "mock",
+			Claims: storage.Claims{
+				UserID:   "user-1",
+				Username: "testuser",
+				Email:    "test@example.com",
+			},
+			Consents:  map[string][]string{"client-b": {"openid", "email"}},
+			CreatedAt: now.Add(-1 * time.Hour),
+			LastLogin: now.Add(-30 * time.Minute),
+		}))
+
+		// Auth request for client-b (not directly in session)
+		authReq := storage.AuthRequest{
+			ID:          storage.NewID(),
+			ClientID:    "client-b",
+			ConnectorID: "mock",
+			Scopes:      []string{"openid", "email"},
+			RedirectURI: "http://localhost/callback",
+			MaxAge:      -1,
+			HMACKey:     storage.NewHMACKey(crypto.SHA256),
+			Expiry:      now.Add(10 * time.Minute),
+		}
+		require.NoError(t, s.Storage.CreateAuthRequest(ctx, authReq))
+
+		r := sessionCookieRequest("test-nonce")
+		w := httptest.NewRecorder()
+
+		session := s.Sessions.ValidAuthSession(ctx, w, r, &authReq)
+		require.NotNil(t, session)
+
+		ok := s.trySessionLoginWithSession(ctx, r, w, &authReq, session)
+		assert.True(t, ok, "SSO login should succeed")
+
+		// Verify client-b state was created in session
+		updated, err := s.Storage.GetAuthSession(ctx, "test-nonce")
+		require.NoError(t, err)
+		assert.Contains(t, updated.ClientStates, "client-b")
+		assert.False(t, updated.ClientStates["client-b"].AuthenticatedAt.IsZero())
+	})
+
+	t.Run("SSO derived state inherits the source authentication time", func(t *testing.T) {
+		s := newTestSessionServer(t)
+		s.SkipApproval = true
+		now := s.Now()
+
+		require.NoError(t, s.Storage.CreateClient(ctx, storage.Client{
+			ID:            "client-a",
+			Secret:        "secret",
+			Name:          "Client A",
+			SSOSharedWith: []string{"client-b"},
+		}))
+
+		// When the source client authenticated. The derived state must say the same:
+		// the user did not authenticate again to reach the target client.
+		sourceAuthTime := now.Add(-1 * time.Minute)
+		require.NoError(t, s.Storage.CreateAuthSession(ctx, storage.AuthSession{
+			UserID:      "user-1",
+			ConnectorID: "mock",
+			ID:          "test-nonce", Secret: "test-nonce",
+			ClientStates: map[string]*storage.ClientAuthState{
+				"client-a": {
+					AuthenticatedAt: sourceAuthTime,
+					LastActivity:    now.Add(-1 * time.Minute),
+				},
+			},
+			CreatedAt:      now.Add(-30 * time.Minute),
+			LastActivity:   now.Add(-1 * time.Minute),
+			IPAddress:      "127.0.0.1",
+			UserAgent:      "test",
+			AbsoluteExpiry: now.Add(24 * time.Hour),
+			IdleExpiry:     now.Add(59 * time.Minute),
+		}))
+
+		require.NoError(t, s.Storage.CreateUserIdentity(ctx, storage.UserIdentity{
+			UserID:      "user-1",
+			ConnectorID: "mock",
+			Claims: storage.Claims{
+				UserID:   "user-1",
+				Username: "testuser",
+				Email:    "test@example.com",
+			},
+			Consents:  map[string][]string{"client-b": {"openid", "email"}},
+			CreatedAt: now.Add(-1 * time.Hour),
+			LastLogin: now.Add(-30 * time.Minute),
+		}))
+
+		authReq := storage.AuthRequest{
+			ID:          storage.NewID(),
+			ClientID:    "client-b",
+			ConnectorID: "mock",
+			Scopes:      []string{"openid", "email"},
+			RedirectURI: "http://localhost/callback",
+			MaxAge:      -1,
+			HMACKey:     storage.NewHMACKey(crypto.SHA256),
+			Expiry:      now.Add(10 * time.Minute),
+		}
+		require.NoError(t, s.Storage.CreateAuthRequest(ctx, authReq))
+
+		r := sessionCookieRequest("test-nonce")
+		w := httptest.NewRecorder()
+
+		session := s.Sessions.ValidAuthSession(ctx, w, r, &authReq)
+		require.NotNil(t, session)
+
+		ok := s.trySessionLoginWithSession(ctx, r, w, &authReq, session)
+		assert.True(t, ok, "SSO login should succeed")
+
+		updated, err := s.Storage.GetAuthSession(ctx, "test-nonce")
+		require.NoError(t, err)
+		require.Contains(t, updated.ClientStates, "client-b")
+		assert.Equal(t, sourceAuthTime, updated.ClientStates["client-b"].AuthenticatedAt,
+			"derived state should carry the source's authentication time")
+		assert.True(t, updated.ClientStates["client-b"].ViaSSO)
+	})
+
+	t.Run("no SSO when client does not share", func(t *testing.T) {
+		s := newTestSessionServer(t)
+		now := s.Now()
+
+		require.NoError(t, s.Storage.CreateClient(ctx, storage.Client{
+			ID:            "client-a",
+			Secret:        "secret",
+			Name:          "Client A",
+			SSOSharedWith: []string{}, // Shares with nobody
+		}))
+
+		require.NoError(t, s.Storage.CreateAuthSession(ctx, storage.AuthSession{
+			UserID:      "user-1",
+			ConnectorID: "mock",
+			ID:          "test-nonce", Secret: "test-nonce",
+			ClientStates: map[string]*storage.ClientAuthState{
+				"client-a": {
+					AuthenticatedAt: now.Add(-1 * time.Minute),
+					LastActivity:    now.Add(-1 * time.Minute),
+				},
+			},
+			CreatedAt:      now.Add(-30 * time.Minute),
+			LastActivity:   now.Add(-1 * time.Minute),
+			IPAddress:      "127.0.0.1",
+			UserAgent:      "test",
+			AbsoluteExpiry: now.Add(24 * time.Hour),
+			IdleExpiry:     now.Add(59 * time.Minute),
+		}))
+
+		authReq := storage.AuthRequest{
+			ID:          storage.NewID(),
+			ClientID:    "client-b",
+			ConnectorID: "mock",
+			MaxAge:      -1,
+			HMACKey:     storage.NewHMACKey(crypto.SHA256),
+			Expiry:      now.Add(10 * time.Minute),
+		}
+		require.NoError(t, s.Storage.CreateAuthRequest(ctx, authReq))
+
+		r := sessionCookieRequest("test-nonce")
+		w := httptest.NewRecorder()
+
+		session := s.Sessions.ValidAuthSession(ctx, w, r, &authReq)
+		require.NotNil(t, session)
+
+		ok := s.trySessionLoginWithSession(ctx, r, w, &authReq, session)
+		assert.False(t, ok, "SSO login should fail when client does not share")
+	})
+}
+
+func TestFinishSessionLogin_MFA(t *testing.T) {
+	ctx := t.Context()
+
+	setupMFAFixture := func(t *testing.T, mfaProviders map[string]mfa.Provider, clientMFAChain []string) (*sessionTestServer, storage.AuthRequest) {
+		t.Helper()
+		s := newTestSessionServer(t)
+		s.SkipApproval = true
+		s.MFAEnabled = len(mfaProviders) > 0
+
+		// Create connector in storage and register it in the connectors map.
+		require.NoError(t, s.Storage.CreateConnector(ctx, storage.Connector{
+			ID:              "mock",
+			Type:            "ldap",
+			Name:            "Mock LDAP",
+			ResourceVersion: "1",
+		}))
+		s.Connectors.Set("mock", connectors.Connector{Type: "ldap", ResourceVersion: "1"})
+
+		// Create client with MFA chain.
+		require.NoError(t, s.Storage.CreateClient(ctx, storage.Client{
+			ID:       "client-1",
+			Secret:   "secret",
+			Name:     "Test Client",
+			MFAChain: clientMFAChain,
+		}))
+
+		authReq := setupSessionLoginFixture(t, s)
+		return s, authReq
+	}
+
+	t.Run("MFA required redirects to MFA page", func(t *testing.T) {
+		s, authReq := setupMFAFixture(t, map[string]mfa.Provider{
+			"totp": mfa.NewTOTPProvider("test-issuer", nil), // nil connectorTypes = enabled for all
+		}, []string{"totp"})
+
+		r := sessionCookieRequest("test-nonce")
+		w := httptest.NewRecorder()
+
+		ok := s.trySessionLogin(ctx, r, w, &authReq)
+		redirectURL := w.Header().Get("Location")
+		require.True(t, ok)
+		assert.Contains(t, redirectURL, "/auth?", "should redirect to MFA page")
+		assert.Contains(t, redirectURL, "req="+authReq.ID, "redirect should include auth request ID")
+
+		// MFAValidated should NOT be set.
+		updated, err := s.Storage.GetAuthRequest(ctx, authReq.ID)
+		require.NoError(t, err)
+		assert.False(t, updated.MFAValidated, "MFAValidated should be false when MFA is required")
+		// LoggedIn should still be set even though MFA is pending.
+		assert.True(t, updated.LoggedIn, "LoggedIn should be true even when MFA is pending")
+	})
+
+	t.Run("MFA provider not enabled for connector type skips MFA", func(t *testing.T) {
+		// TOTP provider only enabled for "oidc" connectors, but our connector is "ldap".
+		s, authReq := setupMFAFixture(t, map[string]mfa.Provider{
+			"totp": mfa.NewTOTPProvider("test-issuer", []string{"oidc"}),
+		}, []string{"totp"})
+		require.NoError(t, s.Storage.UpdateAuthRequest(ctx, authReq.ID, func(a storage.AuthRequest) (storage.AuthRequest, error) {
+			a.ForceApprovalPrompt = true
+			return a, nil
+		}))
+		authReq.ForceApprovalPrompt = true
+
+		r := sessionCookieRequest("test-nonce")
+		w := httptest.NewRecorder()
+
+		ok := s.trySessionLogin(ctx, r, w, &authReq)
+		redirectURL := w.Header().Get("Location")
+		require.True(t, ok)
+		assert.Contains(t, redirectURL, "/auth?", "session login hands off to the dispatcher")
+	})
+}
+
+// TestNonceVerificationRejectsForgedCookie verifies that a session cookie
+// with a valid (userID, connectorID) but wrong nonce is rejected.
+// The nonce comparison uses constant-time comparison to prevent timing attacks.
+// TestSecretVerificationRejectsForgedCookie: the session id travels in every id
+// token as the sid claim, so a cookie naming a real session proves nothing on its
+// own. Only the secret does, and these cases are the ones that reach that check.
+func TestSecretVerificationRejectsForgedCookie(t *testing.T) {
+	ctx := t.Context()
+	s := newTestSessionServer(t)
+	now := s.Now()
+
+	require.NoError(t, s.Storage.CreateAuthSession(ctx, storage.AuthSession{
+		UserID: "user-1", ConnectorID: "mock", ID: "real-session", Secret: "real-secret",
+		CreatedAt: now.Add(-10 * time.Minute), LastActivity: now.Add(-1 * time.Minute),
+		AbsoluteExpiry: now.Add(24 * time.Hour), IdleExpiry: now.Add(59 * time.Minute),
+	}))
+
+	tests := []struct {
+		name      string
+		sessionID string
+		secret    string
+	}{
+		// The published id with every secret an attacker could try from it.
+		{"right id, wrong secret", "real-session", "wrong-secret"},
+		{"right id, no secret", "real-session", ""},
+		{"right id, secret is the id", "real-session", "real-session"},
+		{"right id, prefix of the secret", "real-session", "real"},
+		{"right id, secret with suffix", "real-session", "real-secret-extra"},
+		// And an id that names nothing, which never reaches the comparison.
+		{"unknown id", "other-session", "real-secret"},
+		{"empty id", "", "real-secret"},
+	}
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			r := httptest.NewRequest(http.MethodGet, "/", nil)
+			r.AddCookie(&http.Cookie{
+				Name:  "dex_session",
+				Value: internal.SessionCookieValue(tc.sessionID, tc.secret, nil),
+			})
+			w := httptest.NewRecorder()
+
+			session := s.Sessions.ValidSession(ctx, w, r)
+			assert.Nil(t, session, "forged cookie (%q, %q) should be rejected", tc.sessionID, tc.secret)
+
+			// Cookie should be cleared on nonce mismatch.
+			for _, c := range w.Result().Cookies() {
+				if c.Name == "dex_session" {
+					assert.Equal(t, -1, c.MaxAge, "cookie should be cleared")
+				}
+			}
+		})
+	}
+
+	t.Run("right id and secret accepted", func(t *testing.T) {
+		r := httptest.NewRequest(http.MethodGet, "/", nil)
+		r.AddCookie(&http.Cookie{
+			Name:  "dex_session",
+			Value: internal.SessionCookieValue("real-session", "real-secret", nil),
+		})
+		w := httptest.NewRecorder()
+
+		session := s.Sessions.ValidSession(ctx, w, r)
+		require.NotNil(t, session)
+		assert.Equal(t, "user-1", session.UserID)
+	})
+}
+
+// TestPromptNone tests the prompt=none silent authentication scenarios.
+// These verify the code paths in handleConnectorLogin (handlers.go:444-457)
+// where prompt=none requires session-based login without any UI.
+func TestPromptNone(t *testing.T) {
+	ctx := t.Context()
+
+	t.Run("valid session with consent issues code silently", func(t *testing.T) {
+		s := newTestSessionServer(t)
+		s.SkipApproval = false
+		authReq := setupSessionLoginFixture(t, s)
+		// Fixture already sets up Consents: {"client-1": {"openid", "email"}}
+		// and authReq.Scopes = {"openid", "email"} — consent is satisfied.
+
+		r := sessionCookieRequest("test-nonce")
+		w := httptest.NewRecorder()
+
+		session := s.Sessions.ValidAuthSession(ctx, w, r, &authReq)
+		require.NotNil(t, session)
+
+		ok := s.trySessionLoginWithSession(ctx, r, w, &authReq, session)
+		redirectURL := w.Header().Get("Location")
+		require.True(t, ok, "session login should succeed")
+		assert.Contains(t, redirectURL, "/auth?", "session login hands off to the dispatcher")
+	})
+
+	t.Run("valid session without consent returns approval URL", func(t *testing.T) {
+		s := newTestSessionServer(t)
+		s.SkipApproval = false
+		now := s.Now()
+
+		require.NoError(t, s.Storage.CreateAuthSession(ctx, storage.AuthSession{
+			UserID:      "user-1",
+			ConnectorID: "mock",
+			ID:          "test-nonce", Secret: "test-nonce",
+			ClientStates: map[string]*storage.ClientAuthState{
+				"client-1": {AuthenticatedAt: now.Add(-1 * time.Minute), LastActivity: now.Add(-1 * time.Minute)},
+			},
+			CreatedAt:      now.Add(-30 * time.Minute),
+			LastActivity:   now.Add(-1 * time.Minute),
+			AbsoluteExpiry: now.Add(24 * time.Hour),
+			IdleExpiry:     now.Add(59 * time.Minute),
+		}))
+		require.NoError(t, s.Storage.CreateUserIdentity(ctx, storage.UserIdentity{
+			UserID:      "user-1",
+			ConnectorID: "mock",
+			Claims:      storage.Claims{UserID: "user-1", Username: "testuser", Email: "test@example.com"},
+			Consents:    map[string][]string{}, // No consent for any client.
+			CreatedAt:   now.Add(-1 * time.Hour),
+			LastLogin:   now.Add(-30 * time.Minute),
+		}))
+
+		authReq := storage.AuthRequest{
+			ID:          storage.NewID(),
+			ClientID:    "client-1",
+			ConnectorID: "mock",
+			Scopes:      []string{"openid", "email"},
+			RedirectURI: "http://localhost/callback",
+			MaxAge:      -1,
+			HMACKey:     storage.NewHMACKey(crypto.SHA256),
+			Expiry:      now.Add(10 * time.Minute),
+		}
+		require.NoError(t, s.Storage.CreateAuthRequest(ctx, authReq))
+
+		r := sessionCookieRequest("test-nonce")
+		w := httptest.NewRecorder()
+
+		session := s.Sessions.ValidAuthSession(ctx, w, r, &authReq)
+		require.NotNil(t, session)
+
+		// In handleConnectorLogin, a non-empty redirectURL with prompt=none
+		// triggers oauth2.InteractionRequired ("Consent required").
+		ok := s.trySessionLoginWithSession(ctx, r, w, &authReq, session)
+		redirectURL := w.Header().Get("Location")
+		require.True(t, ok, "session login should succeed (user is authenticated)")
+		assert.Contains(t, redirectURL, "/auth?", "session login hands off to the dispatcher")
+	})
+
+	t.Run("no session returns false", func(t *testing.T) {
+		s := newTestSessionServer(t)
+		authReq := storage.AuthRequest{ConnectorID: "mock"}
+		r := httptest.NewRequest(http.MethodGet, "/", nil) // No cookie.
+		w := httptest.NewRecorder()
+
+		// In handleConnectorLogin, this triggers oauth2.LoginRequired.
+		ok := s.trySessionLogin(ctx, r, w, &authReq)
+		assert.False(t, ok, "should fail without session")
+	})
+
+	t.Run("SSO available issues code silently", func(t *testing.T) {
+		s := newTestSessionServer(t)
+		s.SkipApproval = true
+		now := s.Now()
+
+		require.NoError(t, s.Storage.CreateClient(ctx, storage.Client{
+			ID: "client-a", Secret: "secret", Name: "A", SSOSharedWith: []string{"client-b"},
+		}))
+
+		require.NoError(t, s.Storage.CreateAuthSession(ctx, storage.AuthSession{
+			UserID: "user-1", ConnectorID: "mock", ID: "test-nonce", Secret: "test-nonce",
+			ClientStates: map[string]*storage.ClientAuthState{
+				"client-a": {AuthenticatedAt: now.Add(-1 * time.Minute), LastActivity: now.Add(-1 * time.Minute)},
+			},
+			CreatedAt: now.Add(-30 * time.Minute), LastActivity: now.Add(-1 * time.Minute),
+			AbsoluteExpiry: now.Add(24 * time.Hour), IdleExpiry: now.Add(59 * time.Minute),
+		}))
+		require.NoError(t, s.Storage.CreateUserIdentity(ctx, storage.UserIdentity{
+			UserID: "user-1", ConnectorID: "mock",
+			Claims:    storage.Claims{UserID: "user-1", Username: "testuser", Email: "test@example.com"},
+			Consents:  map[string][]string{},
+			CreatedAt: now.Add(-1 * time.Hour), LastLogin: now.Add(-30 * time.Minute),
+		}))
+
+		authReq := storage.AuthRequest{
+			ID: storage.NewID(), ClientID: "client-b", ConnectorID: "mock",
+			Scopes: []string{"openid"}, RedirectURI: "http://localhost/callback",
+			MaxAge: -1, HMACKey: storage.NewHMACKey(crypto.SHA256), Expiry: now.Add(10 * time.Minute),
+		}
+		require.NoError(t, s.Storage.CreateAuthRequest(ctx, authReq))
+
+		r := sessionCookieRequest("test-nonce")
+		w := httptest.NewRecorder()
+
+		session := s.Sessions.ValidAuthSession(ctx, w, r, &authReq)
+		require.NotNil(t, session)
+
+		ok := s.trySessionLoginWithSession(ctx, r, w, &authReq, session)
+		redirectURL := w.Header().Get("Location")
+		require.True(t, ok, "SSO silent login should succeed")
+		assert.Contains(t, redirectURL, "/auth?", "session login hands off to the dispatcher")
+
+		// Verify SSO created a new client state.
+		updated, err := s.Storage.GetAuthSession(ctx, "test-nonce")
+		require.NoError(t, err)
+		assert.Contains(t, updated.ClientStates, "client-b", "SSO should create client state for target")
+	})
+
+	t.Run("MFA required returns redirect not silent", func(t *testing.T) {
+		// This is the prompt=none + MFA case: finishSessionLogin returns MFA redirect URL.
+		// In handleConnectorLogin, this is a successful (ok=true) redirect, not oauth2.LoginRequired.
+		s := newTestSessionServer(t)
+		s.SkipApproval = true
+		s.MFAEnabled = true
+
+		require.NoError(t, s.Storage.CreateConnector(ctx, storage.Connector{
+			ID: "mock", Type: "ldap", Name: "Mock", ResourceVersion: "1",
+		}))
+		s.Connectors.Set("mock", connectors.Connector{Type: "ldap", ResourceVersion: "1"})
+		require.NoError(t, s.Storage.CreateClient(ctx, storage.Client{
+			ID: "client-1", Secret: "secret", Name: "Test", MFAChain: []string{"totp"},
+		}))
+
+		authReq := setupSessionLoginFixture(t, s)
+
+		r := sessionCookieRequest("test-nonce")
+		w := httptest.NewRecorder()
+
+		ok := s.trySessionLogin(ctx, r, w, &authReq)
+		redirectURL := w.Header().Get("Location")
+		require.True(t, ok)
+		assert.Contains(t, redirectURL, "/auth?", "prompt=none with MFA should redirect to MFA page")
+	})
+}
+
+// TestPromptConsent tests that prompt=consent forces the approval screen
+// even when consent is already given.
+func TestPromptConsent(t *testing.T) {
+	ctx := t.Context()
+
+	t.Run("ForceApprovalPrompt overrides existing consent in session login", func(t *testing.T) {
+		s := newTestSessionServer(t)
+		s.SkipApproval = false
+		authReq := setupSessionLoginFixture(t, s)
+
+		// Set ForceApprovalPrompt (set by prompt=consent in parseAuthorizationRequest).
+		require.NoError(t, s.Storage.UpdateAuthRequest(ctx, authReq.ID, func(a storage.AuthRequest) (storage.AuthRequest, error) {
+			a.ForceApprovalPrompt = true
+			return a, nil
+		}))
+		authReq.ForceApprovalPrompt = true
+
+		r := sessionCookieRequest("test-nonce")
+		w := httptest.NewRecorder()
+
+		ok := s.trySessionLogin(ctx, r, w, &authReq)
+		redirectURL := w.Header().Get("Location")
+		require.True(t, ok)
+		assert.Contains(t, redirectURL, "/auth?", "session login hands off to the dispatcher")
+	})
+
+	t.Run("login+consent parsed correctly", func(t *testing.T) {
+		prompt, err := oauth2.ParsePrompt("login consent")
+		require.NoError(t, err)
+		assert.True(t, prompt.Login(), "login flag should be set")
+		assert.True(t, prompt.Consent(), "consent flag should be set")
+	})
+}
+
+// TestSSO_ConsentAndMFA tests SSO interactions with consent and MFA.
+func TestSSO_ConsentAndMFA(t *testing.T) {
+	ctx := t.Context()
+
+	// setupSSOFixture creates a two-client SSO scenario where client-a shares with client-b.
+	setupSSOFixture := func(t *testing.T, s *sessionTestServer, consentsForB []string) storage.AuthRequest {
+		t.Helper()
+		now := s.Now()
+
+		require.NoError(t, s.Storage.CreateClient(ctx, storage.Client{
+			ID: "client-a", Secret: "secret", Name: "A", SSOSharedWith: []string{"client-b"},
+		}))
+
+		require.NoError(t, s.Storage.CreateAuthSession(ctx, storage.AuthSession{
+			UserID: "user-1", ConnectorID: "mock", ID: "test-nonce", Secret: "test-nonce",
+			ClientStates: map[string]*storage.ClientAuthState{
+				"client-a": {AuthenticatedAt: now.Add(-1 * time.Minute), LastActivity: now.Add(-1 * time.Minute)},
+			},
+			CreatedAt: now.Add(-30 * time.Minute), LastActivity: now.Add(-1 * time.Minute),
+			AbsoluteExpiry: now.Add(24 * time.Hour), IdleExpiry: now.Add(59 * time.Minute),
+		}))
+
+		consents := map[string][]string{}
+		if len(consentsForB) > 0 {
+			consents["client-b"] = consentsForB
+		}
+		require.NoError(t, s.Storage.CreateUserIdentity(ctx, storage.UserIdentity{
+			UserID: "user-1", ConnectorID: "mock",
+			Claims:    storage.Claims{UserID: "user-1", Username: "testuser", Email: "test@example.com"},
+			Consents:  consents,
+			CreatedAt: now.Add(-1 * time.Hour), LastLogin: now.Add(-30 * time.Minute),
+		}))
+
+		authReq := storage.AuthRequest{
+			ID: storage.NewID(), ClientID: "client-b", ConnectorID: "mock",
+			Scopes: []string{"openid", "email"}, RedirectURI: "http://localhost/callback",
+			MaxAge: -1, HMACKey: storage.NewHMACKey(crypto.SHA256), Expiry: now.Add(10 * time.Minute),
+		}
+		require.NoError(t, s.Storage.CreateAuthRequest(ctx, authReq))
+		return authReq
+	}
+
+	t.Run("SSO without consent for target shows approval", func(t *testing.T) {
+		s := newTestSessionServer(t)
+		s.SkipApproval = false
+		authReq := setupSSOFixture(t, s, nil) // No consent for client-b.
+
+		r := sessionCookieRequest("test-nonce")
+		w := httptest.NewRecorder()
+
+		session := s.Sessions.ValidAuthSession(ctx, w, r, &authReq)
+		require.NotNil(t, session)
+
+		ok := s.trySessionLoginWithSession(ctx, r, w, &authReq, session)
+		redirectURL := w.Header().Get("Location")
+		require.True(t, ok, "SSO login should succeed")
+		assert.Contains(t, redirectURL, "/auth?", "session login hands off to the dispatcher")
+	})
+
+	t.Run("SSO with consent for target skips approval", func(t *testing.T) {
+		s := newTestSessionServer(t)
+		s.SkipApproval = false
+		authReq := setupSSOFixture(t, s, []string{"openid", "email"})
+
+		r := sessionCookieRequest("test-nonce")
+		w := httptest.NewRecorder()
+
+		session := s.Sessions.ValidAuthSession(ctx, w, r, &authReq)
+		require.NotNil(t, session)
+
+		ok := s.trySessionLoginWithSession(ctx, r, w, &authReq, session)
+		redirectURL := w.Header().Get("Location")
+		require.True(t, ok, "SSO login should succeed")
+		assert.Contains(t, redirectURL, "/auth?", "session login hands off to the dispatcher")
+	})
+
+	t.Run("SSO with MFA required on target client redirects to MFA", func(t *testing.T) {
+		s := newTestSessionServer(t)
+		s.SkipApproval = true
+		s.MFAEnabled = true
+
+		require.NoError(t, s.Storage.CreateConnector(ctx, storage.Connector{
+			ID: "mock", Type: "ldap", Name: "Mock", ResourceVersion: "1",
+		}))
+		s.Connectors.Set("mock", connectors.Connector{Type: "ldap", ResourceVersion: "1"})
+
+		// client-b requires MFA.
+		require.NoError(t, s.Storage.CreateClient(ctx, storage.Client{
+			ID: "client-b", Secret: "secret", Name: "B", MFAChain: []string{"totp"},
+		}))
+
+		authReq := setupSSOFixture(t, s, []string{"openid", "email"})
+
+		r := sessionCookieRequest("test-nonce")
+		w := httptest.NewRecorder()
+
+		session := s.Sessions.ValidAuthSession(ctx, w, r, &authReq)
+		require.NotNil(t, session)
+
+		ok := s.trySessionLoginWithSession(ctx, r, w, &authReq, session)
+		redirectURL := w.Header().Get("Location")
+		require.True(t, ok)
+		assert.Contains(t, redirectURL, "/auth?", "SSO to MFA-requiring client should redirect to MFA")
+	})
+
+	t.Run("SSO source without MFA target with MFA enforces MFA", func(t *testing.T) {
+		s := newTestSessionServer(t)
+		s.SkipApproval = true
+		s.MFAEnabled = true
+
+		require.NoError(t, s.Storage.CreateConnector(ctx, storage.Connector{
+			ID: "mock", Type: "ldap", Name: "Mock", ResourceVersion: "1",
+		}))
+		s.Connectors.Set("mock", connectors.Connector{Type: "ldap", ResourceVersion: "1"})
+
+		// client-a has NO MFA, client-b requires MFA.
+		require.NoError(t, s.Storage.CreateClient(ctx, storage.Client{
+			ID: "client-a", Secret: "secret", Name: "A", SSOSharedWith: []string{"client-b"},
+			MFAChain: []string{}, // Explicitly no MFA.
+		}))
+		require.NoError(t, s.Storage.CreateClient(ctx, storage.Client{
+			ID: "client-b", Secret: "secret", Name: "B",
+			MFAChain: []string{"totp"},
+		}))
+
+		now := s.Now()
+		require.NoError(t, s.Storage.CreateAuthSession(ctx, storage.AuthSession{
+			UserID: "user-1", ConnectorID: "mock", ID: "test-nonce", Secret: "test-nonce",
+			ClientStates: map[string]*storage.ClientAuthState{
+				"client-a": {AuthenticatedAt: now.Add(-1 * time.Minute), LastActivity: now.Add(-1 * time.Minute)},
+			},
+			CreatedAt: now.Add(-30 * time.Minute), LastActivity: now.Add(-1 * time.Minute),
+			AbsoluteExpiry: now.Add(24 * time.Hour), IdleExpiry: now.Add(59 * time.Minute),
+		}))
+		require.NoError(t, s.Storage.CreateUserIdentity(ctx, storage.UserIdentity{
+			UserID: "user-1", ConnectorID: "mock",
+			Claims:    storage.Claims{UserID: "user-1", Username: "testuser", Email: "test@example.com"},
+			Consents:  map[string][]string{},
+			CreatedAt: now.Add(-1 * time.Hour), LastLogin: now.Add(-30 * time.Minute),
+		}))
+
+		authReq := storage.AuthRequest{
+			ID: storage.NewID(), ClientID: "client-b", ConnectorID: "mock",
+			Scopes: []string{"openid"}, RedirectURI: "http://localhost/callback",
+			MaxAge: -1, HMACKey: storage.NewHMACKey(crypto.SHA256), Expiry: now.Add(10 * time.Minute),
+		}
+		require.NoError(t, s.Storage.CreateAuthRequest(ctx, authReq))
+
+		r := sessionCookieRequest("test-nonce")
+		w := httptest.NewRecorder()
+
+		session := s.Sessions.ValidAuthSession(ctx, w, r, &authReq)
+		require.NotNil(t, session)
+
+		ok := s.trySessionLoginWithSession(ctx, r, w, &authReq, session)
+		redirectURL := w.Header().Get("Location")
+		require.True(t, ok)
+		assert.Contains(t, redirectURL, "/auth?",
+			"SSO from no-MFA source to MFA-requiring target must enforce MFA")
+	})
+}
+
+// TestUpdateSessionTokenIssuedAt tests session activity tracking
+// when tokens are issued via sendCodeResponse (handlers.go:1016).
+func TestUpdateSessionTokenIssuedAt(t *testing.T) {
+	ctx := t.Context()
+
+	t.Run("updates session fields for correct client", func(t *testing.T) {
+		s := newTestSessionServer(t)
+		now := s.Now()
+
+		require.NoError(t, s.Storage.CreateAuthSession(ctx, storage.AuthSession{
+			UserID: "user-1", ConnectorID: "mock", ID: "test-nonce", Secret: "test-nonce",
+			ClientStates: map[string]*storage.ClientAuthState{
+				"client-1": {AuthenticatedAt: now.Add(-10 * time.Minute), LastActivity: now.Add(-10 * time.Minute)},
+				"client-2": {AuthenticatedAt: now.Add(-10 * time.Minute), LastActivity: now.Add(-10 * time.Minute)},
+			},
+			CreatedAt: now.Add(-1 * time.Hour), LastActivity: now.Add(-10 * time.Minute),
+			AbsoluteExpiry: now.Add(24 * time.Hour), IdleExpiry: now.Add(50 * time.Minute),
+		}))
+
+		r := sessionCookieRequest("test-nonce")
+		s.Sessions.UpdateTokenIssuedAt(r, "client-1")
+
+		session, err := s.Storage.GetAuthSession(ctx, "test-nonce")
+		require.NoError(t, err)
+
+		assert.Equal(t, now, session.LastActivity, "session LastActivity should be updated")
+		assert.Equal(t, s.Sessions.IdleExpiry(now), session.IdleExpiry, "IdleExpiry should be extended")
+		assert.Equal(t, now, session.ClientStates["client-1"].LastTokenIssuedAt, "client-1 LastTokenIssuedAt should be set")
+		assert.Equal(t, now, session.ClientStates["client-1"].LastActivity, "client-1 LastActivity should be updated")
+		// client-2 should be untouched.
+		assert.Equal(t, now.Add(-10*time.Minute), session.ClientStates["client-2"].LastActivity,
+			"client-2 should not be affected")
+	})
+
+	t.Run("noop when sessions disabled", func(t *testing.T) {
+		s := newTestSessionServer(t)
+		resetSessions(s, nil, url.URL{})
+
+		r := httptest.NewRequest(http.MethodGet, "/", nil)
+		// Should not panic.
+		s.Sessions.UpdateTokenIssuedAt(r, "any-client")
+	})
+}
+
+// TestIdleExpiryExtension verifies that session activity pushes
+// IdleExpiry forward, preventing premature session expiration.
+func TestIdleExpiryExtension(t *testing.T) {
+	ctx := t.Context()
+
+	t.Run("createOrUpdateAuthSession extends IdleExpiry", func(t *testing.T) {
+		s := newTestSessionServer(t)
+		now := s.Now()
+
+		// Create an existing session with IdleExpiry close to now.
+		require.NoError(t, s.Storage.CreateAuthSession(ctx, storage.AuthSession{
+			UserID: "user-1", ConnectorID: "mock", ID: "test-nonce", Secret: "test-nonce",
+			ClientStates:   map[string]*storage.ClientAuthState{},
+			CreatedAt:      now.Add(-50 * time.Minute),
+			LastActivity:   now.Add(-50 * time.Minute),
+			AbsoluteExpiry: now.Add(24 * time.Hour),
+			IdleExpiry:     now.Add(10 * time.Minute), // Only 10 minutes left.
+		}))
+
+		// The browser presents its cookie, so this is the same session continuing —
+		// without one it would be a new device and a new session.
+		r := sessionCookieRequest("test-nonce")
+		w := httptest.NewRecorder()
+		authReq := storage.AuthRequest{
+			ClientID: "client-1", ConnectorID: "mock",
+			Claims: storage.Claims{UserID: "user-1"},
+		}
+
+		err := s.Sessions.CreateOrUpdateAuthSession(ctx, r, w, authReq, false)
+		require.NoError(t, err)
+
+		session, err := s.Storage.GetAuthSession(ctx, "test-nonce")
+		require.NoError(t, err)
+		assert.Equal(t, s.Sessions.IdleExpiry(now), session.IdleExpiry,
+			"IdleExpiry should be reset to now + ValidIfNotUsedFor")
+	})
+
+	t.Run("finishSessionLogin extends IdleExpiry", func(t *testing.T) {
+		s := newTestSessionServer(t)
+		s.SkipApproval = true
+		now := s.Now()
+
+		require.NoError(t, s.Storage.CreateAuthSession(ctx, storage.AuthSession{
+			UserID: "user-1", ConnectorID: "mock", ID: "test-nonce", Secret: "test-nonce",
+			ClientStates: map[string]*storage.ClientAuthState{
+				"client-1": {AuthenticatedAt: now.Add(-50 * time.Minute), LastActivity: now.Add(-50 * time.Minute)},
+			},
+			CreatedAt: now.Add(-50 * time.Minute), LastActivity: now.Add(-50 * time.Minute),
+			AbsoluteExpiry: now.Add(24 * time.Hour),
+			IdleExpiry:     now.Add(10 * time.Minute), // About to expire.
+		}))
+		require.NoError(t, s.Storage.CreateUserIdentity(ctx, storage.UserIdentity{
+			UserID: "user-1", ConnectorID: "mock",
+			Claims:    storage.Claims{UserID: "user-1", Username: "testuser", Email: "test@example.com"},
+			Consents:  map[string][]string{},
+			CreatedAt: now.Add(-1 * time.Hour), LastLogin: now.Add(-50 * time.Minute),
+		}))
+
+		authReq := storage.AuthRequest{
+			ID: storage.NewID(), ClientID: "client-1", ConnectorID: "mock",
+			Scopes: []string{"openid"}, RedirectURI: "http://localhost/callback",
+			MaxAge: -1, HMACKey: storage.NewHMACKey(crypto.SHA256), Expiry: now.Add(10 * time.Minute),
+		}
+		require.NoError(t, s.Storage.CreateAuthRequest(ctx, authReq))
+
+		r := sessionCookieRequest("test-nonce")
+		w := httptest.NewRecorder()
+
+		session := s.Sessions.ValidAuthSession(ctx, w, r, &authReq)
+		require.NotNil(t, session)
+
+		ok := s.trySessionLoginWithSession(ctx, r, w, &authReq, session)
+		require.True(t, ok)
+
+		updated, err := s.Storage.GetAuthSession(ctx, "test-nonce")
+		require.NoError(t, err)
+		assert.Equal(t, s.Sessions.IdleExpiry(now), updated.IdleExpiry,
+			"IdleExpiry should be extended after session login")
+	})
+}
+
+// TestSSO_Unidirectional verifies that SSO sharing is one-way:
+// A sharing with B does NOT mean B shares with A.
+func TestSSO_Unidirectional(t *testing.T) {
+	ctx := t.Context()
+
+	setup := func(t *testing.T, s *sessionTestServer, loginClient, targetClient string) (storage.AuthRequest, *storage.AuthSession) {
+		t.Helper()
+		now := s.Now()
+
+		require.NoError(t, s.Storage.CreateAuthSession(ctx, storage.AuthSession{
+			UserID: "user-1", ConnectorID: "mock", ID: "test-nonce", Secret: "test-nonce",
+			ClientStates: map[string]*storage.ClientAuthState{
+				loginClient: {AuthenticatedAt: now.Add(-1 * time.Minute), LastActivity: now.Add(-1 * time.Minute)},
+			},
+			CreatedAt: now.Add(-30 * time.Minute), LastActivity: now.Add(-1 * time.Minute),
+			AbsoluteExpiry: now.Add(24 * time.Hour), IdleExpiry: now.Add(59 * time.Minute),
+		}))
+		require.NoError(t, s.Storage.CreateUserIdentity(ctx, storage.UserIdentity{
+			UserID: "user-1", ConnectorID: "mock",
+			Claims:    storage.Claims{UserID: "user-1", Username: "testuser", Email: "test@example.com"},
+			Consents:  map[string][]string{},
+			CreatedAt: now.Add(-1 * time.Hour), LastLogin: now.Add(-30 * time.Minute),
+		}))
+
+		authReq := storage.AuthRequest{
+			ID: storage.NewID(), ClientID: targetClient, ConnectorID: "mock",
+			Scopes: []string{"openid"}, RedirectURI: "http://localhost/callback",
+			MaxAge: -1, HMACKey: storage.NewHMACKey(crypto.SHA256), Expiry: now.Add(10 * time.Minute),
+		}
+		require.NoError(t, s.Storage.CreateAuthRequest(ctx, authReq))
+
+		r := sessionCookieRequest("test-nonce")
+		w := httptest.NewRecorder()
+		session := s.Sessions.ValidAuthSession(ctx, w, r, &authReq)
+		return authReq, session
+	}
+
+	t.Run("A shares with B, login A request B succeeds", func(t *testing.T) {
+		s := newTestSessionServer(t)
+		s.SkipApproval = true
+
+		require.NoError(t, s.Storage.CreateClient(ctx, storage.Client{
+			ID: "client-a", Secret: "s", Name: "A", SSOSharedWith: []string{"client-b"},
+		}))
+		require.NoError(t, s.Storage.CreateClient(ctx, storage.Client{
+			ID: "client-b", Secret: "s", Name: "B", SSOSharedWith: []string{}, // Does NOT share back.
+		}))
+
+		authReq, session := setup(t, s, "client-a", "client-b")
+		require.NotNil(t, session)
+
+		r := sessionCookieRequest("test-nonce")
+		w := httptest.NewRecorder()
+		ok := s.trySessionLoginWithSession(ctx, r, w, &authReq, session)
+		assert.True(t, ok, "A→B SSO should succeed")
+	})
+
+	t.Run("B does not share with A, login B request A fails", func(t *testing.T) {
+		s := newTestSessionServer(t)
+		s.SkipApproval = true
+
+		require.NoError(t, s.Storage.CreateClient(ctx, storage.Client{
+			ID: "client-a", Secret: "s", Name: "A", SSOSharedWith: []string{"client-b"},
+		}))
+		require.NoError(t, s.Storage.CreateClient(ctx, storage.Client{
+			ID: "client-b", Secret: "s", Name: "B", SSOSharedWith: []string{}, // Does NOT share.
+		}))
+
+		authReq, session := setup(t, s, "client-b", "client-a")
+		require.NotNil(t, session)
+
+		r := sessionCookieRequest("test-nonce")
+		w := httptest.NewRecorder()
+		ok := s.trySessionLoginWithSession(ctx, r, w, &authReq, session)
+		assert.False(t, ok, "B→A SSO should fail because B does not share with A")
+	})
+}
+
+// TestSSO_TransitiveTrustChain verifies SSO sharing does not chain: A shares
+// only with B and B shares only with C (A never shares with C), so a user
+// authenticated only to A must not be SSO'd into C via B.
+func TestSSO_TransitiveTrustChain(t *testing.T) {
+	ctx := t.Context()
+
+	s := newTestSessionServer(t)
+	s.SkipApproval = true
+	now := s.Now()
+
+	require.NoError(t, s.Storage.CreateClient(ctx, storage.Client{
+		ID: "client-a", Secret: "s", Name: "A", SSOSharedWith: []string{"client-b"},
+	}))
+	require.NoError(t, s.Storage.CreateClient(ctx, storage.Client{
+		ID: "client-b", Secret: "s", Name: "B", SSOSharedWith: []string{"client-c"},
+	}))
+	require.NoError(t, s.Storage.CreateClient(ctx, storage.Client{
+		ID: "client-c", Secret: "s", Name: "C", SSOSharedWith: []string{},
+	}))
+
+	// User authenticated only to A.
+	require.NoError(t, s.Storage.CreateAuthSession(ctx, storage.AuthSession{
+		UserID: "user-1", ConnectorID: "mock", ID: "test-nonce", Secret: "test-nonce",
+		ClientStates: map[string]*storage.ClientAuthState{
+			"client-a": {AuthenticatedAt: now.Add(-1 * time.Minute), LastActivity: now.Add(-1 * time.Minute)},
+		},
+		CreatedAt: now.Add(-30 * time.Minute), LastActivity: now.Add(-1 * time.Minute),
+		AbsoluteExpiry: now.Add(24 * time.Hour), IdleExpiry: now.Add(59 * time.Minute),
+	}))
+	require.NoError(t, s.Storage.CreateUserIdentity(ctx, storage.UserIdentity{
+		UserID: "user-1", ConnectorID: "mock",
+		Claims:    storage.Claims{UserID: "user-1", Username: "testuser", Email: "test@example.com"},
+		Consents:  map[string][]string{},
+		CreatedAt: now.Add(-1 * time.Hour), LastLogin: now.Add(-30 * time.Minute),
+	}))
+
+	tryLogin := func(target string) bool {
+		req := storage.AuthRequest{
+			ID: storage.NewID(), ClientID: target, ConnectorID: "mock",
+			Scopes: []string{"openid"}, RedirectURI: "http://localhost/callback",
+			MaxAge: -1, HMACKey: storage.NewHMACKey(crypto.SHA256), Expiry: now.Add(10 * time.Minute),
+		}
+		require.NoError(t, s.Storage.CreateAuthRequest(ctx, req))
+		r := sessionCookieRequest("test-nonce")
+		w := httptest.NewRecorder()
+		session := s.Sessions.ValidAuthSession(ctx, w, r, &req)
+		require.NotNil(t, session)
+		ok := s.trySessionLoginWithSession(ctx, r, w, &req, session)
+		return ok
+	}
+
+	// Hop 1: A→B succeeds and records an SSO-derived state for B.
+	require.True(t, tryLogin("client-b"), "A→B SSO should succeed")
+
+	// The derived B state must be marked ViaSSO, which is what makes it ineligible
+	// as a source below — assert it directly so a regression localizes here.
+	sess, err := s.Storage.GetAuthSession(ctx, "test-nonce")
+	require.NoError(t, err)
+	require.NotNil(t, sess.ClientStates["client-b"])
+	assert.True(t, sess.ClientStates["client-b"].ViaSSO, "B's SSO-derived state must be marked ViaSSO")
+
+	// Hop 2: C has no eligible SSO source — A does not share with C and B's state
+	// is SSO-derived. Pin the exact invariant, then the login outcome.
+	assert.Nil(t, s.Sessions.FindSSO(ctx, &sess, "client-c"), "no eligible SSO source for C")
+	assert.False(t, tryLogin("client-c"), "transitive A→B→C SSO must be denied")
+}
+
+// TestRememberMeDefault tests that the rememberMeDefault helper
+// returns the correct value based on session configuration.
+func TestRememberMeDefault(t *testing.T) {
+	t.Run("sessions disabled returns nil", func(t *testing.T) {
+		s := &session.Manager{}
+		assert.Nil(t, s.RememberMeDefault())
+	})
+
+	t.Run("default false", func(t *testing.T) {
+		s := &session.Manager{Config: &session.Config{RememberMeCheckedByDefault: false}}
+		v := s.RememberMeDefault()
+		require.NotNil(t, v)
+		assert.False(t, *v)
+	})
+
+	t.Run("default true", func(t *testing.T) {
+		s := &session.Manager{Config: &session.Config{RememberMeCheckedByDefault: true}}
+		v := s.RememberMeDefault()
+		require.NotNil(t, v)
+		assert.True(t, *v)
+	})
+}
+
+// resetSessions rebuilds the Handler's session manager with the given config and
+// issuer, for tests that exercise Manager behavior under a different config.
+func resetSessions(s *sessionTestServer, cfg *session.Config, issuer url.URL) {
+	s.Sessions = &session.Manager{Storage: s.Storage, Config: cfg, Now: s.Now, Logger: slog.Default(), IssuerURL: oauth2.IssuerURL{URL: issuer}}
+}
diff --git a/server/authflow/urls.go b/server/authflow/urls.go
new file mode 100644
index 0000000000..78278ad0ce
--- /dev/null
+++ b/server/authflow/urls.go
@@ -0,0 +1,26 @@
+package authflow
+
+import (
+	"github.com/dexidp/dex/server/internal"
+	"github.com/dexidp/dex/storage"
+)
+
+// buildContinueURL builds the HMAC-protected URL that returns to the /auth
+// dispatcher, used once login completes so the dispatcher can pick the next step.
+func (h *Handler) buildContinueURL(authReq storage.AuthRequest) string {
+	return internal.StepURL(h.IssuerURL.AbsPath("/auth"), authReq, internal.StepContinue, nil)
+}
+
+// buildMFAURL builds the HMAC-protected URL of the MFA entry, where the
+// dispatcher sends the user when the client requires MFA. MFA resolves the
+// effective chain and picks the factor; the dispatcher only decides that MFA
+// applies.
+func (h *Handler) buildMFAURL(authReq storage.AuthRequest) string {
+	return internal.StepURL(h.IssuerURL.AbsPath("/mfa"), authReq, internal.StepMFA, nil)
+}
+
+// buildApprovalURL builds the HMAC-protected URL of the consent screen, where the
+// dispatcher sends the user when consent is required.
+func (h *Handler) buildApprovalURL(authReq storage.AuthRequest) string {
+	return internal.StepURL(h.IssuerURL.AbsPath("/approval"), authReq, internal.StepApproval, nil)
+}
diff --git a/server/backchannel/backchannel.go b/server/backchannel/backchannel.go
new file mode 100644
index 0000000000..d1ed698fa0
--- /dev/null
+++ b/server/backchannel/backchannel.go
@@ -0,0 +1,203 @@
+package backchannel
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"log/slog"
+	"maps"
+	"net/http"
+	"net/url"
+	"slices"
+	"strings"
+	"sync"
+	"time"
+
+	"github.com/google/uuid"
+
+	"github.com/dexidp/dex/server/internal"
+	"github.com/dexidp/dex/server/oauth2"
+	"github.com/dexidp/dex/server/signer"
+	"github.com/dexidp/dex/storage"
+)
+
+const (
+	// backchannelLogoutEvent is the event identifier a logout token must carry, per
+	// OIDC Back-Channel Logout 1.0 §2.4.
+	backchannelLogoutEvent = "http://schemas.openid.net/event/backchannel-logout"
+
+	// backchannelTokenLifetime bounds the replay window for a logout token. The spec
+	// recommends no more than two minutes.
+	backchannelTokenLifetime = 2 * time.Minute
+
+	// backchannelTimeout caps how long dex waits on one RP. Logout must not hang on a
+	// wedged relying party.
+	backchannelTimeout = 5 * time.Second
+)
+
+// Notifier posts logout tokens to the relying parties of a session that has ended.
+//
+// It lives outside server/logout because a session also ends by an operator's hand
+// over the gRPC API, and every path that ends one goes through here.
+type Notifier struct {
+	Storage   storage.Storage
+	Signer    signer.Signer
+	IssuerURL oauth2.IssuerURL
+	Logger    *slog.Logger
+
+	// Now is the clock, for tests. Defaults to time.Now.
+	Now func() time.Time
+
+	// HTTPClient delivers the logout tokens. Defaults to one that refuses redirects.
+	HTTPClient *http.Client
+}
+
+// logoutTokenClaims is the JWT dex POSTs to a relying party's backchannel_logout_uri.
+//
+// Note the absences: there is no "nonce" (the spec forbids it, to keep a logout token
+// from being mistaken for an ID token) and no "events" payload beyond an empty object.
+type logoutTokenClaims struct {
+	Issuer    string                     `json:"iss"`
+	Subject   string                     `json:"sub"`
+	Audience  string                     `json:"aud"`
+	IssuedAt  int64                      `json:"iat"`
+	Expiry    int64                      `json:"exp"`
+	JWTID     string                     `json:"jti"`
+	SessionID string                     `json:"sid"`
+	Events    map[string]json.RawMessage `json:"events"`
+}
+
+// Notify tells every relying party in the session that it is over.
+//
+// Delivery is best-effort and fire-and-forget: RP-Initiated Logout treats notifying
+// other RPs as a courtesy, and a relying party that is down must not be able to block
+// or fail the user's logout. Failures are logged and dropped.
+//
+// ponytail: no retries and no durable queue. An RP that is unreachable for these few
+// seconds keeps its session until it expires on its own. If that becomes a real
+// problem, the upgrade path is to persist pending notifications and drain them from
+// the garbage collector, not to make the user wait here.
+func (n *Notifier) Notify(ctx context.Context, authSession *storage.AuthSession) {
+	if len(authSession.ClientStates) == 0 {
+		return
+	}
+
+	subject, err := internal.Marshal(&internal.IDTokenSubject{
+		UserId: authSession.UserID,
+		ConnId: authSession.ConnectorID,
+	})
+	if err != nil {
+		n.Logger.ErrorContext(ctx, "logout: failed to marshal backchannel subject", "err", err)
+		return
+	}
+
+	sid := authSession.ID
+	clientIDs := slices.Sorted(maps.Keys(authSession.ClientStates))
+
+	// Read above while the session is still in hand: the caller deletes it the moment
+	// this returns. Delivery runs off the request — one wedged relying party would
+	// otherwise hold the user's redirect for the whole timeout — so it gets a context
+	// that outlives the one dying at that redirect.
+	ctx = context.WithoutCancel(ctx)
+	go func() {
+		ctx, cancel := context.WithTimeout(ctx, backchannelTimeout)
+		defer cancel()
+
+		var wg sync.WaitGroup
+		for _, clientID := range clientIDs {
+			wg.Go(func() {
+				client, err := n.Storage.GetClient(ctx, clientID)
+				if err != nil {
+					n.Logger.DebugContext(ctx, "logout: backchannel skipped, client not found",
+						"client_id", clientID, "err", err)
+					return
+				}
+				if client.BackchannelLogoutURI == "" {
+					return
+				}
+				n.deliverLogoutToken(ctx, client, subject, sid)
+			})
+		}
+		wg.Wait()
+	}()
+}
+
+// deliverLogoutToken mints a logout token for one client and POSTs it.
+func (n *Notifier) deliverLogoutToken(ctx context.Context, client storage.Client, subject, sid string) {
+	token, err := n.signLogoutToken(ctx, client.ID, subject, sid)
+	if err != nil {
+		n.Logger.ErrorContext(ctx, "logout: failed to sign logout token",
+			"client_id", client.ID, "err", err)
+		return
+	}
+
+	body := url.Values{"logout_token": {token}}.Encode()
+	req, err := http.NewRequestWithContext(ctx, http.MethodPost, client.BackchannelLogoutURI, strings.NewReader(body))
+	if err != nil {
+		n.Logger.ErrorContext(ctx, "logout: failed to build backchannel request",
+			"client_id", client.ID, "err", err)
+		return
+	}
+	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+	req.Header.Set("Cache-Control", "no-cache, no-store")
+
+	resp, err := n.client().Do(req)
+	if err != nil {
+		n.Logger.WarnContext(ctx, "logout: backchannel delivery failed",
+			"client_id", client.ID, "uri", client.BackchannelLogoutURI, "err", err)
+		return
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode < 200 || resp.StatusCode >= 300 {
+		n.Logger.WarnContext(ctx, "logout: backchannel delivery rejected",
+			"client_id", client.ID, "uri", client.BackchannelLogoutURI, "status", resp.StatusCode)
+		return
+	}
+
+	n.Logger.DebugContext(ctx, "logout: backchannel delivered", "client_id", client.ID)
+}
+
+// signLogoutToken builds and signs the logout token for one audience.
+func (n *Notifier) signLogoutToken(ctx context.Context, clientID, subject, sid string) (string, error) {
+	now := time.Now()
+	if n.Now != nil {
+		now = n.Now()
+	}
+
+	claims := logoutTokenClaims{
+		Issuer:    n.IssuerURL.String(),
+		Subject:   subject,
+		Audience:  clientID,
+		IssuedAt:  now.Unix(),
+		Expiry:    now.Add(backchannelTokenLifetime).Unix(),
+		JWTID:     uuid.New().String(),
+		SessionID: sid,
+		Events:    map[string]json.RawMessage{backchannelLogoutEvent: json.RawMessage(`{}`)},
+	}
+
+	payload, err := json.Marshal(claims)
+	if err != nil {
+		return "", fmt.Errorf("marshal logout token: %w", err)
+	}
+
+	token, err := n.Signer.Sign(ctx, payload)
+	if err != nil {
+		return "", fmt.Errorf("sign logout token: %w", err)
+	}
+	return token, nil
+}
+
+// client returns the HTTP client used for delivery, defaulting to one with
+// no redirect following: a logout token must reach the URI the client registered, not
+// wherever that URI happens to point today.
+func (n *Notifier) client() *http.Client {
+	if n.HTTPClient != nil {
+		return n.HTTPClient
+	}
+	return &http.Client{
+		CheckRedirect: func(*http.Request, []*http.Request) error {
+			return http.ErrUseLastResponse
+		},
+	}
+}
diff --git a/server/config.go b/server/config.go
new file mode 100644
index 0000000000..554d37ca07
--- /dev/null
+++ b/server/config.go
@@ -0,0 +1,293 @@
+package server
+
+import (
+	"errors"
+	"fmt"
+	"io/fs"
+	"log/slog"
+	"net/http"
+	"net/netip"
+	"net/url"
+	"os"
+	"sort"
+	"time"
+
+	gosundheit "github.com/AppsFlyer/go-sundheit"
+	"github.com/prometheus/client_golang/prometheus"
+
+	"github.com/dexidp/dex/server/authflow"
+	"github.com/dexidp/dex/server/mfa"
+	"github.com/dexidp/dex/server/oauth2"
+	"github.com/dexidp/dex/server/session"
+	"github.com/dexidp/dex/server/signer"
+	"github.com/dexidp/dex/server/templates"
+	"github.com/dexidp/dex/server/tokens"
+	"github.com/dexidp/dex/storage"
+	"github.com/dexidp/dex/web"
+)
+
+// Config holds the server's configuration options.
+//
+// Multiple servers using the same storage are expected to be configured identically.
+type Config struct {
+	Issuer string
+
+	// The backing persistence layer.
+	Storage storage.Storage
+
+	AllowedGrantTypes []string
+
+	// Valid values are "code" to enable the code flow and "token" to enable the implicit
+	// flow. If no response types are supplied this value defaults to "code".
+	SupportedResponseTypes []string
+
+	// Headers is a map of headers to be added to the all responses.
+	Headers http.Header
+
+	// Header to extract real ip from.
+	RealIPHeader       string
+	TrustedRealIPCIDRs []netip.Prefix
+
+	// List of allowed origins for CORS requests on discovery, token and keys endpoint.
+	// If none are indicated, CORS requests are disabled. Passing in "*" will allow any
+	// domain.
+	AllowedOrigins []string
+
+	// List of allowed headers for CORS requests on discovery, token, and keys endpoint.
+	AllowedHeaders []string
+
+	// If enabled, the server won't prompt the user to approve authorization requests.
+	// Logging in implies approval.
+	SkipApprovalScreen bool
+
+	// If enabled, the connectors selection page will always be shown even if there's only one
+	AlwaysShowLoginScreen bool
+
+	IDTokensValidFor       time.Duration // Defaults to 24 hours
+	AuthRequestsValidFor   time.Duration // Defaults to 24 hours
+	DeviceRequestsValidFor time.Duration // Defaults to 5 minutes
+
+	// Refresh token expiration settings
+	RefreshTokenPolicy *tokens.RefreshStrategy
+
+	// If set, the server will use this connector to handle password grants
+	PasswordConnector string
+
+	// PKCE configuration
+	PKCE authflow.PKCEConfig
+
+	GCFrequency time.Duration // Defaults to 5 minutes
+
+	// If specified, the server will use this function for determining time.
+	Now func() time.Time
+
+	Web WebConfig
+
+	Logger *slog.Logger
+
+	// Signer is used to sign tokens.
+	Signer signer.Signer
+
+	PrometheusRegistry *prometheus.Registry
+
+	HealthChecker gosundheit.Health
+
+	// If enabled, the server will continue starting even if some connectors fail to initialize.
+	// This allows the server to operate with a subset of connectors if some are misconfigured.
+	ContinueOnConnectorFailure bool
+
+	// SessionConfig holds session settings. Nil when sessions are disabled.
+	SessionConfig *session.Config
+
+	// MFAProviders maps authenticator IDs to their provider implementations.
+	MFAProviders map[string]mfa.Provider
+
+	// DefaultMFAChain is applied to clients that don't specify their own mfaChain.
+	DefaultMFAChain []string
+}
+
+// WebConfig holds the server's frontend templates and asset configuration.
+type WebConfig struct {
+	// A file path to static web assets.
+	//
+	// It is expected to contain the following directories:
+	//
+	//   * static - Static static served at "( issuer URL )/static".
+	//   * templates - HTML templates controlled by dex.
+	//   * themes/(theme) - Static static served at "( issuer URL )/theme".
+	Dir string
+
+	// Alternative way to programmatically configure static web assets.
+	// If Dir is specified, WebFS is ignored.
+	// It's expected to contain the same files and directories as mentioned above.
+	//
+	// Note: this is experimental. Might get removed without notice!
+	WebFS fs.FS
+
+	// Defaults to "( issuer URL )/theme/logo.png"
+	LogoURL string
+
+	// Defaults to "dex"
+	Issuer string
+
+	// Defaults to "light"
+	Theme string
+
+	// Map of extra values passed into the templates
+	Extra map[string]string
+}
+
+func value(val, defaultValue time.Duration) time.Duration {
+	if val == 0 {
+		return defaultValue
+	}
+	return val
+}
+
+// resolvedConfig is Config after defaults are filled in and values validated:
+// everything the handlers are wired from, derived once so newServer only has to
+// hand the pieces out.
+type resolvedConfig struct {
+	issuerURL oauth2.IssuerURL
+	now       func() time.Time
+
+	// responseTypes and grantTypes are what the server advertises and accepts,
+	// narrowed to the configured subset.
+	responseTypes map[string]bool
+	grantTypes    []string
+
+	authRequestsValidFor   time.Duration
+	deviceRequestsValidFor time.Duration
+	idTokensValidFor       time.Duration
+
+	templates *templates.Templates
+	static    http.Handler
+	theme     http.Handler
+	robots    http.HandlerFunc
+}
+
+// normalizeConfig validates c and derives everything the server is built from.
+// It fills c's own defaults in place (response types, allowed headers, PKCE
+// methods), because the handlers read those fields directly.
+func normalizeConfig(c *Config) (resolvedConfig, error) {
+	if c.Storage == nil {
+		return resolvedConfig{}, errors.New("server: storage cannot be nil")
+	}
+
+	issuerURL, err := url.Parse(c.Issuer)
+	if err != nil {
+		return resolvedConfig{}, fmt.Errorf("server: can't parse issuer URL")
+	}
+
+	if len(c.SupportedResponseTypes) == 0 {
+		c.SupportedResponseTypes = []string{oauth2.ResponseTypeCode}
+	}
+	if len(c.AllowedHeaders) == 0 {
+		c.AllowedHeaders = []string{"Authorization"}
+	}
+	if len(c.PKCE.CodeChallengeMethodsSupported) == 0 {
+		c.PKCE.CodeChallengeMethodsSupported = []string{oauth2.PKCEMethodS256, oauth2.PKCEMethodPlain}
+	}
+	for _, m := range c.PKCE.CodeChallengeMethodsSupported {
+		if m != oauth2.PKCEMethodS256 && m != oauth2.PKCEMethodPlain {
+			return resolvedConfig{}, fmt.Errorf("unsupported PKCE challenge method %q", m)
+		}
+	}
+
+	responseTypes, grantTypes, err := supportedTypes(c)
+	if err != nil {
+		return resolvedConfig{}, err
+	}
+
+	static, theme, robots, tmpls, err := templates.LoadWebConfig(webConfig(c))
+	if err != nil {
+		return resolvedConfig{}, fmt.Errorf("server: failed to load web static: %v", err)
+	}
+
+	now := c.Now
+	if now == nil {
+		now = time.Now
+	}
+
+	return resolvedConfig{
+		issuerURL:              oauth2.IssuerURL{URL: *issuerURL},
+		now:                    now,
+		responseTypes:          responseTypes,
+		grantTypes:             grantTypes,
+		authRequestsValidFor:   value(c.AuthRequestsValidFor, 24*time.Hour),
+		deviceRequestsValidFor: value(c.DeviceRequestsValidFor, 5*time.Minute),
+		idTokensValidFor:       value(c.IDTokensValidFor, 24*time.Hour),
+		templates:              tmpls,
+		static:                 static,
+		theme:                  theme,
+		robots:                 robots,
+	}, nil
+}
+
+// supportedTypes resolves the response types the server accepts and the grant
+// types it advertises. A response type enabling the implicit flow adds the
+// implicit grant; AllowedGrantTypes, when set, narrows the result to it.
+func supportedTypes(c *Config) (map[string]bool, []string, error) {
+	allGrants := map[string]bool{
+		oauth2.GrantTypeAuthorizationCode: true,
+		oauth2.GrantTypeRefreshToken:      true,
+		oauth2.GrantTypeDeviceCode:        true,
+		oauth2.GrantTypeTokenExchange:     true,
+		oauth2.GrantTypeClientCredentials: true,
+	}
+	responseTypes := make(map[string]bool)
+
+	for _, respType := range c.SupportedResponseTypes {
+		switch respType {
+		case oauth2.ResponseTypeCode, oauth2.ResponseTypeIDToken, oauth2.ResponseTypeCodeIDToken:
+			// continue
+		case oauth2.ResponseTypeToken, oauth2.ResponseTypeCodeToken, oauth2.ResponseTypeIDTokenToken, oauth2.ResponseTypeCodeIDTokenToken:
+			// response_type=token is an implicit flow, let's add it to the discovery info
+			// https://datatracker.ietf.org/doc/html/rfc6749#section-4.2.1
+			allGrants[oauth2.GrantTypeImplicit] = true
+		default:
+			return nil, nil, fmt.Errorf("unsupported response_type %q", respType)
+		}
+		responseTypes[respType] = true
+	}
+
+	if c.PasswordConnector != "" {
+		allGrants[oauth2.GrantTypePassword] = true
+	}
+
+	var grantTypes []string
+	if len(c.AllowedGrantTypes) > 0 {
+		for _, grant := range c.AllowedGrantTypes {
+			if allGrants[grant] {
+				grantTypes = append(grantTypes, grant)
+			}
+		}
+	} else {
+		for grant := range allGrants {
+			grantTypes = append(grantTypes, grant)
+		}
+	}
+	sort.Strings(grantTypes)
+
+	return responseTypes, grantTypes, nil
+}
+
+// webConfig resolves where the frontend assets are loaded from: an explicit
+// directory, a caller-supplied filesystem, or the assets embedded in dex.
+func webConfig(c *Config) templates.Config {
+	webFS := web.FS()
+	if c.Web.Dir != "" {
+		webFS = os.DirFS(c.Web.Dir)
+	} else if c.Web.WebFS != nil {
+		webFS = c.Web.WebFS
+	}
+
+	return templates.Config{
+		WebFS:     webFS,
+		LogoURL:   c.Web.LogoURL,
+		IssuerURL: c.Issuer,
+		Issuer:    c.Web.Issuer,
+		Theme:     c.Web.Theme,
+		Extra:     c.Web.Extra,
+	}
+}
diff --git a/server/config_test.go b/server/config_test.go
new file mode 100644
index 0000000000..b62df7615a
--- /dev/null
+++ b/server/config_test.go
@@ -0,0 +1,117 @@
+package server
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/require"
+
+	"github.com/dexidp/dex/server/oauth2"
+	"github.com/dexidp/dex/storage/memory"
+)
+
+// baseConfig is the minimum normalizeConfig accepts: storage and an issuer.
+// Building it needs no server, so the config rules can be tested on their own.
+func baseConfig(t *testing.T) Config {
+	return Config{
+		Issuer:  "https://dex.example.com",
+		Storage: memory.New(newLogger(t)),
+		Web:     WebConfig{Dir: "../web"},
+	}
+}
+
+func TestNormalizeConfigDefaults(t *testing.T) {
+	c := baseConfig(t)
+
+	rc, err := normalizeConfig(&c)
+	require.NoError(t, err)
+
+	require.Equal(t, []string{oauth2.ResponseTypeCode}, c.SupportedResponseTypes)
+	require.Equal(t, []string{"Authorization"}, c.AllowedHeaders)
+	require.Equal(t, []string{oauth2.PKCEMethodS256, oauth2.PKCEMethodPlain}, c.PKCE.CodeChallengeMethodsSupported)
+
+	require.Equal(t, "https://dex.example.com", rc.issuerURL.String())
+	require.NotNil(t, rc.now)
+	require.NotNil(t, rc.templates)
+	require.Equal(t, map[string]bool{oauth2.ResponseTypeCode: true}, rc.responseTypes)
+
+	// Without AllowedGrantTypes every implemented grant is advertised, sorted,
+	// and the implicit grant is absent because no implicit response type is set.
+	// Sorted by value, so the two grant-type URNs come last.
+	require.Equal(t, []string{
+		oauth2.GrantTypeAuthorizationCode,
+		oauth2.GrantTypeClientCredentials,
+		oauth2.GrantTypeRefreshToken,
+		oauth2.GrantTypeDeviceCode,
+		oauth2.GrantTypeTokenExchange,
+	}, rc.grantTypes)
+}
+
+func TestNormalizeConfigGrantTypes(t *testing.T) {
+	t.Run("an implicit response type adds the implicit grant", func(t *testing.T) {
+		c := baseConfig(t)
+		c.SupportedResponseTypes = []string{oauth2.ResponseTypeCode, oauth2.ResponseTypeToken}
+
+		rc, err := normalizeConfig(&c)
+		require.NoError(t, err)
+		require.Contains(t, rc.grantTypes, oauth2.GrantTypeImplicit)
+	})
+
+	t.Run("a password connector adds the password grant", func(t *testing.T) {
+		c := baseConfig(t)
+		c.PasswordConnector = "local"
+
+		rc, err := normalizeConfig(&c)
+		require.NoError(t, err)
+		require.Contains(t, rc.grantTypes, oauth2.GrantTypePassword)
+	})
+
+	t.Run("AllowedGrantTypes narrows the set", func(t *testing.T) {
+		c := baseConfig(t)
+		c.AllowedGrantTypes = []string{oauth2.GrantTypeRefreshToken, "not-a-grant"}
+
+		rc, err := normalizeConfig(&c)
+		require.NoError(t, err)
+		require.Equal(t, []string{oauth2.GrantTypeRefreshToken}, rc.grantTypes)
+	})
+}
+
+func TestNormalizeConfigRejects(t *testing.T) {
+	tests := []struct {
+		name   string
+		mutate func(*Config)
+		errMsg string
+	}{
+		{
+			name:   "nil storage",
+			mutate: func(c *Config) { c.Storage = nil },
+			errMsg: "storage cannot be nil",
+		},
+		{
+			name:   "unparseable issuer",
+			mutate: func(c *Config) { c.Issuer = "://" },
+			errMsg: "can't parse issuer URL",
+		},
+		{
+			name:   "unknown response type",
+			mutate: func(c *Config) { c.SupportedResponseTypes = []string{"nonsense"} },
+			errMsg: `unsupported response_type "nonsense"`,
+		},
+		{
+			name: "unknown PKCE method",
+			mutate: func(c *Config) {
+				c.PKCE.CodeChallengeMethodsSupported = []string{"S512"}
+			},
+			errMsg: `unsupported PKCE challenge method "S512"`,
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			c := baseConfig(t)
+			tc.mutate(&c)
+
+			_, err := normalizeConfig(&c)
+			require.ErrorContains(t, err, tc.errMsg)
+		})
+	}
+}
diff --git a/server/connector.go b/server/connector.go
new file mode 100644
index 0000000000..172031c68b
--- /dev/null
+++ b/server/connector.go
@@ -0,0 +1,46 @@
+package server
+
+import (
+	"github.com/dexidp/dex/connector/atlassiancrowd"
+	"github.com/dexidp/dex/connector/authproxy"
+	"github.com/dexidp/dex/connector/bitbucketcloud"
+	"github.com/dexidp/dex/connector/gitea"
+	"github.com/dexidp/dex/connector/github"
+	"github.com/dexidp/dex/connector/gitlab"
+	"github.com/dexidp/dex/connector/google"
+	"github.com/dexidp/dex/connector/keystone"
+	"github.com/dexidp/dex/connector/ldap"
+	"github.com/dexidp/dex/connector/linkedin"
+	"github.com/dexidp/dex/connector/microsoft"
+	"github.com/dexidp/dex/connector/mock"
+	"github.com/dexidp/dex/connector/oauth"
+	"github.com/dexidp/dex/connector/oidc"
+	"github.com/dexidp/dex/connector/openshift"
+	"github.com/dexidp/dex/connector/saml"
+	"github.com/dexidp/dex/server/connectors"
+)
+
+// ConnectorsConfig maps each built-in connector type to its config factory. It
+// is handed to connectors.Resolver so the connectors package itself imports no
+// connector implementation; a library consumer can pass a different map.
+var ConnectorsConfig = map[string]func() connectors.ConnectorConfig{
+	"keystone":        func() connectors.ConnectorConfig { return new(keystone.Config) },
+	"mockCallback":    func() connectors.ConnectorConfig { return new(mock.CallbackConfig) },
+	"mockPassword":    func() connectors.ConnectorConfig { return new(mock.PasswordConfig) },
+	"ldap":            func() connectors.ConnectorConfig { return new(ldap.Config) },
+	"gitea":           func() connectors.ConnectorConfig { return new(gitea.Config) },
+	"github":          func() connectors.ConnectorConfig { return new(github.Config) },
+	"gitlab":          func() connectors.ConnectorConfig { return new(gitlab.Config) },
+	"google":          func() connectors.ConnectorConfig { return new(google.Config) },
+	"oidc":            func() connectors.ConnectorConfig { return new(oidc.Config) },
+	"oauth":           func() connectors.ConnectorConfig { return new(oauth.Config) },
+	"saml":            func() connectors.ConnectorConfig { return new(saml.Config) },
+	"authproxy":       func() connectors.ConnectorConfig { return new(authproxy.Config) },
+	"linkedin":        func() connectors.ConnectorConfig { return new(linkedin.Config) },
+	"microsoft":       func() connectors.ConnectorConfig { return new(microsoft.Config) },
+	"bitbucket-cloud": func() connectors.ConnectorConfig { return new(bitbucketcloud.Config) },
+	"openshift":       func() connectors.ConnectorConfig { return new(openshift.Config) },
+	"atlassian-crowd": func() connectors.ConnectorConfig { return new(atlassiancrowd.Config) },
+	// Keep around for backwards compatibility.
+	"samlExperimental": func() connectors.ConnectorConfig { return new(saml.Config) },
+}
diff --git a/server/connectors/connectors.go b/server/connectors/connectors.go
new file mode 100644
index 0000000000..a028d54945
--- /dev/null
+++ b/server/connectors/connectors.go
@@ -0,0 +1,115 @@
+package connectors
+
+import (
+	"context"
+	"fmt"
+	"sync"
+
+	"github.com/dexidp/dex/connector"
+	"github.com/dexidp/dex/storage"
+)
+
+// Connector is a connector with resource version metadata.
+type Connector struct {
+	Type            string
+	ResourceVersion string
+	Connector       connector.Connector
+	GrantTypes      []string
+}
+
+// ResolveFunc builds the underlying connector implementation for a stored
+// connector. The server injects it so that connector construction (the local
+// password DB and the connector-config registry) stays in the server package.
+type ResolveFunc func(storage.Connector) (connector.Connector, error)
+
+// Cache resolves connectors from storage and keeps the opened instances in
+// memory, refreshing an entry when its stored resource version changes. It is
+// the sole owner of the connector map and its mutex.
+type Cache struct {
+	mu      sync.Mutex
+	conns   map[string]Connector
+	storage storage.Storage
+	resolve ResolveFunc
+}
+
+// NewCache returns an empty cache backed by the given storage and resolver.
+func NewCache(storage storage.Storage, resolve ResolveFunc) *Cache {
+	return &Cache{
+		conns:   make(map[string]Connector),
+		storage: storage,
+		resolve: resolve,
+	}
+}
+
+// Open builds the connector for the given stored connector and records it in the
+// cache, replacing any existing entry for the same ID.
+func (c *Cache) Open(conn storage.Connector) (Connector, error) {
+	impl, err := c.resolve(conn)
+	if err != nil {
+		return Connector{}, fmt.Errorf("failed to open connector: %v", err)
+	}
+
+	opened := Connector{
+		Type:            conn.Type,
+		ResourceVersion: conn.ResourceVersion,
+		Connector:       impl,
+		GrantTypes:      conn.GrantTypes,
+	}
+
+	c.mu.Lock()
+	c.conns[conn.ID] = opened
+	c.mu.Unlock()
+
+	return opened, nil
+}
+
+// Set records an already-opened connector under the given id, replacing any
+// existing entry. It is used to inject connectors that are not built from stored
+// config (for example the built-in local connector, or mocks in tests).
+func (c *Cache) Set(id string, conn Connector) {
+	c.mu.Lock()
+	c.conns[id] = conn
+	c.mu.Unlock()
+}
+
+// Cached returns the connector currently held for id without consulting storage.
+func (c *Cache) Cached(id string) (Connector, bool) {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	conn, ok := c.conns[id]
+	return conn, ok
+}
+
+// Len reports the number of cached connectors.
+func (c *Cache) Len() int {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	return len(c.conns)
+}
+
+// Close removes the connector from the in-memory cache.
+func (c *Cache) Close(id string) {
+	c.mu.Lock()
+	delete(c.conns, id)
+	c.mu.Unlock()
+}
+
+// Get returns the connector with the given id, opening (or reopening) it when it
+// is missing from the cache or its stored resource version has changed.
+func (c *Cache) Get(ctx context.Context, id string) (Connector, error) {
+	storageConnector, err := c.storage.GetConnector(ctx, id)
+	if err != nil {
+		return Connector{}, fmt.Errorf("failed to get connector object from storage: %v", err)
+	}
+
+	c.mu.Lock()
+	conn, ok := c.conns[id]
+	c.mu.Unlock()
+
+	if !ok || storageConnector.ResourceVersion != conn.ResourceVersion {
+		// Not cached, or updated in storage since we last opened it.
+		return c.Open(storageConnector)
+	}
+
+	return conn, nil
+}
diff --git a/server/connectors/connectors_test.go b/server/connectors/connectors_test.go
new file mode 100644
index 0000000000..c035684e70
--- /dev/null
+++ b/server/connectors/connectors_test.go
@@ -0,0 +1,122 @@
+package connectors
+
+import (
+	"context"
+	"errors"
+	"log/slog"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+
+	"github.com/dexidp/dex/connector"
+	"github.com/dexidp/dex/storage"
+	"github.com/dexidp/dex/storage/memory"
+)
+
+// stubConn is a trivial connector.Connector (which is interface{}) tagged with
+// the version it was resolved from, so tests can tell reopens apart.
+type stubConn struct{ version string }
+
+func newTestCache(t *testing.T) (*Cache, storage.Storage, *int) {
+	t.Helper()
+	store := memory.New(slog.New(slog.DiscardHandler))
+	calls := 0
+	resolve := func(c storage.Connector) (connector.Connector, error) {
+		calls++
+		return stubConn{version: c.ResourceVersion}, nil
+	}
+	return NewCache(store, resolve), store, &calls
+}
+
+func TestGetOpensAndCaches(t *testing.T) {
+	ctx := context.Background()
+	cache, store, calls := newTestCache(t)
+
+	require.NoError(t, store.CreateConnector(ctx, storage.Connector{
+		ID: "c1", Type: "mock", ResourceVersion: "1", GrantTypes: []string{"authorization_code"},
+	}))
+
+	got, err := cache.Get(ctx, "c1")
+	require.NoError(t, err)
+	require.Equal(t, 1, *calls)
+	require.Equal(t, "mock", got.Type)
+	require.Equal(t, "1", got.ResourceVersion)
+	require.Equal(t, []string{"authorization_code"}, got.GrantTypes)
+	require.Equal(t, stubConn{version: "1"}, got.Connector)
+
+	// Second Get hits the cache; the connector is not resolved again.
+	got2, err := cache.Get(ctx, "c1")
+	require.NoError(t, err)
+	require.Equal(t, 1, *calls)
+	require.Equal(t, got, got2)
+}
+
+func TestGetReopensOnVersionChange(t *testing.T) {
+	ctx := context.Background()
+	cache, store, calls := newTestCache(t)
+
+	require.NoError(t, store.CreateConnector(ctx, storage.Connector{ID: "c1", Type: "mock", ResourceVersion: "1"}))
+	_, err := cache.Get(ctx, "c1")
+	require.NoError(t, err)
+	require.Equal(t, 1, *calls)
+
+	// A stored resource-version bump must invalidate the cached entry.
+	require.NoError(t, store.UpdateConnector(ctx, "c1", func(old storage.Connector) (storage.Connector, error) {
+		old.ResourceVersion = "2"
+		return old, nil
+	}))
+
+	got, err := cache.Get(ctx, "c1")
+	require.NoError(t, err)
+	require.Equal(t, 2, *calls)
+	require.Equal(t, "2", got.ResourceVersion)
+	require.Equal(t, stubConn{version: "2"}, got.Connector)
+}
+
+func TestGetNotFound(t *testing.T) {
+	ctx := context.Background()
+	cache, _, calls := newTestCache(t)
+
+	_, err := cache.Get(ctx, "missing")
+	require.Error(t, err)
+	require.Equal(t, 0, *calls)
+}
+
+func TestOpenResolveErrorNotCached(t *testing.T) {
+	store := memory.New(slog.New(slog.DiscardHandler))
+	cache := NewCache(store, func(storage.Connector) (connector.Connector, error) {
+		return nil, errors.New("boom")
+	})
+
+	_, err := cache.Open(storage.Connector{ID: "c1"})
+	require.Error(t, err)
+
+	_, ok := cache.Cached("c1")
+	require.False(t, ok)
+	require.Equal(t, 0, cache.Len())
+}
+
+func TestSetCachedCloseLen(t *testing.T) {
+	cache, _, _ := newTestCache(t)
+
+	require.Equal(t, 0, cache.Len())
+	_, ok := cache.Cached("c1")
+	require.False(t, ok)
+
+	cache.Set("c1", Connector{Type: "mock", ResourceVersion: "1", Connector: stubConn{version: "1"}})
+	cache.Set("c2", Connector{Type: "ldap"})
+	require.Equal(t, 2, cache.Len())
+
+	got, ok := cache.Cached("c1")
+	require.True(t, ok)
+	require.Equal(t, "mock", got.Type)
+
+	cache.Close("c1")
+	_, ok = cache.Cached("c1")
+	require.False(t, ok)
+	require.Equal(t, 1, cache.Len())
+
+	// Closing an unknown id is a no-op.
+	cache.Close("nope")
+	require.Equal(t, 1, cache.Len())
+}
diff --git a/server/connectors/doc.go b/server/connectors/doc.go
new file mode 100644
index 0000000000..942135c257
--- /dev/null
+++ b/server/connectors/doc.go
@@ -0,0 +1,2 @@
+// Package connectors holds the server's in-memory cache of opened connectors.
+package connectors
diff --git a/server/connectors/filter.go b/server/connectors/filter.go
new file mode 100644
index 0000000000..df23341715
--- /dev/null
+++ b/server/connectors/filter.go
@@ -0,0 +1,25 @@
+package connectors
+
+import "github.com/dexidp/dex/storage"
+
+// Filter returns the connectors allowed for a client. When allowedConnectors is
+// empty the list is returned unfiltered. It is the browser auth flow's counterpart
+// to ConnectorAllowed (which checks a single id).
+func Filter(conns []storage.Connector, allowedConnectors []string) []storage.Connector {
+	if len(allowedConnectors) == 0 {
+		return conns
+	}
+
+	allowed := make(map[string]bool, len(allowedConnectors))
+	for _, id := range allowedConnectors {
+		allowed[id] = true
+	}
+
+	filtered := make([]storage.Connector, 0, len(conns))
+	for _, c := range conns {
+		if allowed[c.ID] {
+			filtered = append(filtered, c)
+		}
+	}
+	return filtered
+}
diff --git a/server/connectors/filter_test.go b/server/connectors/filter_test.go
new file mode 100644
index 0000000000..0cc37950aa
--- /dev/null
+++ b/server/connectors/filter_test.go
@@ -0,0 +1,106 @@
+package connectors
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/require"
+
+	"github.com/dexidp/dex/storage"
+)
+
+func TestFilterConnectors(t *testing.T) {
+	connectors := []storage.Connector{
+		{ID: "github", Type: "github", Name: "GitHub"},
+		{ID: "google", Type: "oidc", Name: "Google"},
+		{ID: "ldap", Type: "ldap", Name: "LDAP"},
+	}
+
+	tests := []struct {
+		name              string
+		allowedConnectors []string
+		wantIDs           []string
+	}{
+		{
+			name:              "No filter - all connectors returned",
+			allowedConnectors: nil,
+			wantIDs:           []string{"github", "google", "ldap"},
+		},
+		{
+			name:              "Empty filter - all connectors returned",
+			allowedConnectors: []string{},
+			wantIDs:           []string{"github", "google", "ldap"},
+		},
+		{
+			name:              "Filter to one connector",
+			allowedConnectors: []string{"github"},
+			wantIDs:           []string{"github"},
+		},
+		{
+			name:              "Filter to two connectors",
+			allowedConnectors: []string{"github", "ldap"},
+			wantIDs:           []string{"github", "ldap"},
+		},
+		{
+			name:              "Filter with non-existent connector ID",
+			allowedConnectors: []string{"nonexistent"},
+			wantIDs:           []string{},
+		},
+		{
+			name:              "Filter with mix of valid and invalid IDs",
+			allowedConnectors: []string{"google", "nonexistent"},
+			wantIDs:           []string{"google"},
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			result := Filter(connectors, tc.allowedConnectors)
+			gotIDs := make([]string, len(result))
+			for i, c := range result {
+				gotIDs[i] = c.ID
+			}
+			require.Equal(t, tc.wantIDs, gotIDs)
+		})
+	}
+}
+
+func TestIsConnectorAllowed(t *testing.T) {
+	tests := []struct {
+		name              string
+		allowedConnectors []string
+		connectorID       string
+		want              bool
+	}{
+		{
+			name:              "No restrictions - all allowed",
+			allowedConnectors: nil,
+			connectorID:       "any",
+			want:              true,
+		},
+		{
+			name:              "Empty list - all allowed",
+			allowedConnectors: []string{},
+			connectorID:       "any",
+			want:              true,
+		},
+		{
+			name:              "Connector in allowed list",
+			allowedConnectors: []string{"github", "google"},
+			connectorID:       "github",
+			want:              true,
+		},
+		{
+			name:              "Connector not in allowed list",
+			allowedConnectors: []string{"github", "google"},
+			connectorID:       "ldap",
+			want:              false,
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			got := ConnectorAllowed(tc.allowedConnectors, tc.connectorID)
+			require.Equal(t, tc.want, got)
+		})
+	}
+}
diff --git a/server/connectors/password.go b/server/connectors/password.go
new file mode 100644
index 0000000000..8b5fb8ca1d
--- /dev/null
+++ b/server/connectors/password.go
@@ -0,0 +1,99 @@
+package connectors
+
+import (
+	"context"
+	"errors"
+	"fmt"
+
+	"golang.org/x/crypto/bcrypt"
+
+	"github.com/dexidp/dex/connector"
+	"github.com/dexidp/dex/server/passwords"
+	"github.com/dexidp/dex/storage"
+)
+
+// NewPasswordDB returns the built-in local password connector backed by the
+// password store. Resolver uses it for LocalConnector; it is exported so a
+// custom ResolveFunc can reuse it.
+func NewPasswordDB(s storage.Storage) interface {
+	connector.Connector
+	connector.PasswordConnector
+} {
+	return passwordDB{s}
+}
+
+type passwordDB struct {
+	s storage.Storage
+}
+
+func resolvePasswordName(p storage.Password) string {
+	if p.Name != "" {
+		return p.Name
+	}
+	return p.Username
+}
+
+func resolvePasswordEmailVerified(p storage.Password) bool {
+	if p.EmailVerified != nil {
+		return *p.EmailVerified
+	}
+	return true
+}
+
+func (db passwordDB) Login(ctx context.Context, s connector.Scopes, email, password string) (connector.Identity, bool, error) {
+	p, err := db.s.GetPassword(ctx, email)
+	if err != nil {
+		if err != storage.ErrNotFound {
+			return connector.Identity{}, false, fmt.Errorf("get password: %v", err)
+		}
+		return connector.Identity{}, false, nil
+	}
+	// This check prevents dex users from logging in using static passwords
+	// configured with hash costs that are too high or low.
+	if err := passwords.CheckCost(p.Hash); err != nil {
+		return connector.Identity{}, false, err
+	}
+	if err := bcrypt.CompareHashAndPassword(p.Hash, []byte(password)); err != nil {
+		return connector.Identity{}, false, nil
+	}
+	return connector.Identity{
+		UserID:            p.UserID,
+		Username:          resolvePasswordName(p),
+		PreferredUsername: p.PreferredUsername,
+		Email:             p.Email,
+		EmailVerified:     resolvePasswordEmailVerified(p),
+		Groups:            p.Groups,
+	}, true, nil
+}
+
+func (db passwordDB) Refresh(ctx context.Context, s connector.Scopes, identity connector.Identity) (connector.Identity, error) {
+	// If the user has been deleted, the refresh token will be rejected.
+	p, err := db.s.GetPassword(ctx, identity.Email)
+	if err != nil {
+		if err == storage.ErrNotFound {
+			return connector.Identity{}, errors.New("user not found")
+		}
+		return connector.Identity{}, fmt.Errorf("get password: %v", err)
+	}
+
+	// User removed but a new user with the same email exists.
+	if p.UserID != identity.UserID {
+		return connector.Identity{}, errors.New("user not found")
+	}
+
+	// If a user has updated their username, that will be reflected in the
+	// refreshed token.
+	//
+	// No other fields are expected to be refreshable as email is effectively used
+	// as an ID.
+	identity.Username = resolvePasswordName(p)
+	identity.PreferredUsername = p.PreferredUsername
+	identity.EmailVerified = resolvePasswordEmailVerified(p)
+	identity.Groups = p.Groups
+
+	return identity, nil
+}
+
+func (db passwordDB) Prompt() string {
+	return "Email Address"
+}
diff --git a/server/connectors/policy.go b/server/connectors/policy.go
new file mode 100644
index 0000000000..e70fcb4c32
--- /dev/null
+++ b/server/connectors/policy.go
@@ -0,0 +1,32 @@
+package connectors
+
+import (
+	"slices"
+
+	"github.com/dexidp/dex/server/oauth2"
+)
+
+// ConnectorGrantTypes is the set of grant types that can be restricted per connector.
+var ConnectorGrantTypes = map[string]bool{
+	oauth2.GrantTypeAuthorizationCode: true,
+	oauth2.GrantTypeRefreshToken:      true,
+	oauth2.GrantTypeImplicit:          true,
+	oauth2.GrantTypePassword:          true,
+	oauth2.GrantTypeDeviceCode:        true,
+	oauth2.GrantTypeTokenExchange:     true,
+}
+
+// GrantTypeAllowed reports whether grantType is allowed for a connector with the
+// given configured grant types. If none are configured, all are allowed.
+func GrantTypeAllowed(configuredTypes []string, grantType string) bool {
+	return len(configuredTypes) == 0 || slices.Contains(configuredTypes, grantType)
+}
+
+// ConnectorAllowed reports whether connectorID is in a client's allowed
+// connectors list. If the list is empty, all connectors are allowed.
+func ConnectorAllowed(allowedConnectors []string, connectorID string) bool {
+	if len(allowedConnectors) == 0 {
+		return true
+	}
+	return slices.Contains(allowedConnectors, connectorID)
+}
diff --git a/server/connectors/resolve.go b/server/connectors/resolve.go
new file mode 100644
index 0000000000..c9ee160fc0
--- /dev/null
+++ b/server/connectors/resolve.go
@@ -0,0 +1,57 @@
+package connectors
+
+import (
+	"encoding/json"
+	"fmt"
+	"log/slog"
+
+	"github.com/dexidp/dex/connector"
+	"github.com/dexidp/dex/storage"
+)
+
+// LocalConnector is the local passwordDB connector: an internal connector,
+// backed by the password store, that is not part of the injected config map.
+const LocalConnector = "local"
+
+// ConnectorConfig is a configuration that can open a connector.
+type ConnectorConfig interface {
+	Open(id string, logger *slog.Logger) (connector.Connector, error)
+}
+
+// Resolver returns a ResolveFunc that builds the underlying implementation for a
+// stored connector: the built-in local password DB (backed by storage), or a
+// connector from the given config map. The map is injected by the caller so this
+// package need not import any connector implementation — a library consumer can
+// pass its own set of connectors.
+func Resolver(store storage.Storage, logger *slog.Logger, configs map[string]func() ConnectorConfig) ResolveFunc {
+	return func(conn storage.Connector) (connector.Connector, error) {
+		if conn.Type == LocalConnector {
+			return NewPasswordDB(store), nil
+		}
+		return openConnector(logger, configs, conn)
+	}
+}
+
+// openConnector parses the stored config and opens the connector named by its type.
+func openConnector(logger *slog.Logger, configs map[string]func() ConnectorConfig, conn storage.Connector) (connector.Connector, error) {
+	var c connector.Connector
+
+	f, ok := configs[conn.Type]
+	if !ok {
+		return c, fmt.Errorf("unknown connector type %q", conn.Type)
+	}
+
+	connConfig := f()
+	if len(conn.Config) != 0 {
+		if err := json.Unmarshal(conn.Config, connConfig); err != nil {
+			return c, fmt.Errorf("parse connector config: %v", err)
+		}
+	}
+
+	c, err := connConfig.Open(conn.ID, logger)
+	if err != nil {
+		return c, fmt.Errorf("failed to create connector %s: %v", conn.ID, err)
+	}
+
+	return c, nil
+}
diff --git a/server/consent/consent.go b/server/consent/consent.go
new file mode 100644
index 0000000000..e69d5da3ec
--- /dev/null
+++ b/server/consent/consent.go
@@ -0,0 +1,145 @@
+package consent
+
+import (
+	"context"
+	"log/slog"
+	"net/http"
+
+	"github.com/dexidp/dex/server/internal"
+	"github.com/dexidp/dex/server/oauth2"
+	"github.com/dexidp/dex/server/router"
+	"github.com/dexidp/dex/server/session"
+	"github.com/dexidp/dex/server/templates"
+	"github.com/dexidp/dex/server/tokens"
+	"github.com/dexidp/dex/storage"
+)
+
+// Handler owns the consent step. The /auth dispatcher decides whether consent is
+// needed (via Satisfied) and, if so, routes to the approval screen here; on
+// approve it records the granted scopes and returns to the dispatcher with the
+// "approved" verifier. It holds no reference to the other flow steps.
+type Handler struct {
+	Storage      storage.Storage
+	Templates    *templates.Templates
+	Logger       *slog.Logger
+	IssuerURL    oauth2.IssuerURL
+	Sessions     *session.Manager
+	SkipApproval bool
+}
+
+// renderError renders a user-facing HTML error page.
+func (h *Handler) renderError(r *http.Request, w http.ResponseWriter, status int, description string) {
+	templates.RenderError(h.Templates, h.Logger, r, w, status, description)
+}
+
+// Mount registers the consent endpoint.
+func (h *Handler) Mount(mux router.Mux) {
+	mux.HandleFunc("/approval", h.handleApproval)
+}
+
+// buildApprovedURL builds the HMAC-protected URL that returns to the authorize
+// dispatcher (/auth) with the "approved" verifier, so the dispatcher knows the
+// user consented and can issue.
+func (h *Handler) buildApprovedURL(authReq storage.AuthRequest) string {
+	return internal.StepURL(h.IssuerURL.AbsPath("/auth"), authReq, internal.StepApproved, nil)
+}
+
+// Satisfied reports whether the approval screen can be skipped: the client did
+// not force it, and either approval is disabled server-wide or the user has
+// already consented to the requested scopes for this client. It is a package
+// function so the /auth dispatcher can decide consent from state without holding
+// the consent Handler.
+func Satisfied(ctx context.Context, store storage.Storage, skipApproval bool, authReq *storage.AuthRequest) bool {
+	if authReq.ForceApprovalPrompt {
+		return false
+	}
+	if skipApproval {
+		return true
+	}
+	ui, err := store.GetUserIdentity(ctx, authReq.Claims.UserID, authReq.ConnectorID)
+	return err == nil && scopesCoveredByConsent(ui.Consents[authReq.ClientID], authReq.Scopes)
+}
+
+func (h *Handler) handleApproval(w http.ResponseWriter, r *http.Request) {
+	ctx := r.Context()
+	macEncoded := r.FormValue("hmac")
+	if macEncoded == "" {
+		h.renderError(r, w, http.StatusUnauthorized, "Unauthorized request")
+		return
+	}
+	authReq, err := h.Storage.GetAuthRequest(ctx, r.FormValue("req"))
+	if err != nil {
+		if err == storage.ErrNotFound {
+			h.renderError(r, w, http.StatusBadRequest, "User session error.")
+			return
+		}
+		h.Logger.ErrorContext(ctx, "failed to get auth request", "err", err)
+		h.renderError(r, w, http.StatusInternalServerError, "Database error.")
+		return
+	}
+	if !authReq.LoggedIn {
+		h.Logger.ErrorContext(ctx, "auth request does not have an identity for approval")
+		h.renderError(r, w, http.StatusInternalServerError, "Login process not yet finalized.")
+		return
+	}
+
+	if !internal.VerifyStep(authReq, macEncoded, internal.StepApproval) {
+		h.renderError(r, w, http.StatusUnauthorized, "Unauthorized request")
+		return
+	}
+
+	switch r.Method {
+	case http.MethodGet:
+		// The dispatcher routes here only when consent is required, so just show
+		// the approval screen.
+		client, err := h.Storage.GetClient(ctx, authReq.ClientID)
+		if err != nil {
+			h.Logger.ErrorContext(ctx, "Failed to get client", "client_id", authReq.ClientID, "err", err)
+			h.renderError(r, w, http.StatusInternalServerError, "Failed to retrieve client.")
+			return
+		}
+		if err := h.Templates.Approval(r, w, authReq.ID, authReq.Claims.Username, client.Name, authReq.Scopes); err != nil {
+			h.Logger.ErrorContext(ctx, "server template error", "err", err)
+		}
+	case http.MethodPost:
+		if r.FormValue("approval") != "approve" {
+			h.renderError(r, w, http.StatusInternalServerError, "Approval rejected.")
+			return
+		}
+		// Persist the approved scopes so a future request skips consent, then return
+		// to the dispatcher with the "approved" verifier.
+		if h.Sessions.Enabled() {
+			if err := h.Storage.UpdateUserIdentity(ctx, authReq.Claims.UserID, authReq.ConnectorID, func(old storage.UserIdentity) (storage.UserIdentity, error) {
+				if old.Consents == nil {
+					old.Consents = make(map[string][]string)
+				}
+				old.Consents[authReq.ClientID] = authReq.Scopes
+				return old, nil
+			}); err != nil {
+				h.Logger.ErrorContext(ctx, "failed to update user identity consents", "err", err)
+			}
+		}
+		http.Redirect(w, r, h.buildApprovedURL(authReq), http.StatusSeeOther)
+	}
+}
+
+// scopesCoveredByConsent checks whether the approved scopes cover all requested
+// scopes. The openid scope is excluded from the comparison as it is a technical
+// scope that does not require user consent.
+func scopesCoveredByConsent(approved, requested []string) bool {
+	approvedSet := make(map[string]struct{}, len(approved))
+	for _, s := range approved {
+		approvedSet[s] = struct{}{}
+	}
+
+	for _, scope := range requested {
+		if scope == tokens.ScopeOpenID {
+			continue
+		}
+		if _, ok := approvedSet[scope]; !ok {
+			return false
+		}
+	}
+
+	return true
+}
diff --git a/server/consent/consent_test.go b/server/consent/consent_test.go
new file mode 100644
index 0000000000..4ac8a8a542
--- /dev/null
+++ b/server/consent/consent_test.go
@@ -0,0 +1,80 @@
+package consent
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestScopesCoveredByConsent(t *testing.T) {
+	tests := []struct {
+		name      string
+		approved  []string
+		requested []string
+		want      bool
+	}{
+		{
+			name:      "All scopes covered",
+			approved:  []string{"email", "profile"},
+			requested: []string{"openid", "email", "profile"},
+			want:      true,
+		},
+		{
+			name:      "Missing scope",
+			approved:  []string{"email"},
+			requested: []string{"openid", "email", "groups"},
+			want:      false,
+		},
+		{
+			name:      "Only openid scope skipped",
+			approved:  []string{},
+			requested: []string{"openid"},
+			want:      true,
+		},
+		{
+			name:      "offline_access requires consent",
+			approved:  []string{},
+			requested: []string{"openid", "offline_access"},
+			want:      false,
+		},
+		{
+			name:      "offline_access covered by consent",
+			approved:  []string{"offline_access"},
+			requested: []string{"openid", "offline_access"},
+			want:      true,
+		},
+		{
+			name:      "Nil approved",
+			approved:  nil,
+			requested: []string{"email"},
+			want:      false,
+		},
+		{
+			name:      "Empty requested",
+			approved:  []string{"email"},
+			requested: []string{},
+			want:      true,
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			got := scopesCoveredByConsent(tc.approved, tc.requested)
+			require.Equal(t, tc.want, got)
+		})
+	}
+}
+
+// TestConsentIsolatedBetweenClients verifies that consent given for
+// client-A does not satisfy scope check for client-B.
+func TestConsentIsolatedBetweenClients(t *testing.T) {
+	approvedForA := map[string][]string{"client-a": {"openid", "email"}}
+
+	// client-b should not have consent.
+	require.False(t, scopesCoveredByConsent(approvedForA["client-b"], []string{"openid", "email"}),
+		"consent for client-a should not cover client-b")
+
+	// client-a should have consent.
+	require.True(t, scopesCoveredByConsent(approvedForA["client-a"], []string{"openid", "email"}),
+		"consent for client-a should cover client-a's requested scopes")
+}
diff --git a/server/consent/doc.go b/server/consent/doc.go
new file mode 100644
index 0000000000..94dc27a3bd
--- /dev/null
+++ b/server/consent/doc.go
@@ -0,0 +1,9 @@
+// Package consent owns the approval (consent) step of the authorization flow:
+// the /approval endpoint, the consent screen, recording the user's consent, and
+// the decision of whether consent can be skipped.
+//
+// It is one of the shared flow steps (alongside mfa and issue): the browser
+// login flow and, conceptually, any other front-channel flow reach it once the
+// user is authenticated. When consent is granted (or already covered) it hands
+// off to the issue component to complete the authorization response.
+package consent
diff --git a/server/device/device.go b/server/device/device.go
new file mode 100644
index 0000000000..486d3297ae
--- /dev/null
+++ b/server/device/device.go
@@ -0,0 +1,432 @@
+package device
+
+import (
+	"context"
+	"crypto/subtle"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"log/slog"
+	"net/http"
+	"net/url"
+	"path"
+	"strconv"
+	"strings"
+	"time"
+
+	"github.com/dexidp/dex/server/connectors"
+	"github.com/dexidp/dex/server/grants"
+	"github.com/dexidp/dex/server/oauth2"
+	"github.com/dexidp/dex/server/router"
+	"github.com/dexidp/dex/server/templates"
+	"github.com/dexidp/dex/server/tokens"
+	"github.com/dexidp/dex/storage"
+)
+
+// DeviceCodeResponse is the device authorization response (RFC 8628 §3.2).
+type DeviceCodeResponse struct {
+	// The unique device code for device authentication
+	DeviceCode string `json:"device_code"`
+	// The code the user will exchange via a browser and log in
+	UserCode string `json:"user_code"`
+	// The url to verify the user code.
+	VerificationURI string `json:"verification_uri"`
+	// The verification uri with the user code appended for pre-filling form
+	VerificationURIComplete string `json:"verification_uri_complete"`
+	// The lifetime of the device code
+	ExpireTime int `json:"expires_in"`
+	// How often the device is allowed to poll to verify that the user login occurred
+	PollInterval int `json:"interval"`
+}
+
+// Handler serves the browser side of the device authorization grant.
+type Handler struct {
+	IssuerURL        oauth2.IssuerURL
+	Storage          storage.Storage
+	Templates        *templates.Templates
+	Now              func() time.Time
+	RequestsValidFor time.Duration
+	Logger           *slog.Logger
+
+	// Issuer mints the tokens, and Connectors resolves the connector, for the
+	// auth-code exchange the device flow shares with the authorization_code grant
+	// via grants.ExchangeAuthCode.
+	Issuer     *tokens.Issuer
+	Connectors *connectors.Cache
+}
+
+// Mount registers the device authorization routes.
+func (h *Handler) Mount(m router.Mux) {
+	m.HandleFunc("/device", h.handleDeviceExchange)
+	m.HandleFunc("/device/auth/verify_code", h.verifyUserCode)
+	m.HandleFunc("/device/code", h.handleDeviceCode)
+	m.HandleFunc(oauth2.DeviceCallbackURI, h.handleDeviceCallback)
+}
+
+// deviceFlowError is a failed step in the flow. A non-empty OAuth2 code makes the
+// handler write a JSON error response; otherwise the message is rendered as an
+// HTML error page.
+type deviceFlowError struct {
+	status  int
+	code    string
+	message string
+}
+
+func (h *Handler) writeFlowError(r *http.Request, w http.ResponseWriter, e *deviceFlowError) {
+	if e.code != "" {
+		h.writeError(w, e.code, e.message, e.status)
+		return
+	}
+	h.renderError(r, w, e.status, e.message)
+}
+
+// writeError writes a JSON OAuth2 error response.
+func (h *Handler) writeError(w http.ResponseWriter, typ, description string, statusCode int) {
+	oauth2.WriteErrorResponse(h.Logger, w, typ, description, statusCode)
+}
+
+// renderError renders an HTML error page.
+func (h *Handler) renderError(r *http.Request, w http.ResponseWriter, status int, description string) {
+	templates.RenderError(h.Templates, h.Logger, r, w, status, description)
+}
+
+func (h *Handler) getDeviceVerificationURI() string {
+	return h.IssuerURL.AbsPath("/device/auth/verify_code")
+}
+
+// handleDeviceExchange serves the /device user-code entry page.
+func (h *Handler) handleDeviceExchange(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodGet {
+		h.renderError(r, w, http.StatusBadRequest, "Requested resource does not exist.")
+		return
+	}
+
+	// If "user_code" is set, pre-populate the user code field. If "invalid" is
+	// set, show a message that the code was invalid or expired.
+	userCode := r.URL.Query().Get("user_code")
+	invalidAttempt, err := strconv.ParseBool(r.URL.Query().Get("invalid"))
+	if err != nil {
+		invalidAttempt = false
+	}
+	if err := h.Templates.Device(r, w, h.getDeviceVerificationURI(), userCode, invalidAttempt); err != nil {
+		h.Logger.ErrorContext(r.Context(), "server template error", "err", err)
+		h.renderError(r, w, http.StatusNotFound, "Page not found")
+	}
+}
+
+// deviceCodeRequest is a parsed /device/code authorization request.
+type deviceCodeRequest struct {
+	clientID     string
+	clientSecret string
+	scopes       []string
+	pkce         storage.PKCE
+}
+
+// parseDeviceCodeRequest parses and validates the /device/code form.
+func (h *Handler) parseDeviceCodeRequest(r *http.Request) (deviceCodeRequest, *deviceFlowError) {
+	if err := r.ParseForm(); err != nil {
+		h.Logger.ErrorContext(r.Context(), "could not parse Device Request body", "err", err)
+		return deviceCodeRequest{}, &deviceFlowError{status: http.StatusNotFound, code: oauth2.InvalidRequest}
+	}
+
+	method := r.Form.Get("code_challenge_method")
+	if method == "" {
+		method = oauth2.PKCEMethodPlain
+	}
+	if method != oauth2.PKCEMethodS256 && method != oauth2.PKCEMethodPlain {
+		return deviceCodeRequest{}, &deviceFlowError{
+			status:  http.StatusBadRequest,
+			code:    oauth2.InvalidRequest,
+			message: fmt.Sprintf("Unsupported PKCE challenge method (%q).", method),
+		}
+	}
+
+	scopes := strings.Fields(r.Form.Get("scope"))
+	if len(scopes) == 0 {
+		// per RFC 8628 §3.1 scope is optional, but dex requires at least 'openid'.
+		scopes = []string{"openid"}
+	}
+
+	return deviceCodeRequest{
+		clientID:     r.Form.Get("client_id"),
+		clientSecret: r.Form.Get("client_secret"),
+		scopes:       scopes,
+		pkce: storage.PKCE{
+			CodeChallenge:       r.Form.Get("code_challenge"),
+			CodeChallengeMethod: method,
+		},
+	}, nil
+}
+
+// createDeviceAuthorization mints and stores the device and user codes and builds
+// the authorization response the device polls against.
+func (h *Handler) createDeviceAuthorization(ctx context.Context, req deviceCodeRequest) (*DeviceCodeResponse, *deviceFlowError) {
+	h.Logger.InfoContext(ctx, "received device request", "client_id", req.clientID, "scoped", req.scopes)
+
+	deviceCode := storage.NewDeviceCode()
+	userCode := storage.NewUserCode()
+	expireTime := h.Now().Add(h.RequestsValidFor)
+
+	if err := h.Storage.CreateDeviceRequest(ctx, storage.DeviceRequest{
+		UserCode:     userCode,
+		DeviceCode:   deviceCode,
+		ClientID:     req.clientID,
+		ClientSecret: req.clientSecret,
+		Scopes:       req.scopes,
+		Expiry:       expireTime,
+	}); err != nil {
+		h.Logger.ErrorContext(ctx, "failed to store device request", "err", err)
+		return nil, &deviceFlowError{status: http.StatusInternalServerError, code: oauth2.InvalidRequest}
+	}
+
+	if err := h.Storage.CreateDeviceToken(ctx, storage.DeviceToken{
+		DeviceCode:          deviceCode,
+		Status:              oauth2.DeviceTokenPending,
+		Expiry:              expireTime,
+		LastRequestTime:     h.Now(),
+		PollIntervalSeconds: 0,
+		PKCE:                req.pkce,
+	}); err != nil {
+		h.Logger.ErrorContext(ctx, "failed to store device token", "err", err)
+		return nil, &deviceFlowError{status: http.StatusInternalServerError, code: oauth2.InvalidRequest}
+	}
+
+	u := h.IssuerURL
+	u.Path = path.Join(u.Path, "device")
+	vURI := u.String()
+
+	q := u.Query()
+	q.Set("user_code", userCode)
+	u.RawQuery = q.Encode()
+	vURIComplete := u.String()
+
+	return &DeviceCodeResponse{
+		DeviceCode:              deviceCode,
+		UserCode:                userCode,
+		VerificationURI:         vURI,
+		VerificationURIComplete: vURIComplete,
+		ExpireTime:              int(h.RequestsValidFor.Seconds()),
+		PollInterval:            5,
+	}, nil
+}
+
+func (h *Handler) handleDeviceCode(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodPost {
+		h.renderError(r, w, http.StatusBadRequest, "Invalid device code request type")
+		h.writeError(w, oauth2.InvalidRequest, "", http.StatusBadRequest)
+		return
+	}
+
+	req, ferr := h.parseDeviceCodeRequest(r)
+	if ferr != nil {
+		h.writeFlowError(r, w, ferr)
+		return
+	}
+
+	resp, ferr := h.createDeviceAuthorization(r.Context(), req)
+	if ferr != nil {
+		h.writeFlowError(r, w, ferr)
+		return
+	}
+
+	writeDeviceCodeResponse(w, resp)
+}
+
+// writeDeviceCodeResponse writes the device authorization response: it can carry
+// a cache-control header (RFC 8628 §3.2) and is JSON (RFC 6749 §5.1).
+func writeDeviceCodeResponse(w http.ResponseWriter, resp *DeviceCodeResponse) {
+	w.Header().Set("Cache-Control", "no-store")
+	w.Header().Set("Content-Type", "application/json")
+	json.NewEncoder(w).Encode(resp)
+}
+
+func (h *Handler) verifyUserCode(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodPost {
+		h.renderError(r, w, http.StatusBadRequest, "Requested resource does not exist.")
+		return
+	}
+	ctx := r.Context()
+
+	if err := r.ParseForm(); err != nil {
+		h.Logger.Warn("could not parse user code verification request body", "err", err)
+		h.renderError(r, w, http.StatusBadRequest, "")
+		return
+	}
+
+	userCode := r.Form.Get("user_code")
+	if userCode == "" {
+		h.renderError(r, w, http.StatusBadRequest, "No user code received")
+		return
+	}
+	userCode = strings.ToUpper(userCode)
+
+	// Find the user code among the outstanding requests.
+	deviceRequest, err := h.Storage.GetDeviceRequest(ctx, userCode)
+	if err != nil || h.Now().After(deviceRequest.Expiry) {
+		if err != nil && err != storage.ErrNotFound {
+			h.Logger.ErrorContext(ctx, "failed to get device request", "err", err)
+		}
+		if err := h.Templates.Device(r, w, h.getDeviceVerificationURI(), userCode, true); err != nil {
+			h.Logger.ErrorContext(ctx, "Server template error", "err", err)
+			h.renderError(r, w, http.StatusNotFound, "Page not found")
+		}
+		return
+	}
+
+	// Redirect to the dex auth endpoint, which sends the user back to the device
+	// callback once they authenticate.
+	u := h.IssuerURL
+	u.Path = path.Join(u.Path, "/auth")
+	q := u.Query()
+	q.Set("client_id", deviceRequest.ClientID)
+	// Do not put client_secret in this browser redirect: /auth is the
+	// authorization endpoint and never consumes it, so it would only leak the
+	// confidential secret into browser history, Referer, and access logs. The
+	// client is authenticated later in completeDeviceAuthorization against the
+	// stored device request.
+	q.Set("state", deviceRequest.UserCode)
+	q.Set("response_type", "code")
+	q.Set("redirect_uri", h.IssuerURL.AbsPath(oauth2.DeviceCallbackURI))
+	q.Set("scope", strings.Join(deviceRequest.Scopes, " "))
+	u.RawQuery = q.Encode()
+
+	http.Redirect(w, r, u.String(), http.StatusFound)
+}
+
+func (h *Handler) handleDeviceCallback(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodGet {
+		h.Logger.ErrorContext(r.Context(), "unsupported method in device callback", "method", r.Method)
+		h.renderError(r, w, http.StatusBadRequest, "Method not allowed.")
+		return
+	}
+
+	clientName, ferr := h.completeDeviceAuthorization(w, r)
+	if ferr != nil {
+		h.writeFlowError(r, w, ferr)
+		return
+	}
+
+	if err := h.Templates.DeviceSuccess(r, w, clientName); err != nil {
+		h.Logger.ErrorContext(r.Context(), "Server template error", "err", err)
+		h.renderError(r, w, http.StatusNotFound, "Page not found")
+	}
+}
+
+// completeDeviceAuthorization handles the browser callback: it exchanges the
+// authorization code for tokens and stores them against the device code so the
+// polling device_code grant can return them. It returns the client name for the
+// success page.
+func (h *Handler) completeDeviceAuthorization(w http.ResponseWriter, r *http.Request) (string, *deviceFlowError) {
+	ctx := r.Context()
+
+	userCode := r.FormValue("state")
+	code := r.FormValue("code")
+	if userCode == "" || code == "" {
+		return "", &deviceFlowError{status: http.StatusBadRequest, message: "Request was missing parameters"}
+	}
+
+	// Authorization redirect callback from the OAuth2 auth flow.
+	if errMsg := r.FormValue("error"); errMsg != "" {
+		// Log the error details but don't expose them to the user.
+		h.Logger.ErrorContext(ctx, "OAuth2 authorization error",
+			"error", errMsg,
+			"error_description", r.FormValue("error_description"))
+		return "", &deviceFlowError{status: http.StatusBadRequest, message: "Authorization failed. Please try again."}
+	}
+
+	authCode, err := h.Storage.GetAuthCode(ctx, code)
+	if err != nil || h.Now().After(authCode.Expiry) {
+		status := http.StatusBadRequest
+		if err != nil && err != storage.ErrNotFound {
+			h.Logger.ErrorContext(ctx, "failed to get auth code", "err", err)
+			status = http.StatusInternalServerError
+		}
+		return "", &deviceFlowError{status: status, message: "Invalid or expired auth code."}
+	}
+
+	deviceReq, err := h.Storage.GetDeviceRequest(ctx, userCode)
+	if err != nil || h.Now().After(deviceReq.Expiry) {
+		status := http.StatusBadRequest
+		if err != nil && err != storage.ErrNotFound {
+			h.Logger.ErrorContext(ctx, "failed to get device code", "err", err)
+			status = http.StatusInternalServerError
+		}
+		return "", &deviceFlowError{status: status, message: "Invalid or expired user code."}
+	}
+
+	// Bind the auth code to this device request: it must have been minted for the
+	// same client and issued to the device callback redirect. The authorization_code
+	// grant enforces the same client/redirect binding (see grants/authcode.go); the
+	// device callback must not skip it, or a code minted for one client could be
+	// redeemed against another client's device request (cross-client token theft).
+	// The redirect is matched on its parsed path suffix, mirroring how the auth flow
+	// recognizes the device callback: the issuer path prefix does not matter, and a
+	// "/device/callback" in the query string can not spoof it. A value that fails to
+	// parse is not a valid device redirect.
+	redirectURL, err := url.Parse(authCode.RedirectURI)
+	validRedirect := err == nil && strings.HasSuffix(redirectURL.Path, oauth2.DeviceCallbackURI)
+	if authCode.ClientID != deviceReq.ClientID || !validRedirect {
+		h.Logger.ErrorContext(ctx, "device callback: auth code does not match the device request",
+			"auth_code_client_id", authCode.ClientID, "device_client_id", deviceReq.ClientID)
+		return "", &deviceFlowError{status: http.StatusBadRequest, message: "Invalid or expired auth code."}
+	}
+
+	client, err := h.Storage.GetClient(ctx, deviceReq.ClientID)
+	if err != nil {
+		if err != storage.ErrNotFound {
+			h.Logger.ErrorContext(ctx, "failed to get client", "err", err)
+			return "", &deviceFlowError{status: http.StatusInternalServerError, code: oauth2.ServerError}
+		}
+		return "", &deviceFlowError{status: http.StatusUnauthorized, code: oauth2.InvalidClient, message: "Invalid client credentials."}
+	}
+	// Constant-time comparison of the client secret, matching grants.go's client
+	// authentication, so the compare does not leak the secret via timing.
+	if subtle.ConstantTimeCompare([]byte(client.Secret), []byte(deviceReq.ClientSecret)) != 1 {
+		return "", &deviceFlowError{status: http.StatusUnauthorized, code: oauth2.InvalidClient, message: "Invalid client credentials."}
+	}
+
+	// ExchangeAuthCode consumes the code (its atomic single-use gate) and returns
+	// what to issue; the tokens are minted here.
+	auth, withRefresh, err := grants.ExchangeAuthCode(ctx, h.Storage, h.Connectors, h.Logger, authCode, client)
+	if err != nil {
+		h.Logger.ErrorContext(ctx, "could not exchange auth code for client", "client_id", deviceReq.ClientID, "err", err)
+		return "", &deviceFlowError{status: http.StatusInternalServerError, message: "Failed to exchange auth code."}
+	}
+	resp, err := h.Issuer.IssueResponse(ctx, auth, authCode.ID, withRefresh)
+	if err != nil {
+		h.Logger.ErrorContext(ctx, "could not issue tokens for device flow", "client_id", deviceReq.ClientID, "err", err)
+		return "", &deviceFlowError{status: http.StatusInternalServerError, message: "Failed to exchange auth code."}
+	}
+
+	old, err := h.Storage.GetDeviceToken(ctx, deviceReq.DeviceCode)
+	if err != nil || h.Now().After(old.Expiry) {
+		status := http.StatusBadRequest
+		if err != nil && err != storage.ErrNotFound {
+			h.Logger.ErrorContext(ctx, "failed to get device token", "err", err)
+			status = http.StatusInternalServerError
+		}
+		return "", &deviceFlowError{status: status, message: "Invalid or expired device code."}
+	}
+
+	// Store the token against the device code and mark it complete.
+	updater := func(old storage.DeviceToken) (storage.DeviceToken, error) {
+		if old.Status == oauth2.DeviceTokenComplete {
+			return old, errors.New("device token already complete")
+		}
+		respStr, err := json.MarshalIndent(resp, "", "  ")
+		if err != nil {
+			h.Logger.ErrorContext(ctx, "failed to marshal device token response", "err", err)
+			h.renderError(r, w, http.StatusInternalServerError, "")
+			return old, err
+		}
+		old.Token = string(respStr)
+		old.Status = oauth2.DeviceTokenComplete
+		return old, nil
+	}
+	if err := h.Storage.UpdateDeviceToken(ctx, deviceReq.DeviceCode, updater); err != nil {
+		h.Logger.ErrorContext(ctx, "failed to update device token", "err", err)
+		return "", &deviceFlowError{status: http.StatusBadRequest, message: ""}
+	}
+
+	return client.Name, nil
+}
diff --git a/server/device/device_test.go b/server/device/device_test.go
new file mode 100644
index 0000000000..cdadbffead
--- /dev/null
+++ b/server/device/device_test.go
@@ -0,0 +1,59 @@
+package device
+
+import (
+	"io"
+	"log/slog"
+	"net/url"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/require"
+
+	"github.com/dexidp/dex/server/oauth2"
+	"github.com/dexidp/dex/storage/memory"
+)
+
+func TestGetDeviceVerificationURI(t *testing.T) {
+	u, err := url.Parse("https://dex.example.com/non-root-path")
+	require.NoError(t, err)
+
+	h := &Handler{IssuerURL: oauth2.IssuerURL{URL: *u}}
+	require.Equal(t, "/non-root-path/device/auth/verify_code", h.getDeviceVerificationURI())
+}
+
+// TestCreateDeviceAuthorizationUsesInjectedClock pins the device request and
+// token expiry to the handler's clock. Both were minted from a mix of
+// time.Now() and h.Now(), which made the two expiries drift apart under a
+// fixed test clock.
+func TestCreateDeviceAuthorizationUsesInjectedClock(t *testing.T) {
+	u, err := url.Parse("https://dex.example.com")
+	require.NoError(t, err)
+
+	fixed := time.Date(2020, 1, 1, 0, 0, 0, 0, time.UTC)
+	logger := slog.New(slog.NewTextHandler(io.Discard, nil))
+
+	h := &Handler{
+		IssuerURL:        oauth2.IssuerURL{URL: *u},
+		Storage:          memory.New(logger),
+		Logger:           logger,
+		Now:              func() time.Time { return fixed },
+		RequestsValidFor: 5 * time.Minute,
+	}
+
+	resp, ferr := h.createDeviceAuthorization(t.Context(), deviceCodeRequest{
+		clientID: "test",
+		scopes:   []string{"openid"},
+	})
+	require.Nil(t, ferr)
+
+	want := fixed.Add(5 * time.Minute)
+
+	req, err := h.Storage.GetDeviceRequest(t.Context(), resp.UserCode)
+	require.NoError(t, err)
+	require.WithinDuration(t, want, req.Expiry, 0)
+
+	token, err := h.Storage.GetDeviceToken(t.Context(), resp.DeviceCode)
+	require.NoError(t, err)
+	require.WithinDuration(t, want, token.Expiry, 0)
+	require.WithinDuration(t, fixed, token.LastRequestTime, 0)
+}
diff --git a/server/device/doc.go b/server/device/doc.go
new file mode 100644
index 0000000000..54749ff9ac
--- /dev/null
+++ b/server/device/doc.go
@@ -0,0 +1,6 @@
+// Package device implements the browser-facing side of the OAuth2 device
+// authorization grant (RFC 8628): the /device user-code entry page, the
+// /device/code authorization request, user-code verification, and the callback
+// that completes the flow. The device_code token grant that the device polls for
+// lives with the token endpoint.
+package device
diff --git a/server/deviceflowhandlers.go b/server/deviceflowhandlers.go
deleted file mode 100644
index 95fed3b3c3..0000000000
--- a/server/deviceflowhandlers.go
+++ /dev/null
@@ -1,444 +0,0 @@
-package server
-
-import (
-	"encoding/json"
-	"errors"
-	"fmt"
-	"net/http"
-	"net/url"
-	"path"
-	"strconv"
-	"strings"
-	"time"
-
-	"golang.org/x/net/html"
-
-	"github.com/dexidp/dex/pkg/log"
-	"github.com/dexidp/dex/storage"
-)
-
-type deviceCodeResponse struct {
-	// The unique device code for device authentication
-	DeviceCode string `json:"device_code"`
-	// The code the user will exchange via a browser and log in
-	UserCode string `json:"user_code"`
-	// The url to verify the user code.
-	VerificationURI string `json:"verification_uri"`
-	// The verification uri with the user code appended for pre-filling form
-	VerificationURIComplete string `json:"verification_uri_complete"`
-	// The lifetime of the device code
-	ExpireTime int `json:"expires_in"`
-	// How often the device is allowed to poll to verify that the user login occurred
-	PollInterval int `json:"interval"`
-}
-
-func (s *Server) getDeviceVerificationURI() string {
-	return path.Join(s.issuerURL.Path, "/device/auth/verify_code")
-}
-
-func (s *Server) handleDeviceExchange(w http.ResponseWriter, r *http.Request) {
-	switch r.Method {
-	case http.MethodGet:
-		// Grab the parameter(s) from the query.
-		// If "user_code" is set, pre-populate the user code text field.
-		// If "invalid" is set, set the invalidAttempt boolean, which will display a message to the user that they
-		// attempted to redeem an invalid or expired user code.
-		userCode := r.URL.Query().Get("user_code")
-		invalidAttempt, err := strconv.ParseBool(r.URL.Query().Get("invalid"))
-		if err != nil {
-			invalidAttempt = false
-		}
-		if err := s.templates.device(r, w, s.getDeviceVerificationURI(), userCode, invalidAttempt); err != nil {
-			s.logger.Errorf("Server template error: %v", err)
-			s.renderError(r, w, http.StatusNotFound, "Page not found")
-		}
-	default:
-		s.renderError(r, w, http.StatusBadRequest, "Requested resource does not exist.")
-	}
-}
-
-func (s *Server) handleDeviceCode(w http.ResponseWriter, r *http.Request) {
-	pollIntervalSeconds := 5
-
-	switch r.Method {
-	case http.MethodPost:
-		err := r.ParseForm()
-		if err != nil {
-			s.logger.Errorf("Could not parse Device Request body: %v", err)
-			s.tokenErrHelper(w, errInvalidRequest, "", http.StatusNotFound)
-			return
-		}
-
-		// Get the client id and scopes from the post
-		clientID := r.Form.Get("client_id")
-		clientSecret := r.Form.Get("client_secret")
-		scopes := strings.Fields(r.Form.Get("scope"))
-		codeChallenge := r.Form.Get("code_challenge")
-		codeChallengeMethod := r.Form.Get("code_challenge_method")
-
-		if codeChallengeMethod == "" {
-			codeChallengeMethod = codeChallengeMethodPlain
-		}
-		if codeChallengeMethod != codeChallengeMethodS256 && codeChallengeMethod != codeChallengeMethodPlain {
-			description := fmt.Sprintf("Unsupported PKCE challenge method (%q).", codeChallengeMethod)
-			s.tokenErrHelper(w, errInvalidRequest, description, http.StatusBadRequest)
-			return
-		}
-
-		s.logger.Infof("Received device request for client %v with scopes %v", clientID, scopes)
-
-		// Make device code
-		deviceCode := storage.NewDeviceCode()
-
-		// make user code
-		userCode := storage.NewUserCode()
-
-		// Generate the expire time
-		expireTime := time.Now().Add(s.deviceRequestsValidFor)
-
-		// Store the Device Request
-		deviceReq := storage.DeviceRequest{
-			UserCode:     userCode,
-			DeviceCode:   deviceCode,
-			ClientID:     clientID,
-			ClientSecret: clientSecret,
-			Scopes:       scopes,
-			Expiry:       expireTime,
-		}
-
-		if err := s.storage.CreateDeviceRequest(deviceReq); err != nil {
-			s.logger.Errorf("Failed to store device request; %v", err)
-			s.tokenErrHelper(w, errInvalidRequest, "", http.StatusInternalServerError)
-			return
-		}
-
-		// Store the device token
-		deviceToken := storage.DeviceToken{
-			DeviceCode:          deviceCode,
-			Status:              deviceTokenPending,
-			Expiry:              expireTime,
-			LastRequestTime:     s.now(),
-			PollIntervalSeconds: 0,
-			PKCE: storage.PKCE{
-				CodeChallenge:       codeChallenge,
-				CodeChallengeMethod: codeChallengeMethod,
-			},
-		}
-
-		if err := s.storage.CreateDeviceToken(deviceToken); err != nil {
-			s.logger.Errorf("Failed to store device token %v", err)
-			s.tokenErrHelper(w, errInvalidRequest, "", http.StatusInternalServerError)
-			return
-		}
-
-		u, err := url.Parse(s.issuerURL.String())
-		if err != nil {
-			s.logger.Errorf("Could not parse issuer URL %v", err)
-			s.tokenErrHelper(w, errInvalidRequest, "", http.StatusInternalServerError)
-			return
-		}
-		u.Path = path.Join(u.Path, "device")
-		vURI := u.String()
-
-		q := u.Query()
-		q.Set("user_code", userCode)
-		u.RawQuery = q.Encode()
-		vURIComplete := u.String()
-
-		code := deviceCodeResponse{
-			DeviceCode:              deviceCode,
-			UserCode:                userCode,
-			VerificationURI:         vURI,
-			VerificationURIComplete: vURIComplete,
-			ExpireTime:              int(s.deviceRequestsValidFor.Seconds()),
-			PollInterval:            pollIntervalSeconds,
-		}
-
-		// Device Authorization Response can contain cache control header according to
-		// https://tools.ietf.org/html/rfc8628#section-3.2
-		w.Header().Set("Cache-Control", "no-store")
-
-		// Response type should be application/json according to
-		// https://datatracker.ietf.org/doc/html/rfc6749#section-5.1
-		w.Header().Set("Content-Type", "application/json")
-
-		enc := json.NewEncoder(w)
-		enc.SetEscapeHTML(false)
-		enc.SetIndent("", "   ")
-		enc.Encode(code)
-
-	default:
-		s.renderError(r, w, http.StatusBadRequest, "Invalid device code request type")
-		s.tokenErrHelper(w, errInvalidRequest, "", http.StatusBadRequest)
-	}
-}
-
-func (s *Server) handleDeviceTokenDeprecated(w http.ResponseWriter, r *http.Request) {
-	log.Deprecated(s.logger, `The /device/token endpoint was called. It will be removed, use /token instead.`)
-
-	w.Header().Set("Content-Type", "application/json")
-	switch r.Method {
-	case http.MethodPost:
-		err := r.ParseForm()
-		if err != nil {
-			s.logger.Warnf("Could not parse Device Token Request body: %v", err)
-			s.tokenErrHelper(w, errInvalidRequest, "", http.StatusBadRequest)
-			return
-		}
-
-		grantType := r.PostFormValue("grant_type")
-		if grantType != grantTypeDeviceCode {
-			s.tokenErrHelper(w, errInvalidGrant, "", http.StatusBadRequest)
-			return
-		}
-
-		s.handleDeviceToken(w, r)
-	default:
-		s.renderError(r, w, http.StatusBadRequest, "Requested resource does not exist.")
-	}
-}
-
-func (s *Server) handleDeviceToken(w http.ResponseWriter, r *http.Request) {
-	deviceCode := r.Form.Get("device_code")
-	if deviceCode == "" {
-		s.tokenErrHelper(w, errInvalidRequest, "No device code received", http.StatusBadRequest)
-		return
-	}
-
-	now := s.now()
-
-	// Grab the device token, check validity
-	deviceToken, err := s.storage.GetDeviceToken(deviceCode)
-	if err != nil {
-		if err != storage.ErrNotFound {
-			s.logger.Errorf("failed to get device code: %v", err)
-		}
-		s.tokenErrHelper(w, errInvalidRequest, "Invalid Device code.", http.StatusBadRequest)
-		return
-	} else if now.After(deviceToken.Expiry) {
-		s.tokenErrHelper(w, deviceTokenExpired, "", http.StatusBadRequest)
-		return
-	}
-
-	// Rate Limiting check
-	slowDown := false
-	pollInterval := deviceToken.PollIntervalSeconds
-	minRequestTime := deviceToken.LastRequestTime.Add(time.Second * time.Duration(pollInterval))
-	if now.Before(minRequestTime) {
-		slowDown = true
-		// Continually increase the poll interval until the user waits the proper time
-		pollInterval += 5
-	} else {
-		pollInterval = 5
-	}
-
-	switch deviceToken.Status {
-	case deviceTokenPending:
-		updater := func(old storage.DeviceToken) (storage.DeviceToken, error) {
-			old.PollIntervalSeconds = pollInterval
-			old.LastRequestTime = now
-			return old, nil
-		}
-		// Update device token last request time in storage
-		if err := s.storage.UpdateDeviceToken(deviceCode, updater); err != nil {
-			s.logger.Errorf("failed to update device token: %v", err)
-			s.renderError(r, w, http.StatusInternalServerError, "")
-			return
-		}
-		if slowDown {
-			s.tokenErrHelper(w, deviceTokenSlowDown, "", http.StatusBadRequest)
-		} else {
-			s.tokenErrHelper(w, deviceTokenPending, "", http.StatusUnauthorized)
-		}
-	case deviceTokenComplete:
-		codeChallengeFromStorage := deviceToken.PKCE.CodeChallenge
-		providedCodeVerifier := r.Form.Get("code_verifier")
-
-		switch {
-		case providedCodeVerifier != "" && codeChallengeFromStorage != "":
-			calculatedCodeChallenge, err := s.calculateCodeChallenge(providedCodeVerifier, deviceToken.PKCE.CodeChallengeMethod)
-			if err != nil {
-				s.logger.Error(err)
-				s.tokenErrHelper(w, errServerError, "", http.StatusInternalServerError)
-				return
-			}
-			if codeChallengeFromStorage != calculatedCodeChallenge {
-				s.tokenErrHelper(w, errInvalidGrant, "Invalid code_verifier.", http.StatusBadRequest)
-				return
-			}
-		case providedCodeVerifier != "":
-			// Received no code_challenge on /auth, but a code_verifier on /token
-			s.tokenErrHelper(w, errInvalidRequest, "No PKCE flow started. Cannot check code_verifier.", http.StatusBadRequest)
-			return
-		case codeChallengeFromStorage != "":
-			// Received PKCE request on /auth, but no code_verifier on /token
-			s.tokenErrHelper(w, errInvalidGrant, "Expecting parameter code_verifier in PKCE flow.", http.StatusBadRequest)
-			return
-		}
-		w.Write([]byte(deviceToken.Token))
-	}
-}
-
-func (s *Server) handleDeviceCallback(w http.ResponseWriter, r *http.Request) {
-	switch r.Method {
-	case http.MethodGet:
-		userCode := r.FormValue("state")
-		code := r.FormValue("code")
-
-		if userCode == "" || code == "" {
-			s.renderError(r, w, http.StatusBadRequest, "Request was missing parameters")
-			return
-		}
-
-		// Authorization redirect callback from OAuth2 auth flow.
-		if errMsg := r.FormValue("error"); errMsg != "" {
-			// escape the message to prevent cross-site scripting
-			msg := html.EscapeString(errMsg + ": " + r.FormValue("error_description"))
-			http.Error(w, msg, http.StatusBadRequest)
-			return
-		}
-
-		authCode, err := s.storage.GetAuthCode(code)
-		if err != nil || s.now().After(authCode.Expiry) {
-			errCode := http.StatusBadRequest
-			if err != nil && err != storage.ErrNotFound {
-				s.logger.Errorf("failed to get auth code: %v", err)
-				errCode = http.StatusInternalServerError
-			}
-			s.renderError(r, w, errCode, "Invalid or expired auth code.")
-			return
-		}
-
-		// Grab the device request from storage
-		deviceReq, err := s.storage.GetDeviceRequest(userCode)
-		if err != nil || s.now().After(deviceReq.Expiry) {
-			errCode := http.StatusBadRequest
-			if err != nil && err != storage.ErrNotFound {
-				s.logger.Errorf("failed to get device code: %v", err)
-				errCode = http.StatusInternalServerError
-			}
-			s.renderError(r, w, errCode, "Invalid or expired user code.")
-			return
-		}
-
-		client, err := s.storage.GetClient(deviceReq.ClientID)
-		if err != nil {
-			if err != storage.ErrNotFound {
-				s.logger.Errorf("failed to get client: %v", err)
-				s.tokenErrHelper(w, errServerError, "", http.StatusInternalServerError)
-			} else {
-				s.tokenErrHelper(w, errInvalidClient, "Invalid client credentials.", http.StatusUnauthorized)
-			}
-			return
-		}
-		if client.Secret != deviceReq.ClientSecret {
-			s.tokenErrHelper(w, errInvalidClient, "Invalid client credentials.", http.StatusUnauthorized)
-			return
-		}
-
-		resp, err := s.exchangeAuthCode(w, authCode, client)
-		if err != nil {
-			s.logger.Errorf("Could not exchange auth code for client %q: %v", deviceReq.ClientID, err)
-			s.renderError(r, w, http.StatusInternalServerError, "Failed to exchange auth code.")
-			return
-		}
-
-		// Grab the device token from storage
-		old, err := s.storage.GetDeviceToken(deviceReq.DeviceCode)
-		if err != nil || s.now().After(old.Expiry) {
-			errCode := http.StatusBadRequest
-			if err != nil && err != storage.ErrNotFound {
-				s.logger.Errorf("failed to get device token: %v", err)
-				errCode = http.StatusInternalServerError
-			}
-			s.renderError(r, w, errCode, "Invalid or expired device code.")
-			return
-		}
-
-		updater := func(old storage.DeviceToken) (storage.DeviceToken, error) {
-			if old.Status == deviceTokenComplete {
-				return old, errors.New("device token already complete")
-			}
-			respStr, err := json.MarshalIndent(resp, "", "  ")
-			if err != nil {
-				s.logger.Errorf("failed to marshal device token response: %v", err)
-				s.renderError(r, w, http.StatusInternalServerError, "")
-				return old, err
-			}
-
-			old.Token = string(respStr)
-			old.Status = deviceTokenComplete
-			return old, nil
-		}
-
-		// Update refresh token in the storage, store the token and mark as complete
-		if err := s.storage.UpdateDeviceToken(deviceReq.DeviceCode, updater); err != nil {
-			s.logger.Errorf("failed to update device token: %v", err)
-			s.renderError(r, w, http.StatusBadRequest, "")
-			return
-		}
-
-		if err := s.templates.deviceSuccess(r, w, client.Name); err != nil {
-			s.logger.Errorf("Server template error: %v", err)
-			s.renderError(r, w, http.StatusNotFound, "Page not found")
-		}
-
-	default:
-		http.Error(w, fmt.Sprintf("method not implemented: %s", r.Method), http.StatusBadRequest)
-		return
-	}
-}
-
-func (s *Server) verifyUserCode(w http.ResponseWriter, r *http.Request) {
-	switch r.Method {
-	case http.MethodPost:
-		err := r.ParseForm()
-		if err != nil {
-			s.logger.Warnf("Could not parse user code verification request body : %v", err)
-			s.renderError(r, w, http.StatusBadRequest, "")
-			return
-		}
-
-		userCode := r.Form.Get("user_code")
-		if userCode == "" {
-			s.renderError(r, w, http.StatusBadRequest, "No user code received")
-			return
-		}
-
-		userCode = strings.ToUpper(userCode)
-
-		// Find the user code in the available requests
-		deviceRequest, err := s.storage.GetDeviceRequest(userCode)
-		if err != nil || s.now().After(deviceRequest.Expiry) {
-			if err != nil && err != storage.ErrNotFound {
-				s.logger.Errorf("failed to get device request: %v", err)
-			}
-			if err := s.templates.device(r, w, s.getDeviceVerificationURI(), userCode, true); err != nil {
-				s.logger.Errorf("Server template error: %v", err)
-				s.renderError(r, w, http.StatusNotFound, "Page not found")
-			}
-			return
-		}
-
-		// Redirect to Dex Auth Endpoint
-		authURL := path.Join(s.issuerURL.Path, "/auth")
-		u, err := url.Parse(authURL)
-		if err != nil {
-			s.renderError(r, w, http.StatusInternalServerError, "Invalid auth URI.")
-			return
-		}
-		q := u.Query()
-		q.Set("client_id", deviceRequest.ClientID)
-		q.Set("client_secret", deviceRequest.ClientSecret)
-		q.Set("state", deviceRequest.UserCode)
-		q.Set("response_type", "code")
-		q.Set("redirect_uri", "/device/callback")
-		q.Set("scope", strings.Join(deviceRequest.Scopes, " "))
-		u.RawQuery = q.Encode()
-
-		http.Redirect(w, r, u.String(), http.StatusFound)
-
-	default:
-		s.renderError(r, w, http.StatusBadRequest, "Requested resource does not exist.")
-	}
-}
diff --git a/server/deviceflowhandlers_test.go b/server/deviceflowhandlers_test.go
deleted file mode 100644
index 9a9f28584e..0000000000
--- a/server/deviceflowhandlers_test.go
+++ /dev/null
@@ -1,830 +0,0 @@
-package server
-
-import (
-	"bytes"
-	"context"
-	"encoding/json"
-	"io"
-	"net/http"
-	"net/http/httptest"
-	"net/url"
-	"path"
-	"strings"
-	"testing"
-	"time"
-
-	"github.com/dexidp/dex/storage"
-)
-
-func TestDeviceVerificationURI(t *testing.T) {
-	t0 := time.Now()
-
-	now := func() time.Time { return t0 }
-	ctx, cancel := context.WithCancel(context.Background())
-	defer cancel()
-	// Setup a dex server.
-	httpServer, s := newTestServer(ctx, t, func(c *Config) {
-		c.Issuer += "/non-root-path"
-		c.Now = now
-	})
-	defer httpServer.Close()
-
-	u, err := url.Parse(s.issuerURL.String())
-	if err != nil {
-		t.Fatalf("Could not parse issuer URL %v", err)
-	}
-	u.Path = path.Join(u.Path, "/device/auth/verify_code")
-
-	uri := s.getDeviceVerificationURI()
-	if uri != u.Path {
-		t.Errorf("Invalid verification URI.  Expected %v got %v", u.Path, uri)
-	}
-}
-
-func TestHandleDeviceCode(t *testing.T) {
-	t0 := time.Now()
-
-	now := func() time.Time { return t0 }
-
-	tests := []struct {
-		testName               string
-		clientID               string
-		codeChallengeMethod    string
-		requestType            string
-		scopes                 []string
-		expectedResponseCode   int
-		expectedContentType    string
-		expectedServerResponse string
-	}{
-		{
-			testName:             "New Code",
-			clientID:             "test",
-			requestType:          "POST",
-			scopes:               []string{"openid", "profile", "email"},
-			expectedResponseCode: http.StatusOK,
-			expectedContentType:  "application/json",
-		},
-		{
-			testName:             "Invalid request Type (GET)",
-			clientID:             "test",
-			requestType:          "GET",
-			scopes:               []string{"openid", "profile", "email"},
-			expectedResponseCode: http.StatusBadRequest,
-			expectedContentType:  "application/json",
-		},
-		{
-			testName:             "New Code with valid PKCE",
-			clientID:             "test",
-			requestType:          "POST",
-			scopes:               []string{"openid", "profile", "email"},
-			codeChallengeMethod:  "S256",
-			expectedResponseCode: http.StatusOK,
-			expectedContentType:  "application/json",
-		},
-		{
-			testName:             "Invalid code challenge method",
-			clientID:             "test",
-			requestType:          "POST",
-			codeChallengeMethod:  "invalid",
-			scopes:               []string{"openid", "profile", "email"},
-			expectedResponseCode: http.StatusBadRequest,
-			expectedContentType:  "application/json",
-		},
-	}
-	for _, tc := range tests {
-		t.Run(tc.testName, func(t *testing.T) {
-			ctx, cancel := context.WithCancel(context.Background())
-			defer cancel()
-
-			// Setup a dex server.
-			httpServer, s := newTestServer(ctx, t, func(c *Config) {
-				c.Issuer += "/non-root-path"
-				c.Now = now
-			})
-			defer httpServer.Close()
-
-			u, err := url.Parse(s.issuerURL.String())
-			if err != nil {
-				t.Fatalf("Could not parse issuer URL %v", err)
-			}
-			u.Path = path.Join(u.Path, "device/code")
-
-			data := url.Values{}
-			data.Set("client_id", tc.clientID)
-			data.Set("code_challenge_method", tc.codeChallengeMethod)
-			for _, scope := range tc.scopes {
-				data.Add("scope", scope)
-			}
-			req, _ := http.NewRequest(tc.requestType, u.String(), bytes.NewBufferString(data.Encode()))
-			req.Header.Set("Content-Type", "application/x-www-form-urlencoded; param=value")
-
-			rr := httptest.NewRecorder()
-			s.ServeHTTP(rr, req)
-			if rr.Code != tc.expectedResponseCode {
-				t.Errorf("Unexpected Response Type.  Expected %v got %v", tc.expectedResponseCode, rr.Code)
-			}
-
-			if rr.Header().Get("content-type") != tc.expectedContentType {
-				t.Errorf("Unexpected Response Content Type.  Expected %v got %v", tc.expectedContentType, rr.Header().Get("content-type"))
-			}
-
-			body, err := io.ReadAll(rr.Body)
-			if err != nil {
-				t.Errorf("Could read token response %v", err)
-			}
-			if tc.expectedResponseCode == http.StatusOK {
-				var resp deviceCodeResponse
-				if err := json.Unmarshal(body, &resp); err != nil {
-					t.Errorf("Unexpected Device Code Response Format %v", string(body))
-				}
-			}
-		})
-	}
-}
-
-func TestDeviceCallback(t *testing.T) {
-	t0 := time.Now()
-
-	now := func() time.Time { return t0 }
-
-	type formValues struct {
-		state string
-		code  string
-		error string
-	}
-
-	// Base "Control" test values
-	baseFormValues := formValues{
-		state: "XXXX-XXXX",
-		code:  "somecode",
-	}
-	baseAuthCode := storage.AuthCode{
-		ID:            "somecode",
-		ClientID:      "testclient",
-		RedirectURI:   deviceCallbackURI,
-		Nonce:         "",
-		Scopes:        []string{"openid", "profile", "email"},
-		ConnectorID:   "mock",
-		ConnectorData: nil,
-		Claims:        storage.Claims{},
-		Expiry:        now().Add(5 * time.Minute),
-	}
-	baseDeviceRequest := storage.DeviceRequest{
-		UserCode:     "XXXX-XXXX",
-		DeviceCode:   "devicecode",
-		ClientID:     "testclient",
-		ClientSecret: "",
-		Scopes:       []string{"openid", "profile", "email"},
-		Expiry:       now().Add(5 * time.Minute),
-	}
-	baseDeviceToken := storage.DeviceToken{
-		DeviceCode:          "devicecode",
-		Status:              deviceTokenPending,
-		Token:               "",
-		Expiry:              now().Add(5 * time.Minute),
-		LastRequestTime:     time.Time{},
-		PollIntervalSeconds: 0,
-	}
-
-	tests := []struct {
-		testName               string
-		expectedResponseCode   int
-		expectedServerResponse string
-		values                 formValues
-		testAuthCode           storage.AuthCode
-		testDeviceRequest      storage.DeviceRequest
-		testDeviceToken        storage.DeviceToken
-	}{
-		{
-			testName: "Missing State",
-			values: formValues{
-				state: "",
-				code:  "somecode",
-				error: "",
-			},
-			expectedResponseCode: http.StatusBadRequest,
-		},
-		{
-			testName: "Missing Code",
-			values: formValues{
-				state: "XXXX-XXXX",
-				code:  "",
-				error: "",
-			},
-			expectedResponseCode: http.StatusBadRequest,
-		},
-		{
-			testName: "Error During Authorization",
-			values: formValues{
-				state: "XXXX-XXXX",
-				code:  "somecode",
-				error: "Error Condition",
-			},
-			expectedResponseCode:   http.StatusBadRequest,
-			expectedServerResponse: "Error Condition: \n",
-		},
-		{
-			testName: "Expired Auth Code",
-			values:   baseFormValues,
-			testAuthCode: storage.AuthCode{
-				ID:            "somecode",
-				ClientID:      "testclient",
-				RedirectURI:   deviceCallbackURI,
-				Nonce:         "",
-				Scopes:        []string{"openid", "profile", "email"},
-				ConnectorID:   "pic",
-				ConnectorData: nil,
-				Claims:        storage.Claims{},
-				Expiry:        now().Add(-5 * time.Minute),
-			},
-			expectedResponseCode: http.StatusBadRequest,
-		},
-		{
-			testName: "Invalid Auth Code",
-			values:   baseFormValues,
-			testAuthCode: storage.AuthCode{
-				ID:            "somecode",
-				ClientID:      "testclient",
-				RedirectURI:   deviceCallbackURI,
-				Nonce:         "",
-				Scopes:        []string{"openid", "profile", "email"},
-				ConnectorID:   "pic",
-				ConnectorData: nil,
-				Claims:        storage.Claims{},
-				Expiry:        now().Add(5 * time.Minute),
-			},
-			expectedResponseCode: http.StatusBadRequest,
-		},
-		{
-			testName:     "Expired Device Request",
-			values:       baseFormValues,
-			testAuthCode: baseAuthCode,
-			testDeviceRequest: storage.DeviceRequest{
-				UserCode:   "XXXX-XXXX",
-				DeviceCode: "devicecode",
-				ClientID:   "testclient",
-				Scopes:     []string{"openid", "profile", "email"},
-				Expiry:     now().Add(-5 * time.Minute),
-			},
-			expectedResponseCode: http.StatusBadRequest,
-		},
-		{
-			testName:     "Non-Existent User Code",
-			values:       baseFormValues,
-			testAuthCode: baseAuthCode,
-			testDeviceRequest: storage.DeviceRequest{
-				UserCode:   "ZZZZ-ZZZZ",
-				DeviceCode: "devicecode",
-				Scopes:     []string{"openid", "profile", "email"},
-				Expiry:     now().Add(5 * time.Minute),
-			},
-			expectedResponseCode: http.StatusBadRequest,
-		},
-		{
-			testName:     "Bad Device Request Client",
-			values:       baseFormValues,
-			testAuthCode: baseAuthCode,
-			testDeviceRequest: storage.DeviceRequest{
-				UserCode:   "XXXX-XXXX",
-				DeviceCode: "devicecode",
-				Scopes:     []string{"openid", "profile", "email"},
-				Expiry:     now().Add(5 * time.Minute),
-			},
-			expectedResponseCode: http.StatusUnauthorized,
-		},
-		{
-			testName:     "Bad Device Request Secret",
-			values:       baseFormValues,
-			testAuthCode: baseAuthCode,
-			testDeviceRequest: storage.DeviceRequest{
-				UserCode:     "XXXX-XXXX",
-				DeviceCode:   "devicecode",
-				ClientSecret: "foobar",
-				Scopes:       []string{"openid", "profile", "email"},
-				Expiry:       now().Add(5 * time.Minute),
-			},
-			expectedResponseCode: http.StatusUnauthorized,
-		},
-		{
-			testName:          "Expired Device Token",
-			values:            baseFormValues,
-			testAuthCode:      baseAuthCode,
-			testDeviceRequest: baseDeviceRequest,
-			testDeviceToken: storage.DeviceToken{
-				DeviceCode:          "devicecode",
-				Status:              deviceTokenPending,
-				Token:               "",
-				Expiry:              now().Add(-5 * time.Minute),
-				LastRequestTime:     time.Time{},
-				PollIntervalSeconds: 0,
-			},
-			expectedResponseCode: http.StatusBadRequest,
-		},
-		{
-			testName:          "Device Code Already Redeemed",
-			values:            baseFormValues,
-			testAuthCode:      baseAuthCode,
-			testDeviceRequest: baseDeviceRequest,
-			testDeviceToken: storage.DeviceToken{
-				DeviceCode:          "devicecode",
-				Status:              deviceTokenComplete,
-				Token:               "",
-				Expiry:              now().Add(5 * time.Minute),
-				LastRequestTime:     time.Time{},
-				PollIntervalSeconds: 0,
-			},
-			expectedResponseCode: http.StatusBadRequest,
-		},
-		{
-			testName:             "Successful Exchange",
-			values:               baseFormValues,
-			testAuthCode:         baseAuthCode,
-			testDeviceRequest:    baseDeviceRequest,
-			testDeviceToken:      baseDeviceToken,
-			expectedResponseCode: http.StatusOK,
-		},
-		{
-			testName: "Prevent cross-site scripting",
-			values: formValues{
-				state: "XXXX-XXXX",
-				code:  "somecode",
-				error: "<script>console.log(window);</script>",
-			},
-			expectedResponseCode:   http.StatusBadRequest,
-			expectedServerResponse: "&lt;script&gt;console.log(window);&lt;/script&gt;: \n",
-		},
-	}
-	for _, tc := range tests {
-		t.Run(tc.testName, func(t *testing.T) {
-			ctx, cancel := context.WithCancel(context.Background())
-			defer cancel()
-
-			// Setup a dex server.
-			httpServer, s := newTestServer(ctx, t, func(c *Config) {
-				// c.Issuer = c.Issuer + "/non-root-path"
-				c.Now = now
-			})
-			defer httpServer.Close()
-
-			if err := s.storage.CreateAuthCode(tc.testAuthCode); err != nil {
-				t.Fatalf("failed to create auth code: %v", err)
-			}
-
-			if err := s.storage.CreateDeviceRequest(tc.testDeviceRequest); err != nil {
-				t.Fatalf("failed to create device request: %v", err)
-			}
-
-			if err := s.storage.CreateDeviceToken(tc.testDeviceToken); err != nil {
-				t.Fatalf("failed to create device token: %v", err)
-			}
-
-			client := storage.Client{
-				ID:           "testclient",
-				Secret:       "",
-				RedirectURIs: []string{deviceCallbackURI},
-			}
-			if err := s.storage.CreateClient(client); err != nil {
-				t.Fatalf("failed to create client: %v", err)
-			}
-
-			u, err := url.Parse(s.issuerURL.String())
-			if err != nil {
-				t.Fatalf("Could not parse issuer URL %v", err)
-			}
-			u.Path = path.Join(u.Path, "device/callback")
-			q := u.Query()
-			q.Set("state", tc.values.state)
-			q.Set("code", tc.values.code)
-			q.Set("error", tc.values.error)
-			u.RawQuery = q.Encode()
-			req, _ := http.NewRequest("GET", u.String(), nil)
-			req.Header.Set("Content-Type", "application/x-www-form-urlencoded; param=value")
-
-			rr := httptest.NewRecorder()
-			s.ServeHTTP(rr, req)
-			if rr.Code != tc.expectedResponseCode {
-				t.Errorf("%s: Unexpected Response Type.  Expected %v got %v", tc.testName, tc.expectedResponseCode, rr.Code)
-			}
-
-			if len(tc.expectedServerResponse) > 0 {
-				result, _ := io.ReadAll(rr.Body)
-				if string(result) != tc.expectedServerResponse {
-					t.Errorf("%s: Unexpected Response.  Expected %q got %q", tc.testName, tc.expectedServerResponse, result)
-				}
-			}
-		})
-	}
-}
-
-func TestDeviceTokenResponse(t *testing.T) {
-	t0 := time.Now()
-
-	now := func() time.Time { return t0 }
-
-	// Base PKCE values
-	// base64-urlencoded, sha256 digest of code_verifier
-	codeChallenge := "L7ZqsT_zNwvrH8E7J0CqPHx1wgBaFiaE-fAZcKUUAbc"
-	codeChallengeMethod := "S256"
-	// "random" string between 43 & 128 ASCII characters
-	codeVerifier := "66114650f56cc45dee7ee03c49f048ddf9aa53cbf5b09985832fa4f790ff2604"
-
-	baseDeviceRequest := storage.DeviceRequest{
-		UserCode:   "ABCD-WXYZ",
-		DeviceCode: "foo",
-		ClientID:   "testclient",
-		Scopes:     []string{"openid", "profile", "offline_access"},
-		Expiry:     now().Add(5 * time.Minute),
-	}
-
-	tests := []struct {
-		testName               string
-		testDeviceRequest      storage.DeviceRequest
-		testDeviceToken        storage.DeviceToken
-		testGrantType          string
-		testDeviceCode         string
-		testCodeVerifier       string
-		expectedServerResponse string
-		expectedResponseCode   int
-	}{
-		{
-			testName:          "Valid but pending token",
-			testDeviceRequest: baseDeviceRequest,
-			testDeviceToken: storage.DeviceToken{
-				DeviceCode:          "f00bar",
-				Status:              deviceTokenPending,
-				Token:               "",
-				Expiry:              now().Add(5 * time.Minute),
-				LastRequestTime:     time.Time{},
-				PollIntervalSeconds: 0,
-			},
-			testDeviceCode:         "f00bar",
-			expectedServerResponse: deviceTokenPending,
-			expectedResponseCode:   http.StatusUnauthorized,
-		},
-		{
-			testName:          "Invalid Grant Type",
-			testDeviceRequest: baseDeviceRequest,
-			testDeviceToken: storage.DeviceToken{
-				DeviceCode:          "f00bar",
-				Status:              deviceTokenPending,
-				Token:               "",
-				Expiry:              now().Add(5 * time.Minute),
-				LastRequestTime:     time.Time{},
-				PollIntervalSeconds: 0,
-			},
-			testDeviceCode:         "f00bar",
-			testGrantType:          grantTypeAuthorizationCode,
-			expectedServerResponse: errInvalidGrant,
-			expectedResponseCode:   http.StatusBadRequest,
-		},
-		{
-			testName:          "Test Slow Down State",
-			testDeviceRequest: baseDeviceRequest,
-			testDeviceToken: storage.DeviceToken{
-				DeviceCode:          "f00bar",
-				Status:              deviceTokenPending,
-				Token:               "",
-				Expiry:              now().Add(5 * time.Minute),
-				LastRequestTime:     now(),
-				PollIntervalSeconds: 10,
-			},
-			testDeviceCode:         "f00bar",
-			expectedServerResponse: deviceTokenSlowDown,
-			expectedResponseCode:   http.StatusBadRequest,
-		},
-		{
-			testName:          "Test Expired Device Token",
-			testDeviceRequest: baseDeviceRequest,
-			testDeviceToken: storage.DeviceToken{
-				DeviceCode:          "f00bar",
-				Status:              deviceTokenPending,
-				Token:               "",
-				Expiry:              now().Add(-5 * time.Minute),
-				LastRequestTime:     time.Time{},
-				PollIntervalSeconds: 0,
-			},
-			testDeviceCode:         "f00bar",
-			expectedServerResponse: deviceTokenExpired,
-			expectedResponseCode:   http.StatusBadRequest,
-		},
-		{
-			testName:          "Test Non-existent Device Code",
-			testDeviceRequest: baseDeviceRequest,
-			testDeviceToken: storage.DeviceToken{
-				DeviceCode:          "foo",
-				Status:              deviceTokenPending,
-				Token:               "",
-				Expiry:              now().Add(-5 * time.Minute),
-				LastRequestTime:     time.Time{},
-				PollIntervalSeconds: 0,
-			},
-			testDeviceCode:         "bar",
-			expectedServerResponse: errInvalidRequest,
-			expectedResponseCode:   http.StatusBadRequest,
-		},
-		{
-			testName:          "Empty Device Code in Request",
-			testDeviceRequest: baseDeviceRequest,
-			testDeviceToken: storage.DeviceToken{
-				DeviceCode:          "bar",
-				Status:              deviceTokenPending,
-				Token:               "",
-				Expiry:              now().Add(-5 * time.Minute),
-				LastRequestTime:     time.Time{},
-				PollIntervalSeconds: 0,
-			},
-			testDeviceCode:         "",
-			expectedServerResponse: errInvalidRequest,
-			expectedResponseCode:   http.StatusBadRequest,
-		},
-		{
-			testName:          "Claim validated token from Device Code",
-			testDeviceRequest: baseDeviceRequest,
-			testDeviceToken: storage.DeviceToken{
-				DeviceCode:          "foo",
-				Status:              deviceTokenComplete,
-				Token:               "{\"access_token\": \"foobar\"}",
-				Expiry:              now().Add(5 * time.Minute),
-				LastRequestTime:     time.Time{},
-				PollIntervalSeconds: 0,
-			},
-			testDeviceCode:         "foo",
-			expectedServerResponse: "{\"access_token\": \"foobar\"}",
-			expectedResponseCode:   http.StatusOK,
-		},
-		{
-			testName: "Successful Exchange with PKCE",
-			testDeviceToken: storage.DeviceToken{
-				DeviceCode:          "foo",
-				Status:              deviceTokenComplete,
-				Token:               "{\"access_token\": \"foobar\"}",
-				Expiry:              now().Add(5 * time.Minute),
-				LastRequestTime:     time.Time{},
-				PollIntervalSeconds: 0,
-				PKCE: storage.PKCE{
-					CodeChallenge:       codeChallenge,
-					CodeChallengeMethod: codeChallengeMethod,
-				},
-			},
-			testDeviceCode:         "foo",
-			testCodeVerifier:       codeVerifier,
-			testDeviceRequest:      baseDeviceRequest,
-			expectedServerResponse: "{\"access_token\": \"foobar\"}",
-			expectedResponseCode:   http.StatusOK,
-		},
-		{
-			testName: "Test Exchange started with PKCE but without verifier provided",
-			testDeviceToken: storage.DeviceToken{
-				DeviceCode:          "foo",
-				Status:              deviceTokenComplete,
-				Token:               "{\"access_token\": \"foobar\"}",
-				Expiry:              now().Add(5 * time.Minute),
-				LastRequestTime:     time.Time{},
-				PollIntervalSeconds: 0,
-				PKCE: storage.PKCE{
-					CodeChallenge:       codeChallenge,
-					CodeChallengeMethod: codeChallengeMethod,
-				},
-			},
-			testDeviceCode:         "foo",
-			testDeviceRequest:      baseDeviceRequest,
-			expectedServerResponse: errInvalidGrant,
-			expectedResponseCode:   http.StatusBadRequest,
-		},
-		{
-			testName: "Test Exchange not started with PKCE but verifier provided",
-			testDeviceToken: storage.DeviceToken{
-				DeviceCode:          "foo",
-				Status:              deviceTokenComplete,
-				Token:               "{\"access_token\": \"foobar\"}",
-				Expiry:              now().Add(5 * time.Minute),
-				LastRequestTime:     time.Time{},
-				PollIntervalSeconds: 0,
-			},
-			testDeviceCode:         "foo",
-			testCodeVerifier:       codeVerifier,
-			testDeviceRequest:      baseDeviceRequest,
-			expectedServerResponse: errInvalidRequest,
-			expectedResponseCode:   http.StatusBadRequest,
-		},
-		{
-			testName: "Test with PKCE but incorrect verifier provided",
-			testDeviceToken: storage.DeviceToken{
-				DeviceCode:          "foo",
-				Status:              deviceTokenComplete,
-				Token:               "{\"access_token\": \"foobar\"}",
-				Expiry:              now().Add(5 * time.Minute),
-				LastRequestTime:     time.Time{},
-				PollIntervalSeconds: 0,
-				PKCE: storage.PKCE{
-					CodeChallenge:       codeChallenge,
-					CodeChallengeMethod: codeChallengeMethod,
-				},
-			},
-			testDeviceCode:         "foo",
-			testCodeVerifier:       "invalid",
-			testDeviceRequest:      baseDeviceRequest,
-			expectedServerResponse: errInvalidGrant,
-			expectedResponseCode:   http.StatusBadRequest,
-		},
-		{
-			testName: "Test with PKCE but incorrect challenge provided",
-			testDeviceToken: storage.DeviceToken{
-				DeviceCode:          "foo",
-				Status:              deviceTokenComplete,
-				Token:               "{\"access_token\": \"foobar\"}",
-				Expiry:              now().Add(5 * time.Minute),
-				LastRequestTime:     time.Time{},
-				PollIntervalSeconds: 0,
-				PKCE: storage.PKCE{
-					CodeChallenge:       "invalid",
-					CodeChallengeMethod: codeChallengeMethod,
-				},
-			},
-			testDeviceCode:         "foo",
-			testCodeVerifier:       codeVerifier,
-			testDeviceRequest:      baseDeviceRequest,
-			expectedServerResponse: errInvalidGrant,
-			expectedResponseCode:   http.StatusBadRequest,
-		},
-	}
-	for _, tc := range tests {
-		t.Run(tc.testName, func(t *testing.T) {
-			ctx, cancel := context.WithCancel(context.Background())
-			defer cancel()
-
-			// Setup a dex server.
-			httpServer, s := newTestServer(ctx, t, func(c *Config) {
-				c.Issuer += "/non-root-path"
-				c.Now = now
-			})
-			defer httpServer.Close()
-
-			if err := s.storage.CreateDeviceRequest(tc.testDeviceRequest); err != nil {
-				t.Fatalf("Failed to store device token %v", err)
-			}
-
-			if err := s.storage.CreateDeviceToken(tc.testDeviceToken); err != nil {
-				t.Fatalf("Failed to store device token %v", err)
-			}
-
-			u, err := url.Parse(s.issuerURL.String())
-			if err != nil {
-				t.Fatalf("Could not parse issuer URL %v", err)
-			}
-			u.Path = path.Join(u.Path, "device/token")
-
-			data := url.Values{}
-			grantType := grantTypeDeviceCode
-			if tc.testGrantType != "" {
-				grantType = tc.testGrantType
-			}
-			data.Set("grant_type", grantType)
-			data.Set("device_code", tc.testDeviceCode)
-			if tc.testCodeVerifier != "" {
-				data.Set("code_verifier", tc.testCodeVerifier)
-			}
-			req, _ := http.NewRequest("POST", u.String(), bytes.NewBufferString(data.Encode()))
-			req.Header.Set("Content-Type", "application/x-www-form-urlencoded; param=value")
-
-			rr := httptest.NewRecorder()
-			s.ServeHTTP(rr, req)
-			if rr.Code != tc.expectedResponseCode {
-				t.Errorf("Unexpected Response Type.  Expected %v got %v", tc.expectedResponseCode, rr.Code)
-			}
-
-			body, err := io.ReadAll(rr.Body)
-			if err != nil {
-				t.Errorf("Could read token response %v", err)
-			}
-			if tc.expectedResponseCode == http.StatusBadRequest || tc.expectedResponseCode == http.StatusUnauthorized {
-				expectJSONErrorResponse(tc.testName, body, tc.expectedServerResponse, t)
-			} else if string(body) != tc.expectedServerResponse {
-				t.Errorf("Unexpected Server Response.  Expected %v got %v", tc.expectedServerResponse, string(body))
-			}
-		})
-	}
-}
-
-func expectJSONErrorResponse(testCase string, body []byte, expectedError string, t *testing.T) {
-	jsonMap := make(map[string]interface{})
-	err := json.Unmarshal(body, &jsonMap)
-	if err != nil {
-		t.Errorf("Unexpected error unmarshalling response: %v", err)
-	}
-	if jsonMap["error"] != expectedError {
-		t.Errorf("Test Case %s expected error %v, received %v", testCase, expectedError, jsonMap["error"])
-	}
-}
-
-func TestVerifyCodeResponse(t *testing.T) {
-	t0 := time.Now()
-
-	now := func() time.Time { return t0 }
-
-	tests := []struct {
-		testName             string
-		testDeviceRequest    storage.DeviceRequest
-		userCode             string
-		expectedResponseCode int
-		expectedRedirectPath string
-	}{
-		{
-			testName: "Unknown user code",
-			testDeviceRequest: storage.DeviceRequest{
-				UserCode:   "ABCD-WXYZ",
-				DeviceCode: "f00bar",
-				ClientID:   "testclient",
-				Scopes:     []string{"openid", "profile", "offline_access"},
-				Expiry:     now().Add(5 * time.Minute),
-			},
-			userCode:             "CODE-TEST",
-			expectedResponseCode: http.StatusBadRequest,
-			expectedRedirectPath: "",
-		},
-		{
-			testName: "Expired user code",
-			testDeviceRequest: storage.DeviceRequest{
-				UserCode:   "ABCD-WXYZ",
-				DeviceCode: "f00bar",
-				ClientID:   "testclient",
-				Scopes:     []string{"openid", "profile", "offline_access"},
-				Expiry:     now().Add(-5 * time.Minute),
-			},
-			userCode:             "ABCD-WXYZ",
-			expectedResponseCode: http.StatusBadRequest,
-			expectedRedirectPath: "",
-		},
-		{
-			testName: "No user code",
-			testDeviceRequest: storage.DeviceRequest{
-				UserCode:   "ABCD-WXYZ",
-				DeviceCode: "f00bar",
-				ClientID:   "testclient",
-				Scopes:     []string{"openid", "profile", "offline_access"},
-				Expiry:     now().Add(-5 * time.Minute),
-			},
-			userCode:             "",
-			expectedResponseCode: http.StatusBadRequest,
-			expectedRedirectPath: "",
-		},
-		{
-			testName: "Valid user code, expect redirect to auth endpoint",
-			testDeviceRequest: storage.DeviceRequest{
-				UserCode:   "ABCD-WXYZ",
-				DeviceCode: "f00bar",
-				ClientID:   "testclient",
-				Scopes:     []string{"openid", "profile", "offline_access"},
-				Expiry:     now().Add(5 * time.Minute),
-			},
-			userCode:             "ABCD-WXYZ",
-			expectedResponseCode: http.StatusFound,
-			expectedRedirectPath: "/auth",
-		},
-	}
-	for _, tc := range tests {
-		t.Run(tc.testName, func(t *testing.T) {
-			ctx, cancel := context.WithCancel(context.Background())
-			defer cancel()
-
-			// Setup a dex server.
-			httpServer, s := newTestServer(ctx, t, func(c *Config) {
-				c.Issuer += "/non-root-path"
-				c.Now = now
-			})
-			defer httpServer.Close()
-
-			if err := s.storage.CreateDeviceRequest(tc.testDeviceRequest); err != nil {
-				t.Fatalf("Failed to store device token %v", err)
-			}
-
-			u, err := url.Parse(s.issuerURL.String())
-			if err != nil {
-				t.Fatalf("Could not parse issuer URL %v", err)
-			}
-
-			u.Path = path.Join(u.Path, "device/auth/verify_code")
-			data := url.Values{}
-			data.Set("user_code", tc.userCode)
-			req, _ := http.NewRequest("POST", u.String(), bytes.NewBufferString(data.Encode()))
-			req.Header.Set("Content-Type", "application/x-www-form-urlencoded; param=value")
-
-			rr := httptest.NewRecorder()
-			s.ServeHTTP(rr, req)
-			if rr.Code != tc.expectedResponseCode {
-				t.Errorf("Unexpected Response Type.  Expected %v got %v", tc.expectedResponseCode, rr.Code)
-			}
-
-			u, err = url.Parse(s.issuerURL.String())
-			if err != nil {
-				t.Errorf("Could not parse issuer URL %v", err)
-			}
-			u.Path = path.Join(u.Path, tc.expectedRedirectPath)
-
-			location := rr.Header().Get("Location")
-			if rr.Code == http.StatusFound && !strings.HasPrefix(location, u.Path) {
-				t.Errorf("Invalid Redirect.  Expected %v got %v", u.Path, location)
-			}
-		})
-	}
-}
diff --git a/server/discovery/discovery.go b/server/discovery/discovery.go
new file mode 100644
index 0000000000..d9119d4b68
--- /dev/null
+++ b/server/discovery/discovery.go
@@ -0,0 +1,180 @@
+package discovery
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"log/slog"
+	"net/http"
+	"sort"
+	"strconv"
+	"sync"
+	"time"
+
+	jose "github.com/go-jose/go-jose/v4"
+
+	"github.com/dexidp/dex/server/oauth2"
+	"github.com/dexidp/dex/server/router"
+	"github.com/dexidp/dex/server/signer"
+	"github.com/dexidp/dex/server/templates"
+)
+
+// Handler serves the discovery document and the JWKS. Like every other domain
+// handler it takes the issuer URL and the templates directly, so it can be
+// built without a Server.
+type Handler struct {
+	IssuerURL       oauth2.IssuerURL
+	Templates       *templates.Templates
+	Signer          signer.Signer
+	Logger          *slog.Logger
+	ResponseTypes   map[string]bool
+	GrantTypes      []string
+	PKCEMethods     []string
+	SessionsEnabled bool
+
+	docOnce sync.Once
+	docData []byte
+	docErr  error
+}
+
+// renderError renders a user-facing HTML error page.
+func (h *Handler) renderError(r *http.Request, w http.ResponseWriter, status int, description string) {
+	templates.RenderError(h.Templates, h.Logger, r, w, status, description)
+}
+
+// Mount registers the discovery routes.
+func (h *Handler) Mount(m router.Mux) {
+	m.HandleCORS("/.well-known/openid-configuration", h.serveDocument)
+	m.HandleCORS("/keys", h.Keys)
+}
+
+// Document is the OIDC discovery document.
+type Document struct {
+	Issuer         string `json:"issuer"`
+	Auth           string `json:"authorization_endpoint"`
+	Token          string `json:"token_endpoint"`
+	Keys           string `json:"jwks_uri"`
+	UserInfo       string `json:"userinfo_endpoint"`
+	DeviceEndpoint string `json:"device_authorization_endpoint"`
+	Introspect     string `json:"introspection_endpoint"`
+	EndSession     string `json:"end_session_endpoint,omitempty"`
+	// BackchannelLogout and BackchannelLogoutSession advertise OIDC Back-Channel
+	// Logout 1.0. Both are omitted rather than sent as false when sessions are off,
+	// matching how end_session_endpoint disappears with them.
+	BackchannelLogout        bool     `json:"backchannel_logout_supported,omitempty"`
+	BackchannelLogoutSession bool     `json:"backchannel_logout_session_supported,omitempty"`
+	GrantTypes               []string `json:"grant_types_supported"`
+	ResponseTypes            []string `json:"response_types_supported"`
+	Subjects                 []string `json:"subject_types_supported"`
+	IDTokenAlgs              []string `json:"id_token_signing_alg_values_supported"`
+	CodeChallengeAlgs        []string `json:"code_challenge_methods_supported"`
+	Scopes                   []string `json:"scopes_supported"`
+	AuthMethods              []string `json:"token_endpoint_auth_methods_supported"`
+	Claims                   []string `json:"claims_supported"`
+}
+
+// Keys serves the JSON Web Key Set.
+func (h *Handler) Keys(w http.ResponseWriter, r *http.Request) {
+	ctx := r.Context()
+	// TODO(ericchiang): Cache this.
+	keys, err := h.Signer.ValidationKeys(ctx)
+	if err != nil {
+		h.Logger.ErrorContext(ctx, "failed to get keys", "err", err)
+		h.renderError(r, w, http.StatusInternalServerError, "Internal server error.")
+		return
+	}
+
+	if len(keys) == 0 {
+		h.Logger.ErrorContext(ctx, "no public keys found.")
+		h.renderError(r, w, http.StatusInternalServerError, "Internal server error.")
+		return
+	}
+
+	jwks := jose.JSONWebKeySet{
+		Keys: make([]jose.JSONWebKey, len(keys)),
+	}
+	for i, key := range keys {
+		jwks.Keys[i] = *key
+	}
+
+	data, err := json.MarshalIndent(jwks, "", "  ")
+	if err != nil {
+		h.Logger.ErrorContext(ctx, "failed to marshal discovery data", "err", err)
+		h.renderError(r, w, http.StatusInternalServerError, "Internal server error.")
+		return
+	}
+
+	// We don't have NextRotation info from Signer interface easily,
+	// so we'll just set a reasonable default cache time.
+	maxAge := time.Minute * 10
+
+	w.Header().Set("Cache-Control", fmt.Sprintf("max-age=%d, must-revalidate", int(maxAge.Seconds())))
+	w.Header().Set("Content-Type", "application/json")
+	w.Header().Set("Content-Length", strconv.Itoa(len(data)))
+	w.Write(data)
+}
+
+// serveDocument serves the discovery document, marshaling it once on first use.
+func (h *Handler) serveDocument(w http.ResponseWriter, r *http.Request) {
+	h.docOnce.Do(func() {
+		h.docData, h.docErr = json.MarshalIndent(h.Construct(r.Context()), "", "  ")
+	})
+	if h.docErr != nil {
+		h.Logger.ErrorContext(r.Context(), "failed to marshal discovery data", "err", h.docErr)
+		h.renderError(r, w, http.StatusInternalServerError, "Internal server error.")
+		return
+	}
+
+	w.Header().Set("Content-Type", "application/json")
+	w.Header().Set("Content-Length", strconv.Itoa(len(h.docData)))
+	w.Write(h.docData)
+}
+
+// Construct builds the discovery document from the current configuration.
+func (h *Handler) Construct(ctx context.Context) Document {
+	d := Document{
+		Issuer:            h.IssuerURL.String(),
+		Auth:              h.IssuerURL.AbsURL("/auth"),
+		Token:             h.IssuerURL.AbsURL("/token"),
+		Keys:              h.IssuerURL.AbsURL("/keys"),
+		UserInfo:          h.IssuerURL.AbsURL("/userinfo"),
+		DeviceEndpoint:    h.IssuerURL.AbsURL("/device/code"),
+		Introspect:        h.IssuerURL.AbsURL("/token/introspect"),
+		Subjects:          []string{"public"},
+		IDTokenAlgs:       []string{string(jose.RS256)},
+		CodeChallengeAlgs: h.PKCEMethods,
+		Scopes:            []string{"openid", "email", "groups", "profile", "offline_access"},
+		AuthMethods:       []string{"client_secret_basic", "client_secret_post"},
+		Claims: []string{
+			"iss", "sub", "aud", "iat", "exp", "email", "email_verified",
+			"locale", "name", "preferred_username", "at_hash", "groups",
+			"federated_claims",
+		},
+	}
+
+	// Determine signing algorithm from signer.
+	signingAlg, err := h.Signer.Algorithm(ctx)
+	if err != nil {
+		h.Logger.Error("failed to get signing algorithm", "err", err)
+	} else {
+		d.IDTokenAlgs = []string{string(signingAlg)}
+	}
+
+	for responseType := range h.ResponseTypes {
+		d.ResponseTypes = append(d.ResponseTypes, responseType)
+	}
+	sort.Strings(d.ResponseTypes)
+
+	d.GrantTypes = h.GrantTypes
+
+	if h.SessionsEnabled {
+		d.EndSession = h.IssuerURL.AbsURL("/logout")
+		d.BackchannelLogout = true
+		// Dex always puts a sid in its logout tokens, so clients never need to set
+		// backchannel_logout_session_required to get one.
+		d.BackchannelLogoutSession = true
+		d.Claims = append(d.Claims, "sid")
+	}
+
+	return d
+}
diff --git a/server/discovery/discovery_test.go b/server/discovery/discovery_test.go
new file mode 100644
index 0000000000..720acee18e
--- /dev/null
+++ b/server/discovery/discovery_test.go
@@ -0,0 +1,59 @@
+package discovery
+
+import (
+	"context"
+	"crypto/rand"
+	"crypto/rsa"
+	"log/slog"
+	"net/url"
+	"testing"
+
+	jose "github.com/go-jose/go-jose/v4"
+	"github.com/stretchr/testify/require"
+
+	"github.com/dexidp/dex/server/oauth2"
+	"github.com/dexidp/dex/server/signer"
+)
+
+func testHandler(t *testing.T, sessionsEnabled bool) *Handler {
+	t.Helper()
+	key, err := rsa.GenerateKey(rand.Reader, 2048)
+	require.NoError(t, err)
+	sig, err := signer.NewMockSigner(key)
+	require.NoError(t, err)
+
+	u, err := url.Parse("https://dex.example.com")
+	require.NoError(t, err)
+
+	return &Handler{
+		IssuerURL:       oauth2.IssuerURL{URL: *u},
+		Signer:          sig,
+		Logger:          slog.New(slog.DiscardHandler),
+		ResponseTypes:   map[string]bool{"id_token": true, "code": true},
+		GrantTypes:      []string{"authorization_code", "refresh_token"},
+		PKCEMethods:     []string{"S256", "plain"},
+		SessionsEnabled: sessionsEnabled,
+	}
+}
+
+func TestConstruct(t *testing.T) {
+	doc := testHandler(t, true).Construct(context.Background())
+
+	require.Equal(t, "https://dex.example.com", doc.Issuer)
+	require.Equal(t, "https://dex.example.com/auth", doc.Auth)
+	require.Equal(t, "https://dex.example.com/token", doc.Token)
+	require.Equal(t, "https://dex.example.com/keys", doc.Keys)
+	require.Equal(t, "https://dex.example.com/token/introspect", doc.Introspect)
+	// Response types are sorted.
+	require.Equal(t, []string{"code", "id_token"}, doc.ResponseTypes)
+	require.Equal(t, []string{"authorization_code", "refresh_token"}, doc.GrantTypes)
+	require.Equal(t, []string{"S256", "plain"}, doc.CodeChallengeAlgs)
+	require.Equal(t, []string{string(jose.RS256)}, doc.IDTokenAlgs)
+	// end_session_endpoint is present only when sessions are enabled.
+	require.Equal(t, "https://dex.example.com/logout", doc.EndSession)
+}
+
+func TestConstructNoSessions(t *testing.T) {
+	doc := testHandler(t, false).Construct(context.Background())
+	require.Empty(t, doc.EndSession)
+}
diff --git a/server/discovery/doc.go b/server/discovery/doc.go
new file mode 100644
index 0000000000..2b4f2751b2
--- /dev/null
+++ b/server/discovery/doc.go
@@ -0,0 +1,3 @@
+// Package discovery serves the OIDC discovery document
+// (/.well-known/openid-configuration) and the JWKS endpoint (/keys).
+package discovery
diff --git a/server/grants/authcode.go b/server/grants/authcode.go
new file mode 100644
index 0000000000..d75716c3e1
--- /dev/null
+++ b/server/grants/authcode.go
@@ -0,0 +1,122 @@
+package grants
+
+import (
+	"context"
+	"log/slog"
+	"net/http"
+	"time"
+
+	"github.com/dexidp/dex/server/connectors"
+	"github.com/dexidp/dex/server/oauth2"
+	"github.com/dexidp/dex/server/tokens"
+	"github.com/dexidp/dex/storage"
+)
+
+// authorizationCode serves the authorization_code grant: the client redeems a
+// code minted at the /auth endpoint for tokens.
+type authorizationCode struct {
+	issuer     *tokens.Issuer
+	storage    storage.Storage
+	connectors *connectors.Cache
+	now        func() time.Time
+	logger     *slog.Logger
+}
+
+func (g *authorizationCode) GrantType() string {
+	return oauth2.GrantTypeAuthorizationCode
+}
+
+func (g *authorizationCode) RequiresClientAuth() bool {
+	return true
+}
+
+// Scopes are passed through: they were validated at /auth and stored on the code.
+func (g *authorizationCode) ScopePolicy() ScopePolicy {
+	return ScopePolicy{}
+}
+
+// ConnectorID is empty: the connector is recorded on the stored auth code and
+// was already authorized at /auth. The grant resolves it (without re-running the
+// invariant) only to decide on a refresh token, inside ExchangeAuthCode.
+func (g *authorizationCode) ConnectorID(ctx context.Context, req *Request, client storage.Client) (string, *oauth2.Error) {
+	return "", nil
+}
+
+// handle an access token request https://tools.ietf.org/html/rfc6749#section-4.1.3
+func (g *authorizationCode) Authorize(ctx context.Context, req *Request, client storage.Client, conn connectors.Connector) (Responder, error) {
+	if req.Code == "" {
+		return nil, &oauth2.Error{Type: oauth2.InvalidRequest, Description: "Required param: code.", Status: http.StatusBadRequest}
+	}
+
+	authCode, err := g.storage.GetAuthCode(ctx, req.Code)
+	if err != nil || g.now().After(authCode.Expiry) || authCode.ClientID != client.ID {
+		if err != nil && err != storage.ErrNotFound {
+			g.logger.ErrorContext(ctx, "failed to get auth code", "err", err)
+			return nil, &oauth2.Error{Type: oauth2.ServerError, Status: http.StatusInternalServerError}
+		}
+		return nil, &oauth2.Error{Type: oauth2.InvalidGrant, Description: "Invalid or expired code parameter.", Status: http.StatusBadRequest}
+	}
+
+	if oerr := verifyPKCE(req.CodeVerifier, authCode.PKCE); oerr != nil {
+		return nil, oerr
+	}
+
+	if authCode.RedirectURI != req.RedirectURI {
+		return nil, &oauth2.Error{Type: oauth2.InvalidRequest, Description: "redirect_uri did not match URI from initial request.", Status: http.StatusBadRequest}
+	}
+
+	auth, withRefresh, err := ExchangeAuthCode(ctx, g.storage, g.connectors, g.logger, authCode, client)
+	if err != nil {
+		return nil, err
+	}
+	return issueTokens(ctx, g.logger, g.issuer, auth, authCode.ID, withRefresh)
+}
+
+// ExchangeAuthCode consumes a validated authorization code and returns the
+// authorization to issue tokens for and whether a refresh token is warranted. The
+// caller then mints the tokens, binding authCode.ID into c_hash. It is shared by
+// the authorization_code grant and the device flow, which both redeem an auth
+// code for tokens.
+//
+// DeleteAuthCode is the atomic single-use gate: it serializes concurrent
+// redemptions of the same code, so a second request finds the code already gone
+// and is rejected — a code yields tokens at most once. Consuming it before
+// minting means a signing failure afterwards leaves the code spent, which is the
+// right trade: replay safety over a retry on a rare signer outage.
+func ExchangeAuthCode(ctx context.Context, s storage.Storage, conns *connectors.Cache, logger *slog.Logger, authCode storage.AuthCode, client storage.Client) (tokens.Authorization, bool, error) {
+	if err := s.DeleteAuthCode(ctx, authCode.ID); err != nil {
+		if err == storage.ErrNotFound {
+			return tokens.Authorization{}, false, &oauth2.Error{Type: oauth2.InvalidGrant, Description: "Invalid or expired code parameter.", Status: http.StatusBadRequest}
+		}
+		logger.ErrorContext(ctx, "failed to delete auth code", "err", err)
+		return tokens.Authorization{}, false, &oauth2.Error{Type: oauth2.ServerError, Status: http.StatusInternalServerError}
+	}
+
+	auth := tokens.Authorization{
+		Client:        client,
+		Claims:        authCode.Claims,
+		Scopes:        authCode.Scopes,
+		ConnectorID:   authCode.ConnectorID,
+		Nonce:         authCode.Nonce,
+		AuthTime:      authCode.AuthTime,
+		ConnectorData: authCode.ConnectorData,
+
+		// Stamped on the code while the browser was still here: the token endpoint
+		// has no cookie to consult, and resolving the session from the user would
+		// hand this token whichever session that user has open elsewhere. A code
+		// redeemed after its session ended still names it, which is what the sid
+		// means — where the token came from. Whether that token is good for
+		// anything is the session check in introspection and refresh.
+		SessionID: authCode.SessionID,
+	}
+
+	// A refresh token is only issued when the connector supports it, the grant
+	// type is allowed and offline_access was requested (RFC 6749 §1.5).
+	conn, err := conns.Get(ctx, authCode.ConnectorID)
+	if err != nil {
+		logger.ErrorContext(ctx, "connector not found", "connector_id", authCode.ConnectorID, "err", err)
+		return tokens.Authorization{}, false, &oauth2.Error{Type: oauth2.ServerError, Status: http.StatusInternalServerError}
+	}
+
+	return auth, shouldIssueRefreshToken(conn, authCode.Scopes), nil
+}
diff --git a/server/grants/clientcredentials.go b/server/grants/clientcredentials.go
new file mode 100644
index 0000000000..fbdca60b13
--- /dev/null
+++ b/server/grants/clientcredentials.go
@@ -0,0 +1,82 @@
+package grants
+
+import (
+	"context"
+	"log/slog"
+	"net/http"
+
+	"github.com/dexidp/dex/server/connectors"
+	"github.com/dexidp/dex/server/oauth2"
+	"github.com/dexidp/dex/server/tokens"
+	"github.com/dexidp/dex/storage"
+)
+
+// clientCredentials serves the client_credentials grant: a confidential client
+// obtains tokens for itself, with no user involved.
+type clientCredentials struct {
+	issuer *tokens.Issuer
+	logger *slog.Logger
+}
+
+func (g *clientCredentials) GrantType() string {
+	return oauth2.GrantTypeClientCredentials
+}
+
+func (g *clientCredentials) RequiresClientAuth() bool {
+	return true
+}
+
+var clientCredentialsScopePolicy = ScopePolicy{
+	Standard: map[string]bool{
+		tokens.ScopeOpenID:  true,
+		tokens.ScopeEmail:   true,
+		tokens.ScopeProfile: true,
+		tokens.ScopeGroups:  true,
+	},
+	Rejected: map[string]string{
+		tokens.ScopeOfflineAccess: "client_credentials grant does not support offline_access scope.",
+		tokens.ScopeFederatedID:   "client_credentials grant does not support federated:id scope.",
+	},
+	ErrorType: oauth2.InvalidScope,
+}
+
+func (g *clientCredentials) ScopePolicy() ScopePolicy {
+	return clientCredentialsScopePolicy
+}
+
+// ConnectorID is empty: client_credentials involves no connector.
+func (g *clientCredentials) ConnectorID(ctx context.Context, req *Request, client storage.Client) (string, *oauth2.Error) {
+	return "", nil
+}
+
+func (g *clientCredentials) Authorize(ctx context.Context, req *Request, client storage.Client, conn connectors.Connector) (Responder, error) {
+	// client_credentials requires a confidential client.
+	if client.Public {
+		return nil, &oauth2.Error{Type: oauth2.UnauthorizedClient, Description: "Public clients cannot use client_credentials grant.", Status: http.StatusBadRequest}
+	}
+
+	// Build claims from the client itself — no user involved.
+	claims := storage.Claims{UserID: client.ID}
+	for _, scope := range req.Scopes {
+		switch scope {
+		case tokens.ScopeProfile:
+			claims.Username = client.Name
+			claims.PreferredUsername = client.Name
+		case tokens.ScopeGroups:
+			if client.ClientCredentialsClaims != nil {
+				claims.Groups = client.ClientCredentialsClaims.Groups
+			}
+		}
+	}
+
+	auth := tokens.Authorization{
+		Client: client,
+		Claims: claims,
+		Scopes: req.Scopes,
+		// Empty connector ID is unique for client credentials grant. Creating
+		// connectors with an empty ID via the config and API is prohibited.
+		ConnectorID: "",
+		Nonce:       req.Nonce,
+	}
+	return issueTokens(ctx, g.logger, g.issuer, auth, "", false)
+}
diff --git a/server/grants/devicecode.go b/server/grants/devicecode.go
new file mode 100644
index 0000000000..81a5ef446f
--- /dev/null
+++ b/server/grants/devicecode.go
@@ -0,0 +1,104 @@
+package grants
+
+import (
+	"context"
+	"log/slog"
+	"net/http"
+	"time"
+
+	"github.com/dexidp/dex/server/connectors"
+	"github.com/dexidp/dex/server/oauth2"
+	"github.com/dexidp/dex/storage"
+)
+
+// deviceCode serves the RFC 8628 device_code grant: the device polls for the
+// token minted and stored by the browser callback once the user authorizes it.
+// It issues nothing itself — a Minter returning the stored token — and drives the
+// authorization_pending / slow_down polling protocol.
+type deviceCode struct {
+	storage storage.Storage
+	now     func() time.Time
+	logger  *slog.Logger
+}
+
+func (g *deviceCode) GrantType() string {
+	return oauth2.GrantTypeDeviceCode
+}
+
+// RequiresClientAuth is false: the device is identified by the device code, not
+// client credentials.
+func (g *deviceCode) RequiresClientAuth() bool {
+	return false
+}
+
+func (g *deviceCode) ScopePolicy() ScopePolicy {
+	return ScopePolicy{}
+}
+
+func (g *deviceCode) ConnectorID(ctx context.Context, req *Request, client storage.Client) (string, *oauth2.Error) {
+	return "", nil
+}
+
+func (g *deviceCode) Authorize(ctx context.Context, req *Request, client storage.Client, conn connectors.Connector) (Responder, error) {
+	if req.DeviceCode == "" {
+		return nil, &oauth2.Error{Type: oauth2.InvalidRequest, Description: "No device code received", Status: http.StatusBadRequest}
+	}
+
+	now := g.now()
+	deviceToken, err := g.storage.GetDeviceToken(ctx, req.DeviceCode)
+	if err != nil {
+		if err != storage.ErrNotFound {
+			g.logger.ErrorContext(ctx, "failed to get device code", "err", err)
+		}
+		return nil, &oauth2.Error{Type: oauth2.InvalidRequest, Description: "Invalid Device code.", Status: http.StatusBadRequest}
+	}
+	if now.After(deviceToken.Expiry) {
+		return nil, &oauth2.Error{Type: oauth2.DeviceTokenExpired, Status: http.StatusBadRequest}
+	}
+
+	// Rate limiting: increase the poll interval until the device waits long enough.
+	slowDown := false
+	pollInterval := deviceToken.PollIntervalSeconds
+	if now.Before(deviceToken.LastRequestTime.Add(time.Second * time.Duration(pollInterval))) {
+		slowDown = true
+		pollInterval += 5
+	} else {
+		pollInterval = 5
+	}
+
+	switch deviceToken.Status {
+	case oauth2.DeviceTokenPending:
+		updater := func(old storage.DeviceToken) (storage.DeviceToken, error) {
+			old.PollIntervalSeconds = pollInterval
+			old.LastRequestTime = now
+			return old, nil
+		}
+		if err := g.storage.UpdateDeviceToken(ctx, req.DeviceCode, updater); err != nil {
+			g.logger.ErrorContext(ctx, "failed to update device token", "err", err)
+			return nil, &oauth2.Error{Type: oauth2.ServerError, Status: http.StatusInternalServerError}
+		}
+		if slowDown {
+			return nil, &oauth2.Error{Type: oauth2.DeviceTokenSlowDown, Status: http.StatusBadRequest}
+		}
+		return nil, &oauth2.Error{Type: oauth2.DeviceTokenPending, Status: http.StatusBadRequest}
+
+	case oauth2.DeviceTokenComplete:
+		if oerr := verifyPKCE(req.CodeVerifier, deviceToken.PKCE); oerr != nil {
+			return nil, oerr
+		}
+		// The token was minted and stored by the browser callback; relay it verbatim.
+		return storedResponse(deviceToken.Token), nil
+
+	default:
+		return nil, &oauth2.Error{Type: oauth2.InvalidRequest, Description: "Invalid Device code.", Status: http.StatusBadRequest}
+	}
+}
+
+// storedResponse writes an already-serialized token response verbatim.
+type storedResponse string
+
+func (s storedResponse) Write(w http.ResponseWriter) error {
+	w.Header().Set("Content-Type", "application/json")
+	_, err := w.Write([]byte(s))
+	return err
+}
diff --git a/server/grants/doc.go b/server/grants/doc.go
new file mode 100644
index 0000000000..e73e6cb199
--- /dev/null
+++ b/server/grants/doc.go
@@ -0,0 +1,5 @@
+// Package grants implements the OAuth2 token endpoint (/token). It defines a
+// Grant abstraction — one handler per grant_type — and a Handler that
+// dispatches a token request to the grant registered for its grant_type,
+// authenticating the client first when the grant requires it.
+package grants
diff --git a/server/grants/grants.go b/server/grants/grants.go
new file mode 100644
index 0000000000..04eba65cf5
--- /dev/null
+++ b/server/grants/grants.go
@@ -0,0 +1,404 @@
+package grants
+
+import (
+	"context"
+	"crypto/subtle"
+	"errors"
+	"log/slog"
+	"net/http"
+	"net/url"
+	"slices"
+	"strings"
+	"time"
+
+	"github.com/dexidp/dex/connector"
+	"github.com/dexidp/dex/server/connectors"
+	"github.com/dexidp/dex/server/internal"
+	"github.com/dexidp/dex/server/oauth2"
+	"github.com/dexidp/dex/server/router"
+	"github.com/dexidp/dex/server/session"
+	"github.com/dexidp/dex/server/tokens"
+	"github.com/dexidp/dex/storage"
+)
+
+// Request is the parsed token-endpoint request. Every field the grants read is
+// parsed once, here, so a grant never reaches into the raw form.
+type Request struct {
+	ClientID     string
+	ClientSecret string
+	Scopes       []string
+	Nonce        string
+	ConnectorID  string
+
+	// authorization_code
+	Code         string
+	RedirectURI  string
+	CodeVerifier string
+
+	// refresh_token
+	RefreshToken string
+
+	// device_code
+	DeviceCode string
+
+	// password
+	Username string
+	Password string
+
+	// token exchange (RFC 8693)
+	SubjectToken       string
+	SubjectTokenType   string
+	RequestedTokenType string
+
+	// refresh holds the refresh token the refresh grant looks up while resolving
+	// the connector, so it is fetched and decoded once and reused in Authorize.
+	refresh   *storage.RefreshToken
+	refreshID *internal.RefreshToken
+}
+
+// parseRequest reads the whole token request form once. Client credentials come
+// from the Authorization header when present, otherwise from the form.
+func parseRequest(r *http.Request) (*Request, *oauth2.Error) {
+	if err := r.ParseForm(); err != nil {
+		return nil, &oauth2.Error{Type: oauth2.InvalidRequest, Status: http.StatusBadRequest}
+	}
+
+	req := &Request{
+		Scopes:             strings.Fields(r.PostFormValue("scope")),
+		Nonce:              r.PostFormValue("nonce"),
+		ConnectorID:        r.PostFormValue("connector_id"),
+		DeviceCode:         r.PostFormValue("device_code"),
+		Code:               r.PostFormValue("code"),
+		RedirectURI:        r.PostFormValue("redirect_uri"),
+		CodeVerifier:       r.PostFormValue("code_verifier"),
+		RefreshToken:       r.PostFormValue("refresh_token"),
+		Username:           r.PostFormValue("username"),
+		Password:           r.PostFormValue("password"),
+		SubjectToken:       r.PostFormValue("subject_token"),
+		SubjectTokenType:   r.PostFormValue("subject_token_type"),
+		RequestedTokenType: r.PostFormValue("requested_token_type"),
+	}
+
+	if id, secret, ok := r.BasicAuth(); ok {
+		var err error
+		if req.ClientID, err = url.QueryUnescape(id); err != nil {
+			return nil, &oauth2.Error{Type: oauth2.InvalidRequest, Description: "client_id improperly encoded", Status: http.StatusBadRequest}
+		}
+		if req.ClientSecret, err = url.QueryUnescape(secret); err != nil {
+			return nil, &oauth2.Error{Type: oauth2.InvalidRequest, Description: "client_secret improperly encoded", Status: http.StatusBadRequest}
+		}
+	} else {
+		req.ClientID = r.PostFormValue("client_id")
+		req.ClientSecret = r.PostFormValue("client_secret")
+	}
+
+	return req, nil
+}
+
+// Responder writes the token endpoint's HTTP response body. tokens.Response is
+// the usual one; a grant that returns an already-serialized body (device_code
+// relays the token stored by the browser callback) returns its own.
+type Responder interface {
+	Write(w http.ResponseWriter) error
+}
+
+// Grant serves one OAuth2 grant type at the token endpoint. It is a set of hooks
+// the Handler calls in order — the shared phases (client auth, scope validation,
+// connector resolution, response writing) live on the Handler, so a grant only
+// fills in the parts unique to it and cannot forget a shared step.
+type Grant interface {
+	// GrantType is the grant_type value this grant serves.
+	GrantType() string
+	// RequiresClientAuth reports whether the endpoint must authenticate the
+	// client before the request is processed.
+	RequiresClientAuth() bool
+	// ScopePolicy reports how the endpoint validates the requested scopes for
+	// this grant.
+	ScopePolicy() ScopePolicy
+	// ConnectorID is the connector this grant authenticates against; the endpoint
+	// resolves it and enforces the connector-authorization invariant (client
+	// allows it, connector allows the grant type) before Authorize. The grant may
+	// read it from the request or look it up in storage; returning an error
+	// rejects the request. Returning "" skips the step — for a grant that uses no
+	// connector (client_credentials, device_code), or one already authorized
+	// elsewhere (authorization_code was gated at /auth and resolves its connector
+	// inside Authorize only to decide on a refresh token).
+	ConnectorID(ctx context.Context, req *Request, client storage.Client) (string, *oauth2.Error)
+	// Authorize proves the identity against conn (the zero Connector when
+	// ConnectorID is "") and produces the response to write. Standard grants build
+	// it with the shared issueTokens helper; a grant with a non-standard response
+	// builds its own. Returning an *oauth2.Error makes the endpoint write it.
+	Authorize(ctx context.Context, req *Request, client storage.Client, conn connectors.Connector) (Responder, error)
+}
+
+// ScopePolicy configures the shared scope-validation phase for a grant. It is
+// the single place scope rules are enforced, so no grant re-implements the
+// cross-client trust check or scope filtering.
+type ScopePolicy struct {
+	// Standard is the set of standard (non cross-client) scopes the grant
+	// accepts. When nil, scopes are passed through unvalidated (token exchange).
+	Standard map[string]bool
+	// RequireOpenID rejects the request when the openid scope is absent.
+	RequireOpenID bool
+	// Rejected maps an explicitly refused scope to its rejection message.
+	Rejected map[string]string
+	// ErrorType is the OAuth2 error code returned for scope violations.
+	ErrorType string
+}
+
+// Handler is the /token endpoint. It owns the phases shared by every grant —
+// dispatch by grant_type, client authentication, scope validation, connector
+// resolution and writing the response or error — while each grant carries only
+// its own narrow dependencies. It mounts its own routes (router.Handler).
+type Handler struct {
+	Issuer              *tokens.Issuer
+	Storage             storage.Storage
+	Connectors          *connectors.Cache
+	Now                 func() time.Time
+	Logger              *slog.Logger
+	PasswordConnector   string
+	RefreshPolicy       *tokens.RefreshStrategy
+	Sessions            *session.Manager
+	SessionsEnabled     bool
+	SupportedGrantTypes []string
+
+	grants map[string]Grant
+}
+
+func (h *Handler) register(supported []string, gs ...Grant) {
+	for _, g := range gs {
+		if slices.Contains(supported, g.GrantType()) {
+			h.grants[g.GrantType()] = g
+		}
+	}
+}
+
+// Mount wires the endpoint's grants and registers the token route. Only grants
+// whose type is in SupportedGrantTypes are registered, so a grant type disabled
+// by config is simply not served.
+func (h *Handler) Mount(m router.Mux) {
+	h.grants = map[string]Grant{}
+	h.register(h.SupportedGrantTypes,
+		&clientCredentials{issuer: h.Issuer, logger: h.Logger},
+		&password{issuer: h.Issuer, logger: h.Logger, connectorID: h.PasswordConnector},
+		&tokenExchange{issuer: h.Issuer, logger: h.Logger},
+		&authorizationCode{issuer: h.Issuer, storage: h.Storage, connectors: h.Connectors, now: h.Now, logger: h.Logger},
+		&refresh{storage: h.Storage, issuer: h.Issuer, policy: h.RefreshPolicy, sessions: h.Sessions, sessionsEnabled: h.SessionsEnabled, now: h.Now, logger: h.Logger},
+		&deviceCode{storage: h.Storage, now: h.Now, logger: h.Logger},
+	)
+	m.HandleCORS("/token", h.handleToken)
+}
+
+// handleToken serves /token: it validates the request shape and dispatches to the
+// grant for its grant_type.
+func (h *Handler) handleToken(w http.ResponseWriter, r *http.Request) {
+	ctx := r.Context()
+	w.Header().Set("Content-Type", "application/json")
+	if r.Method != http.MethodPost {
+		h.writeError(ctx, w, &oauth2.Error{Type: oauth2.InvalidRequest, Description: "method not allowed", Status: http.StatusBadRequest})
+		return
+	}
+	if err := r.ParseForm(); err != nil {
+		h.Logger.ErrorContext(ctx, "could not parse request body", "err", err)
+		h.writeError(ctx, w, &oauth2.Error{Type: oauth2.InvalidRequest, Status: http.StatusBadRequest})
+		return
+	}
+
+	grantType := r.PostFormValue("grant_type")
+	if !h.dispatch(w, r, grantType) {
+		h.Logger.ErrorContext(ctx, "unsupported grant type", "grant_type", grantType)
+		h.writeError(ctx, w, &oauth2.Error{Type: oauth2.UnsupportedGrantType, Status: http.StatusBadRequest})
+	}
+}
+
+// dispatch runs the token-endpoint pipeline for the grant registered for
+// grantType. It reports whether a grant handled the request, so the caller can
+// fall back (e.g. the implicit grant, which is not a token-endpoint grant).
+func (h *Handler) dispatch(w http.ResponseWriter, r *http.Request, grantType string) bool {
+	grant, ok := h.grants[grantType]
+	if !ok {
+		return false
+	}
+
+	ctx := r.Context()
+	req, oerr := parseRequest(r)
+	if oerr != nil {
+		h.writeError(ctx, w, oerr)
+		return true
+	}
+
+	// 1. Authenticate the client.
+	client := storage.Client{}
+	if grant.RequiresClientAuth() {
+		client, ok = h.authenticateClient(ctx, w, req)
+		if !ok {
+			return true
+		}
+	}
+
+	// 2. Validate the requested scopes.
+	if oerr := h.validateScopes(ctx, client, req, grant.ScopePolicy()); oerr != nil {
+		h.writeError(ctx, w, oerr)
+		return true
+	}
+
+	// 3. Resolve the grant's connector and enforce the connector-authorization
+	// invariant. A grant that uses no connector resolves to the zero Connector.
+	connID, oerr := grant.ConnectorID(ctx, req, client)
+	if oerr != nil {
+		h.writeError(ctx, w, oerr)
+		return true
+	}
+	conn, oerr := h.resolveConnector(ctx, connID, client, grant.GrantType())
+	if oerr != nil {
+		h.writeError(ctx, w, oerr)
+		return true
+	}
+
+	// 4. Let the grant prove the identity and produce the response.
+	resp, err := grant.Authorize(ctx, req, client, conn)
+	if err != nil {
+		h.writeError(ctx, w, err)
+		return true
+	}
+
+	// 5. Write the response.
+	if err := resp.Write(w); err != nil {
+		h.Logger.ErrorContext(ctx, "failed to write token response", "err", err)
+	}
+	return true
+}
+
+// validateScopes validates the requested scopes per the grant's policy: it
+// rejects refused scopes, filters unknown ones, enforces openid when required,
+// and verifies cross-client trust — the security-sensitive check that must run
+// for every grant. A nil policy set passes scopes through unvalidated.
+func (h *Handler) validateScopes(ctx context.Context, client storage.Client, req *Request, p ScopePolicy) *oauth2.Error {
+	if p.Standard == nil {
+		return nil
+	}
+
+	var unrecognized, invalid []string
+	for _, scope := range req.Scopes {
+		if msg, refused := p.Rejected[scope]; refused {
+			return &oauth2.Error{Type: p.ErrorType, Description: msg, Status: http.StatusBadRequest}
+		}
+		if p.Standard[scope] {
+			continue
+		}
+
+		peerID, ok := tokens.ParseCrossClientScope(scope)
+		if !ok {
+			unrecognized = append(unrecognized, scope)
+			continue
+		}
+		trusted, err := tokens.CrossClientTrusted(ctx, h.Storage, client.ID, peerID)
+		if err != nil {
+			h.Logger.ErrorContext(ctx, "error validating cross client trust", "client_id", client.ID, "peer_id", peerID, "err", err)
+			return &oauth2.Error{Type: oauth2.InvalidClient, Description: "Error validating cross client trust.", Status: http.StatusBadRequest}
+		}
+		if !trusted {
+			invalid = append(invalid, scope)
+		}
+	}
+
+	if p.RequireOpenID && !tokens.HasOpenID(req.Scopes) {
+		return &oauth2.Error{Type: p.ErrorType, Description: `Missing required scope(s) ["openid"].`, Status: http.StatusBadRequest}
+	}
+	if len(unrecognized) > 0 {
+		return oauth2.Errorf(p.ErrorType, http.StatusBadRequest, "Unrecognized scope(s) %q", unrecognized)
+	}
+	if len(invalid) > 0 {
+		return oauth2.Errorf(p.ErrorType, http.StatusBadRequest, "Client can't request scope(s) %q", invalid)
+	}
+	return nil
+}
+
+// resolveConnector enforces the connector-authorization invariant and returns the
+// opened connector: the client must allow the connector, and the connector must
+// permit the grant type. connID == "" (a grant that uses no connector) resolves
+// to the zero Connector. Running here, before Authorize, means no grant can
+// forget the check.
+func (h *Handler) resolveConnector(ctx context.Context, connID string, client storage.Client, grantType string) (connectors.Connector, *oauth2.Error) {
+	if connID == "" {
+		return connectors.Connector{}, nil
+	}
+
+	if !connectors.ConnectorAllowed(client.AllowedConnectors, connID) {
+		h.Logger.WarnContext(ctx, "connector not allowed for client", "client_id", client.ID, "connector_id", connID)
+		return connectors.Connector{}, &oauth2.Error{Type: oauth2.InvalidGrant, Description: "Connector not allowed for this client.", Status: http.StatusBadRequest}
+	}
+	conn, err := h.Connectors.Get(ctx, connID)
+	if err != nil {
+		h.Logger.ErrorContext(ctx, "failed to get connector", "connector_id", connID, "err", err)
+		return connectors.Connector{}, &oauth2.Error{Type: oauth2.InvalidRequest, Description: "Requested connector does not exist.", Status: http.StatusBadRequest}
+	}
+	if !connectors.GrantTypeAllowed(conn.GrantTypes, grantType) {
+		h.Logger.ErrorContext(ctx, "connector does not allow grant", "connector_id", connID, "grant_type", grantType)
+		return connectors.Connector{}, &oauth2.Error{Type: oauth2.InvalidRequest, Description: "Requested connector does not support this grant type.", Status: http.StatusBadRequest}
+	}
+	return conn, nil
+}
+
+// authenticateClient resolves the client from the parsed credentials. On failure
+// it writes the error response and returns ok=false.
+func (h *Handler) authenticateClient(ctx context.Context, w http.ResponseWriter, req *Request) (storage.Client, bool) {
+	client, err := h.Storage.GetClient(ctx, req.ClientID)
+	if err != nil {
+		if err != storage.ErrNotFound {
+			h.Logger.ErrorContext(ctx, "failed to get client", "err", err)
+			h.writeError(ctx, w, &oauth2.Error{Type: oauth2.ServerError, Status: http.StatusInternalServerError})
+		} else {
+			h.writeError(ctx, w, &oauth2.Error{Type: oauth2.InvalidClient, Description: "Invalid client credentials.", Status: http.StatusUnauthorized})
+		}
+		return storage.Client{}, false
+	}
+
+	if subtle.ConstantTimeCompare([]byte(client.Secret), []byte(req.ClientSecret)) != 1 {
+		if req.ClientSecret == "" {
+			h.Logger.InfoContext(ctx, "missing client_secret on token request", "client_id", client.ID)
+		} else {
+			h.Logger.InfoContext(ctx, "invalid client_secret on token request", "client_id", client.ID)
+		}
+		h.writeError(ctx, w, &oauth2.Error{Type: oauth2.InvalidClient, Description: "Invalid client credentials.", Status: http.StatusUnauthorized})
+		return storage.Client{}, false
+	}
+
+	return client, true
+}
+
+// writeError writes err as an OAuth2 error response. An *oauth2.Error carries its
+// own type/description/status; anything else is reported as a server error.
+func (h *Handler) writeError(ctx context.Context, w http.ResponseWriter, err error) {
+	var oerr *oauth2.Error
+	if !errors.As(err, &oerr) || oerr == nil {
+		h.Logger.ErrorContext(ctx, "token request failed", "err", err)
+		oerr = &oauth2.Error{Type: oauth2.ServerError, Status: http.StatusInternalServerError}
+	}
+	oauth2.WriteErrorResponse(h.Logger, w, oerr.Type, oerr.Description, oerr.Status)
+}
+
+// issue mints the standard token response — the single mint every standard grant
+// shares — logging and mapping a signing failure to a server error. code is the
+// authorization code bound into the ID token's c_hash, empty when there is none.
+func issueTokens(ctx context.Context, logger *slog.Logger, issuer *tokens.Issuer, auth tokens.Authorization, code string, withRefresh bool) (Responder, error) {
+	resp, err := issuer.IssueResponse(ctx, auth, code, withRefresh)
+	if err != nil {
+		logger.ErrorContext(ctx, "failed to issue tokens", "err", err)
+		return nil, &oauth2.Error{Type: oauth2.ServerError, Status: http.StatusInternalServerError}
+	}
+	return resp, nil
+}
+
+// shouldIssueRefreshToken reports whether a refresh token should be issued: the
+// connector supports refresh, the connector permits the refresh_token grant, and
+// offline_access was requested. A refresh token is never mandatory (RFC 6749 §1.5).
+func shouldIssueRefreshToken(conn connectors.Connector, scopes []string) bool {
+	if _, ok := conn.Connector.(connector.RefreshConnector); !ok {
+		return false
+	}
+	if !connectors.GrantTypeAllowed(conn.GrantTypes, oauth2.GrantTypeRefreshToken) {
+		return false
+	}
+	return slices.Contains(scopes, tokens.ScopeOfflineAccess)
+}
diff --git a/server/grants/password.go b/server/grants/password.go
new file mode 100644
index 0000000000..1442f86684
--- /dev/null
+++ b/server/grants/password.go
@@ -0,0 +1,77 @@
+package grants
+
+import (
+	"context"
+	"log/slog"
+	"net/http"
+
+	"github.com/dexidp/dex/connector"
+	"github.com/dexidp/dex/server/connectors"
+	"github.com/dexidp/dex/server/oauth2"
+	"github.com/dexidp/dex/server/tokens"
+	"github.com/dexidp/dex/storage"
+)
+
+// password serves the Resource Owner Password Credentials grant: the client
+// exchanges a username and password for tokens via a password-capable connector.
+type password struct {
+	issuer      *tokens.Issuer
+	logger      *slog.Logger
+	connectorID string
+}
+
+func (g *password) GrantType() string {
+	return oauth2.GrantTypePassword
+}
+
+func (g *password) RequiresClientAuth() bool {
+	return true
+}
+
+var passwordScopePolicy = ScopePolicy{
+	Standard: map[string]bool{
+		tokens.ScopeOpenID:        true,
+		tokens.ScopeOfflineAccess: true,
+		tokens.ScopeEmail:         true,
+		tokens.ScopeProfile:       true,
+		tokens.ScopeGroups:        true,
+		tokens.ScopeFederatedID:   true,
+	},
+	RequireOpenID: true,
+	ErrorType:     oauth2.InvalidRequest,
+}
+
+func (g *password) ScopePolicy() ScopePolicy {
+	return passwordScopePolicy
+}
+
+// ConnectorID is the connector the password grant is configured to use.
+func (g *password) ConnectorID(ctx context.Context, req *Request, client storage.Client) (string, *oauth2.Error) {
+	return g.connectorID, nil
+}
+
+func (g *password) Authorize(ctx context.Context, req *Request, client storage.Client, conn connectors.Connector) (Responder, error) {
+	passwordConnector, ok := conn.Connector.(connector.PasswordConnector)
+	if !ok {
+		return nil, &oauth2.Error{Type: oauth2.InvalidRequest, Description: "Requested password connector does not correct type.", Status: http.StatusBadRequest}
+	}
+
+	identity, ok, err := passwordConnector.Login(ctx, tokens.ParseScopes(req.Scopes), req.Username, req.Password)
+	if err != nil {
+		g.logger.ErrorContext(ctx, "failed to login user", "err", err)
+		return nil, &oauth2.Error{Type: oauth2.InvalidRequest, Description: "Could not login user", Status: http.StatusBadRequest}
+	}
+	if !ok {
+		return nil, &oauth2.Error{Type: oauth2.AccessDenied, Description: "Invalid username or password", Status: http.StatusUnauthorized}
+	}
+
+	auth := tokens.Authorization{
+		Client:        client,
+		Claims:        tokens.ClaimsFromIdentity(identity),
+		Scopes:        req.Scopes,
+		ConnectorID:   g.connectorID,
+		Nonce:         req.Nonce,
+		ConnectorData: identity.ConnectorData,
+	}
+	return issueTokens(ctx, g.logger, g.issuer, auth, "", shouldIssueRefreshToken(conn, req.Scopes))
+}
diff --git a/server/grants/pkce.go b/server/grants/pkce.go
new file mode 100644
index 0000000000..a505809a38
--- /dev/null
+++ b/server/grants/pkce.go
@@ -0,0 +1,31 @@
+package grants
+
+import (
+	"net/http"
+
+	"github.com/dexidp/dex/server/oauth2"
+	"github.com/dexidp/dex/storage"
+)
+
+// verifyPKCE checks a code_verifier against a stored PKCE challenge (RFC 7636).
+// It is the single PKCE check, shared by the authorization_code and device_code
+// grants, which redeem a code challenge stored at /auth.
+func verifyPKCE(codeVerifier string, pkce storage.PKCE) *oauth2.Error {
+	switch {
+	case codeVerifier != "" && pkce.CodeChallenge != "":
+		calculated, err := oauth2.CalculateCodeChallenge(codeVerifier, pkce.CodeChallengeMethod)
+		if err != nil {
+			return &oauth2.Error{Type: oauth2.ServerError, Status: http.StatusInternalServerError}
+		}
+		if pkce.CodeChallenge != calculated {
+			return &oauth2.Error{Type: oauth2.InvalidGrant, Description: "Invalid code_verifier.", Status: http.StatusBadRequest}
+		}
+	case codeVerifier != "":
+		// No code_challenge on /auth, but a code_verifier on /token.
+		return &oauth2.Error{Type: oauth2.InvalidRequest, Description: "No PKCE flow started. Cannot check code_verifier.", Status: http.StatusBadRequest}
+	case pkce.CodeChallenge != "":
+		// PKCE started on /auth, but no code_verifier on /token.
+		return &oauth2.Error{Type: oauth2.InvalidGrant, Description: "Expecting parameter code_verifier in PKCE flow.", Status: http.StatusBadRequest}
+	}
+	return nil
+}
diff --git a/server/grants/refresh.go b/server/grants/refresh.go
new file mode 100644
index 0000000000..300d93d5f8
--- /dev/null
+++ b/server/grants/refresh.go
@@ -0,0 +1,307 @@
+package grants
+
+import (
+	"context"
+	"errors"
+	"log/slog"
+	"net/http"
+	"slices"
+	"time"
+
+	"github.com/dexidp/dex/connector"
+	"github.com/dexidp/dex/server/connectors"
+	"github.com/dexidp/dex/server/internal"
+	"github.com/dexidp/dex/server/oauth2"
+	"github.com/dexidp/dex/server/session"
+	"github.com/dexidp/dex/server/tokens"
+	"github.com/dexidp/dex/storage"
+)
+
+// refresh serves the refresh_token grant: it validates and rotates a refresh
+// token, re-reads the identity (from the session or the upstream connector) and
+// issues a fresh token set. Its response reuses the rotated refresh token rather
+// than minting a new one, so it mints its own instead of the standard Issue.
+type refresh struct {
+	sessions        *session.Manager
+	storage         storage.Storage
+	issuer          *tokens.Issuer
+	policy          *tokens.RefreshStrategy
+	sessionsEnabled bool
+	now             func() time.Time
+	logger          *slog.Logger
+}
+
+func (g *refresh) GrantType() string {
+	return oauth2.GrantTypeRefreshToken
+}
+
+func (g *refresh) RequiresClientAuth() bool {
+	return true
+}
+
+// Scopes are validated against the token's originally authorized scopes in
+// Authorize, not against a fixed set, so the shared phase passes them through.
+func (g *refresh) ScopePolicy() ScopePolicy {
+	return ScopePolicy{}
+}
+
+// ConnectorID validates the refresh token and reports the connector recorded on
+// it, so the endpoint resolves and re-checks that connector on every refresh: a
+// client's allowed connectors, or a connector's grant types, may have been
+// tightened after the token was issued. The looked-up and decoded token is
+// stashed on the request so Authorize reuses it without a second lookup or parse.
+func (g *refresh) ConnectorID(ctx context.Context, req *Request, client storage.Client) (string, *oauth2.Error) {
+	token, oerr := parseRefreshToken(req.RefreshToken)
+	if oerr != nil {
+		return "", oerr
+	}
+
+	refreshToken, err := tokens.LookupRefreshToken(ctx, g.storage, g.policy, g.logger, &client.ID, token)
+	if err != nil {
+		return "", refreshLookupError(err)
+	}
+
+	req.refresh, req.refreshID = refreshToken, token
+	return refreshToken.ConnectorID, nil
+}
+
+// Authorize rotates the refresh token, re-reads the identity against the resolved
+// connector, and returns the token set — reusing the rotated refresh token, so it
+// mints its own response rather than the standard set (which would mint a second
+// refresh token).
+func (g *refresh) Authorize(ctx context.Context, req *Request, client storage.Client, conn connectors.Connector) (Responder, error) {
+	refreshToken := req.refresh
+
+	scopes, oerr := g.refreshScopes(req, refreshToken)
+	if oerr != nil {
+		return nil, oerr
+	}
+
+	// Resolved before anything is rotated or read from the connector: a token whose
+	// session has ended is not going to produce a token set. Skipped outright when
+	// sessions are off — nothing was ever bound to one, so the read would only
+	// confirm that, and refusing a refresh over it would be indefensible.
+	var sessionID string
+	if g.sessionsEnabled {
+		var oerr *oauth2.Error
+		if sessionID, oerr = g.sessionID(ctx, refreshToken, client); oerr != nil {
+			return nil, oerr
+		}
+	}
+
+	var userIdent *storage.UserIdentity
+	if g.sessionsEnabled {
+		ui, err := g.storage.GetUserIdentity(ctx, refreshToken.Claims.UserID, refreshToken.ConnectorID)
+		if err != nil {
+			g.logger.ErrorContext(ctx, "failed to get user identity", "err", err)
+			return nil, &oauth2.Error{Type: oauth2.InvalidRequest, Status: http.StatusInternalServerError}
+		}
+		userIdent = &ui
+	}
+
+	authTime := time.Time{}
+	if userIdent != nil {
+		authTime = userIdent.LastLogin
+	}
+
+	// When sessions are enabled, downstream refresh is disconnected from the
+	// upstream provider: use the claims cached in UserIdentity at the last login
+	// instead of contacting the connector (which may fail if the upstream token
+	// has expired). Otherwise re-read the identity from the connector.
+	freshIdentity := func(ctx context.Context) (connector.Identity, error) {
+		if userIdent != nil {
+			return tokens.IdentityFromClaims(userIdent.Claims), nil
+		}
+		connectorData, err := g.refreshConnectorData(ctx, refreshToken)
+		if err != nil {
+			return connector.Identity{}, err
+		}
+		return g.refreshWithConnector(ctx, conn, connectorData, scopes, tokens.IdentityFromClaims(refreshToken.Claims))
+	}
+
+	rawNewToken, ident, err := g.issuer.Refresh.Rotate(ctx, refreshToken, req.refreshID, g.policy, freshIdentity)
+	if err != nil {
+		g.logger.ErrorContext(ctx, "failed to rotate refresh token", "err", err)
+		return nil, &oauth2.Error{Type: oauth2.InvalidRequest, Status: http.StatusInternalServerError}
+	}
+
+	auth := tokens.Authorization{
+		Client:      client,
+		Claims:      tokens.ClaimsFromIdentity(ident),
+		Scopes:      scopes,
+		ConnectorID: refreshToken.ConnectorID,
+		Nonce:       refreshToken.Nonce,
+		AuthTime:    authTime,
+		SessionID:   sessionID,
+	}
+
+	accessToken, _, err := g.issuer.SignAccessToken(ctx, auth)
+	if err != nil {
+		g.logger.ErrorContext(ctx, "failed to create new access token", "err", err)
+		return nil, &oauth2.Error{Type: oauth2.InvalidRequest, Status: http.StatusInternalServerError}
+	}
+	idToken, expiry, err := g.issuer.SignIDToken(ctx, auth, accessToken, "")
+	if err != nil {
+		g.logger.ErrorContext(ctx, "failed to create ID token", "err", err)
+		return nil, &oauth2.Error{Type: oauth2.InvalidRequest, Status: http.StatusInternalServerError}
+	}
+
+	ts := tokens.TokenSet{AccessToken: accessToken, IDToken: idToken, RefreshToken: rawNewToken, Expiry: expiry}
+	return ts.Response(g.now()), nil
+}
+
+// sessionID returns the sid for the refreshed tokens, and refuses the refresh when
+// the session has ended and the client asked its tokens to end with it.
+//
+// The sid names where a token came from and is carried across refreshes unchanged,
+// dead session or not; stripping it would make the token active again at the next
+// refresh, undoing what introspection just reported. Whether the token is still good
+// for anything is the client's RefreshTokenLifetime, read the same way here and in
+// introspection (see sessionAlive in server/introspection).
+//
+// Origin comes from the stored reference and nowhere else: a token minted outside a
+// browser flow has none and must not acquire one from whatever session its user
+// happens to have open.
+func (g *refresh) sessionID(ctx context.Context, refreshToken *storage.RefreshToken, client storage.Client) (string, *oauth2.Error) {
+	bound := client.RefreshBoundToSession()
+
+	offlineSessions, err := g.storage.GetOfflineSessions(ctx, refreshToken.Claims.UserID, refreshToken.ConnectorID)
+	if err != nil {
+		if !errors.Is(err, storage.ErrNotFound) {
+			g.logger.ErrorContext(ctx, "refresh: failed to read offline session for sid", "err", err)
+		}
+		if bound {
+			// Nothing to check the token against. For a standalone token that costs
+			// only its sid, which can make it look less bound than it is but never
+			// more; for a bound one it would mean handing out a token whose whole
+			// validity rests on a session nobody could read.
+			return "", sessionEndedError()
+		}
+		return "", nil
+	}
+
+	ref, ok := offlineSessions.Refresh[refreshToken.ClientID]
+	if !ok || ref.SessionID == "" {
+		// Issued outside a browser flow — the password grant, or before sessions were
+		// turned on. There is no session to be bound to, so there is none to end.
+		return "", nil
+	}
+
+	if !bound {
+		return ref.SessionID, nil
+	}
+
+	if !g.sessions.Alive(ctx, ref.SessionID) {
+		// Through the store, not storage.DeleteRefresh: the token and the offline
+		// session's reference to it have to go together, or the admin API lists a
+		// token that no longer exists and fails trying to revoke it.
+		g.issuer.Refresh.RevokeClients(ctx, refreshToken.Claims.UserID, refreshToken.ConnectorID,
+			[]string{refreshToken.ClientID})
+
+		g.logger.InfoContext(ctx, "refresh: refused, session ended",
+			"client_id", refreshToken.ClientID, "user_id", refreshToken.Claims.UserID)
+		return "", sessionEndedError()
+	}
+	return ref.SessionID, nil
+}
+
+// sessionEndedError reports a refused refresh as invalid_grant, the one code RFC
+// 6749 §5.2 has for a refresh token that is no longer good for anything. The client
+// owns the session in question, so the description names the reason.
+func sessionEndedError() *oauth2.Error {
+	return &oauth2.Error{
+		Type:        oauth2.InvalidGrant,
+		Description: "The session this refresh token belongs to has ended.",
+		Status:      http.StatusBadRequest,
+	}
+}
+
+// refreshScopes resolves the scopes for this refresh. Per RFC 6749 §6 the client
+// may omit them (defaulting to the originally authorized scopes) but may not
+// widen them.
+func (g *refresh) refreshScopes(req *Request, refreshToken *storage.RefreshToken) ([]string, *oauth2.Error) {
+	if len(req.Scopes) == 0 {
+		return refreshToken.Scopes, nil
+	}
+
+	var unauthorized []string
+	for _, scope := range req.Scopes {
+		if !slices.Contains(refreshToken.Scopes, scope) {
+			unauthorized = append(unauthorized, scope)
+		}
+	}
+	if len(unauthorized) > 0 {
+		return nil, oauth2.Errorf(oauth2.InvalidRequest, http.StatusBadRequest, "Requested scopes contain unauthorized scope(s): %q.", unauthorized)
+	}
+	return req.Scopes, nil
+}
+
+// refreshConnectorData returns the connector data for the upstream refresh: the
+// token's own data for legacy tokens that still carry it, otherwise the value on
+// the user's offline session.
+func (g *refresh) refreshConnectorData(ctx context.Context, refreshToken *storage.RefreshToken) ([]byte, error) {
+	if len(refreshToken.ConnectorData) > 0 {
+		return refreshToken.ConnectorData, nil
+	}
+
+	session, err := g.storage.GetOfflineSessions(ctx, refreshToken.Claims.UserID, refreshToken.ConnectorID)
+	if err != nil {
+		if err != storage.ErrNotFound {
+			g.logger.ErrorContext(ctx, "failed to get offline session", "err", err)
+			return nil, err
+		}
+		return nil, nil
+	}
+	return session.ConnectorData, nil
+}
+
+// refreshWithConnector re-reads the identity from the upstream connector when it
+// supports refreshing.
+func (g *refresh) refreshWithConnector(ctx context.Context, conn connectors.Connector, connectorData []byte, scopes []string, ident connector.Identity) (connector.Identity, error) {
+	refreshConn, ok := conn.Connector.(connector.RefreshConnector)
+	if !ok {
+		return ident, nil
+	}
+
+	ident.ConnectorData = connectorData
+	g.logger.Debug("connector data before refresh", "connector_data", ident.ConnectorData)
+
+	newIdent, err := refreshConn.Refresh(ctx, tokens.ParseScopes(scopes), ident)
+	if err != nil {
+		g.logger.ErrorContext(ctx, "failed to refresh identity", "err", err)
+		return ident, err
+	}
+	return newIdent, nil
+}
+
+// parseRefreshToken decodes the refresh_token parameter, tolerating the legacy
+// raw-ID form for backward compatibility.
+func parseRefreshToken(code string) (*internal.RefreshToken, *oauth2.Error) {
+	if code == "" {
+		return nil, &oauth2.Error{Type: oauth2.InvalidRequest, Description: "No refresh token is found in request.", Status: http.StatusBadRequest}
+	}
+
+	token := new(internal.RefreshToken)
+	if err := internal.Unmarshal(code, token); err != nil {
+		// Assume a raw refresh token ID generated by an older server that has no
+		// Token value. Reuse is still rejected because Token stays empty.
+		token = &internal.RefreshToken{RefreshId: code, Token: ""}
+	}
+	return token, nil
+}
+
+// refreshLookupError maps a tokens.LookupRefreshToken sentinel to the grant's
+// OAuth2 error response.
+func refreshLookupError(err error) *oauth2.Error {
+	const claimedDesc = "Refresh token is invalid or has already been claimed by another client."
+	switch {
+	case errors.Is(err, tokens.ErrRefreshTokenInvalid):
+		return &oauth2.Error{Type: oauth2.InvalidRequest, Description: claimedDesc, Status: http.StatusBadRequest}
+	case errors.Is(err, tokens.ErrRefreshTokenClaimedByOtherClient):
+		return &oauth2.Error{Type: oauth2.InvalidGrant, Description: claimedDesc, Status: http.StatusBadRequest}
+	case errors.Is(err, tokens.ErrRefreshTokenExpired):
+		return &oauth2.Error{Type: oauth2.InvalidRequest, Description: "Refresh token expired.", Status: http.StatusBadRequest}
+	default:
+		return &oauth2.Error{Type: oauth2.InvalidRequest, Status: http.StatusInternalServerError}
+	}
+}
diff --git a/server/grants/tokenexchange.go b/server/grants/tokenexchange.go
new file mode 100644
index 0000000000..256fcfb654
--- /dev/null
+++ b/server/grants/tokenexchange.go
@@ -0,0 +1,119 @@
+package grants
+
+import (
+	"context"
+	"log/slog"
+	"net/http"
+	"time"
+
+	"github.com/dexidp/dex/connector"
+	"github.com/dexidp/dex/server/connectors"
+	"github.com/dexidp/dex/server/oauth2"
+	"github.com/dexidp/dex/server/tokens"
+	"github.com/dexidp/dex/storage"
+)
+
+// tokenExchange serves the RFC 8693 token-exchange grant: a subject token
+// (ID or access token) verified by a connector is exchanged for a new token.
+// Its response carries a single requested token plus issued_token_type, so it
+// builds its own response from the issuer primitives instead of the standard
+// Issue mint.
+type tokenExchange struct {
+	issuer *tokens.Issuer
+	logger *slog.Logger
+}
+
+func (g *tokenExchange) GrantType() string {
+	return oauth2.GrantTypeTokenExchange
+}
+
+func (g *tokenExchange) RequiresClientAuth() bool {
+	return true
+}
+
+// Scopes are passed through: for token exchange the requested scope maps to the
+// issued token's scope and is not validated against a fixed set.
+func (g *tokenExchange) ScopePolicy() ScopePolicy {
+	return ScopePolicy{}
+}
+
+// ConnectorID reads the required connector_id parameter (an RFC 8693 extension).
+func (g *tokenExchange) ConnectorID(ctx context.Context, req *Request, client storage.Client) (string, *oauth2.Error) {
+	return req.ConnectorID, nil
+}
+
+func (g *tokenExchange) Authorize(ctx context.Context, req *Request, client storage.Client, conn connectors.Connector) (Responder, error) {
+	switch req.SubjectTokenType {
+	case oauth2.TokenTypeID, oauth2.TokenTypeAccess: // ok, continue
+	default:
+		return nil, &oauth2.Error{Type: oauth2.RequestNotSupported, Description: "Invalid subject_token_type.", Status: http.StatusBadRequest}
+	}
+	if req.SubjectToken == "" {
+		return nil, &oauth2.Error{Type: oauth2.InvalidRequest, Description: "Missing subject_token", Status: http.StatusBadRequest}
+	}
+
+	teConn, ok := conn.Connector.(connector.TokenIdentityConnector)
+	if !ok {
+		g.logger.ErrorContext(ctx, "connector doesn't implement token exchange", "connector_id", req.ConnectorID)
+		return nil, &oauth2.Error{Type: oauth2.InvalidRequest, Description: "Requested connector does not exist.", Status: http.StatusBadRequest}
+	}
+	identity, err := teConn.TokenIdentity(ctx, req.SubjectTokenType, req.SubjectToken)
+	if err != nil {
+		g.logger.ErrorContext(ctx, "failed to verify subject token", "err", err)
+		return nil, &oauth2.Error{Type: oauth2.AccessDenied, Status: http.StatusUnauthorized}
+	}
+
+	email := identity.Email
+	if !identity.EmailVerified {
+		email += " (unverified)"
+	}
+	reqType := requestedTokenType(req)
+	g.logger.InfoContext(ctx, "token exchange successful",
+		"connector_id", req.ConnectorID, "client_id", client.ID,
+		"user_id", identity.UserID,
+		"username", identity.Username, "preferred_username", identity.PreferredUsername,
+		"email", email, "groups", identity.Groups,
+		"subject_token_type", req.SubjectTokenType, "requested_token_type", reqType)
+
+	auth := tokens.Authorization{
+		Client:      client,
+		Claims:      tokens.ClaimsFromIdentity(identity),
+		Scopes:      req.Scopes,
+		ConnectorID: req.ConnectorID,
+	}
+
+	// RFC 8693 returns a single requested token plus issued_token_type, not the
+	// standard access+id+refresh set, so it signs from the issuer primitives.
+	var (
+		token  string
+		expiry time.Time
+	)
+	switch reqType {
+	case oauth2.TokenTypeID:
+		token, expiry, err = g.issuer.SignIDToken(ctx, auth, "", "")
+	case oauth2.TokenTypeAccess:
+		token, expiry, err = g.issuer.SignAccessToken(ctx, auth)
+	default:
+		return nil, &oauth2.Error{Type: oauth2.RequestNotSupported, Description: "Invalid requested_token_type.", Status: http.StatusBadRequest}
+	}
+	if err != nil {
+		g.logger.ErrorContext(ctx, "token exchange failed to create new token", "requested_token_type", reqType, "err", err)
+		return nil, &oauth2.Error{Type: oauth2.ServerError, Status: http.StatusInternalServerError}
+	}
+
+	return tokens.Response{
+		AccessToken:     token,
+		IssuedTokenType: reqType,
+		TokenType:       "bearer",
+		ExpiresIn:       int(time.Until(expiry).Seconds()),
+	}, nil
+}
+
+// requestedTokenType is the requested_token_type param, defaulting to an access
+// token (RFC 8693 §2.1).
+func requestedTokenType(req *Request) string {
+	if req.RequestedTokenType != "" {
+		return req.RequestedTokenType
+	}
+	return oauth2.TokenTypeAccess
+}
diff --git a/server/handlers.go b/server/handlers.go
deleted file mode 100755
index 5f8caf11af..0000000000
--- a/server/handlers.go
+++ /dev/null
@@ -1,1317 +0,0 @@
-package server
-
-import (
-	"crypto/sha256"
-	"crypto/subtle"
-	"encoding/base64"
-	"encoding/json"
-	"fmt"
-	"html/template"
-	"net/http"
-	"net/url"
-	"path"
-	"sort"
-	"strconv"
-	"strings"
-	"time"
-
-	"github.com/coreos/go-oidc/v3/oidc"
-	"github.com/gorilla/mux"
-	jose "gopkg.in/square/go-jose.v2"
-
-	"github.com/dexidp/dex/connector"
-	"github.com/dexidp/dex/server/internal"
-	"github.com/dexidp/dex/storage"
-)
-
-const (
-	codeChallengeMethodPlain = "plain"
-	codeChallengeMethodS256  = "S256"
-)
-
-func (s *Server) handlePublicKeys(w http.ResponseWriter, r *http.Request) {
-	// TODO(ericchiang): Cache this.
-	keys, err := s.storage.GetKeys()
-	if err != nil {
-		s.logger.Errorf("failed to get keys: %v", err)
-		s.renderError(r, w, http.StatusInternalServerError, "Internal server error.")
-		return
-	}
-
-	if keys.SigningKeyPub == nil {
-		s.logger.Errorf("No public keys found.")
-		s.renderError(r, w, http.StatusInternalServerError, "Internal server error.")
-		return
-	}
-
-	jwks := jose.JSONWebKeySet{
-		Keys: make([]jose.JSONWebKey, len(keys.VerificationKeys)+1),
-	}
-	jwks.Keys[0] = *keys.SigningKeyPub
-	for i, verificationKey := range keys.VerificationKeys {
-		jwks.Keys[i+1] = *verificationKey.PublicKey
-	}
-
-	data, err := json.MarshalIndent(jwks, "", "  ")
-	if err != nil {
-		s.logger.Errorf("failed to marshal discovery data: %v", err)
-		s.renderError(r, w, http.StatusInternalServerError, "Internal server error.")
-		return
-	}
-	maxAge := keys.NextRotation.Sub(s.now())
-	if maxAge < (time.Minute * 2) {
-		maxAge = time.Minute * 2
-	}
-
-	w.Header().Set("Cache-Control", fmt.Sprintf("max-age=%d, must-revalidate", int(maxAge.Seconds())))
-	w.Header().Set("Content-Type", "application/json")
-	w.Header().Set("Content-Length", strconv.Itoa(len(data)))
-	w.Write(data)
-}
-
-type discovery struct {
-	Issuer            string   `json:"issuer"`
-	Auth              string   `json:"authorization_endpoint"`
-	Token             string   `json:"token_endpoint"`
-	Keys              string   `json:"jwks_uri"`
-	UserInfo          string   `json:"userinfo_endpoint"`
-	DeviceEndpoint    string   `json:"device_authorization_endpoint"`
-	GrantTypes        []string `json:"grant_types_supported"`
-	ResponseTypes     []string `json:"response_types_supported"`
-	Subjects          []string `json:"subject_types_supported"`
-	IDTokenAlgs       []string `json:"id_token_signing_alg_values_supported"`
-	CodeChallengeAlgs []string `json:"code_challenge_methods_supported"`
-	Scopes            []string `json:"scopes_supported"`
-	AuthMethods       []string `json:"token_endpoint_auth_methods_supported"`
-	Claims            []string `json:"claims_supported"`
-}
-
-func (s *Server) discoveryHandler() (http.HandlerFunc, error) {
-	d := discovery{
-		Issuer:            s.issuerURL.String(),
-		Auth:              s.absURL("/auth"),
-		Token:             s.absURL("/token"),
-		Keys:              s.absURL("/keys"),
-		UserInfo:          s.absURL("/userinfo"),
-		DeviceEndpoint:    s.absURL("/device/code"),
-		Subjects:          []string{"public"},
-		IDTokenAlgs:       []string{string(jose.RS256)},
-		CodeChallengeAlgs: []string{codeChallengeMethodS256, codeChallengeMethodPlain},
-		Scopes:            []string{"openid", "email", "groups", "profile", "offline_access"},
-		AuthMethods:       []string{"client_secret_basic", "client_secret_post"},
-		Claims: []string{
-			"iss", "sub", "aud", "iat", "exp", "email", "email_verified",
-			"locale", "name", "preferred_username", "at_hash",
-		},
-	}
-
-	for responseType := range s.supportedResponseTypes {
-		d.ResponseTypes = append(d.ResponseTypes, responseType)
-	}
-	sort.Strings(d.ResponseTypes)
-
-	d.GrantTypes = s.supportedGrantTypes
-
-	data, err := json.MarshalIndent(d, "", "  ")
-	if err != nil {
-		return nil, fmt.Errorf("failed to marshal discovery data: %v", err)
-	}
-
-	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		w.Header().Set("Content-Type", "application/json")
-		w.Header().Set("Content-Length", strconv.Itoa(len(data)))
-		w.Write(data)
-	}), nil
-}
-
-// handleAuthorization handles the OAuth2 auth endpoint.
-func (s *Server) handleAuthorization(w http.ResponseWriter, r *http.Request) {
-	// Extract the arguments
-	if err := r.ParseForm(); err != nil {
-		s.logger.Errorf("Failed to parse arguments: %v", err)
-
-		s.renderError(r, w, http.StatusBadRequest, err.Error())
-		return
-	}
-
-	connectorID := r.Form.Get("connector_id")
-
-	connectors, err := s.storage.ListConnectors()
-	if err != nil {
-		s.logger.Errorf("Failed to get list of connectors: %v", err)
-		s.renderError(r, w, http.StatusInternalServerError, "Failed to retrieve connector list.")
-		return
-	}
-
-	// We don't need connector_id any more
-	r.Form.Del("connector_id")
-
-	// Construct a URL with all of the arguments in its query
-	connURL := url.URL{
-		RawQuery: r.Form.Encode(),
-	}
-
-	// Redirect if a client chooses a specific connector_id
-	if connectorID != "" {
-		for _, c := range connectors {
-			if c.ID == connectorID {
-				connURL.Path = s.absPath("/auth", url.PathEscape(c.ID))
-				http.Redirect(w, r, connURL.String(), http.StatusFound)
-				return
-			}
-		}
-		s.renderError(r, w, http.StatusBadRequest, "Connector ID does not match a valid Connector")
-		return
-	}
-
-	if len(connectors) == 1 && !s.alwaysShowLogin {
-		connURL.Path = s.absPath("/auth", url.PathEscape(connectors[0].ID))
-		http.Redirect(w, r, connURL.String(), http.StatusFound)
-	}
-
-	connectorInfos := make([]connectorInfo, len(connectors))
-	for index, conn := range connectors {
-		connURL.Path = s.absPath("/auth", url.PathEscape(conn.ID))
-		connectorInfos[index] = connectorInfo{
-			ID:   conn.ID,
-			Name: conn.Name,
-			Type: conn.Type,
-			URL:  template.URL(connURL.String()),
-		}
-	}
-
-	if err := s.templates.login(r, w, connectorInfos); err != nil {
-		s.logger.Errorf("Server template error: %v", err)
-	}
-}
-
-func (s *Server) handleConnectorLogin(w http.ResponseWriter, r *http.Request) {
-	authReq, err := s.parseAuthorizationRequest(r)
-	if err != nil {
-		s.logger.Errorf("Failed to parse authorization request: %v", err)
-
-		switch authErr := err.(type) {
-		case *redirectedAuthErr:
-			authErr.Handler().ServeHTTP(w, r)
-		case *displayedAuthErr:
-			s.renderError(r, w, authErr.Status, err.Error())
-		default:
-			panic("unsupported error type")
-		}
-
-		return
-	}
-
-	connID, err := url.PathUnescape(mux.Vars(r)["connector"])
-	if err != nil {
-		s.logger.Errorf("Failed to parse connector: %v", err)
-		s.renderError(r, w, http.StatusBadRequest, "Requested resource does not exist")
-		return
-	}
-
-	conn, err := s.getConnector(connID)
-	if err != nil {
-		s.logger.Errorf("Failed to get connector: %v", err)
-		s.renderError(r, w, http.StatusBadRequest, "Requested resource does not exist")
-		return
-	}
-
-	// Set the connector being used for the login.
-	if authReq.ConnectorID != "" && authReq.ConnectorID != connID {
-		s.logger.Errorf("Mismatched connector ID in auth request: %s vs %s",
-			authReq.ConnectorID, connID)
-		s.renderError(r, w, http.StatusBadRequest, "Bad connector ID")
-		return
-	}
-
-	authReq.ConnectorID = connID
-
-	// Actually create the auth request
-	authReq.Expiry = s.now().Add(s.authRequestsValidFor)
-	if err := s.storage.CreateAuthRequest(*authReq); err != nil {
-		s.logger.Errorf("Failed to create authorization request: %v", err)
-		s.renderError(r, w, http.StatusInternalServerError, "Failed to connect to the database.")
-		return
-	}
-
-	scopes := parseScopes(authReq.Scopes)
-
-	// Work out where the "Select another login method" link should go.
-	backLink := ""
-	if len(s.connectors) > 1 {
-		backLinkURL := url.URL{
-			Path:     s.absPath("/auth"),
-			RawQuery: r.Form.Encode(),
-		}
-		backLink = backLinkURL.String()
-	}
-
-	switch r.Method {
-	case http.MethodGet:
-		switch conn := conn.Connector.(type) {
-		case connector.CallbackConnector:
-			// Use the auth request ID as the "state" token.
-			//
-			// TODO(ericchiang): Is this appropriate or should we also be using a nonce?
-			callbackURL, err := conn.LoginURL(scopes, s.absURL("/callback"), authReq.ID)
-			if err != nil {
-				s.logger.Errorf("Connector %q returned error when creating callback: %v", connID, err)
-				s.renderError(r, w, http.StatusInternalServerError, "Login error.")
-				return
-			}
-			http.Redirect(w, r, callbackURL, http.StatusFound)
-		case connector.PasswordConnector:
-			loginURL := url.URL{
-				Path: s.absPath("/auth", connID, "login"),
-			}
-			q := loginURL.Query()
-			q.Set("state", authReq.ID)
-			q.Set("back", backLink)
-			loginURL.RawQuery = q.Encode()
-
-			http.Redirect(w, r, loginURL.String(), http.StatusFound)
-		case connector.SAMLConnector:
-			action, value, err := conn.POSTData(scopes, authReq.ID)
-			if err != nil {
-				s.logger.Errorf("Creating SAML data: %v", err)
-				s.renderError(r, w, http.StatusInternalServerError, "Connector Login Error")
-				return
-			}
-
-			// TODO(ericchiang): Don't inline this.
-			fmt.Fprintf(w, `<!DOCTYPE html>
-			  <html lang="en">
-			  <head>
-			    <meta http-equiv="content-type" content="text/html; charset=utf-8">
-			    <title>SAML login</title>
-			  </head>
-			  <body>
-			    <form method="post" action="%s" >
-				    <input type="hidden" name="SAMLRequest" value="%s" />
-				    <input type="hidden" name="RelayState" value="%s" />
-			    </form>
-				<script>
-				    document.forms[0].submit();
-				</script>
-			  </body>
-			  </html>`, action, value, authReq.ID)
-		default:
-			s.renderError(r, w, http.StatusBadRequest, "Requested resource does not exist.")
-		}
-	default:
-		s.renderError(r, w, http.StatusBadRequest, "Unsupported request method.")
-	}
-}
-
-func (s *Server) handlePasswordLogin(w http.ResponseWriter, r *http.Request) {
-	authID := r.URL.Query().Get("state")
-	if authID == "" {
-		s.renderError(r, w, http.StatusBadRequest, "User session error.")
-		return
-	}
-
-	backLink := r.URL.Query().Get("back")
-
-	authReq, err := s.storage.GetAuthRequest(authID)
-	if err != nil {
-		if err == storage.ErrNotFound {
-			s.logger.Errorf("Invalid 'state' parameter provided: %v", err)
-			s.renderError(r, w, http.StatusBadRequest, "Requested resource does not exist.")
-			return
-		}
-		s.logger.Errorf("Failed to get auth request: %v", err)
-		s.renderError(r, w, http.StatusInternalServerError, "Database error.")
-		return
-	}
-
-	connID, err := url.PathUnescape(mux.Vars(r)["connector"])
-	if err != nil {
-		s.logger.Errorf("Failed to parse connector: %v", err)
-		s.renderError(r, w, http.StatusBadRequest, "Requested resource does not exist")
-		return
-	} else if connID != "" && connID != authReq.ConnectorID {
-		s.logger.Errorf("Connector mismatch: authentication started with id %q, but password login for id %q was triggered", authReq.ConnectorID, connID)
-		s.renderError(r, w, http.StatusInternalServerError, "Requested resource does not exist.")
-		return
-	}
-
-	conn, err := s.getConnector(authReq.ConnectorID)
-	if err != nil {
-		s.logger.Errorf("Failed to get connector with id %q : %v", authReq.ConnectorID, err)
-		s.renderError(r, w, http.StatusInternalServerError, "Requested resource does not exist.")
-		return
-	}
-
-	pwConn, ok := conn.Connector.(connector.PasswordConnector)
-	if !ok {
-		s.logger.Errorf("Expected password connector in handlePasswordLogin(), but got %v", pwConn)
-		s.renderError(r, w, http.StatusInternalServerError, "Requested resource does not exist.")
-		return
-	}
-
-	switch r.Method {
-	case http.MethodGet:
-		if err := s.templates.password(r, w, r.URL.String(), "", usernamePrompt(pwConn), false, backLink); err != nil {
-			s.logger.Errorf("Server template error: %v", err)
-		}
-	case http.MethodPost:
-		username := r.FormValue("login")
-		password := r.FormValue("password")
-		scopes := parseScopes(authReq.Scopes)
-
-		identity, ok, err := pwConn.Login(r.Context(), scopes, username, password)
-		if err != nil {
-			s.logger.Errorf("Failed to login user: %v", err)
-			s.renderError(r, w, http.StatusInternalServerError, fmt.Sprintf("Login error: %v", err))
-			return
-		}
-		if !ok {
-			if err := s.templates.password(r, w, r.URL.String(), username, usernamePrompt(pwConn), true, backLink); err != nil {
-				s.logger.Errorf("Server template error: %v", err)
-			}
-			return
-		}
-		redirectURL, err := s.finalizeLogin(identity, authReq, conn.Connector)
-		if err != nil {
-			s.logger.Errorf("Failed to finalize login: %v", err)
-			s.renderError(r, w, http.StatusInternalServerError, "Login error.")
-			return
-		}
-
-		http.Redirect(w, r, redirectURL, http.StatusSeeOther)
-	default:
-		s.renderError(r, w, http.StatusBadRequest, "Unsupported request method.")
-	}
-}
-
-func (s *Server) handleConnectorCallback(w http.ResponseWriter, r *http.Request) {
-	var authID string
-	switch r.Method {
-	case http.MethodGet: // OAuth2 callback
-		if authID = r.URL.Query().Get("state"); authID == "" {
-			s.renderError(r, w, http.StatusBadRequest, "User session error.")
-			return
-		}
-	case http.MethodPost: // SAML POST binding
-		if authID = r.PostFormValue("RelayState"); authID == "" {
-			s.renderError(r, w, http.StatusBadRequest, "User session error.")
-			return
-		}
-	default:
-		s.renderError(r, w, http.StatusBadRequest, "Method not supported")
-		return
-	}
-
-	authReq, err := s.storage.GetAuthRequest(authID)
-	if err != nil {
-		if err == storage.ErrNotFound {
-			s.logger.Errorf("Invalid 'state' parameter provided: %v", err)
-			s.renderError(r, w, http.StatusBadRequest, "Requested resource does not exist.")
-			return
-		}
-		s.logger.Errorf("Failed to get auth request: %v", err)
-		s.renderError(r, w, http.StatusInternalServerError, "Database error.")
-		return
-	}
-
-	connID, err := url.PathUnescape(mux.Vars(r)["connector"])
-	if err != nil {
-		s.logger.Errorf("Failed to get connector with id %q : %v", authReq.ConnectorID, err)
-		s.renderError(r, w, http.StatusInternalServerError, "Requested resource does not exist.")
-		return
-	} else if connID != "" && connID != authReq.ConnectorID {
-		s.logger.Errorf("Connector mismatch: authentication started with id %q, but callback for id %q was triggered", authReq.ConnectorID, connID)
-		s.renderError(r, w, http.StatusInternalServerError, "Requested resource does not exist.")
-		return
-	}
-
-	conn, err := s.getConnector(authReq.ConnectorID)
-	if err != nil {
-		s.logger.Errorf("Failed to get connector with id %q : %v", authReq.ConnectorID, err)
-		s.renderError(r, w, http.StatusInternalServerError, "Requested resource does not exist.")
-		return
-	}
-
-	var identity connector.Identity
-	switch conn := conn.Connector.(type) {
-	case connector.CallbackConnector:
-		if r.Method != http.MethodGet {
-			s.logger.Errorf("SAML request mapped to OAuth2 connector")
-			s.renderError(r, w, http.StatusBadRequest, "Invalid request")
-			return
-		}
-		identity, err = conn.HandleCallback(parseScopes(authReq.Scopes), r)
-	case connector.SAMLConnector:
-		if r.Method != http.MethodPost {
-			s.logger.Errorf("OAuth2 request mapped to SAML connector")
-			s.renderError(r, w, http.StatusBadRequest, "Invalid request")
-			return
-		}
-		identity, err = conn.HandlePOST(parseScopes(authReq.Scopes), r.PostFormValue("SAMLResponse"), authReq.ID)
-	default:
-		s.renderError(r, w, http.StatusInternalServerError, "Requested resource does not exist.")
-		return
-	}
-
-	if err != nil {
-		s.logger.Errorf("Failed to authenticate: %v", err)
-		s.renderError(r, w, http.StatusInternalServerError, fmt.Sprintf("Failed to authenticate: %v", err))
-		return
-	}
-
-	redirectURL, err := s.finalizeLogin(identity, authReq, conn.Connector)
-	if err != nil {
-		s.logger.Errorf("Failed to finalize login: %v", err)
-		s.renderError(r, w, http.StatusInternalServerError, "Login error.")
-		return
-	}
-
-	http.Redirect(w, r, redirectURL, http.StatusSeeOther)
-}
-
-// finalizeLogin associates the user's identity with the current AuthRequest, then returns
-// the approval page's path.
-func (s *Server) finalizeLogin(identity connector.Identity, authReq storage.AuthRequest, conn connector.Connector) (string, error) {
-	claims := storage.Claims{
-		UserID:            identity.UserID,
-		Username:          identity.Username,
-		PreferredUsername: identity.PreferredUsername,
-		Email:             identity.Email,
-		EmailVerified:     identity.EmailVerified,
-		Groups:            identity.Groups,
-	}
-
-	updater := func(a storage.AuthRequest) (storage.AuthRequest, error) {
-		a.LoggedIn = true
-		a.Claims = claims
-		a.ConnectorData = identity.ConnectorData
-		return a, nil
-	}
-	if err := s.storage.UpdateAuthRequest(authReq.ID, updater); err != nil {
-		return "", fmt.Errorf("failed to update auth request: %v", err)
-	}
-
-	email := claims.Email
-	if !claims.EmailVerified {
-		email += " (unverified)"
-	}
-
-	s.logger.Infof("login successful: connector %q, username=%q, preferred_username=%q, email=%q, groups=%q",
-		authReq.ConnectorID, claims.Username, claims.PreferredUsername, email, claims.Groups)
-
-	returnURL := path.Join(s.issuerURL.Path, "/approval") + "?req=" + authReq.ID
-	_, ok := conn.(connector.RefreshConnector)
-	if !ok {
-		return returnURL, nil
-	}
-
-	// Try to retrieve an existing OfflineSession object for the corresponding user.
-	session, err := s.storage.GetOfflineSessions(identity.UserID, authReq.ConnectorID)
-	if err != nil {
-		if err != storage.ErrNotFound {
-			s.logger.Errorf("failed to get offline session: %v", err)
-			return "", err
-		}
-		offlineSessions := storage.OfflineSessions{
-			UserID:        identity.UserID,
-			ConnID:        authReq.ConnectorID,
-			Refresh:       make(map[string]*storage.RefreshTokenRef),
-			ConnectorData: identity.ConnectorData,
-		}
-
-		// Create a new OfflineSession object for the user and add a reference object for
-		// the newly received refreshtoken.
-		if err := s.storage.CreateOfflineSessions(offlineSessions); err != nil {
-			s.logger.Errorf("failed to create offline session: %v", err)
-			return "", err
-		}
-
-		return returnURL, nil
-	}
-
-	// Update existing OfflineSession obj with new RefreshTokenRef.
-	if err := s.storage.UpdateOfflineSessions(session.UserID, session.ConnID, func(old storage.OfflineSessions) (storage.OfflineSessions, error) {
-		if len(identity.ConnectorData) > 0 {
-			old.ConnectorData = identity.ConnectorData
-		}
-		return old, nil
-	}); err != nil {
-		s.logger.Errorf("failed to update offline session: %v", err)
-		return "", err
-	}
-
-	return returnURL, nil
-}
-
-func (s *Server) handleApproval(w http.ResponseWriter, r *http.Request) {
-	authReq, err := s.storage.GetAuthRequest(r.FormValue("req"))
-	if err != nil {
-		s.logger.Errorf("Failed to get auth request: %v", err)
-		s.renderError(r, w, http.StatusInternalServerError, "Database error.")
-		return
-	}
-	if !authReq.LoggedIn {
-		s.logger.Errorf("Auth request does not have an identity for approval")
-		s.renderError(r, w, http.StatusInternalServerError, "Login process not yet finalized.")
-		return
-	}
-
-	switch r.Method {
-	case http.MethodGet:
-		if s.skipApproval {
-			s.sendCodeResponse(w, r, authReq)
-			return
-		}
-		client, err := s.storage.GetClient(authReq.ClientID)
-		if err != nil {
-			s.logger.Errorf("Failed to get client %q: %v", authReq.ClientID, err)
-			s.renderError(r, w, http.StatusInternalServerError, "Failed to retrieve client.")
-			return
-		}
-		if err := s.templates.approval(r, w, authReq.ID, authReq.Claims.Username, client.Name, authReq.Scopes); err != nil {
-			s.logger.Errorf("Server template error: %v", err)
-		}
-	case http.MethodPost:
-		if r.FormValue("approval") != "approve" {
-			s.renderError(r, w, http.StatusInternalServerError, "Approval rejected.")
-			return
-		}
-		s.sendCodeResponse(w, r, authReq)
-	}
-}
-
-func (s *Server) sendCodeResponse(w http.ResponseWriter, r *http.Request, authReq storage.AuthRequest) {
-	if s.now().After(authReq.Expiry) {
-		s.renderError(r, w, http.StatusBadRequest, "User session has expired.")
-		return
-	}
-
-	if err := s.storage.DeleteAuthRequest(authReq.ID); err != nil {
-		if err != storage.ErrNotFound {
-			s.logger.Errorf("Failed to delete authorization request: %v", err)
-			s.renderError(r, w, http.StatusInternalServerError, "Internal server error.")
-		} else {
-			s.renderError(r, w, http.StatusBadRequest, "User session error.")
-		}
-		return
-	}
-	u, err := url.Parse(authReq.RedirectURI)
-	if err != nil {
-		s.renderError(r, w, http.StatusInternalServerError, "Invalid redirect URI.")
-		return
-	}
-
-	var (
-		// Was the initial request using the implicit or hybrid flow instead of
-		// the "normal" code flow?
-		implicitOrHybrid = false
-
-		// Only present in hybrid or code flow. code.ID == "" if this is not set.
-		code storage.AuthCode
-
-		// ID token returned immediately if the response_type includes "id_token".
-		// Only valid for implicit and hybrid flows.
-		idToken       string
-		idTokenExpiry time.Time
-
-		// Access token
-		accessToken string
-	)
-
-	for _, responseType := range authReq.ResponseTypes {
-		switch responseType {
-		case responseTypeCode:
-			code = storage.AuthCode{
-				ID:            storage.NewID(),
-				ClientID:      authReq.ClientID,
-				ConnectorID:   authReq.ConnectorID,
-				Nonce:         authReq.Nonce,
-				Scopes:        authReq.Scopes,
-				Claims:        authReq.Claims,
-				Expiry:        s.now().Add(time.Minute * 30),
-				RedirectURI:   authReq.RedirectURI,
-				ConnectorData: authReq.ConnectorData,
-				PKCE:          authReq.PKCE,
-			}
-			if err := s.storage.CreateAuthCode(code); err != nil {
-				s.logger.Errorf("Failed to create auth code: %v", err)
-				s.renderError(r, w, http.StatusInternalServerError, "Internal server error.")
-				return
-			}
-
-			// Implicit and hybrid flows that try to use the OOB redirect URI are
-			// rejected earlier. If we got here we're using the code flow.
-			if authReq.RedirectURI == redirectURIOOB {
-				if err := s.templates.oob(r, w, code.ID); err != nil {
-					s.logger.Errorf("Server template error: %v", err)
-				}
-				return
-			}
-		case responseTypeToken:
-			implicitOrHybrid = true
-		case responseTypeIDToken:
-			implicitOrHybrid = true
-			var err error
-
-			accessToken, err = s.newAccessToken(authReq.ClientID, authReq.Claims, authReq.Scopes, authReq.Nonce, authReq.ConnectorID)
-			if err != nil {
-				s.logger.Errorf("failed to create new access token: %v", err)
-				s.tokenErrHelper(w, errServerError, "", http.StatusInternalServerError)
-				return
-			}
-
-			idToken, idTokenExpiry, err = s.newIDToken(authReq.ClientID, authReq.Claims, authReq.Scopes, authReq.Nonce, accessToken, code.ID, authReq.ConnectorID)
-			if err != nil {
-				s.logger.Errorf("failed to create ID token: %v", err)
-				s.tokenErrHelper(w, errServerError, "", http.StatusInternalServerError)
-				return
-			}
-		}
-	}
-
-	if implicitOrHybrid {
-		v := url.Values{}
-		v.Set("access_token", accessToken)
-		v.Set("token_type", "bearer")
-		v.Set("state", authReq.State)
-		if idToken != "" {
-			v.Set("id_token", idToken)
-			// The hybrid flow with only "code token" or "code id_token" doesn't return an
-			// "expires_in" value. If "code" wasn't provided, indicating the implicit flow,
-			// don't add it.
-			//
-			// https://openid.net/specs/openid-connect-core-1_0.html#HybridAuthResponse
-			if code.ID == "" {
-				v.Set("expires_in", strconv.Itoa(int(idTokenExpiry.Sub(s.now()).Seconds())))
-			}
-		}
-		if code.ID != "" {
-			v.Set("code", code.ID)
-		}
-
-		// Implicit and hybrid flows return their values as part of the fragment.
-		//
-		//   HTTP/1.1 303 See Other
-		//   Location: https://client.example.org/cb#
-		//     access_token=SlAV32hkKG
-		//     &token_type=bearer
-		//     &id_token=eyJ0 ... NiJ9.eyJ1c ... I6IjIifX0.DeWt4Qu ... ZXso
-		//     &expires_in=3600
-		//     &state=af0ifjsldkj
-		//
-		u.Fragment = v.Encode()
-	} else {
-		// The code flow add values to the URL query.
-		//
-		//   HTTP/1.1 303 See Other
-		//   Location: https://client.example.org/cb?
-		//     code=SplxlOBeZQQYbYS6WxSbIA
-		//     &state=af0ifjsldkj
-		//
-		q := u.Query()
-		q.Set("code", code.ID)
-		q.Set("state", authReq.State)
-		u.RawQuery = q.Encode()
-	}
-
-	http.Redirect(w, r, u.String(), http.StatusSeeOther)
-}
-
-func (s *Server) withClientFromStorage(w http.ResponseWriter, r *http.Request, handler func(http.ResponseWriter, *http.Request, storage.Client)) {
-	clientID, clientSecret, ok := r.BasicAuth()
-	if ok {
-		var err error
-		if clientID, err = url.QueryUnescape(clientID); err != nil {
-			s.tokenErrHelper(w, errInvalidRequest, "client_id improperly encoded", http.StatusBadRequest)
-			return
-		}
-		if clientSecret, err = url.QueryUnescape(clientSecret); err != nil {
-			s.tokenErrHelper(w, errInvalidRequest, "client_secret improperly encoded", http.StatusBadRequest)
-			return
-		}
-	} else {
-		clientID = r.PostFormValue("client_id")
-		clientSecret = r.PostFormValue("client_secret")
-	}
-
-	client, err := s.storage.GetClient(clientID)
-	if err != nil {
-		if err != storage.ErrNotFound {
-			s.logger.Errorf("failed to get client: %v", err)
-			s.tokenErrHelper(w, errServerError, "", http.StatusInternalServerError)
-		} else {
-			s.tokenErrHelper(w, errInvalidClient, "Invalid client credentials.", http.StatusUnauthorized)
-		}
-		return
-	}
-
-	if subtle.ConstantTimeCompare([]byte(client.Secret), []byte(clientSecret)) != 1 {
-		if clientSecret == "" {
-			s.logger.Infof("missing client_secret on token request for client: %s", client.ID)
-		} else {
-			s.logger.Infof("invalid client_secret on token request for client: %s", client.ID)
-		}
-		s.tokenErrHelper(w, errInvalidClient, "Invalid client credentials.", http.StatusUnauthorized)
-		return
-	}
-
-	handler(w, r, client)
-}
-
-func (s *Server) handleToken(w http.ResponseWriter, r *http.Request) {
-	w.Header().Set("Content-Type", "application/json")
-	if r.Method != http.MethodPost {
-		s.tokenErrHelper(w, errInvalidRequest, "method not allowed", http.StatusBadRequest)
-		return
-	}
-
-	err := r.ParseForm()
-	if err != nil {
-		s.logger.Errorf("Could not parse request body: %v", err)
-		s.tokenErrHelper(w, errInvalidRequest, "", http.StatusBadRequest)
-		return
-	}
-
-	grantType := r.PostFormValue("grant_type")
-	switch grantType {
-	case grantTypeDeviceCode:
-		s.handleDeviceToken(w, r)
-	case grantTypeAuthorizationCode:
-		s.withClientFromStorage(w, r, s.handleAuthCode)
-	case grantTypeRefreshToken:
-		s.withClientFromStorage(w, r, s.handleRefreshToken)
-	case grantTypePassword:
-		s.withClientFromStorage(w, r, s.handlePasswordGrant)
-	default:
-		s.tokenErrHelper(w, errUnsupportedGrantType, "", http.StatusBadRequest)
-	}
-}
-
-func (s *Server) calculateCodeChallenge(codeVerifier, codeChallengeMethod string) (string, error) {
-	switch codeChallengeMethod {
-	case codeChallengeMethodPlain:
-		return codeVerifier, nil
-	case codeChallengeMethodS256:
-		shaSum := sha256.Sum256([]byte(codeVerifier))
-		return base64.RawURLEncoding.EncodeToString(shaSum[:]), nil
-	default:
-		return "", fmt.Errorf("unknown challenge method (%v)", codeChallengeMethod)
-	}
-}
-
-// handle an access token request https://tools.ietf.org/html/rfc6749#section-4.1.3
-func (s *Server) handleAuthCode(w http.ResponseWriter, r *http.Request, client storage.Client) {
-	code := r.PostFormValue("code")
-	redirectURI := r.PostFormValue("redirect_uri")
-
-	if code == "" {
-		s.tokenErrHelper(w, errInvalidRequest, `Required param: code.`, http.StatusBadRequest)
-		return
-	}
-
-	authCode, err := s.storage.GetAuthCode(code)
-	if err != nil || s.now().After(authCode.Expiry) || authCode.ClientID != client.ID {
-		if err != storage.ErrNotFound {
-			s.logger.Errorf("failed to get auth code: %v", err)
-			s.tokenErrHelper(w, errServerError, "", http.StatusInternalServerError)
-		} else {
-			s.tokenErrHelper(w, errInvalidGrant, "Invalid or expired code parameter.", http.StatusBadRequest)
-		}
-		return
-	}
-
-	// RFC 7636 (PKCE)
-	codeChallengeFromStorage := authCode.PKCE.CodeChallenge
-	providedCodeVerifier := r.PostFormValue("code_verifier")
-
-	switch {
-	case providedCodeVerifier != "" && codeChallengeFromStorage != "":
-		calculatedCodeChallenge, err := s.calculateCodeChallenge(providedCodeVerifier, authCode.PKCE.CodeChallengeMethod)
-		if err != nil {
-			s.logger.Error(err)
-			s.tokenErrHelper(w, errServerError, "", http.StatusInternalServerError)
-			return
-		}
-		if codeChallengeFromStorage != calculatedCodeChallenge {
-			s.tokenErrHelper(w, errInvalidGrant, "Invalid code_verifier.", http.StatusBadRequest)
-			return
-		}
-	case providedCodeVerifier != "":
-		// Received no code_challenge on /auth, but a code_verifier on /token
-		s.tokenErrHelper(w, errInvalidRequest, "No PKCE flow started. Cannot check code_verifier.", http.StatusBadRequest)
-		return
-	case codeChallengeFromStorage != "":
-		// Received PKCE request on /auth, but no code_verifier on /token
-		s.tokenErrHelper(w, errInvalidGrant, "Expecting parameter code_verifier in PKCE flow.", http.StatusBadRequest)
-		return
-	}
-
-	if authCode.RedirectURI != redirectURI {
-		s.tokenErrHelper(w, errInvalidRequest, "redirect_uri did not match URI from initial request.", http.StatusBadRequest)
-		return
-	}
-
-	tokenResponse, err := s.exchangeAuthCode(w, authCode, client)
-	if err != nil {
-		s.tokenErrHelper(w, errServerError, "", http.StatusInternalServerError)
-		return
-	}
-	s.writeAccessToken(w, tokenResponse)
-}
-
-func (s *Server) exchangeAuthCode(w http.ResponseWriter, authCode storage.AuthCode, client storage.Client) (*accessTokenResponse, error) {
-	accessToken, err := s.newAccessToken(client.ID, authCode.Claims, authCode.Scopes, authCode.Nonce, authCode.ConnectorID)
-	if err != nil {
-		s.logger.Errorf("failed to create new access token: %v", err)
-		s.tokenErrHelper(w, errServerError, "", http.StatusInternalServerError)
-		return nil, err
-	}
-
-	idToken, expiry, err := s.newIDToken(client.ID, authCode.Claims, authCode.Scopes, authCode.Nonce, accessToken, authCode.ID, authCode.ConnectorID)
-	if err != nil {
-		s.logger.Errorf("failed to create ID token: %v", err)
-		s.tokenErrHelper(w, errServerError, "", http.StatusInternalServerError)
-		return nil, err
-	}
-
-	if err := s.storage.DeleteAuthCode(authCode.ID); err != nil {
-		s.logger.Errorf("failed to delete auth code: %v", err)
-		s.tokenErrHelper(w, errServerError, "", http.StatusInternalServerError)
-		return nil, err
-	}
-
-	reqRefresh := func() bool {
-		// Ensure the connector supports refresh tokens.
-		//
-		// Connectors like `saml` do not implement RefreshConnector.
-		conn, err := s.getConnector(authCode.ConnectorID)
-		if err != nil {
-			s.logger.Errorf("connector with ID %q not found: %v", authCode.ConnectorID, err)
-			s.tokenErrHelper(w, errServerError, "", http.StatusInternalServerError)
-			return false
-		}
-
-		_, ok := conn.Connector.(connector.RefreshConnector)
-		if !ok {
-			return false
-		}
-
-		for _, scope := range authCode.Scopes {
-			if scope == scopeOfflineAccess {
-				return true
-			}
-		}
-		return false
-	}()
-	var refreshToken string
-	if reqRefresh {
-		refresh := storage.RefreshToken{
-			ID:            storage.NewID(),
-			Token:         storage.NewID(),
-			ClientID:      authCode.ClientID,
-			ConnectorID:   authCode.ConnectorID,
-			Scopes:        authCode.Scopes,
-			Claims:        authCode.Claims,
-			Nonce:         authCode.Nonce,
-			ConnectorData: authCode.ConnectorData,
-			CreatedAt:     s.now(),
-			LastUsed:      s.now(),
-		}
-		token := &internal.RefreshToken{
-			RefreshId: refresh.ID,
-			Token:     refresh.Token,
-		}
-		if refreshToken, err = internal.Marshal(token); err != nil {
-			s.logger.Errorf("failed to marshal refresh token: %v", err)
-			s.tokenErrHelper(w, errServerError, "", http.StatusInternalServerError)
-			return nil, err
-		}
-
-		if err := s.storage.CreateRefresh(refresh); err != nil {
-			s.logger.Errorf("failed to create refresh token: %v", err)
-			s.tokenErrHelper(w, errServerError, "", http.StatusInternalServerError)
-			return nil, err
-		}
-
-		// deleteToken determines if we need to delete the newly created refresh token
-		// due to a failure in updating/creating the OfflineSession object for the
-		// corresponding user.
-		var deleteToken bool
-		defer func() {
-			if deleteToken {
-				// Delete newly created refresh token from storage.
-				if err := s.storage.DeleteRefresh(refresh.ID); err != nil {
-					s.logger.Errorf("failed to delete refresh token: %v", err)
-					s.tokenErrHelper(w, errServerError, "", http.StatusInternalServerError)
-					return
-				}
-			}
-		}()
-
-		tokenRef := storage.RefreshTokenRef{
-			ID:        refresh.ID,
-			ClientID:  refresh.ClientID,
-			CreatedAt: refresh.CreatedAt,
-			LastUsed:  refresh.LastUsed,
-		}
-
-		// Try to retrieve an existing OfflineSession object for the corresponding user.
-		if session, err := s.storage.GetOfflineSessions(refresh.Claims.UserID, refresh.ConnectorID); err != nil {
-			if err != storage.ErrNotFound {
-				s.logger.Errorf("failed to get offline session: %v", err)
-				s.tokenErrHelper(w, errServerError, "", http.StatusInternalServerError)
-				deleteToken = true
-				return nil, err
-			}
-			offlineSessions := storage.OfflineSessions{
-				UserID:  refresh.Claims.UserID,
-				ConnID:  refresh.ConnectorID,
-				Refresh: make(map[string]*storage.RefreshTokenRef),
-			}
-			offlineSessions.Refresh[tokenRef.ClientID] = &tokenRef
-
-			// Create a new OfflineSession object for the user and add a reference object for
-			// the newly received refreshtoken.
-			if err := s.storage.CreateOfflineSessions(offlineSessions); err != nil {
-				s.logger.Errorf("failed to create offline session: %v", err)
-				s.tokenErrHelper(w, errServerError, "", http.StatusInternalServerError)
-				deleteToken = true
-				return nil, err
-			}
-		} else {
-			if oldTokenRef, ok := session.Refresh[tokenRef.ClientID]; ok {
-				// Delete old refresh token from storage.
-				if err := s.storage.DeleteRefresh(oldTokenRef.ID); err != nil && err != storage.ErrNotFound {
-					s.logger.Errorf("failed to delete refresh token: %v", err)
-					s.tokenErrHelper(w, errServerError, "", http.StatusInternalServerError)
-					deleteToken = true
-					return nil, err
-				}
-			}
-
-			// Update existing OfflineSession obj with new RefreshTokenRef.
-			if err := s.storage.UpdateOfflineSessions(session.UserID, session.ConnID, func(old storage.OfflineSessions) (storage.OfflineSessions, error) {
-				old.Refresh[tokenRef.ClientID] = &tokenRef
-				return old, nil
-			}); err != nil {
-				s.logger.Errorf("failed to update offline session: %v", err)
-				s.tokenErrHelper(w, errServerError, "", http.StatusInternalServerError)
-				deleteToken = true
-				return nil, err
-			}
-		}
-	}
-	return s.toAccessTokenResponse(idToken, accessToken, refreshToken, expiry), nil
-}
-
-func (s *Server) handleUserInfo(w http.ResponseWriter, r *http.Request) {
-	const prefix = "Bearer "
-
-	auth := r.Header.Get("authorization")
-	if len(auth) < len(prefix) || !strings.EqualFold(prefix, auth[:len(prefix)]) {
-		w.Header().Set("WWW-Authenticate", "Bearer")
-		s.tokenErrHelper(w, errAccessDenied, "Invalid bearer token.", http.StatusUnauthorized)
-		return
-	}
-	rawIDToken := auth[len(prefix):]
-
-	verifier := oidc.NewVerifier(s.issuerURL.String(), &storageKeySet{s.storage}, &oidc.Config{SkipClientIDCheck: true})
-	idToken, err := verifier.Verify(r.Context(), rawIDToken)
-	if err != nil {
-		s.tokenErrHelper(w, errAccessDenied, err.Error(), http.StatusForbidden)
-		return
-	}
-
-	var claims json.RawMessage
-	if err := idToken.Claims(&claims); err != nil {
-		s.tokenErrHelper(w, errServerError, err.Error(), http.StatusInternalServerError)
-		return
-	}
-
-	w.Header().Set("Content-Type", "application/json")
-	w.Write(claims)
-}
-
-func (s *Server) handlePasswordGrant(w http.ResponseWriter, r *http.Request, client storage.Client) {
-	// Parse the fields
-	if err := r.ParseForm(); err != nil {
-		s.tokenErrHelper(w, errInvalidRequest, "Couldn't parse data", http.StatusBadRequest)
-		return
-	}
-	q := r.Form
-
-	nonce := q.Get("nonce")
-	// Some clients, like the old go-oidc, provide extra whitespace. Tolerate this.
-	scopes := strings.Fields(q.Get("scope"))
-
-	// Parse the scopes if they are passed
-	var (
-		unrecognized  []string
-		invalidScopes []string
-	)
-	hasOpenIDScope := false
-	for _, scope := range scopes {
-		switch scope {
-		case scopeOpenID:
-			hasOpenIDScope = true
-		case scopeOfflineAccess, scopeEmail, scopeProfile, scopeGroups, scopeFederatedID:
-		default:
-			peerID, ok := parseCrossClientScope(scope)
-			if !ok {
-				unrecognized = append(unrecognized, scope)
-				continue
-			}
-
-			isTrusted, err := s.validateCrossClientTrust(client.ID, peerID)
-			if err != nil {
-				s.tokenErrHelper(w, errInvalidClient, fmt.Sprintf("Error validating cross client trust %v.", err), http.StatusBadRequest)
-				return
-			}
-			if !isTrusted {
-				invalidScopes = append(invalidScopes, scope)
-			}
-		}
-	}
-	if !hasOpenIDScope {
-		s.tokenErrHelper(w, errInvalidRequest, `Missing required scope(s) ["openid"].`, http.StatusBadRequest)
-		return
-	}
-	if len(unrecognized) > 0 {
-		s.tokenErrHelper(w, errInvalidRequest, fmt.Sprintf("Unrecognized scope(s) %q", unrecognized), http.StatusBadRequest)
-		return
-	}
-	if len(invalidScopes) > 0 {
-		s.tokenErrHelper(w, errInvalidRequest, fmt.Sprintf("Client can't request scope(s) %q", invalidScopes), http.StatusBadRequest)
-		return
-	}
-
-	// Which connector
-	connID := s.passwordConnector
-	conn, err := s.getConnector(connID)
-	if err != nil {
-		s.tokenErrHelper(w, errInvalidRequest, "Requested connector does not exist.", http.StatusBadRequest)
-		return
-	}
-
-	passwordConnector, ok := conn.Connector.(connector.PasswordConnector)
-	if !ok {
-		s.tokenErrHelper(w, errInvalidRequest, "Requested password connector does not correct type.", http.StatusBadRequest)
-		return
-	}
-
-	// Login
-	username := q.Get("username")
-	password := q.Get("password")
-	identity, ok, err := passwordConnector.Login(r.Context(), parseScopes(scopes), username, password)
-	if err != nil {
-		s.logger.Errorf("Failed to login user: %v", err)
-		s.tokenErrHelper(w, errInvalidRequest, "Could not login user", http.StatusBadRequest)
-		return
-	}
-	if !ok {
-		s.tokenErrHelper(w, errAccessDenied, "Invalid username or password", http.StatusUnauthorized)
-		return
-	}
-
-	// Build the claims to send the id token
-	claims := storage.Claims{
-		UserID:            identity.UserID,
-		Username:          identity.Username,
-		PreferredUsername: identity.PreferredUsername,
-		Email:             identity.Email,
-		EmailVerified:     identity.EmailVerified,
-		Groups:            identity.Groups,
-	}
-
-	accessToken, err := s.newAccessToken(client.ID, claims, scopes, nonce, connID)
-	if err != nil {
-		s.logger.Errorf("password grant failed to create new access token: %v", err)
-		s.tokenErrHelper(w, errServerError, "", http.StatusInternalServerError)
-		return
-	}
-
-	idToken, expiry, err := s.newIDToken(client.ID, claims, scopes, nonce, accessToken, "", connID)
-	if err != nil {
-		s.logger.Errorf("password grant failed to create new ID token: %v", err)
-		s.tokenErrHelper(w, errServerError, "", http.StatusInternalServerError)
-		return
-	}
-
-	reqRefresh := func() bool {
-		// Ensure the connector supports refresh tokens.
-		//
-		// Connectors like `saml` do not implement RefreshConnector.
-		_, ok := conn.Connector.(connector.RefreshConnector)
-		if !ok {
-			return false
-		}
-
-		for _, scope := range scopes {
-			if scope == scopeOfflineAccess {
-				return true
-			}
-		}
-		return false
-	}()
-	var refreshToken string
-	if reqRefresh {
-		refresh := storage.RefreshToken{
-			ID:          storage.NewID(),
-			Token:       storage.NewID(),
-			ClientID:    client.ID,
-			ConnectorID: connID,
-			Scopes:      scopes,
-			Claims:      claims,
-			Nonce:       nonce,
-			// ConnectorData: authCode.ConnectorData,
-			CreatedAt: s.now(),
-			LastUsed:  s.now(),
-		}
-		token := &internal.RefreshToken{
-			RefreshId: refresh.ID,
-			Token:     refresh.Token,
-		}
-		if refreshToken, err = internal.Marshal(token); err != nil {
-			s.logger.Errorf("failed to marshal refresh token: %v", err)
-			s.tokenErrHelper(w, errServerError, "", http.StatusInternalServerError)
-			return
-		}
-
-		if err := s.storage.CreateRefresh(refresh); err != nil {
-			s.logger.Errorf("failed to create refresh token: %v", err)
-			s.tokenErrHelper(w, errServerError, "", http.StatusInternalServerError)
-			return
-		}
-
-		// deleteToken determines if we need to delete the newly created refresh token
-		// due to a failure in updating/creating the OfflineSession object for the
-		// corresponding user.
-		var deleteToken bool
-		defer func() {
-			if deleteToken {
-				// Delete newly created refresh token from storage.
-				if err := s.storage.DeleteRefresh(refresh.ID); err != nil {
-					s.logger.Errorf("failed to delete refresh token: %v", err)
-					s.tokenErrHelper(w, errServerError, "", http.StatusInternalServerError)
-					return
-				}
-			}
-		}()
-
-		tokenRef := storage.RefreshTokenRef{
-			ID:        refresh.ID,
-			ClientID:  refresh.ClientID,
-			CreatedAt: refresh.CreatedAt,
-			LastUsed:  refresh.LastUsed,
-		}
-
-		// Try to retrieve an existing OfflineSession object for the corresponding user.
-		if session, err := s.storage.GetOfflineSessions(refresh.Claims.UserID, refresh.ConnectorID); err != nil {
-			if err != storage.ErrNotFound {
-				s.logger.Errorf("failed to get offline session: %v", err)
-				s.tokenErrHelper(w, errServerError, "", http.StatusInternalServerError)
-				deleteToken = true
-				return
-			}
-			offlineSessions := storage.OfflineSessions{
-				UserID:        refresh.Claims.UserID,
-				ConnID:        refresh.ConnectorID,
-				Refresh:       make(map[string]*storage.RefreshTokenRef),
-				ConnectorData: identity.ConnectorData,
-			}
-			offlineSessions.Refresh[tokenRef.ClientID] = &tokenRef
-
-			// Create a new OfflineSession object for the user and add a reference object for
-			// the newly received refreshtoken.
-			if err := s.storage.CreateOfflineSessions(offlineSessions); err != nil {
-				s.logger.Errorf("failed to create offline session: %v", err)
-				s.tokenErrHelper(w, errServerError, "", http.StatusInternalServerError)
-				deleteToken = true
-				return
-			}
-		} else {
-			if oldTokenRef, ok := session.Refresh[tokenRef.ClientID]; ok {
-				// Delete old refresh token from storage.
-				if err := s.storage.DeleteRefresh(oldTokenRef.ID); err != nil {
-					if err == storage.ErrNotFound {
-						s.logger.Warnf("database inconsistent, refresh token missing: %v", oldTokenRef.ID)
-					} else {
-						s.logger.Errorf("failed to delete refresh token: %v", err)
-						s.tokenErrHelper(w, errServerError, "", http.StatusInternalServerError)
-						deleteToken = true
-						return
-					}
-				}
-			}
-
-			// Update existing OfflineSession obj with new RefreshTokenRef.
-			if err := s.storage.UpdateOfflineSessions(session.UserID, session.ConnID, func(old storage.OfflineSessions) (storage.OfflineSessions, error) {
-				old.Refresh[tokenRef.ClientID] = &tokenRef
-				old.ConnectorData = identity.ConnectorData
-				return old, nil
-			}); err != nil {
-				s.logger.Errorf("failed to update offline session: %v", err)
-				s.tokenErrHelper(w, errServerError, "", http.StatusInternalServerError)
-				deleteToken = true
-				return
-			}
-		}
-	}
-
-	resp := s.toAccessTokenResponse(idToken, accessToken, refreshToken, expiry)
-	s.writeAccessToken(w, resp)
-}
-
-type accessTokenResponse struct {
-	AccessToken  string `json:"access_token"`
-	TokenType    string `json:"token_type"`
-	ExpiresIn    int    `json:"expires_in"`
-	RefreshToken string `json:"refresh_token,omitempty"`
-	IDToken      string `json:"id_token"`
-}
-
-func (s *Server) toAccessTokenResponse(idToken, accessToken, refreshToken string, expiry time.Time) *accessTokenResponse {
-	return &accessTokenResponse{
-		accessToken,
-		"bearer",
-		int(expiry.Sub(s.now()).Seconds()),
-		refreshToken,
-		idToken,
-	}
-}
-
-func (s *Server) writeAccessToken(w http.ResponseWriter, resp *accessTokenResponse) {
-	data, err := json.Marshal(resp)
-	if err != nil {
-		s.logger.Errorf("failed to marshal access token response: %v", err)
-		s.tokenErrHelper(w, errServerError, "", http.StatusInternalServerError)
-		return
-	}
-	w.Header().Set("Content-Type", "application/json")
-	w.Header().Set("Content-Length", strconv.Itoa(len(data)))
-
-	// Token response must include cache headers https://tools.ietf.org/html/rfc6749#section-5.1
-	w.Header().Set("Cache-Control", "no-store")
-	w.Header().Set("Pragma", "no-cache")
-	w.Write(data)
-}
-
-func (s *Server) renderError(r *http.Request, w http.ResponseWriter, status int, description string) {
-	if err := s.templates.err(r, w, status, description); err != nil {
-		s.logger.Errorf("Server template error: %v", err)
-	}
-}
-
-func (s *Server) tokenErrHelper(w http.ResponseWriter, typ string, description string, statusCode int) {
-	if err := tokenErr(w, typ, description, statusCode); err != nil {
-		s.logger.Errorf("token error response: %v", err)
-	}
-}
-
-// Check for username prompt override from connector. Defaults to "Username".
-func usernamePrompt(conn connector.PasswordConnector) string {
-	if attr := conn.Prompt(); attr != "" {
-		return attr
-	}
-	return "Username"
-}
diff --git a/server/handlers_test.go b/server/handlers_test.go
deleted file mode 100644
index fb1a05064f..0000000000
--- a/server/handlers_test.go
+++ /dev/null
@@ -1,312 +0,0 @@
-package server
-
-import (
-	"bytes"
-	"context"
-	"encoding/json"
-	"errors"
-	"net/http"
-	"net/http/httptest"
-	"net/url"
-	"path"
-	"testing"
-	"time"
-
-	gosundheit "github.com/AppsFlyer/go-sundheit"
-	"github.com/AppsFlyer/go-sundheit/checks"
-	"github.com/coreos/go-oidc/v3/oidc"
-	"github.com/stretchr/testify/require"
-	"golang.org/x/oauth2"
-
-	"github.com/dexidp/dex/storage"
-)
-
-func TestHandleHealth(t *testing.T) {
-	ctx, cancel := context.WithCancel(context.Background())
-	defer cancel()
-
-	httpServer, server := newTestServer(ctx, t, nil)
-	defer httpServer.Close()
-
-	rr := httptest.NewRecorder()
-	server.ServeHTTP(rr, httptest.NewRequest("GET", "/healthz", nil))
-	if rr.Code != http.StatusOK {
-		t.Errorf("expected 200 got %d", rr.Code)
-	}
-}
-
-func TestHandleHealthFailure(t *testing.T) {
-	ctx, cancel := context.WithCancel(context.Background())
-	defer cancel()
-
-	httpServer, server := newTestServer(ctx, t, func(c *Config) {
-		c.HealthChecker = gosundheit.New()
-
-		c.HealthChecker.RegisterCheck(
-			&checks.CustomCheck{
-				CheckName: "fail",
-				CheckFunc: func(_ context.Context) (details interface{}, err error) {
-					return nil, errors.New("error")
-				},
-			},
-			gosundheit.InitiallyPassing(false),
-			gosundheit.ExecutionPeriod(1*time.Second),
-		)
-	})
-	defer httpServer.Close()
-
-	rr := httptest.NewRecorder()
-	server.ServeHTTP(rr, httptest.NewRequest("GET", "/healthz", nil))
-	if rr.Code != http.StatusInternalServerError {
-		t.Errorf("expected 500 got %d", rr.Code)
-	}
-}
-
-type emptyStorage struct {
-	storage.Storage
-}
-
-func (*emptyStorage) GetAuthRequest(string) (storage.AuthRequest, error) {
-	return storage.AuthRequest{}, storage.ErrNotFound
-}
-
-func TestHandleInvalidOAuth2Callbacks(t *testing.T) {
-	ctx, cancel := context.WithCancel(context.Background())
-	defer cancel()
-
-	httpServer, server := newTestServer(ctx, t, func(c *Config) {
-		c.Storage = &emptyStorage{c.Storage}
-	})
-	defer httpServer.Close()
-
-	tests := []struct {
-		TargetURI    string
-		ExpectedCode int
-	}{
-		{"/callback", http.StatusBadRequest},
-		{"/callback?code=&state=", http.StatusBadRequest},
-		{"/callback?code=AAAAAAA&state=BBBBBBB", http.StatusBadRequest},
-	}
-
-	rr := httptest.NewRecorder()
-
-	for i, r := range tests {
-		server.ServeHTTP(rr, httptest.NewRequest("GET", r.TargetURI, nil))
-		if rr.Code != r.ExpectedCode {
-			t.Fatalf("test %d expected %d, got %d", i, r.ExpectedCode, rr.Code)
-		}
-	}
-}
-
-func TestHandleInvalidSAMLCallbacks(t *testing.T) {
-	ctx, cancel := context.WithCancel(context.Background())
-	defer cancel()
-
-	httpServer, server := newTestServer(ctx, t, func(c *Config) {
-		c.Storage = &emptyStorage{c.Storage}
-	})
-	defer httpServer.Close()
-
-	type requestForm struct {
-		RelayState string
-	}
-	tests := []struct {
-		RequestForm  requestForm
-		ExpectedCode int
-	}{
-		{requestForm{}, http.StatusBadRequest},
-		{requestForm{RelayState: "AAAAAAA"}, http.StatusBadRequest},
-	}
-
-	rr := httptest.NewRecorder()
-
-	for i, r := range tests {
-		jsonValue, err := json.Marshal(r.RequestForm)
-		if err != nil {
-			t.Fatal(err.Error())
-		}
-		server.ServeHTTP(rr, httptest.NewRequest("POST", "/callback", bytes.NewBuffer(jsonValue)))
-		if rr.Code != r.ExpectedCode {
-			t.Fatalf("test %d expected %d, got %d", i, r.ExpectedCode, rr.Code)
-		}
-	}
-}
-
-// TestHandleAuthCode checks that it is forbidden to use same code twice
-func TestHandleAuthCode(t *testing.T) {
-	tests := []struct {
-		name       string
-		handleCode func(*testing.T, context.Context, *oauth2.Config, string)
-	}{
-		{
-			name: "Code Reuse should return invalid_grant",
-			handleCode: func(t *testing.T, ctx context.Context, oauth2Config *oauth2.Config, code string) {
-				_, err := oauth2Config.Exchange(ctx, code)
-				require.NoError(t, err)
-
-				_, err = oauth2Config.Exchange(ctx, code)
-				require.Error(t, err)
-
-				oauth2Err, ok := err.(*oauth2.RetrieveError)
-				require.True(t, ok)
-
-				var errResponse struct{ Error string }
-				err = json.Unmarshal(oauth2Err.Body, &errResponse)
-				require.NoError(t, err)
-
-				// invalid_grant must be returned for invalid values
-				// https://tools.ietf.org/html/rfc6749#section-5.2
-				require.Equal(t, errInvalidGrant, errResponse.Error)
-			},
-		},
-		{
-			name: "No Code should return invalid_request",
-			handleCode: func(t *testing.T, ctx context.Context, oauth2Config *oauth2.Config, _ string) {
-				_, err := oauth2Config.Exchange(ctx, "")
-				require.Error(t, err)
-
-				oauth2Err, ok := err.(*oauth2.RetrieveError)
-				require.True(t, ok)
-
-				var errResponse struct{ Error string }
-				err = json.Unmarshal(oauth2Err.Body, &errResponse)
-				require.NoError(t, err)
-
-				require.Equal(t, errInvalidRequest, errResponse.Error)
-			},
-		},
-	}
-
-	for _, tc := range tests {
-		t.Run(tc.name, func(t *testing.T) {
-			ctx, cancel := context.WithCancel(context.Background())
-			defer cancel()
-
-			httpServer, s := newTestServer(ctx, t, func(c *Config) { c.Issuer += "/non-root-path" })
-			defer httpServer.Close()
-
-			p, err := oidc.NewProvider(ctx, httpServer.URL)
-			require.NoError(t, err)
-
-			var oauth2Client oauth2Client
-			oauth2Client.server = httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-				if r.URL.Path != "/callback" {
-					http.Redirect(w, r, oauth2Client.config.AuthCodeURL(""), http.StatusSeeOther)
-					return
-				}
-
-				q := r.URL.Query()
-				require.Equal(t, q.Get("error"), "", q.Get("error_description"))
-
-				code := q.Get("code")
-				tc.handleCode(t, ctx, oauth2Client.config, code)
-
-				w.WriteHeader(http.StatusOK)
-			}))
-			defer oauth2Client.server.Close()
-
-			redirectURL := oauth2Client.server.URL + "/callback"
-			client := storage.Client{
-				ID:           "testclient",
-				Secret:       "testclientsecret",
-				RedirectURIs: []string{redirectURL},
-			}
-			err = s.storage.CreateClient(client)
-			require.NoError(t, err)
-
-			oauth2Client.config = &oauth2.Config{
-				ClientID:     client.ID,
-				ClientSecret: client.Secret,
-				Endpoint:     p.Endpoint(),
-				Scopes:       []string{oidc.ScopeOpenID, "email", "offline_access"},
-				RedirectURL:  redirectURL,
-			}
-
-			resp, err := http.Get(oauth2Client.server.URL + "/login")
-			require.NoError(t, err)
-
-			resp.Body.Close()
-		})
-	}
-}
-
-func mockConnectorDataTestStorage(t *testing.T, s storage.Storage) {
-	c := storage.Client{
-		ID:           "test",
-		Secret:       "barfoo",
-		RedirectURIs: []string{"foo://bar.com/", "https://auth.example.com"},
-		Name:         "dex client",
-		LogoURL:      "https://goo.gl/JIyzIC",
-	}
-
-	err := s.CreateClient(c)
-	require.NoError(t, err)
-
-	c1 := storage.Connector{
-		ID:   "test",
-		Type: "mockPassword",
-		Name: "mockPassword",
-		Config: []byte(`{
-"username": "test",
-"password": "test"
-}`),
-	}
-
-	err = s.CreateConnector(c1)
-	require.NoError(t, err)
-
-	c2 := storage.Connector{
-		ID:   "http://any.valid.url/",
-		Type: "mock",
-		Name: "mockURLID",
-	}
-
-	err = s.CreateConnector(c2)
-	require.NoError(t, err)
-}
-
-func TestPasswordConnectorDataNotEmpty(t *testing.T) {
-	t0 := time.Now()
-
-	ctx, cancel := context.WithCancel(context.Background())
-	defer cancel()
-
-	// Setup a dex server.
-	httpServer, s := newTestServer(ctx, t, func(c *Config) {
-		c.PasswordConnector = "test"
-		c.Now = func() time.Time { return t0 }
-	})
-	defer httpServer.Close()
-
-	mockConnectorDataTestStorage(t, s.storage)
-
-	u, err := url.Parse(s.issuerURL.String())
-	require.NoError(t, err)
-
-	u.Path = path.Join(u.Path, "/token")
-	v := url.Values{}
-	v.Add("scope", "openid offline_access email")
-	v.Add("grant_type", "password")
-	v.Add("username", "test")
-	v.Add("password", "test")
-
-	req, _ := http.NewRequest("POST", u.String(), bytes.NewBufferString(v.Encode()))
-	req.Header.Set("Content-Type", "application/x-www-form-urlencoded; param=value")
-	req.SetBasicAuth("test", "barfoo")
-
-	rr := httptest.NewRecorder()
-	s.ServeHTTP(rr, req)
-
-	require.Equal(t, 200, rr.Code)
-
-	// Check that we received expected refresh token
-	var ref struct {
-		Token string `json:"refresh_token"`
-	}
-	err = json.Unmarshal(rr.Body.Bytes(), &ref)
-	require.NoError(t, err)
-
-	newSess, err := s.storage.GetOfflineSessions("0-385-28089-0", "test")
-	require.NoError(t, err)
-	require.Equal(t, `{"test": "true"}`, string(newSess.ConnectorData))
-}
diff --git a/server/helpers_test.go b/server/helpers_test.go
new file mode 100644
index 0000000000..e3448e690e
--- /dev/null
+++ b/server/helpers_test.go
@@ -0,0 +1,330 @@
+package server
+
+import (
+	"context"
+	"log/slog"
+	"net/http"
+	"net/http/httptest"
+	"net/url"
+	"strings"
+	"testing"
+	"time"
+
+	gosundheit "github.com/AppsFlyer/go-sundheit"
+	"github.com/prometheus/client_golang/prometheus"
+	"github.com/stretchr/testify/require"
+
+	"github.com/dexidp/dex/connector"
+	"github.com/dexidp/dex/pkg/featureflags"
+	"github.com/dexidp/dex/server/connectors"
+	"github.com/dexidp/dex/server/oauth2"
+	"github.com/dexidp/dex/server/session"
+	"github.com/dexidp/dex/server/signer"
+	"github.com/dexidp/dex/server/tokens"
+	"github.com/dexidp/dex/storage"
+	"github.com/dexidp/dex/storage/memory"
+)
+
+func newLogger(t *testing.T) *slog.Logger {
+	return slog.New(slog.NewTextHandler(t.Output(), &slog.HandlerOptions{Level: slog.LevelDebug}))
+}
+
+func boolPtr(v bool) *bool {
+	return &v
+}
+
+// isFlowPath reports whether a redirect target is an internal step of the login
+// chain (the /auth dispatcher, MFA factors, consent) rather than the client
+// redirect.
+func isFlowPath(p string) bool {
+	if strings.HasSuffix(p, "/auth") { // dispatcher re-entry
+		return true
+	}
+	for _, step := range []string{"/mfa/", "/approval"} {
+		if strings.Contains(p, step) {
+			return true
+		}
+	}
+	return false
+}
+
+// followFlow walks the internal redirects of the login chain starting from rr
+// (each hop is HMAC-protected and followed with a GET) and returns the path the
+// flow comes to rest at: the client redirect_uri when the request is issued, or
+// the flow step that renders a page (e.g. /approval). It leaves rr on the final
+// response so callers can still inspect status, body or the Location query.
+func followFlow(t *testing.T, s *Server, rr *httptest.ResponseRecorder) (*httptest.ResponseRecorder, string) {
+	t.Helper()
+	for range 10 {
+		if rr.Code != http.StatusFound && rr.Code != http.StatusSeeOther {
+			return rr, "" // rendered a page with no redirect
+		}
+		loc := rr.Header().Get("Location")
+		u, err := url.Parse(loc)
+		require.NoError(t, err)
+		if !isFlowPath(u.Path) {
+			return rr, u.Path // left the flow — this is the client redirect
+		}
+		next := httptest.NewRecorder()
+		s.ServeHTTP(next, httptest.NewRequest(http.MethodGet, loc, nil))
+		if next.Code != http.StatusFound && next.Code != http.StatusSeeOther {
+			return next, u.Path // this flow step rendered (e.g. the consent screen)
+		}
+		rr = next
+	}
+	t.Fatal("followFlow: redirect loop did not settle")
+	return rr, ""
+}
+
+type emptyStorage struct {
+	storage.Storage
+}
+
+func (*emptyStorage) GetAuthRequest(context.Context, string) (storage.AuthRequest, error) {
+	return storage.AuthRequest{}, storage.ErrNotFound
+}
+
+func mockConnectorDataTestStorage(t *testing.T, s storage.Storage) {
+	ctx := t.Context()
+	c := storage.Client{
+		ID:           "test",
+		Secret:       "barfoo",
+		RedirectURIs: []string{"foo://bar.com/", "https://auth.example.com"},
+		Name:         "dex client",
+		LogoURL:      "https://goo.gl/JIyzIC",
+	}
+
+	err := s.CreateClient(ctx, c)
+	require.NoError(t, err)
+
+	c1 := storage.Connector{
+		ID:   "test",
+		Type: "mockPassword",
+		Name: "mockPassword",
+		Config: []byte(`{
+"username": "test",
+"password": "test"
+}`),
+	}
+
+	err = s.CreateConnector(ctx, c1)
+	require.NoError(t, err)
+
+	c2 := storage.Connector{
+		ID:   "http://any.valid.url/",
+		Type: "mock",
+		Name: "mockURLID",
+	}
+
+	err = s.CreateConnector(ctx, c2)
+	require.NoError(t, err)
+}
+
+func setSessionsEnabled(t *testing.T, enabled bool) {
+	t.Helper()
+	if enabled {
+		t.Setenv("DEX_SESSIONS_ENABLED", "true")
+	} else {
+		t.Setenv("DEX_SESSIONS_ENABLED", "false")
+	}
+}
+
+// spnegoShortCircuit implements connector.PasswordConnector and connector.SPNEGOAware
+// to simulate successful SPNEGO authentication on GET.
+type spnegoShortCircuit struct{ Identity connector.Identity }
+
+func (s spnegoShortCircuit) Close() error { return nil }
+
+func (s spnegoShortCircuit) Prompt() string { return "" }
+
+func (s spnegoShortCircuit) Login(ctx context.Context, sc connector.Scopes, u, p string) (connector.Identity, bool, error) {
+	return connector.Identity{}, false, nil
+}
+
+func (s spnegoShortCircuit) TrySPNEGO(ctx context.Context, sc connector.Scopes, w http.ResponseWriter, r *http.Request) (*connector.Identity, connector.Handled, error) {
+	id := s.Identity
+	return &id, true, nil
+}
+
+// spnegoError implements connector.PasswordConnector and connector.SPNEGOAware
+// to simulate SPNEGO authentication that fails with an error (e.g., LDAP lookup failed).
+type spnegoError struct{ Err error }
+
+func (s spnegoError) Close() error { return nil }
+
+func (s spnegoError) Prompt() string { return "" }
+
+func (s spnegoError) Login(ctx context.Context, sc connector.Scopes, u, p string) (connector.Identity, bool, error) {
+	return connector.Identity{}, false, nil
+}
+
+func (s spnegoError) TrySPNEGO(ctx context.Context, sc connector.Scopes, w http.ResponseWriter, r *http.Request) (*connector.Identity, connector.Handled, error) {
+	return nil, true, s.Err
+}
+
+func setNonEmpty(vals url.Values, key, value string) {
+	if value != "" {
+		vals.Set(key, value)
+	}
+}
+
+// registerTestConnector creates a connector in storage and registers it in the server's connectors map.
+func registerTestConnector(t *testing.T, s *Server, connID string, c connector.Connector) {
+	t.Helper()
+	ctx := t.Context()
+
+	storageConn := storage.Connector{
+		ID:              connID,
+		Type:            "saml",
+		Name:            "Test SAML",
+		ResourceVersion: "1",
+	}
+	if err := s.storage.CreateConnector(ctx, storageConn); err != nil {
+		t.Fatalf("failed to create connector in storage: %v", err)
+	}
+
+	s.connectors.Set(connID, connectors.Connector{
+		ResourceVersion: "1",
+		Connector:       c,
+	})
+}
+
+// mockSAMLRefreshConnector implements SAMLConnector + RefreshConnector for testing.
+type mockSAMLRefreshConnector struct {
+	refreshIdentity connector.Identity
+}
+
+func (m *mockSAMLRefreshConnector) POSTData(s connector.Scopes, requestID string) (ssoURL, samlRequest string, err error) {
+	return "", "", nil
+}
+
+func (m *mockSAMLRefreshConnector) HandlePOST(s connector.Scopes, samlResponse, inResponseTo string) (connector.Identity, error) {
+	return connector.Identity{}, nil
+}
+
+func (m *mockSAMLRefreshConnector) Refresh(ctx context.Context, s connector.Scopes, ident connector.Identity) (connector.Identity, error) {
+	return m.refreshIdentity, nil
+}
+
+// testSessionKey is the AES key the test servers encrypt session cookies with.
+// Tests that forge a session cookie sign it with this key rather than reading
+// the key back off the server they are exercising.
+var testSessionKey = []byte("0123456789abcdef0123456789abcdef")
+
+// mockConnector is the connector every test server serves.
+func mockConnector(id string) storage.Connector {
+	return storage.Connector{
+		ID:              id,
+		Type:            "mockCallback",
+		Name:            "Mock",
+		ResourceVersion: "1",
+	}
+}
+
+// testSessionConfig is the session config the test servers run with.
+func testSessionConfig() *session.Config {
+	return &session.Config{
+		CookieName:          "dex_session",
+		CookieEncryptionKey: testSessionKey,
+		AbsoluteLifetime:    24 * time.Hour,
+		ValidIfNotUsedFor:   time.Hour,
+	}
+}
+
+// newTestServerWith builds a server serving conns, behind an httptest.Server
+// that dispatches to it. updateConfig adjusts the shared default config before
+// the server is built; the caller-facing constructors below are thin wrappers
+// that differ only in the connectors and the grant types they enable.
+func newTestServerWith(t *testing.T, conns []storage.Connector, updateConfig func(c *Config)) (*httptest.Server, *Server) {
+	t.Helper()
+
+	var server *Server
+	s := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		server.ServeHTTP(w, r)
+	}))
+
+	logger := newLogger(t)
+	ctx := t.Context()
+
+	sig, err := signer.NewMockSigner(testKey)
+	require.NoError(t, err, "failed to create mock signer")
+
+	config := Config{
+		Issuer:  s.URL,
+		Storage: memory.New(logger),
+		Web: WebConfig{
+			Dir: "../web",
+		},
+		Logger:             logger,
+		PrometheusRegistry: prometheus.NewRegistry(),
+		HealthChecker:      gosundheit.New(),
+		SkipApprovalScreen: true, // Don't prompt for approval, just immediately redirect with code.
+		Signer:             sig,
+	}
+	if updateConfig != nil {
+		updateConfig(&config)
+	}
+	s.URL = config.Issuer
+
+	// Default rotation policy, set before the server is built so the token
+	// endpoint captures it.
+	if config.RefreshTokenPolicy == nil {
+		config.RefreshTokenPolicy = tokens.NewRefreshStrategy(true, 0, 0, 0, config.Now)
+	}
+
+	// Mirror cmd: the session config is present iff the sessions feature flag is on.
+	if featureflags.SessionsEnabled.Enabled() && config.SessionConfig == nil {
+		config.SessionConfig = testSessionConfig()
+	}
+
+	for _, conn := range conns {
+		require.NoError(t, config.Storage.CreateConnector(ctx, conn), "create connector")
+	}
+
+	server, err = newServer(ctx, config)
+	require.NoError(t, err)
+
+	return s, server
+}
+
+// newTestServer serves one mock connector with every implemented grant enabled.
+func newTestServer(t *testing.T, updateConfig func(c *Config)) (*httptest.Server, *Server) {
+	return newTestServerWith(t, []storage.Connector{mockConnector("mock")}, func(c *Config) {
+		c.AllowedGrantTypes = []string{ // all implemented types
+			oauth2.GrantTypeDeviceCode,
+			oauth2.GrantTypeAuthorizationCode,
+			oauth2.GrantTypeClientCredentials,
+			oauth2.GrantTypeRefreshToken,
+			oauth2.GrantTypeTokenExchange,
+			oauth2.GrantTypeImplicit,
+			oauth2.GrantTypePassword,
+		}
+		if updateConfig != nil {
+			updateConfig(c)
+		}
+	})
+}
+
+// newTestServerMultipleConnectors serves two mock connectors, for the paths that
+// depend on the connector selection screen.
+func newTestServerMultipleConnectors(t *testing.T, updateConfig func(c *Config)) (*httptest.Server, *Server) {
+	return newTestServerWith(t, []storage.Connector{mockConnector("mock"), mockConnector("mock2")}, updateConfig)
+}
+
+// newTestServerWithSessions serves one mock connector with sessions always on,
+// regardless of the feature flag.
+func newTestServerWithSessions(t *testing.T, updateConfig func(c *Config)) (*httptest.Server, *Server) {
+	return newTestServerWith(t, []storage.Connector{mockConnector("mock")}, func(c *Config) {
+		c.AllowedGrantTypes = []string{
+			oauth2.GrantTypeAuthorizationCode,
+			oauth2.GrantTypeClientCredentials,
+			oauth2.GrantTypeRefreshToken,
+			oauth2.GrantTypeTokenExchange,
+			oauth2.GrantTypeDeviceCode,
+		}
+		c.SessionConfig = testSessionConfig()
+		if updateConfig != nil {
+			updateConfig(c)
+		}
+	})
+}
diff --git a/server/home/doc.go b/server/home/doc.go
new file mode 100644
index 0000000000..d718d63fe2
--- /dev/null
+++ b/server/home/doc.go
@@ -0,0 +1,2 @@
+// Package home serves the dex landing page at "/".
+package home
diff --git a/server/home/home.go b/server/home/home.go
new file mode 100644
index 0000000000..6a65486292
--- /dev/null
+++ b/server/home/home.go
@@ -0,0 +1,137 @@
+package home
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"log/slog"
+	"net/http"
+	"time"
+
+	"github.com/dexidp/dex/server/oauth2"
+	"github.com/dexidp/dex/server/router"
+	"github.com/dexidp/dex/server/session"
+	"github.com/dexidp/dex/server/templates"
+	"github.com/dexidp/dex/storage"
+)
+
+// Handler serves the landing page. When sessions are enabled and a home template
+// is available it renders the rich page (with logged-in details); otherwise it
+// falls back to a minimal inline page.
+type Handler struct {
+	IssuerURL oauth2.IssuerURL
+	Storage   storage.Storage
+	Templates *templates.Templates
+	Logger    *slog.Logger
+	// Sessions is the shared session manager; nil (or with a nil Config) when
+	// sessions are disabled.
+	Sessions *session.Manager
+}
+
+// Mount registers the landing-page route.
+func (h *Handler) Mount(m router.Mux) {
+	m.HandleCORS("/", h.handle)
+}
+
+func (h *Handler) renderError(r *http.Request, w http.ResponseWriter, status int, description string) {
+	templates.RenderError(h.Templates, h.Logger, r, w, status, description)
+}
+
+func (h *Handler) handle(w http.ResponseWriter, r *http.Request) {
+	if h.Sessions == nil || h.Sessions.Config == nil || !h.Templates.HasHome() {
+		h.handleInline(w, r)
+		return
+	}
+
+	ctx := r.Context()
+
+	data := templates.HomeData{
+		DiscoveryURL: h.IssuerURL.JoinPath(".well-known", "openid-configuration").String(),
+		LogoutURL:    h.IssuerURL.AbsURL("/logout"),
+	}
+
+	// ValidSession enforces the nonce AND absolute/idle expiry (clearing an
+	// expired session), so an expired-but-not-yet-purged cookie no longer renders
+	// a logged-in page.
+	if session := h.Sessions.ValidSession(ctx, w, r); session != nil {
+		data.LoggedIn = true
+		data.IPAddress = session.IPAddress
+		data.UserAgent = session.UserAgent
+		data.SignedInISO, data.SignedInText = timeFields(session.CreatedAt)
+		expiry, idle := sessionExpiry(session)
+		data.SessionExpiresISO, data.SessionExpiresText = timeFields(expiry)
+		data.SessionExpiryIsIdle = idle
+		h.populateData(ctx, &data, session.UserID, session.ConnectorID)
+	}
+
+	if err := h.Templates.Home(r, w, data); err != nil {
+		h.Logger.ErrorContext(ctx, "failed to render home template", "err", err)
+		h.renderError(r, w, http.StatusInternalServerError, "Internal server error.")
+	}
+}
+
+// timeFields renders a timestamp for the page: an ISO 8601 string for the <time>
+// element's datetime attribute, and the UTC text shown to readers whose browser
+// will not run the script that restates it in their own timezone. Both are empty
+// for the zero time, which drops the row entirely.
+func timeFields(t time.Time) (iso, text string) {
+	if t.IsZero() {
+		return "", ""
+	}
+	return t.UTC().Format(time.RFC3339), t.UTC().Format("2 Jan 2006, 15:04 UTC")
+}
+
+// sessionExpiry reports when the session ends: the earlier of its absolute
+// lifetime and its idle timeout, since whichever comes first logs the user out.
+// It returns the zero time when neither is set, which drops the row.
+//
+// The second return says the idle timeout won. That distinction has to reach
+// the page: the absolute expiry is a fixed moment, while the idle one slides
+// forward every time the session is used, so labeling both "session ends"
+// would state a deadline that is not one.
+func sessionExpiry(s *storage.AuthSession) (time.Time, bool) {
+	expiry, idle := s.AbsoluteExpiry, false
+	if expiry.IsZero() || (!s.IdleExpiry.IsZero() && s.IdleExpiry.Before(expiry)) {
+		expiry, idle = s.IdleExpiry, true
+	}
+	if expiry.IsZero() {
+		return time.Time{}, false
+	}
+	return expiry, idle
+}
+
+func (h *Handler) handleInline(w http.ResponseWriter, r *http.Request) {
+	_, err := fmt.Fprintf(w, `<!DOCTYPE html>
+		<title>Dex</title>
+		<h1>Dex IdP</h1>
+		<h3>A Federated OpenID Connect Provider</h3>
+		<p><a href=%q>Discovery</a></p>`,
+		h.IssuerURL.JoinPath(".well-known", "openid-configuration").String())
+	if err != nil {
+		h.Logger.Error("failed to write response", "err", err)
+		h.renderError(r, w, http.StatusInternalServerError, "Handling the / path error.")
+	}
+}
+
+func (h *Handler) populateData(ctx context.Context, data *templates.HomeData, userID, connectorID string) {
+	ui, err := h.Storage.GetUserIdentity(ctx, userID, connectorID)
+	if err != nil {
+		if !errors.Is(err, storage.ErrNotFound) {
+			h.Logger.ErrorContext(ctx, "home: failed to get user identity", "err", err)
+		}
+		return
+	}
+
+	data.Username = ui.Claims.PreferredUsername
+	if data.Username == "" {
+		data.Username = ui.Claims.Username
+	}
+	data.Email = ui.Claims.Email
+	data.EmailVerified = ui.Claims.EmailVerified
+	data.Groups = ui.Claims.Groups
+
+	conn, err := h.Storage.GetConnector(ctx, connectorID)
+	if err == nil {
+		data.ConnectorName = conn.Name
+	}
+}
diff --git a/server/home/home_test.go b/server/home/home_test.go
new file mode 100644
index 0000000000..4d96d45cbc
--- /dev/null
+++ b/server/home/home_test.go
@@ -0,0 +1,85 @@
+package home
+
+import (
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+
+	"github.com/dexidp/dex/storage"
+)
+
+func TestSessionExpiry(t *testing.T) {
+	absolute := time.Date(2026, 7, 28, 12, 0, 0, 0, time.UTC)
+
+	tests := []struct {
+		name     string
+		session  storage.AuthSession
+		want     time.Time
+		wantIdle bool
+	}{
+		{
+			name:     "idle first",
+			session:  storage.AuthSession{AbsoluteExpiry: absolute, IdleExpiry: absolute.Add(-time.Hour)},
+			want:     absolute.Add(-time.Hour),
+			wantIdle: true,
+		},
+		{
+			name:     "absolute first",
+			session:  storage.AuthSession{AbsoluteExpiry: absolute, IdleExpiry: absolute.Add(time.Hour)},
+			want:     absolute,
+			wantIdle: false,
+		},
+		{
+			// Equal deadlines are the absolute one: it cannot move, so it is the
+			// honest label of the two.
+			name:     "equal",
+			session:  storage.AuthSession{AbsoluteExpiry: absolute, IdleExpiry: absolute},
+			want:     absolute,
+			wantIdle: false,
+		},
+		{
+			name:     "only idle set",
+			session:  storage.AuthSession{IdleExpiry: absolute},
+			want:     absolute,
+			wantIdle: true,
+		},
+		{
+			name:     "only absolute set",
+			session:  storage.AuthSession{AbsoluteExpiry: absolute},
+			want:     absolute,
+			wantIdle: false,
+		},
+		{
+			name:    "neither set",
+			session: storage.AuthSession{},
+			want:    time.Time{},
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			got, idle := sessionExpiry(&tc.session)
+			assert.Equal(t, tc.want, got)
+			assert.Equal(t, tc.wantIdle, idle)
+		})
+	}
+}
+
+func TestTimeFields(t *testing.T) {
+	iso, text := timeFields(time.Date(2026, 7, 28, 9, 5, 0, 0, time.UTC))
+	// The attribute has to parse as a date/time for <time> to mean anything.
+	assert.Equal(t, "2026-07-28T09:05:00Z", iso)
+	assert.Equal(t, "28 Jul 2026, 09:05 UTC", text)
+
+	// A different zone is still reported as the same instant in UTC.
+	tokyo, err := time.LoadLocation("Asia/Tokyo")
+	assert.NoError(t, err)
+	iso, text = timeFields(time.Date(2026, 7, 28, 18, 5, 0, 0, tokyo))
+	assert.Equal(t, "2026-07-28T09:05:00Z", iso)
+	assert.Equal(t, "28 Jul 2026, 09:05 UTC", text)
+
+	iso, text = timeFields(time.Time{})
+	assert.Empty(t, iso)
+	assert.Empty(t, text)
+}
diff --git a/server/internal/cookie.go b/server/internal/cookie.go
new file mode 100644
index 0000000000..8087f5b3b1
--- /dev/null
+++ b/server/internal/cookie.go
@@ -0,0 +1,90 @@
+package internal
+
+import (
+	"crypto/aes"
+	"crypto/cipher"
+	"crypto/rand"
+	"encoding/base64"
+	"errors"
+	"fmt"
+	"io"
+)
+
+// SessionCookieValue marshals the session identity into a cookie value. If
+// encryptionKey is provided, the value is encrypted.
+func SessionCookieValue(sessionID, secret string, encryptionKey []byte) string {
+	val, err := Marshal(&SessionCookie{
+		SessionId: sessionID,
+		Secret:    secret,
+	})
+	if err != nil {
+		// Should never happen with valid string inputs.
+		panic(fmt.Sprintf("marshal session cookie: %v", err))
+	}
+	if len(encryptionKey) > 0 {
+		val, err = encryptCookieValue(val, encryptionKey)
+		if err != nil {
+			panic(fmt.Sprintf("encrypt session cookie: %v", err))
+		}
+	}
+	return val
+}
+
+// ParseSessionCookie decodes a session cookie value. If encryptionKey is
+// provided, the value is decrypted first.
+func ParseSessionCookie(value string, encryptionKey []byte) (sessionID, secret string, err error) {
+	if len(encryptionKey) > 0 {
+		value, err = decryptCookieValue(value, encryptionKey)
+		if err != nil {
+			return "", "", fmt.Errorf("decrypt session cookie: %w", err)
+		}
+	}
+	var cookie SessionCookie
+	if err := Unmarshal(value, &cookie); err != nil {
+		return "", "", fmt.Errorf("decode session cookie: %w", err)
+	}
+	return cookie.SessionId, cookie.Secret, nil
+}
+
+// encryptCookieValue encrypts plaintext with AES-GCM and returns base64url-encoded ciphertext.
+func encryptCookieValue(plaintext string, key []byte) (string, error) {
+	block, err := aes.NewCipher(key)
+	if err != nil {
+		return "", err
+	}
+	gcm, err := cipher.NewGCM(block)
+	if err != nil {
+		return "", err
+	}
+	nonce := make([]byte, gcm.NonceSize())
+	if _, err := io.ReadFull(rand.Reader, nonce); err != nil {
+		return "", err
+	}
+	ciphertext := gcm.Seal(nonce, nonce, []byte(plaintext), nil)
+	return base64.RawURLEncoding.EncodeToString(ciphertext), nil
+}
+
+// decryptCookieValue decodes base64url and decrypts AES-GCM ciphertext.
+func decryptCookieValue(encrypted string, key []byte) (string, error) {
+	data, err := base64.RawURLEncoding.DecodeString(encrypted)
+	if err != nil {
+		return "", err
+	}
+	block, err := aes.NewCipher(key)
+	if err != nil {
+		return "", err
+	}
+	gcm, err := cipher.NewGCM(block)
+	if err != nil {
+		return "", err
+	}
+	nonceSize := gcm.NonceSize()
+	if len(data) < nonceSize {
+		return "", errors.New("ciphertext too short")
+	}
+	plaintext, err := gcm.Open(nil, data[:nonceSize], data[nonceSize:], nil)
+	if err != nil {
+		return "", err
+	}
+	return string(plaintext), nil
+}
diff --git a/server/internal/doc.go b/server/internal/doc.go
new file mode 100644
index 0000000000..68e1bbe86d
--- /dev/null
+++ b/server/internal/doc.go
@@ -0,0 +1,4 @@
+// Package internal holds the server's wire formats: the protobuf value types and
+// the codecs that operate on them — base64 marshaling, the HMAC signer/verifier
+// used to protect redirect URLs, and the session-cookie encoder/decoder.
+package internal
diff --git a/server/internal/flowstep.go b/server/internal/flowstep.go
new file mode 100644
index 0000000000..b7f1362724
--- /dev/null
+++ b/server/internal/flowstep.go
@@ -0,0 +1,56 @@
+package internal
+
+import (
+	"maps"
+	"net/url"
+
+	"github.com/dexidp/dex/storage"
+)
+
+// Step names one hop of the interactive login flow. Every redirect between the
+// /auth dispatcher and a step (MFA, consent) carries an HMAC over the auth
+// request ID and the step it is good for, so a verifier minted for one hop
+// cannot be replayed against another.
+//
+// The labels are namespaced. Authenticator IDs come from the operator's config
+// and are signed the same way, so without the prefixes an authenticator named
+// "approved" would hand the user a valid consent verifier and let them skip the
+// approval screen.
+type Step string
+
+const (
+	// StepContinue returns to the /auth dispatcher so it can pick the next step.
+	// Login and every completed MFA factor use it.
+	StepContinue Step = "step:continue"
+	// StepMFA enters the MFA handler, which resolves the chain and picks a factor.
+	StepMFA Step = "step:mfa"
+	// StepApproval enters the consent screen.
+	StepApproval Step = "step:approval"
+	// StepApproved returns to the dispatcher from the consent screen and proves
+	// the user just approved, resolving consent for this request.
+	StepApproved Step = "step:approved"
+)
+
+// Authenticator returns the step of one MFA factor. The id comes from the
+// server's MFA config, so it is namespaced away from the flow's own steps.
+func Authenticator(id string) Step { return Step("authenticator:" + id) }
+
+// SignStep returns the verifier proving a redirect to step belongs to authReq.
+func SignStep(authReq storage.AuthRequest, step Step) string {
+	return ComputeHMAC(authReq.HMACKey, authReq.ID, string(step))
+}
+
+// VerifyStep reports whether mac is the verifier for step on authReq.
+func VerifyStep(authReq storage.AuthRequest, mac string, step Step) bool {
+	return VerifyHMAC(authReq.HMACKey, mac, authReq.ID, string(step))
+}
+
+// StepURL builds the URL of a flow step under base, carrying the auth request
+// ID and its verifier. extra adds step-specific query parameters and may be nil.
+func StepURL(base string, authReq storage.AuthRequest, step Step, extra url.Values) string {
+	v := url.Values{}
+	maps.Copy(v, extra)
+	v.Set("req", authReq.ID)
+	v.Set("hmac", SignStep(authReq, step))
+	return base + "?" + v.Encode()
+}
diff --git a/server/internal/hmac.go b/server/internal/hmac.go
new file mode 100644
index 0000000000..39021aaaa4
--- /dev/null
+++ b/server/internal/hmac.go
@@ -0,0 +1,38 @@
+package internal
+
+import (
+	"crypto/hmac"
+	"crypto/sha256"
+	"encoding/base64"
+
+	"google.golang.org/protobuf/proto"
+)
+
+// ComputeHMAC computes a SHA-256 HMAC over a protobuf-encoded payload
+// and returns the result as a base64 raw-URL-encoded string.
+func ComputeHMAC(key []byte, values ...string) string {
+	msg := marshalHMACPayload(values)
+	h := hmac.New(sha256.New, key)
+	h.Write(msg)
+	return base64.RawURLEncoding.EncodeToString(h.Sum(nil))
+}
+
+// VerifyHMAC checks that encodedMAC (base64 raw-URL) matches the
+// HMAC-SHA256 of the protobuf-encoded payload under key.
+func VerifyHMAC(key []byte, encodedMAC string, values ...string) bool {
+	mac, err := base64.RawURLEncoding.DecodeString(encodedMAC)
+	if err != nil {
+		return false
+	}
+	msg := marshalHMACPayload(values)
+	h := hmac.New(sha256.New, key)
+	h.Write(msg)
+	return hmac.Equal(mac, h.Sum(nil))
+}
+
+func marshalHMACPayload(values []string) []byte {
+	payload := &HMACPayload{Values: values}
+	// proto.Marshal is deterministic for the same input in the Go implementation.
+	data, _ := proto.Marshal(payload)
+	return data
+}
diff --git a/server/internal/types.pb.go b/server/internal/types.pb.go
index 379c556a93..c6f5ae48c0 100644
--- a/server/internal/types.pb.go
+++ b/server/internal/types.pb.go
@@ -1,11 +1,9 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.26.0
-// 	protoc        v3.15.6
+// 	protoc-gen-go v1.36.5
+// 	protoc        v5.29.3
 // source: server/internal/types.proto
 
-// Package internal holds protobuf types used by the server.
-
 package internal
 
 import (
@@ -13,6 +11,7 @@ import (
 	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
 	reflect "reflect"
 	sync "sync"
+	unsafe "unsafe"
 )
 
 const (
@@ -24,21 +23,18 @@ const (
 
 // RefreshToken is a message that holds refresh token data used by dex.
 type RefreshToken struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	RefreshId     string                 `protobuf:"bytes,1,opt,name=refresh_id,json=refreshId,proto3" json:"refresh_id,omitempty"`
+	Token         string                 `protobuf:"bytes,2,opt,name=token,proto3" json:"token,omitempty"`
 	unknownFields protoimpl.UnknownFields
-
-	RefreshId string `protobuf:"bytes,1,opt,name=refresh_id,json=refreshId,proto3" json:"refresh_id,omitempty"`
-	Token     string `protobuf:"bytes,2,opt,name=token,proto3" json:"token,omitempty"`
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *RefreshToken) Reset() {
 	*x = RefreshToken{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_server_internal_types_proto_msgTypes[0]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_server_internal_types_proto_msgTypes[0]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *RefreshToken) String() string {
@@ -49,7 +45,7 @@ func (*RefreshToken) ProtoMessage() {}
 
 func (x *RefreshToken) ProtoReflect() protoreflect.Message {
 	mi := &file_server_internal_types_proto_msgTypes[0]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -81,21 +77,18 @@ func (x *RefreshToken) GetToken() string {
 // IDTokenSubject represents both the userID and connID which is returned
 // as the "sub" claim in the ID Token.
 type IDTokenSubject struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	UserId        string                 `protobuf:"bytes,1,opt,name=user_id,json=userId,proto3" json:"user_id,omitempty"`
+	ConnId        string                 `protobuf:"bytes,2,opt,name=conn_id,json=connId,proto3" json:"conn_id,omitempty"`
 	unknownFields protoimpl.UnknownFields
-
-	UserId string `protobuf:"bytes,1,opt,name=user_id,json=userId,proto3" json:"user_id,omitempty"`
-	ConnId string `protobuf:"bytes,2,opt,name=conn_id,json=connId,proto3" json:"conn_id,omitempty"`
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *IDTokenSubject) Reset() {
 	*x = IDTokenSubject{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_server_internal_types_proto_msgTypes[1]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_server_internal_types_proto_msgTypes[1]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *IDTokenSubject) String() string {
@@ -106,7 +99,7 @@ func (*IDTokenSubject) ProtoMessage() {}
 
 func (x *IDTokenSubject) ProtoReflect() protoreflect.Message {
 	mi := &file_server_internal_types_proto_msgTypes[1]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -135,9 +128,110 @@ func (x *IDTokenSubject) GetConnId() string {
 	return ""
 }
 
+// SessionCookie holds what the session cookie names: which session, and the
+// secret proving the bearer is the browser that session was issued to.
+type SessionCookie struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	SessionId     string                 `protobuf:"bytes,1,opt,name=session_id,json=sessionId,proto3" json:"session_id,omitempty"`
+	Secret        string                 `protobuf:"bytes,2,opt,name=secret,proto3" json:"secret,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *SessionCookie) Reset() {
+	*x = SessionCookie{}
+	mi := &file_server_internal_types_proto_msgTypes[2]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *SessionCookie) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*SessionCookie) ProtoMessage() {}
+
+func (x *SessionCookie) ProtoReflect() protoreflect.Message {
+	mi := &file_server_internal_types_proto_msgTypes[2]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use SessionCookie.ProtoReflect.Descriptor instead.
+func (*SessionCookie) Descriptor() ([]byte, []int) {
+	return file_server_internal_types_proto_rawDescGZIP(), []int{2}
+}
+
+func (x *SessionCookie) GetSessionId() string {
+	if x != nil {
+		return x.SessionId
+	}
+	return ""
+}
+
+func (x *SessionCookie) GetSecret() string {
+	if x != nil {
+		return x.Secret
+	}
+	return ""
+}
+
+// HMACPayload is the structured message used as HMAC input.
+// Using protobuf encoding instead of string concatenation avoids
+// delimiter-based ambiguities in the HMAC message.
+type HMACPayload struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Values        []string               `protobuf:"bytes,1,rep,name=values,proto3" json:"values,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *HMACPayload) Reset() {
+	*x = HMACPayload{}
+	mi := &file_server_internal_types_proto_msgTypes[3]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *HMACPayload) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*HMACPayload) ProtoMessage() {}
+
+func (x *HMACPayload) ProtoReflect() protoreflect.Message {
+	mi := &file_server_internal_types_proto_msgTypes[3]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use HMACPayload.ProtoReflect.Descriptor instead.
+func (*HMACPayload) Descriptor() ([]byte, []int) {
+	return file_server_internal_types_proto_rawDescGZIP(), []int{3}
+}
+
+func (x *HMACPayload) GetValues() []string {
+	if x != nil {
+		return x.Values
+	}
+	return nil
+}
+
 var File_server_internal_types_proto protoreflect.FileDescriptor
 
-var file_server_internal_types_proto_rawDesc = []byte{
+var file_server_internal_types_proto_rawDesc = string([]byte{
 	0x0a, 0x1b, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x2f, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x6e, 0x61,
 	0x6c, 0x2f, 0x74, 0x79, 0x70, 0x65, 0x73, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x12, 0x08, 0x69,
 	0x6e, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x22, 0x43, 0x0a, 0x0c, 0x52, 0x65, 0x66, 0x72, 0x65,
@@ -149,28 +243,36 @@ var file_server_internal_types_proto_rawDesc = []byte{
 	0x0a, 0x07, 0x75, 0x73, 0x65, 0x72, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52,
 	0x06, 0x75, 0x73, 0x65, 0x72, 0x49, 0x64, 0x12, 0x17, 0x0a, 0x07, 0x63, 0x6f, 0x6e, 0x6e, 0x5f,
 	0x69, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x63, 0x6f, 0x6e, 0x6e, 0x49, 0x64,
-	0x42, 0x27, 0x5a, 0x25, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x64,
-	0x65, 0x78, 0x69, 0x64, 0x70, 0x2f, 0x64, 0x65, 0x78, 0x2f, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72,
-	0x2f, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f,
-	0x33,
-}
+	0x22, 0x46, 0x0a, 0x0d, 0x53, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x43, 0x6f, 0x6f, 0x6b, 0x69,
+	0x65, 0x12, 0x1d, 0x0a, 0x0a, 0x73, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x5f, 0x69, 0x64, 0x18,
+	0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x73, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x49, 0x64,
+	0x12, 0x16, 0x0a, 0x06, 0x73, 0x65, 0x63, 0x72, 0x65, 0x74, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09,
+	0x52, 0x06, 0x73, 0x65, 0x63, 0x72, 0x65, 0x74, 0x22, 0x25, 0x0a, 0x0b, 0x48, 0x4d, 0x41, 0x43,
+	0x50, 0x61, 0x79, 0x6c, 0x6f, 0x61, 0x64, 0x12, 0x16, 0x0a, 0x06, 0x76, 0x61, 0x6c, 0x75, 0x65,
+	0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x09, 0x52, 0x06, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x73, 0x42,
+	0x27, 0x5a, 0x25, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x64, 0x65,
+	0x78, 0x69, 0x64, 0x70, 0x2f, 0x64, 0x65, 0x78, 0x2f, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x2f,
+	0x69, 0x6e, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+})
 
 var (
 	file_server_internal_types_proto_rawDescOnce sync.Once
-	file_server_internal_types_proto_rawDescData = file_server_internal_types_proto_rawDesc
+	file_server_internal_types_proto_rawDescData []byte
 )
 
 func file_server_internal_types_proto_rawDescGZIP() []byte {
 	file_server_internal_types_proto_rawDescOnce.Do(func() {
-		file_server_internal_types_proto_rawDescData = protoimpl.X.CompressGZIP(file_server_internal_types_proto_rawDescData)
+		file_server_internal_types_proto_rawDescData = protoimpl.X.CompressGZIP(unsafe.Slice(unsafe.StringData(file_server_internal_types_proto_rawDesc), len(file_server_internal_types_proto_rawDesc)))
 	})
 	return file_server_internal_types_proto_rawDescData
 }
 
-var file_server_internal_types_proto_msgTypes = make([]protoimpl.MessageInfo, 2)
-var file_server_internal_types_proto_goTypes = []interface{}{
+var file_server_internal_types_proto_msgTypes = make([]protoimpl.MessageInfo, 4)
+var file_server_internal_types_proto_goTypes = []any{
 	(*RefreshToken)(nil),   // 0: internal.RefreshToken
 	(*IDTokenSubject)(nil), // 1: internal.IDTokenSubject
+	(*SessionCookie)(nil),  // 2: internal.SessionCookie
+	(*HMACPayload)(nil),    // 3: internal.HMACPayload
 }
 var file_server_internal_types_proto_depIdxs = []int32{
 	0, // [0:0] is the sub-list for method output_type
@@ -185,39 +287,13 @@ func file_server_internal_types_proto_init() {
 	if File_server_internal_types_proto != nil {
 		return
 	}
-	if !protoimpl.UnsafeEnabled {
-		file_server_internal_types_proto_msgTypes[0].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*RefreshToken); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_server_internal_types_proto_msgTypes[1].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*IDTokenSubject); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-	}
 	type x struct{}
 	out := protoimpl.TypeBuilder{
 		File: protoimpl.DescBuilder{
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
-			RawDescriptor: file_server_internal_types_proto_rawDesc,
+			RawDescriptor: unsafe.Slice(unsafe.StringData(file_server_internal_types_proto_rawDesc), len(file_server_internal_types_proto_rawDesc)),
 			NumEnums:      0,
-			NumMessages:   2,
+			NumMessages:   4,
 			NumExtensions: 0,
 			NumServices:   0,
 		},
@@ -226,7 +302,6 @@ func file_server_internal_types_proto_init() {
 		MessageInfos:      file_server_internal_types_proto_msgTypes,
 	}.Build()
 	File_server_internal_types_proto = out.File
-	file_server_internal_types_proto_rawDesc = nil
 	file_server_internal_types_proto_goTypes = nil
 	file_server_internal_types_proto_depIdxs = nil
 }
diff --git a/server/internal/types.proto b/server/internal/types.proto
index 6a949fe88d..914aed5518 100644
--- a/server/internal/types.proto
+++ b/server/internal/types.proto
@@ -1,6 +1,5 @@
 syntax = "proto3";
 
-// Package internal holds protobuf types used by the server.
 package internal;
 
 option go_package = "github.com/dexidp/dex/server/internal";
@@ -17,3 +16,17 @@ message IDTokenSubject {
   string user_id = 1;
   string conn_id = 2;
 }
+
+// SessionCookie holds what the session cookie names: which session, and the
+// secret proving the bearer is the browser that session was issued to.
+message SessionCookie {
+  string session_id = 1;
+  string secret = 2;
+}
+
+// HMACPayload is the structured message used as HMAC input.
+// Using protobuf encoding instead of string concatenation avoids
+// delimiter-based ambiguities in the HMAC message.
+message HMACPayload {
+  repeated string values = 1;
+}
diff --git a/server/introspection/doc.go b/server/introspection/doc.go
new file mode 100644
index 0000000000..a70cc01315
--- /dev/null
+++ b/server/introspection/doc.go
@@ -0,0 +1,3 @@
+// Package introspection serves the OAuth2 token introspection endpoint
+// (/token/introspect) as specified by RFC 7662.
+package introspection
diff --git a/server/introspection/introspection.go b/server/introspection/introspection.go
new file mode 100644
index 0000000000..eee7480af6
--- /dev/null
+++ b/server/introspection/introspection.go
@@ -0,0 +1,412 @@
+package introspection
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"log/slog"
+	"net/http"
+
+	"github.com/coreos/go-oidc/v3/oidc"
+
+	"github.com/dexidp/dex/server/internal"
+	"github.com/dexidp/dex/server/oauth2"
+	"github.com/dexidp/dex/server/router"
+	"github.com/dexidp/dex/server/session"
+	"github.com/dexidp/dex/server/signer"
+	"github.com/dexidp/dex/server/tokens"
+	"github.com/dexidp/dex/storage"
+)
+
+// Introspection contains an access token's session data as specified by
+// [IETF RFC 7662](https://tools.ietf.org/html/rfc7662)
+type Introspection struct {
+	// Boolean indicator of whether or not the presented token
+	// is currently active.  The specifics of a token's "active" state
+	// will vary depending on the implementation of the authorization
+	// server and the information it keeps about its tokens, but a "true"
+	// value return for the "active" property will generally indicate
+	// that a given token has been issued by this authorization server,
+	// has not been revoked by the resource owner, and is within its
+	// given time window of validity (e.g., after its issuance time and
+	// before its expiration time).
+	Active bool `json:"active"`
+
+	// JSON string containing a space-separated list of
+	// scopes associated with this token.
+	Scope string `json:"scope,omitempty"`
+
+	// Client identifier for the OAuth 2.0 client that
+	// requested this token.
+	ClientID string `json:"client_id"`
+
+	// Subject of the token, as defined in JWT [RFC7519].
+	// Usually a machine-readable identifier of the resource owner who
+	// authorized this token.
+	Subject string `json:"sub"`
+
+	// Integer timestamp, measured in the number of seconds
+	// since January 1 1970 UTC, indicating when this token will expire.
+	Expiry int64 `json:"exp"`
+
+	// Integer timestamp, measured in the number of seconds
+	// since January 1 1970 UTC, indicating when this token was
+	// originally issued.
+	IssuedAt int64 `json:"iat"`
+
+	// Integer timestamp, measured in the number of seconds
+	// since January 1 1970 UTC, indicating when this token is not to be
+	// used before.
+	NotBefore int64 `json:"nbf"`
+
+	// Human-readable identifier for the resource owner who
+	// authorized this token.
+	Username string `json:"username,omitempty"`
+
+	// Service-specific string identifier or list of string
+	// identifiers representing the intended audience for this token, as
+	// defined in JWT
+	Audience tokens.Audience `json:"aud"`
+
+	// String representing the issuer of this token, as
+	// defined in JWT
+	Issuer string `json:"iss"`
+
+	// String identifier for the token, as defined in JWT [RFC7519].
+	JwtTokenID string `json:"jti,omitempty"`
+
+	// TokenType is the introspected token's type, typically `bearer`.
+	TokenType string `json:"token_type"`
+
+	// TokenUse is the introspected token's use, for example `access_token` or `refresh_token`.
+	TokenUse string `json:"token_use"`
+
+	// Extra is arbitrary data set from the token claims.
+	Extra IntrospectionExtra `json:"ext,omitempty"`
+}
+
+type IntrospectionExtra struct {
+	AuthorizingParty string `json:"azp,omitempty"`
+
+	// SessionID is the "sid" claim carried by tokens issued under a browser
+	// session. Absent for tokens minted without one — client credentials, or any
+	// token at all when sessions are disabled.
+	//
+	// Note what this does not mean: introspection reports on the token, not on the
+	// session. A token from a session that has since ended still introspects as
+	// active until it expires, because nothing here consults session storage.
+	SessionID string `json:"sid,omitempty"`
+
+	Email         string `json:"email,omitempty"`
+	EmailVerified *bool  `json:"email_verified,omitempty"`
+
+	Groups []string `json:"groups,omitempty"`
+
+	Name              string `json:"name,omitempty"`
+	PreferredUsername string `json:"preferred_username,omitempty"`
+
+	FederatedIDClaims *tokens.FederatedIDClaims `json:"federated_claims,omitempty"`
+}
+
+type TokenTypeEnum int
+
+const (
+	AccessToken TokenTypeEnum = iota
+	RefreshToken
+)
+
+func (t TokenTypeEnum) String() string {
+	switch t {
+	case AccessToken:
+		return "access_token"
+	case RefreshToken:
+		return "refresh_token"
+	default:
+		return fmt.Sprintf("TokenTypeEnum(%d)", t)
+	}
+}
+
+type introspectionError struct {
+	typ  string
+	code int
+	desc string
+}
+
+func (e *introspectionError) Error() string {
+	return fmt.Sprintf("introspection error: status %d, %q %s", e.code, e.typ, e.desc)
+}
+
+func (e *introspectionError) Is(tgt error) bool {
+	target, ok := tgt.(*introspectionError)
+	if !ok {
+		return false
+	}
+
+	return e.typ == target.typ &&
+		e.code == target.code &&
+		e.desc == target.desc
+}
+
+func newIntrospectInactiveTokenError() *introspectionError {
+	return &introspectionError{typ: oauth2.InactiveToken, desc: "", code: http.StatusUnauthorized}
+}
+
+func newIntrospectInternalServerError() *introspectionError {
+	return &introspectionError{typ: oauth2.ServerError, desc: "", code: http.StatusInternalServerError}
+}
+
+func newIntrospectBadRequestError(desc string) *introspectionError {
+	return &introspectionError{typ: oauth2.InvalidRequest, desc: desc, code: http.StatusBadRequest}
+}
+
+// Handler serves the OAuth2 token introspection endpoint. It validates refresh
+// tokens with tokens.LookupRefreshToken, the same lookup the refresh grant uses.
+type Handler struct {
+	Issuer        string
+	Signer        signer.Signer
+	Storage       storage.Storage
+	Logger        *slog.Logger
+	RefreshPolicy *tokens.RefreshStrategy
+
+	// Sessions resolves whether the browser session a token was issued under is
+	// still alive. Nil when sessions are disabled, in which case no token carries
+	// a sid and there is nothing to check.
+	Sessions *session.Manager
+}
+
+// Mount registers the introspection route.
+func (h *Handler) Mount(m router.Mux) {
+	m.HandleCORS("/token/introspect", h.handle)
+}
+
+func (h *Handler) guessTokenType(ctx context.Context, token string) (TokenTypeEnum, error) {
+	// We skip every checks, we only want to know if it's a valid JWT
+	verifierConfig := oidc.Config{
+		SkipClientIDCheck: true,
+		SkipExpiryCheck:   true,
+		SkipIssuerCheck:   true,
+
+		// We skip signature checks to avoid database calls;
+		InsecureSkipSignatureCheck: true,
+	}
+
+	verifier := oidc.NewVerifier(h.Issuer, nil, &verifierConfig)
+	if _, err := verifier.Verify(ctx, token); err != nil {
+		// If it's not an access token, let's assume it's a refresh token;
+		return RefreshToken, nil
+	}
+
+	// If it's a valid JWT, it's an access token.
+	return AccessToken, nil
+}
+
+func (h *Handler) getTokenFromRequest(r *http.Request) (string, TokenTypeEnum, error) {
+	if r.Method != "POST" {
+		return "", 0, newIntrospectBadRequestError(fmt.Sprintf("HTTP method is \"%s\", expected \"POST\".", r.Method))
+	} else if err := r.ParseForm(); err != nil {
+		return "", 0, newIntrospectBadRequestError("Unable to parse HTTP body, make sure to send a properly formatted form request body.")
+	} else if len(r.PostForm) == 0 {
+		return "", 0, newIntrospectBadRequestError("The POST body can not be empty.")
+	} else if !r.PostForm.Has("token") {
+		return "", 0, newIntrospectBadRequestError("The POST body doesn't contain 'token' parameter.")
+	}
+
+	token := r.PostForm.Get("token")
+	tokenType, err := h.guessTokenType(r.Context(), token)
+	if err != nil {
+		h.Logger.ErrorContext(r.Context(), "failed to guess token type", "err", err)
+		return "", 0, newIntrospectInternalServerError()
+	}
+
+	requestTokenType := r.PostForm.Get("token_type_hint")
+	if requestTokenType != "" {
+		if tokenType.String() != requestTokenType {
+			h.Logger.Warn("token type hint doesn't match token type", "request_token_type", requestTokenType, "token_type", tokenType)
+		}
+	}
+
+	return token, tokenType, nil
+}
+
+func (h *Handler) introspectRefreshToken(ctx context.Context, token string) (*Introspection, error) {
+	rToken := new(internal.RefreshToken)
+	if err := internal.Unmarshal(token, rToken); err != nil {
+		// For backward compatibility, assume the refresh_token is a raw refresh token ID
+		// if it fails to decode.
+		//
+		// Because refresh_token values that aren't unmarshable were generated by servers
+		// that don't have a Token value, we'll still reject any attempts to claim a
+		// refresh_token twice.
+		rToken = &internal.RefreshToken{RefreshId: token, Token: ""}
+	}
+
+	refresh, err := tokens.LookupRefreshToken(ctx, h.Storage, h.RefreshPolicy, h.Logger, nil, rToken)
+	if err != nil {
+		// A rejected token (unknown, revoked or expired) is reported as inactive;
+		// only an infrastructure failure is a server error.
+		if errors.Is(err, tokens.ErrRefreshTokenInvalid) ||
+			errors.Is(err, tokens.ErrRefreshTokenExpired) ||
+			errors.Is(err, tokens.ErrRefreshTokenClaimedByOtherClient) {
+			return nil, newIntrospectInactiveTokenError()
+		}
+		h.Logger.ErrorContext(ctx, "failed to get refresh token", "err", err)
+		return nil, newIntrospectInternalServerError()
+	}
+
+	subjectString, sErr := tokens.GenSubject(refresh.Claims.UserID, refresh.ConnectorID)
+	if sErr != nil {
+		h.Logger.ErrorContext(ctx, "failed to marshal offline session ID", "err", sErr)
+		return nil, newIntrospectInternalServerError()
+	}
+
+	return &Introspection{
+		Active:    true,
+		ClientID:  refresh.ClientID,
+		IssuedAt:  refresh.CreatedAt.Unix(),
+		NotBefore: refresh.CreatedAt.Unix(),
+		Expiry:    refresh.CreatedAt.Add(h.RefreshPolicy.AbsoluteLifetime()).Unix(),
+		Subject:   subjectString,
+		Username:  refresh.Claims.PreferredUsername,
+		// Refresh-token introspection does not resolve scopes, so the audience is
+		// the token's own client only.
+		Audience: tokens.GetAudience(refresh.ClientID, nil),
+		Issuer:   h.Issuer,
+
+		Extra: IntrospectionExtra{
+			Email:             refresh.Claims.Email,
+			EmailVerified:     &refresh.Claims.EmailVerified,
+			Groups:            refresh.Claims.Groups,
+			Name:              refresh.Claims.Username,
+			PreferredUsername: refresh.Claims.PreferredUsername,
+		},
+		TokenType: "Bearer",
+		TokenUse:  "refresh_token",
+	}, nil
+}
+
+// sessionAlive reports whether a token's session still stands, for clients that
+// asked to be judged that way.
+//
+// RFC 7662 §4 requires the server to report a revoked token as inactive, and ending
+// a session revokes the tokens bound to it. Which tokens those are is the client's
+// RefreshTokenLifetime, the same declaration the refresh grant reads — the two must
+// agree, or a standalone client refreshes into a token that is inactive from birth.
+//
+// The comparison is against the sid, not merely the existence of a session: signing
+// out and back in makes a new session under the same subject, and the old token must
+// not be revived by it.
+func (h *Handler) sessionAlive(ctx context.Context, client storage.Client, subject, sessionID string) bool {
+	if sessionID == "" || !client.RefreshBoundToSession() {
+		return true
+	}
+
+	return h.Sessions.Alive(ctx, sessionID)
+}
+
+func (h *Handler) introspectAccessToken(ctx context.Context, token string) (*Introspection, error) {
+	verifier := oidc.NewVerifier(h.Issuer, &signer.KeySet{Signer: h.Signer}, &oidc.Config{SkipClientIDCheck: true})
+	idToken, err := verifier.Verify(ctx, token)
+	if err != nil {
+		return nil, newIntrospectInactiveTokenError()
+	}
+
+	var claims IntrospectionExtra
+	if err := idToken.Claims(&claims); err != nil {
+		h.Logger.ErrorContext(ctx, "error while fetching token claims", "err", err.Error())
+		return nil, newIntrospectInternalServerError()
+	}
+
+	clientID, err := tokens.GetClientID(idToken.Audience, claims.AuthorizingParty)
+	if err != nil {
+		h.Logger.ErrorContext(ctx, "error while fetching client_id from token:", "err", err.Error())
+		return nil, newIntrospectInternalServerError()
+	}
+
+	client, err := h.Storage.GetClient(ctx, clientID)
+	if err != nil {
+		h.Logger.ErrorContext(ctx, "error while fetching client from storage", "err", err.Error())
+		return nil, newIntrospectInternalServerError()
+	}
+
+	if !h.sessionAlive(ctx, client, idToken.Subject, claims.SessionID) {
+		return nil, newIntrospectInactiveTokenError()
+	}
+
+	return &Introspection{
+		Active:    true,
+		ClientID:  client.ID,
+		IssuedAt:  idToken.IssuedAt.Unix(),
+		NotBefore: idToken.IssuedAt.Unix(),
+		Expiry:    idToken.Expiry.Unix(),
+		Subject:   idToken.Subject,
+		Username:  claims.PreferredUsername,
+		Audience:  idToken.Audience,
+		Issuer:    h.Issuer,
+
+		Extra:     claims,
+		TokenType: "Bearer",
+		TokenUse:  "access_token",
+	}, nil
+}
+
+func (h *Handler) handle(w http.ResponseWriter, r *http.Request) {
+	ctx := r.Context()
+
+	var introspect *Introspection
+	token, tokenType, err := h.getTokenFromRequest(r)
+	if err == nil {
+		switch tokenType {
+		case AccessToken:
+			introspect, err = h.introspectAccessToken(ctx, token)
+		case RefreshToken:
+			introspect, err = h.introspectRefreshToken(ctx, token)
+		default:
+			// Token type is neither handled token types.
+			h.Logger.ErrorContext(ctx, "unknown token type", "token_type", tokenType)
+			introspectInactiveErr(w)
+			return
+		}
+	}
+
+	if err != nil {
+		if intErr, ok := err.(*introspectionError); ok {
+			h.writeError(w, intErr.typ, intErr.desc, intErr.code)
+		} else {
+			h.Logger.ErrorContext(ctx, "an unknown error occurred", "err", err.Error())
+			h.writeError(w, oauth2.ServerError, "An unknown error occurred", http.StatusInternalServerError)
+		}
+
+		return
+	}
+
+	rawJSON, jsonErr := json.Marshal(introspect)
+	if jsonErr != nil {
+		h.Logger.ErrorContext(ctx, "failed to marshal introspection response", "err", jsonErr)
+		h.writeError(w, oauth2.ServerError, "", http.StatusInternalServerError)
+		return
+	}
+
+	w.Header().Set("Content-Type", "application/json")
+	w.Write(rawJSON)
+}
+
+// writeError writes an OAuth2 error response. An inactive token is not an
+// error to the caller: RFC 7662 answers it with a 200 and active=false.
+func (h *Handler) writeError(w http.ResponseWriter, typ, description string, statusCode int) {
+	if typ == oauth2.InactiveToken {
+		introspectInactiveErr(w)
+		return
+	}
+	oauth2.WriteErrorResponse(h.Logger, w, typ, description, statusCode)
+}
+
+func introspectInactiveErr(w http.ResponseWriter) {
+	w.Header().Set("Cache-Control", "no-store")
+	w.Header().Set("Pragma", "no-cache")
+	w.Header().Set("Content-Type", "application/json")
+	w.WriteHeader(200)
+	json.NewEncoder(w).Encode(struct {
+		Active bool `json:"active"`
+	}{Active: false})
+}
diff --git a/server/introspection/introspection_test.go b/server/introspection/introspection_test.go
new file mode 100644
index 0000000000..e5733c6496
--- /dev/null
+++ b/server/introspection/introspection_test.go
@@ -0,0 +1,173 @@
+package introspection
+
+import (
+	"context"
+	"crypto/rand"
+	"crypto/rsa"
+	"io"
+	"log/slog"
+	"net/http"
+	"net/http/httptest"
+	"net/url"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/require"
+
+	"github.com/dexidp/dex/server/oauth2"
+	"github.com/dexidp/dex/server/signer"
+	"github.com/dexidp/dex/server/tokens"
+	"github.com/dexidp/dex/storage"
+	"github.com/dexidp/dex/storage/memory"
+)
+
+const testIssuer = "https://test.tech/non-root-path"
+
+func testHandler(t *testing.T) *Handler {
+	t.Helper()
+	return &Handler{
+		Issuer: testIssuer,
+		Logger: slog.New(slog.DiscardHandler),
+	}
+}
+
+// testAccessToken signs a valid RS256 access token for token-type guessing.
+func testAccessToken(t *testing.T) string {
+	t.Helper()
+	ctx := context.Background()
+	logger := slog.New(slog.DiscardHandler)
+
+	key, err := rsa.GenerateKey(rand.Reader, 2048)
+	require.NoError(t, err)
+	sig, err := signer.NewMockSigner(key)
+	require.NoError(t, err)
+
+	issURL, err := url.Parse(testIssuer)
+	require.NoError(t, err)
+
+	issuer := tokens.NewIssuer(memory.New(logger), sig, *issURL, time.Hour, time.Now, logger)
+	token, _, err := issuer.SignIDToken(ctx, tokens.Authorization{
+		Client:      storage.Client{ID: "test"},
+		Claims:      storage.Claims{UserID: "1", Username: "jane"},
+		Scopes:      []string{"openid"},
+		Nonce:       "nonce",
+		ConnectorID: "test",
+	}, "", "")
+	require.NoError(t, err)
+	return token
+}
+
+func TestGetTokenFromRequestSuccess(t *testing.T) {
+	h := testHandler(t)
+	accessToken := testAccessToken(t)
+
+	tests := []struct {
+		testName          string
+		expectedToken     string
+		expectedTokenType TokenTypeEnum
+	}{
+		{
+			testName:          "Access Token",
+			expectedToken:     accessToken,
+			expectedTokenType: AccessToken,
+		},
+		{
+			testName:          "Refresh token",
+			expectedToken:     "CgR0ZXN0EgNiYXI",
+			expectedTokenType: RefreshToken,
+		},
+		{
+			testName:          "Unknown token",
+			expectedToken:     "AaAaAaA",
+			expectedTokenType: RefreshToken,
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.testName, func(t *testing.T) {
+			data := url.Values{}
+			data.Set("token", tc.expectedToken)
+			req := httptest.NewRequest(http.MethodPost, "https://test.tech/token/introspect", strings.NewReader(data.Encode()))
+			req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+
+			token, tokenType, err := h.getTokenFromRequest(req)
+			require.NoError(t, err)
+			require.Equal(t, tc.expectedToken, token)
+			require.Equal(t, tc.expectedTokenType, tokenType)
+		})
+	}
+}
+
+func TestGetTokenFromRequestFailure(t *testing.T) {
+	h := testHandler(t)
+
+	_, _, err := h.getTokenFromRequest(httptest.NewRequest(http.MethodGet, "https://test.tech/token/introspect", nil))
+	require.ErrorIs(t, err, &introspectionError{
+		typ:  oauth2.InvalidRequest,
+		desc: "HTTP method is \"GET\", expected \"POST\".",
+		code: http.StatusBadRequest,
+	})
+
+	_, _, err = h.getTokenFromRequest(httptest.NewRequest(http.MethodPost, "https://test.tech/token/introspect", nil))
+	require.ErrorIs(t, err, &introspectionError{
+		typ:  oauth2.InvalidRequest,
+		desc: "The POST body can not be empty.",
+		code: http.StatusBadRequest,
+	})
+
+	req := httptest.NewRequest(http.MethodPost, "https://test.tech/token/introspect", strings.NewReader("token_type_hint=access_token"))
+	req.Header.Add("Content-Type", "application/x-www-form-urlencoded")
+	_, _, err = h.getTokenFromRequest(req)
+	require.ErrorIs(t, err, &introspectionError{
+		typ:  oauth2.InvalidRequest,
+		desc: "The POST body doesn't contain 'token' parameter.",
+		code: http.StatusBadRequest,
+	})
+}
+
+func TestIntrospectErrHelper(t *testing.T) {
+	h := testHandler(t)
+
+	tests := []struct {
+		testName      string
+		err           *introspectionError
+		resStatusCode int
+		resBody       string
+	}{
+		{
+			testName:      "Inactive Token",
+			err:           newIntrospectInactiveTokenError(),
+			resStatusCode: http.StatusOK,
+			resBody:       "{\"active\":false}\n",
+		},
+		{
+			testName:      "Bad Request",
+			err:           newIntrospectBadRequestError("This is a bad request"),
+			resStatusCode: http.StatusBadRequest,
+			resBody:       `{"error":"invalid_request","error_description":"This is a bad request"}`,
+		},
+		{
+			testName:      "Internal Server Error",
+			err:           newIntrospectInternalServerError(),
+			resStatusCode: http.StatusInternalServerError,
+			resBody:       `{"error":"server_error"}`,
+		},
+	}
+	for _, tc := range tests {
+		t.Run(tc.testName, func(t *testing.T) {
+			w1 := httptest.NewRecorder()
+
+			h.writeError(w1, tc.err.typ, tc.err.desc, tc.err.code)
+
+			res := w1.Result()
+			require.Equal(t, tc.resStatusCode, res.StatusCode)
+			require.Equal(t, "application/json", res.Header.Get("Content-Type"))
+
+			data, err := io.ReadAll(res.Body)
+			defer res.Body.Close()
+			require.NoError(t, err)
+			require.Equal(t, tc.resBody, string(data))
+		})
+	}
+}
diff --git a/server/logout/doc.go b/server/logout/doc.go
new file mode 100644
index 0000000000..9b957fc7ae
--- /dev/null
+++ b/server/logout/doc.go
@@ -0,0 +1,8 @@
+// Package logout implements OIDC RP-Initiated Logout: the /logout and
+// /logout/callback endpoints, upstream (connector) single-logout, refresh-token
+// revocation and session teardown.
+//
+// It is a terminal flow, independent of the login/consent/issue sequence: it
+// ends a session rather than advancing one. It requires sessions and mounts its
+// endpoints only when a session config is present.
+package logout
diff --git a/server/logout/logout.go b/server/logout/logout.go
new file mode 100644
index 0000000000..eab88611b6
--- /dev/null
+++ b/server/logout/logout.go
@@ -0,0 +1,454 @@
+package logout
+
+import (
+	"context"
+	"crypto/subtle"
+	"errors"
+	"fmt"
+	"log/slog"
+	"net/http"
+	"net/url"
+	"slices"
+	"time"
+
+	"github.com/coreos/go-oidc/v3/oidc"
+
+	"github.com/dexidp/dex/connector"
+	"github.com/dexidp/dex/server/backchannel"
+	"github.com/dexidp/dex/server/connectors"
+	"github.com/dexidp/dex/server/internal"
+	"github.com/dexidp/dex/server/oauth2"
+	"github.com/dexidp/dex/server/router"
+	"github.com/dexidp/dex/server/session"
+	"github.com/dexidp/dex/server/signer"
+	"github.com/dexidp/dex/server/templates"
+	"github.com/dexidp/dex/server/tokens"
+	"github.com/dexidp/dex/storage"
+)
+
+// Handler implements RP-Initiated Logout. It depends only on lower components
+// (sessions, storage, connectors, the token issuer), so it carries no login-flow
+// code.
+type Handler struct {
+	Storage    storage.Storage
+	Templates  *templates.Templates
+	Logger     *slog.Logger
+	Sessions   *session.Manager
+	Connectors *connectors.Cache
+	Issuer     *tokens.Issuer
+	Signer     signer.Signer
+	IssuerURL  oauth2.IssuerURL
+	Now        func() time.Time
+
+	// Backchannel tells the session's relying parties that it ended. The same
+	// notifier serves the gRPC API, which ends sessions too.
+	Backchannel *backchannel.Notifier
+}
+
+// renderError renders a user-facing HTML error page.
+func (h *Handler) renderError(r *http.Request, w http.ResponseWriter, status int, description string) {
+	templates.RenderError(h.Templates, h.Logger, r, w, status, description)
+}
+
+// Mount registers the logout endpoints. Logout requires an active session, so it
+// mounts only when sessions are enabled.
+func (h *Handler) Mount(mux router.Mux) {
+	if !h.Sessions.Enabled() {
+		return
+	}
+	mux.HandleFunc("/logout", h.handleLogout)
+	mux.HandleFunc("/logout/callback", h.handleLogoutCallback)
+}
+
+// handleLogout implements OIDC RP-Initiated Logout (https://openid.net/specs/openid-connect-rpinitiated-1_0.html).
+//
+// GET/POST /logout?id_token_hint=...&post_logout_redirect_uri=...&state=...
+//
+// The session cookie — not id_token_hint — decides whose session ends. The hint is
+// merely a claim about which session the RP *believes* is current; treating it as
+// authoritative would let anyone holding a leaked ID token log that user out, and
+// the hint is deliberately accepted past its expiry, so leaked means leaked forever.
+// Requiring the cookie means an attacker needs the victim's browser, at which point
+// they have already won. The hint's remaining jobs are to name the requesting client
+// (for post_logout_redirect_uri validation and refresh-token revocation) and, when it
+// matches the current session, to let dex skip the confirmation prompt.
+//
+// Flow:
+//  1. Resolve the session from the cookie, verifying its nonce against storage
+//  2. Validate id_token_hint (signature + issuer; expiry and audience skipped per spec)
+//     and cross-check its subject and sid against that session
+//  3. Ask the user to confirm unless the hint vouches for the current session
+//  4. Validate post_logout_redirect_uri against the client's registered URIs
+//  5. Revoke the refresh tokens of the clients bound to this session
+//  6. Notify every client in the session over the back channel
+//  7. If the upstream connector implements LogoutCallbackConnector, redirect to it and
+//     finish in handleLogoutCallback; otherwise delete the session, clear the cookie,
+//     and redirect to post_logout_redirect_uri (or render the logout page)
+func (h *Handler) handleLogout(w http.ResponseWriter, r *http.Request) {
+	ctx := r.Context()
+
+	if r.Method != http.MethodGet && r.Method != http.MethodPost {
+		h.renderError(r, w, http.StatusMethodNotAllowed, "Method not allowed.")
+		return
+	}
+
+	idTokenHint := r.FormValue("id_token_hint")
+	postLogoutRedirectURI := r.FormValue("post_logout_redirect_uri")
+	state := r.FormValue("state")
+
+	// The session named by the cookie is the one that will end, if any. ValidSession
+	// is the same check every other session-trusting path makes: nonce verified,
+	// expiry enforced, and a cookie that survived its session cleared on the way out.
+	authSession := h.Sessions.ValidSession(ctx, w, r)
+
+	var clientID string
+	hintMatchesSession := false
+
+	if idTokenHint != "" {
+		hint, err := h.parseIDTokenHint(ctx, idTokenHint)
+		if err != nil {
+			h.Logger.ErrorContext(ctx, "logout: invalid id_token_hint", "err", err)
+			h.renderError(r, w, http.StatusBadRequest, "Invalid id_token_hint.")
+			return
+		}
+
+		clientID = hint.clientID
+		hintMatchesSession = hint.matches(authSession)
+
+		h.Logger.DebugContext(ctx, "logout: parsed id_token_hint",
+			"user_id", hint.userID, "connector_id", hint.connectorID,
+			"client_id", clientID, "matches_session", hintMatchesSession)
+	}
+
+	// Ask the user to confirm in two cases, both from RP-Initiated Logout §2: "the OP
+	// MUST ask the End-User this question if an id_token_hint was not provided or if
+	// the supplied ID Token does not belong to the current OP session."
+	//
+	//   - A hint that names some other session is suspect whatever the method, so a
+	//     cross-site POST cannot use a leaked token to end the current session either.
+	//   - No hint at all needs confirming only on GET, which is what stops
+	//     <img src="/logout"> from working as CSRF. The confirmation form itself POSTs
+	//     back without a hint, and that submission is the one that must go through —
+	//     which is why this case is method-sensitive and the one above is not.
+	confirm := (idTokenHint != "" && !hintMatchesSession) ||
+		(idTokenHint == "" && r.Method == http.MethodGet)
+	if authSession != nil && confirm {
+		if err := h.Templates.Logout(r, w, "", false, true); err != nil {
+			h.Logger.ErrorContext(ctx, "server template error", "err", err)
+		}
+		return
+	}
+
+	// Validate post_logout_redirect_uri against registered client URIs.
+	if postLogoutRedirectURI != "" {
+		if clientID == "" {
+			h.renderError(r, w, http.StatusBadRequest, "post_logout_redirect_uri requires id_token_hint.")
+			return
+		}
+
+		client, err := h.Storage.GetClient(ctx, clientID)
+		if err != nil {
+			h.Logger.ErrorContext(ctx, "logout: failed to get client", "client_id", clientID, "err", err)
+			h.renderError(r, w, http.StatusBadRequest, "Invalid client.")
+			return
+		}
+
+		if !slices.Contains(client.PostLogoutRedirectURIs, postLogoutRedirectURI) {
+			h.Logger.WarnContext(ctx, "logout: unregistered post_logout_redirect_uri",
+				"uri", postLogoutRedirectURI, "client_id", clientID)
+			h.renderError(r, w, http.StatusBadRequest, "Unregistered post_logout_redirect_uri.")
+			return
+		}
+	}
+
+	// Nothing to end: no cookie, or a cookie for a session that is gone or expired.
+	// ValidSession has already cleared the cookie if there was one worth clearing.
+	// Still honor the redirect, so a repeated logout lands the user where they asked.
+	if authSession == nil {
+		h.finishLogout(w, r, postLogoutRedirectURI, state, false)
+		return
+	}
+
+	// Try upstream logout first. It needs a live auth session to park the logout
+	// parameters in, so it must run before the session is deleted, and it finishes
+	// the flow in handleLogoutCallback.
+	//
+	// Nothing is announced or revoked on this branch: the session ends in the callback,
+	// not here. Acting now would sign the relying parties out while dex's session and
+	// cookie live on, so a user who abandons the upstream logout page would be signed
+	// straight back in through SSO.
+	if redirectURL, ok := h.tryUpstreamLogout(ctx, authSession, postLogoutRedirectURI, state, clientID); ok {
+		http.Redirect(w, r, redirectURL, http.StatusSeeOther)
+		return
+	}
+
+	h.Logger.DebugContext(ctx, "logout: completing",
+		"user_id", authSession.UserID, "connector_id", authSession.ConnectorID, "client_id", clientID)
+
+	// Both read ClientStates, which dies with the session, so both run first.
+	h.revokeSessionBoundTokens(ctx, authSession)
+	h.Backchannel.Notify(ctx, authSession)
+
+	loggedOut := h.deleteAuthSession(ctx, authSession)
+	h.Sessions.ClearCookie(w)
+	h.finishLogout(w, r, postLogoutRedirectURI, state, loggedOut)
+}
+
+// revokeSessionBoundTokens deletes the refresh tokens of the clients that declared
+// themselves bound to this session, and leaves every other client's token alone.
+//
+// Dex requires offline_access for every refresh token it issues, so a browser proxy
+// and a kubectl credential reach the token endpoint looking identical. The client's
+// RefreshTokenLifetime is the only place that distinction exists — revoking on
+// behalf of the whole user is what used to destroy a kubectl login on every web
+// logout.
+//
+// Belt and braces: a bound token is refused and deleted at its next redemption
+// anyway (see sessionID in server/grants). Doing it here means the credential is
+// gone at logout rather than at the attacker's convenience.
+func (h *Handler) revokeSessionBoundTokens(ctx context.Context, authSession *storage.AuthSession) {
+	var bound []string
+	for clientID := range authSession.ClientStates {
+		client, err := h.Storage.GetClient(ctx, clientID)
+		if err != nil {
+			h.Logger.DebugContext(ctx, "logout: revocation skipped, client not found",
+				"client_id", clientID, "err", err)
+			continue
+		}
+		if client.RefreshBoundToSession() {
+			bound = append(bound, clientID)
+		}
+	}
+
+	h.Issuer.Refresh.RevokeClients(ctx, authSession.UserID, authSession.ConnectorID, bound)
+}
+
+// idTokenHint holds the parts of a verified id_token_hint that logout cares about.
+type idTokenHint struct {
+	userID      string
+	connectorID string
+	clientID    string
+	sessionID   string // "sid", empty for tokens minted before sid existed
+}
+
+// matches reports whether the hint describes the given session. A hint carrying a sid
+// must match it exactly; one without a sid falls back to the subject alone, which is
+// all a token issued by an older dex can offer.
+func (h idTokenHint) matches(authSession *storage.AuthSession) bool {
+	if authSession == nil {
+		return false
+	}
+	if h.userID != authSession.UserID || h.connectorID != authSession.ConnectorID {
+		return false
+	}
+	if h.sessionID == "" {
+		return true
+	}
+	return h.sessionID == authSession.ID
+}
+
+// parseIDTokenHint verifies the hint and extracts the subject, requesting client and
+// session id from it.
+func (h *Handler) parseIDTokenHint(ctx context.Context, raw string) (idTokenHint, error) {
+	idToken, err := h.validateIDTokenHint(ctx, raw)
+	if err != nil {
+		return idTokenHint{}, err
+	}
+
+	sub := new(internal.IDTokenSubject)
+	if err := internal.Unmarshal(idToken.Subject, sub); err != nil {
+		return idTokenHint{}, fmt.Errorf("unmarshal subject: %w", err)
+	}
+
+	// With cross-client (trusted peers) scopes a token can carry several audiences; the
+	// requesting client is then in "azp". Same resolution as token introspection uses.
+	var claims struct {
+		AuthorizingParty string `json:"azp"`
+		SessionID        string `json:"sid"`
+	}
+	if err := idToken.Claims(&claims); err != nil {
+		return idTokenHint{}, fmt.Errorf("decode claims: %w", err)
+	}
+
+	hint := idTokenHint{
+		userID:      sub.UserId,
+		connectorID: sub.ConnId,
+		sessionID:   claims.SessionID,
+	}
+
+	switch len(idToken.Audience) {
+	case 0:
+		// No audience — cannot determine the client.
+	case 1:
+		hint.clientID = idToken.Audience[0]
+	default:
+		hint.clientID = claims.AuthorizingParty
+	}
+
+	return hint, nil
+}
+
+// handleLogoutCallback receives the redirect back from the upstream provider
+// after it has completed its logout.
+//
+// Identity is resolved from the session cookie (HttpOnly, Secure, SameSite=Lax).
+// The session must still exist in storage with a non-nil LogoutState (set before
+// the upstream redirect). After validation, the session is deleted.
+func (h *Handler) handleLogoutCallback(w http.ResponseWriter, r *http.Request) {
+	ctx := r.Context()
+
+	// Resolve the session from the cookie.
+	sessionID, secret, ok := h.Sessions.ParseCookie(r)
+	if !ok {
+		h.renderError(r, w, http.StatusBadRequest, "Invalid session cookie.")
+		return
+	}
+
+	session, err := h.Storage.GetAuthSession(ctx, sessionID)
+	if err != nil {
+		h.Logger.ErrorContext(ctx, "logout callback: session not found", "err", err)
+		h.renderError(r, w, http.StatusBadRequest, "Session not found.")
+		return
+	}
+
+	if subtle.ConstantTimeCompare([]byte(session.Secret), []byte(secret)) != 1 {
+		h.renderError(r, w, http.StatusBadRequest, "Invalid session.")
+		return
+	}
+
+	if session.LogoutState == nil {
+		h.renderError(r, w, http.StatusBadRequest, "No logout in progress.")
+		return
+	}
+
+	ls := session.LogoutState
+
+	// Let the connector validate the upstream logout response if it supports it.
+	if ls.ConnectorID != "" {
+		conn, err := h.Connectors.Get(ctx, ls.ConnectorID)
+		if err == nil {
+			if logoutConn, ok := conn.Connector.(connector.LogoutCallbackConnector); ok {
+				if err := logoutConn.HandleLogoutCallback(ctx, r); err != nil {
+					h.Logger.ErrorContext(ctx, "logout: upstream logout response validation failed",
+						"connector_id", ls.ConnectorID, "err", err)
+				}
+			}
+		}
+	}
+
+	// The session actually ends here on the upstream path, so this is where its bound
+	// tokens go and its relying parties are told.
+	h.revokeSessionBoundTokens(ctx, &session)
+	h.Backchannel.Notify(ctx, &session)
+
+	// Session kept alive until now — delete it and clear the cookie.
+	h.deleteAuthSession(ctx, &session)
+	h.Sessions.ClearCookie(w)
+	h.finishLogout(w, r, ls.PostLogoutRedirectURI, ls.State, true)
+}
+
+// finishLogout redirects to post_logout_redirect_uri when the RP supplied one that
+// passed validation, as RP-Initiated Logout §4 requires, and otherwise renders the
+// logout page. loggedOut indicates whether an active session was actually terminated.
+//
+// Callers must have validated postLogoutRedirectURI against the client's registered
+// URIs before reaching here; this function redirects to whatever it is handed.
+func (h *Handler) finishLogout(w http.ResponseWriter, r *http.Request, postLogoutRedirectURI, state string, loggedOut bool) {
+	if postLogoutRedirectURI != "" {
+		if u, err := url.Parse(postLogoutRedirectURI); err == nil {
+			if state != "" {
+				q := u.Query()
+				q.Set("state", state)
+				u.RawQuery = q.Encode()
+			}
+			http.Redirect(w, r, u.String(), http.StatusFound)
+			return
+		}
+		h.Logger.ErrorContext(r.Context(), "logout: failed to parse post_logout_redirect_uri",
+			"uri", postLogoutRedirectURI)
+	}
+
+	if err := h.Templates.Logout(r, w, "", loggedOut, false); err != nil {
+		h.Logger.ErrorContext(r.Context(), "server template error", "err", err)
+	}
+}
+
+// tryUpstreamLogout attempts to redirect to the upstream provider's logout endpoint.
+// It stores LogoutState in the auth session before redirecting so the callback can
+// read it back. Returns the redirect URL and true on success, or ("", false) if
+// upstream logout is not possible (connector doesn't support it, etc.).
+func (h *Handler) tryUpstreamLogout(ctx context.Context, authSession *storage.AuthSession, postLogoutRedirectURI, state, clientID string) (string, bool) {
+	connectorID := authSession.ConnectorID
+	if connectorID == "" {
+		return "", false
+	}
+
+	conn, err := h.Connectors.Get(ctx, connectorID)
+	if err != nil {
+		return "", false
+	}
+
+	logoutConn, ok := conn.Connector.(connector.LogoutCallbackConnector)
+	if !ok {
+		return "", false
+	}
+
+	// Store logout parameters in the session.
+	if err := h.Storage.UpdateAuthSession(ctx, authSession.ID, func(old storage.AuthSession) (storage.AuthSession, error) {
+		old.LogoutState = &storage.LogoutState{
+			PostLogoutRedirectURI: postLogoutRedirectURI,
+			State:                 state,
+			ClientID:              clientID,
+			ConnectorID:           connectorID,
+		}
+		return old, nil
+	}); err != nil {
+		h.Logger.ErrorContext(ctx, "logout: failed to save logout state", "err", err)
+		return "", false
+	}
+
+	callbackURI := h.IssuerURL.AbsURL("/logout/callback")
+	upstreamURL, err := logoutConn.LogoutURL(ctx, callbackURI)
+	if err != nil {
+		h.Logger.ErrorContext(ctx, "logout: upstream connector error", "err", err)
+		return "", false
+	}
+	if upstreamURL == "" {
+		return "", false
+	}
+
+	u, err := url.Parse(upstreamURL)
+	if err != nil {
+		h.Logger.ErrorContext(ctx, "logout: failed to parse upstream URL", "err", err)
+		return "", false
+	}
+
+	return u.String(), true
+}
+
+// deleteAuthSession deletes the session and returns true if it existed.
+func (h *Handler) deleteAuthSession(ctx context.Context, session *storage.AuthSession) bool {
+	if session == nil || session.ID == "" {
+		return false
+	}
+	if err := h.Storage.DeleteAuthSession(ctx, session.ID); err != nil {
+		if !errors.Is(err, storage.ErrNotFound) {
+			h.Logger.ErrorContext(ctx, "logout: failed to delete auth session", "err", err)
+		}
+		return false
+	}
+	h.Logger.InfoContext(ctx, "logout successful",
+		"session_id", session.ID, "user_id", session.UserID)
+	return true
+}
+
+// validateIDTokenHint verifies an id_token_hint was issued by this server. The
+// signature check (via signer.KeySet) is what establishes trust; expiry and
+// audience are intentionally skipped per RP-Initiated Logout.
+func (h *Handler) validateIDTokenHint(ctx context.Context, hint string) (*oidc.IDToken, error) {
+	verifier := oidc.NewVerifier(h.IssuerURL.String(), &signer.KeySet{Signer: h.Signer}, &oidc.Config{
+		SkipExpiryCheck:   true,
+		SkipClientIDCheck: true,
+	})
+	return verifier.Verify(ctx, hint)
+}
diff --git a/server/mfa/doc.go b/server/mfa/doc.go
new file mode 100644
index 0000000000..450508857e
--- /dev/null
+++ b/server/mfa/doc.go
@@ -0,0 +1,3 @@
+// Package mfa owns dex's MFA domain: the authenticator chain and the TOTP
+// and WebAuthn endpoints. The interactive auth flow delegates to a Handler.
+package mfa
diff --git a/server/mfa/handler.go b/server/mfa/handler.go
new file mode 100644
index 0000000000..bd397e793d
--- /dev/null
+++ b/server/mfa/handler.go
@@ -0,0 +1,271 @@
+package mfa
+
+import (
+	"context"
+	"fmt"
+	"log/slog"
+	"net/http"
+	"net/url"
+	"time"
+
+	"github.com/dexidp/dex/server/connectors"
+	"github.com/dexidp/dex/server/internal"
+	"github.com/dexidp/dex/server/oauth2"
+	"github.com/dexidp/dex/server/router"
+	"github.com/dexidp/dex/server/templates"
+	"github.com/dexidp/dex/storage"
+)
+
+type Provider interface {
+	// Type returns the authenticator type identifier (e.g., "TOTP").
+	Type() string
+	// EnabledForConnectorType returns true if this provider applies to the given connector type.
+	// If no connector types are configured, the provider applies to all.
+	EnabledForConnectorType(connectorType string) bool
+}
+
+// mfaRequestContext carries the state a factor endpoint resolves once from the
+// request (the auth request, the user identity, the authenticator being run).
+type mfaRequestContext struct {
+	authReq         storage.AuthRequest
+	identity        storage.UserIdentity
+	authenticatorID string
+}
+
+// Handler owns the MFA domain: the /mfa entry the dispatcher hands off to, the
+// effective authenticator chain, the TOTP and WebAuthn factor endpoints, and the
+// challenge lifecycle. A completed factor returns to the /auth dispatcher.
+type Handler struct {
+	Storage         storage.Storage
+	Templates       *templates.Templates
+	Logger          *slog.Logger
+	IssuerURL       oauth2.IssuerURL
+	MFAProviders    map[string]Provider
+	DefaultMFAChain []string
+	Now             func() time.Time
+	Connectors      *connectors.Cache
+}
+
+// renderError renders a user-facing HTML error page.
+func (h *Handler) renderError(r *http.Request, w http.ResponseWriter, status int, description string) {
+	templates.RenderError(h.Templates, h.Logger, r, w, status, description)
+}
+
+func (h *Handler) validateMFARequest(w http.ResponseWriter, r *http.Request) (*mfaRequestContext, bool) {
+	macEncoded := r.FormValue("hmac")
+	if macEncoded == "" {
+		h.renderError(r, w, http.StatusUnauthorized, "Unauthorized request.")
+		return nil, false
+	}
+
+	ctx := r.Context()
+
+	authReq, err := h.Storage.GetAuthRequest(ctx, r.FormValue("req"))
+	if err != nil {
+		h.Logger.ErrorContext(ctx, "failed to get auth request", "err", err)
+		h.renderError(r, w, http.StatusInternalServerError, "Database error.")
+		return nil, false
+	}
+	if !authReq.LoggedIn {
+		h.Logger.ErrorContext(ctx, "auth request does not have an identity for MFA verification")
+		h.renderError(r, w, http.StatusInternalServerError, "Login process not yet finalized.")
+		return nil, false
+	}
+
+	authenticatorID := r.FormValue("authenticator")
+
+	if !internal.VerifyStep(authReq, macEncoded, internal.Authenticator(authenticatorID)) {
+		h.renderError(r, w, http.StatusUnauthorized, "Unauthorized request.")
+		return nil, false
+	}
+
+	identity, err := h.Storage.GetUserIdentity(ctx, authReq.Claims.UserID, authReq.ConnectorID)
+	if err != nil {
+		h.Logger.ErrorContext(ctx, "failed to get user identity", "err", err)
+		h.renderError(r, w, http.StatusInternalServerError, "Database error.")
+		return nil, false
+	}
+
+	// Already satisfied — move on to consent instead of showing a factor.
+	if authReq.MFAValidated {
+		http.Redirect(w, r, h.buildContinueURL(authReq), http.StatusSeeOther)
+		return nil, false
+	}
+
+	return &mfaRequestContext{
+		authReq:         authReq,
+		identity:        identity,
+		authenticatorID: authenticatorID,
+	}, true
+}
+
+func (h *Handler) chainForClient(ctx context.Context, clientID, connectorID string) ([]string, error) {
+	if len(h.MFAProviders) == 0 {
+		return nil, nil
+	}
+
+	client, err := h.Storage.GetClient(ctx, clientID)
+	if err != nil {
+		return nil, err
+	}
+
+	// nil means "not set" — fall back to default.
+	// Explicit empty slice ([]string{}) means "no MFA" — don't fall back.
+	source := client.MFAChain
+	if source == nil {
+		source = h.DefaultMFAChain
+	}
+
+	// Resolve connector type from connector ID.
+	connectorType, err := h.getConnectorType(ctx, connectorID)
+	if err != nil {
+		return nil, err
+	}
+
+	var chain []string
+	for _, authID := range source {
+		provider, ok := h.MFAProviders[authID]
+		if ok && provider.EnabledForConnectorType(connectorType) {
+			chain = append(chain, authID)
+		}
+	}
+	return chain, nil
+}
+
+// getConnectorType returns the type of the connector with the given ID.
+func (h *Handler) getConnectorType(ctx context.Context, connectorID string) (string, error) {
+	conn, err := h.Connectors.Get(ctx, connectorID)
+	if err != nil {
+		return "", fmt.Errorf("get connector %q: %w", connectorID, err)
+	}
+	return conn.Type, nil
+}
+
+// mfaPagePath returns the page URL path for the given MFA provider type.
+func (h *Handler) mfaPagePath(authenticatorID string) string {
+	provider, ok := h.MFAProviders[authenticatorID]
+	if ok && provider.Type() == "WebAuthn" {
+		return "/mfa/webauthn"
+	}
+	return "/mfa/totp"
+}
+
+// CompleteStep checks for the next authenticator in the MFA chain and either
+// returns the URL for the next factor or marks MFA validated and returns the
+// consent URL — the next step in the chain.
+func (h *Handler) CompleteStep(ctx context.Context, authReq storage.AuthRequest, authenticatorID string) (string, error) {
+	mfaChain, err := h.chainForClient(ctx, authReq.ClientID, authReq.ConnectorID)
+	if err != nil {
+		return "", fmt.Errorf("get MFA chain: %w", err)
+	}
+
+	// Find the next authenticator in the chain after the current one.
+	var nextAuthenticator string
+	for i, id := range mfaChain {
+		if id == authenticatorID && i+1 < len(mfaChain) {
+			nextAuthenticator = mfaChain[i+1]
+			break
+		}
+	}
+
+	if nextAuthenticator != "" {
+		return h.buildRedirectURL(authReq, nextAuthenticator), nil
+	}
+
+	// All authenticators completed — mark as validated.
+	if err := h.markValidated(ctx, authReq.ID); err != nil {
+		return "", fmt.Errorf("update auth request: %w", err)
+	}
+
+	return h.buildContinueURL(authReq), nil
+}
+
+// markValidated records that the auth request has satisfied MFA, so the /auth
+// dispatcher stops routing it back to the MFA entry.
+func (h *Handler) markValidated(ctx context.Context, authReqID string) error {
+	return h.Storage.UpdateAuthRequest(ctx, authReqID, func(old storage.AuthRequest) (storage.AuthRequest, error) {
+		old.MFAValidated = true
+		return old, nil
+	})
+}
+
+// handleMFA is the MFA entry point. The /auth dispatcher sends the user here
+// (with the "mfa" verifier) when the client requires MFA; MFA then makes the
+// decision the dispatcher cannot without its providers: resolve the effective
+// chain and send the user to the first pending factor, or — when the chain
+// resolves to nothing applicable — hand straight back to the dispatcher.
+func (h *Handler) handleMFA(w http.ResponseWriter, r *http.Request) {
+	ctx := r.Context()
+
+	authReq, err := h.Storage.GetAuthRequest(ctx, r.FormValue("req"))
+	if err != nil {
+		h.Logger.ErrorContext(ctx, "failed to get auth request", "err", err)
+		h.renderError(r, w, http.StatusInternalServerError, "Database error.")
+		return
+	}
+	if !authReq.LoggedIn {
+		h.Logger.ErrorContext(ctx, "auth request does not have an identity for MFA verification")
+		h.renderError(r, w, http.StatusInternalServerError, "Login process not yet finalized.")
+		return
+	}
+	if !internal.VerifyStep(authReq, r.FormValue("hmac"), internal.StepMFA) {
+		h.renderError(r, w, http.StatusUnauthorized, "Unauthorized request.")
+		return
+	}
+
+	if authReq.MFAValidated {
+		http.Redirect(w, r, h.buildContinueURL(authReq), http.StatusSeeOther)
+		return
+	}
+
+	chain, err := h.chainForClient(ctx, authReq.ClientID, authReq.ConnectorID)
+	if err != nil {
+		h.Logger.ErrorContext(ctx, "failed to determine MFA chain", "err", err)
+		h.renderError(r, w, http.StatusInternalServerError, "Database error.")
+		return
+	}
+	if len(chain) == 0 {
+		// Nothing in the requested chain applies to this connector — record MFA as
+		// satisfied so the dispatcher stops routing back here, and continue.
+		if err := h.markValidated(ctx, authReq.ID); err != nil {
+			h.Logger.ErrorContext(ctx, "failed to mark MFA validated", "err", err)
+			h.renderError(r, w, http.StatusInternalServerError, "Database error.")
+			return
+		}
+		http.Redirect(w, r, h.buildContinueURL(authReq), http.StatusSeeOther)
+		return
+	}
+	http.Redirect(w, r, h.buildRedirectURL(authReq, chain[0]), http.StatusSeeOther)
+}
+
+// buildRedirectURL builds an HMAC-protected redirect URL for the given authenticator.
+func (h *Handler) buildRedirectURL(authReq storage.AuthRequest, authenticatorID string) string {
+	return internal.StepURL(
+		h.IssuerURL.AbsPath(h.mfaPagePath(authenticatorID)),
+		authReq,
+		internal.Authenticator(authenticatorID),
+		url.Values{"authenticator": {authenticatorID}},
+	)
+}
+
+// buildContinueURL builds the HMAC-protected URL that returns to the authorize
+// dispatcher (/auth) once a factor is done, so it can decide the next step.
+func (h *Handler) buildContinueURL(authReq storage.AuthRequest) string {
+	return internal.StepURL(h.IssuerURL.AbsPath("/auth"), authReq, internal.StepContinue, nil)
+}
+
+// Mount registers the MFA factor endpoints, only when at least one authenticator
+// is configured. The dispatcher (/auth) decides whether MFA applies and sends the
+// user to a factor; MFA verifies it and returns to the dispatcher.
+func (h *Handler) Mount(mux router.Mux) {
+	if len(h.MFAProviders) == 0 {
+		return
+	}
+	mux.HandleFunc("/mfa", h.handleMFA)
+	mux.HandleFunc("/mfa/totp", h.handleTOTP)
+	mux.HandleFunc("/mfa/webauthn", h.handleWebAuthn)
+	mux.HandleFunc("/mfa/webauthn/register/begin", h.handleWebAuthnRegisterBegin)
+	mux.HandleFunc("/mfa/webauthn/register/finish", h.handleWebAuthnRegisterFinish)
+	mux.HandleFunc("/mfa/webauthn/login/begin", h.handleWebAuthnLoginBegin)
+	mux.HandleFunc("/mfa/webauthn/login/finish", h.handleWebAuthnLoginFinish)
+}
diff --git a/server/mfa/handler_test.go b/server/mfa/handler_test.go
new file mode 100644
index 0000000000..c845750260
--- /dev/null
+++ b/server/mfa/handler_test.go
@@ -0,0 +1,186 @@
+package mfa
+
+import (
+	"crypto/rand"
+	"log/slog"
+	"net/http"
+	"net/http/httptest"
+	"net/url"
+	"testing"
+	"time"
+
+	"github.com/gorilla/mux"
+	"github.com/stretchr/testify/require"
+
+	"github.com/dexidp/dex/connector"
+	"github.com/dexidp/dex/connector/mock"
+	"github.com/dexidp/dex/server/connectors"
+	"github.com/dexidp/dex/server/internal"
+	"github.com/dexidp/dex/server/oauth2"
+	"github.com/dexidp/dex/server/templates"
+	"github.com/dexidp/dex/storage"
+	"github.com/dexidp/dex/storage/memory"
+	dexweb "github.com/dexidp/dex/web"
+)
+
+// testMux adapts a gorilla router to router.Mux so the Handler can mount its
+// routes.
+type testMux struct{ r *mux.Router }
+
+func (m testMux) Handle(p string, h http.Handler)         { m.r.Handle(p, h) }
+func (m testMux) HandleFunc(p string, h http.HandlerFunc) { m.r.HandleFunc(p, h) }
+func (m testMux) HandleCORS(p string, h http.HandlerFunc) { m.r.HandleFunc(p, h) }
+func (m testMux) HandlePrefix(p string, h http.Handler) {
+	m.r.PathPrefix(p).Handler(http.StripPrefix(p, h))
+}
+
+func resolveTestConnector(storage.Connector) (connector.Connector, error) {
+	return mock.NewCallbackConnector(nil), nil
+}
+
+// newTestHandler builds an MFA Handler mounted on a router, wired to an in-memory
+// store with a single "mock" connector, the way the server wires it. It returns
+// the handler (a few tests call its methods directly), the router serving its
+// routes, and the store.
+func newTestHandler(t *testing.T, providers map[string]Provider, defaultChain []string) (*Handler, http.Handler, storage.Storage) {
+	t.Helper()
+
+	logger := slog.New(slog.NewTextHandler(t.Output(), &slog.HandlerOptions{Level: slog.LevelDebug}))
+	store := memory.New(logger)
+
+	//nolint:dogsled // only the templates are needed here
+	_, _, _, tmpls, err := templates.LoadWebConfig(templates.Config{
+		WebFS:     dexweb.FS(),
+		IssuerURL: "http://127.0.0.1",
+	})
+	require.NoError(t, err)
+
+	issuerURL, err := url.Parse("http://127.0.0.1")
+	require.NoError(t, err)
+
+	conns := connectors.NewCache(store, resolveTestConnector)
+	require.NoError(t, store.CreateConnector(t.Context(), storage.Connector{
+		ID: "mock", Type: "mockCallback", Name: "Mock", ResourceVersion: "1",
+	}))
+	conns.Set("mock", connectors.Connector{Type: "mockCallback", ResourceVersion: "1"})
+
+	h := &Handler{
+		Storage:         store,
+		Templates:       tmpls,
+		Logger:          logger,
+		IssuerURL:       oauth2.IssuerURL{URL: *issuerURL},
+		MFAProviders:    providers,
+		DefaultMFAChain: defaultChain,
+		Now:             time.Now,
+		Connectors:      conns,
+	}
+
+	router := mux.NewRouter()
+	h.Mount(testMux{router})
+	return h, router, store
+}
+
+func randomHMACKey(t *testing.T) []byte {
+	t.Helper()
+	key := make([]byte, 32)
+	_, err := rand.Read(key)
+	require.NoError(t, err)
+	return key
+}
+
+func TestCompleteStep(t *testing.T) {
+	provider, err := NewWebAuthnProvider("Test", "", nil, "", "", "http://127.0.0.1", nil)
+	require.NoError(t, err)
+
+	h, _, store := newTestHandler(t,
+		map[string]Provider{"webauthn-1": provider, "webauthn-2": provider},
+		[]string{"webauthn-1", "webauthn-2"},
+	)
+
+	ctx := t.Context()
+	authReq := storage.AuthRequest{
+		ID:          "test-req-chain",
+		ClientID:    "example-app",
+		Expiry:      time.Now().Add(time.Hour),
+		HMACKey:     randomHMACKey(t),
+		LoggedIn:    true,
+		Claims:      storage.Claims{UserID: "user-1", Email: "user@example.com"},
+		ConnectorID: "mock",
+	}
+	require.NoError(t, store.CreateAuthRequest(ctx, authReq))
+	require.NoError(t, store.CreateClient(ctx, storage.Client{ID: "example-app", Secret: "secret"}))
+
+	// Completing first step should redirect to second.
+	redirectURL, err := h.CompleteStep(ctx, authReq, "webauthn-1")
+	require.NoError(t, err)
+	require.Contains(t, redirectURL, "/mfa/webauthn")
+	require.Contains(t, redirectURL, "authenticator=webauthn-2")
+
+	// Completing the last step should redirect to the flow dispatcher.
+	redirectURL, err = h.CompleteStep(ctx, authReq, "webauthn-2")
+	require.NoError(t, err)
+	require.Contains(t, redirectURL, "/auth?")
+
+	// Verify MFAValidated was set.
+	updated, err := store.GetAuthRequest(ctx, authReq.ID)
+	require.NoError(t, err)
+	require.True(t, updated.MFAValidated)
+}
+
+// TestMFAEntry covers the /mfa entry the dispatcher hands off to: MFA resolves
+// the effective chain itself, sending an applicable factor to its page, and —
+// crucially — recording MFA as satisfied when nothing applies so the dispatcher
+// (which gates on the unfiltered client chain) does not loop back here.
+func TestMFAEntry(t *testing.T) {
+	ctx := t.Context()
+
+	setup := func(t *testing.T, connectorTypes []string) (http.Handler, storage.Storage, storage.AuthRequest, []byte) {
+		t.Helper()
+		_, router, store := newTestHandler(t,
+			map[string]Provider{"totp": NewTOTPProvider("test-issuer", connectorTypes)},
+			nil,
+		)
+
+		hmacKey := randomHMACKey(t)
+		authReq := storage.AuthRequest{
+			ID: "mfa-entry-req", ClientID: "app", Expiry: time.Now().Add(time.Hour),
+			HMACKey: hmacKey, LoggedIn: true,
+			Claims:      storage.Claims{UserID: "user-1", Email: "user@example.com"},
+			ConnectorID: "mock",
+		}
+		require.NoError(t, store.CreateAuthRequest(ctx, authReq))
+		require.NoError(t, store.CreateClient(ctx, storage.Client{ID: "app", Secret: "s", MFAChain: []string{"totp"}}))
+		return router, store, authReq, hmacKey
+	}
+
+	get := func(router http.Handler, authReq storage.AuthRequest, hmacKey []byte) *httptest.ResponseRecorder {
+		hmacVal := internal.SignStep(authReq, internal.StepMFA)
+		w := httptest.NewRecorder()
+		router.ServeHTTP(w, httptest.NewRequest(http.MethodGet, "/mfa?req="+authReq.ID+"&hmac="+hmacVal, nil))
+		return w
+	}
+
+	t.Run("applicable factor redirects to its page", func(t *testing.T) {
+		// nil connector types => the provider applies to every connector.
+		router, _, authReq, hmacKey := setup(t, nil)
+		w := get(router, authReq, hmacKey)
+
+		require.Equal(t, http.StatusSeeOther, w.Code)
+		require.Contains(t, w.Header().Get("Location"), "/mfa/totp")
+		require.Contains(t, w.Header().Get("Location"), "authenticator=totp")
+	})
+
+	t.Run("no applicable factor marks validated and continues", func(t *testing.T) {
+		// The provider is enabled only for oidc; the connector is not, so the
+		// resolved chain is empty.
+		router, store, authReq, hmacKey := setup(t, []string{"oidc"})
+		w := get(router, authReq, hmacKey)
+
+		require.Equal(t, http.StatusSeeOther, w.Code)
+		require.Contains(t, w.Header().Get("Location"), "/auth?")
+
+		updated, err := store.GetAuthRequest(ctx, authReq.ID)
+		require.NoError(t, err)
+		require.True(t, updated.MFAValidated, "MFA must be marked satisfied so the dispatcher does not loop back to /mfa")
+	})
+}
diff --git a/server/mfa/totp.go b/server/mfa/totp.go
new file mode 100644
index 0000000000..9b7fab48ad
--- /dev/null
+++ b/server/mfa/totp.go
@@ -0,0 +1,265 @@
+package mfa
+
+import (
+	"bytes"
+	"context"
+	"crypto/subtle"
+	"encoding/base64"
+	"errors"
+	"fmt"
+	"image/png"
+	"net/http"
+	"time"
+
+	"github.com/pquerna/otp"
+	"github.com/pquerna/otp/totp"
+
+	"github.com/dexidp/dex/storage"
+)
+
+const (
+	totpPeriod = 30 // seconds per TOTP time step
+	totpSkew   = 1  // number of steps tolerated on either side of the current one
+)
+
+var (
+	// errTOTPReplay signals the presented code's time-step was already used.
+	errTOTPReplay = errors.New("totp code already used")
+	// errTOTPNotEnrolled signals the secret disappeared between validation and update.
+	errTOTPNotEnrolled = errors.New("totp not enrolled")
+)
+
+// validateTOTPCode checks code against secret around now (tolerating totpSkew
+// steps) and returns the matched TOTP time-step counter. It returns ok=false
+// when the code does not match, or when the matched counter is <= lastCounter —
+// the latter enforces single use so a captured code cannot be replayed within
+// its validity window.
+func validateTOTPCode(secret, code string, now time.Time, lastCounter int64) (ok bool, counter int64) {
+	opts := totp.ValidateOpts{
+		Period:    totpPeriod,
+		Skew:      totpSkew,
+		Digits:    otp.DigitsSix,
+		Algorithm: otp.AlgorithmSHA1,
+	}
+
+	base := now.Unix() / totpPeriod
+	// Walk the skew window newest-first so the returned counter is the highest
+	// matching step.
+	for d := int64(totpSkew); d >= -int64(totpSkew); d-- {
+		c := base + d
+		if c < 0 {
+			continue
+		}
+		candidate, err := totp.GenerateCodeCustom(secret, time.Unix(c*totpPeriod, 0), opts)
+		if err != nil {
+			continue
+		}
+		if subtle.ConstantTimeCompare([]byte(candidate), []byte(code)) == 1 {
+			if c <= lastCounter {
+				return false, c
+			}
+			return true, c
+		}
+	}
+	return false, 0
+}
+
+// Provider is a pluggable multi-factor authentication method.
+type TOTPProvider struct {
+	issuer         string
+	connectorTypes map[string]struct{}
+}
+
+// NewTOTPProvider creates a new TOTP MFA provider.
+func NewTOTPProvider(issuer string, connectorTypes []string) *TOTPProvider {
+	m := make(map[string]struct{}, len(connectorTypes))
+	for _, t := range connectorTypes {
+		m[t] = struct{}{}
+	}
+	return &TOTPProvider{issuer: issuer, connectorTypes: m}
+}
+
+func (p *TOTPProvider) EnabledForConnectorType(connectorType string) bool {
+	if len(p.connectorTypes) == 0 {
+		return true
+	}
+	_, ok := p.connectorTypes[connectorType]
+	return ok
+}
+
+func (p *TOTPProvider) Type() string { return "TOTP" }
+
+func (p *TOTPProvider) generate(connID, email string) (*otp.Key, error) {
+	return totp.Generate(totp.GenerateOpts{
+		Issuer:      p.issuer,
+		AccountName: fmt.Sprintf("(%s) %s", connID, email),
+	})
+}
+
+// mfaRequestContext holds validated MFA request data shared across handlers.
+func (h *Handler) handleTOTP(w http.ResponseWriter, r *http.Request) {
+	mfa, ok := h.validateMFARequest(w, r)
+	if !ok {
+		return
+	}
+
+	provider, ok := h.MFAProviders[mfa.authenticatorID]
+	if !ok {
+		h.renderError(r, w, http.StatusBadRequest, "Unknown authenticator.")
+		return
+	}
+	totpProvider, ok := provider.(*TOTPProvider)
+	if !ok {
+		h.renderError(r, w, http.StatusBadRequest, "Not a TOTP authenticator.")
+		return
+	}
+
+	h.handleTOTPVerify(w, r, r.Context(), mfa.authReq, mfa.identity, mfa.authenticatorID, totpProvider)
+}
+
+func (h *Handler) handleTOTPVerify(w http.ResponseWriter, r *http.Request, ctx context.Context,
+	authReq storage.AuthRequest, identity storage.UserIdentity,
+	authenticatorID string, totpProvider *TOTPProvider,
+) {
+	secret := identity.MFASecrets[authenticatorID]
+
+	switch r.Method {
+	case http.MethodGet:
+		if secret == nil {
+			// First-time enrollment: generate a new TOTP key.
+			// TODO(nabokihms): clean up stale unconfirmed secrets. If a user starts
+			// enrollment multiple times without completing it, old secrets accumulate.
+			generated, err := totpProvider.generate(authReq.ConnectorID, authReq.Claims.Email)
+			if err != nil {
+				h.Logger.ErrorContext(ctx, "failed to generate TOTP key", "err", err)
+				h.renderError(r, w, http.StatusInternalServerError, "Internal server error.")
+				return
+			}
+
+			secret = &storage.MFASecret{
+				AuthenticatorID: authenticatorID,
+				Type:            "TOTP",
+				Secret:          generated.String(),
+				Confirmed:       false,
+				CreatedAt:       h.Now(),
+			}
+
+			if err := h.Storage.UpdateUserIdentity(ctx, authReq.Claims.UserID, authReq.ConnectorID, func(old storage.UserIdentity) (storage.UserIdentity, error) {
+				if old.MFASecrets == nil {
+					old.MFASecrets = make(map[string]*storage.MFASecret)
+				}
+				old.MFASecrets[authenticatorID] = secret
+				return old, nil
+			}); err != nil {
+				h.Logger.ErrorContext(ctx, "failed to store MFA secret", "err", err)
+				h.renderError(r, w, http.StatusInternalServerError, "Internal server error.")
+				return
+			}
+		}
+
+		h.renderTOTPPage(secret, false, totpProvider.issuer, authReq.ConnectorID, w, r)
+
+	case http.MethodPost:
+		// TODO(nabokihms): this endpoint should be protected with a rate limit (like the auth endpoint).
+		// TOTP has a limited keyspace (6 digits) with a 30-second validity window,
+		// making it particularly vulnerable to brute-force without rate limiting.
+		//
+		// For now the best way is to use external rate limiting solutions.
+		if secret == nil || secret.Secret == "" {
+			h.renderError(r, w, http.StatusBadRequest, "MFA not enrolled.")
+			return
+		}
+
+		code := r.FormValue("totp")
+		generated, err := otp.NewKeyFromURL(secret.Secret)
+		if err != nil {
+			h.Logger.ErrorContext(ctx, "failed to load TOTP key", "err", err)
+			h.renderError(r, w, http.StatusInternalServerError, "Internal server error.")
+			return
+		}
+
+		ok, counter := validateTOTPCode(generated.Secret(), code, h.Now(), secret.LastUsedCounter)
+		if !ok {
+			h.renderTOTPPage(secret, true, totpProvider.issuer, authReq.ConnectorID, w, r)
+			return
+		}
+
+		// Record the accepted time-step (single-use / replay protection) and
+		// confirm the secret on first successful use. The counter is re-checked
+		// against the latest stored value inside the updater so two concurrent
+		// requests with the same code cannot both succeed. This burn commits
+		// before CompleteStep marks the challenge passed, so a code can never
+		// pass the challenge without its counter being recorded first.
+		if err := h.Storage.UpdateUserIdentity(ctx, authReq.Claims.UserID, authReq.ConnectorID, func(old storage.UserIdentity) (storage.UserIdentity, error) {
+			sec := old.MFASecrets[authenticatorID]
+			if sec == nil {
+				return old, errTOTPNotEnrolled
+			}
+			if sec.LastUsedCounter >= counter {
+				return old, errTOTPReplay
+			}
+			sec.Confirmed = true
+			sec.LastUsedCounter = counter
+			return old, nil
+		}); err != nil {
+			if errors.Is(err, errTOTPReplay) || errors.Is(err, errTOTPNotEnrolled) {
+				h.renderTOTPPage(secret, true, totpProvider.issuer, authReq.ConnectorID, w, r)
+				return
+			}
+			h.Logger.ErrorContext(ctx, "failed to update MFA secret", "err", err)
+			h.renderError(r, w, http.StatusInternalServerError, "Internal server error.")
+			return
+		}
+
+		redirectURL, err := h.CompleteStep(ctx, authReq, authenticatorID)
+		if err != nil {
+			h.Logger.ErrorContext(ctx, "failed to complete MFA step", "err", err)
+			h.renderError(r, w, http.StatusInternalServerError, "Internal server error.")
+			return
+		}
+
+		// CompleteStep returns the next factor URL, or the consent URL once MFA is
+		// complete.
+		http.Redirect(w, r, redirectURL, http.StatusSeeOther)
+
+	default:
+		h.renderError(r, w, http.StatusBadRequest, "Unsupported request method.")
+	}
+}
+
+func (h *Handler) renderTOTPPage(secret *storage.MFASecret, lastFail bool, issuer, connectorID string, w http.ResponseWriter, r *http.Request) {
+	// Prevent browser from caching the TOTP page (contains QR code with secret).
+	w.Header().Set("Cache-Control", "no-store")
+	var qrCode string
+	if !secret.Confirmed {
+		var err error
+		qrCode, err = generateTOTPQRCode(secret.Secret)
+		if err != nil {
+			h.Logger.ErrorContext(r.Context(), "failed to generate QR code", "err", err)
+			h.renderError(r, w, http.StatusInternalServerError, "Internal server error.")
+			return
+		}
+	}
+	if err := h.Templates.TOTPVerify(r, w, r.URL.String(), issuer, connectorID, qrCode, lastFail); err != nil {
+		h.Logger.ErrorContext(r.Context(), "server template error", "err", err)
+	}
+}
+
+func generateTOTPQRCode(keyURL string) (string, error) {
+	generated, err := otp.NewKeyFromURL(keyURL)
+	if err != nil {
+		return "", fmt.Errorf("failed to load TOTP key: %w", err)
+	}
+
+	qrCodeImage, err := generated.Image(300, 300)
+	if err != nil {
+		return "", fmt.Errorf("failed to generate TOTP QR code: %w", err)
+	}
+
+	var buf bytes.Buffer
+	if err := png.Encode(&buf, qrCodeImage); err != nil {
+		return "", fmt.Errorf("failed to encode TOTP QR code: %w", err)
+	}
+
+	return base64.StdEncoding.EncodeToString(buf.Bytes()), nil
+}
diff --git a/server/mfa/totp_test.go b/server/mfa/totp_test.go
new file mode 100644
index 0000000000..4017619f04
--- /dev/null
+++ b/server/mfa/totp_test.go
@@ -0,0 +1,47 @@
+package mfa
+
+import (
+	"testing"
+	"time"
+
+	"github.com/pquerna/otp"
+	"github.com/pquerna/otp/totp"
+	"github.com/stretchr/testify/require"
+)
+
+func totpOpts() totp.ValidateOpts {
+	return totp.ValidateOpts{Period: totpPeriod, Skew: totpSkew, Digits: otp.DigitsSix, Algorithm: otp.AlgorithmSHA1}
+}
+
+// TestValidateTOTPCode covers replay protection: a code is single-use per
+// time-step, while a code from a later step is still accepted.
+func TestValidateTOTPCode(t *testing.T) {
+	key, err := totp.Generate(totp.GenerateOpts{Issuer: "dex", AccountName: "user@example.com"})
+	require.NoError(t, err)
+	secret := key.Secret()
+
+	now := time.Unix(1700000000, 0)
+	code, err := totp.GenerateCodeCustom(secret, now, totpOpts())
+	require.NoError(t, err)
+
+	// First use is accepted and reports the matched counter.
+	ok, counter := validateTOTPCode(secret, code, now, 0)
+	require.True(t, ok)
+	require.Equal(t, now.Unix()/totpPeriod, counter)
+
+	// Replaying the same code with that counter recorded is rejected.
+	ok, _ = validateTOTPCode(secret, code, now, counter)
+	require.False(t, ok, "replayed code must be rejected")
+
+	// A wrong code is rejected.
+	ok, _ = validateTOTPCode(secret, "000000", now, 0)
+	require.False(t, ok)
+
+	// A code from the next step is accepted and advances the counter.
+	next := now.Add(totpPeriod * time.Second)
+	nextCode, err := totp.GenerateCodeCustom(secret, next, totpOpts())
+	require.NoError(t, err)
+	ok, nextCounter := validateTOTPCode(secret, nextCode, next, counter)
+	require.True(t, ok)
+	require.Greater(t, nextCounter, counter)
+}
diff --git a/server/mfa/webauthn.go b/server/mfa/webauthn.go
new file mode 100644
index 0000000000..196f19108d
--- /dev/null
+++ b/server/mfa/webauthn.go
@@ -0,0 +1,423 @@
+package mfa
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"net/url"
+	"time"
+
+	gowebauthn "github.com/go-webauthn/webauthn/protocol"
+	"github.com/go-webauthn/webauthn/webauthn"
+
+	"github.com/dexidp/dex/storage"
+)
+
+// WebAuthnProvider implements WebAuthn-based multi-factor authentication.
+type WebAuthnProvider struct {
+	wan            *webauthn.WebAuthn
+	connectorTypes map[string]struct{}
+}
+
+// NewWebAuthnProvider creates a new WebAuthn MFA provider.
+// If rpID or rpOrigins are empty, they are derived from the issuerURL.
+func NewWebAuthnProvider(rpDisplayName, rpID string, rpOrigins []string,
+	attestationPreference, timeout, issuerURL string,
+	connectorTypes []string,
+) (*WebAuthnProvider, error) {
+	parsed, err := url.Parse(issuerURL)
+	if err != nil {
+		return nil, fmt.Errorf("parse issuer URL: %w", err)
+	}
+
+	if rpID == "" {
+		rpID = parsed.Hostname()
+	}
+	if len(rpOrigins) == 0 {
+		rpOrigins = []string{parsed.Scheme + "://" + parsed.Host}
+	}
+	if rpDisplayName == "" {
+		rpDisplayName = rpID
+	}
+
+	cfg := &webauthn.Config{
+		RPID:          rpID,
+		RPDisplayName: rpDisplayName,
+		RPOrigins:     rpOrigins,
+	}
+
+	switch attestationPreference {
+	case "none":
+		cfg.AttestationPreference = gowebauthn.PreferNoAttestation
+	case "direct":
+		cfg.AttestationPreference = gowebauthn.PreferDirectAttestation
+	case "", "indirect":
+		cfg.AttestationPreference = gowebauthn.PreferIndirectAttestation
+	}
+
+	if timeout != "" {
+		d, err := time.ParseDuration(timeout)
+		if err != nil {
+			return nil, fmt.Errorf("parse timeout: %w", err)
+		}
+		timeoutCfg := webauthn.TimeoutConfig{Enforce: true, Timeout: d}
+		cfg.Timeouts = webauthn.TimeoutsConfig{
+			Login:        timeoutCfg,
+			Registration: timeoutCfg,
+		}
+	}
+
+	wan, err := webauthn.New(cfg)
+	if err != nil {
+		return nil, fmt.Errorf("create webauthn: %w", err)
+	}
+
+	m := make(map[string]struct{}, len(connectorTypes))
+	for _, t := range connectorTypes {
+		m[t] = struct{}{}
+	}
+
+	return &WebAuthnProvider{wan: wan, connectorTypes: m}, nil
+}
+
+func (p *WebAuthnProvider) Type() string { return "WebAuthn" }
+
+func (p *WebAuthnProvider) EnabledForConnectorType(connectorType string) bool {
+	if len(p.connectorTypes) == 0 {
+		return true
+	}
+	_, ok := p.connectorTypes[connectorType]
+	return ok
+}
+
+// webauthnUser implements the webauthn.User interface.
+type webauthnUser struct {
+	id          []byte
+	name        string
+	displayName string
+	credentials []webauthn.Credential
+}
+
+func (u *webauthnUser) WebAuthnID() []byte                         { return u.id }
+func (u *webauthnUser) WebAuthnName() string                       { return u.name }
+func (u *webauthnUser) WebAuthnDisplayName() string                { return u.displayName }
+func (u *webauthnUser) WebAuthnCredentials() []webauthn.Credential { return u.credentials }
+
+// buildWebAuthnUser creates a webauthn.User from a UserIdentity, using credentials for the given authenticatorID.
+func buildWebAuthnUser(identity storage.UserIdentity, authenticatorID string) *webauthnUser {
+	stored := identity.WebAuthnCredentials[authenticatorID]
+	creds := make([]webauthn.Credential, 0, len(stored))
+	for _, c := range stored {
+		transports := make([]gowebauthn.AuthenticatorTransport, len(c.Transport))
+		for i, t := range c.Transport {
+			transports[i] = gowebauthn.AuthenticatorTransport(t)
+		}
+		creds = append(creds, webauthn.Credential{
+			ID:              c.CredentialID,
+			PublicKey:       c.PublicKey,
+			AttestationType: c.AttestationType,
+			Transport:       transports,
+			Flags: webauthn.CredentialFlags{
+				BackupEligible: c.BackupEligible,
+				BackupState:    c.BackupState,
+			},
+			Authenticator: webauthn.Authenticator{
+				AAGUID:    c.AAGUID,
+				SignCount: c.SignCount,
+				// CloneWarning is intentionally not loaded from storage. go-webauthn
+				// only ever sets it true and never clears it, so feeding a stored
+				// true value back would make FinishLogin report a clone on every
+				// future login and permanently lock out the credential. Starting
+				// fresh makes clone detection evaluate the current assertion only.
+			},
+		})
+	}
+
+	return &webauthnUser{
+		id:          []byte(identity.UserID + "|" + identity.ConnectorID),
+		name:        identity.Claims.Email,
+		displayName: identity.Claims.PreferredUsername,
+		credentials: creds,
+	}
+}
+
+// handleWebAuthnRegisterBegin starts the WebAuthn registration ceremony.
+func (h *Handler) handleWebAuthnRegisterBegin(w http.ResponseWriter, r *http.Request) {
+	mfa, provider, ok := h.validateWebAuthnAPIRequest(w, r)
+	if !ok {
+		return
+	}
+
+	ctx := r.Context()
+	user := buildWebAuthnUser(mfa.identity, mfa.authenticatorID)
+	user.credentials = nil // don't exclude existing credentials during registration
+
+	creation, session, err := provider.wan.BeginRegistration(user)
+	if err != nil {
+		h.Logger.ErrorContext(ctx, "failed to begin webauthn registration", "err", err)
+		writeJSONError(w, http.StatusInternalServerError, "Internal server error.")
+		return
+	}
+
+	if err := h.storeWebAuthnSession(ctx, mfa.authReq.ID, session); err != nil {
+		h.Logger.ErrorContext(ctx, "failed to store session data", "err", err)
+		writeJSONError(w, http.StatusInternalServerError, "Internal server error.")
+		return
+	}
+
+	writeJSON(w, creation)
+}
+
+// handleWebAuthnRegisterFinish completes the WebAuthn registration ceremony.
+func (h *Handler) handleWebAuthnRegisterFinish(w http.ResponseWriter, r *http.Request) {
+	mfa, provider, ok := h.validateWebAuthnAPIRequest(w, r)
+	if !ok {
+		return
+	}
+
+	ctx := r.Context()
+	session, err := h.loadWebAuthnSession(mfa.authReq)
+	if err != nil {
+		h.Logger.ErrorContext(ctx, "failed to load session data", "err", err)
+		writeJSONError(w, http.StatusBadRequest, "Invalid session.")
+		return
+	}
+
+	user := buildWebAuthnUser(mfa.identity, mfa.authenticatorID)
+	user.credentials = nil
+
+	credential, err := provider.wan.FinishRegistration(user, *session, r)
+	if err != nil {
+		h.Logger.ErrorContext(ctx, "webauthn registration failed", "err", err)
+		writeJSONError(w, http.StatusBadRequest, "Registration failed: "+err.Error())
+		return
+	}
+
+	newCred := convertCredential(credential, h.Now())
+	if err := h.Storage.UpdateUserIdentity(ctx, mfa.authReq.Claims.UserID, mfa.authReq.ConnectorID, func(old storage.UserIdentity) (storage.UserIdentity, error) {
+		if old.WebAuthnCredentials == nil {
+			old.WebAuthnCredentials = make(map[string][]storage.WebAuthnCredential)
+		}
+		old.WebAuthnCredentials[mfa.authenticatorID] = append(old.WebAuthnCredentials[mfa.authenticatorID], newCred)
+		return old, nil
+	}); err != nil {
+		h.Logger.ErrorContext(ctx, "failed to store credential", "err", err)
+		writeJSONError(w, http.StatusInternalServerError, "Internal server error.")
+		return
+	}
+
+	h.writeCompleteMFAStepResponse(w, r, mfa)
+}
+
+// handleWebAuthnLoginBegin starts the WebAuthn login ceremony.
+func (h *Handler) handleWebAuthnLoginBegin(w http.ResponseWriter, r *http.Request) {
+	mfa, provider, ok := h.validateWebAuthnAPIRequest(w, r)
+	if !ok {
+		return
+	}
+
+	ctx := r.Context()
+	user := buildWebAuthnUser(mfa.identity, mfa.authenticatorID)
+	if len(user.credentials) == 0 {
+		writeJSONError(w, http.StatusBadRequest, "No WebAuthn credentials registered.")
+		return
+	}
+
+	assertion, session, err := provider.wan.BeginLogin(user)
+	if err != nil {
+		h.Logger.ErrorContext(ctx, "failed to begin webauthn login", "err", err)
+		writeJSONError(w, http.StatusInternalServerError, "Internal server error.")
+		return
+	}
+
+	if err := h.storeWebAuthnSession(ctx, mfa.authReq.ID, session); err != nil {
+		h.Logger.ErrorContext(ctx, "failed to store session data", "err", err)
+		writeJSONError(w, http.StatusInternalServerError, "Internal server error.")
+		return
+	}
+
+	writeJSON(w, assertion)
+}
+
+// handleWebAuthnLoginFinish completes the WebAuthn login ceremony.
+//
+// TODO(nabokihms): this endpoint should be protected with a rate limit (like the auth endpoint).
+// Although WebAuthn is more resistant to brute-force than TOTP (challenges are random and
+// cryptographically signed), repeated attempts could still be used for denial-of-service.
+//
+// For now the best way is to use external rate limiting solutions.
+func (h *Handler) handleWebAuthnLoginFinish(w http.ResponseWriter, r *http.Request) {
+	mfa, provider, ok := h.validateWebAuthnAPIRequest(w, r)
+	if !ok {
+		return
+	}
+
+	ctx := r.Context()
+	session, err := h.loadWebAuthnSession(mfa.authReq)
+	if err != nil {
+		h.Logger.ErrorContext(ctx, "failed to load session data", "err", err)
+		writeJSONError(w, http.StatusBadRequest, "Invalid session.")
+		return
+	}
+
+	user := buildWebAuthnUser(mfa.identity, mfa.authenticatorID)
+	credential, err := provider.wan.FinishLogin(user, *session, r)
+	if err != nil {
+		h.Logger.ErrorContext(ctx, "webauthn login failed", "err", err)
+		writeJSONError(w, http.StatusUnauthorized, "Authentication failed.")
+		return
+	}
+
+	// Update sign count and clone warning for the matched credential. The
+	// CloneWarning flag is persisted even when we reject below so it is visible
+	// to admins (e.g. via ListMFADevices).
+	if err := h.Storage.UpdateUserIdentity(ctx, mfa.authReq.Claims.UserID, mfa.authReq.ConnectorID, func(old storage.UserIdentity) (storage.UserIdentity, error) {
+		creds := old.WebAuthnCredentials[mfa.authenticatorID]
+		for i := range creds {
+			if bytes.Equal(creds[i].CredentialID, credential.ID) {
+				creds[i].SignCount = credential.Authenticator.SignCount
+				creds[i].CloneWarning = credential.Authenticator.CloneWarning
+				break
+			}
+		}
+		old.WebAuthnCredentials[mfa.authenticatorID] = creds
+		return old, nil
+	}); err != nil {
+		h.Logger.ErrorContext(ctx, "failed to update credential", "err", err)
+		writeJSONError(w, http.StatusInternalServerError, "Internal server error.")
+		return
+	}
+
+	// go-webauthn sets CloneWarning when the presented signature counter did not
+	// advance past the stored value, which indicates a cloned authenticator (or a
+	// replayed assertion). Reject the assertion instead of completing the MFA step.
+	if credential.Authenticator.CloneWarning {
+		h.Logger.ErrorContext(ctx, "webauthn: signature counter regression, possible cloned authenticator — rejecting",
+			"user_id", mfa.authReq.Claims.UserID, "connector_id", mfa.authReq.ConnectorID, "authenticator_id", mfa.authenticatorID)
+		writeJSONError(w, http.StatusUnauthorized, "Authentication failed.")
+		return
+	}
+
+	h.writeCompleteMFAStepResponse(w, r, mfa)
+}
+
+// validateWebAuthnAPIRequest validates a WebAuthn JSON API request.
+// It reuses validateMFARequest for HMAC/auth checks, then asserts the provider type
+// and loads the user identity.
+func (h *Handler) validateWebAuthnAPIRequest(w http.ResponseWriter, r *http.Request) (*mfaRequestContext, *WebAuthnProvider, bool) {
+	if r.Method != http.MethodPost {
+		writeJSONError(w, http.StatusMethodNotAllowed, "Method not allowed.")
+		return nil, nil, false
+	}
+
+	mfa, ok := h.validateMFARequest(w, r)
+	if !ok {
+		return nil, nil, false
+	}
+
+	provider, ok := h.MFAProviders[mfa.authenticatorID]
+	if !ok {
+		writeJSONError(w, http.StatusBadRequest, "Unknown authenticator.")
+		return nil, nil, false
+	}
+	webauthnProvider, ok := provider.(*WebAuthnProvider)
+	if !ok {
+		writeJSONError(w, http.StatusBadRequest, "Not a WebAuthn authenticator.")
+		return nil, nil, false
+	}
+
+	return mfa, webauthnProvider, true
+}
+
+// storeWebAuthnSession marshals and stores WebAuthn session data in the auth request.
+func (h *Handler) storeWebAuthnSession(ctx context.Context, authReqID string, session *webauthn.SessionData) error {
+	data, err := json.Marshal(session)
+	if err != nil {
+		return fmt.Errorf("marshal session: %w", err)
+	}
+	return h.Storage.UpdateAuthRequest(ctx, authReqID, func(old storage.AuthRequest) (storage.AuthRequest, error) {
+		old.WebAuthnSessionData = data
+		return old, nil
+	})
+}
+
+// loadWebAuthnSession unmarshals WebAuthn session data from an auth request.
+func (h *Handler) loadWebAuthnSession(authReq storage.AuthRequest) (*webauthn.SessionData, error) {
+	var session webauthn.SessionData
+	if err := json.Unmarshal(authReq.WebAuthnSessionData, &session); err != nil {
+		return nil, fmt.Errorf("unmarshal session: %w", err)
+	}
+	return &session, nil
+}
+
+// writeCompleteMFAStepResponse completes the MFA step and writes a JSON redirect response.
+func (h *Handler) writeCompleteMFAStepResponse(w http.ResponseWriter, r *http.Request, mfa *mfaRequestContext) {
+	ctx := r.Context()
+	redirectURL, err := h.CompleteStep(ctx, mfa.authReq, mfa.authenticatorID)
+	if err != nil {
+		h.Logger.ErrorContext(ctx, "failed to complete MFA step", "err", err)
+		writeJSONError(w, http.StatusInternalServerError, "Internal server error.")
+		return
+	}
+	writeJSON(w, map[string]string{"status": "ok", "redirect": redirectURL})
+}
+
+// convertCredential converts a webauthn.Credential to a storage.WebAuthnCredential.
+func convertCredential(cred *webauthn.Credential, now time.Time) storage.WebAuthnCredential {
+	transports := make([]string, len(cred.Transport))
+	for i, t := range cred.Transport {
+		transports[i] = string(t)
+	}
+	return storage.WebAuthnCredential{
+		CredentialID:    cred.ID,
+		PublicKey:       cred.PublicKey,
+		AttestationType: cred.AttestationType,
+		AAGUID:          cred.Authenticator.AAGUID,
+		SignCount:       cred.Authenticator.SignCount,
+		CloneWarning:    cred.Authenticator.CloneWarning,
+		Transport:       transports,
+		BackupEligible:  cred.Flags.BackupEligible,
+		BackupState:     cred.Flags.BackupState,
+		DisplayName:     "Security Key",
+		CreatedAt:       now,
+	}
+}
+
+// Dex return JSON errors because of the dynamic nature of WebAuthn, they are received
+// by a JavaScript code and printed for users.
+func writeJSON(w http.ResponseWriter, v any) {
+	w.Header().Set("Content-Type", "application/json")
+	json.NewEncoder(w).Encode(v)
+}
+
+func writeJSONError(w http.ResponseWriter, status int, message string) {
+	w.Header().Set("Content-Type", "application/json")
+	w.WriteHeader(status)
+	json.NewEncoder(w).Encode(map[string]string{"error": message})
+}
+
+func (h *Handler) handleWebAuthn(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodGet {
+		h.renderError(r, w, http.StatusMethodNotAllowed, "Unsupported request method.")
+		return
+	}
+
+	mfa, ok := h.validateMFARequest(w, r)
+	if !ok {
+		return
+	}
+
+	w.Header().Set("Cache-Control", "no-store")
+
+	user := buildWebAuthnUser(mfa.identity, mfa.authenticatorID)
+	mode := "login"
+	if len(user.credentials) == 0 {
+		mode = "register"
+	}
+
+	if err := h.Templates.WebAuthnVerify(r, w, mode, mfa.authenticatorID); err != nil {
+		h.Logger.ErrorContext(r.Context(), "server template error", "err", err)
+	}
+}
diff --git a/server/mfa/webauthn_test.go b/server/mfa/webauthn_test.go
new file mode 100644
index 0000000000..ee6bf29e36
--- /dev/null
+++ b/server/mfa/webauthn_test.go
@@ -0,0 +1,218 @@
+package mfa
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/require"
+
+	"github.com/dexidp/dex/server/internal"
+	"github.com/dexidp/dex/storage"
+)
+
+func TestWebAuthnHandlersMissingHMAC(t *testing.T) {
+	provider, err := NewWebAuthnProvider("Test", "", nil, "", "", "http://127.0.0.1", nil)
+	require.NoError(t, err)
+
+	_, router, _ := newTestHandler(t, map[string]Provider{"webauthn-1": provider}, []string{"webauthn-1"})
+
+	endpoints := []string{
+		"/mfa/webauthn/register/begin",
+		"/mfa/webauthn/register/finish",
+		"/mfa/webauthn/login/begin",
+		"/mfa/webauthn/login/finish",
+	}
+
+	for _, ep := range endpoints {
+		t.Run(ep, func(t *testing.T) {
+			rr := httptest.NewRecorder()
+			router.ServeHTTP(rr, httptest.NewRequest(http.MethodPost, ep, nil))
+			// Should fail with unauthorized (no hmac).
+			require.Equal(t, http.StatusUnauthorized, rr.Code)
+		})
+	}
+}
+
+func TestWebAuthnVerifyPageRender(t *testing.T) {
+	provider, err := NewWebAuthnProvider("Test", "", nil, "", "", "http://127.0.0.1", nil)
+	require.NoError(t, err)
+
+	_, router, store := newTestHandler(t, map[string]Provider{"webauthn-1": provider}, []string{"webauthn-1"})
+
+	ctx := t.Context()
+	hmacKey := randomHMACKey(t)
+	authReq := storage.AuthRequest{
+		ID:          "test-webauthn-verify",
+		ClientID:    "example-app",
+		Expiry:      time.Now().Add(time.Hour),
+		HMACKey:     hmacKey,
+		LoggedIn:    true,
+		Claims:      storage.Claims{UserID: "user-1", Email: "user@example.com"},
+		ConnectorID: "mock",
+	}
+	require.NoError(t, store.CreateAuthRequest(ctx, authReq))
+
+	// Create user identity without WebAuthn credentials (enrollment mode).
+	require.NoError(t, store.CreateUserIdentity(ctx, storage.UserIdentity{
+		UserID:              "user-1",
+		ConnectorID:         "mock",
+		Claims:              authReq.Claims,
+		Consents:            map[string][]string{},
+		MFASecrets:          map[string]*storage.MFASecret{},
+		WebAuthnCredentials: map[string][]storage.WebAuthnCredential{},
+		CreatedAt:           time.Now(),
+		LastLogin:           time.Now(),
+	}))
+
+	hmacVal := internal.SignStep(authReq, internal.Authenticator("webauthn-1"))
+
+	rr := httptest.NewRecorder()
+	req := httptest.NewRequest(http.MethodGet,
+		"/mfa/webauthn?req="+authReq.ID+"&hmac="+hmacVal+"&authenticator=webauthn-1", nil)
+	router.ServeHTTP(rr, req)
+
+	require.Equal(t, http.StatusOK, rr.Code)
+	body := rr.Body.String()
+	require.Contains(t, body, "Register security key")
+	require.Contains(t, body, "startWebAuthn")
+}
+
+func TestBuildWebAuthnUserDropsCloneWarning(t *testing.T) {
+	identity := storage.UserIdentity{
+		UserID:      "user-1",
+		ConnectorID: "mock",
+		WebAuthnCredentials: map[string][]storage.WebAuthnCredential{
+			"webauthn-1": {{
+				CredentialID: []byte("cred"),
+				SignCount:    42,
+				CloneWarning: true,
+			}},
+		},
+	}
+
+	user := buildWebAuthnUser(identity, "webauthn-1")
+	creds := user.WebAuthnCredentials()
+	require.Len(t, creds, 1)
+	require.Equal(t, uint32(42), creds[0].Authenticator.SignCount, "sign count must be preserved")
+	require.False(t, creds[0].Authenticator.CloneWarning, "stored CloneWarning must not be loaded back")
+}
+
+// TestNewWebAuthnProvider verifies provider construction: the relying-party ID
+// and origin are derived from the issuer URL, and invalid configurations are
+// rejected.
+func TestNewWebAuthnProvider(t *testing.T) {
+	tests := []struct {
+		name        string
+		rpDisplay   string
+		rpID        string
+		rpOrigins   []string
+		timeout     string
+		issuerURL   string
+		wantErr     bool
+		errContains string
+	}{
+		{
+			name:      "derives rpID and origin from issuer",
+			rpDisplay: "Test App",
+			issuerURL: "https://auth.example.com/dex",
+		},
+		{
+			name:      "explicit rpID and origins",
+			rpDisplay: "Test App",
+			rpID:      "example.com",
+			rpOrigins: []string{"https://auth.example.com"},
+			issuerURL: "https://auth.example.com/dex",
+		},
+		{
+			name:      "defaults rpDisplayName from hostname",
+			issuerURL: "https://auth.example.com",
+		},
+		{
+			name:      "invalid timeout",
+			rpDisplay: "Test",
+			timeout:   "not-a-duration",
+			issuerURL: "https://auth.example.com",
+			wantErr:   true,
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			provider, err := NewWebAuthnProvider(
+				tc.rpDisplay, tc.rpID, tc.rpOrigins,
+				"", tc.timeout, tc.issuerURL,
+				nil,
+			)
+			if tc.wantErr {
+				require.Error(t, err)
+				return
+			}
+			require.NoError(t, err)
+			require.Equal(t, "WebAuthn", provider.Type())
+		})
+	}
+}
+
+func TestWebAuthnProviderConnectorTypeFiltering(t *testing.T) {
+	provider, err := NewWebAuthnProvider("Test", "", nil, "", "",
+		"https://example.com", []string{"ldap", "oidc"})
+	require.NoError(t, err)
+
+	require.True(t, provider.EnabledForConnectorType("ldap"))
+	require.True(t, provider.EnabledForConnectorType("oidc"))
+	require.False(t, provider.EnabledForConnectorType("saml"))
+
+	// No filter — all types allowed.
+	providerAll, err := NewWebAuthnProvider("Test", "", nil, "", "",
+		"https://example.com", nil)
+	require.NoError(t, err)
+	require.True(t, providerAll.EnabledForConnectorType("anything"))
+}
+
+func TestBuildWebAuthnUser(t *testing.T) {
+	identity := storage.UserIdentity{
+		UserID:      "user-123",
+		ConnectorID: "conn-1",
+		Claims: storage.Claims{
+			Email:             "user@example.com",
+			PreferredUsername: "User Name",
+		},
+		WebAuthnCredentials: map[string][]storage.WebAuthnCredential{
+			"webauthn-1": {
+				{
+					CredentialID:    []byte("cred-1"),
+					PublicKey:       []byte("pk-1"),
+					AttestationType: "none",
+					AAGUID:          []byte("aaguid-1"),
+					SignCount:       5,
+					Transport:       []string{"usb"},
+				},
+			},
+			"webauthn-2": {
+				{
+					CredentialID: []byte("cred-2"),
+					PublicKey:    []byte("pk-2"),
+				},
+			},
+		},
+	}
+
+	user := buildWebAuthnUser(identity, "webauthn-1")
+	require.Equal(t, []byte("user-123|conn-1"), user.WebAuthnID())
+	require.Equal(t, "user@example.com", user.WebAuthnName())
+	require.Equal(t, "User Name", user.WebAuthnDisplayName())
+	require.Len(t, user.WebAuthnCredentials(), 1)
+	require.Equal(t, []byte("cred-1"), user.WebAuthnCredentials()[0].ID)
+	require.Equal(t, uint32(5), user.WebAuthnCredentials()[0].Authenticator.SignCount)
+
+	// Different authenticator — should get the other credential.
+	user2 := buildWebAuthnUser(identity, "webauthn-2")
+	require.Len(t, user2.WebAuthnCredentials(), 1)
+	require.Equal(t, []byte("cred-2"), user2.WebAuthnCredentials()[0].ID)
+
+	// Unknown authenticator — no credentials.
+	user3 := buildWebAuthnUser(identity, "unknown")
+	require.Empty(t, user3.WebAuthnCredentials())
+}
diff --git a/server/oauth2.go b/server/oauth2.go
deleted file mode 100644
index 998bf02ae5..0000000000
--- a/server/oauth2.go
+++ /dev/null
@@ -1,687 +0,0 @@
-package server
-
-import (
-	"context"
-	"crypto/ecdsa"
-	"crypto/elliptic"
-	"crypto/rsa"
-	"crypto/sha256"
-	"crypto/sha512"
-	"encoding/base64"
-	"encoding/json"
-	"errors"
-	"fmt"
-	"hash"
-	"io"
-	"net"
-	"net/http"
-	"net/url"
-	"strconv"
-	"strings"
-	"time"
-
-	jose "gopkg.in/square/go-jose.v2"
-
-	"github.com/dexidp/dex/connector"
-	"github.com/dexidp/dex/server/internal"
-	"github.com/dexidp/dex/storage"
-)
-
-// TODO(ericchiang): clean this file up and figure out more idiomatic error handling.
-
-// See: https://tools.ietf.org/html/rfc6749#section-4.1.2.1
-
-// displayedAuthErr is an error that should be displayed to the user as a web page
-type displayedAuthErr struct {
-	Status      int
-	Description string
-}
-
-func (err *displayedAuthErr) Error() string {
-	return err.Description
-}
-
-func newDisplayedErr(status int, format string, a ...interface{}) *displayedAuthErr {
-	return &displayedAuthErr{status, fmt.Sprintf(format, a...)}
-}
-
-// redirectedAuthErr is an error that should be reported back to the client by 302 redirect
-type redirectedAuthErr struct {
-	State       string
-	RedirectURI string
-	Type        string
-	Description string
-}
-
-func (err *redirectedAuthErr) Error() string {
-	return err.Description
-}
-
-func (err *redirectedAuthErr) Handler() http.Handler {
-	hf := func(w http.ResponseWriter, r *http.Request) {
-		v := url.Values{}
-		v.Add("state", err.State)
-		v.Add("error", err.Type)
-		if err.Description != "" {
-			v.Add("error_description", err.Description)
-		}
-		var redirectURI string
-		if strings.Contains(err.RedirectURI, "?") {
-			redirectURI = err.RedirectURI + "&" + v.Encode()
-		} else {
-			redirectURI = err.RedirectURI + "?" + v.Encode()
-		}
-		http.Redirect(w, r, redirectURI, http.StatusSeeOther)
-	}
-	return http.HandlerFunc(hf)
-}
-
-func tokenErr(w http.ResponseWriter, typ, description string, statusCode int) error {
-	data := struct {
-		Error       string `json:"error"`
-		Description string `json:"error_description,omitempty"`
-	}{typ, description}
-	body, err := json.Marshal(data)
-	if err != nil {
-		return fmt.Errorf("failed to marshal token error response: %v", err)
-	}
-	w.Header().Set("Content-Type", "application/json")
-	w.Header().Set("Content-Length", strconv.Itoa(len(body)))
-	w.WriteHeader(statusCode)
-	w.Write(body)
-	return nil
-}
-
-// nolint
-const (
-	errInvalidRequest          = "invalid_request"
-	errUnauthorizedClient      = "unauthorized_client"
-	errAccessDenied            = "access_denied"
-	errUnsupportedResponseType = "unsupported_response_type"
-	errRequestNotSupported     = "request_not_supported"
-	errInvalidScope            = "invalid_scope"
-	errServerError             = "server_error"
-	errTemporarilyUnavailable  = "temporarily_unavailable"
-	errUnsupportedGrantType    = "unsupported_grant_type"
-	errInvalidGrant            = "invalid_grant"
-	errInvalidClient           = "invalid_client"
-)
-
-const (
-	scopeOfflineAccess     = "offline_access" // Request a refresh token.
-	scopeOpenID            = "openid"
-	scopeGroups            = "groups"
-	scopeEmail             = "email"
-	scopeProfile           = "profile"
-	scopeFederatedID       = "federated:id"
-	scopeCrossClientPrefix = "audience:server:client_id:"
-)
-
-const (
-	deviceCallbackURI = "/device/callback"
-)
-
-const (
-	redirectURIOOB = "urn:ietf:wg:oauth:2.0:oob"
-)
-
-const (
-	grantTypeAuthorizationCode = "authorization_code"
-	grantTypeRefreshToken      = "refresh_token"
-	grantTypeImplicit          = "implicit"
-	grantTypePassword          = "password"
-	grantTypeDeviceCode        = "urn:ietf:params:oauth:grant-type:device_code"
-)
-
-const (
-	responseTypeCode    = "code"     // "Regular" flow
-	responseTypeToken   = "token"    // Implicit flow for frontend apps.
-	responseTypeIDToken = "id_token" // ID Token in url fragment
-)
-
-const (
-	deviceTokenPending  = "authorization_pending"
-	deviceTokenComplete = "complete"
-	deviceTokenSlowDown = "slow_down"
-	deviceTokenExpired  = "expired_token"
-)
-
-func parseScopes(scopes []string) connector.Scopes {
-	var s connector.Scopes
-	for _, scope := range scopes {
-		switch scope {
-		case scopeOfflineAccess:
-			s.OfflineAccess = true
-		case scopeGroups:
-			s.Groups = true
-		}
-	}
-	return s
-}
-
-// Determine the signature algorithm for a JWT.
-func signatureAlgorithm(jwk *jose.JSONWebKey) (alg jose.SignatureAlgorithm, err error) {
-	if jwk.Key == nil {
-		return alg, errors.New("no signing key")
-	}
-	switch key := jwk.Key.(type) {
-	case *rsa.PrivateKey:
-		// Because OIDC mandates that we support RS256, we always return that
-		// value. In the future, we might want to make this configurable on a
-		// per client basis. For example allowing PS256 or ECDSA variants.
-		//
-		// See https://github.com/dexidp/dex/issues/692
-		return jose.RS256, nil
-	case *ecdsa.PrivateKey:
-		// We don't actually support ECDSA keys yet, but they're tested for
-		// in case we want to in the future.
-		//
-		// These values are prescribed depending on the ECDSA key type. We
-		// can't return different values.
-		switch key.Params() {
-		case elliptic.P256().Params():
-			return jose.ES256, nil
-		case elliptic.P384().Params():
-			return jose.ES384, nil
-		case elliptic.P521().Params():
-			return jose.ES512, nil
-		default:
-			return alg, errors.New("unsupported ecdsa curve")
-		}
-	default:
-		return alg, fmt.Errorf("unsupported signing key type %T", key)
-	}
-}
-
-func signPayload(key *jose.JSONWebKey, alg jose.SignatureAlgorithm, payload []byte) (jws string, err error) {
-	signingKey := jose.SigningKey{Key: key, Algorithm: alg}
-
-	signer, err := jose.NewSigner(signingKey, &jose.SignerOptions{})
-	if err != nil {
-		return "", fmt.Errorf("new signer: %v", err)
-	}
-	signature, err := signer.Sign(payload)
-	if err != nil {
-		return "", fmt.Errorf("signing payload: %v", err)
-	}
-	return signature.CompactSerialize()
-}
-
-// The hash algorithm for the at_hash is determined by the signing
-// algorithm used for the id_token. From the spec:
-//
-//    ...the hash algorithm used is the hash algorithm used in the alg Header
-//    Parameter of the ID Token's JOSE Header. For instance, if the alg is RS256,
-//    hash the access_token value with SHA-256
-//
-// https://openid.net/specs/openid-connect-core-1_0.html#ImplicitIDToken
-var hashForSigAlg = map[jose.SignatureAlgorithm]func() hash.Hash{
-	jose.RS256: sha256.New,
-	jose.RS384: sha512.New384,
-	jose.RS512: sha512.New,
-	jose.ES256: sha256.New,
-	jose.ES384: sha512.New384,
-	jose.ES512: sha512.New,
-}
-
-// Compute an at_hash from a raw access token and a signature algorithm
-//
-// See: https://openid.net/specs/openid-connect-core-1_0.html#ImplicitIDToken
-func accessTokenHash(alg jose.SignatureAlgorithm, accessToken string) (string, error) {
-	newHash, ok := hashForSigAlg[alg]
-	if !ok {
-		return "", fmt.Errorf("unsupported signature algorithm: %s", alg)
-	}
-
-	hashFunc := newHash()
-	if _, err := io.WriteString(hashFunc, accessToken); err != nil {
-		return "", fmt.Errorf("computing hash: %v", err)
-	}
-	sum := hashFunc.Sum(nil)
-	return base64.RawURLEncoding.EncodeToString(sum[:len(sum)/2]), nil
-}
-
-type audience []string
-
-func (a audience) contains(aud string) bool {
-	for _, e := range a {
-		if aud == e {
-			return true
-		}
-	}
-	return false
-}
-
-func (a audience) MarshalJSON() ([]byte, error) {
-	if len(a) == 1 {
-		return json.Marshal(a[0])
-	}
-	return json.Marshal([]string(a))
-}
-
-type idTokenClaims struct {
-	Issuer           string   `json:"iss"`
-	Subject          string   `json:"sub"`
-	Audience         audience `json:"aud"`
-	Expiry           int64    `json:"exp"`
-	IssuedAt         int64    `json:"iat"`
-	AuthorizingParty string   `json:"azp,omitempty"`
-	Nonce            string   `json:"nonce,omitempty"`
-
-	AccessTokenHash string `json:"at_hash,omitempty"`
-	CodeHash        string `json:"c_hash,omitempty"`
-
-	Email         string `json:"email,omitempty"`
-	EmailVerified *bool  `json:"email_verified,omitempty"`
-
-	Groups []string `json:"groups,omitempty"`
-
-	Name              string `json:"name,omitempty"`
-	PreferredUsername string `json:"preferred_username,omitempty"`
-
-	FederatedIDClaims *federatedIDClaims `json:"federated_claims,omitempty"`
-}
-
-type federatedIDClaims struct {
-	ConnectorID string `json:"connector_id,omitempty"`
-	UserID      string `json:"user_id,omitempty"`
-}
-
-func (s *Server) newAccessToken(clientID string, claims storage.Claims, scopes []string, nonce, connID string) (accessToken string, err error) {
-	idToken, _, err := s.newIDToken(clientID, claims, scopes, nonce, storage.NewID(), "", connID)
-	return idToken, err
-}
-
-func (s *Server) newIDToken(clientID string, claims storage.Claims, scopes []string, nonce, accessToken, code, connID string) (idToken string, expiry time.Time, err error) {
-	keys, err := s.storage.GetKeys()
-	if err != nil {
-		s.logger.Errorf("Failed to get keys: %v", err)
-		return "", expiry, err
-	}
-
-	signingKey := keys.SigningKey
-	if signingKey == nil {
-		return "", expiry, fmt.Errorf("no key to sign payload with")
-	}
-	signingAlg, err := signatureAlgorithm(signingKey)
-	if err != nil {
-		return "", expiry, err
-	}
-
-	issuedAt := s.now()
-	expiry = issuedAt.Add(s.idTokensValidFor)
-
-	sub := &internal.IDTokenSubject{
-		UserId: claims.UserID,
-		ConnId: connID,
-	}
-
-	subjectString, err := internal.Marshal(sub)
-	if err != nil {
-		s.logger.Errorf("failed to marshal offline session ID: %v", err)
-		return "", expiry, fmt.Errorf("failed to marshal offline session ID: %v", err)
-	}
-
-	tok := idTokenClaims{
-		Issuer:   s.issuerURL.String(),
-		Subject:  subjectString,
-		Nonce:    nonce,
-		Expiry:   expiry.Unix(),
-		IssuedAt: issuedAt.Unix(),
-	}
-
-	if accessToken != "" {
-		atHash, err := accessTokenHash(signingAlg, accessToken)
-		if err != nil {
-			s.logger.Errorf("error computing at_hash: %v", err)
-			return "", expiry, fmt.Errorf("error computing at_hash: %v", err)
-		}
-		tok.AccessTokenHash = atHash
-	}
-
-	if code != "" {
-		cHash, err := accessTokenHash(signingAlg, code)
-		if err != nil {
-			s.logger.Errorf("error computing c_hash: %v", err)
-			return "", expiry, fmt.Errorf("error computing c_hash: #{err}")
-		}
-		tok.CodeHash = cHash
-	}
-
-	for _, scope := range scopes {
-		switch {
-		case scope == scopeEmail:
-			tok.Email = claims.Email
-			tok.EmailVerified = &claims.EmailVerified
-		case scope == scopeGroups:
-			tok.Groups = claims.Groups
-		case scope == scopeProfile:
-			tok.Name = claims.Username
-			tok.PreferredUsername = claims.PreferredUsername
-		case scope == scopeFederatedID:
-			tok.FederatedIDClaims = &federatedIDClaims{
-				ConnectorID: connID,
-				UserID:      claims.UserID,
-			}
-		default:
-			peerID, ok := parseCrossClientScope(scope)
-			if !ok {
-				// Ignore unknown scopes. These are already validated during the
-				// initial auth request.
-				continue
-			}
-			isTrusted, err := s.validateCrossClientTrust(clientID, peerID)
-			if err != nil {
-				return "", expiry, err
-			}
-			if !isTrusted {
-				// TODO(ericchiang): propagate this error to the client.
-				return "", expiry, fmt.Errorf("peer (%s) does not trust client", peerID)
-			}
-			tok.Audience = append(tok.Audience, peerID)
-		}
-	}
-
-	if len(tok.Audience) == 0 {
-		// Client didn't ask for cross client audience. Set the current
-		// client as the audience.
-		tok.Audience = audience{clientID}
-	} else {
-		// Client asked for cross client audience:
-		// if the current client was not requested explicitly
-		if !tok.Audience.contains(clientID) {
-			// by default it becomes one of entries in Audience
-			tok.Audience = append(tok.Audience, clientID)
-		}
-		// The current client becomes the authorizing party.
-		tok.AuthorizingParty = clientID
-	}
-
-	payload, err := json.Marshal(tok)
-	if err != nil {
-		return "", expiry, fmt.Errorf("could not serialize claims: %v", err)
-	}
-
-	if idToken, err = signPayload(signingKey, signingAlg, payload); err != nil {
-		return "", expiry, fmt.Errorf("failed to sign payload: %v", err)
-	}
-	return idToken, expiry, nil
-}
-
-// parse the initial request from the OAuth2 client.
-func (s *Server) parseAuthorizationRequest(r *http.Request) (*storage.AuthRequest, error) {
-	if err := r.ParseForm(); err != nil {
-		return nil, newDisplayedErr(http.StatusBadRequest, "Failed to parse request.")
-	}
-	q := r.Form
-	redirectURI, err := url.QueryUnescape(q.Get("redirect_uri"))
-	if err != nil {
-		return nil, newDisplayedErr(http.StatusBadRequest, "No redirect_uri provided.")
-	}
-
-	clientID := q.Get("client_id")
-	state := q.Get("state")
-	nonce := q.Get("nonce")
-	connectorID := q.Get("connector_id")
-	// Some clients, like the old go-oidc, provide extra whitespace. Tolerate this.
-	scopes := strings.Fields(q.Get("scope"))
-	responseTypes := strings.Fields(q.Get("response_type"))
-
-	codeChallenge := q.Get("code_challenge")
-	codeChallengeMethod := q.Get("code_challenge_method")
-
-	if codeChallengeMethod == "" {
-		codeChallengeMethod = codeChallengeMethodPlain
-	}
-
-	client, err := s.storage.GetClient(clientID)
-	if err != nil {
-		if err == storage.ErrNotFound {
-			return nil, newDisplayedErr(http.StatusNotFound, "Invalid client_id (%q).", clientID)
-		}
-		s.logger.Errorf("Failed to get client: %v", err)
-		return nil, newDisplayedErr(http.StatusInternalServerError, "Database error.")
-	}
-
-	if !validateRedirectURI(client, redirectURI) {
-		return nil, newDisplayedErr(http.StatusBadRequest, "Unregistered redirect_uri (%q).", redirectURI)
-	}
-	if redirectURI == deviceCallbackURI && client.Public {
-		redirectURI = s.issuerURL.Path + deviceCallbackURI
-	}
-
-	// From here on out, we want to redirect back to the client with an error.
-	newRedirectedErr := func(typ, format string, a ...interface{}) *redirectedAuthErr {
-		return &redirectedAuthErr{state, redirectURI, typ, fmt.Sprintf(format, a...)}
-	}
-
-	if connectorID != "" {
-		connectors, err := s.storage.ListConnectors()
-		if err != nil {
-			s.logger.Errorf("Failed to list connectors: %v", err)
-			return nil, newRedirectedErr(errServerError, "Unable to retrieve connectors")
-		}
-		if !validateConnectorID(connectors, connectorID) {
-			return nil, newRedirectedErr(errInvalidRequest, "Invalid ConnectorID")
-		}
-	}
-
-	// dex doesn't support request parameter and must return request_not_supported error
-	// https://openid.net/specs/openid-connect-core-1_0.html#6.1
-	if q.Get("request") != "" {
-		return nil, newRedirectedErr(errRequestNotSupported, "Server does not support request parameter.")
-	}
-
-	if codeChallengeMethod != codeChallengeMethodS256 && codeChallengeMethod != codeChallengeMethodPlain {
-		description := fmt.Sprintf("Unsupported PKCE challenge method (%q).", codeChallengeMethod)
-		return nil, newRedirectedErr(errInvalidRequest, description)
-	}
-
-	var (
-		unrecognized  []string
-		invalidScopes []string
-	)
-	hasOpenIDScope := false
-	for _, scope := range scopes {
-		switch scope {
-		case scopeOpenID:
-			hasOpenIDScope = true
-		case scopeOfflineAccess, scopeEmail, scopeProfile, scopeGroups, scopeFederatedID:
-		default:
-			peerID, ok := parseCrossClientScope(scope)
-			if !ok {
-				unrecognized = append(unrecognized, scope)
-				continue
-			}
-
-			isTrusted, err := s.validateCrossClientTrust(clientID, peerID)
-			if err != nil {
-				return nil, newRedirectedErr(errServerError, "Internal server error.")
-			}
-			if !isTrusted {
-				invalidScopes = append(invalidScopes, scope)
-			}
-		}
-	}
-	if !hasOpenIDScope {
-		return nil, newRedirectedErr(errInvalidScope, `Missing required scope(s) ["openid"].`)
-	}
-	if len(unrecognized) > 0 {
-		return nil, newRedirectedErr(errInvalidScope, "Unrecognized scope(s) %q", unrecognized)
-	}
-	if len(invalidScopes) > 0 {
-		return nil, newRedirectedErr(errInvalidScope, "Client can't request scope(s) %q", invalidScopes)
-	}
-
-	var rt struct {
-		code    bool
-		idToken bool
-		token   bool
-	}
-
-	for _, responseType := range responseTypes {
-		switch responseType {
-		case responseTypeCode:
-			rt.code = true
-		case responseTypeIDToken:
-			rt.idToken = true
-		case responseTypeToken:
-			rt.token = true
-		default:
-			return nil, newRedirectedErr(errInvalidRequest, "Invalid response type %q", responseType)
-		}
-
-		if !s.supportedResponseTypes[responseType] {
-			return nil, newRedirectedErr(errUnsupportedResponseType, "Unsupported response type %q", responseType)
-		}
-	}
-
-	if len(responseTypes) == 0 {
-		return nil, newRedirectedErr(errInvalidRequest, "No response_type provided")
-	}
-
-	if rt.token && !rt.code && !rt.idToken {
-		// "token" can't be provided by its own.
-		//
-		// https://openid.net/specs/openid-connect-core-1_0.html#Authentication
-		return nil, newRedirectedErr(errInvalidRequest, "Response type 'token' must be provided with type 'id_token' and/or 'code'")
-	}
-	if !rt.code {
-		// Either "id_token token" or "id_token" has been provided which implies the
-		// implicit flow. Implicit flow requires a nonce value.
-		//
-		// https://openid.net/specs/openid-connect-core-1_0.html#ImplicitAuthRequest
-		if nonce == "" {
-			return nil, newRedirectedErr(errInvalidRequest, "Response type 'token' requires a 'nonce' value.")
-		}
-	}
-	if rt.token {
-		if redirectURI == redirectURIOOB {
-			err := fmt.Sprintf("Cannot use response type 'token' with redirect_uri '%s'.", redirectURIOOB)
-			return nil, newRedirectedErr(errInvalidRequest, err)
-		}
-	}
-
-	return &storage.AuthRequest{
-		ID:                  storage.NewID(),
-		ClientID:            client.ID,
-		State:               state,
-		Nonce:               nonce,
-		ForceApprovalPrompt: q.Get("approval_prompt") == "force",
-		Scopes:              scopes,
-		RedirectURI:         redirectURI,
-		ResponseTypes:       responseTypes,
-		ConnectorID:         connectorID,
-		PKCE: storage.PKCE{
-			CodeChallenge:       codeChallenge,
-			CodeChallengeMethod: codeChallengeMethod,
-		},
-	}, nil
-}
-
-func parseCrossClientScope(scope string) (peerID string, ok bool) {
-	if ok = strings.HasPrefix(scope, scopeCrossClientPrefix); ok {
-		peerID = scope[len(scopeCrossClientPrefix):]
-	}
-	return
-}
-
-func (s *Server) validateCrossClientTrust(clientID, peerID string) (trusted bool, err error) {
-	if peerID == clientID {
-		return true, nil
-	}
-	peer, err := s.storage.GetClient(peerID)
-	if err != nil {
-		if err != storage.ErrNotFound {
-			s.logger.Errorf("Failed to get client: %v", err)
-			return false, err
-		}
-		return false, nil
-	}
-	for _, id := range peer.TrustedPeers {
-		if id == clientID {
-			return true, nil
-		}
-	}
-	return false, nil
-}
-
-func validateRedirectURI(client storage.Client, redirectURI string) bool {
-	// Allow named RedirectURIs for both public and non-public clients.
-	// This is required make PKCE-enabled web apps work, when configured as public clients.
-	for _, uri := range client.RedirectURIs {
-		if redirectURI == uri {
-			return true
-		}
-	}
-	// For non-public clients or when RedirectURIs is set, we allow only explicitly named RedirectURIs.
-	// Otherwise, we check below for special URIs used for desktop or mobile apps.
-	if !client.Public || len(client.RedirectURIs) > 0 {
-		return false
-	}
-
-	if redirectURI == redirectURIOOB || redirectURI == deviceCallbackURI {
-		return true
-	}
-
-	// verify that the host is of form "http://localhost:(port)(path)" or "http://localhost(path)"
-	u, err := url.Parse(redirectURI)
-	if err != nil {
-		return false
-	}
-	if u.Scheme != "http" {
-		return false
-	}
-	if u.Host == "localhost" {
-		return true
-	}
-	host, _, err := net.SplitHostPort(u.Host)
-	return err == nil && host == "localhost"
-}
-
-func validateConnectorID(connectors []storage.Connector, connectorID string) bool {
-	for _, c := range connectors {
-		if c.ID == connectorID {
-			return true
-		}
-	}
-	return false
-}
-
-// storageKeySet implements the oidc.KeySet interface backed by Dex storage
-type storageKeySet struct {
-	storage.Storage
-}
-
-func (s *storageKeySet) VerifySignature(_ context.Context, jwt string) (payload []byte, err error) {
-	jws, err := jose.ParseSigned(jwt)
-	if err != nil {
-		return nil, err
-	}
-
-	keyID := ""
-	for _, sig := range jws.Signatures {
-		keyID = sig.Header.KeyID
-		break
-	}
-
-	skeys, err := s.Storage.GetKeys()
-	if err != nil {
-		return nil, err
-	}
-
-	keys := []*jose.JSONWebKey{skeys.SigningKeyPub}
-	for _, vk := range skeys.VerificationKeys {
-		keys = append(keys, vk.PublicKey)
-	}
-
-	for _, key := range keys {
-		if keyID == "" || key.KeyID == keyID {
-			if payload, err := jws.Verify(key); err == nil {
-				return payload, nil
-			}
-		}
-	}
-
-	return nil, errors.New("failed to verify id token signature")
-}
diff --git a/server/oauth2/doc.go b/server/oauth2/doc.go
new file mode 100644
index 0000000000..97e70f3918
--- /dev/null
+++ b/server/oauth2/doc.go
@@ -0,0 +1,7 @@
+// Package oauth2 holds the OAuth2/OIDC protocol vocabulary shared across the
+// server: the error codes returned in error responses, grant types, response
+// types, token-exchange token types, device-flow poll statuses, PKCE methods,
+// and the special redirect URIs, plus the OAuth2 error-response writer. Keeping
+// them in one place lets the per-domain handler packages reference the protocol
+// without depending on the server package.
+package oauth2
diff --git a/server/oauth2/error.go b/server/oauth2/error.go
new file mode 100644
index 0000000000..346dd2a4a4
--- /dev/null
+++ b/server/oauth2/error.go
@@ -0,0 +1,57 @@
+package oauth2
+
+import (
+	"encoding/json"
+	"fmt"
+	"log/slog"
+	"net/http"
+	"strconv"
+)
+
+// Error is an OAuth2 error response a token grant can return instead of writing
+// it: the token endpoint turns it into the JSON error body. It lets a grant
+// handler report failures as values rather than writing to the ResponseWriter.
+type Error struct {
+	Type        string
+	Description string
+	Status      int
+}
+
+func (e *Error) Error() string {
+	if e.Description == "" {
+		return e.Type
+	}
+	return e.Type + ": " + e.Description
+}
+
+// Errorf builds an *Error with a formatted description.
+func Errorf(typ string, status int, format string, args ...any) *Error {
+	return &Error{Type: typ, Description: fmt.Sprintf(format, args...), Status: status}
+}
+
+// WriteErrorResponse writes an OAuth2 error response, reporting a failure to
+// write it to the logger. Endpoints that answer in JSON call this rather than
+// each deciding how to handle a write failure.
+func WriteErrorResponse(logger *slog.Logger, w http.ResponseWriter, typ, description string, statusCode int) {
+	if err := WriteError(w, typ, description, statusCode); err != nil {
+		logger.Error("failed to write oauth2 error response", "err", err)
+	}
+}
+
+// WriteError writes an OAuth2 error response: a JSON body with the error code
+// and an optional description, at the given HTTP status.
+func WriteError(w http.ResponseWriter, typ, description string, statusCode int) error {
+	data := struct {
+		Error       string `json:"error"`
+		Description string `json:"error_description,omitempty"`
+	}{typ, description}
+	body, err := json.Marshal(data)
+	if err != nil {
+		return fmt.Errorf("failed to marshal token error response: %v", err)
+	}
+	w.Header().Set("Content-Type", "application/json")
+	w.Header().Set("Content-Length", strconv.Itoa(len(body)))
+	w.WriteHeader(statusCode)
+	w.Write(body)
+	return nil
+}
diff --git a/server/oauth2/issuer.go b/server/oauth2/issuer.go
new file mode 100644
index 0000000000..704fd0721d
--- /dev/null
+++ b/server/oauth2/issuer.go
@@ -0,0 +1,29 @@
+package oauth2
+
+import (
+	"net/url"
+	"path"
+)
+
+// IssuerURL is the dex issuer URL together with the helpers for building paths
+// and absolute URLs under its path. Handlers hold this instead of a bare
+// url.URL so the "join onto the issuer path" logic lives in one place rather
+// than being reimplemented per handler. The embedded url.URL keeps String,
+// JoinPath, Query, and the fields available directly.
+type IssuerURL struct {
+	url.URL
+}
+
+// AbsPath joins the given items onto the issuer path, e.g. issuer path "/dex"
+// plus "auth" gives "/dex/auth".
+func (i IssuerURL) AbsPath(items ...string) string {
+	return path.Join(append([]string{i.Path}, items...)...)
+}
+
+// AbsURL returns the absolute issuer URL with the given items joined onto its
+// path.
+func (i IssuerURL) AbsURL(items ...string) string {
+	u := i.URL
+	u.Path = i.AbsPath(items...)
+	return u.String()
+}
diff --git a/server/oauth2/oauth2.go b/server/oauth2/oauth2.go
new file mode 100644
index 0000000000..24f4b08874
--- /dev/null
+++ b/server/oauth2/oauth2.go
@@ -0,0 +1,75 @@
+package oauth2
+
+// Error codes returned in OAuth2/OIDC error responses (RFC 6749 §5.2, the OIDC
+// Core spec, and RFC 7662 for token introspection).
+const (
+	InvalidRequest          = "invalid_request"
+	UnauthorizedClient      = "unauthorized_client"
+	AccessDenied            = "access_denied"
+	UnsupportedResponseType = "unsupported_response_type"
+	RequestNotSupported     = "request_not_supported"
+	InvalidScope            = "invalid_scope"
+	ServerError             = "server_error"
+	TemporarilyUnavailable  = "temporarily_unavailable"
+	UnsupportedGrantType    = "unsupported_grant_type"
+	InvalidGrant            = "invalid_grant"
+	InvalidClient           = "invalid_client"
+	InactiveToken           = "inactive_token"
+	LoginRequired           = "login_required"
+	InteractionRequired     = "interaction_required"
+	ConsentRequired         = "consent_required"
+)
+
+// Grant types supported at the token endpoint.
+const (
+	GrantTypeAuthorizationCode = "authorization_code"
+	GrantTypeRefreshToken      = "refresh_token"
+	GrantTypeImplicit          = "implicit"
+	GrantTypePassword          = "password"
+	GrantTypeDeviceCode        = "urn:ietf:params:oauth:grant-type:device_code"
+	GrantTypeTokenExchange     = "urn:ietf:params:oauth:grant-type:token-exchange"
+	GrantTypeClientCredentials = "client_credentials"
+)
+
+// Token-exchange token types (RFC 8693 §3).
+const (
+	TokenTypeAccess  = "urn:ietf:params:oauth:token-type:access_token"
+	TokenTypeRefresh = "urn:ietf:params:oauth:token-type:refresh_token"
+	TokenTypeID      = "urn:ietf:params:oauth:token-type:id_token"
+	TokenTypeSAML1   = "urn:ietf:params:oauth:token-type:saml1"
+	TokenTypeSAML2   = "urn:ietf:params:oauth:token-type:saml2"
+	TokenTypeJWT     = "urn:ietf:params:oauth:token-type:jwt"
+)
+
+// Response types for the authorization endpoint.
+const (
+	ResponseTypeCode             = "code"                // "Regular" flow
+	ResponseTypeToken            = "token"               // Implicit flow for frontend apps.
+	ResponseTypeIDToken          = "id_token"            // ID Token in url fragment
+	ResponseTypeCodeToken        = "code token"          // "Regular" flow + Implicit flow
+	ResponseTypeCodeIDToken      = "code id_token"       // "Regular" flow + ID Token
+	ResponseTypeIDTokenToken     = "id_token token"      // ID Token + Implicit flow
+	ResponseTypeCodeIDTokenToken = "code id_token token" // "Regular" flow + ID Token + Implicit flow
+)
+
+// Device authorization grant poll statuses returned at the token endpoint.
+const (
+	DeviceTokenPending  = "authorization_pending"
+	DeviceTokenComplete = "complete"
+	DeviceTokenSlowDown = "slow_down"
+	DeviceTokenExpired  = "expired_token"
+)
+
+// Special redirect URIs for native and device clients.
+const (
+	// RedirectURIOOB is the out-of-band redirect for clients without a browser.
+	RedirectURIOOB = "urn:ietf:wg:oauth:2.0:oob"
+	// DeviceCallbackURI is the callback path used by the device authorization grant.
+	DeviceCallbackURI = "/device/callback"
+)
+
+// PKCE code challenge methods (RFC 7636 §4.2).
+const (
+	PKCEMethodPlain = "plain"
+	PKCEMethodS256  = "S256"
+)
diff --git a/server/oauth2/pkce.go b/server/oauth2/pkce.go
new file mode 100644
index 0000000000..a57b10ecc9
--- /dev/null
+++ b/server/oauth2/pkce.go
@@ -0,0 +1,21 @@
+package oauth2
+
+import (
+	"crypto/sha256"
+	"encoding/base64"
+	"fmt"
+)
+
+// CalculateCodeChallenge derives the PKCE code challenge from a code verifier for
+// the given method (RFC 7636). It is shared by every grant that verifies PKCE.
+func CalculateCodeChallenge(codeVerifier, codeChallengeMethod string) (string, error) {
+	switch codeChallengeMethod {
+	case PKCEMethodPlain:
+		return codeVerifier, nil
+	case PKCEMethodS256:
+		shaSum := sha256.Sum256([]byte(codeVerifier))
+		return base64.RawURLEncoding.EncodeToString(shaSum[:]), nil
+	default:
+		return "", fmt.Errorf("unknown challenge method (%v)", codeChallengeMethod)
+	}
+}
diff --git a/server/oauth2/prompt.go b/server/oauth2/prompt.go
new file mode 100644
index 0000000000..c3d725f2ee
--- /dev/null
+++ b/server/oauth2/prompt.go
@@ -0,0 +1,84 @@
+package oauth2
+
+import (
+	"fmt"
+	"strings"
+)
+
+// Prompt represents the parsed OIDC "prompt" parameter (RFC 6749 / OpenID Connect Core 3.1.2.1).
+// The parameter is space-separated and may contain: "none", "login", "consent", "select_account".
+// "none" must not be combined with any other value.
+type Prompt struct {
+	none          bool
+	login         bool
+	consent       bool
+	selectAccount bool
+}
+
+// ParsePrompt parses and validates the raw prompt query parameter.
+// Returns an error suitable for returning as an OAuth2 invalid_request if the value is invalid.
+func ParsePrompt(raw string) (Prompt, error) {
+	raw = strings.TrimSpace(raw)
+	if raw == "" {
+		return Prompt{}, nil
+	}
+
+	var p Prompt
+	seen := make(map[string]bool)
+
+	for _, v := range strings.Fields(raw) {
+		if seen[v] {
+			continue
+		}
+		seen[v] = true
+
+		switch v {
+		case "none":
+			p.none = true
+		case "login":
+			p.login = true
+		case "consent":
+			p.consent = true
+		case "select_account":
+			p.selectAccount = true
+		default:
+			return Prompt{}, fmt.Errorf("invalid prompt value %q", v)
+		}
+	}
+
+	if p.none && (p.login || p.consent || p.selectAccount) {
+		return Prompt{}, fmt.Errorf("prompt=none must not be combined with other values")
+	}
+
+	return p, nil
+}
+
+// None returns true if the caller requested no interactive UI.
+func (p Prompt) None() bool { return p.none }
+
+// Login returns true if the caller requested forced re-authentication.
+func (p Prompt) Login() bool { return p.login }
+
+// Consent returns true if the caller requested forced consent screen.
+func (p Prompt) Consent() bool { return p.consent }
+
+// SelectAccount returns true if the caller requested account/connector selection.
+func (p Prompt) SelectAccount() bool { return p.selectAccount }
+
+// String returns the canonical space-separated representation stored in the database.
+func (p Prompt) String() string {
+	var parts []string
+	if p.none {
+		return "none"
+	}
+	if p.login {
+		parts = append(parts, "login")
+	}
+	if p.consent {
+		parts = append(parts, "consent")
+	}
+	if p.selectAccount {
+		parts = append(parts, "select_account")
+	}
+	return strings.Join(parts, " ")
+}
diff --git a/server/oauth2/prompt_test.go b/server/oauth2/prompt_test.go
new file mode 100644
index 0000000000..f93b1d50a3
--- /dev/null
+++ b/server/oauth2/prompt_test.go
@@ -0,0 +1,68 @@
+package oauth2
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestParsePrompt(t *testing.T) {
+	tests := []struct {
+		name    string
+		raw     string
+		want    Prompt
+		wantErr bool
+	}{
+		{name: "empty", raw: "", want: Prompt{}},
+		{name: "none", raw: "none", want: Prompt{none: true}},
+		{name: "login", raw: "login", want: Prompt{login: true}},
+		{name: "consent", raw: "consent", want: Prompt{consent: true}},
+		{name: "login consent", raw: "login consent", want: Prompt{login: true, consent: true}},
+		{name: "consent login", raw: "consent login", want: Prompt{login: true, consent: true}},
+		{name: "select_account", raw: "select_account", want: Prompt{selectAccount: true}},
+		{name: "login select_account", raw: "login select_account", want: Prompt{login: true, selectAccount: true}},
+		{name: "consent select_account", raw: "consent select_account", want: Prompt{consent: true, selectAccount: true}},
+		{name: "duplicate values", raw: "login login", want: Prompt{login: true}},
+		{name: "whitespace padding", raw: "  login  ", want: Prompt{login: true}},
+
+		// Errors.
+		{name: "none with login", raw: "none login", wantErr: true},
+		{name: "none with consent", raw: "none consent", wantErr: true},
+		{name: "none with select_account", raw: "none select_account", wantErr: true},
+		{name: "unknown value", raw: "bogus", wantErr: true},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			got, err := ParsePrompt(tc.raw)
+			if tc.wantErr {
+				require.Error(t, err)
+				return
+			}
+			require.NoError(t, err)
+			assert.Equal(t, tc.want, got)
+		})
+	}
+}
+
+func TestPromptString(t *testing.T) {
+	tests := []struct {
+		prompt Prompt
+		want   string
+	}{
+		{Prompt{}, ""},
+		{Prompt{none: true}, "none"},
+		{Prompt{login: true}, "login"},
+		{Prompt{consent: true}, "consent"},
+		{Prompt{login: true, consent: true}, "login consent"},
+		{Prompt{selectAccount: true}, "select_account"},
+		{Prompt{login: true, selectAccount: true}, "login select_account"},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.want, func(t *testing.T) {
+			assert.Equal(t, tc.want, tc.prompt.String())
+		})
+	}
+}
diff --git a/server/passwords/passwords.go b/server/passwords/passwords.go
new file mode 100644
index 0000000000..970db96ebb
--- /dev/null
+++ b/server/passwords/passwords.go
@@ -0,0 +1,37 @@
+// Package passwords holds the shared password-hashing policy used by both the
+// gRPC API (when a password is created) and the local passwordDB connector (when
+// a static password is used to log in).
+package passwords
+
+import (
+	"fmt"
+
+	"golang.org/x/crypto/bcrypt"
+)
+
+const (
+	// recCost is the recommended bcrypt cost, which balances hash strength and
+	// efficiency.
+	recCost = 12
+
+	// upBoundCost is a sane upper bound on bcrypt cost determined by benchmarking:
+	// high enough to ensure secure encryption, low enough to not put unnecessary
+	// load on a dex server.
+	upBoundCost = 16
+)
+
+// CheckCost returns an error if the bcrypt hash's cost is below the minimum or
+// above the accepted upper bound.
+func CheckCost(hash []byte) error {
+	actual, err := bcrypt.Cost(hash)
+	if err != nil {
+		return fmt.Errorf("parsing bcrypt hash: %v", err)
+	}
+	if actual < bcrypt.DefaultCost {
+		return fmt.Errorf("given hash cost = %d does not meet minimum cost requirement = %d", actual, bcrypt.DefaultCost)
+	}
+	if actual > upBoundCost {
+		return fmt.Errorf("given hash cost = %d is above upper bound cost = %d, recommended cost = %d", actual, upBoundCost, recCost)
+	}
+	return nil
+}
diff --git a/server/passwords/passwords_test.go b/server/passwords/passwords_test.go
new file mode 100644
index 0000000000..1d14a735d0
--- /dev/null
+++ b/server/passwords/passwords_test.go
@@ -0,0 +1,47 @@
+package passwords
+
+import "testing"
+
+func TestCheckCost(t *testing.T) {
+	tests := []struct {
+		name      string
+		inputHash []byte
+		wantErr   bool
+	}{
+		{
+			name: "valid cost",
+			// bcrypt hash of the value "test1" with cost 12 (default)
+			inputHash: []byte("$2a$12$M2Ot95Qty1MuQdubh1acWOiYadJDzeVg3ve4n5b.dgcgPdjCseKx2"),
+		},
+		{
+			name:      "invalid hash",
+			inputHash: []byte(""),
+			wantErr:   true,
+		},
+		{
+			name: "cost below default",
+			// bcrypt hash of the value "test1" with cost 4
+			inputHash: []byte("$2a$04$8bSTbuVCLpKzaqB3BmgI7edDigG5tIQKkjYUu/mEO9gQgIkw9m7eG"),
+			wantErr:   true,
+		},
+		{
+			name: "cost above recommendation",
+			// bcrypt hash of the value "test1" with cost 17
+			inputHash: []byte("$2a$17$tWuZkTxtSmRyWZAGWVHQE.7npdl.TgP8adjzLJD.SyjpFznKBftPe"),
+			wantErr:   true,
+		},
+	}
+
+	for _, tc := range tests {
+		err := CheckCost(tc.inputHash)
+		if tc.wantErr {
+			if err == nil {
+				t.Errorf("%s: expected err", tc.name)
+			}
+			continue
+		}
+		if err != nil {
+			t.Errorf("%s: %s", tc.name, err)
+		}
+	}
+}
diff --git a/server/refreshhandlers.go b/server/refreshhandlers.go
deleted file mode 100644
index 0c9b1393d3..0000000000
--- a/server/refreshhandlers.go
+++ /dev/null
@@ -1,342 +0,0 @@
-package server
-
-import (
-	"context"
-	"errors"
-	"fmt"
-	"net/http"
-	"strings"
-	"time"
-
-	"github.com/dexidp/dex/connector"
-	"github.com/dexidp/dex/server/internal"
-	"github.com/dexidp/dex/storage"
-)
-
-func contains(arr []string, item string) bool {
-	for _, itemFromArray := range arr {
-		if itemFromArray == item {
-			return true
-		}
-	}
-	return false
-}
-
-type refreshError struct {
-	msg  string
-	code int
-	desc string
-}
-
-func newInternalServerError() *refreshError {
-	return &refreshError{msg: errInvalidRequest, desc: "", code: http.StatusInternalServerError}
-}
-
-func newBadRequestError(desc string) *refreshError {
-	return &refreshError{msg: errInvalidRequest, desc: desc, code: http.StatusBadRequest}
-}
-
-func (s *Server) refreshTokenErrHelper(w http.ResponseWriter, err *refreshError) {
-	s.tokenErrHelper(w, err.msg, err.desc, err.code)
-}
-
-func (s *Server) extractRefreshTokenFromRequest(r *http.Request) (*internal.RefreshToken, *refreshError) {
-	code := r.PostFormValue("refresh_token")
-	if code == "" {
-		return nil, newBadRequestError("No refresh token is found in request.")
-	}
-
-	token := new(internal.RefreshToken)
-	if err := internal.Unmarshal(code, token); err != nil {
-		// For backward compatibility, assume the refresh_token is a raw refresh token ID
-		// if it fails to decode.
-		//
-		// Because refresh_token values that aren't unmarshable were generated by servers
-		// that don't have a Token value, we'll still reject any attempts to claim a
-		// refresh_token twice.
-		token = &internal.RefreshToken{RefreshId: code, Token: ""}
-	}
-
-	return token, nil
-}
-
-// getRefreshTokenFromStorage checks that refresh token is valid and exists in the storage and gets its info
-func (s *Server) getRefreshTokenFromStorage(clientID string, token *internal.RefreshToken) (*storage.RefreshToken, *refreshError) {
-	invalidErr := newBadRequestError("Refresh token is invalid or has already been claimed by another client.")
-
-	refresh, err := s.storage.GetRefresh(token.RefreshId)
-	if err != nil {
-		if err != storage.ErrNotFound {
-			s.logger.Errorf("failed to get refresh token: %v", err)
-			return nil, newInternalServerError()
-		}
-		return nil, invalidErr
-	}
-
-	if refresh.ClientID != clientID {
-		s.logger.Errorf("client %s trying to claim token for client %s", clientID, refresh.ClientID)
-		// According to https://datatracker.ietf.org/doc/html/rfc6749#section-5.2 Dex should respond with an
-		//  invalid grant error if token has already been claimed by another client.
-		return nil, &refreshError{msg: errInvalidGrant, desc: invalidErr.desc, code: http.StatusBadRequest}
-	}
-
-	if refresh.Token != token.Token {
-		switch {
-		case !s.refreshTokenPolicy.AllowedToReuse(refresh.LastUsed):
-			fallthrough
-		case refresh.ObsoleteToken != token.Token:
-			fallthrough
-		case refresh.ObsoleteToken == "":
-			s.logger.Errorf("refresh token with id %s claimed twice", refresh.ID)
-			return nil, invalidErr
-		}
-	}
-
-	expiredErr := newBadRequestError("Refresh token expired.")
-	if s.refreshTokenPolicy.CompletelyExpired(refresh.CreatedAt) {
-		s.logger.Errorf("refresh token with id %s expired", refresh.ID)
-		return nil, expiredErr
-	}
-
-	if s.refreshTokenPolicy.ExpiredBecauseUnused(refresh.LastUsed) {
-		s.logger.Errorf("refresh token with id %s expired due to inactivity", refresh.ID)
-		return nil, expiredErr
-	}
-
-	return &refresh, nil
-}
-
-func (s *Server) getRefreshScopes(r *http.Request, refresh *storage.RefreshToken) ([]string, *refreshError) {
-	// Per the OAuth2 spec, if the client has omitted the scopes, default to the original
-	// authorized scopes.
-	//
-	// https://tools.ietf.org/html/rfc6749#section-6
-	scope := r.PostFormValue("scope")
-
-	if scope == "" {
-		return refresh.Scopes, nil
-	}
-
-	requestedScopes := strings.Fields(scope)
-	var unauthorizedScopes []string
-
-	// Per the OAuth2 spec, if the client has omitted the scopes, default to the original
-	// authorized scopes.
-	//
-	// https://tools.ietf.org/html/rfc6749#section-6
-	for _, requestScope := range requestedScopes {
-		if !contains(refresh.Scopes, requestScope) {
-			unauthorizedScopes = append(unauthorizedScopes, requestScope)
-		}
-	}
-
-	if len(unauthorizedScopes) > 0 {
-		desc := fmt.Sprintf("Requested scopes contain unauthorized scope(s): %q.", unauthorizedScopes)
-		return nil, newBadRequestError(desc)
-	}
-
-	return requestedScopes, nil
-}
-
-func (s *Server) refreshWithConnector(ctx context.Context, token *internal.RefreshToken, refresh *storage.RefreshToken, scopes []string) (connector.Identity, *refreshError) {
-	var connectorData []byte
-
-	session, err := s.storage.GetOfflineSessions(refresh.Claims.UserID, refresh.ConnectorID)
-	switch {
-	case err != nil:
-		if err != storage.ErrNotFound {
-			s.logger.Errorf("failed to get offline session: %v", err)
-			return connector.Identity{}, newInternalServerError()
-		}
-	case len(refresh.ConnectorData) > 0:
-		// Use the old connector data if it exists, should be deleted once used
-		connectorData = refresh.ConnectorData
-	default:
-		connectorData = session.ConnectorData
-	}
-
-	conn, err := s.getConnector(refresh.ConnectorID)
-	if err != nil {
-		s.logger.Errorf("connector with ID %q not found: %v", refresh.ConnectorID, err)
-		return connector.Identity{}, newInternalServerError()
-	}
-
-	ident := connector.Identity{
-		UserID:            refresh.Claims.UserID,
-		Username:          refresh.Claims.Username,
-		PreferredUsername: refresh.Claims.PreferredUsername,
-		Email:             refresh.Claims.Email,
-		EmailVerified:     refresh.Claims.EmailVerified,
-		Groups:            refresh.Claims.Groups,
-		ConnectorData:     connectorData,
-	}
-
-	// user's token was previously updated by a connector and is allowed to reuse
-	// it is excessive to refresh identity in upstream
-	if s.refreshTokenPolicy.AllowedToReuse(refresh.LastUsed) && token.Token == refresh.ObsoleteToken {
-		return ident, nil
-	}
-
-	// Can the connector refresh the identity? If so, attempt to refresh the data
-	// in the connector.
-	//
-	// TODO(ericchiang): We may want a strict mode where connectors that don't implement
-	// this interface can't perform refreshing.
-	if refreshConn, ok := conn.Connector.(connector.RefreshConnector); ok {
-		newIdent, err := refreshConn.Refresh(ctx, parseScopes(scopes), ident)
-		if err != nil {
-			s.logger.Errorf("failed to refresh identity: %v", err)
-			return connector.Identity{}, newInternalServerError()
-		}
-		ident = newIdent
-	}
-
-	return ident, nil
-}
-
-// updateOfflineSession updates offline session in the storage
-func (s *Server) updateOfflineSession(refresh *storage.RefreshToken, ident connector.Identity, lastUsed time.Time) *refreshError {
-	offlineSessionUpdater := func(old storage.OfflineSessions) (storage.OfflineSessions, error) {
-		if old.Refresh[refresh.ClientID].ID != refresh.ID {
-			return old, errors.New("refresh token invalid")
-		}
-		old.Refresh[refresh.ClientID].LastUsed = lastUsed
-		old.ConnectorData = ident.ConnectorData
-		return old, nil
-	}
-
-	// Update LastUsed time stamp in refresh token reference object
-	// in offline session for the user.
-	err := s.storage.UpdateOfflineSessions(refresh.Claims.UserID, refresh.ConnectorID, offlineSessionUpdater)
-	if err != nil {
-		s.logger.Errorf("failed to update offline session: %v", err)
-		return newInternalServerError()
-	}
-
-	return nil
-}
-
-// updateRefreshToken updates refresh token and offline session in the storage
-func (s *Server) updateRefreshToken(token *internal.RefreshToken, refresh *storage.RefreshToken, ident connector.Identity) (*internal.RefreshToken, *refreshError) {
-	newToken := token
-	if s.refreshTokenPolicy.RotationEnabled() {
-		newToken = &internal.RefreshToken{
-			RefreshId: refresh.ID,
-			Token:     storage.NewID(),
-		}
-	}
-
-	lastUsed := s.now()
-
-	refreshTokenUpdater := func(old storage.RefreshToken) (storage.RefreshToken, error) {
-		if s.refreshTokenPolicy.RotationEnabled() {
-			if old.Token != token.Token {
-				if s.refreshTokenPolicy.AllowedToReuse(old.LastUsed) && old.ObsoleteToken == token.Token {
-					newToken.Token = old.Token
-					// Do not update last used time for offline session if token is allowed to be reused
-					lastUsed = old.LastUsed
-					return old, nil
-				}
-				return old, errors.New("refresh token claimed twice")
-			}
-
-			old.ObsoleteToken = old.Token
-		}
-
-		old.Token = newToken.Token
-		// Update the claims of the refresh token.
-		//
-		// UserID intentionally ignored for now.
-		old.Claims.Username = ident.Username
-		old.Claims.PreferredUsername = ident.PreferredUsername
-		old.Claims.Email = ident.Email
-		old.Claims.EmailVerified = ident.EmailVerified
-		old.Claims.Groups = ident.Groups
-		old.LastUsed = lastUsed
-
-		// ConnectorData has been moved to OfflineSession
-		old.ConnectorData = []byte{}
-		return old, nil
-	}
-
-	// Update refresh token in the storage.
-	err := s.storage.UpdateRefreshToken(refresh.ID, refreshTokenUpdater)
-	if err != nil {
-		s.logger.Errorf("failed to update refresh token: %v", err)
-		return nil, newInternalServerError()
-	}
-
-	rerr := s.updateOfflineSession(refresh, ident, lastUsed)
-	if rerr != nil {
-		return nil, rerr
-	}
-
-	return newToken, nil
-}
-
-// handleRefreshToken handles a refresh token request https://tools.ietf.org/html/rfc6749#section-6
-// this method is the entrypoint for refresh tokens handling
-func (s *Server) handleRefreshToken(w http.ResponseWriter, r *http.Request, client storage.Client) {
-	token, rerr := s.extractRefreshTokenFromRequest(r)
-	if rerr != nil {
-		s.refreshTokenErrHelper(w, rerr)
-		return
-	}
-
-	refresh, rerr := s.getRefreshTokenFromStorage(client.ID, token)
-	if rerr != nil {
-		s.refreshTokenErrHelper(w, rerr)
-		return
-	}
-
-	scopes, rerr := s.getRefreshScopes(r, refresh)
-	if rerr != nil {
-		s.refreshTokenErrHelper(w, rerr)
-		return
-	}
-
-	ident, rerr := s.refreshWithConnector(r.Context(), token, refresh, scopes)
-	if rerr != nil {
-		s.refreshTokenErrHelper(w, rerr)
-		return
-	}
-
-	claims := storage.Claims{
-		UserID:            ident.UserID,
-		Username:          ident.Username,
-		PreferredUsername: ident.PreferredUsername,
-		Email:             ident.Email,
-		EmailVerified:     ident.EmailVerified,
-		Groups:            ident.Groups,
-	}
-
-	accessToken, err := s.newAccessToken(client.ID, claims, scopes, refresh.Nonce, refresh.ConnectorID)
-	if err != nil {
-		s.logger.Errorf("failed to create new access token: %v", err)
-		s.refreshTokenErrHelper(w, newInternalServerError())
-		return
-	}
-
-	idToken, expiry, err := s.newIDToken(client.ID, claims, scopes, refresh.Nonce, accessToken, "", refresh.ConnectorID)
-	if err != nil {
-		s.logger.Errorf("failed to create ID token: %v", err)
-		s.refreshTokenErrHelper(w, newInternalServerError())
-		return
-	}
-
-	newToken, rerr := s.updateRefreshToken(token, refresh, ident)
-	if rerr != nil {
-		s.refreshTokenErrHelper(w, rerr)
-		return
-	}
-
-	rawNewToken, err := internal.Marshal(newToken)
-	if err != nil {
-		s.logger.Errorf("failed to marshal refresh token: %v", err)
-		s.refreshTokenErrHelper(w, newInternalServerError())
-		return
-	}
-
-	resp := s.toAccessTokenResponse(idToken, accessToken, rawNewToken, expiry)
-	s.writeAccessToken(w, resp)
-}
diff --git a/server/refreshhandlers_test.go b/server/refreshhandlers_test.go
deleted file mode 100644
index c64c50b330..0000000000
--- a/server/refreshhandlers_test.go
+++ /dev/null
@@ -1,212 +0,0 @@
-package server
-
-import (
-	"bytes"
-	"context"
-	"encoding/json"
-	"net/http"
-	"net/http/httptest"
-	"net/url"
-	"path"
-	"testing"
-	"time"
-
-	"github.com/stretchr/testify/require"
-
-	"github.com/dexidp/dex/server/internal"
-	"github.com/dexidp/dex/storage"
-)
-
-func mockRefreshTokenTestStorage(t *testing.T, s storage.Storage, useObsolete bool) {
-	c := storage.Client{
-		ID:           "test",
-		Secret:       "barfoo",
-		RedirectURIs: []string{"foo://bar.com/", "https://auth.example.com"},
-		Name:         "dex client",
-		LogoURL:      "https://goo.gl/JIyzIC",
-	}
-
-	err := s.CreateClient(c)
-	require.NoError(t, err)
-
-	c1 := storage.Connector{
-		ID:     "test",
-		Type:   "mockCallback",
-		Name:   "mockCallback",
-		Config: nil,
-	}
-
-	err = s.CreateConnector(c1)
-	require.NoError(t, err)
-
-	refresh := storage.RefreshToken{
-		ID:            "test",
-		Token:         "bar",
-		ObsoleteToken: "",
-		Nonce:         "foo",
-		ClientID:      "test",
-		ConnectorID:   "test",
-		Scopes:        []string{"openid", "email", "profile"},
-		CreatedAt:     time.Now().UTC().Round(time.Millisecond),
-		LastUsed:      time.Now().UTC().Round(time.Millisecond),
-		Claims: storage.Claims{
-			UserID:        "1",
-			Username:      "jane",
-			Email:         "jane.doe@example.com",
-			EmailVerified: true,
-			Groups:        []string{"a", "b"},
-		},
-		ConnectorData: []byte(`{"some":"data"}`),
-	}
-
-	if useObsolete {
-		refresh.Token = "testtest"
-		refresh.ObsoleteToken = "bar"
-	}
-
-	err = s.CreateRefresh(refresh)
-	require.NoError(t, err)
-
-	offlineSessions := storage.OfflineSessions{
-		UserID:        "1",
-		ConnID:        "test",
-		Refresh:       map[string]*storage.RefreshTokenRef{"test": {ID: "test", ClientID: "test"}},
-		ConnectorData: nil,
-	}
-
-	err = s.CreateOfflineSessions(offlineSessions)
-	require.NoError(t, err)
-}
-
-func TestRefreshTokenExpirationScenarios(t *testing.T) {
-	t0 := time.Now()
-	tests := []struct {
-		name        string
-		policy      *RefreshTokenPolicy
-		useObsolete bool
-		error       string
-	}{
-		{
-			name:   "Normal",
-			policy: &RefreshTokenPolicy{rotateRefreshTokens: true},
-			error:  ``,
-		},
-		{
-			name: "Not expired because used",
-			policy: &RefreshTokenPolicy{
-				rotateRefreshTokens: false,
-				validIfNotUsedFor:   time.Second * 60,
-				now:                 func() time.Time { return t0.Add(time.Second * 25) },
-			},
-			error: ``,
-		},
-		{
-			name: "Expired because not used",
-			policy: &RefreshTokenPolicy{
-				rotateRefreshTokens: false,
-				validIfNotUsedFor:   time.Second * 60,
-				now:                 func() time.Time { return t0.Add(time.Hour) },
-			},
-			error: `{"error":"invalid_request","error_description":"Refresh token expired."}`,
-		},
-		{
-			name: "Absolutely expired",
-			policy: &RefreshTokenPolicy{
-				rotateRefreshTokens: true,
-				absoluteLifetime:    time.Second * 60,
-				now:                 func() time.Time { return t0.Add(time.Hour) },
-			},
-			error: `{"error":"invalid_request","error_description":"Refresh token expired."}`,
-		},
-		{
-			name:        "Obsolete tokens are allowed",
-			useObsolete: true,
-			policy: &RefreshTokenPolicy{
-				rotateRefreshTokens: true,
-				reuseInterval:       time.Second * 30,
-				now:                 func() time.Time { return t0.Add(time.Second * 25) },
-			},
-			error: ``,
-		},
-		{
-			name:        "Obsolete tokens are not allowed",
-			useObsolete: true,
-			policy: &RefreshTokenPolicy{
-				rotateRefreshTokens: true,
-				now:                 func() time.Time { return t0.Add(time.Second * 25) },
-			},
-			error: `{"error":"invalid_request","error_description":"Refresh token is invalid or has already been claimed by another client."}`,
-		},
-		{
-			name:        "Obsolete tokens are allowed but token is expired globally",
-			useObsolete: true,
-			policy: &RefreshTokenPolicy{
-				rotateRefreshTokens: true,
-				reuseInterval:       time.Second * 30,
-				absoluteLifetime:    time.Second * 20,
-				now:                 func() time.Time { return t0.Add(time.Second * 25) },
-			},
-			error: `{"error":"invalid_request","error_description":"Refresh token expired."}`,
-		},
-	}
-
-	for _, tc := range tests {
-		t.Run(tc.name, func(*testing.T) {
-			ctx, cancel := context.WithCancel(context.Background())
-			defer cancel()
-
-			// Setup a dex server.
-			httpServer, s := newTestServer(ctx, t, func(c *Config) {
-				c.RefreshTokenPolicy = tc.policy
-				c.Now = func() time.Time { return t0 }
-			})
-			defer httpServer.Close()
-
-			mockRefreshTokenTestStorage(t, s.storage, tc.useObsolete)
-
-			u, err := url.Parse(s.issuerURL.String())
-			require.NoError(t, err)
-
-			tokenData, err := internal.Marshal(&internal.RefreshToken{RefreshId: "test", Token: "bar"})
-			require.NoError(t, err)
-
-			u.Path = path.Join(u.Path, "/token")
-			v := url.Values{}
-			v.Add("grant_type", "refresh_token")
-			v.Add("refresh_token", tokenData)
-
-			req, _ := http.NewRequest("POST", u.String(), bytes.NewBufferString(v.Encode()))
-			req.Header.Set("Content-Type", "application/x-www-form-urlencoded; param=value")
-			req.SetBasicAuth("test", "barfoo")
-
-			rr := httptest.NewRecorder()
-			s.ServeHTTP(rr, req)
-
-			if tc.error == "" {
-				require.Equal(t, 200, rr.Code)
-			} else {
-				require.Equal(t, rr.Body.String(), tc.error)
-				return
-			}
-
-			// Check that we received expected refresh token
-			var ref struct {
-				Token string `json:"refresh_token"`
-			}
-			err = json.Unmarshal(rr.Body.Bytes(), &ref)
-			require.NoError(t, err)
-
-			if tc.policy.rotateRefreshTokens == false {
-				require.Equal(t, tokenData, ref.Token)
-			} else {
-				require.NotEqual(t, tokenData, ref.Token)
-			}
-
-			if tc.useObsolete {
-				updatedTokenData, err := internal.Marshal(&internal.RefreshToken{RefreshId: "test", Token: "testtest"})
-				require.NoError(t, err)
-				require.Equal(t, updatedTokenData, ref.Token)
-			}
-		})
-	}
-}
diff --git a/server/reqctx/doc.go b/server/reqctx/doc.go
new file mode 100644
index 0000000000..6f144f2614
--- /dev/null
+++ b/server/reqctx/doc.go
@@ -0,0 +1,7 @@
+// Package reqctx carries per-request values (request ID, client IP) through the
+// context. The server's middleware sets them; the CLI logger reads them as log
+// attributes and the auth flow reads the client IP for the session audit record.
+// It is a neutral, low-level home so the server, the auth flow and its
+// sub-packages, and the CLI can all reference the same keys without an import
+// cycle.
+package reqctx
diff --git a/server/reqctx/reqctx.go b/server/reqctx/reqctx.go
new file mode 100644
index 0000000000..56bc491e8b
--- /dev/null
+++ b/server/reqctx/reqctx.go
@@ -0,0 +1,24 @@
+package reqctx
+
+import (
+	"context"
+
+	"github.com/google/uuid"
+)
+
+type key string
+
+const (
+	RequestKeyRequestID key = "request_id"
+	RequestKeyRemoteIP  key = "client_remote_addr"
+)
+
+// WithRequestID attaches a fresh request ID to the context.
+func WithRequestID(ctx context.Context) context.Context {
+	return context.WithValue(ctx, RequestKeyRequestID, uuid.NewString())
+}
+
+// WithRemoteIP attaches the client's remote IP to the context.
+func WithRemoteIP(ctx context.Context, ip string) context.Context {
+	return context.WithValue(ctx, RequestKeyRemoteIP, ip)
+}
diff --git a/server/rotation.go b/server/rotation.go
deleted file mode 100644
index 98489767e0..0000000000
--- a/server/rotation.go
+++ /dev/null
@@ -1,249 +0,0 @@
-package server
-
-import (
-	"context"
-	"crypto/rand"
-	"crypto/rsa"
-	"encoding/hex"
-	"errors"
-	"fmt"
-	"io"
-	"time"
-
-	"gopkg.in/square/go-jose.v2"
-
-	"github.com/dexidp/dex/pkg/log"
-	"github.com/dexidp/dex/storage"
-)
-
-var errAlreadyRotated = errors.New("keys already rotated by another server instance")
-
-// rotationStrategy describes a strategy for generating cryptographic keys, how
-// often to rotate them, and how long they can validate signatures after rotation.
-type rotationStrategy struct {
-	// Time between rotations.
-	rotationFrequency time.Duration
-
-	// After being rotated how long should the key be kept around for validating
-	// signatures?
-	idTokenValidFor time.Duration
-
-	// Keys are always RSA keys. Though cryptopasta recommends ECDSA keys, not every
-	// client may support these (e.g. github.com/coreos/go-oidc/oidc).
-	key func() (*rsa.PrivateKey, error)
-}
-
-// staticRotationStrategy returns a strategy which never rotates keys.
-func staticRotationStrategy(key *rsa.PrivateKey) rotationStrategy {
-	return rotationStrategy{
-		// Setting these values to 100 years is easier than having a flag indicating no rotation.
-		rotationFrequency: time.Hour * 8760 * 100,
-		idTokenValidFor:   time.Hour * 8760 * 100,
-		key:               func() (*rsa.PrivateKey, error) { return key, nil },
-	}
-}
-
-// defaultRotationStrategy returns a strategy which rotates keys every provided period,
-// holding onto the public parts for some specified amount of time.
-func defaultRotationStrategy(rotationFrequency, idTokenValidFor time.Duration) rotationStrategy {
-	return rotationStrategy{
-		rotationFrequency: rotationFrequency,
-		idTokenValidFor:   idTokenValidFor,
-		key: func() (*rsa.PrivateKey, error) {
-			return rsa.GenerateKey(rand.Reader, 2048)
-		},
-	}
-}
-
-type keyRotator struct {
-	storage.Storage
-
-	strategy rotationStrategy
-	now      func() time.Time
-
-	logger log.Logger
-}
-
-// startKeyRotation begins key rotation in a new goroutine, closing once the context is canceled.
-//
-// The method blocks until after the first attempt to rotate keys has completed. That way
-// healthy storages will return from this call with valid keys.
-func (s *Server) startKeyRotation(ctx context.Context, strategy rotationStrategy, now func() time.Time) {
-	rotator := keyRotator{s.storage, strategy, now, s.logger}
-
-	// Try to rotate immediately so properly configured storages will have keys.
-	if err := rotator.rotate(); err != nil {
-		if err == errAlreadyRotated {
-			s.logger.Infof("Key rotation not needed: %v", err)
-		} else {
-			s.logger.Errorf("failed to rotate keys: %v", err)
-		}
-	}
-
-	go func() {
-		for {
-			select {
-			case <-ctx.Done():
-				return
-			case <-time.After(time.Second * 30):
-				if err := rotator.rotate(); err != nil {
-					s.logger.Errorf("failed to rotate keys: %v", err)
-				}
-			}
-		}
-	}()
-}
-
-func (k keyRotator) rotate() error {
-	keys, err := k.GetKeys()
-	if err != nil && err != storage.ErrNotFound {
-		return fmt.Errorf("get keys: %v", err)
-	}
-	if k.now().Before(keys.NextRotation) {
-		return nil
-	}
-	k.logger.Infof("keys expired, rotating")
-
-	// Generate the key outside of a storage transaction.
-	key, err := k.strategy.key()
-	if err != nil {
-		return fmt.Errorf("generate key: %v", err)
-	}
-	b := make([]byte, 20)
-	if _, err := io.ReadFull(rand.Reader, b); err != nil {
-		panic(err)
-	}
-	keyID := hex.EncodeToString(b)
-	priv := &jose.JSONWebKey{
-		Key:       key,
-		KeyID:     keyID,
-		Algorithm: "RS256",
-		Use:       "sig",
-	}
-	pub := &jose.JSONWebKey{
-		Key:       key.Public(),
-		KeyID:     keyID,
-		Algorithm: "RS256",
-		Use:       "sig",
-	}
-
-	var nextRotation time.Time
-	err = k.Storage.UpdateKeys(func(keys storage.Keys) (storage.Keys, error) {
-		tNow := k.now()
-
-		// if you are running multiple instances of dex, another instance
-		// could have already rotated the keys.
-		if tNow.Before(keys.NextRotation) {
-			return storage.Keys{}, errAlreadyRotated
-		}
-
-		expired := func(key storage.VerificationKey) bool {
-			return tNow.After(key.Expiry)
-		}
-
-		// Remove any verification keys that have expired.
-		i := 0
-		for _, key := range keys.VerificationKeys {
-			if !expired(key) {
-				keys.VerificationKeys[i] = key
-				i++
-			}
-		}
-		keys.VerificationKeys = keys.VerificationKeys[:i]
-
-		if keys.SigningKeyPub != nil {
-			// Move current signing key to a verification only key, throwing
-			// away the private part.
-			verificationKey := storage.VerificationKey{
-				PublicKey: keys.SigningKeyPub,
-				// After demoting the signing key, keep the token around for at least
-				// the amount of time an ID Token is valid for. This ensures the
-				// verification key won't expire until all ID Tokens it's signed
-				// expired as well.
-				Expiry: tNow.Add(k.strategy.idTokenValidFor),
-			}
-			keys.VerificationKeys = append(keys.VerificationKeys, verificationKey)
-		}
-
-		nextRotation = k.now().Add(k.strategy.rotationFrequency)
-		keys.SigningKey = priv
-		keys.SigningKeyPub = pub
-		keys.NextRotation = nextRotation
-		return keys, nil
-	})
-	if err != nil {
-		return err
-	}
-	k.logger.Infof("keys rotated, next rotation: %s", nextRotation)
-	return nil
-}
-
-type RefreshTokenPolicy struct {
-	rotateRefreshTokens bool // enable rotation
-
-	absoluteLifetime  time.Duration // interval from token creation to the end of its life
-	validIfNotUsedFor time.Duration // interval from last token update to the end of its life
-	reuseInterval     time.Duration // interval within which old refresh token is allowed to be reused
-
-	now func() time.Time
-
-	logger log.Logger
-}
-
-func NewRefreshTokenPolicy(logger log.Logger, rotation bool, validIfNotUsedFor, absoluteLifetime, reuseInterval string) (*RefreshTokenPolicy, error) {
-	r := RefreshTokenPolicy{now: time.Now, logger: logger}
-	var err error
-
-	if validIfNotUsedFor != "" {
-		r.validIfNotUsedFor, err = time.ParseDuration(validIfNotUsedFor)
-		if err != nil {
-			return nil, fmt.Errorf("invalid config value %q for refresh token valid if not used for: %v", validIfNotUsedFor, err)
-		}
-		logger.Infof("config refresh tokens valid if not used for: %v", validIfNotUsedFor)
-	}
-
-	if absoluteLifetime != "" {
-		r.absoluteLifetime, err = time.ParseDuration(absoluteLifetime)
-		if err != nil {
-			return nil, fmt.Errorf("invalid config value %q for refresh tokens absolute lifetime: %v", absoluteLifetime, err)
-		}
-		logger.Infof("config refresh tokens absolute lifetime: %v", absoluteLifetime)
-	}
-
-	if reuseInterval != "" {
-		r.reuseInterval, err = time.ParseDuration(reuseInterval)
-		if err != nil {
-			return nil, fmt.Errorf("invalid config value %q for refresh tokens reuse interval: %v", reuseInterval, err)
-		}
-		logger.Infof("config refresh tokens reuse interval: %v", reuseInterval)
-	}
-
-	r.rotateRefreshTokens = !rotation
-	logger.Infof("config refresh tokens rotation enabled: %v", r.rotateRefreshTokens)
-	return &r, nil
-}
-
-func (r *RefreshTokenPolicy) RotationEnabled() bool {
-	return r.rotateRefreshTokens
-}
-
-func (r *RefreshTokenPolicy) CompletelyExpired(lastUsed time.Time) bool {
-	if r.absoluteLifetime == 0 {
-		return false // expiration disabled
-	}
-	return r.now().After(lastUsed.Add(r.absoluteLifetime))
-}
-
-func (r *RefreshTokenPolicy) ExpiredBecauseUnused(lastUsed time.Time) bool {
-	if r.validIfNotUsedFor == 0 {
-		return false // expiration disabled
-	}
-	return r.now().After(lastUsed.Add(r.validIfNotUsedFor))
-}
-
-func (r *RefreshTokenPolicy) AllowedToReuse(lastUsed time.Time) bool {
-	if r.reuseInterval == 0 {
-		return false // expiration disabled
-	}
-	return !r.now().After(lastUsed.Add(r.reuseInterval))
-}
diff --git a/server/router/doc.go b/server/router/doc.go
new file mode 100644
index 0000000000..5e7c8ebbae
--- /dev/null
+++ b/server/router/doc.go
@@ -0,0 +1,3 @@
+// Package router defines the abstraction domain handlers use to mount their own
+// HTTP routes, so the top-level server does not hardcode each handler's paths.
+package router
diff --git a/server/router/realip.go b/server/router/realip.go
new file mode 100644
index 0000000000..80b80eb2ea
--- /dev/null
+++ b/server/router/realip.go
@@ -0,0 +1,64 @@
+package router
+
+import (
+	"net"
+	"net/http"
+	"net/netip"
+	"slices"
+	"strings"
+)
+
+// ParseRealIP returns the resolver that Config.RealIP is set to: it reports the
+// client's IP for a request, reading it from the named header when — and only
+// when — the request reached dex through a trusted proxy.
+//
+// A request's peer address is trusted if it falls inside any one of the trusted
+// prefixes. The header is attacker-controlled for everyone else, so an untrusted
+// peer (including every peer when trusted is empty) is reported by its own
+// address. Callers that set a header without declaring trusted proxies get the
+// peer address, never the header.
+//
+// The header may carry a chain of hops (X-Forwarded-For appends one per proxy,
+// left to right, so the rightmost is the closest). Only the hops added by the
+// trusted proxies can be believed: the client controls everything to the left of
+// its first trusted proxy and can prepend whatever it likes. So the chain is
+// walked from the right, skipping trusted hops, and the first untrusted one is
+// the client. A single-valued header (X-Real-IP) is a chain of one and needs no
+// special case.
+func ParseRealIP(header string, trusted []netip.Prefix) func(*http.Request) (string, error) {
+	isTrusted := func(ip netip.Addr) bool {
+		return slices.ContainsFunc(trusted, func(n netip.Prefix) bool { return n.Contains(ip) })
+	}
+
+	return func(r *http.Request) (string, error) {
+		remoteAddr, _, err := net.SplitHostPort(r.RemoteAddr)
+		if err != nil {
+			return "", err
+		}
+
+		remoteIP, err := netip.ParseAddr(remoteAddr)
+		if err != nil {
+			return "", err
+		}
+
+		if !isTrusted(remoteIP) {
+			return remoteAddr, nil
+		}
+
+		hops := strings.Split(r.Header.Get(header), ",")
+		for _, hop := range slices.Backward(hops) {
+			ip, err := netip.ParseAddr(strings.TrimSpace(hop))
+			if err != nil {
+				// A malformed hop breaks the chain: nothing to its left can be
+				// attributed to a trusted proxy, so stop and fall back.
+				break
+			}
+			if !isTrusted(ip) {
+				return ip.String(), nil
+			}
+		}
+
+		// Every hop was a trusted proxy, or the header was absent or malformed.
+		return remoteAddr, nil
+	}
+}
diff --git a/server/router/realip_test.go b/server/router/realip_test.go
new file mode 100644
index 0000000000..b913c1d374
--- /dev/null
+++ b/server/router/realip_test.go
@@ -0,0 +1,151 @@
+package router
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"net/netip"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func prefixes(t *testing.T, cidrs ...string) []netip.Prefix {
+	t.Helper()
+	out := make([]netip.Prefix, 0, len(cidrs))
+	for _, c := range cidrs {
+		p, err := netip.ParsePrefix(c)
+		require.NoError(t, err)
+		out = append(out, p)
+	}
+	return out
+}
+
+func TestParseRealIP(t *testing.T) {
+	const header = "X-Forwarded-For"
+
+	tests := []struct {
+		name       string
+		trusted    []string
+		remoteAddr string
+		headerVal  string
+		want       string
+	}{
+		{
+			name:       "trusted proxy, header honored",
+			trusted:    []string{"10.0.0.0/8"},
+			remoteAddr: "10.1.2.3:1234",
+			headerVal:  "203.0.113.9",
+			want:       "203.0.113.9",
+		},
+		{
+			// The resolver used to return on the first prefix that did not match,
+			// so only the first entry of trustedProxies ever took effect.
+			name:       "trusted proxy in a later prefix, header honored",
+			trusted:    []string{"10.0.0.0/8", "192.168.0.0/16"},
+			remoteAddr: "192.168.5.5:1234",
+			headerVal:  "203.0.113.9",
+			want:       "203.0.113.9",
+		},
+		{
+			name:       "untrusted peer, header ignored",
+			trusted:    []string{"10.0.0.0/8"},
+			remoteAddr: "203.0.113.1:1234",
+			headerVal:  "198.51.100.7",
+			want:       "203.0.113.1",
+		},
+		{
+			// Nothing is trusted, so the header is spoofable by any client.
+			name:       "no trusted proxies, header ignored",
+			trusted:    nil,
+			remoteAddr: "203.0.113.1:1234",
+			headerVal:  "198.51.100.7",
+			want:       "203.0.113.1",
+		},
+		{
+			name:       "trusted proxy, no header",
+			trusted:    []string{"10.0.0.0/8"},
+			remoteAddr: "10.1.2.3:1234",
+			want:       "10.1.2.3",
+		},
+		{
+			name:       "trusted proxy, unparseable header",
+			trusted:    []string{"10.0.0.0/8"},
+			remoteAddr: "10.1.2.3:1234",
+			headerVal:  "not-an-ip",
+			want:       "10.1.2.3",
+		},
+		{
+			name:       "IPv6 trusted proxy",
+			trusted:    []string{"2001:db8::/32"},
+			remoteAddr: "[2001:db8::1]:1234",
+			headerVal:  "203.0.113.9",
+			want:       "203.0.113.9",
+		},
+		{
+			// The whole header used to go to netip.ParseAddr, so any chain was
+			// unparseable and the header was dropped for the peer address.
+			name:       "chain through one trusted proxy",
+			trusted:    []string{"10.0.0.0/8"},
+			remoteAddr: "10.1.2.3:1234",
+			headerVal:  "203.0.113.9, 10.1.2.3",
+			want:       "203.0.113.9",
+		},
+		{
+			name:       "chain through several trusted proxies",
+			trusted:    []string{"10.0.0.0/8", "192.168.0.0/16"},
+			remoteAddr: "10.1.2.3:1234",
+			headerVal:  "203.0.113.9, 192.168.1.1, 10.9.9.9",
+			want:       "203.0.113.9",
+		},
+		{
+			// The client prepended a hop of its own. Everything left of the first
+			// untrusted hop is its invention, so the untrusted hop is the client.
+			name:       "client-spoofed hops left of the real client",
+			trusted:    []string{"10.0.0.0/8"},
+			remoteAddr: "10.1.2.3:1234",
+			headerVal:  "1.2.3.4, 198.51.100.7, 10.1.2.3",
+			want:       "198.51.100.7",
+		},
+		{
+			// Nothing left of a malformed hop can be attributed to a proxy.
+			name:       "malformed hop breaks the chain",
+			trusted:    []string{"10.0.0.0/8"},
+			remoteAddr: "10.1.2.3:1234",
+			headerVal:  "203.0.113.9, garbage, 10.1.2.3",
+			want:       "10.1.2.3",
+		},
+		{
+			name:       "every hop is a trusted proxy",
+			trusted:    []string{"10.0.0.0/8"},
+			remoteAddr: "10.1.2.3:1234",
+			headerVal:  "10.9.9.9, 10.1.2.3",
+			want:       "10.1.2.3",
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			resolve := ParseRealIP(header, prefixes(t, tc.trusted...))
+
+			r := httptest.NewRequest(http.MethodGet, "/auth", nil)
+			r.RemoteAddr = tc.remoteAddr
+			if tc.headerVal != "" {
+				r.Header.Set(header, tc.headerVal)
+			}
+
+			got, err := resolve(r)
+			require.NoError(t, err)
+			require.Equal(t, tc.want, got)
+		})
+	}
+}
+
+func TestParseRealIPMalformedRemoteAddr(t *testing.T) {
+	resolve := ParseRealIP("X-Forwarded-For", prefixes(t, "10.0.0.0/8"))
+
+	r := httptest.NewRequest(http.MethodGet, "/auth", nil)
+	r.RemoteAddr = "no-port"
+
+	_, err := resolve(r)
+	require.Error(t, err)
+}
diff --git a/server/router/router.go b/server/router/router.go
new file mode 100644
index 0000000000..6d7712bdd2
--- /dev/null
+++ b/server/router/router.go
@@ -0,0 +1,100 @@
+package router
+
+import (
+	"net/http"
+	"path"
+
+	"github.com/gorilla/handlers"
+	"github.com/gorilla/mux"
+
+	"github.com/dexidp/dex/server/reqctx"
+)
+
+// Mux registers HTTP routes. New returns the implementation used by the server
+// (path prefixing, per-route headers, CORS); handlers only name their routes.
+type Mux interface {
+	// Handle mounts h at pattern.
+	Handle(pattern string, h http.Handler)
+	// HandleFunc mounts h at pattern.
+	HandleFunc(pattern string, h http.HandlerFunc)
+	// HandleCORS mounts h at pattern with cross-origin support (discovery,
+	// token, keys and similar public endpoints).
+	HandleCORS(pattern string, h http.HandlerFunc)
+	// HandlePrefix mounts h for every path under pattern, stripping the prefix.
+	HandlePrefix(pattern string, h http.Handler)
+}
+
+// Handler is a self-contained domain that mounts its own routes on the given
+// Mux. The server collects handlers and calls Mount on each.
+type Handler interface {
+	Mount(Mux)
+}
+
+// Config configures the Mux returned by New.
+type Config struct {
+	// Router is the underlying gorilla router routes are registered on.
+	Router *mux.Router
+	// IssuerPath is prefixed onto every registered route.
+	IssuerPath string
+	// Headers are added to every response.
+	Headers http.Header
+	// RealIPHeader, when set, names the header the real client IP is read from.
+	RealIPHeader string
+	// Instrument wraps a handler with request metrics.
+	Instrument func(name string, h http.Handler) http.HandlerFunc
+	// RealIP extracts the client IP from a request.
+	RealIP func(*http.Request) (string, error)
+	// CORSOrigins / CORSHeaders configure HandleCORS; CORS is skipped when
+	// CORSOrigins is empty.
+	CORSOrigins []string
+	CORSHeaders []string
+}
+
+// New returns a Mux backed by the given config. Handle/HandleFunc/HandleCORS
+// prefix the route with the issuer path and wrap it with the response headers,
+// request-id/real-ip context, and instrumentation. HandlePrefix mounts static
+// asset trees directly (stripped of the prefix) without that wrapping.
+func New(c Config) Mux { return mountMux{c} }
+
+type mountMux struct{ c Config }
+
+// wrap applies the common response headers, request-id/real-ip context, and
+// instrumentation to a handler.
+func (m mountMux) wrap(name string, h http.Handler) http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		for k, v := range m.c.Headers {
+			w.Header()[k] = v
+		}
+		// Context values are used for logging purposes with the log/slog logger.
+		rCtx := reqctx.WithRequestID(r.Context())
+		if m.c.RealIPHeader != "" && m.c.RealIP != nil {
+			if realIP, err := m.c.RealIP(r); err == nil {
+				rCtx = reqctx.WithRemoteIP(rCtx, realIP)
+			}
+		}
+		m.c.Instrument(name, h)(w, r.WithContext(rCtx))
+	}
+}
+
+func (m mountMux) Handle(p string, h http.Handler) {
+	m.c.Router.Handle(path.Join(m.c.IssuerPath, p), m.wrap(p, h))
+}
+
+func (m mountMux) HandleFunc(p string, h http.HandlerFunc) { m.Handle(p, h) }
+
+func (m mountMux) HandlePrefix(p string, h http.Handler) {
+	prefix := path.Join(m.c.IssuerPath, p)
+	m.c.Router.PathPrefix(prefix).Handler(http.StripPrefix(prefix, h))
+}
+
+func (m mountMux) HandleCORS(p string, h http.HandlerFunc) {
+	var handler http.Handler = h
+	if len(m.c.CORSOrigins) > 0 {
+		cors := handlers.CORS(
+			handlers.AllowedOrigins(m.c.CORSOrigins),
+			handlers.AllowedHeaders(m.c.CORSHeaders),
+		)
+		handler = cors(handler)
+	}
+	m.Handle(p, handler)
+}
diff --git a/server/server.go b/server/server.go
old mode 100755
new mode 100644
index df16e655cf..6433b619c3
--- a/server/server.go
+++ b/server/server.go
@@ -2,385 +2,334 @@ package server
 
 import (
 	"context"
-	"crypto/rsa"
-	"encoding/json"
 	"errors"
 	"fmt"
-	"io/fs"
+	"log/slog"
 	"net/http"
-	"net/url"
-	"os"
-	"path"
-	"sort"
-	"strconv"
-	"strings"
-	"sync"
 	"sync/atomic"
 	"time"
 
-	gosundheit "github.com/AppsFlyer/go-sundheit"
-	"github.com/felixge/httpsnoop"
-	"github.com/gorilla/handlers"
 	"github.com/gorilla/mux"
 	"github.com/prometheus/client_golang/prometheus"
-	"golang.org/x/crypto/bcrypt"
-
-	"github.com/dexidp/dex/connector"
-	"github.com/dexidp/dex/connector/atlassiancrowd"
-	"github.com/dexidp/dex/connector/authproxy"
-	"github.com/dexidp/dex/connector/bitbucketcloud"
-	"github.com/dexidp/dex/connector/gitea"
-	"github.com/dexidp/dex/connector/github"
-	"github.com/dexidp/dex/connector/gitlab"
-	"github.com/dexidp/dex/connector/google"
-	"github.com/dexidp/dex/connector/keystone"
-	"github.com/dexidp/dex/connector/ldap"
-	"github.com/dexidp/dex/connector/linkedin"
-	"github.com/dexidp/dex/connector/microsoft"
-	"github.com/dexidp/dex/connector/mock"
-	"github.com/dexidp/dex/connector/oauth"
-	"github.com/dexidp/dex/connector/oidc"
-	"github.com/dexidp/dex/connector/openshift"
-	"github.com/dexidp/dex/connector/saml"
-	"github.com/dexidp/dex/pkg/log"
+	"github.com/prometheus/client_golang/prometheus/promhttp"
+
+	"github.com/dexidp/dex/pkg/featureflags"
+	"github.com/dexidp/dex/server/authflow"
+	"github.com/dexidp/dex/server/backchannel"
+	"github.com/dexidp/dex/server/connectors"
+	"github.com/dexidp/dex/server/consent"
+	"github.com/dexidp/dex/server/device"
+	"github.com/dexidp/dex/server/discovery"
+	"github.com/dexidp/dex/server/grants"
+	"github.com/dexidp/dex/server/home"
+	"github.com/dexidp/dex/server/introspection"
+	"github.com/dexidp/dex/server/logout"
+	"github.com/dexidp/dex/server/mfa"
+	"github.com/dexidp/dex/server/oauth2"
+	"github.com/dexidp/dex/server/router"
+	"github.com/dexidp/dex/server/session"
+	"github.com/dexidp/dex/server/templates"
+	"github.com/dexidp/dex/server/tokens"
+	"github.com/dexidp/dex/server/userinfo"
 	"github.com/dexidp/dex/storage"
-	"github.com/dexidp/dex/web"
 )
 
-// LocalConnector is the local passwordDB connector which is an internal
-// connector maintained by the server.
-const LocalConnector = "local"
-
-// Connector is a connector with resource version metadata.
-type Connector struct {
-	ResourceVersion string
-	Connector       connector.Connector
-}
-
-// Config holds the server's configuration options.
-//
-// Multiple servers using the same storage are expected to be configured identically.
-type Config struct {
-	Issuer string
-
-	// The backing persistence layer.
-	Storage storage.Storage
-
-	// Valid values are "code" to enable the code flow and "token" to enable the implicit
-	// flow. If no response types are supplied this value defaults to "code".
-	SupportedResponseTypes []string
-
-	// List of allowed origins for CORS requests on discovery, token and keys endpoint.
-	// If none are indicated, CORS requests are disabled. Passing in "*" will allow any
-	// domain.
-	AllowedOrigins []string
-
-	// If enabled, the server won't prompt the user to approve authorization requests.
-	// Logging in implies approval.
-	SkipApprovalScreen bool
-
-	// If enabled, the connectors selection page will always be shown even if there's only one
-	AlwaysShowLoginScreen bool
-
-	RotateKeysAfter        time.Duration // Defaults to 6 hours.
-	IDTokensValidFor       time.Duration // Defaults to 24 hours
-	AuthRequestsValidFor   time.Duration // Defaults to 24 hours
-	DeviceRequestsValidFor time.Duration // Defaults to 5 minutes
-
-	// Refresh token expiration settings
-	RefreshTokenPolicy *RefreshTokenPolicy
-
-	// If set, the server will use this connector to handle password grants
-	PasswordConnector string
-
-	GCFrequency time.Duration // Defaults to 5 minutes
-
-	// If specified, the server will use this function for determining time.
-	Now func() time.Time
-
-	Web WebConfig
-
-	Logger log.Logger
-
-	PrometheusRegistry *prometheus.Registry
-
-	HealthChecker gosundheit.Health
-}
-
-// WebConfig holds the server's frontend templates and asset configuration.
-type WebConfig struct {
-	// A file path to static web assets.
-	//
-	// It is expected to contain the following directories:
-	//
-	//   * static - Static static served at "( issuer URL )/static".
-	//   * templates - HTML templates controlled by dex.
-	//   * themes/(theme) - Static static served at "( issuer URL )/theme".
-	Dir string
-
-	// Alternative way to programatically configure static web assets.
-	// If Dir is specified, WebFS is ignored.
-	// It's expected to contain the same files and directories as mentioned above.
-	//
-	// Note: this is experimental. Might get removed without notice!
-	WebFS fs.FS
-
-	// Defaults to "( issuer URL )/theme/logo.png"
-	LogoURL string
-
-	// Defaults to "dex"
-	Issuer string
-
-	// Defaults to "light"
-	Theme string
-
-	// Map of extra values passed into the templates
-	Extra map[string]string
-}
-
-func value(val, defaultValue time.Duration) time.Duration {
-	if val == 0 {
-		return defaultValue
-	}
-	return val
-}
-
 // Server is the top level object.
 type Server struct {
-	issuerURL url.URL
+	issuerURL oauth2.IssuerURL
 
-	// mutex for the connectors map.
-	mu sync.Mutex
-	// Map of connector IDs to connectors.
-	connectors map[string]Connector
+	// In-memory cache of opened connectors.
+	connectors *connectors.Cache
 
 	storage storage.Storage
 
 	mux http.Handler
 
-	templates *templates
-
-	// If enabled, don't prompt user for approval after logging in through connector.
-	skipApproval bool
+	templates *templates.Templates
 
-	// If enabled, show the connector selection screen even if there's only one
-	alwaysShowLogin bool
+	logger *slog.Logger
 
-	// Used for password grant
-	passwordConnector string
+	// issuer turns an Authorization into a TokenSet.
+	issuer *tokens.Issuer
 
-	supportedResponseTypes map[string]bool
+	// sessions owns the session cookie, SSO and auth-session CRUD. Built before the
+	// issuer because the issuer reads it to resolve the "sid" claim.
+	sessions *session.Manager
 
-	supportedGrantTypes []string
+	// discovery is built once from config and shared by the mounted HTTP handler
+	// and the gRPC API's Discovery accessor.
+	discovery *discovery.Handler
 
-	now func() time.Time
+	// backchannel notifies relying parties that a session ended. Shared with the
+	// gRPC API, which ends sessions too.
+	backchannel *backchannel.Notifier
+}
 
-	idTokensValidFor       time.Duration
-	authRequestsValidFor   time.Duration
-	deviceRequestsValidFor time.Duration
+// Connectors is the server's connector cache. The gRPC API needs it to
+// invalidate the cache on connector CRUD.
+func (s *Server) Connectors() *connectors.Cache { return s.connectors }
 
-	refreshTokenPolicy *RefreshTokenPolicy
+// Discovery is the handler that builds the OIDC discovery document. The gRPC
+// API serves the same handler that is mounted for HTTP, so both return an
+// identical document.
+func (s *Server) Discovery() *discovery.Handler { return s.discovery }
 
-	logger log.Logger
-}
+// Backchannel notifies a session's relying parties that it has ended. The gRPC
+// API terminates sessions as well, and an RP cannot tell — and has no reason to
+// care — whether a session ended by logout or by an operator's hand.
+func (s *Server) Backchannel() *backchannel.Notifier { return s.backchannel }
 
 // NewServer constructs a server from the provided config.
 func NewServer(ctx context.Context, c Config) (*Server, error) {
-	return newServer(ctx, c, defaultRotationStrategy(
-		value(c.RotateKeysAfter, 6*time.Hour),
-		value(c.IDTokensValidFor, 24*time.Hour),
-	))
-}
-
-// NewServerWithKey constructs a server from the provided config and a static signing key.
-func NewServerWithKey(ctx context.Context, c Config, privateKey *rsa.PrivateKey) (*Server, error) {
-	return newServer(ctx, c, staticRotationStrategy(
-		privateKey,
-	))
+	return newServer(ctx, c)
 }
 
-func newServer(ctx context.Context, c Config, rotationStrategy rotationStrategy) (*Server, error) {
-	issuerURL, err := url.Parse(c.Issuer)
+func newServer(ctx context.Context, c Config) (*Server, error) {
+	rc, err := normalizeConfig(&c)
 	if err != nil {
-		return nil, fmt.Errorf("server: can't parse issuer URL")
-	}
-
-	if c.Storage == nil {
-		return nil, errors.New("server: storage cannot be nil")
-	}
-
-	if len(c.SupportedResponseTypes) == 0 {
-		c.SupportedResponseTypes = []string{responseTypeCode}
+		return nil, err
 	}
 
-	supportedGrant := []string{grantTypeAuthorizationCode, grantTypeRefreshToken, grantTypeDeviceCode} // default
-	supportedRes := make(map[string]bool)
-
-	for _, respType := range c.SupportedResponseTypes {
-		switch respType {
-		case responseTypeCode, responseTypeIDToken:
-			// continue
-		case responseTypeToken:
-			// response_type=token is an implicit flow, let's add it to the discovery info
-			// https://datatracker.ietf.org/doc/html/rfc6749#section-4.2.1
-			supportedGrant = append(supportedGrant, grantTypeImplicit)
-		default:
-			return nil, fmt.Errorf("unsupported response_type %q", respType)
-		}
-		supportedRes[respType] = true
+	s := &Server{
+		issuerURL: rc.issuerURL,
+		storage:   newKeyCacher(c.Storage, rc.now),
+		templates: rc.templates,
+		logger:    c.Logger,
+	}
+	s.sessions = &session.Manager{
+		Storage:   s.storage,
+		Config:    c.SessionConfig,
+		Now:       rc.now,
+		Logger:    s.logger,
+		IssuerURL: s.issuerURL,
+	}
+	s.issuer = tokens.NewIssuer(s.storage, c.Signer, s.issuerURL.URL, rc.idTokensValidFor, rc.now, s.logger)
+	s.connectors = connectors.NewCache(s.storage, connectors.Resolver(s.storage, s.logger, ConnectorsConfig))
+	s.backchannel = &backchannel.Notifier{
+		Storage:   s.storage,
+		Signer:    c.Signer,
+		IssuerURL: s.issuerURL,
+		Logger:    s.logger,
+		Now:       rc.now,
+	}
+	// Build the discovery handler once from config; both the mounted HTTP route
+	// and the gRPC API (via Discovery) serve this same handler.
+	s.discovery = &discovery.Handler{
+		IssuerURL:       s.issuerURL,
+		Templates:       s.templates,
+		Signer:          c.Signer,
+		Logger:          s.logger,
+		ResponseTypes:   rc.responseTypes,
+		GrantTypes:      rc.grantTypes,
+		PKCEMethods:     c.PKCE.CodeChallengeMethodsSupported,
+		SessionsEnabled: c.SessionConfig != nil,
+	}
+
+	if err := s.openConnectors(ctx, c); err != nil {
+		return nil, err
 	}
 
-	if c.PasswordConnector != "" {
-		supportedGrant = append(supportedGrant, grantTypePassword)
+	if featureflags.SessionsEnabled.Enabled() {
+		s.logger.InfoContext(ctx, "sessions feature flag is enabled")
 	}
 
-	sort.Strings(supportedGrant)
+	r := mux.NewRouter().SkipClean(true).UseEncodedPath()
+	r.NotFoundHandler = http.NotFoundHandler()
+	s.mount(router.New(router.Config{
+		Router:       r,
+		IssuerPath:   s.issuerURL.Path,
+		Headers:      c.Headers,
+		RealIPHeader: c.RealIPHeader,
+		Instrument:   instrumentHandler(c.PrometheusRegistry),
+		RealIP:       router.ParseRealIP(c.RealIPHeader, c.TrustedRealIPCIDRs),
+		CORSOrigins:  c.AllowedOrigins,
+		CORSHeaders:  c.AllowedHeaders,
+	}), c, rc)
+	s.mux = r
 
-	webFS := web.FS()
-	if c.Web.Dir != "" {
-		webFS = os.DirFS(c.Web.Dir)
-	} else if c.Web.WebFS != nil {
-		webFS = c.Web.WebFS
-	}
+	c.Signer.Start(ctx)
+	s.startGarbageCollection(ctx, value(c.GCFrequency, 5*time.Minute), rc.now)
 
-	web := webConfig{
-		webFS:     webFS,
-		logoURL:   c.Web.LogoURL,
-		issuerURL: c.Issuer,
-		issuer:    c.Web.Issuer,
-		theme:     c.Web.Theme,
-		extra:     c.Web.Extra,
-	}
+	return s, nil
+}
 
-	static, theme, tmpls, err := loadWebConfig(web)
+// openConnectors opens every connector in storage into the cache. Nothing is
+// served without at least one, so an empty set is an error; so is a single
+// failure, unless the server is configured to start on a subset.
+func (s *Server) openConnectors(ctx context.Context, c Config) error {
+	// This list includes the static connectors defined in the ConfigMap and
+	// dynamic connectors retrieved from the storage.
+	storageConnectors, err := c.Storage.ListConnectors(ctx)
 	if err != nil {
-		return nil, fmt.Errorf("server: failed to load web static: %v", err)
+		return fmt.Errorf("server: failed to list connector objects from storage: %v", err)
 	}
 
-	now := c.Now
-	if now == nil {
-		now = time.Now
+	if len(storageConnectors) == 0 && s.connectors.Len() == 0 {
+		return errors.New("server: no connectors specified")
 	}
 
-	s := &Server{
-		issuerURL:              *issuerURL,
-		connectors:             make(map[string]Connector),
-		storage:                newKeyCacher(c.Storage, now),
-		supportedResponseTypes: supportedRes,
-		supportedGrantTypes:    supportedGrant,
-		idTokensValidFor:       value(c.IDTokensValidFor, 24*time.Hour),
-		authRequestsValidFor:   value(c.AuthRequestsValidFor, 24*time.Hour),
-		deviceRequestsValidFor: value(c.DeviceRequestsValidFor, 5*time.Minute),
-		refreshTokenPolicy:     c.RefreshTokenPolicy,
-		skipApproval:           c.SkipApprovalScreen,
-		alwaysShowLogin:        c.AlwaysShowLoginScreen,
-		now:                    now,
-		templates:              tmpls,
-		passwordConnector:      c.PasswordConnector,
-		logger:                 c.Logger,
+	var failedCount int
+	for _, conn := range storageConnectors {
+		if _, err := s.connectors.Open(conn); err != nil {
+			failedCount++
+			if c.ContinueOnConnectorFailure {
+				s.logger.Error("server: Failed to open connector", "id", conn.ID, "err", err)
+				continue
+			}
+			return fmt.Errorf("server: Failed to open connector %s: %v", conn.ID, err)
+		}
 	}
 
-	// Retrieves connector objects in backend storage. This list includes the static connectors
-	// defined in the ConfigMap and dynamic connectors retrieved from the storage.
-	storageConnectors, err := c.Storage.ListConnectors()
-	if err != nil {
-		return nil, fmt.Errorf("server: failed to list connector objects from storage: %v", err)
+	if c.ContinueOnConnectorFailure && failedCount == len(storageConnectors) {
+		return fmt.Errorf("server: failed to open all connectors (%d/%d)", failedCount, len(storageConnectors))
 	}
 
-	if len(storageConnectors) == 0 && len(s.connectors) == 0 {
-		return nil, errors.New("server: no connectors specified")
-	}
+	return nil
+}
 
-	for _, conn := range storageConnectors {
-		if _, err := s.OpenConnector(conn); err != nil {
-			return nil, fmt.Errorf("server: Failed to open connector %s: %v", conn.ID, err)
-		}
+// instrumentHandler returns the per-route metrics wrapper the mux applies. With
+// no registry it is the identity wrapper, so metrics stay opt-in.
+func instrumentHandler(registry *prometheus.Registry) func(string, http.Handler) http.HandlerFunc {
+	if registry == nil {
+		return func(_ string, handler http.Handler) http.HandlerFunc { return handler.ServeHTTP }
 	}
 
-	instrumentHandlerCounter := func(_ string, handler http.Handler) http.HandlerFunc {
-		return handler.ServeHTTP
-	}
+	requestCounter := prometheus.NewCounterVec(prometheus.CounterOpts{
+		Name: "http_requests_total",
+		Help: "Count of all HTTP requests.",
+	}, []string{"code", "method", "handler"})
 
-	if c.PrometheusRegistry != nil {
-		requestCounter := prometheus.NewCounterVec(prometheus.CounterOpts{
-			Name: "http_requests_total",
-			Help: "Count of all HTTP requests.",
-		}, []string{"handler", "code", "method"})
+	durationHist := prometheus.NewHistogramVec(prometheus.HistogramOpts{
+		Name:    "request_duration_seconds",
+		Help:    "A histogram of latencies for requests.",
+		Buckets: []float64{.25, .5, 1, 2.5, 5, 10},
+	}, []string{"code", "method", "handler"})
 
-		err = c.PrometheusRegistry.Register(requestCounter)
-		if err != nil {
-			return nil, fmt.Errorf("server: Failed to register Prometheus HTTP metrics: %v", err)
-		}
+	sizeHist := prometheus.NewHistogramVec(prometheus.HistogramOpts{
+		Name:    "response_size_bytes",
+		Help:    "A histogram of response sizes for requests.",
+		Buckets: []float64{200, 500, 900, 1500},
+	}, []string{"code", "method", "handler"})
 
-		instrumentHandlerCounter = func(handlerName string, handler http.Handler) http.HandlerFunc {
-			return func(w http.ResponseWriter, r *http.Request) {
-				m := httpsnoop.CaptureMetrics(handler, w, r)
-				requestCounter.With(prometheus.Labels{"handler": handlerName, "code": strconv.Itoa(m.Code), "method": r.Method}).Inc()
-			}
-		}
-	}
+	registry.MustRegister(requestCounter, durationHist, sizeHist)
 
-	r := mux.NewRouter().SkipClean(true).UseEncodedPath()
-	handle := func(p string, h http.Handler) {
-		r.Handle(path.Join(issuerURL.Path, p), instrumentHandlerCounter(p, h))
-	}
-	handleFunc := func(p string, h http.HandlerFunc) {
-		handle(p, h)
-	}
-	handlePrefix := func(p string, h http.Handler) {
-		prefix := path.Join(issuerURL.Path, p)
-		r.PathPrefix(prefix).Handler(http.StripPrefix(prefix, h))
-	}
-	handleWithCORS := func(p string, h http.HandlerFunc) {
-		var handler http.Handler = h
-		if len(c.AllowedOrigins) > 0 {
-			allowedHeaders := []string{
-				"Authorization",
-			}
-			cors := handlers.CORS(
-				handlers.AllowedOrigins(c.AllowedOrigins),
-				handlers.AllowedHeaders(allowedHeaders),
-			)
-			handler = cors(handler)
-		}
-		r.Handle(path.Join(issuerURL.Path, p), instrumentHandlerCounter(p, handler))
+	return func(handlerName string, handler http.Handler) http.HandlerFunc {
+		return promhttp.InstrumentHandlerDuration(durationHist.MustCurryWith(prometheus.Labels{"handler": handlerName}),
+			promhttp.InstrumentHandlerCounter(requestCounter.MustCurryWith(prometheus.Labels{"handler": handlerName}),
+				promhttp.InstrumentHandlerResponseSize(sizeHist.MustCurryWith(prometheus.Labels{"handler": handlerName}), handler),
+			),
+		)
 	}
-	r.NotFoundHandler = http.NotFoundHandler()
+}
 
-	discoveryHandler, err := s.discoveryHandler()
-	if err != nil {
-		return nil, err
-	}
-	handleWithCORS("/.well-known/openid-configuration", discoveryHandler)
-
-	// TODO(ericchiang): rate limit certain paths based on IP.
-	handleWithCORS("/token", s.handleToken)
-	handleWithCORS("/keys", s.handlePublicKeys)
-	handleWithCORS("/userinfo", s.handleUserInfo)
-	handleFunc("/auth", s.handleAuthorization)
-	handleFunc("/auth/{connector}", s.handleConnectorLogin)
-	handleFunc("/auth/{connector}/login", s.handlePasswordLogin)
-	handleFunc("/device", s.handleDeviceExchange)
-	handleFunc("/device/auth/verify_code", s.verifyUserCode)
-	handleFunc("/device/code", s.handleDeviceCode)
-	// TODO(nabokihms): "/device/token" endpoint is deprecated, consider using /token endpoint instead
-	handleFunc("/device/token", s.handleDeviceTokenDeprecated)
-	handleFunc(deviceCallbackURI, s.handleDeviceCallback)
-	r.HandleFunc(path.Join(issuerURL.Path, "/callback"), func(w http.ResponseWriter, r *http.Request) {
-		// Strip the X-Remote-* headers to prevent security issues on
-		// misconfigured authproxy connector setups.
-		for key := range r.Header {
-			if strings.HasPrefix(strings.ToLower(key), "x-remote-") {
-				r.Header.Del(key)
-			}
-		}
-		s.handleConnectorCallback(w, r)
-	})
-	// For easier connector-specific web server configuration, e.g. for the
-	// "authproxy" connector.
-	handleFunc("/callback/{connector}", s.handleConnectorCallback)
-	handleFunc("/approval", s.handleApproval)
-	handle("/healthz", http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+// mount wires every domain onto routes. Self-contained domains mount their own
+// routes through the router.Mux abstraction; this is the only place they are
+// wired in.
+func (s *Server) mount(routes router.Mux, c Config, rc resolvedConfig) {
+	// sessions is shared infrastructure (session cookie, SSO, auth-session CRUD)
+	// referenced by the flow steps mounted below. The steps themselves hold no
+	// reference to one another; the /auth dispatcher decides MFA and consent from
+	// persisted state and config, so mfa and consent are mounted inline like the
+	// rest.
+	sessions := s.sessions
+
+	for _, h := range []router.Handler{
+		s.discovery,
+		&grants.Handler{
+			Issuer:              s.issuer,
+			Storage:             s.storage,
+			Connectors:          s.connectors,
+			Now:                 rc.now,
+			Logger:              s.logger,
+			PasswordConnector:   c.PasswordConnector,
+			RefreshPolicy:       c.RefreshTokenPolicy,
+			Sessions:            sessions,
+			SessionsEnabled:     c.SessionConfig != nil,
+			SupportedGrantTypes: rc.grantTypes,
+		},
+		&userinfo.Handler{
+			Issuer: s.issuerURL.String(),
+			Signer: c.Signer,
+			Logger: s.logger,
+		},
+		&introspection.Handler{
+			Issuer:        s.issuerURL.String(),
+			Signer:        c.Signer,
+			Storage:       s.storage,
+			Logger:        s.logger,
+			RefreshPolicy: c.RefreshTokenPolicy,
+			Sessions:      sessions,
+		},
+		&device.Handler{
+			IssuerURL:        s.issuerURL,
+			Storage:          s.storage,
+			Templates:        s.templates,
+			Now:              rc.now,
+			RequestsValidFor: rc.deviceRequestsValidFor,
+			Logger:           s.logger,
+			Issuer:           s.issuer,
+			Connectors:       s.connectors,
+		},
+		&home.Handler{
+			IssuerURL: s.issuerURL,
+			Storage:   s.storage,
+			Templates: s.templates,
+			Logger:    s.logger,
+			Sessions:  sessions,
+		},
+		&authflow.Handler{
+			IssuerURL:              s.issuerURL,
+			Connectors:             s.connectors,
+			Storage:                s.storage,
+			Templates:              s.templates,
+			Signer:                 c.Signer,
+			Now:                    rc.now,
+			Logger:                 s.logger,
+			AlwaysShowLogin:        c.AlwaysShowLoginScreen,
+			SupportedResponseTypes: rc.responseTypes,
+			PKCE:                   c.PKCE,
+			AuthRequestsValidFor:   rc.authRequestsValidFor,
+			Sessions:               sessions,
+			Issuer:                 s.issuer,
+			MFAEnabled:             len(c.MFAProviders) > 0,
+			DefaultMFAChain:        c.DefaultMFAChain,
+			SkipApproval:           c.SkipApprovalScreen,
+		},
+		&mfa.Handler{
+			Storage:         s.storage,
+			Templates:       s.templates,
+			Logger:          s.logger,
+			IssuerURL:       s.issuerURL,
+			MFAProviders:    c.MFAProviders,
+			DefaultMFAChain: c.DefaultMFAChain,
+			Now:             rc.now,
+			Connectors:      s.connectors,
+		},
+		&consent.Handler{
+			Storage:      s.storage,
+			Templates:    s.templates,
+			Logger:       s.logger,
+			IssuerURL:    s.issuerURL,
+			Sessions:     sessions,
+			SkipApproval: c.SkipApprovalScreen,
+		},
+		&logout.Handler{
+			Storage:     s.storage,
+			Templates:   s.templates,
+			Logger:      s.logger,
+			Sessions:    sessions,
+			Connectors:  s.connectors,
+			Issuer:      s.issuer,
+			Signer:      c.Signer,
+			IssuerURL:   s.issuerURL,
+			Now:         rc.now,
+			Backchannel: s.backchannel,
+		},
+	} {
+		h.Mount(routes)
+	}
+
+	routes.Handle("/healthz", http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		if !c.HealthChecker.IsHealthy() {
 			s.renderError(r, w, http.StatusInternalServerError, "Health check failed.")
 			return
@@ -388,97 +337,15 @@ func newServer(ctx context.Context, c Config, rotationStrategy rotationStrategy)
 		fmt.Fprintf(w, "Health check passed")
 	}))
 
-	handlePrefix("/static", static)
-	handlePrefix("/theme", theme)
-	s.mux = r
-
-	s.startKeyRotation(ctx, rotationStrategy, now)
-	s.startGarbageCollection(ctx, value(c.GCFrequency, 5*time.Minute), now)
-
-	return s, nil
+	routes.HandlePrefix("/static", rc.static)
+	routes.HandlePrefix("/theme", rc.theme)
+	routes.HandleFunc("/robots.txt", rc.robots)
 }
 
 func (s *Server) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 	s.mux.ServeHTTP(w, r)
 }
 
-func (s *Server) absPath(pathItems ...string) string {
-	paths := make([]string, len(pathItems)+1)
-	paths[0] = s.issuerURL.Path
-	copy(paths[1:], pathItems)
-	return path.Join(paths...)
-}
-
-func (s *Server) absURL(pathItems ...string) string {
-	u := s.issuerURL
-	u.Path = s.absPath(pathItems...)
-	return u.String()
-}
-
-func newPasswordDB(s storage.Storage) interface {
-	connector.Connector
-	connector.PasswordConnector
-} {
-	return passwordDB{s}
-}
-
-type passwordDB struct {
-	s storage.Storage
-}
-
-func (db passwordDB) Login(ctx context.Context, s connector.Scopes, email, password string) (connector.Identity, bool, error) {
-	p, err := db.s.GetPassword(email)
-	if err != nil {
-		if err != storage.ErrNotFound {
-			return connector.Identity{}, false, fmt.Errorf("get password: %v", err)
-		}
-		return connector.Identity{}, false, nil
-	}
-	// This check prevents dex users from logging in using static passwords
-	// configured with hash costs that are too high or low.
-	if err := checkCost(p.Hash); err != nil {
-		return connector.Identity{}, false, err
-	}
-	if err := bcrypt.CompareHashAndPassword(p.Hash, []byte(password)); err != nil {
-		return connector.Identity{}, false, nil
-	}
-	return connector.Identity{
-		UserID:        p.UserID,
-		Username:      p.Username,
-		Email:         p.Email,
-		EmailVerified: true,
-	}, true, nil
-}
-
-func (db passwordDB) Refresh(ctx context.Context, s connector.Scopes, identity connector.Identity) (connector.Identity, error) {
-	// If the user has been deleted, the refresh token will be rejected.
-	p, err := db.s.GetPassword(identity.Email)
-	if err != nil {
-		if err == storage.ErrNotFound {
-			return connector.Identity{}, errors.New("user not found")
-		}
-		return connector.Identity{}, fmt.Errorf("get password: %v", err)
-	}
-
-	// User removed but a new user with the same email exists.
-	if p.UserID != identity.UserID {
-		return connector.Identity{}, errors.New("user not found")
-	}
-
-	// If a user has updated their username, that will be reflected in the
-	// refreshed token.
-	//
-	// No other fields are expected to be refreshable as email is effectively used
-	// as an ID and this implementation doesn't deal with groups.
-	identity.Username = p.Username
-
-	return identity, nil
-}
-
-func (db passwordDB) Prompt() string {
-	return "Email Address"
-}
-
 // newKeyCacher returns a storage which caches keys so long as the next
 func newKeyCacher(s storage.Storage, now func() time.Time) storage.Storage {
 	if now == nil {
@@ -494,13 +361,13 @@ type keyCacher struct {
 	keys atomic.Value // Always holds nil or type *storage.Keys.
 }
 
-func (k *keyCacher) GetKeys() (storage.Keys, error) {
+func (k *keyCacher) GetKeys(ctx context.Context) (storage.Keys, error) {
 	keys, ok := k.keys.Load().(*storage.Keys)
 	if ok && keys != nil && k.now().Before(keys.NextRotation) {
 		return *keys, nil
 	}
 
-	storageKeys, err := k.Storage.GetKeys()
+	storageKeys, err := k.Storage.GetKeys(ctx)
 	if err != nil {
 		return storageKeys, err
 	}
@@ -518,119 +385,21 @@ func (s *Server) startGarbageCollection(ctx context.Context, frequency time.Dura
 			case <-ctx.Done():
 				return
 			case <-time.After(frequency):
-				if r, err := s.storage.GarbageCollect(now()); err != nil {
-					s.logger.Errorf("garbage collection failed: %v", err)
+				if r, err := s.storage.GarbageCollect(ctx, now()); err != nil {
+					s.logger.ErrorContext(ctx, "garbage collection failed", "err", err)
 				} else if !r.IsEmpty() {
-					s.logger.Infof("garbage collection run, delete auth requests=%d, auth codes=%d, device requests=%d, device tokens=%d",
-						r.AuthRequests, r.AuthCodes, r.DeviceRequests, r.DeviceTokens)
+					s.logger.InfoContext(ctx, "garbage collection run, delete auth",
+						"requests", r.AuthRequests, "auth_codes", r.AuthCodes,
+						"device_requests", r.DeviceRequests, "device_tokens", r.DeviceTokens,
+						"auth_sessions", r.AuthSessions)
 				}
 			}
 		}
 	}()
 }
 
-// ConnectorConfig is a configuration that can open a connector.
-type ConnectorConfig interface {
-	Open(id string, logger log.Logger) (connector.Connector, error)
-}
-
-// ConnectorsConfig variable provides an easy way to return a config struct
-// depending on the connector type.
-var ConnectorsConfig = map[string]func() ConnectorConfig{
-	"keystone":        func() ConnectorConfig { return new(keystone.Config) },
-	"mockCallback":    func() ConnectorConfig { return new(mock.CallbackConfig) },
-	"mockPassword":    func() ConnectorConfig { return new(mock.PasswordConfig) },
-	"ldap":            func() ConnectorConfig { return new(ldap.Config) },
-	"gitea":           func() ConnectorConfig { return new(gitea.Config) },
-	"github":          func() ConnectorConfig { return new(github.Config) },
-	"gitlab":          func() ConnectorConfig { return new(gitlab.Config) },
-	"google":          func() ConnectorConfig { return new(google.Config) },
-	"oidc":            func() ConnectorConfig { return new(oidc.Config) },
-	"oauth":           func() ConnectorConfig { return new(oauth.Config) },
-	"saml":            func() ConnectorConfig { return new(saml.Config) },
-	"authproxy":       func() ConnectorConfig { return new(authproxy.Config) },
-	"linkedin":        func() ConnectorConfig { return new(linkedin.Config) },
-	"microsoft":       func() ConnectorConfig { return new(microsoft.Config) },
-	"bitbucket-cloud": func() ConnectorConfig { return new(bitbucketcloud.Config) },
-	"openshift":       func() ConnectorConfig { return new(openshift.Config) },
-	"atlassian-crowd": func() ConnectorConfig { return new(atlassiancrowd.Config) },
-	// Keep around for backwards compatibility.
-	"samlExperimental": func() ConnectorConfig { return new(saml.Config) },
-}
-
-// openConnector will parse the connector config and open the connector.
-func openConnector(logger log.Logger, conn storage.Connector) (connector.Connector, error) {
-	var c connector.Connector
-
-	f, ok := ConnectorsConfig[conn.Type]
-	if !ok {
-		return c, fmt.Errorf("unknown connector type %q", conn.Type)
-	}
-
-	connConfig := f()
-	if len(conn.Config) != 0 {
-		data := []byte(string(conn.Config))
-		if err := json.Unmarshal(data, connConfig); err != nil {
-			return c, fmt.Errorf("parse connector config: %v", err)
-		}
-	}
-
-	c, err := connConfig.Open(conn.ID, logger)
-	if err != nil {
-		return c, fmt.Errorf("failed to create connector %s: %v", conn.ID, err)
-	}
-
-	return c, nil
-}
-
-// OpenConnector updates server connector map with specified connector object.
-func (s *Server) OpenConnector(conn storage.Connector) (Connector, error) {
-	var c connector.Connector
-
-	if conn.Type == LocalConnector {
-		c = newPasswordDB(s.storage)
-	} else {
-		var err error
-		c, err = openConnector(s.logger, conn)
-		if err != nil {
-			return Connector{}, fmt.Errorf("failed to open connector: %v", err)
-		}
-	}
-
-	connector := Connector{
-		ResourceVersion: conn.ResourceVersion,
-		Connector:       c,
-	}
-	s.mu.Lock()
-	s.connectors[conn.ID] = connector
-	s.mu.Unlock()
-
-	return connector, nil
-}
-
-// getConnector retrieves the connector object with the given id from the storage
-// and updates the connector list for server if necessary.
-func (s *Server) getConnector(id string) (Connector, error) {
-	storageConnector, err := s.storage.GetConnector(id)
-	if err != nil {
-		return Connector{}, fmt.Errorf("failed to get connector object from storage: %v", err)
-	}
-
-	var conn Connector
-	var ok bool
-	s.mu.Lock()
-	conn, ok = s.connectors[id]
-	s.mu.Unlock()
-
-	if !ok || storageConnector.ResourceVersion != conn.ResourceVersion {
-		// Connector object does not exist in server connectors map or
-		// has been updated in the storage. Need to get latest.
-		conn, err := s.OpenConnector(storageConnector)
-		if err != nil {
-			return Connector{}, fmt.Errorf("failed to open connector: %v", err)
-		}
-		return conn, nil
-	}
-
-	return conn, nil
+// renderError renders a user-facing error page for the non-flow endpoints the
+// server still serves directly (e.g. /healthz).
+func (s *Server) renderError(r *http.Request, w http.ResponseWriter, status int, description string) {
+	templates.RenderError(s.templates, s.logger, r, w, status, description)
 }
diff --git a/server/server_approval_test.go b/server/server_approval_test.go
new file mode 100644
index 0000000000..96ec32343c
--- /dev/null
+++ b/server/server_approval_test.go
@@ -0,0 +1,323 @@
+package server
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"net/http"
+	"net/http/httptest"
+	"net/url"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/require"
+
+	"github.com/dexidp/dex/server/internal"
+	"github.com/dexidp/dex/server/oauth2"
+	"github.com/dexidp/dex/storage"
+)
+
+func TestSkipApprovalWithExistingConsent(t *testing.T) {
+	ctx := t.Context()
+	setSessionsEnabled(t, true)
+
+	connID := "mock"
+	authReqID := "test-consent-skip"
+	expiry := time.Now().Add(100 * time.Second)
+
+	tests := []struct {
+		name        string
+		consents    map[string][]string
+		scopes      []string
+		clientID    string
+		forcePrompt bool
+		wantPath    string
+	}{
+		{
+			name:     "Existing consent covers requested scopes",
+			consents: map[string][]string{"test": {"email", "profile"}},
+			scopes:   []string{"openid", "email", "profile"},
+			clientID: "test",
+			wantPath: "/cb",
+		},
+		{
+			name:     "Existing consent missing a scope",
+			consents: map[string][]string{"test": {"email"}},
+			scopes:   []string{"openid", "email", "profile"},
+			clientID: "test",
+			wantPath: "/approval",
+		},
+		{
+			name:        "Force approval overrides consent",
+			consents:    map[string][]string{"test": {"email", "profile"}},
+			scopes:      []string{"openid", "email", "profile"},
+			clientID:    "test",
+			forcePrompt: true,
+			wantPath:    "/approval",
+		},
+		{
+			name:     "No consent for this client",
+			consents: map[string][]string{"other-client": {"email"}},
+			scopes:   []string{"openid", "email"},
+			clientID: "test",
+			wantPath: "/approval",
+		},
+		{
+			name:     "Only openid scope - skip with empty consent",
+			consents: map[string][]string{"test": {}},
+			scopes:   []string{"openid"},
+			clientID: "test",
+			wantPath: "/cb",
+		},
+		{
+			name:     "offline_access requires consent",
+			consents: map[string][]string{"test": {}},
+			scopes:   []string{"openid", "offline_access"},
+			clientID: "test",
+			wantPath: "/approval",
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			httpServer, s := newTestServer(t, func(c *Config) {
+				c.SkipApprovalScreen = false
+				c.Now = time.Now
+			})
+			defer httpServer.Close()
+
+			// Pre-create UserIdentity with consents
+			require.NoError(t, s.storage.CreateUserIdentity(ctx, storage.UserIdentity{
+				UserID:      "0-385-28089-0",
+				ConnectorID: connID,
+				Claims: storage.Claims{
+					UserID:        "0-385-28089-0",
+					Username:      "Kilgore Trout",
+					Email:         "kilgore@kilgore.trout",
+					EmailVerified: true,
+				},
+				Consents:  tc.consents,
+				CreatedAt: time.Now(),
+				LastLogin: time.Now(),
+			}))
+
+			authReq := storage.AuthRequest{
+				ID:                  authReqID,
+				ConnectorID:         connID,
+				ClientID:            tc.clientID,
+				RedirectURI:         "cb",
+				Expiry:              expiry,
+				ResponseTypes:       []string{oauth2.ResponseTypeCode},
+				Scopes:              tc.scopes,
+				ForceApprovalPrompt: tc.forcePrompt,
+			}
+			require.NoError(t, s.storage.CreateAuthRequest(ctx, authReq))
+
+			rr := httptest.NewRecorder()
+			reqPath := fmt.Sprintf("/callback/%s?state=%s", connID, authReqID)
+			s.ServeHTTP(rr, httptest.NewRequest("GET", reqPath, nil))
+
+			require.Equal(t, 303, rr.Code)
+			_, restPath := followFlow(t, s, rr)
+			require.Equal(t, tc.wantPath, restPath)
+		})
+	}
+}
+
+func TestConsentPersistedOnApproval(t *testing.T) {
+	ctx := t.Context()
+	setSessionsEnabled(t, true)
+
+	httpServer, s := newTestServer(t, nil)
+	defer httpServer.Close()
+
+	userID := "test-user"
+	connectorID := "mock"
+	clientID := "test"
+
+	// Pre-create UserIdentity (would have been created during login)
+	require.NoError(t, s.storage.CreateUserIdentity(ctx, storage.UserIdentity{
+		UserID:      userID,
+		ConnectorID: connectorID,
+		Claims:      storage.Claims{UserID: userID},
+		Consents:    make(map[string][]string),
+		CreatedAt:   time.Now(),
+		LastLogin:   time.Now(),
+	}))
+
+	authReq := storage.AuthRequest{
+		ID:            "approval-consent-test",
+		ClientID:      clientID,
+		ConnectorID:   connectorID,
+		ResponseTypes: []string{oauth2.ResponseTypeCode},
+		RedirectURI:   "https://client.example/callback",
+		Expiry:        time.Now().Add(time.Minute),
+		LoggedIn:      true,
+		Claims:        storage.Claims{UserID: userID},
+		Scopes:        []string{"openid", "email", "profile"},
+		HMACKey:       []byte("consent-test-key"),
+	}
+	require.NoError(t, s.storage.CreateAuthRequest(ctx, authReq))
+
+	mac := internal.SignStep(authReq, internal.StepApproval)
+
+	form := url.Values{
+		"approval": {"approve"},
+		"req":      {authReq.ID},
+		"hmac":     {mac},
+	}
+
+	rr := httptest.NewRecorder()
+	req := httptest.NewRequest(http.MethodPost, "/approval", strings.NewReader(form.Encode()))
+	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+	s.ServeHTTP(rr, req)
+
+	require.Equal(t, http.StatusSeeOther, rr.Code, "approval should redirect")
+
+	ui, err := s.storage.GetUserIdentity(ctx, userID, connectorID)
+	require.NoError(t, err, "UserIdentity should exist")
+	require.Equal(t, []string{"openid", "email", "profile"}, ui.Consents[clientID], "approved scopes should be persisted")
+}
+
+// TestConsentSurvivesSessionDeletion verifies that UserIdentity.Consents
+// persists independently from AuthSession lifecycle (logout should not
+// clear consent decisions).
+func TestConsentSurvivesSessionDeletion(t *testing.T) {
+	ctx := t.Context()
+
+	httpServer, s := newTestServerWithSessions(t, nil)
+	defer httpServer.Close()
+
+	userID := "test-user"
+	connectorID := "mock"
+	clientID := "test-client"
+
+	// Create UserIdentity with existing consents.
+	require.NoError(t, s.storage.CreateUserIdentity(ctx, storage.UserIdentity{
+		UserID:      userID,
+		ConnectorID: connectorID,
+		Claims:      storage.Claims{UserID: userID, Username: "testuser"},
+		Consents:    map[string][]string{clientID: {"openid", "email", "profile"}},
+		CreatedAt:   time.Now(),
+		LastLogin:   time.Now(),
+	}))
+
+	// Create and then delete the session (simulating logout).
+	require.NoError(t, s.storage.CreateAuthSession(ctx, storage.AuthSession{
+		ID: "nonce", Secret: testSessionSecret("nonce"),
+		UserID: userID, ConnectorID: connectorID,
+		CreatedAt: time.Now(), LastActivity: time.Now(),
+	}))
+	require.NoError(t, s.storage.DeleteAuthSession(ctx, "nonce"))
+
+	// Session is gone.
+	_, err := s.storage.GetAuthSession(ctx, "nonce")
+	require.ErrorIs(t, err, storage.ErrNotFound)
+
+	// Consent survives.
+	ui, err := s.storage.GetUserIdentity(ctx, userID, connectorID)
+	require.NoError(t, err)
+	require.Equal(t, []string{"openid", "email", "profile"}, ui.Consents[clientID],
+		"consent should survive session deletion")
+}
+
+type getAuthRequestErrorStorage struct {
+	storage.Storage
+	err error
+}
+
+func (s *getAuthRequestErrorStorage) GetAuthRequest(context.Context, string) (storage.AuthRequest, error) {
+	return storage.AuthRequest{}, s.err
+}
+
+func TestHandleApprovalGetAuthRequestErrorGET(t *testing.T) {
+	httpServer, server := newTestServer(t, func(c *Config) {
+		c.Storage = &getAuthRequestErrorStorage{Storage: c.Storage, err: errors.New("storage unavailable")}
+	})
+	defer httpServer.Close()
+
+	rr := httptest.NewRecorder()
+	req := httptest.NewRequest(http.MethodGet, "/approval?req=any&hmac=AQ", nil)
+
+	server.ServeHTTP(rr, req)
+
+	require.Equal(t, http.StatusInternalServerError, rr.Code)
+	require.Contains(t, rr.Body.String(), "Database error.")
+}
+
+func TestHandleApprovalGetAuthRequestNotFoundGET(t *testing.T) {
+	httpServer, server := newTestServer(t, nil)
+	defer httpServer.Close()
+
+	rr := httptest.NewRecorder()
+	req := httptest.NewRequest(http.MethodGet, "/approval?req=does-not-exist&hmac=AQ", nil)
+
+	server.ServeHTTP(rr, req)
+
+	require.Equal(t, http.StatusBadRequest, rr.Code)
+	require.Contains(t, rr.Body.String(), "User session error.")
+	require.NotContains(t, rr.Body.String(), "Database error.")
+}
+
+func TestHandleApprovalGetAuthRequestNotFoundPOST(t *testing.T) {
+	httpServer, server := newTestServer(t, nil)
+	defer httpServer.Close()
+
+	body := strings.NewReader("approval=approve&req=does-not-exist&hmac=AQ")
+	rr := httptest.NewRecorder()
+	req := httptest.NewRequest(http.MethodPost, "/approval", body)
+	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+
+	server.ServeHTTP(rr, req)
+
+	require.Equal(t, http.StatusBadRequest, rr.Code)
+	require.Contains(t, rr.Body.String(), "User session error.")
+	require.NotContains(t, rr.Body.String(), "Database error.")
+}
+
+func TestHandleApprovalDoubleSubmitPOST(t *testing.T) {
+	ctx := t.Context()
+	httpServer, server := newTestServer(t, nil)
+	defer httpServer.Close()
+
+	authReq := storage.AuthRequest{
+		ID:            "approval-double-submit",
+		ClientID:      "test",
+		ResponseTypes: []string{oauth2.ResponseTypeCode},
+		RedirectURI:   "https://client.example/callback",
+		Expiry:        time.Now().Add(time.Minute),
+		LoggedIn:      true,
+		MFAValidated:  true,
+		HMACKey:       []byte("approval-double-submit-key"),
+	}
+	require.NoError(t, server.storage.CreateAuthRequest(ctx, authReq))
+
+	mac := internal.SignStep(authReq, internal.StepApproval)
+
+	form := url.Values{
+		"approval": {"approve"},
+		"req":      {authReq.ID},
+		"hmac":     {mac},
+	}
+
+	firstRR := httptest.NewRecorder()
+	firstReq := httptest.NewRequest(http.MethodPost, "/approval", strings.NewReader(form.Encode()))
+	firstReq.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+	server.ServeHTTP(firstRR, firstReq)
+
+	require.Equal(t, http.StatusSeeOther, firstRR.Code)
+	// Approval hands off to issuance; following the chain issues the code and
+	// consumes the auth request.
+	finalRR, _ := followFlow(t, server, firstRR)
+	require.Contains(t, finalRR.Header().Get("Location"), "https://client.example/callback")
+
+	secondRR := httptest.NewRecorder()
+	secondReq := httptest.NewRequest(http.MethodPost, "/approval", strings.NewReader(form.Encode()))
+	secondReq.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+	server.ServeHTTP(secondRR, secondReq)
+
+	require.Equal(t, http.StatusBadRequest, secondRR.Code)
+	require.Contains(t, secondRR.Body.String(), "User session error.")
+	require.NotContains(t, secondRR.Body.String(), "Database error.")
+}
diff --git a/server/server_authorize_test.go b/server/server_authorize_test.go
new file mode 100644
index 0000000000..58a732968a
--- /dev/null
+++ b/server/server_authorize_test.go
@@ -0,0 +1,397 @@
+package server
+
+import (
+	"fmt"
+	"net/http"
+	"net/http/httptest"
+	"net/url"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/require"
+
+	"github.com/dexidp/dex/server/internal"
+	"github.com/dexidp/dex/server/oauth2"
+	"github.com/dexidp/dex/server/session"
+	"github.com/dexidp/dex/storage"
+)
+
+func TestHandleAuthorizationConnectorGrantTypeFiltering(t *testing.T) {
+	tests := []struct {
+		name string
+		// grantTypes per connector ID; nil means unrestricted
+		connectorGrantTypes map[string][]string
+		responseType        string
+		wantCode            int
+		// wantRedirectContains is checked when wantCode == 302
+		wantRedirectContains string
+		// wantBodyContains is checked when wantCode != 302
+		wantBodyContains string
+	}{
+		{
+			name: "one connector filtered, redirect to remaining",
+			connectorGrantTypes: map[string][]string{
+				"mock":  {oauth2.GrantTypeDeviceCode},
+				"mock2": nil,
+			},
+			responseType:         "code",
+			wantCode:             http.StatusFound,
+			wantRedirectContains: "/auth/mock2",
+		},
+		{
+			name: "all connectors filtered",
+			connectorGrantTypes: map[string][]string{
+				"mock":  {oauth2.GrantTypeDeviceCode},
+				"mock2": {oauth2.GrantTypeDeviceCode},
+			},
+			responseType:     "code",
+			wantCode:         http.StatusBadRequest,
+			wantBodyContains: "No connectors available",
+		},
+		{
+			name: "no restrictions, both available",
+			connectorGrantTypes: map[string][]string{
+				"mock":  nil,
+				"mock2": nil,
+			},
+			responseType: "code",
+			wantCode:     http.StatusOK,
+		},
+		{
+			name: "implicit flow filters auth_code-only connector",
+			connectorGrantTypes: map[string][]string{
+				"mock":  {oauth2.GrantTypeAuthorizationCode},
+				"mock2": nil,
+			},
+			responseType:         "token",
+			wantCode:             http.StatusFound,
+			wantRedirectContains: "/auth/mock2",
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			ctx := t.Context()
+			httpServer, s := newTestServerMultipleConnectors(t, func(c *Config) {
+				c.Storage.CreateClient(ctx, storage.Client{
+					ID:           "test",
+					RedirectURIs: []string{"http://example.com/callback"},
+				})
+			})
+			defer httpServer.Close()
+
+			for id, gts := range tc.connectorGrantTypes {
+				err := s.storage.UpdateConnector(ctx, id, func(c storage.Connector) (storage.Connector, error) {
+					c.GrantTypes = gts
+					return c, nil
+				})
+				require.NoError(t, err)
+				s.connectors.Close(id)
+			}
+
+			rr := httptest.NewRecorder()
+			reqURL := fmt.Sprintf("%s/auth?response_type=%s&client_id=test&redirect_uri=http://example.com/callback&scope=openid", httpServer.URL, tc.responseType)
+			req := httptest.NewRequest(http.MethodGet, reqURL, nil)
+			s.ServeHTTP(rr, req)
+
+			require.Equal(t, tc.wantCode, rr.Code)
+			if tc.wantRedirectContains != "" {
+				require.Contains(t, rr.Header().Get("Location"), tc.wantRedirectContains)
+			}
+			if tc.wantBodyContains != "" {
+				require.Contains(t, rr.Body.String(), tc.wantBodyContains)
+			}
+		})
+	}
+}
+
+func TestHandleAuthorizationInvalidRequestWithSessions(t *testing.T) {
+	ctx := t.Context()
+	httpServer, s := newTestServerMultipleConnectors(t, func(c *Config) {
+		c.SessionConfig = &session.Config{
+			CookieName:        "dex_session",
+			AbsoluteLifetime:  24 * time.Hour,
+			ValidIfNotUsedFor: 1 * time.Hour,
+		}
+		c.Storage.CreateClient(ctx, storage.Client{
+			ID:           "test",
+			RedirectURIs: []string{"http://example.com/callback"},
+		})
+	})
+	defer httpServer.Close()
+
+	// Send a request with an unregistered redirect_uri — should not panic.
+	rr := httptest.NewRecorder()
+	reqURL := fmt.Sprintf("%s/auth?response_type=code&client_id=test&redirect_uri=http://evil.com/callback&scope=openid", httpServer.URL)
+	req := httptest.NewRequest(http.MethodGet, reqURL, nil)
+	s.ServeHTTP(rr, req)
+
+	require.Equal(t, http.StatusBadRequest, rr.Code)
+}
+
+func TestHandleAuthorizationWithAllowedConnectors(t *testing.T) {
+	ctx := t.Context()
+
+	httpServer, s := newTestServerMultipleConnectors(t, nil)
+	defer httpServer.Close()
+
+	// Create a client that only allows "mock" connector (not "mock2")
+	client := storage.Client{
+		ID:                "filtered-client",
+		Secret:            "secret",
+		RedirectURIs:      []string{"https://example.com/callback"},
+		Name:              "Filtered Client",
+		AllowedConnectors: []string{"mock"},
+	}
+	require.NoError(t, s.storage.CreateClient(ctx, client))
+
+	// Request the auth page with this client - should only show "mock" connector
+	rr := httptest.NewRecorder()
+	req := httptest.NewRequest("GET", fmt.Sprintf("/auth?client_id=%s&redirect_uri=%s&response_type=code&scope=openid",
+		client.ID, url.QueryEscape("https://example.com/callback")), nil)
+	s.ServeHTTP(rr, req)
+
+	// With only one allowed connector and alwaysShowLogin=false (default),
+	// the server should redirect directly to the connector
+	require.Equal(t, http.StatusFound, rr.Code)
+	location := rr.Header().Get("Location")
+	require.Contains(t, location, "/auth/mock")
+	require.NotContains(t, location, "mock2")
+}
+
+func TestHandleAuthorizationWithNoMatchingConnectors(t *testing.T) {
+	ctx := t.Context()
+
+	httpServer, s := newTestServerMultipleConnectors(t, nil)
+	defer httpServer.Close()
+
+	// Create a client that only allows a non-existent connector
+	client := storage.Client{
+		ID:                "no-connectors-client",
+		Secret:            "secret",
+		RedirectURIs:      []string{"https://example.com/callback"},
+		Name:              "No Connectors Client",
+		AllowedConnectors: []string{"nonexistent"},
+	}
+	require.NoError(t, s.storage.CreateClient(ctx, client))
+
+	rr := httptest.NewRecorder()
+	req := httptest.NewRequest("GET", fmt.Sprintf("/auth?client_id=%s&redirect_uri=%s&response_type=code&scope=openid",
+		client.ID, url.QueryEscape("https://example.com/callback")), nil)
+	s.ServeHTTP(rr, req)
+
+	// Should return an error, not an empty login page
+	require.Equal(t, http.StatusBadRequest, rr.Code)
+}
+
+func TestHandleAuthorizationSessionSkipsConnectorSelection(t *testing.T) {
+	ctx := t.Context()
+
+	sessionConfig := &session.Config{
+		CookieName:        "dex_session",
+		AbsoluteLifetime:  24 * time.Hour,
+		ValidIfNotUsedFor: 1 * time.Hour,
+	}
+
+	client := storage.Client{
+		ID:           "test-client",
+		Secret:       "secret",
+		RedirectURIs: []string{"https://example.com/callback"},
+		Name:         "Test Client",
+	}
+
+	authURL := fmt.Sprintf("/auth?client_id=%s&redirect_uri=%s&response_type=code&scope=openid",
+		client.ID, url.QueryEscape("https://example.com/callback"))
+
+	createSession := func(t *testing.T, s *Server, connectorID string) *http.Cookie {
+		t.Helper()
+		now := time.Now()
+		sessionID := "test-session"
+		session := storage.AuthSession{
+			ID:             sessionID,
+			Secret:         testSessionSecret(sessionID),
+			UserID:         "user1",
+			ConnectorID:    connectorID,
+			ClientStates:   map[string]*storage.ClientAuthState{},
+			CreatedAt:      now.Add(-30 * time.Minute),
+			LastActivity:   now.Add(-5 * time.Minute),
+			IPAddress:      "127.0.0.1",
+			UserAgent:      "test",
+			AbsoluteExpiry: now.Add(24 * time.Hour),
+			IdleExpiry:     now.Add(1 * time.Hour),
+		}
+		require.NoError(t, s.storage.CreateAuthSession(ctx, session))
+		return &http.Cookie{
+			Name:  "dex_session",
+			Value: internal.SessionCookieValue(sessionID, testSessionSecret(sessionID), nil),
+		}
+	}
+
+	t.Run("valid session redirects to session connector", func(t *testing.T) {
+		httpServer, s := newTestServerMultipleConnectors(t, func(c *Config) {
+			c.SessionConfig = sessionConfig
+		})
+		defer httpServer.Close()
+		require.NoError(t, s.storage.CreateClient(ctx, client))
+
+		cookie := createSession(t, s, "mock")
+
+		rr := httptest.NewRecorder()
+		req := httptest.NewRequest("GET", authURL, nil)
+		req.AddCookie(cookie)
+		s.ServeHTTP(rr, req)
+
+		require.Equal(t, http.StatusFound, rr.Code)
+		require.Contains(t, rr.Header().Get("Location"), "/auth/mock")
+	})
+
+	t.Run("prompt=select_account shows connector selection despite session", func(t *testing.T) {
+		httpServer, s := newTestServerMultipleConnectors(t, func(c *Config) {
+			c.SessionConfig = sessionConfig
+		})
+		defer httpServer.Close()
+		require.NoError(t, s.storage.CreateClient(ctx, client))
+
+		cookie := createSession(t, s, "mock")
+
+		rr := httptest.NewRecorder()
+		req := httptest.NewRequest("GET", authURL+"&prompt=select_account", nil)
+		req.AddCookie(cookie)
+		s.ServeHTTP(rr, req)
+
+		require.Equal(t, http.StatusOK, rr.Code)
+	})
+
+	t.Run("no session shows connector selection", func(t *testing.T) {
+		httpServer, s := newTestServerMultipleConnectors(t, func(c *Config) {
+			c.SessionConfig = sessionConfig
+		})
+		defer httpServer.Close()
+		require.NoError(t, s.storage.CreateClient(ctx, client))
+
+		rr := httptest.NewRecorder()
+		req := httptest.NewRequest("GET", authURL, nil)
+		s.ServeHTTP(rr, req)
+
+		require.Equal(t, http.StatusOK, rr.Code)
+	})
+
+	t.Run("alwaysShowLogin shows connector selection despite session", func(t *testing.T) {
+		httpServer, s := newTestServerMultipleConnectors(t, func(c *Config) {
+			c.SessionConfig = sessionConfig
+			c.AlwaysShowLoginScreen = true
+		})
+		defer httpServer.Close()
+		require.NoError(t, s.storage.CreateClient(ctx, client))
+
+		cookie := createSession(t, s, "mock")
+
+		rr := httptest.NewRecorder()
+		req := httptest.NewRequest("GET", authURL, nil)
+		req.AddCookie(cookie)
+		s.ServeHTTP(rr, req)
+
+		require.Equal(t, http.StatusOK, rr.Code)
+	})
+
+	t.Run("session connector not in filtered list shows connector selection", func(t *testing.T) {
+		httpServer, s := newTestServerMultipleConnectors(t, func(c *Config) {
+			c.SessionConfig = sessionConfig
+		})
+		defer httpServer.Close()
+
+		filteredClient := storage.Client{
+			ID:                "filtered-client",
+			Secret:            "secret",
+			RedirectURIs:      []string{"https://example.com/callback"},
+			Name:              "Filtered Client",
+			AllowedConnectors: []string{"mock", "mock2"},
+		}
+		require.NoError(t, s.storage.CreateClient(ctx, filteredClient))
+
+		// Session is for "other-connector" which is not in the allowed list.
+		cookie := createSession(t, s, "other-connector")
+
+		rr := httptest.NewRecorder()
+		req := httptest.NewRequest("GET", fmt.Sprintf("/auth?client_id=%s&redirect_uri=%s&response_type=code&scope=openid",
+			filteredClient.ID, url.QueryEscape("https://example.com/callback")), nil)
+		req.AddCookie(cookie)
+		s.ServeHTTP(rr, req)
+
+		require.Equal(t, http.StatusOK, rr.Code)
+	})
+}
+
+func TestHandleAuthorizationWithoutAllowedConnectors(t *testing.T) {
+	ctx := t.Context()
+
+	httpServer, s := newTestServerMultipleConnectors(t, nil)
+	defer httpServer.Close()
+
+	// Create a client with no connector restrictions
+	client := storage.Client{
+		ID:           "unfiltered-client",
+		Secret:       "secret",
+		RedirectURIs: []string{"https://example.com/callback"},
+		Name:         "Unfiltered Client",
+	}
+	require.NoError(t, s.storage.CreateClient(ctx, client))
+
+	// Request the auth page - should show all connectors (rendered as HTML)
+	rr := httptest.NewRecorder()
+	req := httptest.NewRequest("GET", fmt.Sprintf("/auth?client_id=%s&redirect_uri=%s&response_type=code&scope=openid",
+		client.ID, url.QueryEscape("https://example.com/callback")), nil)
+	s.ServeHTTP(rr, req)
+
+	// With multiple connectors and no filter, the login page should be rendered (200 OK)
+	require.Equal(t, http.StatusOK, rr.Code)
+}
+
+func TestBackLinkIncludesPromptSelectAccount(t *testing.T) {
+	ctx := t.Context()
+
+	httpServer, s := newTestServerMultipleConnectors(t, func(c *Config) {
+		// select_account prompt only works with the sessions feature flag enabled.
+		c.SessionConfig = &session.Config{}
+	})
+	defer httpServer.Close()
+
+	// Add a password connector so handleConnectorLogin passes the backlink via redirect.
+	pwConn := storage.Connector{
+		ID:              "mockPw",
+		Type:            "mockPassword",
+		Name:            "MockPassword",
+		ResourceVersion: "1",
+		Config:          []byte(`{"username": "foo", "password": "bar"}`),
+	}
+	require.NoError(t, s.storage.CreateConnector(ctx, pwConn))
+	_, err := s.connectors.Open(pwConn)
+	require.NoError(t, err)
+
+	client := storage.Client{
+		ID:           "test-client",
+		Secret:       "secret",
+		RedirectURIs: []string{"https://example.com/callback"},
+		Name:         "Test Client",
+	}
+	require.NoError(t, s.storage.CreateClient(ctx, client))
+
+	rr := httptest.NewRecorder()
+	authURL := fmt.Sprintf("/auth/mockPw?client_id=%s&redirect_uri=%s&response_type=code&scope=openid",
+		client.ID, url.QueryEscape("https://example.com/callback"))
+	req := httptest.NewRequest("GET", authURL, nil)
+	s.ServeHTTP(rr, req)
+
+	require.Equal(t, http.StatusFound, rr.Code)
+
+	loc, err := url.Parse(rr.Header().Get("Location"))
+	require.NoError(t, err)
+
+	backLink := loc.Query().Get("back")
+	require.NotEmpty(t, backLink, "back link should be set when multiple connectors exist")
+
+	backURL, err := url.Parse(backLink)
+	require.NoError(t, err)
+	require.Equal(t, "select_account", backURL.Query().Get("prompt"),
+		"back link should include prompt=select_account")
+}
diff --git a/server/server_device_authorize_test.go b/server/server_device_authorize_test.go
new file mode 100644
index 0000000000..3d95eb6ad7
--- /dev/null
+++ b/server/server_device_authorize_test.go
@@ -0,0 +1,242 @@
+package server
+
+import (
+	"bytes"
+	"encoding/json"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"net/url"
+	"path"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/dexidp/dex/server/device"
+	"github.com/dexidp/dex/storage"
+)
+
+func TestHandleDeviceCode(t *testing.T) {
+	t0 := time.Now()
+
+	now := func() time.Time { return t0 }
+
+	tests := []struct {
+		testName               string
+		clientID               string
+		codeChallengeMethod    string
+		requestType            string
+		scopes                 []string
+		expectedResponseCode   int
+		expectedContentType    string
+		expectedServerResponse string
+	}{
+		{
+			testName:             "New Code",
+			clientID:             "test",
+			requestType:          "POST",
+			scopes:               []string{"openid", "profile", "email"},
+			expectedResponseCode: http.StatusOK,
+			expectedContentType:  "application/json",
+		},
+		{
+			testName:             "Invalid request Type (GET)",
+			clientID:             "test",
+			requestType:          "GET",
+			scopes:               []string{"openid", "profile", "email"},
+			expectedResponseCode: http.StatusBadRequest,
+			expectedContentType:  "application/json",
+		},
+		{
+			testName:             "New Code with valid PKCE",
+			clientID:             "test",
+			requestType:          "POST",
+			scopes:               []string{"openid", "profile", "email"},
+			codeChallengeMethod:  "S256",
+			expectedResponseCode: http.StatusOK,
+			expectedContentType:  "application/json",
+		},
+		{
+			testName:             "Invalid code challenge method",
+			clientID:             "test",
+			requestType:          "POST",
+			codeChallengeMethod:  "invalid",
+			scopes:               []string{"openid", "profile", "email"},
+			expectedResponseCode: http.StatusBadRequest,
+			expectedContentType:  "application/json",
+		},
+		{
+			testName:             "New Code without scope",
+			clientID:             "test",
+			requestType:          "POST",
+			scopes:               []string{},
+			expectedResponseCode: http.StatusOK,
+			expectedContentType:  "application/json",
+		},
+	}
+	for _, tc := range tests {
+		t.Run(tc.testName, func(t *testing.T) {
+			// Setup a dex server.
+			httpServer, s := newTestServer(t, func(c *Config) {
+				c.Issuer += "/non-root-path"
+				c.Now = now
+			})
+			defer httpServer.Close()
+
+			u, err := url.Parse(s.issuerURL.String())
+			if err != nil {
+				t.Fatalf("Could not parse issuer URL %v", err)
+			}
+			u.Path = path.Join(u.Path, "device/code")
+
+			data := url.Values{}
+			data.Set("client_id", tc.clientID)
+			data.Set("code_challenge_method", tc.codeChallengeMethod)
+			for _, scope := range tc.scopes {
+				data.Add("scope", scope)
+			}
+			req, _ := http.NewRequest(tc.requestType, u.String(), bytes.NewBufferString(data.Encode()))
+			req.Header.Set("Content-Type", "application/x-www-form-urlencoded; param=value")
+
+			rr := httptest.NewRecorder()
+			s.ServeHTTP(rr, req)
+			if rr.Code != tc.expectedResponseCode {
+				t.Errorf("Unexpected Response Type.  Expected %v got %v", tc.expectedResponseCode, rr.Code)
+			}
+
+			if rr.Header().Get("content-type") != tc.expectedContentType {
+				t.Errorf("Unexpected Response Content Type.  Expected %v got %v", tc.expectedContentType, rr.Header().Get("content-type"))
+			}
+
+			body, err := io.ReadAll(rr.Body)
+			if err != nil {
+				t.Errorf("Could read token response %v", err)
+			}
+			if tc.expectedResponseCode == http.StatusOK {
+				var resp device.DeviceCodeResponse
+				if err := json.Unmarshal(body, &resp); err != nil {
+					t.Errorf("Unexpected Device Code Response Format %v", string(body))
+				}
+			}
+		})
+	}
+}
+
+func TestVerifyCodeResponse(t *testing.T) {
+	t0 := time.Now()
+
+	now := func() time.Time { return t0 }
+
+	tests := []struct {
+		testName             string
+		testDeviceRequest    storage.DeviceRequest
+		userCode             string
+		expectedResponseCode int
+		expectedAuthPath     string
+		shouldRedirectToAuth bool
+	}{
+		{
+			testName: "Unknown user code",
+			testDeviceRequest: storage.DeviceRequest{
+				UserCode:   "ABCD-WXYZ",
+				DeviceCode: "f00bar",
+				ClientID:   "testclient",
+				Scopes:     []string{"openid", "profile", "offline_access"},
+				Expiry:     now().Add(5 * time.Minute),
+			},
+			userCode:             "CODE-TEST",
+			expectedResponseCode: http.StatusBadRequest,
+		},
+		{
+			testName: "Expired user code",
+			testDeviceRequest: storage.DeviceRequest{
+				UserCode:   "ABCD-WXYZ",
+				DeviceCode: "f00bar",
+				ClientID:   "testclient",
+				Scopes:     []string{"openid", "profile", "offline_access"},
+				Expiry:     now().Add(-5 * time.Minute),
+			},
+			userCode:             "ABCD-WXYZ",
+			expectedResponseCode: http.StatusBadRequest,
+		},
+		{
+			testName: "No user code",
+			testDeviceRequest: storage.DeviceRequest{
+				UserCode:   "ABCD-WXYZ",
+				DeviceCode: "f00bar",
+				ClientID:   "testclient",
+				Scopes:     []string{"openid", "profile", "offline_access"},
+				Expiry:     now().Add(-5 * time.Minute),
+			},
+			userCode:             "",
+			expectedResponseCode: http.StatusBadRequest,
+		},
+		{
+			testName: "Valid user code, expect redirect to auth endpoint with device callback",
+			testDeviceRequest: storage.DeviceRequest{
+				UserCode:   "ABCD-WXYZ",
+				DeviceCode: "f00bar",
+				ClientID:   "testclient",
+				Scopes:     []string{"openid", "profile", "offline_access"},
+				Expiry:     now().Add(5 * time.Minute),
+			},
+			userCode:             "ABCD-WXYZ",
+			expectedResponseCode: http.StatusFound,
+			expectedAuthPath:     "/auth",
+			shouldRedirectToAuth: true,
+		},
+	}
+	for _, tc := range tests {
+		t.Run(tc.testName, func(t *testing.T) {
+			ctx := t.Context()
+
+			// Setup a dex server.
+			httpServer, s := newTestServer(t, func(c *Config) {
+				c.Issuer += "/non-root-path"
+				c.Now = now
+			})
+			defer httpServer.Close()
+
+			if err := s.storage.CreateDeviceRequest(ctx, tc.testDeviceRequest); err != nil {
+				t.Fatalf("Failed to store device token %v", err)
+			}
+
+			u, err := url.Parse(s.issuerURL.String())
+			if err != nil {
+				t.Fatalf("Could not parse issuer URL %v", err)
+			}
+
+			u.Path = path.Join(u.Path, "device/auth/verify_code")
+			data := url.Values{}
+			data.Set("user_code", tc.userCode)
+			req, _ := http.NewRequest("POST", u.String(), bytes.NewBufferString(data.Encode()))
+			req.Header.Set("Content-Type", "application/x-www-form-urlencoded; param=value")
+
+			rr := httptest.NewRecorder()
+			s.ServeHTTP(rr, req)
+			if rr.Code != tc.expectedResponseCode {
+				t.Errorf("Unexpected Response Type.  Expected %v got %v", tc.expectedResponseCode, rr.Code)
+			}
+
+			location := rr.Header().Get("Location")
+			if rr.Code == http.StatusFound && tc.shouldRedirectToAuth {
+				// Parse the redirect location
+				redirectURL, err := url.Parse(location)
+				if err != nil {
+					t.Errorf("Could not parse redirect URL: %v", err)
+					return
+				}
+
+				// Check that the redirect path contains /auth
+				if !strings.Contains(redirectURL.Path, tc.expectedAuthPath) {
+					t.Errorf("Invalid Redirect Path. Expected to contain %q got %q", tc.expectedAuthPath, redirectURL.Path)
+				}
+
+				// Check that redirect_uri parameter contains /device/callback
+				if !strings.Contains(location, "redirect_uri=%2Fnon-root-path%2Fdevice%2Fcallback") {
+					t.Errorf("Invalid redirect_uri parameter. Expected to contain /device/callback (URL encoded), got %v", location)
+				}
+			}
+		})
+	}
+}
diff --git a/server/server_device_callback_test.go b/server/server_device_callback_test.go
new file mode 100644
index 0000000000..c719c5143a
--- /dev/null
+++ b/server/server_device_callback_test.go
@@ -0,0 +1,351 @@
+package server
+
+import (
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"net/url"
+	"path"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/dexidp/dex/server/oauth2"
+	"github.com/dexidp/dex/storage"
+)
+
+func TestDeviceCallback(t *testing.T) {
+	t0 := time.Now()
+
+	now := func() time.Time { return t0 }
+
+	type formValues struct {
+		state string
+		code  string
+		error string
+	}
+
+	// Base "Control" test values
+	baseFormValues := formValues{
+		state: "XXXX-XXXX",
+		code:  "somecode",
+	}
+	baseAuthCode := storage.AuthCode{
+		ID:            "somecode",
+		ClientID:      "testclient",
+		RedirectURI:   oauth2.DeviceCallbackURI,
+		Nonce:         "",
+		Scopes:        []string{"openid", "profile", "email"},
+		ConnectorID:   "mock",
+		ConnectorData: nil,
+		Claims:        storage.Claims{},
+		Expiry:        now().Add(5 * time.Minute),
+	}
+	baseDeviceRequest := storage.DeviceRequest{
+		UserCode:     "XXXX-XXXX",
+		DeviceCode:   "devicecode",
+		ClientID:     "testclient",
+		ClientSecret: "",
+		Scopes:       []string{"openid", "profile", "email"},
+		Expiry:       now().Add(5 * time.Minute),
+	}
+	baseDeviceToken := storage.DeviceToken{
+		DeviceCode:          "devicecode",
+		Status:              oauth2.DeviceTokenPending,
+		Token:               "",
+		Expiry:              now().Add(5 * time.Minute),
+		LastRequestTime:     time.Time{},
+		PollIntervalSeconds: 0,
+	}
+
+	tests := []struct {
+		testName               string
+		expectedResponseCode   int
+		expectedServerResponse string
+		values                 formValues
+		testAuthCode           storage.AuthCode
+		testDeviceRequest      storage.DeviceRequest
+		testDeviceToken        storage.DeviceToken
+	}{
+		{
+			testName: "Missing State",
+			values: formValues{
+				state: "",
+				code:  "somecode",
+				error: "",
+			},
+			expectedResponseCode: http.StatusBadRequest,
+		},
+		{
+			testName: "Missing Code",
+			values: formValues{
+				state: "XXXX-XXXX",
+				code:  "",
+				error: "",
+			},
+			expectedResponseCode: http.StatusBadRequest,
+		},
+		{
+			testName: "Error During Authorization",
+			values: formValues{
+				state: "XXXX-XXXX",
+				code:  "somecode",
+				error: "Error Condition",
+			},
+			expectedResponseCode: http.StatusBadRequest,
+			// Note: Error details should NOT be displayed to user anymore.
+			// Instead, a safe generic message is shown.
+		},
+		{
+			testName: "Expired Auth Code",
+			values:   baseFormValues,
+			testAuthCode: storage.AuthCode{
+				ID:            "somecode",
+				ClientID:      "testclient",
+				RedirectURI:   oauth2.DeviceCallbackURI,
+				Nonce:         "",
+				Scopes:        []string{"openid", "profile", "email"},
+				ConnectorID:   "pic",
+				ConnectorData: nil,
+				Claims:        storage.Claims{},
+				Expiry:        now().Add(-5 * time.Minute),
+			},
+			expectedResponseCode: http.StatusBadRequest,
+		},
+		{
+			testName: "Invalid Auth Code",
+			values:   baseFormValues,
+			testAuthCode: storage.AuthCode{
+				ID:            "somecode",
+				ClientID:      "testclient",
+				RedirectURI:   oauth2.DeviceCallbackURI,
+				Nonce:         "",
+				Scopes:        []string{"openid", "profile", "email"},
+				ConnectorID:   "pic",
+				ConnectorData: nil,
+				Claims:        storage.Claims{},
+				Expiry:        now().Add(5 * time.Minute),
+			},
+			expectedResponseCode: http.StatusBadRequest,
+		},
+		{
+			testName:     "Expired Device Request",
+			values:       baseFormValues,
+			testAuthCode: baseAuthCode,
+			testDeviceRequest: storage.DeviceRequest{
+				UserCode:   "XXXX-XXXX",
+				DeviceCode: "devicecode",
+				ClientID:   "testclient",
+				Scopes:     []string{"openid", "profile", "email"},
+				Expiry:     now().Add(-5 * time.Minute),
+			},
+			expectedResponseCode: http.StatusBadRequest,
+		},
+		{
+			testName:     "Non-Existent User Code",
+			values:       baseFormValues,
+			testAuthCode: baseAuthCode,
+			testDeviceRequest: storage.DeviceRequest{
+				UserCode:   "ZZZZ-ZZZZ",
+				DeviceCode: "devicecode",
+				Scopes:     []string{"openid", "profile", "email"},
+				Expiry:     now().Add(5 * time.Minute),
+			},
+			expectedResponseCode: http.StatusBadRequest,
+		},
+		{
+			// The device request names a different client than the auth code was
+			// minted for: the client/redirect binding must reject it (cross-client
+			// auth code injection guard) before any client lookup.
+			testName:     "Cross-client auth code injection",
+			values:       baseFormValues,
+			testAuthCode: baseAuthCode,
+			testDeviceRequest: storage.DeviceRequest{
+				UserCode:   "XXXX-XXXX",
+				DeviceCode: "devicecode",
+				ClientID:   "otherclient",
+				Scopes:     []string{"openid", "profile", "email"},
+				Expiry:     now().Add(5 * time.Minute),
+			},
+			expectedResponseCode: http.StatusBadRequest,
+		},
+		{
+			// Same client, but the code was minted for a non-device-callback
+			// redirect: the redirect binding must reject it.
+			testName: "Auth code from a different redirect",
+			values:   baseFormValues,
+			testAuthCode: storage.AuthCode{
+				ID:          "somecode",
+				ClientID:    "testclient",
+				RedirectURI: "https://example.com/callback",
+				Scopes:      []string{"openid", "profile", "email"},
+				ConnectorID: "mock",
+				Expiry:      now().Add(5 * time.Minute),
+			},
+			testDeviceRequest:    baseDeviceRequest,
+			expectedResponseCode: http.StatusBadRequest,
+		},
+		{
+			// The redirect path is not the device callback; only the query string
+			// ends with "/device/callback". Matching on the raw string would be
+			// spoofed here, so the path is what must be checked.
+			testName: "Auth code redirect spoofed via query string",
+			values:   baseFormValues,
+			testAuthCode: storage.AuthCode{
+				ID:          "somecode",
+				ClientID:    "testclient",
+				RedirectURI: "https://example.com/callback?next=/device/callback",
+				Scopes:      []string{"openid", "profile", "email"},
+				ConnectorID: "mock",
+				Expiry:      now().Add(5 * time.Minute),
+			},
+			testDeviceRequest:    baseDeviceRequest,
+			expectedResponseCode: http.StatusBadRequest,
+		},
+		{
+			testName:     "Bad Device Request Secret",
+			values:       baseFormValues,
+			testAuthCode: baseAuthCode,
+			testDeviceRequest: storage.DeviceRequest{
+				UserCode:     "XXXX-XXXX",
+				DeviceCode:   "devicecode",
+				ClientID:     "testclient",
+				ClientSecret: "foobar",
+				Scopes:       []string{"openid", "profile", "email"},
+				Expiry:       now().Add(5 * time.Minute),
+			},
+			expectedResponseCode: http.StatusUnauthorized,
+		},
+		{
+			testName:          "Expired Device Token",
+			values:            baseFormValues,
+			testAuthCode:      baseAuthCode,
+			testDeviceRequest: baseDeviceRequest,
+			testDeviceToken: storage.DeviceToken{
+				DeviceCode:          "devicecode",
+				Status:              oauth2.DeviceTokenPending,
+				Token:               "",
+				Expiry:              now().Add(-5 * time.Minute),
+				LastRequestTime:     time.Time{},
+				PollIntervalSeconds: 0,
+			},
+			expectedResponseCode: http.StatusBadRequest,
+		},
+		{
+			testName:          "Device Code Already Redeemed",
+			values:            baseFormValues,
+			testAuthCode:      baseAuthCode,
+			testDeviceRequest: baseDeviceRequest,
+			testDeviceToken: storage.DeviceToken{
+				DeviceCode:          "devicecode",
+				Status:              oauth2.DeviceTokenComplete,
+				Token:               "",
+				Expiry:              now().Add(5 * time.Minute),
+				LastRequestTime:     time.Time{},
+				PollIntervalSeconds: 0,
+			},
+			expectedResponseCode: http.StatusBadRequest,
+		},
+		{
+			testName:             "Successful Exchange",
+			values:               baseFormValues,
+			testAuthCode:         baseAuthCode,
+			testDeviceRequest:    baseDeviceRequest,
+			testDeviceToken:      baseDeviceToken,
+			expectedResponseCode: http.StatusOK,
+		},
+		{
+			testName: "Prevent cross-site scripting",
+			values: formValues{
+				state: "XXXX-XXXX",
+				code:  "somecode",
+				error: "<script>console.log(window);</script>",
+			},
+			expectedResponseCode: http.StatusBadRequest,
+			// Note: XSS data should NOT be displayed to user anymore.
+			// Instead, a safe generic message is shown.
+		},
+	}
+	for _, tc := range tests {
+		t.Run(tc.testName, func(t *testing.T) {
+			ctx := t.Context()
+
+			// Setup a dex server.
+			httpServer, s := newTestServer(t, func(c *Config) {
+				c.Issuer = c.Issuer + "/non-root-path"
+				c.Now = now
+			})
+			defer httpServer.Close()
+
+			if err := s.storage.CreateAuthCode(ctx, tc.testAuthCode); err != nil {
+				t.Fatalf("failed to create auth code: %v", err)
+			}
+
+			if err := s.storage.CreateDeviceRequest(ctx, tc.testDeviceRequest); err != nil {
+				t.Fatalf("failed to create device request: %v", err)
+			}
+
+			if err := s.storage.CreateDeviceToken(ctx, tc.testDeviceToken); err != nil {
+				t.Fatalf("failed to create device token: %v", err)
+			}
+
+			client := storage.Client{
+				ID:           "testclient",
+				Secret:       "",
+				RedirectURIs: []string{oauth2.DeviceCallbackURI},
+			}
+			if err := s.storage.CreateClient(ctx, client); err != nil {
+				t.Fatalf("failed to create client: %v", err)
+			}
+
+			u, err := url.Parse(s.issuerURL.String())
+			if err != nil {
+				t.Fatalf("Could not parse issuer URL %v", err)
+			}
+			u.Path = path.Join(u.Path, "device/callback")
+			q := u.Query()
+			q.Set("state", tc.values.state)
+			q.Set("code", tc.values.code)
+			q.Set("error", tc.values.error)
+			u.RawQuery = q.Encode()
+			req, _ := http.NewRequest("GET", u.String(), nil)
+			req.Header.Set("Content-Type", "application/x-www-form-urlencoded; param=value")
+
+			rr := httptest.NewRecorder()
+			s.ServeHTTP(rr, req)
+			if rr.Code != tc.expectedResponseCode {
+				t.Errorf("%s: Unexpected Response Type.  Expected %v got %v", tc.testName, tc.expectedResponseCode, rr.Code)
+			}
+
+			if len(tc.expectedServerResponse) > 0 {
+				result, _ := io.ReadAll(rr.Body)
+				if string(result) != tc.expectedServerResponse {
+					t.Errorf("%s: Unexpected Response.  Expected %q got %q", tc.testName, tc.expectedServerResponse, result)
+				}
+			}
+
+			// Special check for error message safety tests
+			if tc.testName == "Prevent cross-site scripting" || tc.testName == "Error During Authorization" {
+				result, _ := io.ReadAll(rr.Body)
+				responseBody := string(result)
+
+				// Error details should NOT be present in the response (for security)
+				if tc.testName == "Prevent cross-site scripting" {
+					if strings.Contains(responseBody, "<script>") || strings.Contains(responseBody, "console.log(window)") {
+						t.Errorf("%s: XSS script found in response, but should be blocked: %q", tc.testName, responseBody)
+					}
+				}
+				if tc.testName == "Error During Authorization" {
+					if strings.Contains(responseBody, "Error Condition") {
+						t.Errorf("%s: Error details found in response, but should be hidden: %q", tc.testName, responseBody)
+					}
+				}
+
+				// Safe message should be present
+				if !strings.Contains(responseBody, "Authorization failed. Please try again.") {
+					t.Errorf("%s: Safe error message not found in response: %q", tc.testName, responseBody)
+				}
+			}
+		})
+	}
+}
diff --git a/server/server_discovery_test.go b/server/server_discovery_test.go
new file mode 100644
index 0000000000..806bc4ac55
--- /dev/null
+++ b/server/server_discovery_test.go
@@ -0,0 +1,110 @@
+package server
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+	"time"
+
+	"github.com/go-jose/go-jose/v4"
+	"github.com/stretchr/testify/require"
+
+	"github.com/dexidp/dex/server/discovery"
+	"github.com/dexidp/dex/server/signer"
+)
+
+func TestHandleDiscovery(t *testing.T) {
+	httpServer, server := newTestServer(t, nil)
+	defer httpServer.Close()
+
+	rr := httptest.NewRecorder()
+	server.ServeHTTP(rr, httptest.NewRequest("GET", "/.well-known/openid-configuration", nil))
+	if rr.Code != http.StatusOK {
+		t.Errorf("expected 200 got %d", rr.Code)
+	}
+
+	var res discovery.Document
+	err := json.NewDecoder(rr.Result().Body).Decode(&res)
+	require.NoError(t, err)
+	require.Equal(t, discovery.Document{
+		Issuer:         httpServer.URL,
+		Auth:           fmt.Sprintf("%s/auth", httpServer.URL),
+		Token:          fmt.Sprintf("%s/token", httpServer.URL),
+		Keys:           fmt.Sprintf("%s/keys", httpServer.URL),
+		UserInfo:       fmt.Sprintf("%s/userinfo", httpServer.URL),
+		DeviceEndpoint: fmt.Sprintf("%s/device/code", httpServer.URL),
+		Introspect:     fmt.Sprintf("%s/token/introspect", httpServer.URL),
+		GrantTypes: []string{
+			"authorization_code",
+			"client_credentials",
+			"refresh_token",
+			"urn:ietf:params:oauth:grant-type:device_code",
+			"urn:ietf:params:oauth:grant-type:token-exchange",
+		},
+		ResponseTypes: []string{
+			"code",
+		},
+		Subjects: []string{
+			"public",
+		},
+		IDTokenAlgs: []string{
+			"RS256",
+		},
+		CodeChallengeAlgs: []string{
+			"S256",
+			"plain",
+		},
+		Scopes: []string{
+			"openid",
+			"email",
+			"groups",
+			"profile",
+			"offline_access",
+		},
+		AuthMethods: []string{
+			"client_secret_basic",
+			"client_secret_post",
+		},
+		Claims: []string{
+			"iss",
+			"sub",
+			"aud",
+			"iat",
+			"exp",
+			"email",
+			"email_verified",
+			"locale",
+			"name",
+			"preferred_username",
+			"at_hash",
+			"groups",
+			"federated_claims",
+		},
+	}, res)
+}
+
+func TestHandleDiscoveryWithES256LocalSigner(t *testing.T) {
+	httpServer, server := newTestServer(t, func(c *Config) {
+		localConfig := signer.LocalConfig{
+			KeysRotationPeriod: time.Hour.String(),
+			Algorithm:          jose.ES256,
+		}
+
+		sig, err := localConfig.Open(context.Background(), c.Storage, time.Hour, time.Now, c.Logger)
+		require.NoError(t, err)
+		c.Signer = sig
+	})
+	defer httpServer.Close()
+
+	rr := httptest.NewRecorder()
+	server.ServeHTTP(rr, httptest.NewRequest("GET", "/.well-known/openid-configuration", nil))
+	require.Equal(t, http.StatusOK, rr.Code)
+
+	var res discovery.Document
+	err := json.NewDecoder(rr.Result().Body).Decode(&res)
+	require.NoError(t, err)
+	require.Equal(t, []string{string(jose.ES256)}, res.IDTokenAlgs)
+}
diff --git a/server/server_errors_test.go b/server/server_errors_test.go
new file mode 100644
index 0000000000..fcfec59153
--- /dev/null
+++ b/server/server_errors_test.go
@@ -0,0 +1,237 @@
+package server
+
+import (
+	"bytes"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+// TestErrorMessagesDoNotLeakInternalDetails verifies that error responses
+// do not contain internal error details that could be exploited by attackers.
+func TestErrorMessagesDoNotLeakInternalDetails(t *testing.T) {
+	// List of sensitive patterns that should never appear in user-facing errors
+	sensitivePatterns := []string{
+		"panic",
+		"runtime error",
+		"nil pointer",
+		"stack trace",
+		"goroutine",
+		".go:",       // file paths like "server.go:123"
+		"sql:",       // SQL errors
+		"connection", // Connection errors
+		"timeout",    // Unless it's a user-friendly timeout message
+		"ECONNREFUSED",
+		"EOF",
+		"broken pipe",
+	}
+
+	tests := []struct {
+		name        string
+		path        string
+		method      string
+		body        string
+		contentType string
+		setupFunc   func(t *testing.T, s *Server)
+		checkFunc   func(t *testing.T, resp *http.Response, body string)
+	}{
+		{
+			name:        "Invalid authorization request parse error",
+			path:        "/auth",
+			method:      "POST",
+			body:        "invalid%body",
+			contentType: "application/x-www-form-urlencoded",
+			checkFunc: func(t *testing.T, resp *http.Response, body string) {
+				// Should return a safe error message, not the parse error details
+				for _, pattern := range sensitivePatterns {
+					require.NotContains(t, body, pattern,
+						"Response should not contain sensitive pattern: %s", pattern)
+				}
+			},
+		},
+		{
+			name:   "Invalid callback state",
+			path:   "/callback?state=invalid_state",
+			method: "GET",
+			checkFunc: func(t *testing.T, resp *http.Response, body string) {
+				require.Equal(t, http.StatusBadRequest, resp.StatusCode)
+				// Should not leak storage error details
+				require.NotContains(t, body, "storage")
+				require.NotContains(t, body, "not found")
+			},
+		},
+		{
+			name:        "Invalid token request",
+			path:        "/token",
+			method:      "POST",
+			body:        "grant_type=authorization_code&code=invalid",
+			contentType: "application/x-www-form-urlencoded",
+			checkFunc: func(t *testing.T, resp *http.Response, body string) {
+				// Token endpoint returns JSON errors which is correct OAuth2 behavior
+				// Just verify no internal details leak
+				for _, pattern := range sensitivePatterns {
+					require.NotContains(t, body, pattern,
+						"Response should not contain sensitive pattern: %s", pattern)
+				}
+			},
+		},
+		{
+			name:        "Invalid introspection request - no token",
+			path:        "/token/introspect",
+			method:      "POST",
+			body:        "",
+			contentType: "application/x-www-form-urlencoded",
+			checkFunc: func(t *testing.T, resp *http.Response, body string) {
+				for _, pattern := range sensitivePatterns {
+					require.NotContains(t, body, pattern,
+						"Response should not contain sensitive pattern: %s", pattern)
+				}
+			},
+		},
+		{
+			name:   "Device flow invalid user code",
+			path:   "/device/auth/verify_code",
+			method: "POST",
+			body:   "user_code=INVALID",
+			checkFunc: func(t *testing.T, resp *http.Response, body string) {
+				for _, pattern := range sensitivePatterns {
+					require.NotContains(t, body, pattern,
+						"Response should not contain sensitive pattern: %s", pattern)
+				}
+			},
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			httpServer, s := newTestServer(t, nil)
+			defer httpServer.Close()
+
+			if tc.setupFunc != nil {
+				tc.setupFunc(t, s)
+			}
+
+			var reqBody io.Reader
+			if tc.body != "" {
+				reqBody = strings.NewReader(tc.body)
+			}
+
+			req := httptest.NewRequest(tc.method, tc.path, reqBody)
+			if tc.contentType != "" {
+				req.Header.Set("Content-Type", tc.contentType)
+			}
+
+			rr := httptest.NewRecorder()
+			s.ServeHTTP(rr, req)
+
+			resp := rr.Result()
+			defer resp.Body.Close()
+
+			bodyBytes, err := io.ReadAll(resp.Body)
+			require.NoError(t, err)
+			body := string(bodyBytes)
+
+			if tc.checkFunc != nil {
+				tc.checkFunc(t, resp, body)
+			}
+		})
+	}
+}
+
+// TestLoginErrorMessageIsSafe verifies that the login error page
+// shows a safe, user-friendly message.
+func TestLoginErrorMessageIsSafe(t *testing.T) {
+	httpServer, s := newTestServer(t, nil)
+	defer httpServer.Close()
+
+	// Create a request that will trigger a login error
+	rr := httptest.NewRecorder()
+	req := httptest.NewRequest("GET", "/auth/nonexistent/login?state=test", nil)
+	s.ServeHTTP(rr, req)
+
+	resp := rr.Result()
+	defer resp.Body.Close()
+
+	body, _ := io.ReadAll(resp.Body)
+	bodyStr := string(body)
+
+	// Should not contain error stack traces or internal details
+	require.NotContains(t, bodyStr, "panic")
+	require.NotContains(t, bodyStr, ".go:")
+	require.NotContains(t, bodyStr, "goroutine")
+}
+
+// TestCallbackErrorMessageIsSafe verifies that callback errors
+// do not leak internal details.
+func TestCallbackErrorMessageIsSafe(t *testing.T) {
+	httpServer, s := newTestServer(t, nil)
+	defer httpServer.Close()
+
+	// Test OAuth2 callback with invalid state
+	rr := httptest.NewRecorder()
+	req := httptest.NewRequest("GET", "/callback?code=test&state=invalid", nil)
+	s.ServeHTTP(rr, req)
+
+	resp := rr.Result()
+	defer resp.Body.Close()
+
+	body, _ := io.ReadAll(resp.Body)
+	bodyStr := string(body)
+
+	// Should not contain storage error details
+	require.NotContains(t, bodyStr, "storage.ErrNotFound")
+	require.NotContains(t, bodyStr, "database")
+}
+
+// TestDeviceCallbackMethodError verifies that unsupported methods
+// return safe error messages.
+func TestDeviceCallbackMethodError(t *testing.T) {
+	httpServer, s := newTestServer(t, nil)
+	defer httpServer.Close()
+
+	// Test with unsupported method
+	rr := httptest.NewRecorder()
+	req := httptest.NewRequest("PUT", "/device/callback", nil)
+	s.ServeHTTP(rr, req)
+
+	resp := rr.Result()
+	defer resp.Body.Close()
+
+	body, _ := io.ReadAll(resp.Body)
+	bodyStr := string(body)
+
+	// Should not expose the method name in error
+	require.Equal(t, http.StatusBadRequest, resp.StatusCode)
+	require.NotContains(t, bodyStr, "PUT")
+	require.NotContains(t, bodyStr, "method not implemented")
+}
+
+// TestTokenErrorDoesNotLeakDetails tests that token errors don't leak internal details
+func TestTokenErrorDoesNotLeakDetails(t *testing.T) {
+	httpServer, s := newTestServer(t, nil)
+	defer httpServer.Close()
+
+	// Create a token request with invalid credentials
+	body := bytes.NewBufferString("grant_type=authorization_code&code=invalid_code")
+	req := httptest.NewRequest("POST", "/token", body)
+	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+	req.SetBasicAuth("invalid_client", "invalid_secret")
+
+	rr := httptest.NewRecorder()
+	s.ServeHTTP(rr, req)
+
+	resp := rr.Result()
+	defer resp.Body.Close()
+
+	respBody, _ := io.ReadAll(resp.Body)
+	bodyStr := string(respBody)
+
+	// Should not contain internal error details
+	require.NotContains(t, bodyStr, "storage")
+	require.NotContains(t, bodyStr, "not found")
+	require.NotContains(t, bodyStr, ".go:")
+}
diff --git a/server/server_flow_test.go b/server/server_flow_test.go
new file mode 100644
index 0000000000..7edade89df
--- /dev/null
+++ b/server/server_flow_test.go
@@ -0,0 +1,72 @@
+package server
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/require"
+
+	"github.com/dexidp/dex/server/internal"
+	"github.com/dexidp/dex/server/oauth2"
+	"github.com/dexidp/dex/storage"
+)
+
+// TestFlowStepsRequireHMAC verifies the dispatcher's step-skip protection: the
+// /auth dispatcher rejects requests that do not carry the HMAC the previous
+// step would have issued. A browser can only reach the dispatcher by being
+// redirected there with its HMAC, so a missing or wrong HMAC is rejected.
+func TestFlowStepsRequireHMAC(t *testing.T) {
+	ctx := t.Context()
+
+	httpServer, s := newTestServer(t, nil)
+	defer httpServer.Close()
+
+	authReq := storage.AuthRequest{
+		ID:            "flow-hmac-test",
+		ClientID:      "test",
+		ConnectorID:   "mock",
+		ResponseTypes: []string{oauth2.ResponseTypeCode},
+		RedirectURI:   "https://client.example/callback",
+		Expiry:        time.Now().Add(time.Minute),
+		LoggedIn:      true,
+		Claims:        storage.Claims{UserID: "u1"},
+		Scopes:        []string{"openid"},
+		HMACKey:       []byte("flow-hmac-test-key"),
+	}
+	require.NoError(t, s.storage.CreateAuthRequest(ctx, authReq))
+
+	// The dispatcher accepts only the "continue" and "approved" verifiers; a value
+	// minted for a different step (or none) is rejected.
+	wrongStepMAC := internal.SignStep(authReq, internal.StepMFA)
+
+	// Authenticator IDs are operator config and are signed the same way. They
+	// live in their own namespace, so an authenticator named after a step cannot
+	// hand the user that step's verifier — an "approved" authenticator must not
+	// let its factor URL double as a consent approval.
+	collidingMAC := internal.SignStep(authReq, internal.Authenticator("approved"))
+
+	for _, tc := range []struct {
+		name string
+		path string
+	}{
+		{"dispatcher without hmac", "/auth?req=" + authReq.ID},
+		{"dispatcher with wrong-step hmac", "/auth?req=" + authReq.ID + "&hmac=" + wrongStepMAC},
+		{"dispatcher with authenticator hmac named after a step", "/auth?req=" + authReq.ID + "&hmac=" + collidingMAC},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			rr := httptest.NewRecorder()
+			s.ServeHTTP(rr, httptest.NewRequest(http.MethodGet, tc.path, nil))
+			require.Equal(t, http.StatusUnauthorized, rr.Code)
+		})
+	}
+
+	// With no MFA configured and the "approved" verifier resolving consent, the
+	// dispatcher issues the code to the client.
+	rr := httptest.NewRecorder()
+	approvedMAC := internal.SignStep(authReq, internal.StepApproved)
+	s.ServeHTTP(rr, httptest.NewRequest(http.MethodGet, "/auth?req="+authReq.ID+"&hmac="+approvedMAC, nil))
+	require.Equal(t, http.StatusSeeOther, rr.Code)
+	require.Contains(t, rr.Header().Get("Location"), "https://client.example/callback")
+}
diff --git a/server/server_grant_authcode_test.go b/server/server_grant_authcode_test.go
new file mode 100644
index 0000000000..1db930b6c7
--- /dev/null
+++ b/server/server_grant_authcode_test.go
@@ -0,0 +1,113 @@
+package server
+
+import (
+	"context"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/coreos/go-oidc/v3/oidc"
+	"github.com/stretchr/testify/require"
+	xoauth2 "golang.org/x/oauth2"
+
+	"github.com/dexidp/dex/server/oauth2"
+	"github.com/dexidp/dex/storage"
+)
+
+// TestHandleAuthCode checks that it is forbidden to use same code twice
+func TestHandleAuthCode(t *testing.T) {
+	tests := []struct {
+		name       string
+		handleCode func(*testing.T, context.Context, *xoauth2.Config, string)
+	}{
+		{
+			name: "Code Reuse should return invalid_grant",
+			handleCode: func(t *testing.T, ctx context.Context, oauth2Config *xoauth2.Config, code string) {
+				_, err := oauth2Config.Exchange(ctx, code)
+				require.NoError(t, err)
+
+				_, err = oauth2Config.Exchange(ctx, code)
+				require.Error(t, err)
+
+				oauth2Err, ok := err.(*xoauth2.RetrieveError)
+				require.True(t, ok)
+
+				var errResponse struct{ Error string }
+				err = json.Unmarshal(oauth2Err.Body, &errResponse)
+				require.NoError(t, err)
+
+				// invalid_grant must be returned for invalid values
+				// https://tools.ietf.org/html/rfc6749#section-5.2
+				require.Equal(t, oauth2.InvalidGrant, errResponse.Error)
+			},
+		},
+		{
+			name: "No Code should return invalid_request",
+			handleCode: func(t *testing.T, ctx context.Context, oauth2Config *xoauth2.Config, _ string) {
+				_, err := oauth2Config.Exchange(ctx, "")
+				require.Error(t, err)
+
+				oauth2Err, ok := err.(*xoauth2.RetrieveError)
+				require.True(t, ok)
+
+				var errResponse struct{ Error string }
+				err = json.Unmarshal(oauth2Err.Body, &errResponse)
+				require.NoError(t, err)
+
+				require.Equal(t, oauth2.InvalidRequest, errResponse.Error)
+			},
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			ctx := t.Context()
+
+			httpServer, s := newTestServer(t, func(c *Config) { c.Issuer += "/non-root-path" })
+			defer httpServer.Close()
+
+			p, err := oidc.NewProvider(ctx, httpServer.URL)
+			require.NoError(t, err)
+
+			var oauth2Client oauth2Client
+			oauth2Client.server = httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+				if r.URL.Path != "/callback" {
+					http.Redirect(w, r, oauth2Client.config.AuthCodeURL(""), http.StatusSeeOther)
+					return
+				}
+
+				q := r.URL.Query()
+				require.Equal(t, q.Get("error"), "", q.Get("error_description"))
+
+				code := q.Get("code")
+				tc.handleCode(t, ctx, oauth2Client.config, code)
+
+				w.WriteHeader(http.StatusOK)
+			}))
+			defer oauth2Client.server.Close()
+
+			redirectURL := oauth2Client.server.URL + "/callback"
+			client := storage.Client{
+				ID:           "testclient",
+				Secret:       "testclientsecret",
+				RedirectURIs: []string{redirectURL},
+			}
+			err = s.storage.CreateClient(ctx, client)
+			require.NoError(t, err)
+
+			oauth2Client.config = &xoauth2.Config{
+				ClientID:     client.ID,
+				ClientSecret: client.Secret,
+				Endpoint:     p.Endpoint(),
+				Scopes:       []string{oidc.ScopeOpenID, "email", "offline_access"},
+				RedirectURL:  redirectURL,
+			}
+
+			resp, err := http.Get(oauth2Client.server.URL + "/login")
+			require.NoError(t, err)
+
+			resp.Body.Close()
+		})
+	}
+}
diff --git a/server/server_grant_clientcredentials_test.go b/server/server_grant_clientcredentials_test.go
new file mode 100644
index 0000000000..e199791bed
--- /dev/null
+++ b/server/server_grant_clientcredentials_test.go
@@ -0,0 +1,220 @@
+package server
+
+import (
+	"bytes"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"net/url"
+	"path"
+	"testing"
+	"time"
+
+	"github.com/coreos/go-oidc/v3/oidc"
+	"github.com/stretchr/testify/require"
+
+	"github.com/dexidp/dex/server/internal"
+	"github.com/dexidp/dex/storage"
+)
+
+func TestHandleClientCredentials(t *testing.T) {
+	tests := []struct {
+		name                    string
+		clientID                string
+		clientSecret            string
+		clientCredentialsClaims *storage.ClientCredentialsClaims
+		scopes                  string
+		wantCode                int
+		wantAccessTok           bool
+		wantIDToken             bool
+		wantUsername            string
+		wantGroups              []string
+	}{
+		{
+			name:          "Basic grant, no scopes",
+			clientID:      "test",
+			clientSecret:  "barfoo",
+			scopes:        "",
+			wantCode:      200,
+			wantAccessTok: true,
+			wantIDToken:   false,
+		},
+		{
+			name:          "With openid scope",
+			clientID:      "test",
+			clientSecret:  "barfoo",
+			scopes:        "openid",
+			wantCode:      200,
+			wantAccessTok: true,
+			wantIDToken:   true,
+		},
+		{
+			name:          "With openid and profile scope includes username",
+			clientID:      "test",
+			clientSecret:  "barfoo",
+			scopes:        "openid profile",
+			wantCode:      200,
+			wantAccessTok: true,
+			wantIDToken:   true,
+			wantUsername:  "Test Client",
+		},
+		{
+			name:          "With openid email profile groups",
+			clientID:      "test",
+			clientSecret:  "barfoo",
+			scopes:        "openid email profile groups",
+			wantCode:      200,
+			wantAccessTok: true,
+			wantIDToken:   true,
+			wantUsername:  "Test Client",
+		},
+		{
+			name:         "With groups scope and clientCredentialsClaims groups populated",
+			clientID:     "test",
+			clientSecret: "barfoo",
+			clientCredentialsClaims: &storage.ClientCredentialsClaims{
+				Groups: []string{"admin-group", "dev-group"},
+			},
+			scopes:        "openid groups",
+			wantCode:      200,
+			wantAccessTok: true,
+			wantIDToken:   true,
+			wantGroups:    []string{"admin-group", "dev-group"},
+		},
+		{
+			name:          "With groups scope but no clientCredentialsClaims configured",
+			clientID:      "test",
+			clientSecret:  "barfoo",
+			scopes:        "openid groups",
+			wantCode:      200,
+			wantAccessTok: true,
+			wantIDToken:   true,
+		},
+		{
+			name:         "Invalid client secret",
+			clientID:     "test",
+			clientSecret: "wrong",
+			scopes:       "",
+			wantCode:     401,
+		},
+		{
+			name:         "Unknown client",
+			clientID:     "nonexistent",
+			clientSecret: "secret",
+			scopes:       "",
+			wantCode:     401,
+		},
+		{
+			name:         "offline_access scope rejected",
+			clientID:     "test",
+			clientSecret: "barfoo",
+			scopes:       "openid offline_access",
+			wantCode:     400,
+		},
+		{
+			name:         "Unrecognized scope",
+			clientID:     "test",
+			clientSecret: "barfoo",
+			scopes:       "openid bogus",
+			wantCode:     400,
+		},
+	}
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			ctx := t.Context()
+
+			httpServer, s := newTestServer(t, func(c *Config) {
+				c.Now = time.Now
+			})
+			defer httpServer.Close()
+
+			// Create a confidential client for testing.
+			err := s.storage.CreateClient(ctx, storage.Client{
+				ID:                      "test",
+				Secret:                  "barfoo",
+				RedirectURIs:            []string{"https://example.com/callback"},
+				Name:                    "Test Client",
+				ClientCredentialsClaims: tc.clientCredentialsClaims,
+			})
+			require.NoError(t, err)
+
+			u, err := url.Parse(s.issuerURL.String())
+			require.NoError(t, err)
+			u.Path = path.Join(u.Path, "/token")
+
+			v := url.Values{}
+			v.Add("grant_type", "client_credentials")
+			if tc.scopes != "" {
+				v.Add("scope", tc.scopes)
+			}
+
+			req, _ := http.NewRequest("POST", u.String(), bytes.NewBufferString(v.Encode()))
+			req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+			req.SetBasicAuth(tc.clientID, tc.clientSecret)
+
+			rr := httptest.NewRecorder()
+			s.ServeHTTP(rr, req)
+
+			require.Equal(t, tc.wantCode, rr.Code)
+
+			if tc.wantCode == 200 {
+				var resp struct {
+					AccessToken  string `json:"access_token"`
+					TokenType    string `json:"token_type"`
+					ExpiresIn    int    `json:"expires_in"`
+					IDToken      string `json:"id_token"`
+					RefreshToken string `json:"refresh_token"`
+				}
+				err := json.Unmarshal(rr.Body.Bytes(), &resp)
+				require.NoError(t, err)
+
+				if tc.wantAccessTok {
+					require.NotEmpty(t, resp.AccessToken)
+					require.Equal(t, "bearer", resp.TokenType)
+					require.Greater(t, resp.ExpiresIn, 0)
+				}
+				if tc.wantIDToken {
+					require.NotEmpty(t, resp.IDToken)
+
+					// Verify the ID token claims.
+					provider, err := oidc.NewProvider(ctx, httpServer.URL)
+					require.NoError(t, err)
+					verifier := provider.Verifier(&oidc.Config{ClientID: tc.clientID})
+					idToken, err := verifier.Verify(ctx, resp.IDToken)
+					require.NoError(t, err)
+
+					// Decode the subject to verify the connector ID.
+					var sub internal.IDTokenSubject
+					require.NoError(t, internal.Unmarshal(idToken.Subject, &sub))
+					require.Equal(t, "", sub.ConnId)
+					require.Equal(t, tc.clientID, sub.UserId)
+
+					var claims struct {
+						Name              string   `json:"name"`
+						PreferredUsername string   `json:"preferred_username"`
+						Groups            []string `json:"groups"`
+					}
+					require.NoError(t, idToken.Claims(&claims))
+
+					if tc.wantUsername != "" {
+						require.Equal(t, tc.wantUsername, claims.Name)
+						require.Equal(t, tc.wantUsername, claims.PreferredUsername)
+					} else {
+						require.Empty(t, claims.Name)
+						require.Empty(t, claims.PreferredUsername)
+					}
+
+					if tc.wantGroups != nil {
+						require.Equal(t, tc.wantGroups, claims.Groups)
+					} else {
+						require.Empty(t, claims.Groups)
+					}
+				} else {
+					require.Empty(t, resp.IDToken)
+				}
+				// client_credentials must never return a refresh token.
+				require.Empty(t, resp.RefreshToken)
+			}
+		})
+	}
+}
diff --git a/server/server_grant_devicecode_test.go b/server/server_grant_devicecode_test.go
new file mode 100644
index 0000000000..a7377d3244
--- /dev/null
+++ b/server/server_grant_devicecode_test.go
@@ -0,0 +1,295 @@
+package server
+
+import (
+	"bytes"
+	"encoding/json"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"net/url"
+	"path"
+	"testing"
+	"time"
+
+	"github.com/dexidp/dex/server/oauth2"
+	"github.com/dexidp/dex/storage"
+)
+
+func TestDeviceTokenResponse(t *testing.T) {
+	t0 := time.Now()
+
+	now := func() time.Time { return t0 }
+
+	// Base PKCE values
+	// base64-urlencoded, sha256 digest of code_verifier
+	codeChallenge := "L7ZqsT_zNwvrH8E7J0CqPHx1wgBaFiaE-fAZcKUUAbc"
+	codeChallengeMethod := "S256"
+	// "random" string between 43 & 128 ASCII characters
+	codeVerifier := "66114650f56cc45dee7ee03c49f048ddf9aa53cbf5b09985832fa4f790ff2604"
+
+	baseDeviceRequest := storage.DeviceRequest{
+		UserCode:   "ABCD-WXYZ",
+		DeviceCode: "foo",
+		ClientID:   "testclient",
+		Scopes:     []string{"openid", "profile", "offline_access"},
+		Expiry:     now().Add(5 * time.Minute),
+	}
+
+	tests := []struct {
+		testName               string
+		testDeviceRequest      storage.DeviceRequest
+		testDeviceToken        storage.DeviceToken
+		testDeviceCode         string
+		testCodeVerifier       string
+		expectedServerResponse string
+		expectedResponseCode   int
+	}{
+		{
+			testName:          "Valid but pending token",
+			testDeviceRequest: baseDeviceRequest,
+			testDeviceToken: storage.DeviceToken{
+				DeviceCode:          "f00bar",
+				Status:              oauth2.DeviceTokenPending,
+				Token:               "",
+				Expiry:              now().Add(5 * time.Minute),
+				LastRequestTime:     time.Time{},
+				PollIntervalSeconds: 0,
+			},
+			testDeviceCode:         "f00bar",
+			expectedServerResponse: oauth2.DeviceTokenPending,
+			expectedResponseCode:   http.StatusBadRequest,
+		},
+		{
+			testName:          "Test Slow Down State",
+			testDeviceRequest: baseDeviceRequest,
+			testDeviceToken: storage.DeviceToken{
+				DeviceCode:          "f00bar",
+				Status:              oauth2.DeviceTokenPending,
+				Token:               "",
+				Expiry:              now().Add(5 * time.Minute),
+				LastRequestTime:     now(),
+				PollIntervalSeconds: 10,
+			},
+			testDeviceCode:         "f00bar",
+			expectedServerResponse: oauth2.DeviceTokenSlowDown,
+			expectedResponseCode:   http.StatusBadRequest,
+		},
+		{
+			testName:          "Test Expired Device Token",
+			testDeviceRequest: baseDeviceRequest,
+			testDeviceToken: storage.DeviceToken{
+				DeviceCode:          "f00bar",
+				Status:              oauth2.DeviceTokenPending,
+				Token:               "",
+				Expiry:              now().Add(-5 * time.Minute),
+				LastRequestTime:     time.Time{},
+				PollIntervalSeconds: 0,
+			},
+			testDeviceCode:         "f00bar",
+			expectedServerResponse: oauth2.DeviceTokenExpired,
+			expectedResponseCode:   http.StatusBadRequest,
+		},
+		{
+			testName:          "Test Nonexistent Device Code",
+			testDeviceRequest: baseDeviceRequest,
+			testDeviceToken: storage.DeviceToken{
+				DeviceCode:          "foo",
+				Status:              oauth2.DeviceTokenPending,
+				Token:               "",
+				Expiry:              now().Add(-5 * time.Minute),
+				LastRequestTime:     time.Time{},
+				PollIntervalSeconds: 0,
+			},
+			testDeviceCode:         "bar",
+			expectedServerResponse: oauth2.InvalidRequest,
+			expectedResponseCode:   http.StatusBadRequest,
+		},
+		{
+			testName:          "Empty Device Code in Request",
+			testDeviceRequest: baseDeviceRequest,
+			testDeviceToken: storage.DeviceToken{
+				DeviceCode:          "bar",
+				Status:              oauth2.DeviceTokenPending,
+				Token:               "",
+				Expiry:              now().Add(-5 * time.Minute),
+				LastRequestTime:     time.Time{},
+				PollIntervalSeconds: 0,
+			},
+			testDeviceCode:         "",
+			expectedServerResponse: oauth2.InvalidRequest,
+			expectedResponseCode:   http.StatusBadRequest,
+		},
+		{
+			testName:          "Claim validated token from Device Code",
+			testDeviceRequest: baseDeviceRequest,
+			testDeviceToken: storage.DeviceToken{
+				DeviceCode:          "foo",
+				Status:              oauth2.DeviceTokenComplete,
+				Token:               "{\"access_token\": \"foobar\"}",
+				Expiry:              now().Add(5 * time.Minute),
+				LastRequestTime:     time.Time{},
+				PollIntervalSeconds: 0,
+			},
+			testDeviceCode:         "foo",
+			expectedServerResponse: "{\"access_token\": \"foobar\"}",
+			expectedResponseCode:   http.StatusOK,
+		},
+		{
+			testName: "Successful Exchange with PKCE",
+			testDeviceToken: storage.DeviceToken{
+				DeviceCode:          "foo",
+				Status:              oauth2.DeviceTokenComplete,
+				Token:               "{\"access_token\": \"foobar\"}",
+				Expiry:              now().Add(5 * time.Minute),
+				LastRequestTime:     time.Time{},
+				PollIntervalSeconds: 0,
+				PKCE: storage.PKCE{
+					CodeChallenge:       codeChallenge,
+					CodeChallengeMethod: codeChallengeMethod,
+				},
+			},
+			testDeviceCode:         "foo",
+			testCodeVerifier:       codeVerifier,
+			testDeviceRequest:      baseDeviceRequest,
+			expectedServerResponse: "{\"access_token\": \"foobar\"}",
+			expectedResponseCode:   http.StatusOK,
+		},
+		{
+			testName: "Test Exchange started with PKCE but without verifier provided",
+			testDeviceToken: storage.DeviceToken{
+				DeviceCode:          "foo",
+				Status:              oauth2.DeviceTokenComplete,
+				Token:               "{\"access_token\": \"foobar\"}",
+				Expiry:              now().Add(5 * time.Minute),
+				LastRequestTime:     time.Time{},
+				PollIntervalSeconds: 0,
+				PKCE: storage.PKCE{
+					CodeChallenge:       codeChallenge,
+					CodeChallengeMethod: codeChallengeMethod,
+				},
+			},
+			testDeviceCode:         "foo",
+			testDeviceRequest:      baseDeviceRequest,
+			expectedServerResponse: oauth2.InvalidGrant,
+			expectedResponseCode:   http.StatusBadRequest,
+		},
+		{
+			testName: "Test Exchange not started with PKCE but verifier provided",
+			testDeviceToken: storage.DeviceToken{
+				DeviceCode:          "foo",
+				Status:              oauth2.DeviceTokenComplete,
+				Token:               "{\"access_token\": \"foobar\"}",
+				Expiry:              now().Add(5 * time.Minute),
+				LastRequestTime:     time.Time{},
+				PollIntervalSeconds: 0,
+			},
+			testDeviceCode:         "foo",
+			testCodeVerifier:       codeVerifier,
+			testDeviceRequest:      baseDeviceRequest,
+			expectedServerResponse: oauth2.InvalidRequest,
+			expectedResponseCode:   http.StatusBadRequest,
+		},
+		{
+			testName: "Test with PKCE but incorrect verifier provided",
+			testDeviceToken: storage.DeviceToken{
+				DeviceCode:          "foo",
+				Status:              oauth2.DeviceTokenComplete,
+				Token:               "{\"access_token\": \"foobar\"}",
+				Expiry:              now().Add(5 * time.Minute),
+				LastRequestTime:     time.Time{},
+				PollIntervalSeconds: 0,
+				PKCE: storage.PKCE{
+					CodeChallenge:       codeChallenge,
+					CodeChallengeMethod: codeChallengeMethod,
+				},
+			},
+			testDeviceCode:         "foo",
+			testCodeVerifier:       "invalid",
+			testDeviceRequest:      baseDeviceRequest,
+			expectedServerResponse: oauth2.InvalidGrant,
+			expectedResponseCode:   http.StatusBadRequest,
+		},
+		{
+			testName: "Test with PKCE but incorrect challenge provided",
+			testDeviceToken: storage.DeviceToken{
+				DeviceCode:          "foo",
+				Status:              oauth2.DeviceTokenComplete,
+				Token:               "{\"access_token\": \"foobar\"}",
+				Expiry:              now().Add(5 * time.Minute),
+				LastRequestTime:     time.Time{},
+				PollIntervalSeconds: 0,
+				PKCE: storage.PKCE{
+					CodeChallenge:       "invalid",
+					CodeChallengeMethod: codeChallengeMethod,
+				},
+			},
+			testDeviceCode:         "foo",
+			testCodeVerifier:       codeVerifier,
+			testDeviceRequest:      baseDeviceRequest,
+			expectedServerResponse: oauth2.InvalidGrant,
+			expectedResponseCode:   http.StatusBadRequest,
+		},
+	}
+	for _, tc := range tests {
+		t.Run(tc.testName, func(t *testing.T) {
+			ctx := t.Context()
+
+			// Setup a dex server.
+			httpServer, s := newTestServer(t, func(c *Config) {
+				c.Issuer += "/non-root-path"
+				c.Now = now
+			})
+			defer httpServer.Close()
+
+			if err := s.storage.CreateDeviceRequest(ctx, tc.testDeviceRequest); err != nil {
+				t.Fatalf("Failed to store device token %v", err)
+			}
+
+			if err := s.storage.CreateDeviceToken(ctx, tc.testDeviceToken); err != nil {
+				t.Fatalf("Failed to store device token %v", err)
+			}
+
+			u, err := url.Parse(s.issuerURL.String())
+			if err != nil {
+				t.Fatalf("Could not parse issuer URL %v", err)
+			}
+			u.Path = path.Join(u.Path, "token")
+
+			data := url.Values{}
+			data.Set("grant_type", oauth2.GrantTypeDeviceCode)
+			data.Set("device_code", tc.testDeviceCode)
+			if tc.testCodeVerifier != "" {
+				data.Set("code_verifier", tc.testCodeVerifier)
+			}
+			req, _ := http.NewRequest("POST", u.String(), bytes.NewBufferString(data.Encode()))
+			req.Header.Set("Content-Type", "application/x-www-form-urlencoded; param=value")
+
+			rr := httptest.NewRecorder()
+			s.ServeHTTP(rr, req)
+			if rr.Code != tc.expectedResponseCode {
+				t.Errorf("Unexpected Response Type.  Expected %v got %v", tc.expectedResponseCode, rr.Code)
+			}
+
+			body, err := io.ReadAll(rr.Body)
+			if err != nil {
+				t.Errorf("Could read token response %v", err)
+			}
+			if tc.expectedResponseCode == http.StatusBadRequest || tc.expectedResponseCode == http.StatusUnauthorized {
+				expectJSONErrorResponse(tc.testName, body, tc.expectedServerResponse, t)
+			} else if string(body) != tc.expectedServerResponse {
+				t.Errorf("Unexpected Server Response.  Expected %v got %v", tc.expectedServerResponse, string(body))
+			}
+		})
+	}
+}
+
+func expectJSONErrorResponse(testCase string, body []byte, expectedError string, t *testing.T) {
+	jsonMap := make(map[string]any)
+	err := json.Unmarshal(body, &jsonMap)
+	if err != nil {
+		t.Errorf("Unexpected error unmarshalling response: %v", err)
+	}
+	if jsonMap["error"] != expectedError {
+		t.Errorf("Test Case %s expected error %v, received %v", testCase, expectedError, jsonMap["error"])
+	}
+}
diff --git a/server/server_grant_password_test.go b/server/server_grant_password_test.go
new file mode 100644
index 0000000000..f8afdde058
--- /dev/null
+++ b/server/server_grant_password_test.go
@@ -0,0 +1,239 @@
+package server
+
+import (
+	"bytes"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"net/url"
+	"path"
+	"testing"
+	"time"
+
+	"github.com/coreos/go-oidc/v3/oidc"
+	"github.com/stretchr/testify/require"
+	"golang.org/x/crypto/bcrypt"
+
+	"github.com/dexidp/dex/server/connectors"
+	"github.com/dexidp/dex/storage"
+)
+
+func TestHandlePassword(t *testing.T) {
+	ctx := t.Context()
+
+	tests := []struct {
+		name                  string
+		scopes                string
+		offlineSessionCreated bool
+	}{
+		{
+			name:                  "Password login, request refresh token",
+			scopes:                "openid offline_access email",
+			offlineSessionCreated: true,
+		},
+		{
+			name:                  "Password login",
+			scopes:                "openid email",
+			offlineSessionCreated: false,
+		},
+	}
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			// Setup a dex server.
+			httpServer, s := newTestServer(t, func(c *Config) {
+				c.PasswordConnector = "test"
+				c.Now = time.Now
+			})
+			defer httpServer.Close()
+
+			mockConnectorDataTestStorage(t, s.storage)
+
+			makeReq := func(username, password string) *httptest.ResponseRecorder {
+				u, err := url.Parse(s.issuerURL.String())
+				require.NoError(t, err)
+
+				u.Path = path.Join(u.Path, "/token")
+				v := url.Values{}
+				v.Add("scope", tc.scopes)
+				v.Add("grant_type", "password")
+				v.Add("username", username)
+				v.Add("password", password)
+
+				req, _ := http.NewRequest("POST", u.String(), bytes.NewBufferString(v.Encode()))
+				req.Header.Set("Content-Type", "application/x-www-form-urlencoded; param=value")
+				req.SetBasicAuth("test", "barfoo")
+
+				rr := httptest.NewRecorder()
+				s.ServeHTTP(rr, req)
+
+				return rr
+			}
+
+			// Check unauthorized error
+			{
+				rr := makeReq("test", "invalid")
+				require.Equal(t, 401, rr.Code)
+			}
+
+			// Check that we received expected refresh token
+			{
+				rr := makeReq("test", "test")
+				require.Equal(t, 200, rr.Code)
+
+				var ref struct {
+					Token string `json:"refresh_token"`
+				}
+				err := json.Unmarshal(rr.Body.Bytes(), &ref)
+				require.NoError(t, err)
+
+				newSess, err := s.storage.GetOfflineSessions(ctx, "0-385-28089-0", "test")
+				if tc.offlineSessionCreated {
+					require.NoError(t, err)
+					require.Equal(t, `{"test": "true"}`, string(newSess.ConnectorData))
+				} else {
+					require.Error(t, storage.ErrNotFound, err)
+				}
+			}
+		})
+	}
+}
+
+func TestHandlePassword_LocalPasswordDBClaims(t *testing.T) {
+	ctx := t.Context()
+
+	// Setup a dex server.
+	httpServer, s := newTestServer(t, func(c *Config) {
+		c.PasswordConnector = "local"
+	})
+	defer httpServer.Close()
+
+	// Client credentials for password grant.
+	client := storage.Client{
+		ID:           "test",
+		Secret:       "barfoo",
+		RedirectURIs: []string{"foo://bar.com/", "https://auth.example.com"},
+	}
+	require.NoError(t, s.storage.CreateClient(ctx, client))
+
+	// Enable local connector.
+	localConn := storage.Connector{
+		ID:              "local",
+		Type:            connectors.LocalConnector,
+		Name:            "Email",
+		ResourceVersion: "1",
+	}
+	require.NoError(t, s.storage.CreateConnector(ctx, localConn))
+	_, err := s.connectors.Open(localConn)
+	require.NoError(t, err)
+
+	// Create a user in the password DB with groups and preferred_username.
+	pw := "secret"
+	hash, err := bcrypt.GenerateFromPassword([]byte(pw), bcrypt.DefaultCost)
+	require.NoError(t, err)
+	require.NoError(t, s.storage.CreatePassword(ctx, storage.Password{
+		Email:             "user@example.com",
+		Username:          "user-login",
+		Name:              "User Full Name",
+		EmailVerified:     boolPtr(false),
+		PreferredUsername: "user-public",
+		UserID:            "user-id",
+		Groups:            []string{"team-a", "team-a/admins"},
+		Hash:              hash,
+	}))
+
+	u, err := url.Parse(s.issuerURL.String())
+	require.NoError(t, err)
+	u.Path = path.Join(u.Path, "/token")
+
+	v := url.Values{}
+	v.Add("scope", "openid profile email groups")
+	v.Add("grant_type", "password")
+	v.Add("username", "user@example.com")
+	v.Add("password", pw)
+
+	req, _ := http.NewRequest("POST", u.String(), bytes.NewBufferString(v.Encode()))
+	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+	req.SetBasicAuth("test", "barfoo")
+
+	rr := httptest.NewRecorder()
+	s.ServeHTTP(rr, req)
+	require.Equal(t, http.StatusOK, rr.Code)
+
+	var tokenResponse struct {
+		IDToken string `json:"id_token"`
+	}
+	require.NoError(t, json.Unmarshal(rr.Body.Bytes(), &tokenResponse))
+	require.NotEmpty(t, tokenResponse.IDToken)
+
+	p, err := oidc.NewProvider(ctx, httpServer.URL)
+	require.NoError(t, err)
+	idToken, err := p.Verifier(&oidc.Config{SkipClientIDCheck: true}).Verify(ctx, tokenResponse.IDToken)
+	require.NoError(t, err)
+
+	var claims struct {
+		Name              string   `json:"name"`
+		EmailVerified     bool     `json:"email_verified"`
+		PreferredUsername string   `json:"preferred_username"`
+		Groups            []string `json:"groups"`
+	}
+	require.NoError(t, idToken.Claims(&claims))
+	require.Equal(t, "User Full Name", claims.Name)
+	require.False(t, claims.EmailVerified)
+	require.Equal(t, "user-public", claims.PreferredUsername)
+	require.Equal(t, []string{"team-a", "team-a/admins"}, claims.Groups)
+}
+
+// TestHandlePasswordAllowedConnectors verifies the password grant enforces the
+// client's AllowedConnectors (mirrors TestHandleTokenExchangeAllowedConnectors
+// and TestHandleRefreshTokenAllowedConnectors — every token grant must enforce it).
+func TestHandlePasswordAllowedConnectors(t *testing.T) {
+	tests := []struct {
+		name              string
+		allowedConnectors []string
+		expectedCode      int
+	}{
+		{"connector in allowed list", []string{"test"}, http.StatusOK},
+		{"connector matches non-first entry", []string{"other", "test"}, http.StatusOK},
+		{"connector not in allowed list", []string{"other"}, http.StatusBadRequest},
+		{"empty allowed list permits any connector", nil, http.StatusOK},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			ctx := t.Context()
+			httpServer, s := newTestServer(t, func(c *Config) {
+				c.PasswordConnector = "test"
+				c.Now = time.Now
+			})
+			defer httpServer.Close()
+
+			mockConnectorDataTestStorage(t, s.storage)
+			require.NoError(t, s.storage.UpdateClient(ctx, "test", func(c storage.Client) (storage.Client, error) {
+				c.AllowedConnectors = tc.allowedConnectors
+				return c, nil
+			}))
+
+			u, err := url.Parse(s.issuerURL.String())
+			require.NoError(t, err)
+			u.Path = path.Join(u.Path, "/token")
+
+			v := url.Values{}
+			v.Add("scope", "openid email")
+			v.Add("grant_type", "password")
+			v.Add("username", "test")
+			v.Add("password", "test")
+
+			req, _ := http.NewRequest("POST", u.String(), bytes.NewBufferString(v.Encode()))
+			req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+			req.SetBasicAuth("test", "barfoo")
+
+			rr := httptest.NewRecorder()
+			s.ServeHTTP(rr, req)
+			require.Equal(t, tc.expectedCode, rr.Code, rr.Body.String())
+			if tc.expectedCode == http.StatusBadRequest {
+				require.Contains(t, rr.Body.String(), "Connector not allowed",
+					"rejection must be for the connector policy, not an unrelated reason")
+			}
+		})
+	}
+}
diff --git a/server/server_grant_refresh_test.go b/server/server_grant_refresh_test.go
new file mode 100644
index 0000000000..c7beb0af62
--- /dev/null
+++ b/server/server_grant_refresh_test.go
@@ -0,0 +1,679 @@
+package server
+
+import (
+	"bytes"
+	"context"
+	"encoding/base64"
+	"encoding/json"
+	"errors"
+	"net/http"
+	"net/http/httptest"
+	"net/url"
+	"path"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/dexidp/dex/connector"
+	"github.com/dexidp/dex/server/connectors"
+	"github.com/dexidp/dex/server/internal"
+	"github.com/dexidp/dex/server/session"
+	"github.com/dexidp/dex/server/tokens"
+	"github.com/dexidp/dex/storage"
+)
+
+func mockRefreshTokenTestStorage(t *testing.T, s storage.Storage, useObsolete bool) {
+	ctx := t.Context()
+	c := storage.Client{
+		ID:           "test",
+		Secret:       "barfoo",
+		RedirectURIs: []string{"foo://bar.com/", "https://auth.example.com"},
+		Name:         "dex client",
+		LogoURL:      "https://goo.gl/JIyzIC",
+	}
+
+	err := s.CreateClient(ctx, c)
+	require.NoError(t, err)
+
+	c1 := storage.Connector{
+		ID:     "test",
+		Type:   "mockCallback",
+		Name:   "mockCallback",
+		Config: nil,
+	}
+
+	err = s.CreateConnector(ctx, c1)
+	require.NoError(t, err)
+
+	refresh := storage.RefreshToken{
+		ID:            "test",
+		Token:         "bar",
+		ObsoleteToken: "",
+		Nonce:         "foo",
+		ClientID:      "test",
+		ConnectorID:   "test",
+		Scopes:        []string{"openid", "email", "profile"},
+		CreatedAt:     time.Now().UTC().Round(time.Millisecond),
+		LastUsed:      time.Now().UTC().Round(time.Millisecond),
+		Claims: storage.Claims{
+			UserID:        "1",
+			Username:      "jane",
+			Email:         "jane.doe@example.com",
+			EmailVerified: true,
+			Groups:        []string{"a", "b"},
+		},
+		ConnectorData: []byte(`{"some":"data"}`),
+	}
+
+	if useObsolete {
+		refresh.Token = "testtest"
+		refresh.ObsoleteToken = "bar"
+	}
+
+	err = s.CreateRefresh(ctx, refresh)
+	require.NoError(t, err)
+
+	offlineSessions := storage.OfflineSessions{
+		UserID:        "1",
+		ConnID:        "test",
+		Refresh:       map[string]*storage.RefreshTokenRef{"test": {ID: "test", ClientID: "test"}},
+		ConnectorData: nil,
+	}
+
+	err = s.CreateOfflineSessions(ctx, offlineSessions)
+	require.NoError(t, err)
+}
+
+func TestRefreshTokenExpirationScenarios(t *testing.T) {
+	t0 := time.Now()
+	tests := []struct {
+		name        string
+		policy      *tokens.RefreshStrategy
+		useObsolete bool
+		error       string
+	}{
+		{
+			name:   "Normal",
+			policy: tokens.NewRefreshStrategy(true, 0, 0, 0, nil),
+			error:  ``,
+		},
+		{
+			name:   "Not expired because used",
+			policy: tokens.NewRefreshStrategy(false, 0, time.Second*60, 0, func() time.Time { return t0.Add(time.Second * 25) }),
+			error:  ``,
+		},
+		{
+			name:   "Expired because not used",
+			policy: tokens.NewRefreshStrategy(false, 0, time.Second*60, 0, func() time.Time { return t0.Add(time.Hour) }),
+			error:  `{"error":"invalid_request","error_description":"Refresh token expired."}`,
+		},
+		{
+			name:   "Absolutely expired",
+			policy: tokens.NewRefreshStrategy(true, time.Second*60, 0, 0, func() time.Time { return t0.Add(time.Hour) }),
+			error:  `{"error":"invalid_request","error_description":"Refresh token expired."}`,
+		},
+		{
+			name:        "Obsolete tokens are allowed",
+			useObsolete: true,
+			policy:      tokens.NewRefreshStrategy(true, 0, 0, time.Second*30, func() time.Time { return t0.Add(time.Second * 25) }),
+			error:       ``,
+		},
+		{
+			name:        "Obsolete tokens are not allowed",
+			useObsolete: true,
+			policy:      tokens.NewRefreshStrategy(true, 0, 0, 0, func() time.Time { return t0.Add(time.Second * 25) }),
+			error:       `{"error":"invalid_request","error_description":"Refresh token is invalid or has already been claimed by another client."}`,
+		},
+		{
+			name:        "Obsolete tokens are allowed but token is expired globally",
+			useObsolete: true,
+			policy:      tokens.NewRefreshStrategy(true, time.Second*20, 0, time.Second*30, func() time.Time { return t0.Add(time.Second * 25) }),
+			error:       `{"error":"invalid_request","error_description":"Refresh token expired."}`,
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(*testing.T) {
+			// Setup a dex server.
+			httpServer, s := newTestServer(t, func(c *Config) {
+				c.RefreshTokenPolicy = tc.policy
+				c.Now = func() time.Time { return t0 }
+			})
+			defer httpServer.Close()
+
+			mockRefreshTokenTestStorage(t, s.storage, tc.useObsolete)
+
+			u, err := url.Parse(s.issuerURL.String())
+			require.NoError(t, err)
+
+			tokenData, err := internal.Marshal(&internal.RefreshToken{RefreshId: "test", Token: "bar"})
+			require.NoError(t, err)
+
+			u.Path = path.Join(u.Path, "/token")
+			v := url.Values{}
+			v.Add("grant_type", "refresh_token")
+			v.Add("refresh_token", tokenData)
+
+			req, _ := http.NewRequest("POST", u.String(), bytes.NewBufferString(v.Encode()))
+			req.Header.Set("Content-Type", "application/x-www-form-urlencoded; param=value")
+			req.SetBasicAuth("test", "barfoo")
+
+			rr := httptest.NewRecorder()
+			s.ServeHTTP(rr, req)
+
+			if tc.error == "" {
+				require.Equal(t, 200, rr.Code)
+			} else {
+				require.Equal(t, rr.Body.String(), tc.error)
+				return
+			}
+
+			// Check that we received expected refresh token
+			var ref struct {
+				Token string `json:"refresh_token"`
+			}
+			err = json.Unmarshal(rr.Body.Bytes(), &ref)
+			require.NoError(t, err)
+
+			if !tc.policy.RotationEnabled() {
+				require.Equal(t, tokenData, ref.Token)
+			} else {
+				require.NotEqual(t, tokenData, ref.Token)
+			}
+
+			if tc.useObsolete {
+				updatedTokenData, err := internal.Marshal(&internal.RefreshToken{RefreshId: "test", Token: "testtest"})
+				require.NoError(t, err)
+				require.Equal(t, updatedTokenData, ref.Token)
+			}
+		})
+	}
+}
+
+// decodeJWTClaims decodes the payload of a JWT token without verifying the signature.
+func decodeJWTClaims(t *testing.T, token string) map[string]any {
+	t.Helper()
+	parts := strings.SplitN(token, ".", 3)
+	require.Len(t, parts, 3, "JWT should have 3 parts")
+
+	payload, err := base64.RawURLEncoding.DecodeString(parts[1])
+	require.NoError(t, err)
+
+	var claims map[string]any
+	err = json.Unmarshal(payload, &claims)
+	require.NoError(t, err)
+	return claims
+}
+
+func TestRefreshTokenAuthTime(t *testing.T) {
+	t0 := time.Now().UTC().Round(time.Second)
+	loginTime := t0.Add(-10 * time.Minute)
+
+	tests := []struct {
+		name               string
+		sessionConfig      *session.Config
+		createUserIdentity bool
+		wantAuthTime       bool
+		wantHTTPError      bool
+	}{
+		{
+			name: "sessions enabled with user identity",
+			sessionConfig: &session.Config{
+				CookieName:       "dex_session",
+				AbsoluteLifetime: 24 * time.Hour,
+			},
+			createUserIdentity: true,
+			wantAuthTime:       true,
+		},
+		{
+			name:               "sessions disabled",
+			sessionConfig:      nil,
+			createUserIdentity: false,
+			wantAuthTime:       false,
+		},
+		{
+			name: "sessions enabled but user identity missing",
+			sessionConfig: &session.Config{
+				CookieName:       "dex_session",
+				AbsoluteLifetime: 24 * time.Hour,
+			},
+			createUserIdentity: false,
+			wantHTTPError:      true,
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			httpServer, s := newTestServer(t, func(c *Config) {
+				c.Now = func() time.Time { return t0 }
+				c.SessionConfig = tc.sessionConfig
+			})
+			defer httpServer.Close()
+
+			mockRefreshTokenTestStorage(t, s.storage, false)
+
+			if tc.createUserIdentity {
+				// UserIdentity must match the refresh token's Claims.UserID ("1")
+				// because updateRefreshToken looks it up by that ID.
+				err := s.storage.CreateUserIdentity(t.Context(), storage.UserIdentity{
+					UserID:      "1",
+					ConnectorID: "test",
+					Claims: storage.Claims{
+						UserID:        "1",
+						Username:      "jane",
+						Email:         "jane.doe@example.com",
+						EmailVerified: true,
+						Groups:        []string{"a", "b"},
+					},
+					CreatedAt: loginTime,
+					LastLogin: loginTime,
+				})
+				require.NoError(t, err)
+			}
+
+			u, err := url.Parse(s.issuerURL.String())
+			require.NoError(t, err)
+
+			tokenData, err := internal.Marshal(&internal.RefreshToken{RefreshId: "test", Token: "bar"})
+			require.NoError(t, err)
+
+			u.Path = path.Join(u.Path, "/token")
+			v := url.Values{}
+			v.Add("grant_type", "refresh_token")
+			v.Add("refresh_token", tokenData)
+
+			req, _ := http.NewRequest("POST", u.String(), bytes.NewBufferString(v.Encode()))
+			req.Header.Set("Content-Type", "application/x-www-form-urlencoded; param=value")
+			req.SetBasicAuth("test", "barfoo")
+
+			rr := httptest.NewRecorder()
+			s.ServeHTTP(rr, req)
+
+			if tc.wantHTTPError {
+				assert.Equal(t, http.StatusInternalServerError, rr.Code)
+				return
+			}
+			require.Equal(t, http.StatusOK, rr.Code)
+
+			var resp struct {
+				AccessToken  string `json:"access_token"`
+				IDToken      string `json:"id_token"`
+				RefreshToken string `json:"refresh_token"`
+			}
+			err = json.Unmarshal(rr.Body.Bytes(), &resp)
+			require.NoError(t, err)
+
+			accessClaims := decodeJWTClaims(t, resp.AccessToken)
+
+			if tc.wantAuthTime {
+				assert.Equal(t, float64(loginTime.Unix()), accessClaims["auth_time"],
+					"access token auth_time should match UserIdentity.LastLogin")
+			} else {
+				assert.Nil(t, accessClaims["auth_time"],
+					"access token should not have auth_time when sessions are disabled")
+			}
+
+			if tc.wantAuthTime {
+				idClaims := decodeJWTClaims(t, resp.IDToken)
+				assert.Equal(t, float64(loginTime.Unix()), idClaims["auth_time"],
+					"id token auth_time should match UserIdentity.LastLogin")
+			}
+		})
+	}
+}
+
+// failingRefreshConnector implements connector.CallbackConnector and connector.RefreshConnector
+// but always returns an error on Refresh, proving that the upstream is not contacted.
+type failingRefreshConnector struct {
+	identity connector.Identity
+}
+
+func (f *failingRefreshConnector) LoginURL(_ connector.Scopes, callbackURL, state string) (string, []byte, error) {
+	u, _ := url.Parse(callbackURL)
+	v := u.Query()
+	v.Set("state", state)
+	u.RawQuery = v.Encode()
+	return u.String(), nil, nil
+}
+
+func (f *failingRefreshConnector) HandleCallback(_ connector.Scopes, _ []byte, _ *http.Request) (connector.Identity, error) {
+	return f.identity, nil
+}
+
+func (f *failingRefreshConnector) Refresh(_ context.Context, _ connector.Scopes, _ connector.Identity) (connector.Identity, error) {
+	return connector.Identity{}, errors.New("upstream: refresh token expired")
+}
+
+func TestRefreshDisconnectsUpstreamWhenSessionsEnabled(t *testing.T) {
+	t0 := time.Now().UTC().Round(time.Second)
+	loginTime := t0.Add(-10 * time.Minute)
+
+	tests := []struct {
+		name               string
+		sessionsEnabled    bool
+		createUserIdentity bool
+		wantOK             bool
+	}{
+		{
+			name:               "sessions enabled - uses user identity, skips upstream",
+			sessionsEnabled:    true,
+			createUserIdentity: true,
+			wantOK:             true,
+		},
+		{
+			name:               "sessions enabled without user identity - fails",
+			sessionsEnabled:    true,
+			createUserIdentity: false,
+			wantOK:             false,
+		},
+		{
+			name:               "sessions disabled - upstream failure returns error",
+			sessionsEnabled:    false,
+			createUserIdentity: false,
+			wantOK:             false,
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			httpServer, s := newTestServer(t, func(c *Config) {
+				c.Now = func() time.Time { return t0 }
+				if tc.sessionsEnabled {
+					c.SessionConfig = &session.Config{
+						CookieName:       "dex_session",
+						AbsoluteLifetime: 24 * time.Hour,
+					}
+				}
+			})
+			defer httpServer.Close()
+
+			mockRefreshTokenTestStorage(t, s.storage, false)
+
+			// Replace the connector with one that always fails on Refresh.
+			// When sessions are enabled this connector should never be called;
+			// when sessions are disabled, the failure proves the error path works.
+			s.connectors.Set("test", connectors.Connector{
+				Connector: &failingRefreshConnector{
+					identity: connector.Identity{
+						UserID:   "0-385-28089-0",
+						Username: "Kilgore Trout",
+						Email:    "kilgore@kilgore.trout",
+					},
+				},
+			})
+
+			if tc.createUserIdentity {
+				err := s.storage.CreateUserIdentity(t.Context(), storage.UserIdentity{
+					UserID:      "1",
+					ConnectorID: "test",
+					Claims: storage.Claims{
+						UserID:        "1",
+						Username:      "jane",
+						Email:         "jane.doe@example.com",
+						EmailVerified: true,
+						Groups:        []string{"a", "b"},
+					},
+					CreatedAt: loginTime,
+					LastLogin: loginTime,
+				})
+				require.NoError(t, err)
+			}
+
+			u, err := url.Parse(s.issuerURL.String())
+			require.NoError(t, err)
+
+			tokenData, err := internal.Marshal(&internal.RefreshToken{RefreshId: "test", Token: "bar"})
+			require.NoError(t, err)
+
+			u.Path = path.Join(u.Path, "/token")
+			v := url.Values{}
+			v.Add("grant_type", "refresh_token")
+			v.Add("refresh_token", tokenData)
+
+			req, _ := http.NewRequest("POST", u.String(), bytes.NewBufferString(v.Encode()))
+			req.Header.Set("Content-Type", "application/x-www-form-urlencoded; param=value")
+			req.SetBasicAuth("test", "barfoo")
+
+			rr := httptest.NewRecorder()
+			s.ServeHTTP(rr, req)
+
+			if tc.wantOK {
+				require.Equal(t, http.StatusOK, rr.Code, "body: %s", rr.Body.String())
+
+				var resp struct {
+					IDToken string `json:"id_token"`
+				}
+				err = json.Unmarshal(rr.Body.Bytes(), &resp)
+				require.NoError(t, err)
+
+				// Verify the returned claims match UserIdentity, not the connector.
+				claims := decodeJWTClaims(t, resp.IDToken)
+				assert.Equal(t, "jane.doe@example.com", claims["email"])
+				assert.Equal(t, "jane", claims["name"])
+			} else {
+				require.NotEqual(t, http.StatusOK, rr.Code,
+					"expected error when sessions disabled or user identity missing")
+			}
+		})
+	}
+}
+
+// TestHandleRefreshTokenAllowedConnectors verifies the refresh grant enforces
+// the client's AllowedConnectors (mirrors TestHandleTokenExchangeAllowedConnectors
+// and TestHandlePasswordAllowedConnectors — every token grant must enforce it).
+func TestHandleRefreshTokenAllowedConnectors(t *testing.T) {
+	tests := []struct {
+		name              string
+		allowedConnectors []string
+		expectedCode      int
+	}{
+		{"connector in allowed list", []string{"test"}, http.StatusOK},
+		{"connector matches non-first entry", []string{"other", "test"}, http.StatusOK},
+		{"connector not in allowed list", []string{"other"}, http.StatusBadRequest},
+		{"empty allowed list permits any connector", nil, http.StatusOK},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			ctx := t.Context()
+			httpServer, s := newTestServer(t, func(c *Config) {
+				c.RefreshTokenPolicy = tokens.NewRefreshStrategy(true, 0, 0, 0, nil)
+			})
+			defer httpServer.Close()
+
+			mockRefreshTokenTestStorage(t, s.storage, false)
+			require.NoError(t, s.storage.UpdateClient(ctx, "test", func(c storage.Client) (storage.Client, error) {
+				c.AllowedConnectors = tc.allowedConnectors
+				return c, nil
+			}))
+
+			tokenData, err := internal.Marshal(&internal.RefreshToken{RefreshId: "test", Token: "bar"})
+			require.NoError(t, err)
+
+			u, err := url.Parse(s.issuerURL.String())
+			require.NoError(t, err)
+			u.Path = path.Join(u.Path, "/token")
+
+			v := url.Values{}
+			v.Add("grant_type", "refresh_token")
+			v.Add("refresh_token", tokenData)
+
+			req, _ := http.NewRequest("POST", u.String(), bytes.NewBufferString(v.Encode()))
+			req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+			req.SetBasicAuth("test", "barfoo")
+
+			rr := httptest.NewRecorder()
+			s.ServeHTTP(rr, req)
+			require.Equal(t, tc.expectedCode, rr.Code, rr.Body.String())
+			if tc.expectedCode == http.StatusBadRequest {
+				require.Contains(t, rr.Body.String(), "Connector not allowed",
+					"rejection must be for the connector policy, not an unrelated reason")
+			}
+		})
+	}
+}
+
+// TestRefreshTokenSID pins what a refresh does with the sid claim.
+//
+// A refresh carries the claim across unchanged, alive session or not, and never
+// hands one to a token minted outside a browser flow. What the end of that session
+// costs the token is the client's declaration: nothing for a standalone one,
+// everything for a session-bound one.
+func TestRefreshTokenSID(t *testing.T) {
+	// The session's own id is the sid; nothing is derived any more.
+	const sid = "sessionid"
+
+	tests := []struct {
+		name string
+		// origin is the sid recorded on the offline-session reference: what flow
+		// the refresh token came from.
+		origin string
+		// live is the id of the session that exists at refresh time, empty for none.
+		live string
+		// lifetime is the client's declared refresh token lifetime, empty for the
+		// default (standalone).
+		lifetime string
+		wantSID  any
+		// wantRefused expects the refresh to be turned away instead of issuing.
+		wantRefused bool
+	}{
+		{
+			name:    "browser flow, session alive",
+			origin:  sid,
+			live:    sid,
+			wantSID: sid,
+		},
+		{
+			// The sid says where the token came from, not that the session is still
+			// there. Dropping it made the token active again at the next refresh.
+			name:    "browser flow, session ended",
+			origin:  sid,
+			live:    "",
+			wantSID: sid,
+		},
+		{
+			name:    "browser flow, user signed in again",
+			origin:  sid,
+			live:    "anothersession",
+			wantSID: sid,
+		},
+		{
+			name:    "token from a flow with no browser",
+			origin:  "",
+			live:    sid,
+			wantSID: nil,
+		},
+		{
+			name:     "session-bound client, session alive",
+			origin:   sid,
+			live:     sid,
+			lifetime: storage.RefreshTokenLifetimeSession,
+			wantSID:  sid,
+		},
+		{
+			// The whole point of the setting.
+			name:        "session-bound client, session ended",
+			origin:      sid,
+			live:        "",
+			lifetime:    storage.RefreshTokenLifetimeSession,
+			wantRefused: true,
+		},
+		{
+			name:        "session-bound client, user signed in again",
+			origin:      sid,
+			live:        "anothersession",
+			lifetime:    storage.RefreshTokenLifetimeSession,
+			wantRefused: true,
+		},
+		{
+			// Nothing bound it to a session in the first place, so there is no
+			// session for it to have outlived.
+			name:     "session-bound client, token from a flow with no browser",
+			origin:   "",
+			live:     sid,
+			lifetime: storage.RefreshTokenLifetimeSession,
+			wantSID:  nil,
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			httpServer, s := newTestServerWithSessions(t, nil)
+			defer httpServer.Close()
+
+			ctx := t.Context()
+			mockRefreshTokenTestStorage(t, s.storage, false)
+
+			require.NoError(t, s.storage.UpdateOfflineSessions(ctx, "1", "test",
+				func(old storage.OfflineSessions) (storage.OfflineSessions, error) {
+					old.Refresh["test"].SessionID = tc.origin
+					return old, nil
+				}))
+
+			if tc.lifetime != "" {
+				require.NoError(t, s.storage.UpdateClient(ctx, "test",
+					func(old storage.Client) (storage.Client, error) {
+						old.RefreshTokenLifetime = tc.lifetime
+						return old, nil
+					}))
+			}
+
+			require.NoError(t, s.storage.CreateUserIdentity(ctx, storage.UserIdentity{
+				UserID: "1", ConnectorID: "test",
+				Claims:    storage.Claims{UserID: "1", Username: "jane"},
+				LastLogin: time.Now(),
+			}))
+
+			if tc.live != "" {
+				require.NoError(t, s.storage.CreateAuthSession(ctx, storage.AuthSession{
+					ID: tc.live, Secret: testSessionSecret(tc.live),
+					UserID: "1", ConnectorID: "test",
+					CreatedAt: time.Now(), LastActivity: time.Now(),
+				}))
+			}
+
+			tokenData, err := internal.Marshal(&internal.RefreshToken{RefreshId: "test", Token: "bar"})
+			require.NoError(t, err)
+
+			u, err := url.Parse(s.issuerURL.String())
+			require.NoError(t, err)
+			u.Path = path.Join(u.Path, "/token")
+
+			v := url.Values{}
+			v.Add("grant_type", "refresh_token")
+			v.Add("refresh_token", tokenData)
+
+			req, _ := http.NewRequest("POST", u.String(), bytes.NewBufferString(v.Encode()))
+			req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+			req.SetBasicAuth("test", "barfoo")
+
+			rr := httptest.NewRecorder()
+			s.ServeHTTP(rr, req)
+
+			if tc.wantRefused {
+				require.Equal(t, http.StatusBadRequest, rr.Code, rr.Body.String())
+				require.Contains(t, rr.Body.String(), "invalid_grant")
+
+				// Spent, not merely refused: a token left in storage only fails for
+				// as long as the check holds.
+				_, err := s.storage.GetRefresh(ctx, "test")
+				require.ErrorIs(t, err, storage.ErrNotFound)
+				return
+			}
+
+			require.Equal(t, http.StatusOK, rr.Code, rr.Body.String())
+
+			var resp struct {
+				AccessToken string `json:"access_token"`
+				IDToken     string `json:"id_token"`
+			}
+			require.NoError(t, json.Unmarshal(rr.Body.Bytes(), &resp))
+
+			assert.Equal(t, tc.wantSID, decodeJWTClaims(t, resp.AccessToken)["sid"])
+			assert.Equal(t, tc.wantSID, decodeJWTClaims(t, resp.IDToken)["sid"])
+		})
+	}
+}
diff --git a/server/server_grant_tokenexchange_test.go b/server/server_grant_tokenexchange_test.go
new file mode 100644
index 0000000000..022de917a2
--- /dev/null
+++ b/server/server_grant_tokenexchange_test.go
@@ -0,0 +1,275 @@
+package server
+
+import (
+	"bytes"
+	"encoding/json"
+	"log/slog"
+	"net/http"
+	"net/http/httptest"
+	"net/url"
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+
+	"github.com/dexidp/dex/server/oauth2"
+	"github.com/dexidp/dex/server/tokens"
+	"github.com/dexidp/dex/storage"
+)
+
+func TestHandleTokenExchange(t *testing.T) {
+	tests := []struct {
+		name               string
+		scope              string
+		requestedTokenType string
+		subjectTokenType   string
+		subjectToken       string
+
+		expectedCode      int
+		expectedTokenType string
+	}{
+		{
+			"id-for-acccess",
+			"openid",
+			oauth2.TokenTypeAccess,
+			oauth2.TokenTypeID,
+			"foobar",
+			http.StatusOK,
+			oauth2.TokenTypeAccess,
+		},
+		{
+			"id-for-id",
+			"openid",
+			oauth2.TokenTypeID,
+			oauth2.TokenTypeID,
+			"foobar",
+			http.StatusOK,
+			oauth2.TokenTypeID,
+		},
+		{
+			"id-for-default",
+			"openid",
+			"",
+			oauth2.TokenTypeID,
+			"foobar",
+			http.StatusOK,
+			oauth2.TokenTypeAccess,
+		},
+		{
+			"access-for-access",
+			"openid",
+			oauth2.TokenTypeAccess,
+			oauth2.TokenTypeAccess,
+			"foobar",
+			http.StatusOK,
+			oauth2.TokenTypeAccess,
+		},
+		{
+			"missing-subject_token_type",
+			"openid",
+			oauth2.TokenTypeAccess,
+			"",
+			"foobar",
+			http.StatusBadRequest,
+			"",
+		},
+		{
+			"missing-subject_token",
+			"openid",
+			oauth2.TokenTypeAccess,
+			oauth2.TokenTypeAccess,
+			"",
+			http.StatusBadRequest,
+			"",
+		},
+	}
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			ctx := t.Context()
+			httpServer, s := newTestServer(t, func(c *Config) {
+				c.Storage.CreateClient(ctx, storage.Client{
+					ID:     "client_1",
+					Secret: "secret_1",
+				})
+			})
+			defer httpServer.Close()
+			vals := make(url.Values)
+			vals.Set("grant_type", oauth2.GrantTypeTokenExchange)
+			setNonEmpty(vals, "connector_id", "mock")
+			setNonEmpty(vals, "scope", tc.scope)
+			setNonEmpty(vals, "requested_token_type", tc.requestedTokenType)
+			setNonEmpty(vals, "subject_token_type", tc.subjectTokenType)
+			setNonEmpty(vals, "subject_token", tc.subjectToken)
+			setNonEmpty(vals, "client_id", "client_1")
+			setNonEmpty(vals, "client_secret", "secret_1")
+
+			rr := httptest.NewRecorder()
+			req := httptest.NewRequest(http.MethodPost, httpServer.URL+"/token", strings.NewReader(vals.Encode()))
+			req.Header.Set("content-type", "application/x-www-form-urlencoded")
+
+			s.ServeHTTP(rr, req)
+
+			require.Equal(t, tc.expectedCode, rr.Code, rr.Body.String())
+			require.Equal(t, "application/json", rr.Result().Header.Get("content-type"))
+			if tc.expectedCode == http.StatusOK {
+				var res tokens.Response
+				err := json.NewDecoder(rr.Result().Body).Decode(&res)
+				require.NoError(t, err)
+				require.Equal(t, tc.expectedTokenType, res.IssuedTokenType)
+			}
+		})
+	}
+}
+
+func TestHandleTokenExchangeLogsSuccess(t *testing.T) {
+	ctx := t.Context()
+	var logBuf bytes.Buffer
+	httpServer, s := newTestServer(t, func(c *Config) {
+		c.Logger = slog.New(slog.NewJSONHandler(&logBuf, &slog.HandlerOptions{Level: slog.LevelInfo}))
+		c.Storage.CreateClient(ctx, storage.Client{
+			ID:     "client_1",
+			Secret: "secret_1",
+		})
+	})
+	defer httpServer.Close()
+
+	vals := make(url.Values)
+	vals.Set("grant_type", oauth2.GrantTypeTokenExchange)
+	vals.Set("connector_id", "mock")
+	vals.Set("scope", "openid")
+	vals.Set("requested_token_type", oauth2.TokenTypeAccess)
+	vals.Set("subject_token_type", oauth2.TokenTypeID)
+	vals.Set("subject_token", "foobar")
+	vals.Set("client_id", "client_1")
+	vals.Set("client_secret", "secret_1")
+
+	rr := httptest.NewRecorder()
+	req := httptest.NewRequest(http.MethodPost, httpServer.URL+"/token", strings.NewReader(vals.Encode()))
+	req.Header.Set("content-type", "application/x-www-form-urlencoded")
+
+	s.ServeHTTP(rr, req)
+	require.Equal(t, http.StatusOK, rr.Code, rr.Body.String())
+
+	var found map[string]any
+	for _, line := range strings.Split(strings.TrimSpace(logBuf.String()), "\n") {
+		var entry map[string]any
+		require.NoError(t, json.Unmarshal([]byte(line), &entry))
+		if entry["msg"] == "token exchange successful" {
+			found = entry
+			break
+		}
+	}
+	require.NotNil(t, found, "expected \"token exchange successful\" log line, got: %s", logBuf.String())
+	require.Equal(t, "INFO", found["level"])
+	require.Equal(t, "mock", found["connector_id"])
+	require.Equal(t, "client_1", found["client_id"])
+	require.Equal(t, "0-385-28089-0", found["user_id"])
+	require.Equal(t, "Kilgore Trout", found["username"])
+	require.Equal(t, "kilgore@kilgore.trout", found["email"])
+	require.Equal(t, []any{"authors"}, found["groups"])
+	require.Equal(t, oauth2.TokenTypeID, found["subject_token_type"])
+	require.Equal(t, oauth2.TokenTypeAccess, found["requested_token_type"])
+}
+
+func TestHandleTokenExchangeConnectorGrantTypeRestriction(t *testing.T) {
+	ctx := t.Context()
+	httpServer, s := newTestServer(t, func(c *Config) {
+		c.Storage.CreateClient(ctx, storage.Client{
+			ID:     "client_1",
+			Secret: "secret_1",
+		})
+	})
+	defer httpServer.Close()
+
+	// Restrict mock connector to authorization_code only
+	err := s.storage.UpdateConnector(ctx, "mock", func(c storage.Connector) (storage.Connector, error) {
+		c.GrantTypes = []string{oauth2.GrantTypeAuthorizationCode}
+		return c, nil
+	})
+	require.NoError(t, err)
+	// Clear cached connector to pick up new grant types
+	s.connectors.Close("mock")
+
+	vals := make(url.Values)
+	vals.Set("grant_type", oauth2.GrantTypeTokenExchange)
+	vals.Set("connector_id", "mock")
+	vals.Set("scope", "openid")
+	vals.Set("requested_token_type", oauth2.TokenTypeAccess)
+	vals.Set("subject_token_type", oauth2.TokenTypeID)
+	vals.Set("subject_token", "foobar")
+	vals.Set("client_id", "client_1")
+	vals.Set("client_secret", "secret_1")
+
+	rr := httptest.NewRecorder()
+	req := httptest.NewRequest(http.MethodPost, httpServer.URL+"/token", strings.NewReader(vals.Encode()))
+	req.Header.Set("content-type", "application/x-www-form-urlencoded")
+
+	s.ServeHTTP(rr, req)
+
+	require.Equal(t, http.StatusBadRequest, rr.Code, rr.Body.String())
+}
+
+func TestHandleTokenExchangeAllowedConnectors(t *testing.T) {
+	tests := []struct {
+		name              string
+		allowedConnectors []string
+		expectedCode      int
+	}{
+		{
+			name:              "connector in allowed list",
+			allowedConnectors: []string{"mock"},
+			expectedCode:      http.StatusOK,
+		},
+		{
+			name:              "connector matches non-first entry in allowed list",
+			allowedConnectors: []string{"other", "mock"},
+			expectedCode:      http.StatusOK,
+		},
+		{
+			name:              "connector not in allowed list",
+			allowedConnectors: []string{"other"},
+			expectedCode:      http.StatusBadRequest,
+		},
+		{
+			name:              "empty allowed list permits any connector",
+			allowedConnectors: nil,
+			expectedCode:      http.StatusOK,
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			ctx := t.Context()
+			httpServer, s := newTestServer(t, func(c *Config) {
+				c.Storage.CreateClient(ctx, storage.Client{
+					ID:                "client_1",
+					Secret:            "secret_1",
+					AllowedConnectors: tc.allowedConnectors,
+				})
+			})
+			defer httpServer.Close()
+
+			vals := make(url.Values)
+			vals.Set("grant_type", oauth2.GrantTypeTokenExchange)
+			vals.Set("connector_id", "mock")
+			vals.Set("scope", "openid")
+			vals.Set("requested_token_type", oauth2.TokenTypeAccess)
+			vals.Set("subject_token_type", oauth2.TokenTypeID)
+			vals.Set("subject_token", "foobar")
+			vals.Set("client_id", "client_1")
+			vals.Set("client_secret", "secret_1")
+
+			rr := httptest.NewRecorder()
+			req := httptest.NewRequest(http.MethodPost, httpServer.URL+"/token", strings.NewReader(vals.Encode()))
+			req.Header.Set("content-type", "application/x-www-form-urlencoded")
+
+			s.ServeHTTP(rr, req)
+
+			require.Equal(t, tc.expectedCode, rr.Code, rr.Body.String())
+			if tc.expectedCode == http.StatusBadRequest {
+				require.Contains(t, rr.Body.String(), "Connector not allowed",
+					"rejection must be for the connector policy, not an unrelated reason")
+			}
+		})
+	}
+}
diff --git a/server/server_home_test.go b/server/server_home_test.go
new file mode 100644
index 0000000000..65d29f282c
--- /dev/null
+++ b/server/server_home_test.go
@@ -0,0 +1,141 @@
+package server
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/require"
+
+	"github.com/dexidp/dex/server/internal"
+	"github.com/dexidp/dex/storage"
+)
+
+func TestHomeNoSessions(t *testing.T) {
+	httpServer, server := newTestServer(t, nil)
+	defer httpServer.Close()
+
+	rr := httptest.NewRecorder()
+	server.ServeHTTP(rr, httptest.NewRequest("GET", "/", nil))
+	require.Equal(t, http.StatusOK, rr.Code)
+
+	body := rr.Body.String()
+	require.Contains(t, body, "Dex IdP")
+	require.Contains(t, body, "Discovery")
+	require.NotContains(t, body, "/logout")
+}
+
+func TestHomeNotLoggedIn(t *testing.T) {
+	httpServer, server := newTestServerWithSessions(t, nil)
+	defer httpServer.Close()
+
+	rr := httptest.NewRecorder()
+	server.ServeHTTP(rr, httptest.NewRequest("GET", "/", nil))
+	require.Equal(t, http.StatusOK, rr.Code)
+
+	body := rr.Body.String()
+	require.Contains(t, body, ".well-known/openid-configuration")
+	require.Contains(t, body, "Not signed in")
+	require.NotContains(t, body, "/logout")
+}
+
+func TestHomeLoggedIn(t *testing.T) {
+	httpServer, server := newTestServerWithSessions(t, nil)
+	defer httpServer.Close()
+
+	ctx := t.Context()
+	userID := "test-user"
+	connectorID := "mock"
+	nonce := "testnonce"
+	now := time.Now()
+
+	// The identity's last login is deliberately later than this session's start:
+	// the page reports the session it is describing, not the last time the same
+	// user signed in somewhere else.
+	sessionStart := now.Add(-3 * time.Hour)
+	lastLogin := now.Add(-5 * time.Minute)
+
+	// The idle deadline is the earlier of the two, so that is the one the page
+	// has to report — and it has to say the deadline is the sliding one.
+	idleExpiry := now.Add(30 * time.Minute)
+	absoluteExpiry := now.Add(21 * time.Hour)
+
+	require.NoError(t, server.storage.CreateAuthSession(ctx, storage.AuthSession{
+		ID:             nonce,
+		Secret:         testSessionSecret(nonce),
+		UserID:         userID,
+		ConnectorID:    connectorID,
+		CreatedAt:      sessionStart,
+		LastActivity:   now,
+		IdleExpiry:     idleExpiry,
+		AbsoluteExpiry: absoluteExpiry,
+	}))
+
+	require.NoError(t, server.storage.CreateUserIdentity(ctx, storage.UserIdentity{
+		UserID:      userID,
+		ConnectorID: connectorID,
+		Claims: storage.Claims{
+			UserID:            userID,
+			Username:          "Test User",
+			PreferredUsername: "testuser",
+			Email:             "test@example.com",
+			EmailVerified:     true,
+			Groups:            []string{"admins", "devs"},
+		},
+		LastLogin: lastLogin,
+	}))
+
+	req := httptest.NewRequest("GET", "/", nil)
+	req.AddCookie(&http.Cookie{
+		Name:  "dex_session",
+		Value: internal.SessionCookieValue(nonce, testSessionSecret(nonce), testSessionKey),
+	})
+
+	rr := httptest.NewRecorder()
+	server.ServeHTTP(rr, req)
+	require.Equal(t, http.StatusOK, rr.Code)
+
+	body := rr.Body.String()
+	require.Contains(t, body, "/logout")
+	require.Contains(t, body, "testuser")
+	require.Contains(t, body, "test@example.com")
+	require.Contains(t, body, "Mock")
+	// Groups are listed outright rather than hidden behind a disclosure.
+	require.Contains(t, body, "admins")
+	require.Contains(t, body, "devs")
+	require.Contains(t, body, ".well-known/openid-configuration")
+	require.NotContains(t, body, "Not signed in")
+
+	// Both the datetime attribute and the text a reader without JavaScript sees
+	// have to be the session's start, not the identity's last login.
+	require.Contains(t, body, sessionStart.UTC().Format(time.RFC3339))
+	require.Contains(t, body, sessionStart.UTC().Format("2 Jan 2006, 15:04 UTC"))
+	require.NotContains(t, body, lastLogin.UTC().Format(time.RFC3339))
+
+	// The expiry row reports the earlier deadline and names it as the idle one.
+	require.Contains(t, body, "Expires if idle")
+	require.NotContains(t, body, "Session ends")
+	require.Contains(t, body, idleExpiry.UTC().Format(time.RFC3339))
+	require.NotContains(t, body, absoluteExpiry.UTC().Format(time.RFC3339))
+}
+
+func TestHomeInvalidCookie(t *testing.T) {
+	httpServer, server := newTestServerWithSessions(t, nil)
+	defer httpServer.Close()
+
+	req := httptest.NewRequest("GET", "/", nil)
+	req.AddCookie(&http.Cookie{
+		Name:  "dex_session",
+		Value: "invalid-cookie-value",
+	})
+
+	rr := httptest.NewRecorder()
+	server.ServeHTTP(rr, req)
+	require.Equal(t, http.StatusOK, rr.Code)
+
+	body := rr.Body.String()
+	require.NotContains(t, body, "/logout")
+	require.Contains(t, body, "Not signed in")
+	require.Contains(t, body, ".well-known/openid-configuration")
+}
diff --git a/server/server_introspection_test.go b/server/server_introspection_test.go
new file mode 100644
index 0000000000..b44f969bfe
--- /dev/null
+++ b/server/server_introspection_test.go
@@ -0,0 +1,259 @@
+package server
+
+import (
+	"bytes"
+	"encoding/json"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"net/url"
+	"path"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/require"
+
+	"github.com/dexidp/dex/server/internal"
+	"github.com/dexidp/dex/server/introspection"
+	"github.com/dexidp/dex/server/tokens"
+	"github.com/dexidp/dex/storage"
+)
+
+func toJSON(a interface{}) string {
+	b, err := json.Marshal(a)
+	if err != nil {
+		return ""
+	}
+
+	return string(b)
+}
+
+func mockTestStorage(t *testing.T, s storage.Storage) {
+	ctx := t.Context()
+	c := storage.Client{
+		ID:           "test",
+		Secret:       "barfoo",
+		RedirectURIs: []string{"foo://bar.com/", "https://auth.example.com"},
+		Name:         "dex client",
+		LogoURL:      "https://goo.gl/JIyzIC",
+	}
+
+	err := s.CreateClient(ctx, c)
+	require.NoError(t, err)
+
+	c1 := storage.Connector{
+		ID:   "test",
+		Type: "mockPassword",
+		Name: "mockPassword",
+		Config: []byte(`{
+"username": "test",
+"password": "test"
+}`),
+	}
+
+	err = s.CreateConnector(ctx, c1)
+	require.NoError(t, err)
+
+	err = s.CreateRefresh(ctx, storage.RefreshToken{
+		ID:            "test",
+		Token:         "bar",
+		ObsoleteToken: "",
+		Nonce:         "foo",
+		ClientID:      "test",
+		ConnectorID:   "test",
+		Scopes:        []string{"openid", "email", "profile"},
+		CreatedAt:     time.Now().UTC().Round(time.Millisecond),
+		LastUsed:      time.Now().UTC().Round(time.Millisecond),
+		Claims: storage.Claims{
+			UserID:        "1",
+			Username:      "jane",
+			Email:         "jane.doe@example.com",
+			EmailVerified: true,
+			Groups:        []string{"a", "b"},
+		},
+		ConnectorData: []byte(`{"some":"data"}`),
+	})
+	require.NoError(t, err)
+
+	err = s.CreateRefresh(ctx, storage.RefreshToken{
+		ID:            "expired",
+		Token:         "bar",
+		ObsoleteToken: "",
+		Nonce:         "foo",
+		ClientID:      "test",
+		ConnectorID:   "test",
+		Scopes:        []string{"openid", "email", "profile"},
+		CreatedAt:     time.Now().AddDate(-1, 0, 0).UTC().Round(time.Millisecond),
+		LastUsed:      time.Now().AddDate(-1, 0, 0).UTC().Round(time.Millisecond),
+		Claims: storage.Claims{
+			UserID:        "1",
+			Username:      "jane",
+			Email:         "jane.doe@example.com",
+			EmailVerified: true,
+			Groups:        []string{"a", "b"},
+		},
+		ConnectorData: []byte(`{"some":"data"}`),
+	})
+	require.NoError(t, err)
+
+	err = s.CreateOfflineSessions(ctx, storage.OfflineSessions{
+		UserID: "1",
+		ConnID: "test",
+		Refresh: map[string]*storage.RefreshTokenRef{
+			"test":    {ID: "test", ClientID: "test"},
+			"expired": {ID: "expired", ClientID: "test"},
+		},
+		ConnectorData: nil,
+	})
+	require.NoError(t, err)
+}
+
+func getIntrospectionValue(issuerURL url.URL, issuedAt time.Time, expiry time.Time, tokenUse string) *introspection.Introspection {
+	trueValue := true
+	return &introspection.Introspection{
+		Active:    true,
+		ClientID:  "test",
+		Subject:   "CgExEgR0ZXN0",
+		Expiry:    expiry.Unix(),
+		IssuedAt:  issuedAt.Unix(),
+		NotBefore: issuedAt.Unix(),
+		Audience: []string{
+			"test",
+		},
+		Issuer:    issuerURL.String(),
+		TokenType: "Bearer",
+		TokenUse:  tokenUse,
+		Extra: introspection.IntrospectionExtra{
+			Email:         "jane.doe@example.com",
+			EmailVerified: &trueValue,
+			Groups: []string{
+				"a",
+				"b",
+			},
+			Name: "jane",
+		},
+	}
+}
+
+func TestHandleIntrospect(t *testing.T) {
+	t0 := time.Now()
+
+	ctx := t.Context()
+
+	// Setup a dex server.
+	now := func() time.Time { return t0 }
+
+	refreshTokenPolicy := tokens.NewRefreshStrategy(true, 24*time.Hour, 0, 0, now)
+
+	httpServer, s := newTestServer(t, func(c *Config) {
+		c.Issuer += "/non-root-path"
+		c.RefreshTokenPolicy = refreshTokenPolicy
+		c.Now = now
+	})
+	defer httpServer.Close()
+
+	mockTestStorage(t, s.storage)
+
+	activeAccessToken, expiry, err := s.issuer.SignIDToken(ctx, tokens.Authorization{
+		Client: storage.Client{ID: "test"},
+		Claims: storage.Claims{
+			UserID:        "1",
+			Username:      "jane",
+			Email:         "jane.doe@example.com",
+			EmailVerified: true,
+			Groups:        []string{"a", "b"},
+		},
+		Scopes:      []string{"openid", "email", "profile", "groups"},
+		Nonce:       "foo",
+		ConnectorID: "test",
+	}, "", "")
+	require.NoError(t, err)
+
+	activeRefreshToken, err := internal.Marshal(&internal.RefreshToken{RefreshId: "test", Token: "bar"})
+	require.NoError(t, err)
+	expiredRefreshToken, err := internal.Marshal(&internal.RefreshToken{RefreshId: "expired", Token: "bar"})
+	require.NoError(t, err)
+
+	inactiveResponse := "{\"active\":false}\n"
+	badRequestResponse := `{"error":"invalid_request","error_description":"The POST body can not be empty."}`
+
+	tests := []struct {
+		testName           string
+		token              string
+		tokenType          string
+		response           string
+		responseStatusCode int
+	}{
+		// No token
+		{
+			testName:           "No token",
+			response:           badRequestResponse,
+			responseStatusCode: 400,
+		},
+		// Access token tests
+		{
+			testName:           "Access Token: active",
+			token:              activeAccessToken,
+			response:           toJSON(getIntrospectionValue(s.issuerURL.URL, t0, expiry, "access_token")),
+			responseStatusCode: 200,
+		},
+		{
+			testName:           "Access Token: wrong",
+			token:              "fake-token",
+			response:           inactiveResponse,
+			responseStatusCode: 200,
+		},
+		// Refresh token tests
+		{
+			testName:           "Refresh Token: active",
+			token:              activeRefreshToken,
+			response:           toJSON(getIntrospectionValue(s.issuerURL.URL, t0, t0.Add(refreshTokenPolicy.AbsoluteLifetime()), "refresh_token")),
+			responseStatusCode: 200,
+		},
+		{
+			testName:           "Refresh Token: expired",
+			token:              expiredRefreshToken,
+			response:           inactiveResponse,
+			responseStatusCode: 200,
+		},
+		{
+			testName:           "Refresh Token: active => false (wrong)",
+			token:              "fake-token",
+			response:           inactiveResponse,
+			responseStatusCode: 200,
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.testName, func(t *testing.T) {
+			data := url.Values{}
+			if tc.token != "" {
+				data.Set("token", tc.token)
+			}
+			if tc.tokenType != "" {
+				data.Set("token_type_hint", tc.tokenType)
+			}
+
+			u, err := url.Parse(s.issuerURL.String())
+			if err != nil {
+				t.Fatalf("Could not parse issuer URL %v", err)
+			}
+			u.Path = path.Join(u.Path, "token", "introspect")
+
+			req, _ := http.NewRequest("POST", u.String(), bytes.NewBufferString(data.Encode()))
+			req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+
+			rr := httptest.NewRecorder()
+			s.ServeHTTP(rr, req)
+
+			if rr.Code != tc.responseStatusCode {
+				t.Errorf("%s: Unexpected Response Type.  Expected %v got %v", tc.testName, tc.responseStatusCode, rr.Code)
+			}
+
+			result, _ := io.ReadAll(rr.Body)
+			if string(result) != tc.response {
+				t.Errorf("%s: Unexpected Response.  Expected %q got %q", tc.testName, tc.response, result)
+			}
+		})
+	}
+}
diff --git a/server/server_login_test.go b/server/server_login_test.go
new file mode 100644
index 0000000000..fa483b03fe
--- /dev/null
+++ b/server/server_login_test.go
@@ -0,0 +1,766 @@
+package server
+
+import (
+	"bytes"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/require"
+
+	"github.com/dexidp/dex/connector"
+	"github.com/dexidp/dex/server/connectors"
+	"github.com/dexidp/dex/server/oauth2"
+	"github.com/dexidp/dex/server/tokens"
+	"github.com/dexidp/dex/storage"
+)
+
+func TestHandleInvalidOAuth2Callbacks(t *testing.T) {
+	httpServer, server := newTestServer(t, func(c *Config) {
+		c.Storage = &emptyStorage{c.Storage}
+	})
+	defer httpServer.Close()
+
+	tests := []struct {
+		TargetURI    string
+		ExpectedCode int
+	}{
+		{"/callback", http.StatusBadRequest},
+		{"/callback?code=&state=", http.StatusBadRequest},
+		{"/callback?code=AAAAAAA&state=BBBBBBB", http.StatusBadRequest},
+	}
+
+	rr := httptest.NewRecorder()
+
+	for i, r := range tests {
+		server.ServeHTTP(rr, httptest.NewRequest("GET", r.TargetURI, nil))
+		if rr.Code != r.ExpectedCode {
+			t.Fatalf("test %d expected %d, got %d", i, r.ExpectedCode, rr.Code)
+		}
+	}
+}
+
+func TestHandleInvalidSAMLCallbacks(t *testing.T) {
+	httpServer, server := newTestServer(t, func(c *Config) {
+		c.Storage = &emptyStorage{c.Storage}
+	})
+	defer httpServer.Close()
+
+	type requestForm struct {
+		RelayState string
+	}
+	tests := []struct {
+		RequestForm  requestForm
+		ExpectedCode int
+	}{
+		{requestForm{}, http.StatusBadRequest},
+		{requestForm{RelayState: "AAAAAAA"}, http.StatusBadRequest},
+	}
+
+	rr := httptest.NewRecorder()
+
+	for i, r := range tests {
+		jsonValue, err := json.Marshal(r.RequestForm)
+		if err != nil {
+			t.Fatal(err.Error())
+		}
+		server.ServeHTTP(rr, httptest.NewRequest("POST", "/callback", bytes.NewBuffer(jsonValue)))
+		if rr.Code != r.ExpectedCode {
+			t.Fatalf("test %d expected %d, got %d", i, r.ExpectedCode, rr.Code)
+		}
+	}
+}
+
+func TestFinalizeLoginCreatesUserIdentity(t *testing.T) {
+	ctx := t.Context()
+	setSessionsEnabled(t, true)
+
+	connID := "mockPw"
+	authReqID := "test-create-ui"
+	expiry := time.Now().Add(100 * time.Second)
+
+	httpServer, s := newTestServer(t, func(c *Config) {
+		c.SkipApprovalScreen = true
+		c.Now = time.Now
+	})
+	defer httpServer.Close()
+
+	sc := storage.Connector{
+		ID:              connID,
+		Type:            "mockPassword",
+		Name:            "MockPassword",
+		ResourceVersion: "1",
+		Config:          []byte(`{"username": "foo", "password": "password"}`),
+	}
+	require.NoError(t, s.storage.CreateConnector(ctx, sc))
+	_, err := s.connectors.Open(sc)
+	require.NoError(t, err)
+
+	authReq := storage.AuthRequest{
+		ID:            authReqID,
+		ConnectorID:   connID,
+		RedirectURI:   "cb",
+		Expiry:        expiry,
+		ResponseTypes: []string{oauth2.ResponseTypeCode},
+	}
+	require.NoError(t, s.storage.CreateAuthRequest(ctx, authReq))
+
+	rr := httptest.NewRecorder()
+	reqPath := fmt.Sprintf("/auth/%s/login?state=%s&back=&login=foo&password=password", connID, authReqID)
+	s.ServeHTTP(rr, httptest.NewRequest("POST", reqPath, nil))
+
+	require.Equal(t, 303, rr.Code)
+
+	ui, err := s.storage.GetUserIdentity(ctx, "0-385-28089-0", connID)
+	require.NoError(t, err, "UserIdentity should exist after login")
+	require.Equal(t, "0-385-28089-0", ui.UserID)
+	require.Equal(t, connID, ui.ConnectorID)
+	require.Equal(t, "kilgore@kilgore.trout", ui.Claims.Email)
+	require.NotZero(t, ui.CreatedAt, "CreatedAt should be set")
+	require.NotZero(t, ui.LastLogin, "LastLogin should be set")
+}
+
+func TestFinalizeLoginUpdatesUserIdentity(t *testing.T) {
+	ctx := t.Context()
+	setSessionsEnabled(t, true)
+
+	connID := "mockPw"
+	authReqID := "test-update-ui"
+	expiry := time.Now().Add(100 * time.Second)
+	oldTime := time.Date(2025, 1, 1, 0, 0, 0, 0, time.UTC)
+
+	httpServer, s := newTestServer(t, func(c *Config) {
+		c.SkipApprovalScreen = true
+		c.Now = time.Now
+	})
+	defer httpServer.Close()
+
+	sc := storage.Connector{
+		ID:              connID,
+		Type:            "mockPassword",
+		Name:            "MockPassword",
+		ResourceVersion: "1",
+		Config:          []byte(`{"username": "foo", "password": "password"}`),
+	}
+	require.NoError(t, s.storage.CreateConnector(ctx, sc))
+	_, err := s.connectors.Open(sc)
+	require.NoError(t, err)
+
+	// Pre-create UserIdentity with old data
+	require.NoError(t, s.storage.CreateUserIdentity(ctx, storage.UserIdentity{
+		UserID:      "0-385-28089-0",
+		ConnectorID: connID,
+		Claims: storage.Claims{
+			UserID:   "0-385-28089-0",
+			Username: "Old Name",
+			Email:    "old@example.com",
+		},
+		Consents:  map[string][]string{"existing-client": {"openid"}},
+		CreatedAt: oldTime,
+		LastLogin: oldTime,
+	}))
+
+	authReq := storage.AuthRequest{
+		ID:            authReqID,
+		ConnectorID:   connID,
+		RedirectURI:   "cb",
+		Expiry:        expiry,
+		ResponseTypes: []string{oauth2.ResponseTypeCode},
+	}
+	require.NoError(t, s.storage.CreateAuthRequest(ctx, authReq))
+
+	rr := httptest.NewRecorder()
+	reqPath := fmt.Sprintf("/auth/%s/login?state=%s&back=&login=foo&password=password", connID, authReqID)
+	s.ServeHTTP(rr, httptest.NewRequest("POST", reqPath, nil))
+
+	require.Equal(t, 303, rr.Code)
+
+	ui, err := s.storage.GetUserIdentity(ctx, "0-385-28089-0", connID)
+	require.NoError(t, err, "UserIdentity should exist after login")
+	require.Equal(t, "Kilgore Trout", ui.Claims.Username, "claims should be refreshed from the connector")
+	require.Equal(t, "kilgore@kilgore.trout", ui.Claims.Email, "claims should be refreshed from the connector")
+	require.True(t, ui.LastLogin.After(oldTime), "LastLogin should be updated")
+	require.Equal(t, oldTime, ui.CreatedAt, "CreatedAt should not change on update")
+	require.Equal(t, []string{"openid"}, ui.Consents["existing-client"], "existing consents should be preserved")
+}
+
+func TestFinalizeLoginSkipsUserIdentityWhenDisabled(t *testing.T) {
+	ctx := t.Context()
+	setSessionsEnabled(t, false)
+
+	connID := "mockPw"
+	authReqID := "test-no-ui"
+	expiry := time.Now().Add(100 * time.Second)
+
+	httpServer, s := newTestServer(t, func(c *Config) {
+		c.SkipApprovalScreen = true
+		c.Now = time.Now
+	})
+	defer httpServer.Close()
+
+	sc := storage.Connector{
+		ID:              connID,
+		Type:            "mockPassword",
+		Name:            "MockPassword",
+		ResourceVersion: "1",
+		Config:          []byte(`{"username": "foo", "password": "password"}`),
+	}
+	require.NoError(t, s.storage.CreateConnector(ctx, sc))
+	_, err := s.connectors.Open(sc)
+	require.NoError(t, err)
+
+	authReq := storage.AuthRequest{
+		ID:            authReqID,
+		ConnectorID:   connID,
+		RedirectURI:   "cb",
+		Expiry:        expiry,
+		ResponseTypes: []string{oauth2.ResponseTypeCode},
+	}
+	require.NoError(t, s.storage.CreateAuthRequest(ctx, authReq))
+
+	rr := httptest.NewRecorder()
+	reqPath := fmt.Sprintf("/auth/%s/login?state=%s&back=&login=foo&password=password", connID, authReqID)
+	s.ServeHTTP(rr, httptest.NewRequest("POST", reqPath, nil))
+
+	require.Equal(t, 303, rr.Code)
+
+	_, err = s.storage.GetUserIdentity(ctx, "0-385-28089-0", connID)
+	require.ErrorIs(t, err, storage.ErrNotFound, "UserIdentity should not be created when sessions disabled")
+}
+
+func TestHandlePasswordLoginWithSkipApproval(t *testing.T) {
+	ctx := t.Context()
+
+	connID := "mockPw"
+	authReqID := "test"
+	expiry := time.Now().Add(100 * time.Second)
+	resTypes := []string{oauth2.ResponseTypeCode}
+
+	tests := []struct {
+		name                  string
+		skipApproval          bool
+		authReq               storage.AuthRequest
+		expectedRes           string
+		offlineSessionCreated bool
+	}{
+		{
+			name:         "Force approval",
+			skipApproval: false,
+			authReq: storage.AuthRequest{
+				ID:                  authReqID,
+				ConnectorID:         connID,
+				RedirectURI:         "cb",
+				Expiry:              expiry,
+				ResponseTypes:       resTypes,
+				ForceApprovalPrompt: true,
+			},
+			expectedRes:           "/approval",
+			offlineSessionCreated: false,
+		},
+		{
+			name:         "Skip approval by server config",
+			skipApproval: true,
+			authReq: storage.AuthRequest{
+				ID:                  authReqID,
+				ConnectorID:         connID,
+				RedirectURI:         "cb",
+				Expiry:              expiry,
+				ResponseTypes:       resTypes,
+				ForceApprovalPrompt: true,
+			},
+			expectedRes:           "/approval",
+			offlineSessionCreated: false,
+		},
+		{
+			name:         "No skip",
+			skipApproval: false,
+			authReq: storage.AuthRequest{
+				ID:                  authReqID,
+				ConnectorID:         connID,
+				RedirectURI:         "cb",
+				Expiry:              expiry,
+				ResponseTypes:       resTypes,
+				ForceApprovalPrompt: false,
+			},
+			expectedRes:           "/approval",
+			offlineSessionCreated: false,
+		},
+		{
+			name:         "Skip approval",
+			skipApproval: true,
+			authReq: storage.AuthRequest{
+				ID:                  authReqID,
+				ConnectorID:         connID,
+				RedirectURI:         "cb",
+				Expiry:              expiry,
+				ResponseTypes:       resTypes,
+				ForceApprovalPrompt: false,
+			},
+			expectedRes:           "/cb",
+			offlineSessionCreated: false,
+		},
+		{
+			name:         "Force approval, request refresh token",
+			skipApproval: false,
+			authReq: storage.AuthRequest{
+				ID:                  authReqID,
+				ConnectorID:         connID,
+				RedirectURI:         "cb",
+				Expiry:              expiry,
+				ResponseTypes:       resTypes,
+				ForceApprovalPrompt: true,
+				Scopes:              []string{"offline_access"},
+			},
+			expectedRes:           "/approval",
+			offlineSessionCreated: true,
+		},
+		{
+			name:         "Skip approval, request refresh token",
+			skipApproval: true,
+			authReq: storage.AuthRequest{
+				ID:                  authReqID,
+				ConnectorID:         connID,
+				RedirectURI:         "cb",
+				Expiry:              expiry,
+				ResponseTypes:       resTypes,
+				ForceApprovalPrompt: false,
+				Scopes:              []string{"offline_access"},
+			},
+			expectedRes:           "/cb",
+			offlineSessionCreated: true,
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			httpServer, s := newTestServer(t, func(c *Config) {
+				c.SkipApprovalScreen = tc.skipApproval
+				c.Now = time.Now
+			})
+			defer httpServer.Close()
+
+			sc := storage.Connector{
+				ID:              connID,
+				Type:            "mockPassword",
+				Name:            "MockPassword",
+				ResourceVersion: "1",
+				Config:          []byte("{\"username\": \"foo\", \"password\": \"password\"}"),
+			}
+			if err := s.storage.CreateConnector(ctx, sc); err != nil {
+				t.Fatalf("create connector: %v", err)
+			}
+			if _, err := s.connectors.Open(sc); err != nil {
+				t.Fatalf("open connector: %v", err)
+			}
+			if err := s.storage.CreateAuthRequest(ctx, tc.authReq); err != nil {
+				t.Fatalf("failed to create AuthRequest: %v", err)
+			}
+
+			rr := httptest.NewRecorder()
+
+			path := fmt.Sprintf("/auth/%s/login?state=%s&back=&login=foo&password=password", connID, authReqID)
+			s.ServeHTTP(rr, httptest.NewRequest("POST", path, nil))
+
+			require.Equal(t, 303, rr.Code)
+
+			_, restPath := followFlow(t, s, rr)
+			require.Equal(t, tc.expectedRes, restPath)
+
+			offlineSession, err := s.storage.GetOfflineSessions(ctx, "0-385-28089-0", connID)
+			if tc.offlineSessionCreated {
+				require.NoError(t, err)
+				require.NotEmpty(t, offlineSession)
+			} else {
+				require.Error(t, storage.ErrNotFound, err)
+			}
+		})
+	}
+}
+
+func TestHandleConnectorCallbackWithSkipApproval(t *testing.T) {
+	ctx := t.Context()
+
+	connID := "mock"
+	authReqID := "test"
+	expiry := time.Now().Add(100 * time.Second)
+	resTypes := []string{oauth2.ResponseTypeCode}
+
+	tests := []struct {
+		name                  string
+		skipApproval          bool
+		authReq               storage.AuthRequest
+		expectedRes           string
+		offlineSessionCreated bool
+	}{
+		{
+			name:         "Force approval",
+			skipApproval: false,
+			authReq: storage.AuthRequest{
+				ID:                  authReqID,
+				ConnectorID:         connID,
+				RedirectURI:         "cb",
+				Expiry:              expiry,
+				ResponseTypes:       resTypes,
+				ForceApprovalPrompt: true,
+			},
+			expectedRes:           "/approval",
+			offlineSessionCreated: false,
+		},
+		{
+			name:         "Skip approval by server config",
+			skipApproval: true,
+			authReq: storage.AuthRequest{
+				ID:                  authReqID,
+				ConnectorID:         connID,
+				RedirectURI:         "cb",
+				Expiry:              expiry,
+				ResponseTypes:       resTypes,
+				ForceApprovalPrompt: true,
+			},
+			expectedRes:           "/approval",
+			offlineSessionCreated: false,
+		},
+		{
+			name:         "Skip approval by auth request",
+			skipApproval: false,
+			authReq: storage.AuthRequest{
+				ID:                  authReqID,
+				ConnectorID:         connID,
+				RedirectURI:         "cb",
+				Expiry:              expiry,
+				ResponseTypes:       resTypes,
+				ForceApprovalPrompt: false,
+			},
+			expectedRes:           "/approval",
+			offlineSessionCreated: false,
+		},
+		{
+			name:         "Skip approval",
+			skipApproval: true,
+			authReq: storage.AuthRequest{
+				ID:                  authReqID,
+				ConnectorID:         connID,
+				RedirectURI:         "cb",
+				Expiry:              expiry,
+				ResponseTypes:       resTypes,
+				ForceApprovalPrompt: false,
+			},
+			expectedRes:           "/cb",
+			offlineSessionCreated: false,
+		},
+		{
+			name:         "Force approval, request refresh token",
+			skipApproval: false,
+			authReq: storage.AuthRequest{
+				ID:                  authReqID,
+				ConnectorID:         connID,
+				RedirectURI:         "cb",
+				Expiry:              expiry,
+				ResponseTypes:       resTypes,
+				ForceApprovalPrompt: true,
+				Scopes:              []string{"offline_access"},
+			},
+			expectedRes:           "/approval",
+			offlineSessionCreated: true,
+		},
+		{
+			name:         "Skip approval, request refresh token",
+			skipApproval: true,
+			authReq: storage.AuthRequest{
+				ID:                  authReqID,
+				ConnectorID:         connID,
+				RedirectURI:         "cb",
+				Expiry:              expiry,
+				ResponseTypes:       resTypes,
+				ForceApprovalPrompt: false,
+				Scopes:              []string{"offline_access"},
+			},
+			expectedRes:           "/cb",
+			offlineSessionCreated: false,
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			httpServer, s := newTestServer(t, func(c *Config) {
+				c.SkipApprovalScreen = tc.skipApproval
+				c.Now = time.Now
+			})
+			defer httpServer.Close()
+
+			if err := s.storage.CreateAuthRequest(ctx, tc.authReq); err != nil {
+				t.Fatalf("failed to create AuthRequest: %v", err)
+			}
+			rr := httptest.NewRecorder()
+
+			path := fmt.Sprintf("/callback/%s?state=%s", connID, authReqID)
+			s.ServeHTTP(rr, httptest.NewRequest("GET", path, nil))
+
+			require.Equal(t, 303, rr.Code)
+
+			_, restPath := followFlow(t, s, rr)
+			require.Equal(t, tc.expectedRes, restPath)
+
+			offlineSession, err := s.storage.GetOfflineSessions(ctx, "0-385-28089-0", connID)
+			if tc.offlineSessionCreated {
+				require.NoError(t, err)
+				require.NotEmpty(t, offlineSession)
+			} else {
+				require.Error(t, storage.ErrNotFound, err)
+			}
+		})
+	}
+}
+
+// SPNEGO integration test (server layer): on GET login, if connector implements SPNEGOAware
+// and returns an identity, server should finalize login and redirect without rendering form.
+func TestHandlePasswordLogin_SPNEGOShortCircuit(t *testing.T) {
+	ctx := t.Context()
+	connID := "mockPassword"
+	authReqID := "spnego"
+	expiry := time.Now().Add(100 * time.Second)
+	resTypes := []string{oauth2.ResponseTypeCode}
+
+	httpServer, s := newTestServer(t, func(c *Config) {
+		c.SkipApprovalScreen = true
+		c.Now = time.Now
+	})
+	defer httpServer.Close()
+
+	// Create password connector which we will wrap with a SPNEGO-aware adapter in storage config
+	sc := storage.Connector{
+		ID:              connID,
+		Type:            "mockPassword",
+		Name:            "MockPassword",
+		ResourceVersion: "1",
+		Config:          []byte("{\"username\": \"foo\", \"password\": \"password\"}"),
+	}
+	require.NoError(t, s.storage.CreateConnector(ctx, sc))
+	_, err := s.connectors.Open(sc)
+	require.NoError(t, err)
+
+	// Prepare auth request
+	require.NoError(t, s.storage.CreateAuthRequest(ctx, storage.AuthRequest{
+		ID:            authReqID,
+		ClientID:      "client_1",
+		ConnectorID:   connID,
+		RedirectURI:   "cb",
+		Expiry:        expiry,
+		ResponseTypes: resTypes,
+		Scopes:        []string{"openid"},
+	}))
+
+	// Replace the server connector with a SPNEGO-aware fake that short-circuits
+	orig, _ := s.connectors.Get(ctx, connID)
+	s.connectors.Set(connID, connectors.Connector{
+		ResourceVersion: orig.ResourceVersion,
+		Connector: spnegoShortCircuit{Identity: connector.Identity{
+			UserID:        "user-id",
+			Username:      "user",
+			Email:         "user@example.com",
+			EmailVerified: true,
+		}},
+	})
+
+	// Need a client for finalizeLogin to succeed
+	require.NoError(t, s.storage.CreateClient(ctx, storage.Client{
+		ID:           "client_1",
+		Secret:       "secret",
+		RedirectURIs: []string{"http://127.0.0.1/callback"},
+		Name:         "test",
+	}))
+
+	// GET login should short-circuit and redirect to /approval or code response
+	rr := httptest.NewRecorder()
+	path := fmt.Sprintf("/auth/%s/login?state=%s&back=", connID, authReqID)
+	s.ServeHTTP(rr, httptest.NewRequest("GET", path, nil))
+
+	// In SkipApproval mode server may directly send code response (200) or 303 redirect
+	if rr.Code != http.StatusSeeOther && rr.Code != http.StatusOK {
+		t.Fatalf("expected 200 or 303, got %d", rr.Code)
+	}
+}
+
+// TestHandlePasswordLogin_SPNEGOError verifies that when SPNEGO returns an error
+// (e.g., Kerberos auth succeeded but LDAP lookup failed), the server renders
+// an error page instead of showing an empty 401 or falling back to password form.
+func TestHandlePasswordLogin_SPNEGOError(t *testing.T) {
+	ctx := t.Context()
+	connID := "mockPassword"
+	authReqID := "spnego-err"
+	expiry := time.Now().Add(100 * time.Second)
+	resTypes := []string{oauth2.ResponseTypeCode}
+
+	httpServer, s := newTestServer(t, func(c *Config) {
+		c.SkipApprovalScreen = true
+		c.Now = time.Now
+	})
+	defer httpServer.Close()
+
+	// Create password connector
+	sc := storage.Connector{
+		ID:              connID,
+		Type:            "mockPassword",
+		Name:            "MockPassword",
+		ResourceVersion: "1",
+		Config:          []byte("{\"username\": \"foo\", \"password\": \"password\"}"),
+	}
+	require.NoError(t, s.storage.CreateConnector(ctx, sc))
+	_, err := s.connectors.Open(sc)
+	require.NoError(t, err)
+
+	// Prepare auth request
+	require.NoError(t, s.storage.CreateAuthRequest(ctx, storage.AuthRequest{
+		ID:            authReqID,
+		ClientID:      "client_1",
+		ConnectorID:   connID,
+		RedirectURI:   "cb",
+		Expiry:        expiry,
+		ResponseTypes: resTypes,
+		Scopes:        []string{"openid"},
+	}))
+
+	// Replace the server connector with a SPNEGO-aware fake that returns an error
+	orig, _ := s.connectors.Get(ctx, connID)
+	s.connectors.Set(connID, connectors.Connector{
+		ResourceVersion: orig.ResourceVersion,
+		Connector:       spnegoError{Err: errors.New("ldap: user lookup failed for kerberos principal")},
+	})
+
+	// Need a client for the flow
+	require.NoError(t, s.storage.CreateClient(ctx, storage.Client{
+		ID:           "client_1",
+		Secret:       "secret",
+		RedirectURIs: []string{"http://127.0.0.1/callback"},
+		Name:         "test",
+	}))
+
+	// GET login should return 401 with error message rendered
+	rr := httptest.NewRecorder()
+	path := fmt.Sprintf("/auth/%s/login?state=%s&back=", connID, authReqID)
+	s.ServeHTTP(rr, httptest.NewRequest("GET", path, nil))
+
+	// Should return 401 (unauthorized) with an error page, not 200 (form) or empty response
+	if rr.Code != http.StatusUnauthorized {
+		t.Fatalf("expected 401 Unauthorized, got %d", rr.Code)
+	}
+
+	// The response body should contain safe generic error message (not internal details)
+	body := rr.Body.String()
+	if !strings.Contains(body, "Authentication failed") {
+		t.Fatalf("expected error page with 'Authentication failed', got: %s", body)
+	}
+	// Should NOT contain internal error details (per 008-hide-internal-500-error-details.patch)
+	if strings.Contains(body, "ldap: user lookup failed") {
+		t.Fatalf("error page should not contain internal error details")
+	}
+}
+
+func TestHandleConnectorLoginGrantTypeRejection(t *testing.T) {
+	ctx := t.Context()
+	httpServer, s := newTestServer(t, func(c *Config) {
+		c.Storage.CreateClient(ctx, storage.Client{
+			ID:           "test-client",
+			Secret:       "secret",
+			RedirectURIs: []string{"http://example.com/callback"},
+		})
+	})
+	defer httpServer.Close()
+
+	// Restrict mock connector to device_code only
+	err := s.storage.UpdateConnector(ctx, "mock", func(c storage.Connector) (storage.Connector, error) {
+		c.GrantTypes = []string{oauth2.GrantTypeDeviceCode}
+		return c, nil
+	})
+	require.NoError(t, err)
+	s.connectors.Close("mock")
+
+	// Try to use mock connector for auth code flow via the full server router
+	rr := httptest.NewRecorder()
+	reqURL := httpServer.URL + "/auth/mock?response_type=code&client_id=test-client&redirect_uri=http://example.com/callback&scope=openid"
+	req := httptest.NewRequest(http.MethodGet, reqURL, nil)
+	s.ServeHTTP(rr, req)
+
+	require.Equal(t, http.StatusBadRequest, rr.Code)
+	require.Contains(t, rr.Body.String(), "does not support this grant type")
+}
+
+func TestConnectorDataPersistence(t *testing.T) {
+	// Test that ConnectorData is correctly stored in refresh token
+	// and can be used for subsequent refresh operations.
+	httpServer, server := newTestServer(t, func(c *Config) {
+		c.RefreshTokenPolicy = tokens.NewRefreshStrategy(true, 0, 0, 0, nil)
+	})
+	defer httpServer.Close()
+
+	ctx := t.Context()
+	connID := "saml-conndata"
+
+	// Create a mock SAML connector that also implements RefreshConnector
+	mockConn := &mockSAMLRefreshConnector{
+		refreshIdentity: connector.Identity{
+			UserID:        "refreshed-user",
+			Username:      "refreshed-name",
+			Email:         "refreshed@example.com",
+			EmailVerified: true,
+			Groups:        []string{"refreshed-group"},
+		},
+	}
+	registerTestConnector(t, server, connID, mockConn)
+
+	// Create client
+	client := storage.Client{
+		ID:           "conndata-client",
+		Secret:       "conndata-secret",
+		RedirectURIs: []string{"https://example.com/callback"},
+		Name:         "ConnData Test Client",
+	}
+	require.NoError(t, server.storage.CreateClient(ctx, client))
+
+	// Create refresh token with ConnectorData (simulating what HandlePOST would store)
+	connectorData := []byte(`{"userID":"user-123","username":"testuser","email":"test@example.com","emailVerified":true,"groups":["admin","dev"]}`)
+	refreshToken := storage.RefreshToken{
+		ID:          "conndata-refresh",
+		Token:       "conndata-token",
+		CreatedAt:   time.Now(),
+		LastUsed:    time.Now(),
+		ClientID:    client.ID,
+		ConnectorID: connID,
+		Scopes:      []string{"openid", "email", "offline_access"},
+		Claims: storage.Claims{
+			UserID:        "user-123",
+			Username:      "testuser",
+			Email:         "test@example.com",
+			EmailVerified: true,
+			Groups:        []string{"admin", "dev"},
+		},
+		ConnectorData: connectorData,
+		Nonce:         "conndata-nonce",
+	}
+	require.NoError(t, server.storage.CreateRefresh(ctx, refreshToken))
+
+	offlineSession := storage.OfflineSessions{
+		UserID:        "user-123",
+		ConnID:        connID,
+		Refresh:       map[string]*storage.RefreshTokenRef{client.ID: {ID: refreshToken.ID, ClientID: client.ID}},
+		ConnectorData: connectorData,
+	}
+	require.NoError(t, server.storage.CreateOfflineSessions(ctx, offlineSession))
+
+	// Verify ConnectorData is stored correctly
+	storedToken, err := server.storage.GetRefresh(ctx, refreshToken.ID)
+	require.NoError(t, err)
+	require.Equal(t, connectorData, storedToken.ConnectorData,
+		"ConnectorData should be persisted in refresh token storage")
+
+	// Verify ConnectorData is stored in offline session
+	storedSession, err := server.storage.GetOfflineSessions(ctx, "user-123", connID)
+	require.NoError(t, err)
+	require.Equal(t, connectorData, storedSession.ConnectorData,
+		"ConnectorData should be persisted in offline session storage")
+}
diff --git a/server/server_logout_test.go b/server/server_logout_test.go
new file mode 100644
index 0000000000..9443e742c4
--- /dev/null
+++ b/server/server_logout_test.go
@@ -0,0 +1,1161 @@
+package server
+
+import (
+	"context"
+	"encoding/base64"
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"net/http/httptest"
+	"net/url"
+	"strings"
+	"sync"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/require"
+
+	"github.com/dexidp/dex/server/discovery"
+	"github.com/dexidp/dex/server/internal"
+	"github.com/dexidp/dex/server/tokens"
+	"github.com/dexidp/dex/storage"
+)
+
+func TestHandleLogoutNoSessions(t *testing.T) {
+	httpServer, server := newTestServer(t, nil)
+	defer httpServer.Close()
+
+	rr := httptest.NewRecorder()
+	req := httptest.NewRequest("GET", "/logout", nil)
+	server.ServeHTTP(rr, req)
+	require.Equal(t, http.StatusNotFound, rr.Code)
+}
+
+func TestHandleLogoutMethodNotAllowed(t *testing.T) {
+	httpServer, server := newTestServerWithSessions(t, nil)
+	defer httpServer.Close()
+
+	rr := httptest.NewRecorder()
+	req := httptest.NewRequest("PUT", "/logout", nil)
+	server.ServeHTTP(rr, req)
+	require.Equal(t, http.StatusMethodNotAllowed, rr.Code)
+}
+
+func TestHandleLogoutPOST(t *testing.T) {
+	httpServer, server := newTestServerWithSessions(t, nil)
+	defer httpServer.Close()
+
+	rr := httptest.NewRecorder()
+	req := httptest.NewRequest("POST", "/logout", nil)
+	server.ServeHTTP(rr, req)
+	require.Equal(t, http.StatusOK, rr.Code)
+	body := rr.Body.String()
+	require.Contains(t, body, "No active session")
+}
+
+func TestHandleLogoutNoHintGETShowsConfirmation(t *testing.T) {
+	httpServer, server := newTestServerWithSessions(t, nil)
+	defer httpServer.Close()
+
+	newTestAuthSession(t, server, "test-user", "mock", "testnonce")
+
+	rr := httptest.NewRecorder()
+	req := httptest.NewRequest("GET", "/logout", nil)
+	req.AddCookie(testSessionCookie("testnonce"))
+	server.ServeHTTP(rr, req)
+	require.Equal(t, http.StatusOK, rr.Code)
+	body := rr.Body.String()
+	require.Contains(t, body, "Do you want to log out?")
+	require.Contains(t, body, `method="post"`)
+	require.NotContains(t, body, "successfully logged out")
+}
+
+func TestHandleLogoutNoHintPOSTPerformsLogout(t *testing.T) {
+	httpServer, server := newTestServerWithSessions(t, nil)
+	defer httpServer.Close()
+
+	ctx := t.Context()
+	userID := "test-user"
+	connectorID := "mock"
+	nonce := "testnonce"
+
+	require.NoError(t, server.storage.CreateAuthSession(ctx, storage.AuthSession{
+		ID: nonce, Secret: testSessionSecret(nonce),
+		UserID: userID, ConnectorID: connectorID,
+		CreatedAt: time.Now(), LastActivity: time.Now(),
+	}))
+
+	rr := httptest.NewRecorder()
+	req := httptest.NewRequest("POST", "/logout", nil)
+	req.AddCookie(&http.Cookie{
+		Name:  "dex_session",
+		Value: internal.SessionCookieValue(nonce, testSessionSecret(nonce), testSessionKey),
+	})
+	server.ServeHTTP(rr, req)
+
+	require.Equal(t, http.StatusOK, rr.Code)
+	require.Contains(t, rr.Body.String(), "successfully logged out")
+
+	// Session should be deleted.
+	_, err := server.storage.GetAuthSession(ctx, "testnonce")
+	require.ErrorIs(t, err, storage.ErrNotFound)
+}
+
+func TestHandleLogoutInvalidHint(t *testing.T) {
+	httpServer, server := newTestServerWithSessions(t, nil)
+	defer httpServer.Close()
+
+	rr := httptest.NewRecorder()
+	req := httptest.NewRequest("GET", "/logout?id_token_hint=invalid-token", nil)
+	server.ServeHTTP(rr, req)
+	require.Equal(t, http.StatusBadRequest, rr.Code)
+}
+
+func TestHandleLogoutWithValidHint(t *testing.T) {
+	httpServer, server := newTestServerWithSessions(t, nil)
+	defer httpServer.Close()
+
+	ctx := t.Context()
+
+	clientID := "test-client"
+	postLogoutURI := "https://example.com/done"
+	userID := "test-user"
+	connectorID := "mock"
+
+	require.NoError(t, server.storage.CreateClient(ctx, storage.Client{
+		ID:                     clientID,
+		Secret:                 "secret",
+		RedirectURIs:           []string{"https://example.com/callback"},
+		PostLogoutRedirectURIs: []string{postLogoutURI},
+	}))
+
+	require.NoError(t, server.storage.CreateAuthSession(ctx, storage.AuthSession{
+		ID:           "testnonce",
+		Secret:       testSessionSecret("testnonce"),
+		UserID:       userID,
+		ConnectorID:  connectorID,
+		CreatedAt:    time.Now(),
+		LastActivity: time.Now(),
+	}))
+
+	idToken, _, err := server.issuer.SignIDToken(ctx, tokens.Authorization{
+		Client:      storage.Client{ID: clientID},
+		Claims:      storage.Claims{UserID: userID, Username: "testuser", Email: "test@example.com"},
+		Scopes:      []string{"openid"},
+		ConnectorID: connectorID,
+		AuthTime:    time.Now(),
+	}, "", "")
+	require.NoError(t, err)
+
+	logoutURL := fmt.Sprintf("/logout?id_token_hint=%s&post_logout_redirect_uri=%s&state=mystate",
+		url.QueryEscape(idToken), url.QueryEscape(postLogoutURI))
+
+	rr := httptest.NewRecorder()
+	req := httptest.NewRequest("GET", logoutURL, nil)
+	req.AddCookie(testSessionCookie("testnonce"))
+	server.ServeHTTP(rr, req)
+
+	// RP-Initiated Logout §4: a validated post_logout_redirect_uri is a redirect,
+	// not a page with a link on it.
+	require.Equal(t, http.StatusFound, rr.Code)
+	require.Equal(t, postLogoutURI+"?state=mystate", rr.Header().Get("Location"))
+
+	// Session deleted.
+	_, err = server.storage.GetAuthSession(ctx, "testnonce")
+	require.ErrorIs(t, err, storage.ErrNotFound)
+
+	// Cookie cleared.
+	for _, c := range rr.Result().Cookies() {
+		if c.Name == "dex_session" {
+			require.Equal(t, -1, c.MaxAge)
+		}
+	}
+}
+
+func TestHandleLogoutUnregisteredRedirectURI(t *testing.T) {
+	httpServer, server := newTestServerWithSessions(t, nil)
+	defer httpServer.Close()
+
+	ctx := t.Context()
+	clientID := "test-client"
+	require.NoError(t, server.storage.CreateClient(ctx, storage.Client{
+		ID:                     clientID,
+		Secret:                 "secret",
+		RedirectURIs:           []string{"https://example.com/callback"},
+		PostLogoutRedirectURIs: []string{"https://example.com/done"},
+	}))
+
+	idToken, _, err := server.issuer.SignIDToken(ctx, tokens.Authorization{
+		Client:      storage.Client{ID: clientID},
+		Claims:      storage.Claims{UserID: "user1", Username: "testuser", Email: "test@example.com"},
+		Scopes:      []string{"openid"},
+		ConnectorID: "mock",
+		AuthTime:    time.Now(),
+	}, "", "")
+	require.NoError(t, err)
+
+	logoutURL := fmt.Sprintf("/logout?id_token_hint=%s&post_logout_redirect_uri=%s",
+		url.QueryEscape(idToken), url.QueryEscape("https://evil.com/steal"))
+
+	rr := httptest.NewRecorder()
+	server.ServeHTTP(rr, httptest.NewRequest("GET", logoutURL, nil))
+	require.Equal(t, http.StatusBadRequest, rr.Code)
+}
+
+func TestHandleLogoutRedirectURIWithoutHint(t *testing.T) {
+	httpServer, server := newTestServerWithSessions(t, nil)
+	defer httpServer.Close()
+
+	// post_logout_redirect_uri can only be validated against the client that
+	// id_token_hint names, so without a hint it is an error either way.
+	for _, method := range []string{"GET", "POST"} {
+		rr := httptest.NewRecorder()
+		server.ServeHTTP(rr, httptest.NewRequest(method, "/logout?post_logout_redirect_uri=https://example.com/done", nil))
+		require.Equal(t, http.StatusBadRequest, rr.Code, method)
+	}
+}
+
+// TestHandleLogoutRevokesOnlySessionBoundClients is the regression test for the bug
+// where signing out of a web app destroyed the user's kubectl credentials: logout
+// used to revoke every refresh token the user owned, across all clients.
+//
+// The rule now is the client's own RefreshTokenLifetime, and it holds even for the
+// client that asked for the logout.
+func TestHandleLogoutRevokesOnlySessionBoundClients(t *testing.T) {
+	httpServer, server := newTestServerWithSessions(t, nil)
+	defer httpServer.Close()
+
+	ctx := t.Context()
+	const (
+		webClient   = "web-client"
+		proxyClient = "proxy"
+		cliClient   = "kubectl"
+		userID      = "test-user"
+		connectorID = "mock"
+		postLogout  = "https://example.com/done"
+	)
+
+	// Asks for the logout, but never declared its tokens tied to the session.
+	require.NoError(t, server.storage.CreateClient(ctx, storage.Client{
+		ID: webClient, Secret: "secret",
+		RedirectURIs:           []string{"https://example.com/callback"},
+		PostLogoutRedirectURIs: []string{postLogout},
+	}))
+	// Another client in the same session, this one bound to it.
+	require.NoError(t, server.storage.CreateClient(ctx, storage.Client{
+		ID: proxyClient, Secret: "secret",
+		RedirectURIs:         []string{"https://example.com/callback"},
+		RefreshTokenLifetime: storage.RefreshTokenLifetimeSession,
+	}))
+
+	webRefresh := newTestRefreshToken(t, server, userID, connectorID, webClient)
+	proxyRefresh := newTestRefreshToken(t, server, userID, connectorID, proxyClient)
+	cliRefresh := newTestRefreshToken(t, server, userID, connectorID, cliClient)
+
+	require.NoError(t, server.storage.CreateOfflineSessions(ctx, storage.OfflineSessions{
+		UserID: userID, ConnID: connectorID,
+		Refresh: map[string]*storage.RefreshTokenRef{
+			webClient:   {ID: webRefresh, ClientID: webClient, CreatedAt: time.Now(), LastUsed: time.Now()},
+			proxyClient: {ID: proxyRefresh, ClientID: proxyClient, CreatedAt: time.Now(), LastUsed: time.Now()},
+			cliClient:   {ID: cliRefresh, ClientID: cliClient, CreatedAt: time.Now(), LastUsed: time.Now()},
+		},
+	}))
+
+	require.NoError(t, server.storage.CreateAuthSession(ctx, storage.AuthSession{
+		ID: "testnonce", Secret: testSessionSecret("testnonce"),
+		UserID: userID, ConnectorID: connectorID,
+		CreatedAt: time.Now(), LastActivity: time.Now(),
+		ClientStates: map[string]*storage.ClientAuthState{
+			webClient:   {AuthenticatedAt: time.Now()},
+			proxyClient: {AuthenticatedAt: time.Now()},
+		},
+	}))
+	idToken := newTestIDToken(t, server, webClient, userID, connectorID, "testnonce")
+
+	rr := httptest.NewRecorder()
+	req := httptest.NewRequest("GET", fmt.Sprintf("/logout?id_token_hint=%s&post_logout_redirect_uri=%s",
+		url.QueryEscape(idToken), url.QueryEscape(postLogout)), nil)
+	req.AddCookie(testSessionCookie("testnonce"))
+	server.ServeHTTP(rr, req)
+	require.Equal(t, http.StatusFound, rr.Code)
+
+	// The client that declared itself part of the session loses its token...
+	_, err := server.storage.GetRefresh(ctx, proxyRefresh)
+	require.ErrorIs(t, err, storage.ErrNotFound)
+
+	// ...while the one that merely asked for the logout keeps its own...
+	_, err = server.storage.GetRefresh(ctx, webRefresh)
+	require.NoError(t, err)
+
+	// ...and so does a client that was never in this session at all.
+	_, err = server.storage.GetRefresh(ctx, cliRefresh)
+	require.NoError(t, err)
+
+	os, err := server.storage.GetOfflineSessions(ctx, userID, connectorID)
+	require.NoError(t, err)
+	require.NotContains(t, os.Refresh, proxyClient)
+	require.Contains(t, os.Refresh, webClient)
+	require.Contains(t, os.Refresh, cliClient)
+}
+
+func TestHandleLogoutRepeat(t *testing.T) {
+	httpServer, server := newTestServerWithSessions(t, nil)
+	defer httpServer.Close()
+
+	ctx := t.Context()
+	clientID := "test-client"
+	postLogoutURI := "https://example.com/done"
+	userID := "test-user"
+	connectorID := "mock"
+
+	require.NoError(t, server.storage.CreateClient(ctx, storage.Client{
+		ID: clientID, Secret: "secret",
+		RedirectURIs:           []string{"https://example.com/callback"},
+		PostLogoutRedirectURIs: []string{postLogoutURI},
+	}))
+
+	require.NoError(t, server.storage.CreateAuthSession(ctx, storage.AuthSession{
+		ID: "testnonce", Secret: testSessionSecret("testnonce"),
+		UserID: userID, ConnectorID: connectorID,
+		CreatedAt: time.Now(), LastActivity: time.Now(),
+	}))
+
+	idToken, _, err := server.issuer.SignIDToken(ctx, tokens.Authorization{
+		Client:      storage.Client{ID: clientID},
+		Claims:      storage.Claims{UserID: userID, Username: "testuser", Email: "test@example.com"},
+		Scopes:      []string{"openid"},
+		ConnectorID: connectorID,
+		AuthTime:    time.Now(),
+	}, "", "")
+	require.NoError(t, err)
+
+	logoutURL := fmt.Sprintf("/logout?id_token_hint=%s&post_logout_redirect_uri=%s",
+		url.QueryEscape(idToken), url.QueryEscape(postLogoutURI))
+
+	req := httptest.NewRequest("GET", logoutURL, nil)
+	req.AddCookie(testSessionCookie("testnonce"))
+	rr := httptest.NewRecorder()
+	server.ServeHTTP(rr, req)
+	require.Equal(t, http.StatusFound, rr.Code)
+
+	// Second logout — session already gone, but the RP still gets its redirect.
+	req = httptest.NewRequest("GET", logoutURL, nil)
+	req.AddCookie(testSessionCookie("testnonce"))
+	rr = httptest.NewRecorder()
+	server.ServeHTTP(rr, req)
+	require.Equal(t, http.StatusFound, rr.Code)
+	require.Equal(t, postLogoutURI, rr.Header().Get("Location"))
+}
+
+func TestLogoutCallbackNoState(t *testing.T) {
+	httpServer, server := newTestServerWithSessions(t, nil)
+	defer httpServer.Close()
+
+	rr := httptest.NewRecorder()
+	server.ServeHTTP(rr, httptest.NewRequest("GET", "/logout/callback", nil))
+	require.Equal(t, http.StatusBadRequest, rr.Code)
+}
+
+func TestDiscoveryWithSessions(t *testing.T) {
+	httpServer, server := newTestServerWithSessions(t, nil)
+	defer httpServer.Close()
+
+	rr := httptest.NewRecorder()
+	server.ServeHTTP(rr, httptest.NewRequest("GET", "/.well-known/openid-configuration", nil))
+	require.Equal(t, http.StatusOK, rr.Code)
+
+	var d discovery.Document
+	require.NoError(t, json.NewDecoder(rr.Result().Body).Decode(&d))
+	require.Equal(t, fmt.Sprintf("%s/logout", httpServer.URL), d.EndSession)
+	require.True(t, d.BackchannelLogout)
+	require.True(t, d.BackchannelLogoutSession)
+	require.Contains(t, d.Claims, "sid")
+	require.Contains(t, d.Claims, "groups")
+	require.Contains(t, d.Claims, "federated_claims")
+}
+
+func TestDiscoveryWithoutSessions(t *testing.T) {
+	httpServer, server := newTestServer(t, nil)
+	defer httpServer.Close()
+
+	rr := httptest.NewRecorder()
+	server.ServeHTTP(rr, httptest.NewRequest("GET", "/.well-known/openid-configuration", nil))
+	require.Equal(t, http.StatusOK, rr.Code)
+
+	var d discovery.Document
+	require.NoError(t, json.NewDecoder(rr.Result().Body).Decode(&d))
+	require.Empty(t, d.EndSession)
+	require.False(t, d.BackchannelLogout)
+	require.False(t, d.BackchannelLogoutSession)
+	require.NotContains(t, d.Claims, "sid")
+}
+
+// TestHandleLogoutFromCookie tests logout without id_token_hint,
+// where the user is identified by their session cookie alone.
+func TestHandleLogoutFromCookie(t *testing.T) {
+	httpServer, server := newTestServerWithSessions(t, nil)
+	defer httpServer.Close()
+
+	ctx := t.Context()
+	userID := "test-user"
+	connectorID := "mock"
+	nonce := "testnonce"
+
+	require.NoError(t, server.storage.CreateAuthSession(ctx, storage.AuthSession{
+		ID: nonce, Secret: testSessionSecret(nonce),
+		UserID: userID, ConnectorID: connectorID,
+		CreatedAt: time.Now(), LastActivity: time.Now(),
+	}))
+
+	// POST performs logout (GET without hint shows confirmation).
+	rr := httptest.NewRecorder()
+	req := httptest.NewRequest("POST", "/logout", nil)
+	req.AddCookie(&http.Cookie{
+		Name:  "dex_session",
+		Value: internal.SessionCookieValue(nonce, testSessionSecret(nonce), testSessionKey),
+	})
+	server.ServeHTTP(rr, req)
+
+	require.Equal(t, http.StatusOK, rr.Code)
+	require.Contains(t, rr.Body.String(), "successfully logged out")
+
+	// Session should be deleted.
+	_, err := server.storage.GetAuthSession(ctx, "testnonce")
+	require.ErrorIs(t, err, storage.ErrNotFound)
+
+	// Cookie should be cleared.
+	for _, c := range rr.Result().Cookies() {
+		if c.Name == "dex_session" {
+			require.Equal(t, -1, c.MaxAge)
+		}
+	}
+}
+
+// TestLogoutCallbackWithExpiredSession tests that /logout/callback
+// returns an error when the session has expired or been deleted.
+func TestLogoutCallbackWithExpiredSession(t *testing.T) {
+	httpServer, server := newTestServerWithSessions(t, nil)
+	defer httpServer.Close()
+
+	// No session created — cookie points to nonexistent session.
+	rr := httptest.NewRecorder()
+	req := httptest.NewRequest("GET", "/logout/callback", nil)
+	req.AddCookie(&http.Cookie{
+		Name:  "dex_session",
+		Value: internal.SessionCookieValue("nonce", testSessionSecret("nonce"), testSessionKey),
+	})
+	server.ServeHTTP(rr, req)
+	require.Equal(t, http.StatusBadRequest, rr.Code)
+}
+
+func TestRevokeRefreshTokens(t *testing.T) {
+	httpServer, server := newTestServerWithSessions(t, nil)
+	defer httpServer.Close()
+
+	ctx := context.Background()
+	userID := "user1"
+	connectorID := "mock"
+	expectedConnData := []byte(`{"RefreshToken":"abc"}`)
+
+	refreshID := storage.NewID()
+	require.NoError(t, server.storage.CreateRefresh(ctx, storage.RefreshToken{
+		ID: refreshID, Token: "tok", ClientID: "client1", ConnectorID: connectorID,
+		Claims: storage.Claims{UserID: userID}, CreatedAt: time.Now(), LastUsed: time.Now(),
+	}))
+
+	require.NoError(t, server.storage.CreateOfflineSessions(ctx, storage.OfflineSessions{
+		UserID: userID, ConnID: connectorID, ConnectorData: expectedConnData,
+		Refresh: map[string]*storage.RefreshTokenRef{"client1": {ID: refreshID, ClientID: "client1"}},
+	}))
+
+	server.issuer.Refresh.RevokeAll(ctx, userID, connectorID)
+
+	_, err := server.storage.GetRefresh(ctx, refreshID)
+	require.ErrorIs(t, err, storage.ErrNotFound)
+
+	// Revocation clears the refresh references but keeps the session object.
+	os, err := server.storage.GetOfflineSessions(ctx, userID, connectorID)
+	require.NoError(t, err)
+	require.Empty(t, os.Refresh)
+	require.Equal(t, expectedConnData, os.ConnectorData)
+}
+
+// --- helpers ---
+
+// testSessionSecret is the secret paired with a session id in these tests. Sessions
+// are named by an id the tokens publish, and proved by a secret only the cookie ever
+// carries, so tests need both.
+func testSessionSecret(sessionID string) string { return sessionID + "-secret" }
+
+func testSessionCookie(sessionID string) *http.Cookie {
+	return &http.Cookie{
+		Name:  "dex_session",
+		Value: internal.SessionCookieValue(sessionID, testSessionSecret(sessionID), testSessionKey),
+	}
+}
+
+func newTestAuthSession(t *testing.T, server *Server, userID, connectorID, sessionID string) {
+	t.Helper()
+	require.NoError(t, server.storage.CreateAuthSession(t.Context(), storage.AuthSession{
+		ID: sessionID, Secret: testSessionSecret(sessionID),
+		UserID: userID, ConnectorID: connectorID,
+		CreatedAt: time.Now(), LastActivity: time.Now(),
+	}))
+}
+
+func newTestRefreshToken(t *testing.T, server *Server, userID, connectorID, clientID string) string {
+	t.Helper()
+	id := storage.NewID()
+	require.NoError(t, server.storage.CreateRefresh(t.Context(), storage.RefreshToken{
+		ID: id, Token: storage.NewID(), ClientID: clientID, ConnectorID: connectorID,
+		Claims:    storage.Claims{UserID: userID},
+		Scopes:    []string{"openid", "offline_access"},
+		CreatedAt: time.Now(), LastUsed: time.Now(),
+	}))
+	return id
+}
+
+// newTestIDToken mints a token the way a browser flow would: the sid names the
+// session the token came from, which is what the authorization code carries.
+func newTestIDToken(t *testing.T, server *Server, clientID, userID, connectorID, sessionID string) string {
+	t.Helper()
+
+	idToken, _, err := server.issuer.SignIDToken(t.Context(), tokens.Authorization{
+		Client:      storage.Client{ID: clientID},
+		Claims:      storage.Claims{UserID: userID, Username: "testuser", Email: "test@example.com"},
+		Scopes:      []string{"openid"},
+		ConnectorID: connectorID,
+		AuthTime:    time.Now(),
+		SessionID:   sessionID,
+	}, "", "")
+	require.NoError(t, err)
+	return idToken
+}
+
+// idTokenClaims decodes a signed token's payload without verifying it.
+func idTokenClaims(t *testing.T, token string) map[string]any {
+	t.Helper()
+	parts := strings.Split(token, ".")
+	require.Len(t, parts, 3)
+	payload, err := base64.RawURLEncoding.DecodeString(parts[1])
+	require.NoError(t, err)
+	var claims map[string]any
+	require.NoError(t, json.Unmarshal(payload, &claims))
+	return claims
+}
+
+// --- sid ---
+
+// TestIDTokenSIDNamesTheSession: the claim is the session's own identifier, and the
+// secret that proves the cookie never travels with it.
+func TestIDTokenSIDNamesTheSession(t *testing.T) {
+	httpServer, server := newTestServerWithSessions(t, nil)
+	defer httpServer.Close()
+
+	const userID, connectorID = "test-user", "mock"
+	newTestAuthSession(t, server, userID, connectorID, "session-a")
+
+	claims := idTokenClaims(t, newTestIDToken(t, server, "c", userID, connectorID, "session-a"))
+	require.Equal(t, "session-a", claims["sid"])
+	require.NotContains(t, newTestIDToken(t, server, "c", userID, connectorID, "session-a"),
+		testSessionSecret("session-a"))
+
+	// A second device is a second session, so its tokens name a different one.
+	newTestAuthSession(t, server, userID, connectorID, "session-b")
+	other := idTokenClaims(t, newTestIDToken(t, server, "c", userID, connectorID, "session-b"))
+	require.Equal(t, "session-b", other["sid"])
+}
+
+func TestIDTokenHasNoSIDWithoutSessions(t *testing.T) {
+	httpServer, server := newTestServer(t, nil)
+	defer httpServer.Close()
+
+	claims := idTokenClaims(t, newTestIDToken(t, server, "c", "test-user", "mock", ""))
+	require.NotContains(t, claims, "sid")
+}
+
+// --- replay ---
+
+// TestHandleLogoutHintReplay covers the attack the cookie-authoritative rule exists
+// to stop: a leaked id_token_hint is accepted past its expiry, so on its own it must
+// never be enough to end anybody's session.
+func TestHandleLogoutHintReplay(t *testing.T) {
+	const (
+		clientID    = "test-client"
+		userID      = "victim"
+		connectorID = "mock"
+	)
+
+	setup := func(t *testing.T) (*Server, string, string) {
+		t.Helper()
+		httpServer, server := newTestServerWithSessions(t, nil)
+		t.Cleanup(httpServer.Close)
+
+		require.NoError(t, server.storage.CreateClient(t.Context(), storage.Client{
+			ID: clientID, Secret: "secret",
+			RedirectURIs: []string{"https://example.com/callback"},
+		}))
+		newTestAuthSession(t, server, userID, connectorID, "testnonce")
+		refreshID := newTestRefreshToken(t, server, userID, connectorID, clientID)
+		require.NoError(t, server.storage.CreateOfflineSessions(t.Context(), storage.OfflineSessions{
+			UserID: userID, ConnID: connectorID,
+			Refresh: map[string]*storage.RefreshTokenRef{
+				clientID: {ID: refreshID, ClientID: clientID},
+			},
+		}))
+		return server, newTestIDToken(t, server, clientID, userID, connectorID, "testnonce"), refreshID
+	}
+
+	assertUntouched := func(t *testing.T, server *Server, sessionID, refreshID string) {
+		t.Helper()
+		_, err := server.storage.GetAuthSession(t.Context(), sessionID)
+		require.NoError(t, err, "session must survive a replayed hint")
+		_, err = server.storage.GetRefresh(t.Context(), refreshID)
+		require.NoError(t, err, "refresh token must survive a replayed hint")
+	}
+
+	t.Run("no cookie", func(t *testing.T) {
+		server, idToken, refreshID := setup(t)
+
+		rr := httptest.NewRecorder()
+		server.ServeHTTP(rr, httptest.NewRequest("GET", "/logout?id_token_hint="+url.QueryEscape(idToken), nil))
+
+		require.Equal(t, http.StatusOK, rr.Code)
+		assertUntouched(t, server, "testnonce", refreshID)
+	})
+
+	// A mismatched hint is refused on POST as well as GET, so a cross-site form
+	// submission cannot turn a leaked token into a logout either.
+	for _, method := range []string{"GET", "POST"} {
+		t.Run("cookie for a different session/"+method, func(t *testing.T) {
+			server, idToken, refreshID := setup(t)
+			newTestAuthSession(t, server, "attacker", connectorID, "attackernonce")
+
+			rr := httptest.NewRecorder()
+			req := httptest.NewRequest(method, "/logout?id_token_hint="+url.QueryEscape(idToken), nil)
+			req.AddCookie(testSessionCookie("attackernonce"))
+			server.ServeHTTP(rr, req)
+
+			// The hint does not describe the session named by the cookie, so dex asks
+			// rather than acts — RP-Initiated Logout §2.
+			require.Equal(t, http.StatusOK, rr.Code)
+			require.Contains(t, rr.Body.String(), "Do you want to log out?")
+			assertUntouched(t, server, "testnonce", refreshID)
+
+			// The attacker's own session is untouched too.
+			_, err := server.storage.GetAuthSession(t.Context(), "attackernonce")
+			require.NoError(t, err)
+		})
+	}
+
+	t.Run("stale sid for the same user", func(t *testing.T) {
+		server, idToken, refreshID := setup(t)
+
+		// The user signed out and back in: same subject, new session, so the old
+		// token's sid no longer matches.
+		require.NoError(t, server.storage.DeleteAuthSession(t.Context(), "testnonce"))
+		newTestAuthSession(t, server, userID, connectorID, "newnonce")
+
+		rr := httptest.NewRecorder()
+		req := httptest.NewRequest("GET", "/logout?id_token_hint="+url.QueryEscape(idToken), nil)
+		req.AddCookie(testSessionCookie("newnonce"))
+		server.ServeHTTP(rr, req)
+
+		require.Equal(t, http.StatusOK, rr.Code)
+		require.Contains(t, rr.Body.String(), "Do you want to log out?")
+		assertUntouched(t, server, "newnonce", refreshID)
+	})
+}
+
+// TestHandleLogoutEndsOneDevice: two browsers of the same user are two sessions, so
+// signing out of one leaves the other signed in — the thing that was impossible while
+// a session was keyed by the user and the connector it belonged to.
+func TestHandleLogoutEndsOneDevice(t *testing.T) {
+	httpServer, server := newTestServerWithSessions(t, nil)
+	defer httpServer.Close()
+
+	ctx := t.Context()
+	const userID, connectorID = "test-user", "mock"
+
+	newTestAuthSession(t, server, userID, connectorID, "laptop")
+	newTestAuthSession(t, server, userID, connectorID, "phone")
+
+	rr := httptest.NewRecorder()
+	req := httptest.NewRequest("POST", "/logout", nil)
+	req.AddCookie(testSessionCookie("phone"))
+	server.ServeHTTP(rr, req)
+	require.Equal(t, http.StatusOK, rr.Code)
+	require.Contains(t, rr.Body.String(), "successfully logged out")
+
+	_, err := server.storage.GetAuthSession(ctx, "phone")
+	require.ErrorIs(t, err, storage.ErrNotFound)
+
+	laptop, err := server.storage.GetAuthSession(ctx, "laptop")
+	require.NoError(t, err, "signing out of one device must leave the other alone")
+	require.Equal(t, userID, laptop.UserID)
+
+	// And the laptop's cookie still works, which is what "left alone" has to mean.
+	rr = httptest.NewRecorder()
+	req = httptest.NewRequest("GET", "/logout", nil)
+	req.AddCookie(testSessionCookie("laptop"))
+	server.ServeHTTP(rr, req)
+	require.Contains(t, rr.Body.String(), "Do you want to log out?")
+}
+
+// --- back-channel ---
+
+type backchannelCall struct {
+	clientID string
+	token    string
+}
+
+// startBackchannelRP returns a stub relying party that records the logout tokens it
+// receives, keyed by the client id passed in the path, and a function that collects
+// them.
+//
+// Delivery runs off the request so that a slow relying party cannot hold up the
+// user's logout, which means the response can land before the tokens do. Callers say
+// how many they expect: wait(n) blocks until n arrive, wait(0) asserts none ever do.
+func startBackchannelRP(t *testing.T, status int) (*httptest.Server, func(n int) []backchannelCall) {
+	t.Helper()
+
+	var mu sync.Mutex
+	var calls []backchannelCall
+
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		require.Equal(t, http.MethodPost, r.Method)
+		require.Equal(t, "application/x-www-form-urlencoded", r.Header.Get("Content-Type"))
+		require.NoError(t, r.ParseForm())
+
+		mu.Lock()
+		calls = append(calls, backchannelCall{
+			clientID: strings.TrimPrefix(r.URL.Path, "/"),
+			token:    r.PostForm.Get("logout_token"),
+		})
+		mu.Unlock()
+
+		w.WriteHeader(status)
+	}))
+	t.Cleanup(srv.Close)
+
+	snapshot := func() []backchannelCall {
+		mu.Lock()
+		defer mu.Unlock()
+		return append([]backchannelCall(nil), calls...)
+	}
+
+	return srv, func(n int) []backchannelCall {
+		if n == 0 {
+			require.Never(t, func() bool { return len(snapshot()) > 0 }, 200*time.Millisecond, 10*time.Millisecond)
+		} else {
+			require.Eventually(t, func() bool { return len(snapshot()) >= n }, 2*time.Second, 10*time.Millisecond)
+		}
+		return snapshot()
+	}
+}
+
+func TestBackchannelLogoutNotifiesSessionClients(t *testing.T) {
+	httpServer, server := newTestServerWithSessions(t, nil)
+	defer httpServer.Close()
+
+	rp, wait := startBackchannelRP(t, http.StatusOK)
+
+	ctx := t.Context()
+	const userID, connectorID = "test-user", "mock"
+
+	// Two clients registered for back-channel logout, one that never registered.
+	for _, id := range []string{"web-a", "web-b"} {
+		require.NoError(t, server.storage.CreateClient(ctx, storage.Client{
+			ID: id, Secret: "secret",
+			RedirectURIs:         []string{"https://example.com/callback"},
+			BackchannelLogoutURI: rp.URL + "/" + id,
+		}))
+	}
+	require.NoError(t, server.storage.CreateClient(ctx, storage.Client{
+		ID: "silent", Secret: "secret", RedirectURIs: []string{"https://example.com/callback"},
+	}))
+
+	require.NoError(t, server.storage.CreateAuthSession(ctx, storage.AuthSession{
+		ID: "testnonce", Secret: testSessionSecret("testnonce"),
+		UserID: userID, ConnectorID: connectorID,
+		CreatedAt: time.Now(), LastActivity: time.Now(),
+		ClientStates: map[string]*storage.ClientAuthState{
+			"web-a":  {AuthenticatedAt: time.Now()},
+			"web-b":  {AuthenticatedAt: time.Now()},
+			"silent": {AuthenticatedAt: time.Now()},
+		},
+	}))
+
+	idToken := newTestIDToken(t, server, "web-a", userID, connectorID, "testnonce")
+	wantSID, _ := idTokenClaims(t, idToken)["sid"].(string)
+	require.NotEmpty(t, wantSID)
+
+	rr := httptest.NewRecorder()
+	req := httptest.NewRequest("GET", "/logout?id_token_hint="+url.QueryEscape(idToken), nil)
+	req.AddCookie(testSessionCookie("testnonce"))
+	server.ServeHTTP(rr, req)
+	require.Equal(t, http.StatusOK, rr.Code)
+
+	got := wait(2)
+	require.Len(t, got, 2, "only clients with a backchannel_logout_uri are notified")
+
+	seen := map[string]bool{}
+	for _, call := range got {
+		seen[call.clientID] = true
+
+		claims := idTokenClaims(t, call.token)
+		require.Equal(t, wantSID, claims["sid"], "logout token carries the session's sid")
+		require.Equal(t, call.clientID, claims["aud"])
+		require.NotEmpty(t, claims["jti"])
+		require.NotEmpty(t, claims["sub"])
+		require.NotContains(t, claims, "nonce", "Back-Channel Logout §2.4 forbids nonce")
+
+		events, ok := claims["events"].(map[string]any)
+		require.True(t, ok)
+		require.Contains(t, events, "http://schemas.openid.net/event/backchannel-logout")
+
+		// Short lifetime bounds the replay window; the spec recommends two minutes.
+		require.InDelta(t, claims["iat"].(float64)+120, claims["exp"].(float64), 1)
+	}
+	require.Equal(t, map[string]bool{"web-a": true, "web-b": true}, seen)
+}
+
+// TestBackchannelLogoutToleratesFailingRP: a wedged relying party must not be able to
+// keep the user signed in.
+func TestBackchannelLogoutToleratesFailingRP(t *testing.T) {
+	httpServer, server := newTestServerWithSessions(t, nil)
+	defer httpServer.Close()
+
+	rp, wait := startBackchannelRP(t, http.StatusInternalServerError)
+
+	ctx := t.Context()
+	const userID, connectorID = "test-user", "mock"
+
+	require.NoError(t, server.storage.CreateClient(ctx, storage.Client{
+		ID: "web-a", Secret: "secret",
+		RedirectURIs:         []string{"https://example.com/callback"},
+		BackchannelLogoutURI: rp.URL + "/web-a",
+	}))
+	require.NoError(t, server.storage.CreateAuthSession(ctx, storage.AuthSession{
+		ID: "testnonce", Secret: testSessionSecret("testnonce"),
+		UserID: userID, ConnectorID: connectorID,
+		CreatedAt: time.Now(), LastActivity: time.Now(),
+		ClientStates: map[string]*storage.ClientAuthState{"web-a": {AuthenticatedAt: time.Now()}},
+	}))
+
+	rr := httptest.NewRecorder()
+	req := httptest.NewRequest("POST", "/logout", nil)
+	req.AddCookie(testSessionCookie("testnonce"))
+	server.ServeHTTP(rr, req)
+
+	require.Equal(t, http.StatusOK, rr.Code)
+	require.Len(t, wait(1), 1)
+
+	_, err := server.storage.GetAuthSession(ctx, "testnonce")
+	require.ErrorIs(t, err, storage.ErrNotFound, "logout completes despite the RP failing")
+}
+
+// TestBackchannelLogoutSSOSharesOneSID: clients reached through ssoSharedWith live in
+// the same AuthSession, so they share a sid and are all notified together, whatever
+// each of them declared about its refresh tokens.
+func TestBackchannelLogoutSSOSharesOneSID(t *testing.T) {
+	httpServer, server := newTestServerWithSessions(t, nil)
+	defer httpServer.Close()
+
+	rp, wait := startBackchannelRP(t, http.StatusOK)
+
+	ctx := t.Context()
+	const userID, connectorID = "test-user", "mock"
+
+	require.NoError(t, server.storage.CreateClient(ctx, storage.Client{
+		ID: "app-a", Secret: "secret",
+		RedirectURIs:         []string{"https://example.com/callback"},
+		BackchannelLogoutURI: rp.URL + "/app-a",
+		SSOSharedWith:        []string{"app-b"},
+		RefreshTokenLifetime: storage.RefreshTokenLifetimeSession,
+	}))
+	require.NoError(t, server.storage.CreateClient(ctx, storage.Client{
+		ID: "app-b", Secret: "secret",
+		RedirectURIs:         []string{"https://example.com/callback"},
+		BackchannelLogoutURI: rp.URL + "/app-b",
+	}))
+
+	aRefresh := newTestRefreshToken(t, server, userID, connectorID, "app-a")
+	bRefresh := newTestRefreshToken(t, server, userID, connectorID, "app-b")
+	require.NoError(t, server.storage.CreateOfflineSessions(ctx, storage.OfflineSessions{
+		UserID: userID, ConnID: connectorID,
+		Refresh: map[string]*storage.RefreshTokenRef{
+			"app-a": {ID: aRefresh, ClientID: "app-a"},
+			"app-b": {ID: bRefresh, ClientID: "app-b"},
+		},
+	}))
+
+	require.NoError(t, server.storage.CreateAuthSession(ctx, storage.AuthSession{
+		ID: "testnonce", Secret: testSessionSecret("testnonce"),
+		UserID: userID, ConnectorID: connectorID,
+		CreatedAt: time.Now(), LastActivity: time.Now(),
+		ClientStates: map[string]*storage.ClientAuthState{
+			"app-a": {AuthenticatedAt: time.Now()},
+			"app-b": {AuthenticatedAt: time.Now(), ViaSSO: true},
+		},
+	}))
+
+	idToken := newTestIDToken(t, server, "app-a", userID, connectorID, "testnonce")
+
+	rr := httptest.NewRecorder()
+	req := httptest.NewRequest("GET", "/logout?id_token_hint="+url.QueryEscape(idToken), nil)
+	req.AddCookie(testSessionCookie("testnonce"))
+	server.ServeHTTP(rr, req)
+	require.Equal(t, http.StatusOK, rr.Code)
+
+	got := wait(2)
+	require.Len(t, got, 2)
+	require.Equal(t, idTokenClaims(t, got[0].token)["sid"], idTokenClaims(t, got[1].token)["sid"],
+		"one session, one sid, however many clients share it")
+
+	// The SSO peer is logged out over the back channel, not by having its credential
+	// pulled out from under it: it never asked to be bound to the session.
+	_, err := server.storage.GetRefresh(ctx, aRefresh)
+	require.ErrorIs(t, err, storage.ErrNotFound)
+	_, err = server.storage.GetRefresh(ctx, bRefresh)
+	require.NoError(t, err)
+}
+
+// TestIntrospectionFollowsSession is the gateway-side half of logout: RFC 7662 §4
+// requires an authorization server to report a revoked token as inactive, and once
+// a token is bound to a session, ending the session is what revokes it.
+func TestIntrospectionFollowsSession(t *testing.T) {
+	httpServer, server := newTestServerWithSessions(t, nil)
+	defer httpServer.Close()
+
+	ctx := t.Context()
+	const clientID, userID, connectorID = "test-client", "test-user", "mock"
+
+	require.NoError(t, server.storage.CreateClient(ctx, storage.Client{
+		ID: clientID, Secret: "secret",
+		RedirectURIs: []string{"https://example.com/callback"},
+		// Only a client that declared its tokens session-bound is judged by its
+		// session here; see sessionAlive in server/introspection.
+		RefreshTokenLifetime: storage.RefreshTokenLifetimeSession,
+	}))
+	newTestAuthSession(t, server, userID, connectorID, "testnonce")
+
+	accessToken := newTestIDToken(t, server, clientID, userID, connectorID, "testnonce")
+	require.NotEmpty(t, idTokenClaims(t, accessToken)["sid"])
+
+	introspect := func(t *testing.T) bool {
+		t.Helper()
+		rr := httptest.NewRecorder()
+		req := httptest.NewRequest("POST", "/token/introspect",
+			strings.NewReader(url.Values{"token": {accessToken}}.Encode()))
+		req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+		req.SetBasicAuth(clientID, "secret")
+		server.ServeHTTP(rr, req)
+
+		var resp struct {
+			Active bool `json:"active"`
+		}
+		require.NoError(t, json.NewDecoder(rr.Result().Body).Decode(&resp))
+		return resp.Active
+	}
+
+	require.True(t, introspect(t), "a token of a live session is active")
+
+	require.NoError(t, server.storage.DeleteAuthSession(ctx, "testnonce"))
+	require.False(t, introspect(t), "ending the session revokes the token")
+
+	// Signing in again creates a session with a new nonce, so a new sid. The old
+	// token names the old one and must not come back to life.
+	newTestAuthSession(t, server, userID, connectorID, "anothernonce")
+	require.False(t, introspect(t), "a fresh session must not revive an old token")
+
+	// The same token, for a client that never asked to be bound to the session, is
+	// still active: outliving the session is what standalone means, and it is the
+	// half of this that keeps a CLI signed in.
+	require.NoError(t, server.storage.UpdateClient(ctx, clientID, func(old storage.Client) (storage.Client, error) {
+		old.RefreshTokenLifetime = storage.RefreshTokenLifetimeStandalone
+		return old, nil
+	}))
+	require.True(t, introspect(t), "a standalone client's token is not judged by the session")
+}
+
+// TestIntrospectionIgnoresTokensWithoutSession: a token minted without a session
+// carries no sid, so there is nothing to check and nothing changes for it.
+func TestIntrospectionIgnoresTokensWithoutSession(t *testing.T) {
+	httpServer, server := newTestServer(t, nil)
+	defer httpServer.Close()
+
+	const clientID = "test-client"
+	require.NoError(t, server.storage.CreateClient(t.Context(), storage.Client{
+		ID: clientID, Secret: "secret",
+		RedirectURIs: []string{"https://example.com/callback"},
+	}))
+
+	accessToken := newTestIDToken(t, server, clientID, "test-user", "mock", "")
+	require.NotContains(t, idTokenClaims(t, accessToken), "sid")
+
+	rr := httptest.NewRecorder()
+	req := httptest.NewRequest("POST", "/token/introspect",
+		strings.NewReader(url.Values{"token": {accessToken}}.Encode()))
+	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+	req.SetBasicAuth(clientID, "secret")
+	server.ServeHTTP(rr, req)
+
+	var resp struct {
+		Active bool `json:"active"`
+	}
+	require.NoError(t, json.NewDecoder(rr.Result().Body).Decode(&resp))
+	require.True(t, resp.Active)
+}
+
+// TestSIDOnlyFromBrowserFlows: the sid says which browser session a token belongs
+// to, so a flow that never passed through a browser must not acquire one. Resolving
+// it from the user's identity used to hand a password-grant token whatever session
+// that user happened to have open — and, with introspection now following the
+// session, signing out of the browser would then kill an unrelated token.
+func TestSIDOnlyFromBrowserFlows(t *testing.T) {
+	httpServer, server := newTestServerWithSessions(t, nil)
+	defer httpServer.Close()
+
+	const userID, connectorID = "test-user", "mock"
+	newTestAuthSession(t, server, userID, connectorID, "browsernonce")
+
+	// A browser flow supplies the session it belongs to.
+	browserToken, _, err := server.issuer.SignIDToken(t.Context(), tokens.Authorization{
+		Client:      storage.Client{ID: "web"},
+		Claims:      storage.Claims{UserID: userID},
+		Scopes:      []string{"openid"},
+		ConnectorID: connectorID,
+		SessionID:   "browsernonce",
+	}, "", "")
+	require.NoError(t, err)
+	require.NotEmpty(t, idTokenClaims(t, browserToken)["sid"])
+
+	// Everything else leaves it unset, even for a user who is signed in elsewhere.
+	otherToken, _, err := server.issuer.SignIDToken(t.Context(), tokens.Authorization{
+		Client:      storage.Client{ID: "cli"},
+		Claims:      storage.Claims{UserID: userID},
+		Scopes:      []string{"openid"},
+		ConnectorID: connectorID,
+	}, "", "")
+	require.NoError(t, err)
+	require.NotContains(t, idTokenClaims(t, otherToken), "sid")
+}
+
+// TestRefreshSIDFollowsOrigin covers what a refresh does with the sid: it names the
+// session the token came from, and is never invented for a token that was not part
+// of one.
+func TestRefreshSIDFollowsOrigin(t *testing.T) {
+	httpServer, server := newTestServerWithSessions(t, nil)
+	defer httpServer.Close()
+
+	ctx := t.Context()
+	const userID, connectorID = "test-user", "mock"
+	newTestAuthSession(t, server, userID, connectorID, "browsernonce")
+	const sid = "browsernonce"
+
+	// A refresh token from a browser flow records the session it came from; one
+	// from any other flow records nothing.
+	fromBrowser, err := server.issuer.Refresh.Create(ctx, tokens.Authorization{
+		Client:      storage.Client{ID: "web"},
+		Claims:      storage.Claims{UserID: userID},
+		Scopes:      []string{"openid", "offline_access"},
+		ConnectorID: connectorID,
+		SessionID:   sid,
+	})
+	require.NoError(t, err)
+	require.NotEmpty(t, fromBrowser)
+
+	_, err = server.issuer.Refresh.Create(ctx, tokens.Authorization{
+		Client:      storage.Client{ID: "cli"},
+		Claims:      storage.Claims{UserID: userID},
+		Scopes:      []string{"openid", "offline_access"},
+		ConnectorID: connectorID,
+	})
+	require.NoError(t, err)
+
+	offline, err := server.storage.GetOfflineSessions(ctx, userID, connectorID)
+	require.NoError(t, err)
+	require.Equal(t, sid, offline.Refresh["web"].SessionID, "browser flow records its session")
+	require.Empty(t, offline.Refresh["cli"].SessionID, "other flows record none")
+}
+
+// TestExpiredSessionHasNoSID: garbage collection removes an expired session only
+// every GCFrequency, so between expiry and collection the row is still there. A sid
+// resolved from it would tell introspection that tokens of an ended session are
+// still good, which is exactly the window this feature exists to close.
+func TestExpiredSessionHasNoSID(t *testing.T) {
+	httpServer, server := newTestServerWithSessions(t, nil)
+	defer httpServer.Close()
+
+	ctx := t.Context()
+	const clientID, userID, connectorID = "test-client", "test-user", "mock"
+	require.NoError(t, server.storage.CreateClient(ctx, storage.Client{
+		ID: clientID, Secret: "secret", RedirectURIs: []string{"https://example.com/cb"},
+	}))
+
+	past := time.Now().Add(-time.Hour)
+	for _, tc := range []struct {
+		name     string
+		absolute time.Time
+		idle     time.Time
+	}{
+		{"absolute lifetime", past, time.Now().Add(time.Hour)},
+		{"idle timeout", time.Now().Add(time.Hour), past},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			if err := server.storage.DeleteAuthSession(ctx, "expirednonce"); err != nil {
+				require.ErrorIs(t, err, storage.ErrNotFound)
+			}
+			require.NoError(t, server.storage.CreateAuthSession(ctx, storage.AuthSession{
+				ID: "expirednonce", Secret: testSessionSecret("expirednonce"),
+				UserID: userID, ConnectorID: connectorID,
+				CreatedAt: past, LastActivity: past,
+				AbsoluteExpiry: tc.absolute, IdleExpiry: tc.idle,
+			}))
+
+			// The session is still stored...
+			_, err := server.storage.GetAuthSession(ctx, "expirednonce")
+			require.NoError(t, err)
+
+			// ...but it is over, so nothing may claim it. Garbage collection runs on
+			// its own schedule; a token must not outlive its session by that window.
+			require.False(t, server.sessions.Alive(ctx, "expirednonce"))
+		})
+	}
+}
+
+// TestHandleLogoutExpiredSession: an expired session is nothing left to end, so
+// logout must not report otherwise or fan out logout tokens for it.
+func TestHandleLogoutExpiredSession(t *testing.T) {
+	httpServer, server := newTestServerWithSessions(t, nil)
+	defer httpServer.Close()
+
+	rp, wait := startBackchannelRP(t, http.StatusOK)
+
+	ctx := t.Context()
+	const userID, connectorID = "test-user", "mock"
+	require.NoError(t, server.storage.CreateClient(ctx, storage.Client{
+		ID: "web-a", Secret: "secret",
+		RedirectURIs:         []string{"https://example.com/cb"},
+		BackchannelLogoutURI: rp.URL + "/web-a",
+	}))
+
+	past := time.Now().Add(-time.Hour)
+	require.NoError(t, server.storage.CreateAuthSession(ctx, storage.AuthSession{
+		ID: "expirednonce", Secret: testSessionSecret("expirednonce"),
+		UserID: userID, ConnectorID: connectorID,
+		CreatedAt: past, LastActivity: past,
+		AbsoluteExpiry: past, IdleExpiry: past,
+		ClientStates: map[string]*storage.ClientAuthState{"web-a": {AuthenticatedAt: time.Now()}},
+	}))
+
+	rr := httptest.NewRecorder()
+	req := httptest.NewRequest("POST", "/logout", nil)
+	req.AddCookie(testSessionCookie("expirednonce"))
+	server.ServeHTTP(rr, req)
+
+	require.Equal(t, http.StatusOK, rr.Code)
+	require.Contains(t, rr.Body.String(), "No active session")
+	require.Empty(t, wait(0), "an expired session has no relying parties left to tell")
+}
diff --git a/server/server_oauth2_test.go b/server/server_oauth2_test.go
new file mode 100644
index 0000000000..ce1c36a9f4
--- /dev/null
+++ b/server/server_oauth2_test.go
@@ -0,0 +1,303 @@
+package server
+
+import (
+	"context"
+	"crypto/rand"
+	"crypto/rsa"
+	"encoding/json"
+	"log/slog"
+	"net/url"
+	"testing"
+	"time"
+
+	"github.com/go-jose/go-jose/v4"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/dexidp/dex/server/signer"
+	"github.com/dexidp/dex/server/tokens"
+	"github.com/dexidp/dex/storage"
+	"github.com/dexidp/dex/storage/memory"
+)
+
+func TestSignerKeySet(t *testing.T) {
+	logger := newLogger(t)
+	s := memory.New(logger)
+	if err := s.UpdateKeys(t.Context(), func(keys storage.Keys) (storage.Keys, error) {
+		keys.SigningKey = &jose.JSONWebKey{
+			Key:       testKey,
+			KeyID:     "testkey",
+			Algorithm: "RS256",
+			Use:       "sig",
+		}
+		keys.SigningKeyPub = &jose.JSONWebKey{
+			Key:       testKey.Public(),
+			KeyID:     "testkey",
+			Algorithm: "RS256",
+			Use:       "sig",
+		}
+		return keys, nil
+	}); err != nil {
+		t.Fatal(err)
+	}
+
+	tests := []struct {
+		name           string
+		tokenGenerator func() (jwt string, err error)
+		wantErr        bool
+	}{
+		{
+			name: "valid token",
+			tokenGenerator: func() (string, error) {
+				signer, err := jose.NewSigner(jose.SigningKey{Algorithm: jose.RS256, Key: testKey}, nil)
+				if err != nil {
+					return "", err
+				}
+
+				jws, err := signer.Sign([]byte("payload"))
+				if err != nil {
+					return "", err
+				}
+
+				return jws.CompactSerialize()
+			},
+			wantErr: false,
+		},
+		{
+			name: "token signed by different key",
+			tokenGenerator: func() (string, error) {
+				key, err := rsa.GenerateKey(rand.Reader, 2048)
+				if err != nil {
+					return "", err
+				}
+
+				signer, err := jose.NewSigner(jose.SigningKey{Algorithm: jose.RS256, Key: key}, nil)
+				if err != nil {
+					return "", err
+				}
+
+				jws, err := signer.Sign([]byte("payload"))
+				if err != nil {
+					return "", err
+				}
+
+				return jws.CompactSerialize()
+			},
+			wantErr: true,
+		},
+	}
+
+	for _, tc := range tests {
+		tc := tc
+		t.Run(tc.name, func(t *testing.T) {
+			jwt, err := tc.tokenGenerator()
+			if err != nil {
+				t.Fatal(err)
+			}
+
+			// Create a mock signer for testing
+			sig, err := signer.NewMockSigner(testKey)
+			if err != nil {
+				t.Fatal(err)
+			}
+
+			keySet := &signer.KeySet{
+				Signer: sig,
+			}
+
+			_, err = keySet.VerifySignature(t.Context(), jwt)
+			if (err != nil && !tc.wantErr) || (err == nil && tc.wantErr) {
+				t.Fatalf("wantErr = %v, but got err = %v", tc.wantErr, err)
+			}
+		})
+	}
+}
+
+func TestSignerKeySetWithES256LocalSigner(t *testing.T) {
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+
+	logger := slog.New(slog.DiscardHandler)
+	store := memory.New(logger)
+
+	localConfig := signer.LocalConfig{
+		KeysRotationPeriod: time.Hour.String(),
+		Algorithm:          jose.ES256,
+	}
+	sig, err := localConfig.Open(ctx, store, time.Hour, time.Now, logger)
+	require.NoError(t, err)
+
+	sig.Start(ctx)
+
+	jwt, err := sig.Sign(ctx, []byte("payload"))
+	require.NoError(t, err)
+
+	keySet := &signer.KeySet{Signer: sig}
+	payload, err := keySet.VerifySignature(ctx, jwt)
+	require.NoError(t, err)
+	require.Equal(t, []byte("payload"), payload)
+}
+
+func TestNewIDTokenUsesStoredAlgorithmUntilNextRotation(t *testing.T) {
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+
+	logger := slog.New(slog.DiscardHandler)
+	store := memory.New(logger)
+
+	now := time.Now().UTC()
+	err := store.UpdateKeys(ctx, func(keys storage.Keys) (storage.Keys, error) {
+		keys.SigningKey = &jose.JSONWebKey{
+			Key:       testKey,
+			KeyID:     "legacy-rs256",
+			Algorithm: string(jose.RS256),
+			Use:       "sig",
+		}
+		keys.SigningKeyPub = &jose.JSONWebKey{
+			Key:       testKey.Public(),
+			KeyID:     "legacy-rs256",
+			Algorithm: string(jose.RS256),
+			Use:       "sig",
+		}
+		keys.NextRotation = now.Add(time.Hour)
+		return keys, nil
+	})
+	require.NoError(t, err)
+
+	localConfig := signer.LocalConfig{
+		KeysRotationPeriod: time.Hour.String(),
+		Algorithm:          jose.ES256,
+	}
+	sig, err := localConfig.Open(ctx, store, time.Hour, func() time.Time { return now }, logger)
+	require.NoError(t, err)
+
+	sig.Start(ctx)
+
+	alg, err := sig.Algorithm(ctx)
+	require.NoError(t, err)
+	require.Equal(t, jose.RS256, alg)
+
+	issuerURL, err := url.Parse("https://issuer.example.com")
+	require.NoError(t, err)
+
+	issuer := tokens.NewIssuer(store, sig, *issuerURL, time.Hour, func() time.Time { return now }, logger)
+
+	accessToken := "test-access-token"
+	code := "test-auth-code"
+	idToken, _, err := issuer.SignIDToken(ctx, tokens.Authorization{
+		Client:      storage.Client{ID: "test-client"},
+		Claims:      storage.Claims{UserID: "1", Username: "jane"},
+		Scopes:      []string{"openid"},
+		Nonce:       "nonce",
+		ConnectorID: "test",
+	}, accessToken, code)
+	require.NoError(t, err)
+
+	keys, err := sig.ValidationKeys(ctx)
+	require.NoError(t, err)
+	require.NotEmpty(t, keys)
+
+	jws, err := jose.ParseSigned(idToken, []jose.SignatureAlgorithm{jose.RS256})
+	require.NoError(t, err)
+	require.Len(t, jws.Signatures, 1)
+	require.Equal(t, string(jose.RS256), jws.Signatures[0].Protected.Algorithm)
+
+	payload, err := jws.Verify(keys[0])
+	require.NoError(t, err)
+
+	var claims struct {
+		AccessTokenHash string `json:"at_hash"`
+		CodeHash        string `json:"c_hash"`
+	}
+	err = json.Unmarshal(payload, &claims)
+	require.NoError(t, err)
+
+	wantAtHash, err := tokens.AccessTokenHash(jose.RS256, accessToken)
+	require.NoError(t, err)
+	require.Equal(t, wantAtHash, claims.AccessTokenHash)
+
+	wantCodeHash, err := tokens.AccessTokenHash(jose.RS256, code)
+	require.NoError(t, err)
+	require.Equal(t, wantCodeHash, claims.CodeHash)
+}
+
+func TestNewIDTokenContainsJTI(t *testing.T) {
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+
+	logger := slog.New(slog.DiscardHandler)
+	store := memory.New(logger)
+
+	now := time.Now().UTC()
+	err := store.UpdateKeys(ctx, func(keys storage.Keys) (storage.Keys, error) {
+		keys.SigningKey = &jose.JSONWebKey{
+			Key:       testKey,
+			KeyID:     "test-rs256",
+			Algorithm: string(jose.RS256),
+			Use:       "sig",
+		}
+		keys.SigningKeyPub = &jose.JSONWebKey{
+			Key:       testKey.Public(),
+			KeyID:     "test-rs256",
+			Algorithm: string(jose.RS256),
+			Use:       "sig",
+		}
+		keys.NextRotation = now.Add(time.Hour)
+		return keys, nil
+	})
+	require.NoError(t, err)
+
+	localConfig := signer.LocalConfig{
+		KeysRotationPeriod: time.Hour.String(),
+		Algorithm:          jose.RS256,
+	}
+	sig, err := localConfig.Open(ctx, store, time.Hour, func() time.Time { return now }, logger)
+	require.NoError(t, err)
+
+	sig.Start(ctx)
+
+	issuerURL, err := url.Parse("https://issuer.example.com")
+	require.NoError(t, err)
+
+	issuer := tokens.NewIssuer(store, sig, *issuerURL, time.Hour, func() time.Time { return now }, logger)
+
+	keys, err := sig.ValidationKeys(ctx)
+	require.NoError(t, err)
+	require.NotEmpty(t, keys)
+
+	extractJTI := func(t *testing.T, idToken string) string {
+		t.Helper()
+		jws, err := jose.ParseSigned(idToken, []jose.SignatureAlgorithm{jose.RS256})
+		require.NoError(t, err)
+		payload, err := jws.Verify(keys[0])
+		require.NoError(t, err)
+		var claims struct {
+			JTI string `json:"jti"`
+		}
+		err = json.Unmarshal(payload, &claims)
+		require.NoError(t, err)
+		return claims.JTI
+	}
+
+	mint := func(nonce string) string {
+		t.Helper()
+		token, _, err := issuer.SignIDToken(ctx, tokens.Authorization{
+			Client:      storage.Client{ID: "client"},
+			Claims:      storage.Claims{UserID: "1", Username: "alice"},
+			Scopes:      []string{"openid"},
+			Nonce:       nonce,
+			ConnectorID: "mock",
+		}, "", "")
+		require.NoError(t, err)
+		return token
+	}
+	token1 := mint("n1")
+	token2 := mint("n2")
+
+	jti1 := extractJTI(t, token1)
+	jti2 := extractJTI(t, token2)
+
+	assert.NotEmpty(t, jti1, "jti claim must be present and non-empty")
+	assert.NotEmpty(t, jti2, "jti claim must be present and non-empty")
+	assert.NotEqual(t, jti1, jti2, "each token must have a unique jti")
+}
diff --git a/server/server_test.go b/server/server_test.go
index 828e7faf95..24dc272764 100644
--- a/server/server_test.go
+++ b/server/server_test.go
@@ -13,7 +13,6 @@ import (
 	"net/http/httptest"
 	"net/http/httputil"
 	"net/url"
-	"os"
 	"path"
 	"reflect"
 	"sort"
@@ -22,17 +21,22 @@ import (
 	"time"
 
 	gosundheit "github.com/AppsFlyer/go-sundheit"
+	"github.com/AppsFlyer/go-sundheit/checks"
 	"github.com/coreos/go-oidc/v3/oidc"
+	"github.com/go-jose/go-jose/v4"
 	"github.com/kylelemons/godebug/pretty"
 	"github.com/prometheus/client_golang/prometheus"
-	"github.com/sirupsen/logrus"
 	"github.com/stretchr/testify/require"
 	"golang.org/x/crypto/bcrypt"
-	"golang.org/x/oauth2"
-	jose "gopkg.in/square/go-jose.v2"
+	xoauth2 "golang.org/x/oauth2"
 
 	"github.com/dexidp/dex/connector"
 	"github.com/dexidp/dex/connector/mock"
+	"github.com/dexidp/dex/server/connectors"
+	"github.com/dexidp/dex/server/device"
+	"github.com/dexidp/dex/server/oauth2"
+	"github.com/dexidp/dex/server/signer"
+	"github.com/dexidp/dex/server/tokens"
 	"github.com/dexidp/dex/storage"
 	"github.com/dexidp/dex/storage/memory"
 )
@@ -77,124 +81,17 @@ FDWV28nTP9sqbtsmU8Tem2jzMvZ7C/Q0AuDoKELFUpux8shm8wfIhyaPnXUGZoAZ
 Np4vUwMSYV5mopESLWOg3loBxKyLGFtgGKVCjGiQvy6zISQ4fQo=
 -----END RSA PRIVATE KEY-----`)
 
-var logger = &logrus.Logger{
-	Out:       os.Stderr,
-	Formatter: &logrus.TextFormatter{DisableColors: true},
-	Level:     logrus.DebugLevel,
-}
-
-func newTestServer(ctx context.Context, t *testing.T, updateConfig func(c *Config)) (*httptest.Server, *Server) {
-	var server *Server
-	s := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		server.ServeHTTP(w, r)
-	}))
-
-	config := Config{
-		Issuer:  s.URL,
-		Storage: memory.New(logger),
-		Web: WebConfig{
-			Dir: "../web",
-		},
-		Logger:             logger,
-		PrometheusRegistry: prometheus.NewRegistry(),
-		HealthChecker:      gosundheit.New(),
-	}
-	if updateConfig != nil {
-		updateConfig(&config)
-	}
-	s.URL = config.Issuer
-
-	connector := storage.Connector{
-		ID:              "mock",
-		Type:            "mockCallback",
-		Name:            "Mock",
-		ResourceVersion: "1",
-	}
-	if err := config.Storage.CreateConnector(connector); err != nil {
-		t.Fatalf("create connector: %v", err)
-	}
-
-	var err error
-	if server, err = newServer(ctx, config, staticRotationStrategy(testKey)); err != nil {
-		t.Fatal(err)
-	}
-	server.skipApproval = true // Don't prompt for approval, just immediately redirect with code.
-
-	// Default rotation policy
-	if server.refreshTokenPolicy == nil {
-		server.refreshTokenPolicy, err = NewRefreshTokenPolicy(logger, false, "", "", "")
-		if err != nil {
-			t.Fatalf("failed to prepare rotation policy: %v", err)
-		}
-		server.refreshTokenPolicy.now = config.Now
-	}
-
-	return s, server
-}
-
-func newTestServerMultipleConnectors(ctx context.Context, t *testing.T, updateConfig func(c *Config)) (*httptest.Server, *Server) {
-	var server *Server
-	s := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		server.ServeHTTP(w, r)
-	}))
-
-	config := Config{
-		Issuer:  s.URL,
-		Storage: memory.New(logger),
-		Web: WebConfig{
-			Dir: "../web",
-		},
-		Logger:             logger,
-		PrometheusRegistry: prometheus.NewRegistry(),
-	}
-	if updateConfig != nil {
-		updateConfig(&config)
-	}
-	s.URL = config.Issuer
-
-	connector := storage.Connector{
-		ID:              "mock",
-		Type:            "mockCallback",
-		Name:            "Mock",
-		ResourceVersion: "1",
-	}
-	connector2 := storage.Connector{
-		ID:              "mock2",
-		Type:            "mockCallback",
-		Name:            "Mock",
-		ResourceVersion: "1",
-	}
-	if err := config.Storage.CreateConnector(connector); err != nil {
-		t.Fatalf("create connector: %v", err)
-	}
-	if err := config.Storage.CreateConnector(connector2); err != nil {
-		t.Fatalf("create connector: %v", err)
-	}
-
-	var err error
-	if server, err = newServer(ctx, config, staticRotationStrategy(testKey)); err != nil {
-		t.Fatal(err)
-	}
-	server.skipApproval = true // Don't prompt for approval, just immediately redirect with code.
-	return s, server
-}
-
 func TestNewTestServer(t *testing.T) {
-	ctx, cancel := context.WithCancel(context.Background())
-	defer cancel()
-	newTestServer(ctx, t, nil)
+	newTestServer(t, nil)
 }
 
 func TestDiscovery(t *testing.T) {
-	ctx, cancel := context.WithCancel(context.Background())
-	defer cancel()
-
-	httpServer, _ := newTestServer(ctx, t, func(c *Config) {
+	httpServer, _ := newTestServer(t, func(c *Config) {
 		c.Issuer += "/non-root-path"
 	})
 	defer httpServer.Close()
 
-	p, err := oidc.NewProvider(ctx, httpServer.URL)
+	p, err := oidc.NewProvider(t.Context(), httpServer.URL)
 	if err != nil {
 		t.Fatalf("failed to get provider: %v", err)
 	}
@@ -228,13 +125,13 @@ type test struct {
 	// If specified these set of scopes will be used during the test case.
 	scopes []string
 	// handleToken provides the OAuth2 token response for the integration test.
-	handleToken func(context.Context, *oidc.Provider, *oauth2.Config, *oauth2.Token, *mock.Callback) error
+	handleToken func(context.Context, *oidc.Provider, *xoauth2.Config, *xoauth2.Token, *mock.Callback) error
 
 	// extra parameters to pass when requesting auth_code
-	authCodeOptions []oauth2.AuthCodeOption
+	authCodeOptions []xoauth2.AuthCodeOption
 
 	// extra parameters to pass when retrieving id token
-	retrieveTokenOptions []oauth2.AuthCodeOption
+	retrieveTokenOptions []xoauth2.AuthCodeOption
 
 	// define an error response, when the test expects an error on the auth endpoint
 	authError *OAuth2ErrorResponse
@@ -268,7 +165,7 @@ func makeOAuth2Tests(clientID string, clientSecret string, now func() time.Time)
 
 	oidcConfig := &oidc.Config{SkipClientIDCheck: true}
 
-	basicIDTokenVerify := func(ctx context.Context, p *oidc.Provider, config *oauth2.Config, token *oauth2.Token, conn *mock.Callback) error {
+	basicIDTokenVerify := func(ctx context.Context, p *oidc.Provider, config *xoauth2.Config, token *xoauth2.Token, conn *mock.Callback) error {
 		idToken, ok := token.Extra("id_token").(string)
 		if !ok {
 			return fmt.Errorf("no id token found")
@@ -284,7 +181,7 @@ func makeOAuth2Tests(clientID string, clientSecret string, now func() time.Time)
 		tests: []test{
 			{
 				name: "verify ID Token",
-				handleToken: func(ctx context.Context, p *oidc.Provider, config *oauth2.Config, token *oauth2.Token, conn *mock.Callback) error {
+				handleToken: func(ctx context.Context, p *oidc.Provider, config *xoauth2.Config, token *xoauth2.Token, conn *mock.Callback) error {
 					idToken, ok := token.Extra("id_token").(string)
 					if !ok {
 						return fmt.Errorf("no id token found")
@@ -297,7 +194,7 @@ func makeOAuth2Tests(clientID string, clientSecret string, now func() time.Time)
 			},
 			{
 				name: "fetch userinfo",
-				handleToken: func(ctx context.Context, p *oidc.Provider, config *oauth2.Config, token *oauth2.Token, conn *mock.Callback) error {
+				handleToken: func(ctx context.Context, p *oidc.Provider, config *xoauth2.Config, token *xoauth2.Token, conn *mock.Callback) error {
 					ui, err := p.UserInfo(ctx, config.TokenSource(ctx, token))
 					if err != nil {
 						return fmt.Errorf("failed to fetch userinfo: %v", err)
@@ -310,7 +207,7 @@ func makeOAuth2Tests(clientID string, clientSecret string, now func() time.Time)
 			},
 			{
 				name: "verify id token and oauth2 token expiry",
-				handleToken: func(ctx context.Context, p *oidc.Provider, config *oauth2.Config, token *oauth2.Token, conn *mock.Callback) error {
+				handleToken: func(ctx context.Context, p *oidc.Provider, config *xoauth2.Config, token *xoauth2.Token, conn *mock.Callback) error {
 					expectedExpiry := now().Add(idTokensValidFor)
 
 					timeEq := func(t1, t2 time.Time, within time.Duration) bool {
@@ -338,7 +235,7 @@ func makeOAuth2Tests(clientID string, clientSecret string, now func() time.Time)
 			},
 			{
 				name: "verify at_hash",
-				handleToken: func(ctx context.Context, p *oidc.Provider, config *oauth2.Config, token *oauth2.Token, conn *mock.Callback) error {
+				handleToken: func(ctx context.Context, p *oidc.Provider, config *xoauth2.Config, token *xoauth2.Token, conn *mock.Callback) error {
 					rawIDToken, ok := token.Extra("id_token").(string)
 					if !ok {
 						return fmt.Errorf("no id token found")
@@ -357,7 +254,7 @@ func makeOAuth2Tests(clientID string, clientSecret string, now func() time.Time)
 					if claims.AtHash == "" {
 						return errors.New("no at_hash value in id_token")
 					}
-					wantAtHash, err := accessTokenHash(jose.RS256, token.AccessToken)
+					wantAtHash, err := tokens.AccessTokenHash(jose.RS256, token.AccessToken)
 					if err != nil {
 						return fmt.Errorf("computed expected at hash: %v", err)
 					}
@@ -370,7 +267,7 @@ func makeOAuth2Tests(clientID string, clientSecret string, now func() time.Time)
 			},
 			{
 				name: "refresh token",
-				handleToken: func(ctx context.Context, p *oidc.Provider, config *oauth2.Config, token *oauth2.Token, conn *mock.Callback) error {
+				handleToken: func(ctx context.Context, p *oidc.Provider, config *xoauth2.Config, token *xoauth2.Token, conn *mock.Callback) error {
 					// have to use time.Now because the OAuth2 package uses it.
 					token.Expiry = time.Now().Add(time.Second * -10)
 					if token.Valid() {
@@ -393,7 +290,7 @@ func makeOAuth2Tests(clientID string, clientSecret string, now func() time.Time)
 			},
 			{
 				name: "refresh with explicit scopes",
-				handleToken: func(ctx context.Context, p *oidc.Provider, config *oauth2.Config, token *oauth2.Token, conn *mock.Callback) error {
+				handleToken: func(ctx context.Context, p *oidc.Provider, config *xoauth2.Config, token *xoauth2.Token, conn *mock.Callback) error {
 					v := url.Values{}
 					v.Add("client_id", clientID)
 					v.Add("client_secret", clientSecret)
@@ -423,7 +320,7 @@ func makeOAuth2Tests(clientID string, clientSecret string, now func() time.Time)
 			},
 			{
 				name: "refresh with extra spaces",
-				handleToken: func(ctx context.Context, p *oidc.Provider, config *oauth2.Config, token *oauth2.Token, conn *mock.Callback) error {
+				handleToken: func(ctx context.Context, p *oidc.Provider, config *xoauth2.Config, token *xoauth2.Token, conn *mock.Callback) error {
 					v := url.Values{}
 					v.Add("client_id", clientID)
 					v.Add("client_secret", clientSecret)
@@ -458,7 +355,7 @@ func makeOAuth2Tests(clientID string, clientSecret string, now func() time.Time)
 			{
 				name:   "refresh with unauthorized scopes",
 				scopes: []string{"openid", "email"},
-				handleToken: func(ctx context.Context, p *oidc.Provider, config *oauth2.Config, token *oauth2.Token, conn *mock.Callback) error {
+				handleToken: func(ctx context.Context, p *oidc.Provider, config *xoauth2.Config, token *xoauth2.Token, conn *mock.Callback) error {
 					v := url.Values{}
 					v.Add("client_id", clientID)
 					v.Add("client_secret", clientSecret)
@@ -484,7 +381,7 @@ func makeOAuth2Tests(clientID string, clientSecret string, now func() time.Time)
 			{
 				name:   "refresh with different client id",
 				scopes: []string{"openid", "email"},
-				handleToken: func(ctx context.Context, p *oidc.Provider, config *oauth2.Config, token *oauth2.Token, conn *mock.Callback) error {
+				handleToken: func(ctx context.Context, p *oidc.Provider, config *xoauth2.Config, token *xoauth2.Token, conn *mock.Callback) error {
 					v := url.Values{}
 					v.Add("client_id", clientID)
 					v.Add("client_secret", clientSecret)
@@ -510,8 +407,8 @@ func makeOAuth2Tests(clientID string, clientSecret string, now func() time.Time)
 						return fmt.Errorf("cannot decode token response: %v", err)
 					}
 
-					if respErr.Error != errInvalidGrant {
-						return fmt.Errorf("expected error %q, got %q", errInvalidGrant, respErr.Error)
+					if respErr.Error != oauth2.InvalidGrant {
+						return fmt.Errorf("expected error %q, got %q", oauth2.InvalidGrant, respErr.Error)
 					}
 
 					expectedMsg := "Refresh token is invalid or has already been claimed by another client."
@@ -526,7 +423,7 @@ func makeOAuth2Tests(clientID string, clientSecret string, now func() time.Time)
 				// This test ensures that the connector.RefreshConnector interface is being
 				// used when clients request a refresh token.
 				name: "refresh with identity changes",
-				handleToken: func(ctx context.Context, p *oidc.Provider, config *oauth2.Config, token *oauth2.Token, conn *mock.Callback) error {
+				handleToken: func(ctx context.Context, p *oidc.Provider, config *xoauth2.Config, token *xoauth2.Token, conn *mock.Callback) error {
 					// have to use time.Now because the OAuth2 package uses it.
 					token.Expiry = time.Now().Add(time.Second * -10)
 					if token.Valid() {
@@ -575,66 +472,66 @@ func makeOAuth2Tests(clientID string, clientSecret string, now func() time.Time)
 			},
 			{
 				name: "unsupported grant type",
-				retrieveTokenOptions: []oauth2.AuthCodeOption{
-					oauth2.SetAuthURLParam("grant_type", "unsupported"),
+				retrieveTokenOptions: []xoauth2.AuthCodeOption{
+					xoauth2.SetAuthURLParam("grant_type", "unsupported"),
 				},
 				handleToken: basicIDTokenVerify,
 				tokenError: ErrorResponse{
-					Error:      errUnsupportedGrantType,
+					Error:      oauth2.UnsupportedGrantType,
 					StatusCode: http.StatusBadRequest,
 				},
 			},
 			{
 				// This test ensures that PKCE work in "plain" mode (no code_challenge_method specified)
 				name: "PKCE with plain",
-				authCodeOptions: []oauth2.AuthCodeOption{
-					oauth2.SetAuthURLParam("code_challenge", "challenge123"),
+				authCodeOptions: []xoauth2.AuthCodeOption{
+					xoauth2.SetAuthURLParam("code_challenge", "challenge123"),
 				},
-				retrieveTokenOptions: []oauth2.AuthCodeOption{
-					oauth2.SetAuthURLParam("code_verifier", "challenge123"),
+				retrieveTokenOptions: []xoauth2.AuthCodeOption{
+					xoauth2.SetAuthURLParam("code_verifier", "challenge123"),
 				},
 				handleToken: basicIDTokenVerify,
 			},
 			{
 				// This test ensures that PKCE works in "S256" mode
 				name: "PKCE with S256",
-				authCodeOptions: []oauth2.AuthCodeOption{
-					oauth2.SetAuthURLParam("code_challenge", "lyyl-X4a69qrqgEfUL8wodWic3Be9ZZ5eovBgIKKi-w"),
-					oauth2.SetAuthURLParam("code_challenge_method", "S256"),
+				authCodeOptions: []xoauth2.AuthCodeOption{
+					xoauth2.SetAuthURLParam("code_challenge", "lyyl-X4a69qrqgEfUL8wodWic3Be9ZZ5eovBgIKKi-w"),
+					xoauth2.SetAuthURLParam("code_challenge_method", "S256"),
 				},
-				retrieveTokenOptions: []oauth2.AuthCodeOption{
-					oauth2.SetAuthURLParam("code_verifier", "challenge123"),
+				retrieveTokenOptions: []xoauth2.AuthCodeOption{
+					xoauth2.SetAuthURLParam("code_verifier", "challenge123"),
 				},
 				handleToken: basicIDTokenVerify,
 			},
 			{
 				// This test ensures that PKCE does fail with wrong code_verifier in "plain" mode
 				name: "PKCE with plain and wrong code_verifier",
-				authCodeOptions: []oauth2.AuthCodeOption{
-					oauth2.SetAuthURLParam("code_challenge", "challenge123"),
+				authCodeOptions: []xoauth2.AuthCodeOption{
+					xoauth2.SetAuthURLParam("code_challenge", "challenge123"),
 				},
-				retrieveTokenOptions: []oauth2.AuthCodeOption{
-					oauth2.SetAuthURLParam("code_verifier", "challenge124"),
+				retrieveTokenOptions: []xoauth2.AuthCodeOption{
+					xoauth2.SetAuthURLParam("code_verifier", "challenge124"),
 				},
 				handleToken: basicIDTokenVerify,
 				tokenError: ErrorResponse{
-					Error:      errInvalidGrant,
+					Error:      oauth2.InvalidGrant,
 					StatusCode: http.StatusBadRequest,
 				},
 			},
 			{
 				// This test ensures that PKCE fail with wrong code_verifier in "S256" mode
 				name: "PKCE with S256 and wrong code_verifier",
-				authCodeOptions: []oauth2.AuthCodeOption{
-					oauth2.SetAuthURLParam("code_challenge", "lyyl-X4a69qrqgEfUL8wodWic3Be9ZZ5eovBgIKKi-w"),
-					oauth2.SetAuthURLParam("code_challenge_method", "S256"),
+				authCodeOptions: []xoauth2.AuthCodeOption{
+					xoauth2.SetAuthURLParam("code_challenge", "lyyl-X4a69qrqgEfUL8wodWic3Be9ZZ5eovBgIKKi-w"),
+					xoauth2.SetAuthURLParam("code_challenge_method", "S256"),
 				},
-				retrieveTokenOptions: []oauth2.AuthCodeOption{
-					oauth2.SetAuthURLParam("code_verifier", "challenge124"),
+				retrieveTokenOptions: []xoauth2.AuthCodeOption{
+					xoauth2.SetAuthURLParam("code_verifier", "challenge124"),
 				},
 				handleToken: basicIDTokenVerify,
 				tokenError: ErrorResponse{
-					Error:      errInvalidGrant,
+					Error:      oauth2.InvalidGrant,
 					StatusCode: http.StatusBadRequest,
 				},
 			},
@@ -642,16 +539,16 @@ func makeOAuth2Tests(clientID string, clientSecret string, now func() time.Time)
 				// Ensure that, when PKCE flow started on /auth
 				// we stay in PKCE flow on /token
 				name: "PKCE flow expected on /token",
-				authCodeOptions: []oauth2.AuthCodeOption{
-					oauth2.SetAuthURLParam("code_challenge", "lyyl-X4a69qrqgEfUL8wodWic3Be9ZZ5eovBgIKKi-w"),
-					oauth2.SetAuthURLParam("code_challenge_method", "S256"),
+				authCodeOptions: []xoauth2.AuthCodeOption{
+					xoauth2.SetAuthURLParam("code_challenge", "lyyl-X4a69qrqgEfUL8wodWic3Be9ZZ5eovBgIKKi-w"),
+					xoauth2.SetAuthURLParam("code_challenge_method", "S256"),
 				},
-				retrieveTokenOptions: []oauth2.AuthCodeOption{
+				retrieveTokenOptions: []xoauth2.AuthCodeOption{
 					// No PKCE call on /token
 				},
 				handleToken: basicIDTokenVerify,
 				tokenError: ErrorResponse{
-					Error:      errInvalidGrant,
+					Error:      oauth2.InvalidGrant,
 					StatusCode: http.StatusBadRequest,
 				},
 			},
@@ -659,45 +556,45 @@ func makeOAuth2Tests(clientID string, clientSecret string, now func() time.Time)
 				// Ensure that when no PKCE flow was started on /auth
 				// we cannot switch to PKCE on /token
 				name:            "No PKCE flow started on /auth",
-				authCodeOptions: []oauth2.AuthCodeOption{
+				authCodeOptions: []xoauth2.AuthCodeOption{
 					// No PKCE call on /auth
 				},
-				retrieveTokenOptions: []oauth2.AuthCodeOption{
-					oauth2.SetAuthURLParam("code_verifier", "challenge123"),
+				retrieveTokenOptions: []xoauth2.AuthCodeOption{
+					xoauth2.SetAuthURLParam("code_verifier", "challenge123"),
 				},
 				handleToken: basicIDTokenVerify,
 				tokenError: ErrorResponse{
-					Error:      errInvalidRequest,
+					Error:      oauth2.InvalidRequest,
 					StatusCode: http.StatusBadRequest,
 				},
 			},
 			{
 				// Make sure that, when we start with "S256" on /auth, we cannot downgrade to "plain" on /token
 				name: "PKCE with S256 and try to downgrade to plain",
-				authCodeOptions: []oauth2.AuthCodeOption{
-					oauth2.SetAuthURLParam("code_challenge", "lyyl-X4a69qrqgEfUL8wodWic3Be9ZZ5eovBgIKKi-w"),
-					oauth2.SetAuthURLParam("code_challenge_method", "S256"),
+				authCodeOptions: []xoauth2.AuthCodeOption{
+					xoauth2.SetAuthURLParam("code_challenge", "lyyl-X4a69qrqgEfUL8wodWic3Be9ZZ5eovBgIKKi-w"),
+					xoauth2.SetAuthURLParam("code_challenge_method", "S256"),
 				},
-				retrieveTokenOptions: []oauth2.AuthCodeOption{
-					oauth2.SetAuthURLParam("code_verifier", "lyyl-X4a69qrqgEfUL8wodWic3Be9ZZ5eovBgIKKi-w"),
-					oauth2.SetAuthURLParam("code_challenge_method", "plain"),
+				retrieveTokenOptions: []xoauth2.AuthCodeOption{
+					xoauth2.SetAuthURLParam("code_verifier", "lyyl-X4a69qrqgEfUL8wodWic3Be9ZZ5eovBgIKKi-w"),
+					xoauth2.SetAuthURLParam("code_challenge_method", "plain"),
 				},
 				handleToken: basicIDTokenVerify,
 				tokenError: ErrorResponse{
-					Error:      errInvalidGrant,
+					Error:      oauth2.InvalidGrant,
 					StatusCode: http.StatusBadRequest,
 				},
 			},
 			{
 				name: "Request parameter in authorization query",
-				authCodeOptions: []oauth2.AuthCodeOption{
-					oauth2.SetAuthURLParam("request", "anything"),
+				authCodeOptions: []xoauth2.AuthCodeOption{
+					xoauth2.SetAuthURLParam("request", "anything"),
 				},
 				authError: &OAuth2ErrorResponse{
-					Error:            errRequestNotSupported,
+					Error:            oauth2.RequestNotSupported,
 					ErrorDescription: "Server does not support request parameter.",
 				},
-				handleToken: func(ctx context.Context, p *oidc.Provider, config *oauth2.Config, token *oauth2.Token, conn *mock.Callback) error {
+				handleToken: func(ctx context.Context, p *oidc.Provider, config *xoauth2.Config, token *xoauth2.Token, conn *mock.Callback) error {
 					return nil
 				},
 			},
@@ -731,18 +628,17 @@ func TestOAuth2CodeFlow(t *testing.T) {
 	tests := makeOAuth2Tests(clientID, clientSecret, now)
 	for _, tc := range tests.tests {
 		t.Run(tc.name, func(t *testing.T) {
-			ctx, cancel := context.WithCancel(context.Background())
-			defer cancel()
+			ctx := t.Context()
 
 			// Setup a dex server.
-			httpServer, s := newTestServer(ctx, t, func(c *Config) {
+			httpServer, s := newTestServer(t, func(c *Config) {
 				c.Issuer += "/non-root-path"
 				c.Now = now
 				c.IDTokensValidFor = idTokensValidFor
 			})
 			defer httpServer.Close()
 
-			mockConn := s.connectors["mock"]
+			mockConn, _ := s.connectors.Cached("mock")
 			conn = mockConn.Connector.(*mock.Callback)
 
 			// Query server's provider metadata.
@@ -765,7 +661,7 @@ func TestOAuth2CodeFlow(t *testing.T) {
 			}()
 
 			// Setup OAuth2 client.
-			var oauth2Config *oauth2.Config
+			var oauth2Config *xoauth2.Config
 			oauth2Client := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 				if r.URL.Path != "/callback" {
 					// User is visiting app first time. Redirect to dex.
@@ -829,11 +725,11 @@ func TestOAuth2CodeFlow(t *testing.T) {
 				Secret:       clientSecret,
 				RedirectURIs: []string{redirectURL},
 			}
-			if err := s.storage.CreateClient(client); err != nil {
+			if err := s.storage.CreateClient(ctx, client); err != nil {
 				t.Fatalf("failed to create client: %v", err)
 			}
 
-			if err := s.storage.CreateRefresh(storage.RefreshToken{
+			if err := s.storage.CreateRefresh(ctx, storage.RefreshToken{
 				ID:       "existedrefrestoken",
 				ClientID: "unexcistedclientid",
 			}); err != nil {
@@ -841,7 +737,7 @@ func TestOAuth2CodeFlow(t *testing.T) {
 			}
 
 			// Create the OAuth2 config.
-			oauth2Config = &oauth2.Config{
+			oauth2Config = &xoauth2.Config{
 				ClientID:     client.ID,
 				ClientSecret: client.Secret,
 				Endpoint:     p.Endpoint(),
@@ -871,15 +767,25 @@ func TestOAuth2CodeFlow(t *testing.T) {
 			if respDump, err = httputil.DumpResponse(resp, true); err != nil {
 				t.Fatal(err)
 			}
+
+			tokens, err := s.storage.ListRefreshTokens(ctx)
+			if err != nil {
+				t.Fatalf("failed to get existed refresh token: %v", err)
+			}
+
+			for _, token := range tokens {
+				if /* token was updated */ token.ObsoleteToken != "" && token.ConnectorData != nil {
+					t.Fatalf("token connectorData with id %q field is not nil: %s", token.ID, token.ConnectorData)
+				}
+			}
 		})
 	}
 }
 
 func TestOAuth2ImplicitFlow(t *testing.T) {
-	ctx, cancel := context.WithCancel(context.Background())
-	defer cancel()
+	ctx := t.Context()
 
-	httpServer, s := newTestServer(ctx, t, func(c *Config) {
+	httpServer, s := newTestServer(t, func(c *Config) {
 		// Enable support for the implicit flow.
 		c.SupportedResponseTypes = []string{"code", "token", "id_token"}
 	})
@@ -902,7 +808,7 @@ func TestOAuth2ImplicitFlow(t *testing.T) {
 		}
 	}()
 
-	var oauth2Config *oauth2.Config
+	var oauth2Config *xoauth2.Config
 	oauth2Server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		if r.URL.Path == "/callback" {
 			q := r.URL.Query()
@@ -924,7 +830,7 @@ func TestOAuth2ImplicitFlow(t *testing.T) {
 			w.WriteHeader(http.StatusOK)
 			return
 		}
-		u := oauth2Config.AuthCodeURL(state, oauth2.SetAuthURLParam("response_type", "id_token token"), oidc.Nonce(nonce))
+		u := oauth2Config.AuthCodeURL(state, xoauth2.SetAuthURLParam("response_type", "id_token token"), oidc.Nonce(nonce))
 		http.Redirect(w, r, u, http.StatusSeeOther)
 	}))
 
@@ -936,7 +842,7 @@ func TestOAuth2ImplicitFlow(t *testing.T) {
 		Secret:       "testclientsecret",
 		RedirectURIs: []string{redirectURL},
 	}
-	if err := s.storage.CreateClient(client); err != nil {
+	if err := s.storage.CreateClient(ctx, client); err != nil {
 		t.Fatalf("failed to create client: %v", err)
 	}
 
@@ -944,7 +850,7 @@ func TestOAuth2ImplicitFlow(t *testing.T) {
 		ClientID: client.ID,
 	})
 
-	oauth2Config = &oauth2.Config{
+	oauth2Config = &xoauth2.Config{
 		ClientID:     client.ID,
 		ClientSecret: client.Secret,
 		Endpoint:     p.Endpoint(),
@@ -1012,10 +918,9 @@ func TestOAuth2ImplicitFlow(t *testing.T) {
 }
 
 func TestCrossClientScopes(t *testing.T) {
-	ctx, cancel := context.WithCancel(context.Background())
-	defer cancel()
+	ctx := t.Context()
 
-	httpServer, s := newTestServer(ctx, t, func(c *Config) {
+	httpServer, s := newTestServer(t, func(c *Config) {
 		c.Issuer += "/non-root-path"
 	})
 	defer httpServer.Close()
@@ -1039,7 +944,7 @@ func TestCrossClientScopes(t *testing.T) {
 	testClientID := "testclient"
 	peerID := "peer"
 
-	var oauth2Config *oauth2.Config
+	var oauth2Config *xoauth2.Config
 	oauth2Server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		if r.URL.Path == "/callback" {
 			q := r.URL.Query()
@@ -1094,7 +999,7 @@ func TestCrossClientScopes(t *testing.T) {
 		Secret:       "testclientsecret",
 		RedirectURIs: []string{redirectURL},
 	}
-	if err := s.storage.CreateClient(client); err != nil {
+	if err := s.storage.CreateClient(ctx, client); err != nil {
 		t.Fatalf("failed to create client: %v", err)
 	}
 
@@ -1104,11 +1009,11 @@ func TestCrossClientScopes(t *testing.T) {
 		TrustedPeers: []string{"testclient"},
 	}
 
-	if err := s.storage.CreateClient(peer); err != nil {
+	if err := s.storage.CreateClient(ctx, peer); err != nil {
 		t.Fatalf("failed to create client: %v", err)
 	}
 
-	oauth2Config = &oauth2.Config{
+	oauth2Config = &xoauth2.Config{
 		ClientID:     client.ID,
 		ClientSecret: client.Secret,
 		Endpoint:     p.Endpoint(),
@@ -1135,10 +1040,9 @@ func TestCrossClientScopes(t *testing.T) {
 }
 
 func TestCrossClientScopesWithAzpInAudienceByDefault(t *testing.T) {
-	ctx, cancel := context.WithCancel(context.Background())
-	defer cancel()
+	ctx := t.Context()
 
-	httpServer, s := newTestServer(ctx, t, func(c *Config) {
+	httpServer, s := newTestServer(t, func(c *Config) {
 		c.Issuer += "/non-root-path"
 	})
 	defer httpServer.Close()
@@ -1162,7 +1066,7 @@ func TestCrossClientScopesWithAzpInAudienceByDefault(t *testing.T) {
 	testClientID := "testclient"
 	peerID := "peer"
 
-	var oauth2Config *oauth2.Config
+	var oauth2Config *xoauth2.Config
 	oauth2Server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		if r.URL.Path == "/callback" {
 			q := r.URL.Query()
@@ -1217,7 +1121,7 @@ func TestCrossClientScopesWithAzpInAudienceByDefault(t *testing.T) {
 		Secret:       "testclientsecret",
 		RedirectURIs: []string{redirectURL},
 	}
-	if err := s.storage.CreateClient(client); err != nil {
+	if err := s.storage.CreateClient(ctx, client); err != nil {
 		t.Fatalf("failed to create client: %v", err)
 	}
 
@@ -1227,11 +1131,11 @@ func TestCrossClientScopesWithAzpInAudienceByDefault(t *testing.T) {
 		TrustedPeers: []string{"testclient"},
 	}
 
-	if err := s.storage.CreateClient(peer); err != nil {
+	if err := s.storage.CreateClient(ctx, peer); err != nil {
 		t.Fatalf("failed to create client: %v", err)
 	}
 
-	oauth2Config = &oauth2.Config{
+	oauth2Config = &xoauth2.Config{
 		ClientID:     client.ID,
 		ClientSecret: client.Secret,
 		Endpoint:     p.Endpoint(),
@@ -1257,8 +1161,11 @@ func TestCrossClientScopesWithAzpInAudienceByDefault(t *testing.T) {
 }
 
 func TestPasswordDB(t *testing.T) {
+	ctx := t.Context()
+
+	logger := newLogger(t)
 	s := memory.New(logger)
-	conn := newPasswordDB(s)
+	conn := connectors.NewPasswordDB(s)
 
 	pw := "hi"
 
@@ -1267,11 +1174,15 @@ func TestPasswordDB(t *testing.T) {
 		t.Fatal(err)
 	}
 
-	s.CreatePassword(storage.Password{
-		Email:    "jane@example.com",
-		Username: "jane",
-		UserID:   "foobar",
-		Hash:     h,
+	s.CreatePassword(ctx, storage.Password{
+		Email:             "jane@example.com",
+		Username:          "jane",
+		Name:              "Jane Doe",
+		PreferredUsername: "jane-public",
+		EmailVerified:     boolPtr(false),
+		UserID:            "foobar",
+		Groups:            []string{"team-a", "team-a/admins"},
+		Hash:              h,
 	})
 
 	tests := []struct {
@@ -1287,10 +1198,12 @@ func TestPasswordDB(t *testing.T) {
 			username: "jane@example.com",
 			password: pw,
 			wantIdentity: connector.Identity{
-				Email:         "jane@example.com",
-				Username:      "jane",
-				UserID:        "foobar",
-				EmailVerified: true,
+				Email:             "jane@example.com",
+				Username:          "Jane Doe",
+				PreferredUsername: "jane-public",
+				UserID:            "foobar",
+				EmailVerified:     false,
+				Groups:            []string{"team-a", "team-a/admins"},
 			},
 		},
 		{
@@ -1308,7 +1221,7 @@ func TestPasswordDB(t *testing.T) {
 	}
 
 	for _, tc := range tests {
-		ident, valid, err := conn.Login(context.Background(), connector.Scopes{}, tc.username, tc.password)
+		ident, valid, err := conn.Login(t.Context(), connector.Scopes{}, tc.username, tc.password)
 		if err != nil {
 			if !tc.wantErr {
 				t.Errorf("%s: %v", tc.name, err)
@@ -1340,8 +1253,9 @@ func TestPasswordDB(t *testing.T) {
 }
 
 func TestPasswordDBUsernamePrompt(t *testing.T) {
+	logger := newLogger(t)
 	s := memory.New(logger)
-	conn := newPasswordDB(s)
+	conn := connectors.NewPasswordDB(s)
 
 	expected := "Email Address"
 	if actual := conn.Prompt(); actual != expected {
@@ -1354,15 +1268,16 @@ type storageWithKeysTrigger struct {
 	f func()
 }
 
-func (s storageWithKeysTrigger) GetKeys() (storage.Keys, error) {
+func (s storageWithKeysTrigger) GetKeys(ctx context.Context) (storage.Keys, error) {
 	s.f()
-	return s.Storage.GetKeys()
+	return s.Storage.GetKeys(ctx)
 }
 
 func TestKeyCacher(t *testing.T) {
 	tNow := time.Now()
 	now := func() time.Time { return tNow }
-
+	ctx := t.Context()
+	logger := newLogger(t)
 	s := memory.New(logger)
 
 	tests := []struct {
@@ -1375,7 +1290,7 @@ func TestKeyCacher(t *testing.T) {
 		},
 		{
 			before: func() {
-				s.UpdateKeys(func(old storage.Keys) (storage.Keys, error) {
+				s.UpdateKeys(ctx, func(old storage.Keys) (storage.Keys, error) {
 					old.NextRotation = tNow.Add(time.Minute)
 					return old, nil
 				})
@@ -1395,7 +1310,7 @@ func TestKeyCacher(t *testing.T) {
 		{
 			before: func() {
 				tNow = tNow.Add(time.Hour)
-				s.UpdateKeys(func(old storage.Keys) (storage.Keys, error) {
+				s.UpdateKeys(ctx, func(old storage.Keys) (storage.Keys, error) {
 					old.NextRotation = tNow.Add(time.Minute)
 					return old, nil
 				})
@@ -1413,7 +1328,7 @@ func TestKeyCacher(t *testing.T) {
 	for i, tc := range tests {
 		gotCall = false
 		tc.before()
-		s.GetKeys()
+		s.GetKeys(t.Context())
 		if gotCall != tc.wantCallToStorage {
 			t.Errorf("case %d: expected call to storage=%t got call to storage=%t", i, tc.wantCallToStorage, gotCall)
 		}
@@ -1425,7 +1340,7 @@ func checkErrorResponse(err error, t *testing.T, tc test) {
 		t.Errorf("%s: DANGEROUS! got a token when we should not get one!", tc.name)
 		return
 	}
-	if rErr, ok := err.(*oauth2.RetrieveError); ok {
+	if rErr, ok := err.(*xoauth2.RetrieveError); ok {
 		if rErr.Response.StatusCode != tc.tokenError.StatusCode {
 			t.Errorf("%s: got wrong StatusCode from server %d. expected %d",
 				tc.name, rErr.Response.StatusCode, tc.tokenError.StatusCode)
@@ -1440,25 +1355,25 @@ func checkErrorResponse(err error, t *testing.T, tc test) {
 				tc.name, details.Error, details.ErrorDescription, tc.tokenError.Error)
 		}
 	} else {
-		t.Errorf("%s: unexpected error type: %s. expected *oauth2.RetrieveError", tc.name, reflect.TypeOf(err))
+		t.Errorf("%s: unexpected error type: %s. expected *xoauth2.RetrieveError", tc.name, reflect.TypeOf(err))
 	}
 }
 
 type oauth2Client struct {
-	config *oauth2.Config
-	token  *oauth2.Token
+	config *xoauth2.Config
+	token  *xoauth2.Token
 	server *httptest.Server
 }
 
-// TestRefreshTokenFlow tests the refresh token code flow for oauth2. The test verifies
+// TestRefreshTokenFlow tests the refresh token code flow for xoauth2. The test verifies
 // that only valid refresh tokens can be used to refresh an expired token.
 func TestRefreshTokenFlow(t *testing.T) {
 	state := "state"
 	now := time.Now
-	ctx, cancel := context.WithCancel(context.Background())
-	defer cancel()
 
-	httpServer, s := newTestServer(ctx, t, func(c *Config) {
+	ctx := t.Context()
+
+	httpServer, s := newTestServer(t, func(c *Config) {
 		c.Now = now
 	})
 	defer httpServer.Close()
@@ -1515,11 +1430,11 @@ func TestRefreshTokenFlow(t *testing.T) {
 		Secret:       "testclientsecret",
 		RedirectURIs: []string{redirectURL},
 	}
-	if err := s.storage.CreateClient(client); err != nil {
+	if err := s.storage.CreateClient(ctx, client); err != nil {
 		t.Fatalf("failed to create client: %v", err)
 	}
 
-	oauth2Client.config = &oauth2.Config{
+	oauth2Client.config = &xoauth2.Config{
 		ClientID:     client.ID,
 		ClientSecret: client.Secret,
 		Endpoint:     p.Endpoint(),
@@ -1533,7 +1448,7 @@ func TestRefreshTokenFlow(t *testing.T) {
 	}
 	defer resp.Body.Close()
 
-	tok := &oauth2.Token{
+	tok := &xoauth2.Token{
 		RefreshToken: oauth2Client.token.RefreshToken,
 		Expiry:       time.Now().Add(-time.Hour),
 	}
@@ -1578,29 +1493,22 @@ func TestOAuth2DeviceFlow(t *testing.T) {
 			tokenEndpoint: "/token",
 			oauth2Tests:   tests,
 		},
-		// TODO(nabokihms): delete temporary tests after removing the deprecated token endpoint support
-		{
-			name:          "Deprecated token endpoint for devices",
-			tokenEndpoint: "/device/token",
-			oauth2Tests:   tests,
-		},
 	}
 
 	for _, testCase := range testCases {
 		for _, tc := range testCase.oauth2Tests.tests {
 			t.Run(tc.name, func(t *testing.T) {
-				ctx, cancel := context.WithCancel(context.Background())
-				defer cancel()
+				ctx := t.Context()
 
 				// Setup a dex server.
-				httpServer, s := newTestServer(ctx, t, func(c *Config) {
+				httpServer, s := newTestServer(t, func(c *Config) {
 					c.Issuer += "/non-root-path"
 					c.Now = now
 					c.IDTokensValidFor = idTokensValidFor
 				})
 				defer httpServer.Close()
 
-				mockConn := s.connectors["mock"]
+				mockConn, _ := s.connectors.Cached("mock")
 				conn = mockConn.Connector.(*mock.Callback)
 
 				p, err := oidc.NewProvider(ctx, httpServer.URL)
@@ -1611,14 +1519,14 @@ func TestOAuth2DeviceFlow(t *testing.T) {
 				// Add the Clients to the test server
 				client := storage.Client{
 					ID:           clientID,
-					RedirectURIs: []string{deviceCallbackURI},
+					RedirectURIs: []string{s.issuerURL.AbsPath(oauth2.DeviceCallbackURI)},
 					Public:       true,
 				}
-				if err := s.storage.CreateClient(client); err != nil {
+				if err := s.storage.CreateClient(ctx, client); err != nil {
 					t.Fatalf("failed to create client: %v", err)
 				}
 
-				if err := s.storage.CreateRefresh(storage.RefreshToken{
+				if err := s.storage.CreateRefresh(ctx, storage.RefreshToken{
 					ID:       "existedrefrestoken",
 					ClientID: "unexcistedclientid",
 				}); err != nil {
@@ -1655,7 +1563,7 @@ func TestOAuth2DeviceFlow(t *testing.T) {
 				}
 
 				// Parse the code response
-				var deviceCode deviceCodeResponse
+				var deviceCode device.DeviceCodeResponse
 				if err := json.Unmarshal(responseBody, &deviceCode); err != nil {
 					t.Errorf("Unexpected Device Code Response Format %v", string(responseBody))
 				}
@@ -1682,7 +1590,7 @@ func TestOAuth2DeviceFlow(t *testing.T) {
 				tokenURL, _ := url.Parse(issuer.String())
 				tokenURL.Path = path.Join(tokenURL.Path, testCase.tokenEndpoint)
 				v := url.Values{}
-				v.Add("grant_type", grantTypeDeviceCode)
+				v.Add("grant_type", oauth2.GrantTypeDeviceCode)
 				v.Add("device_code", deviceCode.DeviceCode)
 				resp, err = http.PostForm(tokenURL.String(), v)
 				if err != nil {
@@ -1698,12 +1606,12 @@ func TestOAuth2DeviceFlow(t *testing.T) {
 				}
 
 				// Parse the response
-				var tokenRes accessTokenResponse
+				var tokenRes tokens.Response
 				if err := json.Unmarshal(responseBody, &tokenRes); err != nil {
 					t.Errorf("Unexpected Device Access Token Response Format %v", string(responseBody))
 				}
 
-				token := &oauth2.Token{
+				token := &xoauth2.Token{
 					AccessToken:  tokenRes.AccessToken,
 					TokenType:    tokenRes.TokenType,
 					RefreshToken: tokenRes.RefreshToken,
@@ -1717,12 +1625,12 @@ func TestOAuth2DeviceFlow(t *testing.T) {
 
 				// Run token tests to validate info is correct
 				// Create the OAuth2 config.
-				oauth2Config := &oauth2.Config{
+				oauth2Config := &xoauth2.Config{
 					ClientID:     client.ID,
 					ClientSecret: client.Secret,
 					Endpoint:     p.Endpoint(),
 					Scopes:       requestedScopes,
-					RedirectURL:  deviceCallbackURI,
+					RedirectURL:  s.issuerURL.AbsURL(oauth2.DeviceCallbackURI),
 				}
 				if len(tc.scopes) != 0 {
 					oauth2Config.Scopes = tc.scopes
@@ -1745,32 +1653,318 @@ func TestServerSupportedGrants(t *testing.T) {
 		{
 			name:      "Simple",
 			config:    func(c *Config) {},
-			resGrants: []string{grantTypeAuthorizationCode, grantTypeRefreshToken, grantTypeDeviceCode},
+			resGrants: []string{oauth2.GrantTypeAuthorizationCode, oauth2.GrantTypeClientCredentials, oauth2.GrantTypeRefreshToken, oauth2.GrantTypeDeviceCode, oauth2.GrantTypeTokenExchange},
 		},
 		{
-			name:      "With password connector",
-			config:    func(c *Config) { c.PasswordConnector = "local" },
-			resGrants: []string{grantTypeAuthorizationCode, grantTypePassword, grantTypeRefreshToken, grantTypeDeviceCode},
+			name:      "Minimal",
+			config:    func(c *Config) { c.AllowedGrantTypes = []string{oauth2.GrantTypeTokenExchange} },
+			resGrants: []string{oauth2.GrantTypeTokenExchange},
 		},
 		{
-			name:      "With token response",
-			config:    func(c *Config) { c.SupportedResponseTypes = append(c.SupportedResponseTypes, responseTypeToken) },
-			resGrants: []string{grantTypeAuthorizationCode, grantTypeImplicit, grantTypeRefreshToken, grantTypeDeviceCode},
+			name: "With password connector",
+			config: func(c *Config) {
+				c.PasswordConnector = "local"
+			},
+			resGrants: []string{oauth2.GrantTypeAuthorizationCode, oauth2.GrantTypeClientCredentials, oauth2.GrantTypePassword, oauth2.GrantTypeRefreshToken, oauth2.GrantTypeDeviceCode, oauth2.GrantTypeTokenExchange},
+		},
+		{
+			name: "Without client credentials",
+			config: func(c *Config) {
+				c.AllowedGrantTypes = []string{
+					oauth2.GrantTypeAuthorizationCode,
+					oauth2.GrantTypeRefreshToken,
+					oauth2.GrantTypeDeviceCode,
+					oauth2.GrantTypeTokenExchange,
+				}
+			},
+			resGrants: []string{oauth2.GrantTypeAuthorizationCode, oauth2.GrantTypeRefreshToken, oauth2.GrantTypeDeviceCode, oauth2.GrantTypeTokenExchange},
+		},
+		{
+			name: "With token response",
+			config: func(c *Config) {
+				c.SupportedResponseTypes = append(c.SupportedResponseTypes, oauth2.ResponseTypeToken)
+			},
+			resGrants: []string{oauth2.GrantTypeAuthorizationCode, oauth2.GrantTypeClientCredentials, oauth2.GrantTypeImplicit, oauth2.GrantTypeRefreshToken, oauth2.GrantTypeDeviceCode, oauth2.GrantTypeTokenExchange},
 		},
 		{
 			name: "All",
 			config: func(c *Config) {
 				c.PasswordConnector = "local"
-				c.SupportedResponseTypes = append(c.SupportedResponseTypes, responseTypeToken)
+				c.SupportedResponseTypes = append(c.SupportedResponseTypes, oauth2.ResponseTypeToken)
+			},
+			resGrants: []string{oauth2.GrantTypeAuthorizationCode, oauth2.GrantTypeClientCredentials, oauth2.GrantTypeImplicit, oauth2.GrantTypePassword, oauth2.GrantTypeRefreshToken, oauth2.GrantTypeDeviceCode, oauth2.GrantTypeTokenExchange},
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			_, srv := newTestServer(t, tc.config)
+			require.Equal(t, tc.resGrants, srv.discovery.GrantTypes)
+		})
+	}
+}
+
+func TestHeaders(t *testing.T) {
+	ctx := t.Context()
+
+	httpServer, _ := newTestServer(t, func(c *Config) {
+		c.Headers = map[string][]string{
+			"Strict-Transport-Security": {"max-age=31536000; includeSubDomains"},
+		}
+	})
+	defer httpServer.Close()
+
+	p, err := oidc.NewProvider(ctx, httpServer.URL)
+	if err != nil {
+		t.Fatalf("failed to get provider: %v", err)
+	}
+
+	resp, err := http.Get(p.Endpoint().TokenURL)
+	require.NoError(t, err)
+
+	require.Equal(t, "max-age=31536000; includeSubDomains", resp.Header.Get("Strict-Transport-Security"))
+}
+
+func TestConnectorFailureHandling(t *testing.T) {
+	ctx := t.Context()
+
+	tests := []struct {
+		name                       string
+		connectors                 []storage.Connector
+		continueOnConnectorFailure bool
+		wantErr                    bool
+		wantErrContains            string
+		expectConnectors           []string // IDs of connectors that should be loaded successfully
+	}{
+		{
+			name: "all connectors succeed with flag enabled",
+			connectors: []storage.Connector{
+				{
+					ID:   "mock1",
+					Type: "mockCallback",
+					Name: "Mock1",
+				},
+				{
+					ID:   "mock2",
+					Type: "mockCallback",
+					Name: "Mock2",
+				},
+			},
+			continueOnConnectorFailure: true,
+			wantErr:                    false,
+			expectConnectors:           []string{"mock1", "mock2"},
+		},
+		{
+			name: "all connectors succeed with flag disabled",
+			connectors: []storage.Connector{
+				{
+					ID:   "mock1",
+					Type: "mockCallback",
+					Name: "Mock1",
+				},
+				{
+					ID:   "mock2",
+					Type: "mockCallback",
+					Name: "Mock2",
+				},
+			},
+			continueOnConnectorFailure: false,
+			wantErr:                    false,
+			expectConnectors:           []string{"mock1", "mock2"},
+		},
+		{
+			name: "partial connector failure with flag enabled",
+			connectors: []storage.Connector{
+				{
+					ID:   "mock-good",
+					Type: "mockCallback",
+					Name: "Good Mock",
+				},
+				{
+					ID:   "bad-connector",
+					Type: "nonexistent",
+					Name: "Bad Connector",
+				},
+				{
+					ID:   "mock-good2",
+					Type: "mockCallback",
+					Name: "Good Mock 2",
+				},
+			},
+			continueOnConnectorFailure: true,
+			wantErr:                    false,
+			expectConnectors:           []string{"mock-good", "mock-good2"},
+		},
+		{
+			name: "partial connector failure with flag disabled",
+			connectors: []storage.Connector{
+				{
+					ID:   "mock-good",
+					Type: "mockCallback",
+					Name: "Good Mock",
+				},
+				{
+					ID:   "bad-connector",
+					Type: "nonexistent",
+					Name: "Bad Connector",
+				},
+				{
+					ID:   "mock-good2",
+					Type: "mockCallback",
+					Name: "Good Mock 2",
+				},
+			},
+			continueOnConnectorFailure: false,
+			wantErr:                    true,
+			wantErrContains:            "Failed to open connector bad-connector",
+			expectConnectors:           []string{}, // Server creation should fail
+		},
+		{
+			name: "all connectors fail with flag enabled",
+			connectors: []storage.Connector{
+				{
+					ID:   "bad1",
+					Type: "nonexistent1",
+					Name: "Bad 1",
+				},
+				{
+					ID:   "bad2",
+					Type: "nonexistent2",
+					Name: "Bad 2",
+				},
+			},
+			continueOnConnectorFailure: true,
+			wantErr:                    true,
+			wantErrContains:            "failed to open all connectors (2/2)",
+		},
+		{
+			name: "all connectors fail with flag disabled",
+			connectors: []storage.Connector{
+				{
+					ID:   "bad1",
+					Type: "nonexistent1",
+					Name: "Bad 1",
+				},
+				{
+					ID:   "bad2",
+					Type: "nonexistent2",
+					Name: "Bad 2",
+				},
 			},
-			resGrants: []string{grantTypeAuthorizationCode, grantTypeImplicit, grantTypePassword, grantTypeRefreshToken, grantTypeDeviceCode},
+			continueOnConnectorFailure: false,
+			wantErr:                    true,
+			wantErrContains:            "Failed to open connector",
+		},
+		{
+			name:                       "no connectors",
+			connectors:                 []storage.Connector{},
+			continueOnConnectorFailure: true,
+			wantErr:                    true,
+			wantErrContains:            "no connectors specified",
 		},
 	}
 
 	for _, tc := range tests {
 		t.Run(tc.name, func(t *testing.T) {
-			_, srv := newTestServer(context.TODO(), t, tc.config)
-			require.Equal(t, srv.supportedGrantTypes, tc.resGrants)
+			logger := newLogger(t)
+
+			sig, err := signer.NewMockSigner(testKey)
+			if err != nil {
+				t.Fatalf("failed to create mock signer: %v", err)
+			}
+
+			config := Config{
+				Issuer:  "http://localhost",
+				Storage: memory.New(logger),
+				Web: WebConfig{
+					Dir: "../web",
+				},
+				Logger:                     logger,
+				PrometheusRegistry:         prometheus.NewRegistry(),
+				HealthChecker:              gosundheit.New(),
+				ContinueOnConnectorFailure: tc.continueOnConnectorFailure,
+				Signer:                     sig,
+			}
+
+			// Create connectors in storage
+			for _, conn := range tc.connectors {
+				if err := config.Storage.CreateConnector(ctx, conn); err != nil {
+					t.Fatalf("failed to create connector: %v", err)
+				}
+			}
+
+			server, err := newServer(ctx, config)
+
+			if tc.wantErr {
+				if err == nil {
+					t.Errorf("expected error but got none")
+				} else if tc.wantErrContains != "" && !strings.Contains(err.Error(), tc.wantErrContains) {
+					t.Errorf("expected error containing %q, got %q", tc.wantErrContains, err.Error())
+				}
+			} else {
+				if err != nil {
+					t.Errorf("unexpected error: %v", err)
+				} else {
+					// Verify expected connectors are loaded
+					for _, id := range tc.expectConnectors {
+						if _, exists := server.connectors.Cached(id); !exists {
+							t.Errorf("expected connector %q to be loaded", id)
+						}
+					}
+
+					// Verify failed connectors are not loaded
+					for _, conn := range tc.connectors {
+						_, shouldExist := false, false
+						for _, expectedID := range tc.expectConnectors {
+							if conn.ID == expectedID {
+								shouldExist = true
+								break
+							}
+						}
+						_, exists := server.connectors.Cached(conn.ID)
+						if shouldExist && !exists {
+							t.Errorf("connector %q should have been loaded but wasn't", conn.ID)
+						} else if !shouldExist && exists {
+							t.Errorf("connector %q should not have been loaded but was", conn.ID)
+						}
+					}
+				}
+			}
 		})
 	}
 }
+
+func TestHandleHealth(t *testing.T) {
+	httpServer, server := newTestServer(t, nil)
+	defer httpServer.Close()
+
+	rr := httptest.NewRecorder()
+	server.ServeHTTP(rr, httptest.NewRequest("GET", "/healthz", nil))
+	if rr.Code != http.StatusOK {
+		t.Errorf("expected 200 got %d", rr.Code)
+	}
+}
+
+func TestHandleHealthFailure(t *testing.T) {
+	httpServer, server := newTestServer(t, func(c *Config) {
+		c.HealthChecker = gosundheit.New()
+
+		c.HealthChecker.RegisterCheck(
+			&checks.CustomCheck{
+				CheckName: "fail",
+				CheckFunc: func(_ context.Context) (details interface{}, err error) {
+					return nil, errors.New("error")
+				},
+			},
+			gosundheit.InitiallyPassing(false),
+			gosundheit.ExecutionPeriod(1*time.Second),
+		)
+	})
+	defer httpServer.Close()
+
+	rr := httptest.NewRecorder()
+	server.ServeHTTP(rr, httptest.NewRequest("GET", "/healthz", nil))
+	if rr.Code != http.StatusInternalServerError {
+		t.Errorf("expected 500 got %d", rr.Code)
+	}
+}
diff --git a/server/session/doc.go b/server/session/doc.go
new file mode 100644
index 0000000000..269b6e452f
--- /dev/null
+++ b/server/session/doc.go
@@ -0,0 +1,4 @@
+// Package session owns dex's browser session: the session cookie, SSO session
+// lookup, and auth-session CRUD. The interactive auth flow delegates to a
+// Manager; it never touches these internals directly.
+package session
diff --git a/server/session/session.go b/server/session/session.go
new file mode 100644
index 0000000000..cf45703ae4
--- /dev/null
+++ b/server/session/session.go
@@ -0,0 +1,401 @@
+package session
+
+import (
+	"context"
+	"crypto/subtle"
+	"errors"
+	"fmt"
+	"log/slog"
+	"net"
+	"net/http"
+	"time"
+
+	"github.com/dexidp/dex/server/internal"
+	"github.com/dexidp/dex/server/oauth2"
+	"github.com/dexidp/dex/server/reqctx"
+	"github.com/dexidp/dex/storage"
+)
+
+// Config holds resolved session configuration.
+type Config struct {
+	CookieName                 string
+	CookieEncryptionKey        []byte
+	AbsoluteLifetime           time.Duration
+	ValidIfNotUsedFor          time.Duration
+	RememberMeCheckedByDefault bool
+	// SSOSharedWithDefault is the default SSO sharing policy for clients without explicit SSOSharedWith.
+	// "all" = share with all clients, "none" or "" = share with no one (default).
+	SSOSharedWithDefault string
+}
+
+// Manager owns the session lifecycle. Construct it with New.
+type Manager struct {
+	Storage   storage.Storage
+	Config    *Config
+	Now       func() time.Time
+	Logger    *slog.Logger
+	IssuerURL oauth2.IssuerURL
+}
+
+// Enabled reports whether sessions are configured.
+func (m *Manager) Enabled() bool { return m.Config != nil }
+
+// RememberMeDefault reports the configured default for the remember-me choice,
+// or nil when sessions are disabled. The password form renders it as the
+// checkbox's initial state; callers that need a plain bool (connector callbacks,
+// which render no checkbox) treat nil as false.
+func (m *Manager) RememberMeDefault() *bool {
+	if m.Config == nil {
+		return nil
+	}
+	v := m.Config.RememberMeCheckedByDefault
+	return &v
+}
+
+// remoteIP returns the real IP from context (set by the real-IP resolver) or,
+// failing that, the host part of r.RemoteAddr. Either way the result carries no
+// port; only an address that parses as neither is returned verbatim.
+func remoteIP(r *http.Request) string {
+	if ip, ok := r.Context().Value(reqctx.RequestKeyRemoteIP).(string); ok && ip != "" {
+		return ip
+	}
+	// RemoteAddr carries the ephemeral source port, which is noise in an audit
+	// record: it identifies the connection, not the client. The resolver behind
+	// the context value already strips it, so strip it here too.
+	if host, _, err := net.SplitHostPort(r.RemoteAddr); err == nil {
+		return host
+	}
+	return r.RemoteAddr
+}
+
+func (m *Manager) cookiePath() string {
+	if m.IssuerURL.Path == "" {
+		return "/"
+	}
+	return m.IssuerURL.Path
+}
+
+func (m *Manager) SetCookie(w http.ResponseWriter, sessionID, secret string, rememberMe bool) {
+	cookie := &http.Cookie{
+		Name:     m.Config.CookieName,
+		Value:    internal.SessionCookieValue(sessionID, secret, m.Config.CookieEncryptionKey),
+		Path:     m.cookiePath(),
+		HttpOnly: true,
+		Secure:   m.IssuerURL.Scheme == "https",
+		SameSite: http.SameSiteLaxMode,
+	}
+	if rememberMe {
+		cookie.MaxAge = int(m.Config.AbsoluteLifetime.Seconds())
+	}
+	http.SetCookie(w, cookie)
+}
+
+func (m *Manager) ClearCookie(w http.ResponseWriter) {
+	http.SetCookie(w, &http.Cookie{
+		Name:     m.Config.CookieName,
+		Value:    "",
+		Path:     m.cookiePath(),
+		HttpOnly: true,
+		Secure:   m.IssuerURL.Scheme == "https",
+		SameSite: http.SameSiteLaxMode,
+		MaxAge:   -1,
+	})
+}
+
+// expiryReason names why a session is over, or "" while it is still live.
+func expiryReason(session storage.AuthSession, now time.Time) string {
+	if !session.AbsoluteExpiry.IsZero() && now.After(session.AbsoluteExpiry) {
+		return "absolute lifetime"
+	}
+	if !session.IdleExpiry.IsZero() && now.After(session.IdleExpiry) {
+		return "idle timeout"
+	}
+	return ""
+}
+
+// Alive reports whether the session a token names is still there. Tokens carry the
+// session's ID as their "sid" claim, so this is a direct read — nothing has to be
+// resolved from the user's identity and compared.
+//
+// Expiry counts as gone. Garbage collection runs on its own schedule, so between a
+// session ending and its row disappearing there is a window in which reporting it
+// alive would keep the tokens of an ended session working.
+func (m *Manager) Alive(ctx context.Context, sessionID string) bool {
+	if m == nil || m.Config == nil || sessionID == "" {
+		return false
+	}
+
+	session, err := m.Storage.GetAuthSession(ctx, sessionID)
+	if err != nil {
+		if !errors.Is(err, storage.ErrNotFound) {
+			m.Logger.ErrorContext(ctx, "failed to get auth session", "err", err)
+		}
+		return false
+	}
+
+	return expiryReason(session, m.Now()) == ""
+}
+
+// ValidSession returns the live session the request's cookie names, or nil. The
+// cookie is cleared when it names nothing, names something expired, or fails to
+// prove itself.
+func (m *Manager) ValidSession(ctx context.Context, w http.ResponseWriter, r *http.Request) *storage.AuthSession {
+	if m.Config == nil {
+		return nil
+	}
+
+	sessionID, secret, ok := m.ParseCookie(r)
+	if !ok {
+		// A cookie that cannot be decoded is still a cookie the browser will keep
+		// sending, so drop it. Nothing to drop when there was none.
+		if c, err := r.Cookie(m.Config.CookieName); err == nil && c.Value != "" {
+			m.ClearCookie(w)
+		}
+		return nil
+	}
+
+	session, err := m.Storage.GetAuthSession(ctx, sessionID)
+	if err != nil {
+		if !errors.Is(err, storage.ErrNotFound) {
+			m.Logger.ErrorContext(ctx, "failed to get auth session", "err", err)
+		}
+		m.ClearCookie(w)
+		return nil
+	}
+
+	// The ID is published in every token as "sid", so it proves nothing on its own.
+	// Constant-time, as a byte-by-byte comparison would leak the secret by timing.
+	if subtle.ConstantTimeCompare([]byte(session.Secret), []byte(secret)) != 1 {
+		m.Logger.DebugContext(ctx, "auth session secret mismatch", "session_id", sessionID)
+		m.ClearCookie(w)
+		return nil
+	}
+
+	// A browser presenting an expired session is the one place worth spending a
+	// write on: the cookie is in hand, so the row can go now rather than waiting
+	// for the collector.
+	if reason := expiryReason(session, m.Now()); reason != "" {
+		m.Logger.InfoContext(ctx, "auth session expired",
+			"session_id", session.ID, "user_id", session.UserID, "reason", reason)
+		if err := m.Storage.DeleteAuthSession(ctx, session.ID); err != nil {
+			m.Logger.DebugContext(ctx, "failed to delete expired auth session", "err", err)
+		}
+		m.ClearCookie(w)
+		return nil
+	}
+
+	return &session
+}
+
+// ValidAuthSession returns a valid session matching the auth request's connector, or nil.
+func (m *Manager) ValidAuthSession(ctx context.Context, w http.ResponseWriter, r *http.Request, authReq *storage.AuthRequest) *storage.AuthSession {
+	session := m.ValidSession(ctx, w, r)
+	if session == nil {
+		return nil
+	}
+
+	// Only reuse sessions from the same connector.
+	if session.ConnectorID != authReq.ConnectorID {
+		return nil
+	}
+
+	return session
+}
+
+// CreateOrUpdateAuthSession records a successful login on this browser's session
+// and sets the cookie. rememberMe makes that cookie persistent.
+//
+// The browser's own cookie decides whether there is a session to continue: a login
+// from a second device joins nothing, it starts its own session, which is what makes
+// signing out on one device leave the other alone. A cookie naming someone else's
+// session — another user, or another connector — is about to be overwritten, so the
+// session it named is deleted rather than left unreachable until it times out.
+func (m *Manager) CreateOrUpdateAuthSession(ctx context.Context, r *http.Request, w http.ResponseWriter, authReq storage.AuthRequest, rememberMe bool) error {
+	if m.Config == nil {
+		return nil
+	}
+
+	now := m.Now()
+	userID := authReq.Claims.UserID
+	connectorID := authReq.ConnectorID
+
+	clientState := &storage.ClientAuthState{
+		AuthenticatedAt: now,
+		LastActivity:    now,
+	}
+
+	if current := m.ValidSession(ctx, w, r); current != nil {
+		if current.UserID == userID && current.ConnectorID == connectorID {
+			m.Logger.DebugContext(ctx, "updating existing auth session",
+				"session_id", current.ID, "user_id", userID, "client_id", authReq.ClientID)
+
+			if err := m.Storage.UpdateAuthSession(ctx, current.ID, func(old storage.AuthSession) (storage.AuthSession, error) {
+				old.LastActivity = now
+				old.IdleExpiry = now.Add(m.Config.ValidIfNotUsedFor)
+				old.IPAddress = remoteIP(r)
+				old.UserAgent = r.UserAgent()
+				if old.ClientStates == nil {
+					old.ClientStates = make(map[string]*storage.ClientAuthState)
+				}
+				old.ClientStates[authReq.ClientID] = clientState
+				return old, nil
+			}); err != nil {
+				return fmt.Errorf("update auth session: %w", err)
+			}
+
+			m.SetCookie(w, current.ID, current.Secret, rememberMe)
+			return nil
+		}
+
+		if err := m.Storage.DeleteAuthSession(ctx, current.ID); err != nil && !errors.Is(err, storage.ErrNotFound) {
+			m.Logger.ErrorContext(ctx, "failed to delete superseded auth session", "err", err)
+		}
+	}
+
+	newSession := storage.AuthSession{
+		ID:          storage.NewID(),
+		Secret:      storage.NewID(),
+		UserID:      userID,
+		ConnectorID: connectorID,
+		ClientStates: map[string]*storage.ClientAuthState{
+			authReq.ClientID: clientState,
+		},
+		CreatedAt:      now,
+		LastActivity:   now,
+		IPAddress:      remoteIP(r),
+		UserAgent:      r.UserAgent(),
+		AbsoluteExpiry: now.Add(m.Config.AbsoluteLifetime),
+		IdleExpiry:     now.Add(m.Config.ValidIfNotUsedFor),
+	}
+
+	if err := m.Storage.CreateAuthSession(ctx, newSession); err != nil {
+		return fmt.Errorf("create auth session: %w", err)
+	}
+
+	m.Logger.DebugContext(ctx, "created new auth session",
+		"session_id", newSession.ID, "user_id", userID, "client_id", authReq.ClientID)
+	m.SetCookie(w, newSession.ID, newSession.Secret, rememberMe)
+	return nil
+}
+
+// ClientSharesWith reports whether sourceClient's ssoSharedWith policy lets its
+// authenticated state be reused for targetClientID. A nil policy falls back to
+// the server-wide SSOSharedWithDefault; an explicit empty slice shares with no one.
+func (m *Manager) ClientSharesWith(sourceClient storage.Client, targetClientID string) bool {
+	ssoSharedWith := sourceClient.SSOSharedWith
+
+	// If client has no explicit ssoSharedWith, use default from session config.
+	if ssoSharedWith == nil {
+		switch m.Config.SSOSharedWithDefault {
+		case "all":
+			return true
+		default: // "none" or ""
+			return false
+		}
+	}
+
+	// Explicit empty slice means share with no one.
+	if len(ssoSharedWith) == 0 {
+		return false
+	}
+
+	for _, peer := range ssoSharedWith {
+		if peer == "*" || peer == targetClientID {
+			return true
+		}
+	}
+	return false
+}
+
+// FindSSO checks whether any active client in the session shares its
+// authentication with targetClientID via the ssoSharedWith policy.
+//
+// Note: the caller already has the target client loaded (for AllowedConnectors
+// validation), but here we need the *source* client configs - those are the
+// clients the user previously authenticated for, and their ssoSharedWith
+// policies determine whether SSO is allowed. These are different clients,
+// so the GetClient calls below are not redundant.
+func (m *Manager) FindSSO(ctx context.Context, session *storage.AuthSession, targetClientID string) *storage.ClientAuthState {
+	for sourceClientID, state := range session.ClientStates {
+		// Only directly-authenticated states may act as SSO sources. Skipping
+		// SSO-derived states keeps sharing unidirectional and prevents transitive
+		// A->B->C chains (a user authenticated only to A must not be SSO'd into C
+		// just because B shares with C).
+		if state.ViaSSO {
+			continue
+		}
+
+		sourceClient, err := m.Storage.GetClient(ctx, sourceClientID)
+		if err != nil {
+			m.Logger.DebugContext(ctx, "session: SSO lookup failed to get source client",
+				"source_client_id", sourceClientID, "err", err)
+			continue
+		}
+
+		if m.ClientSharesWith(sourceClient, targetClientID) {
+			return state
+		}
+	}
+
+	return nil
+}
+
+// UpdateTokenIssuedAt records that a token was just issued to clientID: it refreshes
+// the session's idle timeout and the client state's last-issued timestamp. A missing,
+// undecodable or superseded cookie is a no-op.
+func (m *Manager) UpdateTokenIssuedAt(r *http.Request, clientID string) {
+	if m.Config == nil {
+		return
+	}
+
+	sessionID, secret, ok := m.ParseCookie(r)
+	if !ok {
+		return
+	}
+
+	now := m.Now()
+	_ = m.Storage.UpdateAuthSession(r.Context(), sessionID, func(old storage.AuthSession) (storage.AuthSession, error) {
+		// Prove the cookie as every other session-trusting path does: a stale one
+		// must not refresh a live session's idle timeout. Aborting leaves it untouched.
+		if subtle.ConstantTimeCompare([]byte(old.Secret), []byte(secret)) != 1 {
+			return old, errors.New("session secret mismatch")
+		}
+		old.LastActivity = now
+		old.IdleExpiry = now.Add(m.Config.ValidIfNotUsedFor)
+		if cs, ok := old.ClientStates[clientID]; ok {
+			cs.LastTokenIssuedAt = now
+			cs.LastActivity = now
+		}
+		return old, nil
+	})
+}
+
+// --- Handler orchestration (uses sessionManager primitives) ---
+
+// ParseCookie reads and decodes the session cookie from the request. ok is false
+// when sessions are disabled, the cookie is absent, or it fails to decode.
+func (m *Manager) ParseCookie(r *http.Request) (sessionID, secret string, ok bool) {
+	if m.Config == nil {
+		return "", "", false
+	}
+	cookie, err := r.Cookie(m.Config.CookieName)
+	if err != nil || cookie.Value == "" {
+		return "", "", false
+	}
+	id, sec, err := internal.ParseSessionCookie(cookie.Value, m.Config.CookieEncryptionKey)
+	if err != nil {
+		m.Logger.DebugContext(r.Context(), "invalid session cookie format", "err", err)
+		return "", "", false
+	}
+	return id, sec, true
+}
+
+// AbsoluteExpiry returns the absolute session expiry measured from now.
+func (m *Manager) AbsoluteExpiry(now time.Time) time.Time {
+	return now.Add(m.Config.AbsoluteLifetime)
+}
+
+// IdleExpiry returns the idle-timeout expiry measured from now.
+func (m *Manager) IdleExpiry(now time.Time) time.Time {
+	return now.Add(m.Config.ValidIfNotUsedFor)
+}
diff --git a/server/session/session_test.go b/server/session/session_test.go
new file mode 100644
index 0000000000..1ce9ede86a
--- /dev/null
+++ b/server/session/session_test.go
@@ -0,0 +1,75 @@
+package session
+
+import (
+	"context"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+
+	"github.com/dexidp/dex/server/reqctx"
+)
+
+// The address stored on a session is an audit record, so it has to be the
+// client's address and nothing else — in particular not the ephemeral source
+// port, which identifies the connection rather than the client.
+func TestRemoteIP(t *testing.T) {
+	tests := []struct {
+		name       string
+		remoteAddr string
+		ctxIP      string
+		want       string
+	}{
+		{
+			name:       "resolver value wins",
+			remoteAddr: "10.0.0.1:4711",
+			ctxIP:      "203.0.113.7",
+			want:       "203.0.113.7",
+		},
+		{
+			name:       "empty resolver value falls through",
+			remoteAddr: "10.0.0.1:4711",
+			ctxIP:      "",
+			want:       "10.0.0.1",
+		},
+		{
+			name:       "ipv4 with port",
+			remoteAddr: "192.168.1.10:54321",
+			want:       "192.168.1.10",
+		},
+		{
+			name:       "ipv6 with port",
+			remoteAddr: "[2001:db8::1]:54321",
+			want:       "2001:db8::1",
+		},
+		{
+			name:       "ipv6 zone with port",
+			remoteAddr: "[fe80::1%eth0]:8080",
+			want:       "fe80::1%eth0",
+		},
+		{
+			// Not something net/http produces, but the fallback must not turn an
+			// unexpected value into an empty audit record.
+			name:       "no port",
+			remoteAddr: "192.168.1.10",
+			want:       "192.168.1.10",
+		},
+		{
+			name:       "unix socket",
+			remoteAddr: "@",
+			want:       "@",
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			r := httptest.NewRequest("GET", "/", nil)
+			r.RemoteAddr = tc.remoteAddr
+			if tc.ctxIP != "" {
+				r = r.WithContext(context.WithValue(r.Context(), reqctx.RequestKeyRemoteIP, tc.ctxIP))
+			}
+
+			assert.Equal(t, tc.want, remoteIP(r))
+		})
+	}
+}
diff --git a/server/signer/doc.go b/server/signer/doc.go
new file mode 100644
index 0000000000..248f26d2eb
--- /dev/null
+++ b/server/signer/doc.go
@@ -0,0 +1,4 @@
+// Package signer signs tokens and exposes the corresponding validation keys.
+// It supports pluggable key backends (in-memory local rotation and Vault) and a
+// KeySet that verifies JWT signatures against the current validation keys.
+package signer
diff --git a/server/signer/keyset.go b/server/signer/keyset.go
new file mode 100644
index 0000000000..4d4fae43b1
--- /dev/null
+++ b/server/signer/keyset.go
@@ -0,0 +1,42 @@
+package signer
+
+import (
+	"context"
+	"errors"
+
+	jose "github.com/go-jose/go-jose/v4"
+)
+
+// KeySet implements the oidc.KeySet interface backed by a Dex Signer,
+// verifying a JWT's signature against the signer's current validation keys.
+type KeySet struct {
+	Signer Signer
+}
+
+func (k *KeySet) VerifySignature(ctx context.Context, jwt string) (payload []byte, err error) {
+	jws, err := jose.ParseSigned(jwt, []jose.SignatureAlgorithm{jose.RS256, jose.RS384, jose.RS512, jose.ES256, jose.ES384, jose.ES512})
+	if err != nil {
+		return nil, err
+	}
+
+	keyID := ""
+	for _, sig := range jws.Signatures {
+		keyID = sig.Header.KeyID
+		break
+	}
+
+	keys, err := k.Signer.ValidationKeys(ctx)
+	if err != nil {
+		return nil, err
+	}
+
+	for _, key := range keys {
+		if keyID == "" || key.KeyID == keyID {
+			if payload, err := jws.Verify(key); err == nil {
+				return payload, nil
+			}
+		}
+	}
+
+	return nil, errors.New("failed to verify id token signature")
+}
diff --git a/server/signer/local.go b/server/signer/local.go
new file mode 100644
index 0000000000..30fd37d31e
--- /dev/null
+++ b/server/signer/local.go
@@ -0,0 +1,145 @@
+package signer
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"log/slog"
+	"time"
+
+	"github.com/go-jose/go-jose/v4"
+
+	"github.com/dexidp/dex/storage"
+)
+
+// LocalConfig holds configuration for the local signer.
+type LocalConfig struct {
+	// KeysRotationPeriod defines the duration of time after which the signing keys will be rotated.
+	KeysRotationPeriod string `json:"keysRotationPeriod"`
+	// Algorithm defines the signing algorithm used for newly generated local keys.
+	// Changing it does not replace the current signing key immediately. The new
+	// algorithm is applied when Dex generates the next signing key during rotation.
+	// Supported values are RS256 and ES256.
+	Algorithm jose.SignatureAlgorithm `json:"algorithm"`
+}
+
+func (c *LocalConfig) signingAlgorithm() (jose.SignatureAlgorithm, error) {
+	if c.Algorithm == "" {
+		return jose.RS256, nil
+	}
+	if c.Algorithm == jose.RS256 || c.Algorithm == jose.ES256 {
+		return c.Algorithm, nil
+	}
+	return "", fmt.Errorf("unsupported local signer algorithm %q", c.Algorithm)
+}
+
+// Open creates a new local signer.
+func (c *LocalConfig) Open(_ context.Context, s storage.Storage, idTokenValidFor time.Duration, now func() time.Time, logger *slog.Logger) (Signer, error) {
+	rotateKeysAfter, err := time.ParseDuration(c.KeysRotationPeriod)
+	if err != nil {
+		return nil, fmt.Errorf("invalid config value %q for local signer rotation period: %v", c.KeysRotationPeriod, err)
+	}
+
+	alg, err := c.signingAlgorithm()
+	if err != nil {
+		return nil, fmt.Errorf("invalid config value %q for local signer algorithm: %v", c.Algorithm, err)
+	}
+
+	strategy, err := rotationStrategyForAlgorithm(rotateKeysAfter, idTokenValidFor, alg)
+	if err != nil {
+		return nil, err
+	}
+	r := &keyRotator{s, strategy, now, logger}
+	return &localSigner{
+		storage: s,
+		rotator: r,
+		logger:  logger,
+	}, nil
+}
+
+// localSigner signs payloads using keys stored in the Dex storage.
+// It manages key rotation and storage using the existing keyRotator logic.
+type localSigner struct {
+	storage storage.Storage
+	rotator *keyRotator
+	logger  *slog.Logger
+}
+
+// Start begins key rotation in a new goroutine, closing once the context is canceled.
+//
+// The method blocks until after the first attempt to rotate keys has completed. That way
+// healthy storages will return from this call with valid keys.
+func (l *localSigner) Start(ctx context.Context) {
+	// Try to rotate immediately so properly configured storages will have keys.
+	if err := l.rotator.rotate(); err != nil {
+		l.logRotateError(err)
+	}
+
+	go func() {
+		for {
+			select {
+			case <-ctx.Done():
+				return
+			case <-time.After(time.Second * 30):
+				if err := l.rotator.rotate(); err != nil {
+					l.logRotateError(err)
+				}
+			}
+		}
+	}()
+}
+
+func (l *localSigner) logRotateError(err error) {
+	if errors.Is(err, errAlreadyRotated) {
+		l.logger.Info("key rotation not needed", "err", err)
+		return
+	}
+	l.logger.Error("failed to rotate keys", "err", err)
+}
+
+func (l *localSigner) Sign(ctx context.Context, payload []byte) (string, error) {
+	keys, err := l.storage.GetKeys(ctx)
+	if err != nil {
+		return "", fmt.Errorf("failed to get keys: %v", err)
+	}
+
+	signingKey := keys.SigningKey
+	if signingKey == nil {
+		return "", fmt.Errorf("no key to sign payload with")
+	}
+	signingAlg, err := signatureAlgorithm(signingKey)
+	if err != nil {
+		return "", err
+	}
+
+	return signPayload(signingKey, signingAlg, payload)
+}
+
+func (l *localSigner) ValidationKeys(ctx context.Context) ([]*jose.JSONWebKey, error) {
+	keys, err := l.storage.GetKeys(ctx)
+	if err != nil {
+		return nil, fmt.Errorf("failed to get keys: %v", err)
+	}
+
+	if keys.SigningKeyPub == nil {
+		return nil, fmt.Errorf("no public keys found")
+	}
+
+	jwks := make([]*jose.JSONWebKey, len(keys.VerificationKeys)+1)
+	jwks[0] = keys.SigningKeyPub
+	for i, verificationKey := range keys.VerificationKeys {
+		jwks[i+1] = verificationKey.PublicKey
+	}
+	return jwks, nil
+}
+
+func (l *localSigner) Algorithm(ctx context.Context) (jose.SignatureAlgorithm, error) {
+	keys, err := l.storage.GetKeys(ctx)
+	if err != nil && !errors.Is(err, storage.ErrNotFound) {
+		return "", fmt.Errorf("failed to get keys: %v", err)
+	}
+	if keys.SigningKey == nil {
+		return l.rotator.strategy.algorithm, nil
+	}
+	return signatureAlgorithm(keys.SigningKey)
+}
diff --git a/server/signer/local_test.go b/server/signer/local_test.go
new file mode 100644
index 0000000000..dfd657632e
--- /dev/null
+++ b/server/signer/local_test.go
@@ -0,0 +1,258 @@
+package signer
+
+import (
+	"context"
+	"crypto/ecdsa"
+	"crypto/elliptic"
+	"crypto/rand"
+	"crypto/rsa"
+	"log/slog"
+	"testing"
+	"time"
+
+	"github.com/go-jose/go-jose/v4"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/dexidp/dex/storage"
+	"github.com/dexidp/dex/storage/memory"
+)
+
+func newTestLocalSigner(t *testing.T, config LocalConfig, s storage.Storage, now func() time.Time) *localSigner {
+	t.Helper()
+
+	logger := slog.New(slog.DiscardHandler)
+	if s == nil {
+		s = memory.New(logger)
+	}
+	if config.KeysRotationPeriod == "" {
+		config.KeysRotationPeriod = time.Hour.String()
+	}
+	if now == nil {
+		now = time.Now
+	}
+
+	sig, err := config.Open(context.Background(), s, time.Hour, now, logger)
+	require.NoError(t, err)
+
+	ls, ok := sig.(*localSigner)
+	require.True(t, ok)
+	return ls
+}
+
+func newTestRSAJWKPair(t *testing.T) (*jose.JSONWebKey, *jose.JSONWebKey) {
+	t.Helper()
+
+	key, err := rsa.GenerateKey(rand.Reader, 2048)
+	require.NoError(t, err)
+
+	priv, pub, err := newJWKPair(key, jose.RS256)
+	require.NoError(t, err)
+
+	return priv, pub
+}
+
+func newTestES256JWKPair(t *testing.T) (*jose.JSONWebKey, *jose.JSONWebKey) {
+	t.Helper()
+
+	key, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
+	require.NoError(t, err)
+
+	priv, pub, err := newJWKPair(key, jose.ES256)
+	require.NoError(t, err)
+
+	return priv, pub
+}
+
+func requireVerifiedByAnyKey(t *testing.T, token string, alg jose.SignatureAlgorithm, keys []*jose.JSONWebKey, wantPayload []byte) {
+	t.Helper()
+
+	jws, err := jose.ParseSigned(token, []jose.SignatureAlgorithm{alg})
+	require.NoError(t, err)
+
+	for _, key := range keys {
+		payload, err := jws.Verify(key)
+		if err == nil {
+			require.Equal(t, wantPayload, payload)
+			return
+		}
+	}
+
+	t.Fatalf("token did not verify with any key for algorithm %s", alg)
+}
+
+func TestLocalSignerAlgorithm(t *testing.T) {
+	tests := []struct {
+		name string
+		cfg  LocalConfig
+		want jose.SignatureAlgorithm
+	}{
+		{
+			name: "default RS256 before first rotation",
+			cfg:  LocalConfig{KeysRotationPeriod: time.Hour.String()},
+			want: jose.RS256,
+		},
+		{
+			name: "ES256 before first rotation",
+			cfg:  LocalConfig{KeysRotationPeriod: time.Hour.String(), Algorithm: jose.ES256},
+			want: jose.ES256,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			ls := newTestLocalSigner(t, tt.cfg, nil, nil)
+
+			alg, err := ls.Algorithm(context.Background())
+			require.NoError(t, err)
+			assert.Equal(t, tt.want, alg)
+		})
+	}
+}
+
+func TestLocalSignerSignAndValidate(t *testing.T) {
+	tests := []struct {
+		name string
+		cfg  LocalConfig
+		want jose.SignatureAlgorithm
+	}{
+		{
+			name: "RS256",
+			cfg:  LocalConfig{KeysRotationPeriod: time.Hour.String()},
+			want: jose.RS256,
+		},
+		{
+			name: "ES256",
+			cfg:  LocalConfig{KeysRotationPeriod: time.Hour.String(), Algorithm: jose.ES256},
+			want: jose.ES256,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			ls := newTestLocalSigner(t, tt.cfg, nil, nil)
+			ctx := context.Background()
+
+			require.NoError(t, ls.rotator.rotate())
+
+			payload := []byte(`{"sub":"test-user"}`)
+			signed, err := ls.Sign(ctx, payload)
+			require.NoError(t, err)
+			assert.NotEmpty(t, signed)
+
+			keys, err := ls.ValidationKeys(ctx)
+			require.NoError(t, err)
+			require.Len(t, keys, 1)
+			assert.Equal(t, string(tt.want), keys[0].Algorithm)
+
+			alg, err := ls.Algorithm(ctx)
+			require.NoError(t, err)
+			assert.Equal(t, tt.want, alg)
+
+			requireVerifiedByAnyKey(t, signed, tt.want, keys, payload)
+		})
+	}
+}
+
+func TestLocalSignerAppliesConfiguredAlgorithmOnNextRotation(t *testing.T) {
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+
+	logger := slog.New(slog.DiscardHandler)
+	s := memory.New(logger)
+
+	currentTime := time.Now().UTC()
+
+	rsaPriv, rsaPub := newTestRSAJWKPair(t)
+	err := s.UpdateKeys(ctx, func(keys storage.Keys) (storage.Keys, error) {
+		keys.SigningKey = rsaPriv
+		keys.SigningKeyPub = rsaPub
+		keys.NextRotation = currentTime.Add(time.Hour)
+		return keys, nil
+	})
+	require.NoError(t, err)
+
+	ls := newTestLocalSigner(
+		t,
+		LocalConfig{KeysRotationPeriod: time.Hour.String(), Algorithm: jose.ES256},
+		s,
+		func() time.Time { return currentTime },
+	)
+
+	beforeAlg, err := ls.Algorithm(ctx)
+	require.NoError(t, err)
+	assert.Equal(t, jose.RS256, beforeAlg)
+
+	beforePayload := []byte(`{"sub":"before-rotation"}`)
+	beforeToken, err := ls.Sign(ctx, beforePayload)
+	require.NoError(t, err)
+
+	ls.Start(ctx)
+
+	afterStartAlg, err := ls.Algorithm(ctx)
+	require.NoError(t, err)
+	assert.Equal(t, jose.RS256, afterStartAlg)
+
+	currentTime = currentTime.Add(time.Hour + time.Second)
+	require.NoError(t, ls.rotator.rotate())
+
+	afterRotationAlg, err := ls.Algorithm(ctx)
+	require.NoError(t, err)
+	assert.Equal(t, jose.ES256, afterRotationAlg)
+
+	afterPayload := []byte(`{"sub":"after-rotation"}`)
+	afterToken, err := ls.Sign(ctx, afterPayload)
+	require.NoError(t, err)
+
+	keys, err := ls.ValidationKeys(ctx)
+	require.NoError(t, err)
+	require.Len(t, keys, 2)
+	assert.Equal(t, string(jose.ES256), keys[0].Algorithm)
+	assert.Equal(t, string(jose.RS256), keys[1].Algorithm)
+
+	requireVerifiedByAnyKey(t, beforeToken, jose.RS256, keys, beforePayload)
+	requireVerifiedByAnyKey(t, afterToken, jose.ES256, keys, afterPayload)
+}
+
+func TestLocalSignerDoesNotRevertSharedKeyAlgorithmBeforeNextRotation(t *testing.T) {
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+
+	logger := slog.New(slog.DiscardHandler)
+	s := memory.New(logger)
+
+	currentTime := time.Now().UTC()
+
+	esPriv, esPub := newTestES256JWKPair(t)
+	err := s.UpdateKeys(ctx, func(keys storage.Keys) (storage.Keys, error) {
+		keys.SigningKey = esPriv
+		keys.SigningKeyPub = esPub
+		keys.NextRotation = currentTime.Add(time.Hour)
+		return keys, nil
+	})
+	require.NoError(t, err)
+
+	ls := newTestLocalSigner(
+		t,
+		LocalConfig{KeysRotationPeriod: time.Hour.String(), Algorithm: jose.RS256},
+		s,
+		func() time.Time { return currentTime },
+	)
+
+	require.NoError(t, ls.rotator.rotate())
+
+	alg, err := ls.Algorithm(ctx)
+	require.NoError(t, err)
+	assert.Equal(t, jose.ES256, alg)
+
+	keys, err := ls.ValidationKeys(ctx)
+	require.NoError(t, err)
+	require.Len(t, keys, 1)
+	assert.Equal(t, string(jose.ES256), keys[0].Algorithm)
+	assert.Equal(t, esPub.KeyID, keys[0].KeyID)
+
+	payload := []byte(`{"sub":"shared-key"}`)
+	token, err := ls.Sign(ctx, payload)
+	require.NoError(t, err)
+	requireVerifiedByAnyKey(t, token, jose.ES256, keys, payload)
+}
diff --git a/server/signer/mock.go b/server/signer/mock.go
new file mode 100644
index 0000000000..832a9be87c
--- /dev/null
+++ b/server/signer/mock.go
@@ -0,0 +1,78 @@
+package signer
+
+import (
+	"context"
+	"crypto/rand"
+	"crypto/rsa"
+	"encoding/hex"
+	"io"
+
+	"github.com/go-jose/go-jose/v4"
+)
+
+// MockConfig creates a mock signer with a static key for testing.
+type MockConfig struct {
+	Key *rsa.PrivateKey
+}
+
+// Open creates a new mock signer.
+func (c *MockConfig) Open(_ context.Context) (Signer, error) {
+	if c.Key == nil {
+		// Generate a new key if not provided
+		key, err := rsa.GenerateKey(rand.Reader, 2048)
+		if err != nil {
+			return nil, err
+		}
+		c.Key = key
+	}
+
+	// Generate a key ID
+	b := make([]byte, 20)
+	if _, err := io.ReadFull(rand.Reader, b); err != nil {
+		panic(err)
+	}
+	keyID := hex.EncodeToString(b)
+
+	return &mockSigner{
+		key: &jose.JSONWebKey{
+			Key:       c.Key,
+			KeyID:     keyID,
+			Algorithm: "RS256",
+			Use:       "sig",
+		},
+		pubKey: &jose.JSONWebKey{
+			Key:       c.Key.Public(),
+			KeyID:     keyID,
+			Algorithm: "RS256",
+			Use:       "sig",
+		},
+	}, nil
+}
+
+// mockSigner is a simple signer that uses a static RSA key for testing.
+type mockSigner struct {
+	key    *jose.JSONWebKey
+	pubKey *jose.JSONWebKey
+}
+
+func (m *mockSigner) Sign(_ context.Context, payload []byte) (string, error) {
+	return signPayload(m.key, jose.RS256, payload)
+}
+
+func (m *mockSigner) ValidationKeys(_ context.Context) ([]*jose.JSONWebKey, error) {
+	return []*jose.JSONWebKey{m.pubKey}, nil
+}
+
+func (m *mockSigner) Algorithm(_ context.Context) (jose.SignatureAlgorithm, error) {
+	return jose.RS256, nil
+}
+
+func (m *mockSigner) Start(_ context.Context) {
+	// Nothing to do for mock signer
+}
+
+// NewMockSigner creates a mock signer with the provided key for testing.
+// If key is nil, a new one will be generated.
+func NewMockSigner(key *rsa.PrivateKey) (Signer, error) {
+	return (&MockConfig{Key: key}).Open(context.Background())
+}
diff --git a/server/signer/rotation.go b/server/signer/rotation.go
new file mode 100644
index 0000000000..b24fa1dbab
--- /dev/null
+++ b/server/signer/rotation.go
@@ -0,0 +1,177 @@
+package signer
+
+import (
+	"context"
+	"crypto"
+	"crypto/ecdsa"
+	"crypto/elliptic"
+	"crypto/rand"
+	"crypto/rsa"
+	"encoding/hex"
+	"errors"
+	"fmt"
+	"io"
+	"log/slog"
+	"time"
+
+	"github.com/go-jose/go-jose/v4"
+
+	"github.com/dexidp/dex/storage"
+)
+
+var errAlreadyRotated = errors.New("keys already rotated by another server instance")
+
+// rotationStrategy describes a strategy for generating cryptographic keys, how
+// often to rotate them, and how long they can validate signatures after rotation.
+type rotationStrategy struct {
+	// Time between rotations.
+	rotationFrequency time.Duration
+
+	// After being rotated how long should the key be kept around for validating
+	// signatures?
+	idTokenValidFor time.Duration
+
+	// Algorithm used for newly generated signing keys.
+	algorithm jose.SignatureAlgorithm
+
+	// Local signer keys can be RSA or ECDSA depending on the configured algorithm.
+	key func() (crypto.Signer, error)
+}
+
+// rotationStrategyForAlgorithm builds a key rotation strategy for the provided
+// local signer algorithm.
+func rotationStrategyForAlgorithm(rotationFrequency, idTokenValidFor time.Duration, algorithm jose.SignatureAlgorithm) (rotationStrategy, error) {
+	strategy := rotationStrategy{
+		rotationFrequency: rotationFrequency,
+		idTokenValidFor:   idTokenValidFor,
+		algorithm:         algorithm,
+	}
+	// Only RS256 and ES256 are supported for local key rotation; all other algorithms are handled by the default case.
+	switch algorithm { //nolint:exhaustive
+	case jose.RS256:
+		strategy.key = func() (crypto.Signer, error) {
+			return rsa.GenerateKey(rand.Reader, 2048)
+		}
+	case jose.ES256:
+		strategy.key = func() (crypto.Signer, error) {
+			return ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
+		}
+	default:
+		return rotationStrategy{}, fmt.Errorf("unsupported local signer algorithm %q", algorithm)
+	}
+	return strategy, nil
+}
+
+func newJWKPair(key crypto.Signer, algorithm jose.SignatureAlgorithm) (priv, pub *jose.JSONWebKey, err error) {
+	b := make([]byte, 20)
+	if _, err := io.ReadFull(rand.Reader, b); err != nil {
+		return nil, nil, fmt.Errorf("generate key id: %v", err)
+	}
+	keyID := hex.EncodeToString(b)
+
+	return &jose.JSONWebKey{
+			Key:       key,
+			KeyID:     keyID,
+			Algorithm: string(algorithm),
+			Use:       "sig",
+		}, &jose.JSONWebKey{
+			Key:       key.Public(),
+			KeyID:     keyID,
+			Algorithm: string(algorithm),
+			Use:       "sig",
+		}, nil
+}
+
+type keyRotator struct {
+	storage.Storage
+
+	strategy rotationStrategy
+	now      func() time.Time
+
+	logger *slog.Logger
+}
+
+func (k keyRotator) rotationReason(keys storage.Keys, tNow time.Time) string {
+	if keys.SigningKey == nil {
+		return "missing signing key"
+	}
+
+	if tNow.Before(keys.NextRotation) {
+		return ""
+	}
+	return "expired"
+}
+
+func (k keyRotator) rotate() error {
+	keys, err := k.GetKeys(context.Background())
+	if err != nil && err != storage.ErrNotFound {
+		return fmt.Errorf("get keys: %v", err)
+	}
+
+	reason := k.rotationReason(keys, k.now())
+	if reason == "" {
+		return nil
+	}
+	k.logger.Info("rotating signing keys", "reason", reason)
+
+	// Generate the key outside of a storage transaction.
+	key, err := k.strategy.key()
+	if err != nil {
+		return fmt.Errorf("generate key: %v", err)
+	}
+	priv, pub, err := newJWKPair(key, k.strategy.algorithm)
+	if err != nil {
+		return fmt.Errorf("generate JWK pair: %v", err)
+	}
+
+	var nextRotation time.Time
+	err = k.Storage.UpdateKeys(context.Background(), func(keys storage.Keys) (storage.Keys, error) {
+		tNow := k.now()
+		reason := k.rotationReason(keys, tNow)
+
+		// if you are running multiple instances of dex, another instance
+		// could have already rotated the keys.
+		if reason == "" {
+			return storage.Keys{}, errAlreadyRotated
+		}
+
+		expired := func(key storage.VerificationKey) bool {
+			return tNow.After(key.Expiry)
+		}
+
+		// Remove any verification keys that have expired.
+		i := 0
+		for _, key := range keys.VerificationKeys {
+			if !expired(key) {
+				keys.VerificationKeys[i] = key
+				i++
+			}
+		}
+		keys.VerificationKeys = keys.VerificationKeys[:i]
+
+		if keys.SigningKeyPub != nil {
+			// Move current signing key to a verification only key, throwing
+			// away the private part.
+			verificationKey := storage.VerificationKey{
+				PublicKey: keys.SigningKeyPub,
+				// After demoting the signing key, keep the token around for at least
+				// the amount of time an ID Token is valid for. This ensures the
+				// verification key won't expire until all ID Tokens it's signed
+				// expired as well.
+				Expiry: tNow.Add(k.strategy.idTokenValidFor),
+			}
+			keys.VerificationKeys = append(keys.VerificationKeys, verificationKey)
+		}
+
+		nextRotation = k.now().Add(k.strategy.rotationFrequency)
+		keys.SigningKey = priv
+		keys.SigningKeyPub = pub
+		keys.NextRotation = nextRotation
+		return keys, nil
+	})
+	if err != nil {
+		return err
+	}
+	k.logger.Info("keys rotated", "reason", reason, "next_rotation", nextRotation)
+	return nil
+}
diff --git a/server/rotation_test.go b/server/signer/rotation_test.go
similarity index 60%
rename from server/rotation_test.go
rename to server/signer/rotation_test.go
index e279bf543e..a4e0f937f3 100644
--- a/server/rotation_test.go
+++ b/server/signer/rotation_test.go
@@ -1,20 +1,20 @@
-package server
+package signer
 
 import (
-	"os"
+	"context"
+	"log/slog"
 	"sort"
 	"testing"
 	"time"
 
-	"github.com/sirupsen/logrus"
-	"github.com/stretchr/testify/require"
+	"github.com/go-jose/go-jose/v4"
 
 	"github.com/dexidp/dex/storage"
 	"github.com/dexidp/dex/storage/memory"
 )
 
 func signingKeyID(t *testing.T, s storage.Storage) string {
-	keys, err := s.GetKeys()
+	keys, err := s.GetKeys(context.TODO())
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -22,7 +22,7 @@ func signingKeyID(t *testing.T, s storage.Storage) string {
 }
 
 func verificationKeyIDs(t *testing.T, s storage.Storage) (ids []string) {
-	keys, err := s.GetKeys()
+	keys, err := s.GetKeys(context.TODO())
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -68,15 +68,15 @@ func TestKeyRotator(t *testing.T) {
 	// Only the last 5 verification keys are expected to be kept around.
 	maxVerificationKeys := 5
 
-	l := &logrus.Logger{
-		Out:       os.Stderr,
-		Formatter: &logrus.TextFormatter{DisableColors: true},
-		Level:     logrus.DebugLevel,
+	l := slog.New(slog.DiscardHandler)
+	strategy, err := rotationStrategyForAlgorithm(rotationFrequency, validFor, jose.RS256)
+	if err != nil {
+		t.Fatal(err)
 	}
 
 	r := &keyRotator{
 		Storage:  memory.New(l),
-		strategy: defaultRotationStrategy(rotationFrequency, validFor),
+		strategy: strategy,
 		now:      func() time.Time { return now },
 		logger:   l,
 	}
@@ -101,29 +101,3 @@ func TestKeyRotator(t *testing.T) {
 		}
 	}
 }
-
-func TestRefreshTokenPolicy(t *testing.T) {
-	lastTime := time.Now()
-	l := &logrus.Logger{
-		Out:       os.Stderr,
-		Formatter: &logrus.TextFormatter{DisableColors: true},
-		Level:     logrus.DebugLevel,
-	}
-
-	r, err := NewRefreshTokenPolicy(l, true, "1m", "1m", "1m")
-	require.NoError(t, err)
-
-	t.Run("Allowed", func(t *testing.T) {
-		r.now = func() time.Time { return lastTime }
-		require.Equal(t, true, r.AllowedToReuse(lastTime))
-		require.Equal(t, false, r.ExpiredBecauseUnused(lastTime))
-		require.Equal(t, false, r.CompletelyExpired(lastTime))
-	})
-
-	t.Run("Expired", func(t *testing.T) {
-		r.now = func() time.Time { return lastTime.Add(2 * time.Minute) }
-		require.Equal(t, false, r.AllowedToReuse(lastTime))
-		require.Equal(t, true, r.ExpiredBecauseUnused(lastTime))
-		require.Equal(t, true, r.CompletelyExpired(lastTime))
-	})
-}
diff --git a/server/signer/signer.go b/server/signer/signer.go
new file mode 100644
index 0000000000..1e15bbd196
--- /dev/null
+++ b/server/signer/signer.go
@@ -0,0 +1,19 @@
+package signer
+
+import (
+	"context"
+
+	"github.com/go-jose/go-jose/v4"
+)
+
+// Signer is an interface for signing payloads and retrieving validation keys.
+type Signer interface {
+	// Sign signs the provided payload.
+	Sign(ctx context.Context, payload []byte) (string, error)
+	// ValidationKeys returns the current public keys used for signature validation.
+	ValidationKeys(ctx context.Context) ([]*jose.JSONWebKey, error)
+	// Algorithm returns the signing algorithm used by this signer.
+	Algorithm(ctx context.Context) (jose.SignatureAlgorithm, error)
+	// Start starts any background tasks required by the signer (e.g., key rotation).
+	Start(ctx context.Context)
+}
diff --git a/server/signer/utils.go b/server/signer/utils.go
new file mode 100644
index 0000000000..92926d5b57
--- /dev/null
+++ b/server/signer/utils.go
@@ -0,0 +1,74 @@
+package signer
+
+import (
+	"crypto/ecdsa"
+	"crypto/ed25519"
+	"crypto/elliptic"
+	"crypto/rsa"
+	"errors"
+	"fmt"
+
+	"github.com/go-jose/go-jose/v4"
+)
+
+// signatureAlgorithm returns the JOSE signing algorithm declared by the JWK or
+// inferred from its key material when the algorithm field is empty.
+func signatureAlgorithm(jwk *jose.JSONWebKey) (alg jose.SignatureAlgorithm, err error) {
+	if jwk.Key == nil {
+		return alg, errors.New("no signing key")
+	}
+	if jwk.Algorithm != "" {
+		return jose.SignatureAlgorithm(jwk.Algorithm), nil
+	}
+	return signatureAlgorithmFromKey(jwk.Key)
+}
+
+func signatureAlgorithmFromKey(key any) (alg jose.SignatureAlgorithm, err error) {
+	switch key := key.(type) {
+	case *rsa.PublicKey, *rsa.PrivateKey:
+		// Because OIDC mandates that we support RS256, we always return that
+		// value. In the future, we might want to make this configurable on a
+		// per client basis. For example allowing PS256 or ECDSA variants.
+		//
+		// See https://github.com/dexidp/dex/issues/692
+		return jose.RS256, nil
+	case *ecdsa.PublicKey:
+		return signatureAlgorithmFromECDSACurve(key.Curve)
+	case *ecdsa.PrivateKey:
+		return signatureAlgorithmFromECDSACurve(key.Curve)
+	case ed25519.PublicKey, ed25519.PrivateKey:
+		return jose.EdDSA, nil
+	default:
+		return alg, fmt.Errorf("unsupported signing key type %T", key)
+	}
+}
+
+func signatureAlgorithmFromECDSACurve(curve elliptic.Curve) (jose.SignatureAlgorithm, error) {
+	if curve == nil {
+		return "", errors.New("unsupported ecdsa curve")
+	}
+	switch curve.Params() {
+	case elliptic.P256().Params():
+		return jose.ES256, nil
+	case elliptic.P384().Params():
+		return jose.ES384, nil
+	case elliptic.P521().Params():
+		return jose.ES512, nil
+	default:
+		return "", errors.New("unsupported ecdsa curve")
+	}
+}
+
+func signPayload(key *jose.JSONWebKey, alg jose.SignatureAlgorithm, payload []byte) (jws string, err error) {
+	signingKey := jose.SigningKey{Key: key, Algorithm: alg}
+
+	signer, err := jose.NewSigner(signingKey, &jose.SignerOptions{})
+	if err != nil {
+		return "", fmt.Errorf("new signer: %v", err)
+	}
+	signature, err := signer.Sign(payload)
+	if err != nil {
+		return "", fmt.Errorf("signing payload: %v", err)
+	}
+	return signature.CompactSerialize()
+}
diff --git a/server/signer/utils_test.go b/server/signer/utils_test.go
new file mode 100644
index 0000000000..7162447c27
--- /dev/null
+++ b/server/signer/utils_test.go
@@ -0,0 +1,50 @@
+package signer
+
+import (
+	"crypto/ecdsa"
+	"crypto/ed25519"
+	"crypto/elliptic"
+	"crypto/rand"
+	"crypto/rsa"
+	"testing"
+
+	"github.com/go-jose/go-jose/v4"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestSignatureAlgorithmFromKey(t *testing.T) {
+	t.Run("RSA private key", func(t *testing.T) {
+		key, err := rsa.GenerateKey(rand.Reader, 2048)
+		require.NoError(t, err)
+
+		alg, err := signatureAlgorithmFromKey(key)
+		require.NoError(t, err)
+		assert.Equal(t, jose.RS256, alg)
+	})
+
+	t.Run("ECDSA P-256 private key", func(t *testing.T) {
+		key, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
+		require.NoError(t, err)
+
+		alg, err := signatureAlgorithmFromKey(key)
+		require.NoError(t, err)
+		assert.Equal(t, jose.ES256, alg)
+	})
+
+	t.Run("Ed25519 private key", func(t *testing.T) {
+		_, key, err := ed25519.GenerateKey(rand.Reader)
+		require.NoError(t, err)
+
+		alg, err := signatureAlgorithmFromKey(key)
+		require.NoError(t, err)
+		assert.Equal(t, jose.EdDSA, alg)
+	})
+
+	t.Run("unsupported key type", func(t *testing.T) {
+		alg, err := signatureAlgorithmFromKey(struct{}{})
+		require.Error(t, err)
+		assert.Empty(t, alg)
+		assert.EqualError(t, err, "unsupported signing key type struct {}")
+	})
+}
diff --git a/server/signer/vault.go b/server/signer/vault.go
new file mode 100644
index 0000000000..ba175f2775
--- /dev/null
+++ b/server/signer/vault.go
@@ -0,0 +1,402 @@
+package signer
+
+import (
+	"context"
+	"crypto"
+	"crypto/ecdsa"
+	"crypto/ed25519"
+	"crypto/elliptic"
+	"crypto/rsa"
+	"crypto/sha256"
+	"crypto/sha512"
+	"crypto/x509"
+	"encoding/base64"
+	"encoding/json"
+	"encoding/pem"
+	"fmt"
+	"hash"
+	"os"
+
+	"github.com/go-jose/go-jose/v4"
+	vault "github.com/openbao/openbao/api/v2"
+)
+
+// VaultConfig holds configuration for the Vault signer.
+type VaultConfig struct {
+	Addr    string `json:"addr"`
+	Token   string `json:"token"`
+	KeyName string `json:"keyName"`
+}
+
+// UnmarshalJSON unmarshals a VaultConfig and applies environment variables.
+// If Addr or Token are not provided in the config, they are read from VAULT_ADDR
+// and VAULT_TOKEN environment variables respectively.
+func (c *VaultConfig) UnmarshalJSON(data []byte) error {
+	type Alias VaultConfig
+	aux := &struct {
+		*Alias
+	}{
+		Alias: (*Alias)(c),
+	}
+
+	if err := json.Unmarshal(data, &aux); err != nil {
+		return err
+	}
+
+	// Apply environment variables if config values are empty
+	if c.Addr == "" {
+		if addr := os.Getenv("VAULT_ADDR"); addr != "" {
+			c.Addr = addr
+		}
+	}
+
+	if c.Token == "" {
+		if token := os.Getenv("VAULT_TOKEN"); token != "" {
+			c.Token = token
+		}
+	}
+
+	return nil
+}
+
+// Open creates a new Vault signer.
+func (c *VaultConfig) Open(_ context.Context) (Signer, error) {
+	return newVaultSigner(*c)
+}
+
+// vaultSigner signs payloads using HashiCorp Vault's Transit backend.
+type vaultSigner struct {
+	client  *vault.Client
+	keyName string
+}
+
+// newVaultSigner creates a new Vault signer that uses Transit backend for signing.
+func newVaultSigner(c VaultConfig) (*vaultSigner, error) {
+	config := vault.DefaultConfig()
+	config.Address = c.Addr
+
+	client, err := vault.NewClient(config)
+	if err != nil {
+		return nil, fmt.Errorf("failed to create vault client: %v", err)
+	}
+
+	if c.Token != "" {
+		client.SetToken(c.Token)
+	}
+
+	return &vaultSigner{
+		client:  client,
+		keyName: c.KeyName,
+	}, nil
+}
+
+func (v *vaultSigner) Start(_ context.Context) {
+	// Vault signer does not need background rotation tasks
+}
+
+func (v *vaultSigner) Sign(ctx context.Context, payload []byte) (string, error) {
+	// 1. Fetch keys to determine the key to use (latest version) and its ID.
+	keysMap, latestVersion, err := v.getTransitKeysMap(ctx)
+	if err != nil {
+		return "", fmt.Errorf("failed to get keys for signing context: %v", err)
+	}
+
+	// Determine the key version and ID to use
+	// We use the latest version by default
+	signingJWK, ok := keysMap[latestVersion]
+	if !ok {
+		return "", fmt.Errorf("latest key version %d not found in public keys", latestVersion)
+	}
+
+	// 2. Construct JWS Header and Payload first (Signing Input)
+	header := map[string]interface{}{
+		"alg": signingJWK.Algorithm,
+		"kid": signingJWK.KeyID,
+	}
+
+	headerBytes, err := json.Marshal(header)
+	if err != nil {
+		return "", fmt.Errorf("failed to marshal header: %v", err)
+	}
+
+	headerB64 := base64.RawURLEncoding.EncodeToString(headerBytes)
+	payloadB64 := base64.RawURLEncoding.EncodeToString(payload)
+
+	// The input to the signature is "header.payload"
+	signingInput := fmt.Sprintf("%s.%s", headerB64, payloadB64)
+
+	// 3. Sign the signingInput using Vault
+	var vaultInput string
+	data := map[string]interface{}{}
+
+	// Determine Vault params based on JWS algorithm
+	params, err := getVaultParams(signingJWK.Algorithm)
+	if err != nil {
+		return "", err
+	}
+
+	// Apply params to data map
+	for k, v := range params.extraParams {
+		data[k] = v
+	}
+
+	// Hash input if needed
+	if params.hasher != nil {
+		params.hasher.Write([]byte(signingInput))
+		hash := params.hasher.Sum(nil)
+		vaultInput = base64.StdEncoding.EncodeToString(hash)
+	} else {
+		// No pre-hashing (EdDSA)
+		vaultInput = base64.StdEncoding.EncodeToString([]byte(signingInput))
+	}
+	data["input"] = vaultInput
+
+	signPath := fmt.Sprintf("transit/sign/%s", v.keyName)
+	signSecret, err := v.client.Logical().WriteWithContext(ctx, signPath, data)
+	if err != nil {
+		return "", fmt.Errorf("vault sign: %v", err)
+	}
+
+	signatureString, ok := signSecret.Data["signature"].(string)
+	if !ok {
+		return "", fmt.Errorf("vault response missing signature")
+	}
+
+	// Parse vault signature: "vault:v1:base64sig"
+	var signatureB64 []byte
+	if len(signatureString) > 8 && signatureString[:6] == "vault:" {
+		parts := splitVaultSignature(signatureString)
+		if len(parts) == 3 {
+			// part 1 is "vault", part 2 is "v1", part 3 is signature
+			// The signature is already base64 encoded, decoding it is not needed and
+			// will make the code failing.
+			signatureB64 = []byte(parts[2])
+		}
+	} else {
+		return "", fmt.Errorf("unexpected signature format: %s", signatureString)
+	}
+
+	return fmt.Sprintf("%s.%s.%s", headerB64, payloadB64, signatureB64), nil
+}
+
+func (v *vaultSigner) ValidationKeys(ctx context.Context) ([]*jose.JSONWebKey, error) {
+	keysMap, _, err := v.getTransitKeysMap(ctx)
+	if err != nil {
+		return nil, err
+	}
+
+	keys := make([]*jose.JSONWebKey, 0, len(keysMap))
+	for _, k := range keysMap {
+		keys = append(keys, k)
+	}
+	return keys, nil
+}
+
+// getTransitKeysMap returns a map of key_version -> JWK and the latest version number
+func (v *vaultSigner) getTransitKeysMap(ctx context.Context) (map[int64]*jose.JSONWebKey, int64, error) {
+	path := fmt.Sprintf("transit/keys/%s", v.keyName)
+	secret, err := v.client.Logical().ReadWithContext(ctx, path)
+	if err != nil {
+		return nil, 0, fmt.Errorf("failed to read key from vault: %v", err)
+	}
+	if secret == nil {
+		return nil, 0, fmt.Errorf("key %q not found in vault", v.keyName)
+	}
+
+	latestVersion, ok := secret.Data["latest_version"].(json.Number)
+	if !ok {
+		// Try float64 which is default for unmarshal interface{}
+		if lv, ok := secret.Data["latest_version"].(float64); ok {
+			latestVersion = json.Number(fmt.Sprintf("%d", int(lv)))
+		} else if lv, ok := secret.Data["latest_version"].(int); ok {
+			latestVersion = json.Number(fmt.Sprintf("%d", lv))
+		}
+	}
+	latestVerInt, err := latestVersion.Int64()
+	if err != nil {
+		return nil, 0, fmt.Errorf("failed to get latest version: %v", err)
+	}
+
+	keysObj, ok := secret.Data["keys"].(map[string]interface{})
+	if !ok {
+		return nil, 0, fmt.Errorf("invalid response from vault")
+	}
+
+	jwksMap := make(map[int64]*jose.JSONWebKey)
+
+	for verStr, data := range keysObj {
+		d, ok := data.(map[string]interface{})
+		if !ok {
+			continue
+		}
+
+		var ver int64
+		fmt.Sscanf(verStr, "%d", &ver)
+
+		pemStr, ok := d["public_key"].(string)
+		if !ok {
+			continue
+		}
+
+		jwk, err := parsePEMToJWK(pemStr)
+		if err != nil {
+			continue
+		}
+
+		jwksMap[ver] = jwk
+	}
+
+	return jwksMap, latestVerInt, nil
+}
+
+func parsePEMToJWK(pemStr string) (*jose.JSONWebKey, error) {
+	block, _ := pem.Decode([]byte(pemStr))
+	if block == nil {
+		// OpenBao may return ED25519 keys as raw base64-encoded strings instead of PEM
+		// Try to decode as raw base64 ED25519 key
+		keyBytes, err := base64.StdEncoding.DecodeString(pemStr)
+		if err != nil {
+			return nil, fmt.Errorf("failed to parse PEM block or base64: %v", err)
+		}
+
+		// Check if it's a raw 32-byte ED25519 key
+		var ed25519Key ed25519.PublicKey
+		if len(keyBytes) == 32 {
+			ed25519Key = ed25519.PublicKey(keyBytes)
+		} else {
+			// Try to parse as PKIX public key
+			pub, err := x509.ParsePKIXPublicKey(keyBytes)
+			if err != nil {
+				return nil, fmt.Errorf("failed to parse raw key: %v", err)
+			}
+
+			// Create JWK for ED25519 key
+			var ok bool
+			ed25519Key, ok = pub.(ed25519.PublicKey)
+			if !ok {
+				return nil, fmt.Errorf("expected ED25519 key, got %T", pub)
+			}
+		}
+
+		jwk := &jose.JSONWebKey{
+			Key:       ed25519Key,
+			Algorithm: "EdDSA",
+			Use:       "sig",
+		}
+
+		thumbprint, err := jwk.Thumbprint(crypto.SHA256)
+		if err != nil {
+			return nil, err
+		}
+		jwk.KeyID = base64.RawURLEncoding.EncodeToString(thumbprint)
+
+		return jwk, nil
+	}
+
+	pub, err := x509.ParsePKIXPublicKey(block.Bytes)
+	if err != nil {
+		return nil, fmt.Errorf("failed to parse public key: %v", err)
+	}
+
+	alg := ""
+	switch k := pub.(type) {
+	case *rsa.PublicKey:
+		alg = "RS256"
+	case *ecdsa.PublicKey:
+		switch k.Curve {
+		case elliptic.P256():
+			alg = "ES256"
+		case elliptic.P384():
+			alg = "ES384"
+		case elliptic.P521():
+			alg = "ES512"
+		default:
+			return nil, fmt.Errorf("unsupported ECDSA curve")
+		}
+	case ed25519.PublicKey:
+		alg = "EdDSA"
+	default:
+		return nil, fmt.Errorf("unsupported key type %T", pub)
+	}
+
+	jwk := &jose.JSONWebKey{
+		Key:       pub,
+		Algorithm: alg,
+		Use:       "sig",
+	}
+
+	thumbprint, err := jwk.Thumbprint(crypto.SHA256)
+	if err != nil {
+		return nil, err
+	}
+	jwk.KeyID = base64.RawURLEncoding.EncodeToString(thumbprint)
+
+	return jwk, nil
+}
+
+func splitVaultSignature(sig string) []string {
+	// Basic split implementation
+	// "vault:v1:signature"
+	var parts []string
+	start := 0
+	for i := 0; i < len(sig); i++ {
+		if sig[i] == ':' {
+			parts = append(parts, sig[start:i])
+			start = i + 1
+		}
+	}
+	parts = append(parts, sig[start:])
+	return parts
+}
+
+func (v *vaultSigner) Algorithm(ctx context.Context) (jose.SignatureAlgorithm, error) {
+	keysMap, latestVersion, err := v.getTransitKeysMap(ctx)
+	if err != nil {
+		return "", fmt.Errorf("failed to get keys: %v", err)
+	}
+
+	signingJWK, ok := keysMap[latestVersion]
+	if !ok {
+		return "", fmt.Errorf("latest key version %d not found", latestVersion)
+	}
+	return jose.SignatureAlgorithm(signingJWK.Algorithm), nil
+}
+
+type vaultAlgoParams struct {
+	hasher      hash.Hash
+	extraParams map[string]interface{}
+}
+
+func getVaultParams(alg string) (vaultAlgoParams, error) {
+	params := vaultAlgoParams{
+		extraParams: map[string]interface{}{
+			"marshaling_algorithm": "jws",
+			"signature_algorithm":  "pkcs1v15",
+		},
+	}
+
+	switch alg {
+	case "RS256":
+		params.hasher = sha256.New()
+		params.extraParams["prehashed"] = true
+		params.extraParams["hash_algorithm"] = "sha2-256"
+	case "ES256":
+		params.hasher = sha256.New()
+		params.extraParams["prehashed"] = true
+		params.extraParams["hash_algorithm"] = "sha2-256"
+	case "ES384":
+		params.hasher = sha512.New384()
+		params.extraParams["prehashed"] = true
+		params.extraParams["hash_algorithm"] = "sha2-384"
+	case "ES512":
+		params.hasher = sha512.New()
+		params.extraParams["prehashed"] = true
+		params.extraParams["hash_algorithm"] = "sha2-512"
+	case "EdDSA":
+		// No hashing
+		params.hasher = nil
+	default:
+		return params, fmt.Errorf("unsupported signing algorithm: %s", alg)
+	}
+	return params, nil
+}
diff --git a/server/signer/vault_integration_test.go b/server/signer/vault_integration_test.go
new file mode 100644
index 0000000000..84f824ae5a
--- /dev/null
+++ b/server/signer/vault_integration_test.go
@@ -0,0 +1,549 @@
+package signer
+
+import (
+	"context"
+	"crypto/rand"
+	"encoding/base64"
+	"encoding/json"
+	"fmt"
+	"os"
+	"testing"
+	"time"
+
+	"github.com/go-jose/go-jose/v4"
+	vault "github.com/openbao/openbao/api/v2"
+)
+
+// Conformance tests verify that Vault and OpenBao behave identically with the signer.
+// These tests use a single SDK (OpenBao API) that works with both systems.
+//
+// To run tests for a specific system, set the environment variables:
+//
+// For Vault:
+//   DEX_VAULT_ADDR=http://localhost:8200
+//   DEX_VAULT_TOKEN=root-token
+//   go test -v -run TestVaultSignerConformance
+//
+// For OpenBao:
+//   DEX_OPENBAO_ADDR=http://localhost:8210
+//   DEX_OPENBAO_TOKEN=root-token
+//   go test -v -run TestVaultSignerConformance
+//
+// To test both systems in parallel, set both sets of environment variables.
+
+type conformanceTestConfig struct {
+	name  string
+	addr  string
+	token string
+}
+
+// getTestConfigs returns list of test configs based on environment variables
+func getTestConfigs(t *testing.T) []conformanceTestConfig {
+	var configs []conformanceTestConfig
+
+	// Check for Vault
+	vaultAddr := os.Getenv("DEX_VAULT_ADDR")
+	vaultToken := os.Getenv("DEX_VAULT_TOKEN")
+	if vaultAddr != "" && vaultToken != "" {
+		configs = append(configs, conformanceTestConfig{
+			name:  "Vault",
+			addr:  vaultAddr,
+			token: vaultToken,
+		})
+	}
+
+	// Check for OpenBao
+	openbaoAddr := os.Getenv("DEX_OPENBAO_ADDR")
+	openbaoToken := os.Getenv("DEX_OPENBAO_TOKEN")
+	if openbaoAddr != "" && openbaoToken != "" {
+		configs = append(configs, conformanceTestConfig{
+			name:  "OpenBao",
+			addr:  openbaoAddr,
+			token: openbaoToken,
+		})
+	}
+
+	if len(configs) == 0 {
+		t.Skip("Skipping conformance tests. Set DEX_VAULT_TOKEN+DEX_VAULT_ADDR or DEX_OPENBAO_TOKEN+DEX_OPENBAO_ADDR to run.")
+	}
+
+	return configs
+}
+
+// TestVaultSignerConformance_SigningAndVerification tests that signing and verification work the same way
+// across Vault and OpenBao implementations.
+func TestVaultSignerConformance_SigningAndVerification(t *testing.T) {
+	configs := getTestConfigs(t)
+
+	testCases := []struct {
+		name    string
+		keyType string
+		alg     string
+	}{
+		{
+			name:    "RSA-2048",
+			keyType: "rsa-2048",
+			alg:     "RS256",
+		},
+		{
+			name:    "ECDSA-P256",
+			keyType: "ecdsa-p256",
+			alg:     "ES256",
+		},
+		{
+			name:    "ECDSA-P384",
+			keyType: "ecdsa-p384",
+			alg:     "ES384",
+		},
+		{
+			name:    "ED25519",
+			keyType: "ed25519",
+			alg:     "EdDSA",
+		},
+	}
+
+	for _, config := range configs {
+		t.Run(config.name, func(t *testing.T) {
+			ctx := context.Background()
+
+			// Create client
+			vaultConfig := vault.DefaultConfig()
+			vaultConfig.Address = config.addr
+			client, err := vault.NewClient(vaultConfig)
+			if err != nil {
+				t.Fatalf("failed to create client: %v", err)
+			}
+			client.SetToken(config.token)
+
+			// Enable transit engine
+			if err := enableTransitEngine(client); err != nil {
+				t.Fatalf("failed to enable transit engine: %v", err)
+			}
+
+			for _, tc := range testCases {
+				t.Run(tc.name, func(t *testing.T) {
+					keyName := fmt.Sprintf("test-key-%s-%s-%d", config.name, tc.keyType, time.Now().Unix())
+
+					// Create key
+					keyData := map[string]interface{}{
+						"type": tc.keyType,
+					}
+					_, err := client.Logical().WriteWithContext(ctx, fmt.Sprintf("transit/keys/%s", keyName), keyData)
+					if err != nil {
+						t.Fatalf("failed to create key: %v", err)
+					}
+
+					defer cleanupTests(t, ctx, client, keyName)
+
+					// Create signer
+					signerConfig := VaultConfig{
+						Addr:    config.addr,
+						Token:   config.token,
+						KeyName: keyName,
+					}
+					signer, err := newVaultSigner(signerConfig)
+					if err != nil {
+						t.Fatalf("failed to create signer: %v", err)
+					}
+
+					// Test 1: Verify algorithm
+					alg, err := signer.Algorithm(ctx)
+					if err != nil {
+						t.Fatalf("failed to get algorithm: %v", err)
+					}
+					if string(alg) != tc.alg {
+						t.Errorf("expected algorithm %s, got %s", tc.alg, alg)
+					}
+
+					// Test 2: Get validation keys
+					keys, err := signer.ValidationKeys(ctx)
+					if err != nil {
+						t.Fatalf("failed to get validation keys: %v", err)
+					}
+					if len(keys) == 0 {
+						t.Fatal("expected at least one validation key")
+					}
+					if keys[0].Algorithm != tc.alg {
+						t.Errorf("expected key algorithm %s, got %s", tc.alg, keys[0].Algorithm)
+					}
+					if keys[0].Use != "sig" {
+						t.Errorf("expected key use 'sig', got %s", keys[0].Use)
+					}
+
+					// Test 3: Sign and verify JWT
+					payload := map[string]interface{}{
+						"iss": "https://dex.example.com",
+						"sub": "user123",
+						"aud": "client-app",
+						"exp": time.Now().Add(time.Hour).Unix(),
+						"iat": time.Now().Unix(),
+					}
+					payloadBytes, err := json.Marshal(payload)
+					if err != nil {
+						t.Fatalf("failed to marshal payload: %v", err)
+					}
+
+					jwtString, err := signer.Sign(ctx, payloadBytes)
+					if err != nil {
+						t.Fatalf("failed to sign payload: %v", err)
+					}
+
+					// Verify JWT signature
+					jws, err := jose.ParseSigned(jwtString, []jose.SignatureAlgorithm{jose.SignatureAlgorithm(tc.alg)})
+					if err != nil {
+						t.Fatalf("failed to parse signed JWT: %v", err)
+					}
+
+					verifiedPayload, err := jws.Verify(keys[0])
+					if err != nil {
+						t.Fatalf("failed to verify JWT signature: %v", err)
+					}
+
+					var decodedPayload map[string]interface{}
+					if err := json.Unmarshal(verifiedPayload, &decodedPayload); err != nil {
+						t.Fatalf("failed to unmarshal verified payload: %v", err)
+					}
+
+					if decodedPayload["sub"] != payload["sub"] {
+						t.Errorf("payload mismatch: expected sub=%s, got %s", payload["sub"], decodedPayload["sub"])
+					}
+
+					// Test 4: Multiple signatures with same key
+					for i := 0; i < 3; i++ {
+						randomPayload := make([]byte, 32)
+						_, err := rand.Read(randomPayload)
+						if err != nil {
+							t.Fatalf("failed to generate random payload: %v", err)
+						}
+
+						payloadData := map[string]interface{}{
+							"data": base64.StdEncoding.EncodeToString(randomPayload),
+							"iat":  time.Now().Unix(),
+						}
+						payloadBytes, err := json.Marshal(payloadData)
+						if err != nil {
+							t.Fatalf("failed to marshal payload: %v", err)
+						}
+
+						jwtString, err := signer.Sign(ctx, payloadBytes)
+						if err != nil {
+							t.Fatalf("sign attempt %d failed: %v", i+1, err)
+						}
+
+						jws, err := jose.ParseSigned(jwtString, []jose.SignatureAlgorithm{jose.SignatureAlgorithm(tc.alg)})
+						if err != nil {
+							t.Fatalf("parse attempt %d failed: %v", i+1, err)
+						}
+
+						_, err = jws.Verify(keys[0])
+						if err != nil {
+							t.Fatalf("verify attempt %d failed: %v", i+1, err)
+						}
+					}
+				})
+			}
+		})
+	}
+}
+
+// TestVaultSignerConformance_KeyRotation tests that key rotation works identically
+// across Vault and OpenBao implementations.
+func TestVaultSignerConformance_KeyRotation(t *testing.T) {
+	configs := getTestConfigs(t)
+
+	for _, config := range configs {
+		t.Run(config.name, func(t *testing.T) {
+			ctx := context.Background()
+
+			// Create client
+			vaultConfig := vault.DefaultConfig()
+			vaultConfig.Address = config.addr
+			client, err := vault.NewClient(vaultConfig)
+			if err != nil {
+				t.Fatalf("failed to create client: %v", err)
+			}
+			client.SetToken(config.token)
+
+			// Enable transit engine
+			if err := enableTransitEngine(client); err != nil {
+				t.Fatalf("failed to enable transit engine: %v", err)
+			}
+
+			keyName := fmt.Sprintf("test-rotation-key-%s-%d", config.name, time.Now().Unix())
+
+			// Create initial key
+			keyData := map[string]interface{}{
+				"type": "ecdsa-p256",
+			}
+			_, err = client.Logical().WriteWithContext(ctx, fmt.Sprintf("transit/keys/%s", keyName), keyData)
+			if err != nil {
+				t.Fatalf("failed to create key: %v", err)
+			}
+
+			defer cleanupTests(t, ctx, client, keyName)
+
+			// Create signer
+			signerConfig := VaultConfig{
+				Addr:    config.addr,
+				Token:   config.token,
+				KeyName: keyName,
+			}
+			signer, err := newVaultSigner(signerConfig)
+			if err != nil {
+				t.Fatalf("failed to create signer: %v", err)
+			}
+
+			// Sign with initial key version
+			payload1 := map[string]interface{}{"version": "v1", "iat": time.Now().Unix()}
+			payload1Bytes, err := json.Marshal(payload1)
+			if err != nil {
+				t.Fatalf("failed to marshal payload: %v", err)
+			}
+
+			jwt1, err := signer.Sign(ctx, payload1Bytes)
+			if err != nil {
+				t.Fatalf("failed to sign with v1: %v", err)
+			}
+
+			// Get keys before rotation
+			keysBefore, err := signer.ValidationKeys(ctx)
+			if err != nil {
+				t.Fatalf("failed to get keys before rotation: %v", err)
+			}
+			if len(keysBefore) != 1 {
+				t.Errorf("expected 1 key before rotation, got %d", len(keysBefore))
+			}
+
+			// Rotate key
+			_, err = client.Logical().WriteWithContext(ctx, fmt.Sprintf("transit/keys/%s/rotate", keyName), nil)
+			if err != nil {
+				t.Fatalf("failed to rotate key: %v", err)
+			}
+
+			// Sign with new key version
+			payload2 := map[string]interface{}{"version": "v2", "iat": time.Now().Unix()}
+			payload2Bytes, err := json.Marshal(payload2)
+			if err != nil {
+				t.Fatalf("failed to marshal payload: %v", err)
+			}
+
+			jwt2, err := signer.Sign(ctx, payload2Bytes)
+			if err != nil {
+				t.Fatalf("failed to sign with v2: %v", err)
+			}
+
+			// Get keys after rotation
+			keysAfter, err := signer.ValidationKeys(ctx)
+			if err != nil {
+				t.Fatalf("failed to get keys after rotation: %v", err)
+			}
+			if len(keysAfter) != 2 {
+				t.Errorf("expected 2 keys after rotation, got %d", len(keysAfter))
+			}
+
+			// Verify both JWTs can be validated with the current keyset
+			jws1, err := jose.ParseSigned(jwt1, []jose.SignatureAlgorithm{jose.ES256})
+			if err != nil {
+				t.Fatalf("failed to parse jwt1: %v", err)
+			}
+
+			jws2, err := jose.ParseSigned(jwt2, []jose.SignatureAlgorithm{jose.ES256})
+			if err != nil {
+				t.Fatalf("failed to parse jwt2: %v", err)
+			}
+
+			// Find matching keys and verify
+			verified1 := false
+			verified2 := false
+
+			for _, key := range keysAfter {
+				if _, err := jws1.Verify(key); err == nil {
+					verified1 = true
+				}
+				if _, err := jws2.Verify(key); err == nil {
+					verified2 = true
+				}
+			}
+
+			if !verified1 {
+				t.Error("failed to verify JWT signed with version 1")
+			}
+			if !verified2 {
+				t.Error("failed to verify JWT signed with version 2")
+			}
+		})
+	}
+}
+
+// TestVaultSignerConformance_PublicKeyDiscovery tests that public key discovery works identically
+// across Vault and OpenBao implementations.
+func TestVaultSignerConformance_PublicKeyDiscovery(t *testing.T) {
+	configs := getTestConfigs(t)
+
+	for _, config := range configs {
+		t.Run(config.name, func(t *testing.T) {
+			ctx := context.Background()
+
+			// Create client
+			vaultConfig := vault.DefaultConfig()
+			vaultConfig.Address = config.addr
+			client, err := vault.NewClient(vaultConfig)
+			if err != nil {
+				t.Fatalf("failed to create client: %v", err)
+			}
+			client.SetToken(config.token)
+
+			// Enable transit engine
+			if err := enableTransitEngine(client); err != nil {
+				t.Fatalf("failed to enable transit engine: %v", err)
+			}
+
+			keyName := fmt.Sprintf("test-discovery-key-%s-%d", config.name, time.Now().Unix())
+
+			// Create key
+			keyData := map[string]interface{}{
+				"type": "rsa-2048",
+			}
+			_, err = client.Logical().WriteWithContext(ctx, fmt.Sprintf("transit/keys/%s", keyName), keyData)
+			if err != nil {
+				t.Fatalf("failed to create key: %v", err)
+			}
+
+			defer cleanupTests(t, ctx, client, keyName)
+
+			// Create signer
+			signerConfig := VaultConfig{
+				Addr:    config.addr,
+				Token:   config.token,
+				KeyName: keyName,
+			}
+			signer, err := newVaultSigner(signerConfig)
+			if err != nil {
+				t.Fatalf("failed to create signer: %v", err)
+			}
+
+			// Get public keys (simulating JWKS endpoint)
+			keys, err := signer.ValidationKeys(ctx)
+			if err != nil {
+				t.Fatalf("failed to get validation keys: %v", err)
+			}
+
+			// Verify keys have required JWKS fields
+			for i, key := range keys {
+				if key.KeyID == "" {
+					t.Errorf("key %d missing KeyID", i)
+				}
+				if key.Algorithm == "" {
+					t.Errorf("key %d missing Algorithm", i)
+				}
+				if key.Use != "sig" {
+					t.Errorf("key %d has wrong Use field: expected 'sig', got '%s'", i, key.Use)
+				}
+				if key.Key == nil {
+					t.Errorf("key %d missing public key", i)
+				}
+
+				// Verify key can be marshaled to JWKS format
+				jwksData, err := json.Marshal(key)
+				if err != nil {
+					t.Errorf("key %d cannot be marshaled to JSON: %v", i, err)
+				}
+
+				var jwksCheck map[string]interface{}
+				if err := json.Unmarshal(jwksData, &jwksCheck); err != nil {
+					t.Errorf("key %d JWKS data is invalid: %v", i, err)
+				}
+
+				// Check for standard JWKS fields
+				requiredFields := []string{"kty", "use", "kid", "alg"}
+				for _, field := range requiredFields {
+					if _, ok := jwksCheck[field]; !ok {
+						t.Errorf("key %d missing required JWKS field: %s", i, field)
+					}
+				}
+			}
+
+			// Sign a JWT
+			payload := map[string]interface{}{
+				"iss": "https://dex.example.com",
+				"sub": "test-user",
+				"aud": "test-client",
+				"exp": time.Now().Add(time.Hour).Unix(),
+				"iat": time.Now().Unix(),
+			}
+			payloadBytes, err := json.Marshal(payload)
+			if err != nil {
+				t.Fatalf("failed to marshal payload: %v", err)
+			}
+
+			jwtString, err := signer.Sign(ctx, payloadBytes)
+			if err != nil {
+				t.Fatalf("failed to sign JWT: %v", err)
+			}
+
+			// Parse JWT and verify it has correct kid in header
+			jws, err := jose.ParseSigned(jwtString, []jose.SignatureAlgorithm{jose.RS256})
+			if err != nil {
+				t.Fatalf("failed to parse JWT: %v", err)
+			}
+
+			if len(jws.Signatures) == 0 {
+				t.Fatal("JWT has no signatures")
+			}
+
+			kid := jws.Signatures[0].Header.KeyID
+			if kid == "" {
+				t.Error("JWT header missing kid")
+			}
+
+			// Verify kid matches one of the public keys
+			kidFound := false
+			for _, key := range keys {
+				if key.KeyID == kid {
+					kidFound = true
+					break
+				}
+			}
+			if !kidFound {
+				t.Errorf("JWT kid '%s' not found in public keys", kid)
+			}
+		})
+	}
+}
+
+// enableTransitEngine enables the transit secrets engine if not already enabled.
+func enableTransitEngine(client *vault.Client) error {
+	// Check if already enabled
+	mounts, err := client.Sys().ListMounts()
+	if err != nil {
+		return fmt.Errorf("failed to list mounts: %v", err)
+	}
+
+	if _, exists := mounts["transit/"]; exists {
+		return nil
+	}
+
+	// Enable transit engine
+	mountInput := &vault.MountInput{
+		Type: "transit",
+	}
+	if err := client.Sys().Mount("transit", mountInput); err != nil {
+		return fmt.Errorf("failed to mount transit: %v", err)
+	}
+
+	return nil
+}
+
+func cleanupTests(t *testing.T, ctx context.Context, client *vault.Client, keyName string) {
+	updateData := map[string]interface{}{
+		"deletion_allowed": true,
+	}
+	_, err := client.Logical().WriteWithContext(ctx, fmt.Sprintf("transit/keys/%s/config", keyName), updateData)
+	if err != nil {
+		t.Logf("failed to update key config: %v", err)
+	}
+	_, err = client.Logical().DeleteWithContext(ctx, fmt.Sprintf("transit/keys/%s", keyName))
+	if err != nil {
+		t.Logf("failed to delete key: %v", err)
+	}
+}
diff --git a/server/signer/vault_test.go b/server/signer/vault_test.go
new file mode 100644
index 0000000000..f0e0690865
--- /dev/null
+++ b/server/signer/vault_test.go
@@ -0,0 +1,196 @@
+package signer
+
+import (
+	"encoding/json"
+	"os"
+	"testing"
+)
+
+func TestVaultConfigUnmarshalJSON_WithEnvVars(t *testing.T) {
+	// Save original environment variables
+	originalAddr := os.Getenv("VAULT_ADDR")
+	originalToken := os.Getenv("VAULT_TOKEN")
+	defer func() {
+		os.Setenv("VAULT_ADDR", originalAddr)
+		os.Setenv("VAULT_TOKEN", originalToken)
+	}()
+
+	// Set environment variables
+	os.Setenv("VAULT_ADDR", "http://vault.example.com:8200")
+	os.Setenv("VAULT_TOKEN", "s.xxxxxxxxxxxxxxxx")
+
+	tests := []struct {
+		name    string
+		json    string
+		want    VaultConfig
+		wantErr bool
+	}{
+		{
+			name: "empty config uses env vars",
+			json: `{"keyName": "signing-key"}`,
+			want: VaultConfig{
+				Addr:    "http://vault.example.com:8200",
+				Token:   "s.xxxxxxxxxxxxxxxx",
+				KeyName: "signing-key",
+			},
+			wantErr: false,
+		},
+		{
+			name: "config values override env vars",
+			json: `{"addr": "http://custom.vault.com:8200", "token": "s.custom", "keyName": "signing-key"}`,
+			want: VaultConfig{
+				Addr:    "http://custom.vault.com:8200",
+				Token:   "s.custom",
+				KeyName: "signing-key",
+			},
+			wantErr: false,
+		},
+		{
+			name: "partial config uses env vars for missing values",
+			json: `{"addr": "http://custom.vault.com:8200", "keyName": "signing-key"}`,
+			want: VaultConfig{
+				Addr:    "http://custom.vault.com:8200",
+				Token:   "s.xxxxxxxxxxxxxxxx",
+				KeyName: "signing-key",
+			},
+			wantErr: false,
+		},
+		{
+			name: "empty token in config uses env var",
+			json: `{"addr": "http://custom.vault.com:8200", "token": "", "keyName": "signing-key"}`,
+			want: VaultConfig{
+				Addr:    "http://custom.vault.com:8200",
+				Token:   "s.xxxxxxxxxxxxxxxx",
+				KeyName: "signing-key",
+			},
+			wantErr: false,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			var got VaultConfig
+			err := json.Unmarshal([]byte(tt.json), &got)
+
+			if (err != nil) != tt.wantErr {
+				t.Errorf("UnmarshalJSON() error = %v, wantErr %v", err, tt.wantErr)
+				return
+			}
+
+			if got.Addr != tt.want.Addr {
+				t.Errorf("Addr: got %q, want %q", got.Addr, tt.want.Addr)
+			}
+			if got.Token != tt.want.Token {
+				t.Errorf("Token: got %q, want %q", got.Token, tt.want.Token)
+			}
+			if got.KeyName != tt.want.KeyName {
+				t.Errorf("KeyName: got %q, want %q", got.KeyName, tt.want.KeyName)
+			}
+		})
+	}
+}
+
+func TestVaultConfigUnmarshalJSON_WithoutEnvVars(t *testing.T) {
+	// Save original environment variables
+	originalAddr := os.Getenv("VAULT_ADDR")
+	originalToken := os.Getenv("VAULT_TOKEN")
+	defer func() {
+		os.Setenv("VAULT_ADDR", originalAddr)
+		os.Setenv("VAULT_TOKEN", originalToken)
+	}()
+
+	// Unset environment variables
+	os.Unsetenv("VAULT_ADDR")
+	os.Unsetenv("VAULT_TOKEN")
+
+	tests := []struct {
+		name    string
+		json    string
+		want    VaultConfig
+		wantErr bool
+	}{
+		{
+			name: "config values used when env vars not set",
+			json: `{"addr": "http://vault.example.com:8200", "token": "s.xxxxxxxxxxxxxxxx", "keyName": "signing-key"}`,
+			want: VaultConfig{
+				Addr:    "http://vault.example.com:8200",
+				Token:   "s.xxxxxxxxxxxxxxxx",
+				KeyName: "signing-key",
+			},
+			wantErr: false,
+		},
+		{
+			name: "empty config when env vars not set",
+			json: `{"keyName": "signing-key"}`,
+			want: VaultConfig{
+				Addr:    "",
+				Token:   "",
+				KeyName: "signing-key",
+			},
+			wantErr: false,
+		},
+		{
+			name: "only keyName required in config",
+			json: `{"keyName": "my-key"}`,
+			want: VaultConfig{
+				Addr:    "",
+				Token:   "",
+				KeyName: "my-key",
+			},
+			wantErr: false,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			var got VaultConfig
+			err := json.Unmarshal([]byte(tt.json), &got)
+
+			if (err != nil) != tt.wantErr {
+				t.Errorf("UnmarshalJSON() error = %v, wantErr %v", err, tt.wantErr)
+				return
+			}
+
+			if got.Addr != tt.want.Addr {
+				t.Errorf("Addr: got %q, want %q", got.Addr, tt.want.Addr)
+			}
+			if got.Token != tt.want.Token {
+				t.Errorf("Token: got %q, want %q", got.Token, tt.want.Token)
+			}
+			if got.KeyName != tt.want.KeyName {
+				t.Errorf("KeyName: got %q, want %q", got.KeyName, tt.want.KeyName)
+			}
+		})
+	}
+}
+
+func TestVaultConfigUnmarshalJSON_InvalidJSON(t *testing.T) {
+	tests := []struct {
+		name    string
+		json    string
+		wantErr bool
+	}{
+		{
+			name:    "invalid json",
+			json:    `{invalid json}`,
+			wantErr: true,
+		},
+		{
+			name:    "empty json",
+			json:    `{}`,
+			wantErr: false,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			var got VaultConfig
+			err := json.Unmarshal([]byte(tt.json), &got)
+
+			if (err != nil) != tt.wantErr {
+				t.Errorf("UnmarshalJSON() error = %v, wantErr %v", err, tt.wantErr)
+				return
+			}
+		})
+	}
+}
diff --git a/server/templates.go b/server/templates.go
deleted file mode 100644
index 33f00fda36..0000000000
--- a/server/templates.go
+++ /dev/null
@@ -1,362 +0,0 @@
-package server
-
-import (
-	"fmt"
-	"html/template"
-	"io"
-	"io/fs"
-	"net/http"
-	"net/url"
-	"path"
-	"sort"
-	"strings"
-
-	"github.com/Masterminds/sprig/v3"
-)
-
-const (
-	tmplApproval      = "approval.html"
-	tmplLogin         = "login.html"
-	tmplPassword      = "password.html"
-	tmplOOB           = "oob.html"
-	tmplError         = "error.html"
-	tmplDevice        = "device.html"
-	tmplDeviceSuccess = "device_success.html"
-)
-
-var requiredTmpls = []string{
-	tmplApproval,
-	tmplLogin,
-	tmplPassword,
-	tmplOOB,
-	tmplError,
-	tmplDevice,
-	tmplDeviceSuccess,
-}
-
-type templates struct {
-	loginTmpl         *template.Template
-	approvalTmpl      *template.Template
-	passwordTmpl      *template.Template
-	oobTmpl           *template.Template
-	errorTmpl         *template.Template
-	deviceTmpl        *template.Template
-	deviceSuccessTmpl *template.Template
-}
-
-type webConfig struct {
-	webFS     fs.FS
-	logoURL   string
-	issuer    string
-	theme     string
-	issuerURL string
-	extra     map[string]string
-}
-
-func getFuncMap(c webConfig) (template.FuncMap, error) {
-	funcs := sprig.FuncMap()
-
-	issuerURL, err := url.Parse(c.issuerURL)
-	if err != nil {
-		return nil, fmt.Errorf("error parsing issuerURL: %v", err)
-	}
-
-	additionalFuncs := map[string]interface{}{
-		"extra":  func(k string) string { return c.extra[k] },
-		"issuer": func() string { return c.issuer },
-		"logo":   func() string { return c.logoURL },
-		"url": func(reqPath, assetPath string) string {
-			return relativeURL(issuerURL.Path, reqPath, assetPath)
-		},
-	}
-
-	for k, v := range additionalFuncs {
-		funcs[k] = v
-	}
-
-	return funcs, nil
-}
-
-// loadWebConfig returns static assets, theme assets, and templates used by the frontend by
-// reading the dir specified in the webConfig. If directory is not specified it will
-// use the file system specified by webFS.
-//
-// The directory layout is expected to be:
-//
-//    ( web directory )
-//    |- static
-//    |- themes
-//    |  |- (theme name)
-//    |- templates
-//
-func loadWebConfig(c webConfig) (http.Handler, http.Handler, *templates, error) {
-	// fallback to the default theme if the legacy theme name is provided
-	if c.theme == "coreos" || c.theme == "tectonic" {
-		c.theme = ""
-	}
-	if c.theme == "" {
-		c.theme = "light"
-	}
-	if c.issuer == "" {
-		c.issuer = "dex"
-	}
-	if c.logoURL == "" {
-		c.logoURL = "theme/logo.png"
-	}
-
-	staticFiles, err := fs.Sub(c.webFS, "static")
-	if err != nil {
-		return nil, nil, nil, fmt.Errorf("read static dir: %v", err)
-	}
-	themeFiles, err := fs.Sub(c.webFS, path.Join("themes", c.theme))
-	if err != nil {
-		return nil, nil, nil, fmt.Errorf("read themes dir: %v", err)
-	}
-
-	static := http.FileServer(http.FS(staticFiles))
-	theme := http.FileServer(http.FS(themeFiles))
-
-	templates, err := loadTemplates(c, "templates")
-	return static, theme, templates, err
-}
-
-// loadTemplates parses the expected templates from the provided directory.
-func loadTemplates(c webConfig, templatesDir string) (*templates, error) {
-	files, err := fs.ReadDir(c.webFS, templatesDir)
-	if err != nil {
-		return nil, fmt.Errorf("read dir: %v", err)
-	}
-
-	filenames := []string{}
-	for _, file := range files {
-		if file.IsDir() {
-			continue
-		}
-		filenames = append(filenames, path.Join(templatesDir, file.Name()))
-	}
-	if len(filenames) == 0 {
-		return nil, fmt.Errorf("no files in template dir %q", templatesDir)
-	}
-
-	funcs, err := getFuncMap(c)
-	if err != nil {
-		return nil, err
-	}
-
-	tmpls, err := template.New("").Funcs(funcs).ParseFS(c.webFS, filenames...)
-	if err != nil {
-		return nil, fmt.Errorf("parse files: %v", err)
-	}
-	missingTmpls := []string{}
-	for _, tmplName := range requiredTmpls {
-		if tmpls.Lookup(tmplName) == nil {
-			missingTmpls = append(missingTmpls, tmplName)
-		}
-	}
-	if len(missingTmpls) > 0 {
-		return nil, fmt.Errorf("missing template(s): %s", missingTmpls)
-	}
-	return &templates{
-		loginTmpl:         tmpls.Lookup(tmplLogin),
-		approvalTmpl:      tmpls.Lookup(tmplApproval),
-		passwordTmpl:      tmpls.Lookup(tmplPassword),
-		oobTmpl:           tmpls.Lookup(tmplOOB),
-		errorTmpl:         tmpls.Lookup(tmplError),
-		deviceTmpl:        tmpls.Lookup(tmplDevice),
-		deviceSuccessTmpl: tmpls.Lookup(tmplDeviceSuccess),
-	}, nil
-}
-
-// relativeURL returns the URL of the asset relative to the URL of the request path.
-// The serverPath is consulted to trim any prefix due in case it is not listening
-// to the root path.
-//
-// Algorithm:
-// 1. Remove common prefix of serverPath and reqPath
-// 2. Remove common prefix of assetPath and reqPath
-// 3. For each part of reqPath remaining(minus one), go up one level (..)
-// 4. For each part of assetPath remaining, append it to result
-//
-// eg
-// server listens at localhost/dex so serverPath is dex
-// reqPath is /dex/auth
-// assetPath is static/main.css
-// relativeURL("/dex", "/dex/auth", "static/main.css") = "../static/main.css"
-func relativeURL(serverPath, reqPath, assetPath string) string {
-	if u, err := url.ParseRequestURI(assetPath); err == nil && u.Scheme != "" {
-		// assetPath points to the external URL, no changes needed
-		return assetPath
-	}
-
-	splitPath := func(p string) []string {
-		res := []string{}
-		parts := strings.Split(path.Clean(p), "/")
-		for _, part := range parts {
-			if part != "" {
-				res = append(res, part)
-			}
-		}
-		return res
-	}
-
-	stripCommonParts := func(s1, s2 []string) ([]string, []string) {
-		min := len(s1)
-		if len(s2) < min {
-			min = len(s2)
-		}
-
-		splitIndex := min
-		for i := 0; i < min; i++ {
-			if s1[i] != s2[i] {
-				splitIndex = i
-				break
-			}
-		}
-		return s1[splitIndex:], s2[splitIndex:]
-	}
-
-	server, req, asset := splitPath(serverPath), splitPath(reqPath), splitPath(assetPath)
-
-	// Remove common prefix of request path with server path
-	_, req = stripCommonParts(server, req)
-
-	// Remove common prefix of request path with asset path
-	asset, req = stripCommonParts(asset, req)
-
-	// For each part of the request remaining (minus one) -> go up one level (..)
-	// For each part of the asset remaining               -> append it
-	var relativeURL string
-	for i := 0; i < len(req)-1; i++ {
-		relativeURL = path.Join("..", relativeURL)
-	}
-	relativeURL = path.Join(relativeURL, path.Join(asset...))
-
-	return relativeURL
-}
-
-var scopeDescriptions = map[string]string{
-	"offline_access": "Have offline access",
-	"profile":        "View basic profile information",
-	"email":          "View your email address",
-	// 'groups' is not a standard OIDC scope, and Dex only returns groups only if the upstream provider does too.
-	// This warning is added for convenience to show that the user may expose some sensitive data to the application.
-	"groups": "View your groups",
-}
-
-type connectorInfo struct {
-	ID   string
-	Name string
-	URL  template.URL
-	Type string
-}
-
-type byName []connectorInfo
-
-func (n byName) Len() int           { return len(n) }
-func (n byName) Less(i, j int) bool { return n[i].Name < n[j].Name }
-func (n byName) Swap(i, j int)      { n[i], n[j] = n[j], n[i] }
-
-func (t *templates) device(r *http.Request, w http.ResponseWriter, postURL string, userCode string, lastWasInvalid bool) error {
-	if lastWasInvalid {
-		w.WriteHeader(http.StatusBadRequest)
-	}
-	data := struct {
-		PostURL  string
-		UserCode string
-		Invalid  bool
-		ReqPath  string
-	}{postURL, userCode, lastWasInvalid, r.URL.Path}
-	return renderTemplate(w, t.deviceTmpl, data)
-}
-
-func (t *templates) deviceSuccess(r *http.Request, w http.ResponseWriter, clientName string) error {
-	data := struct {
-		ClientName string
-		ReqPath    string
-	}{clientName, r.URL.Path}
-	return renderTemplate(w, t.deviceSuccessTmpl, data)
-}
-
-func (t *templates) login(r *http.Request, w http.ResponseWriter, connectors []connectorInfo) error {
-	sort.Sort(byName(connectors))
-	data := struct {
-		Connectors []connectorInfo
-		ReqPath    string
-	}{connectors, r.URL.Path}
-	return renderTemplate(w, t.loginTmpl, data)
-}
-
-func (t *templates) password(r *http.Request, w http.ResponseWriter, postURL, lastUsername, usernamePrompt string, lastWasInvalid bool, backLink string) error {
-	data := struct {
-		PostURL        string
-		BackLink       string
-		Username       string
-		UsernamePrompt string
-		Invalid        bool
-		ReqPath        string
-	}{postURL, backLink, lastUsername, usernamePrompt, lastWasInvalid, r.URL.Path}
-	return renderTemplate(w, t.passwordTmpl, data)
-}
-
-func (t *templates) approval(r *http.Request, w http.ResponseWriter, authReqID, username, clientName string, scopes []string) error {
-	accesses := []string{}
-	for _, scope := range scopes {
-		access, ok := scopeDescriptions[scope]
-		if ok {
-			accesses = append(accesses, access)
-		}
-	}
-	sort.Strings(accesses)
-	data := struct {
-		User      string
-		Client    string
-		AuthReqID string
-		Scopes    []string
-		ReqPath   string
-	}{username, clientName, authReqID, accesses, r.URL.Path}
-	return renderTemplate(w, t.approvalTmpl, data)
-}
-
-func (t *templates) oob(r *http.Request, w http.ResponseWriter, code string) error {
-	data := struct {
-		Code    string
-		ReqPath string
-	}{code, r.URL.Path}
-	return renderTemplate(w, t.oobTmpl, data)
-}
-
-func (t *templates) err(r *http.Request, w http.ResponseWriter, errCode int, errMsg string) error {
-	w.WriteHeader(errCode)
-	data := struct {
-		ErrType string
-		ErrMsg  string
-		ReqPath string
-	}{http.StatusText(errCode), errMsg, r.URL.Path}
-	if err := t.errorTmpl.Execute(w, data); err != nil {
-		return fmt.Errorf("rendering template %s failed: %s", t.errorTmpl.Name(), err)
-	}
-	return nil
-}
-
-// small io.Writer utility to determine if executing the template wrote to the underlying response writer.
-type writeRecorder struct {
-	wrote bool
-	w     io.Writer
-}
-
-func (w *writeRecorder) Write(p []byte) (n int, err error) {
-	w.wrote = true
-	return w.w.Write(p)
-}
-
-func renderTemplate(w http.ResponseWriter, tmpl *template.Template, data interface{}) error {
-	wr := &writeRecorder{w: w}
-	if err := tmpl.Execute(wr, data); err != nil {
-		if !wr.wrote {
-			// TODO(ericchiang): replace with better internal server error.
-			http.Error(w, "Internal server error", http.StatusInternalServerError)
-		}
-		return fmt.Errorf("rendering template %s failed: %s", tmpl.Name(), err)
-	}
-	return nil
-}
diff --git a/server/templates/doc.go b/server/templates/doc.go
new file mode 100644
index 0000000000..265f4e4904
--- /dev/null
+++ b/server/templates/doc.go
@@ -0,0 +1,4 @@
+// Package templates renders dex's HTML pages — login, connector selection,
+// approval, out-of-band code, device flow, MFA (TOTP and WebAuthn), the landing
+// page, and error pages.
+package templates
diff --git a/server/templates/templates.go b/server/templates/templates.go
new file mode 100644
index 0000000000..cc5e3dd184
--- /dev/null
+++ b/server/templates/templates.go
@@ -0,0 +1,497 @@
+package templates
+
+import (
+	"cmp"
+	"fmt"
+	"html/template"
+	"io"
+	"io/fs"
+	"log/slog"
+	"net/http"
+	"net/url"
+	"path"
+	"slices"
+	"sort"
+	"strings"
+
+	"github.com/Masterminds/sprig/v3"
+)
+
+const (
+	tmplApproval       = "approval.html"
+	tmplLogin          = "login.html"
+	tmplPassword       = "password.html"
+	tmplOOB            = "oob.html"
+	tmplError          = "error.html"
+	tmplDevice         = "device.html"
+	tmplDeviceSuccess  = "device_success.html"
+	tmplTOTPVerify     = "totp_verify.html"
+	tmplWebAuthnVerify = "webauthn_verify.html"
+	tmplHome           = "home.html"
+	tmplLogout         = "logout.html"
+)
+
+var requiredTmpls = []string{
+	tmplApproval,
+	tmplLogin,
+	tmplPassword,
+	tmplOOB,
+	tmplError,
+	tmplDevice,
+	tmplDeviceSuccess,
+	tmplTOTPVerify,
+	tmplWebAuthnVerify,
+	tmplHome,
+	tmplLogout,
+}
+
+type Templates struct {
+	loginTmpl          *template.Template
+	approvalTmpl       *template.Template
+	passwordTmpl       *template.Template
+	oobTmpl            *template.Template
+	errorTmpl          *template.Template
+	deviceTmpl         *template.Template
+	deviceSuccessTmpl  *template.Template
+	totpVerifyTmpl     *template.Template
+	webauthnVerifyTmpl *template.Template
+	homeTmpl           *template.Template
+	logoutTmpl         *template.Template
+}
+
+type Config struct {
+	WebFS     fs.FS
+	LogoURL   string
+	Issuer    string
+	Theme     string
+	IssuerURL string
+	Extra     map[string]string
+}
+
+func getFuncMap(c Config) (template.FuncMap, error) {
+	funcs := sprig.FuncMap()
+
+	issuerURL, err := url.Parse(c.IssuerURL)
+	if err != nil {
+		return nil, fmt.Errorf("error parsing issuerURL: %v", err)
+	}
+
+	additionalFuncs := map[string]interface{}{
+		"extra":  func(k string) string { return c.Extra[k] },
+		"issuer": func() string { return c.Issuer },
+		"logo":   func() string { return c.LogoURL },
+		"url": func(reqPath, assetPath string) string {
+			return relativeURL(issuerURL.Path, reqPath, assetPath)
+		},
+	}
+
+	for k, v := range additionalFuncs {
+		funcs[k] = v
+	}
+
+	return funcs, nil
+}
+
+// loadWebConfig returns static assets, theme assets, and templates used by the frontend by
+// reading the dir specified in the webConfig. If directory is not specified it will
+// use the file system specified by webFS.
+//
+// The directory layout is expected to be:
+//
+//	( web directory )
+//	|- static
+//	|- themes
+//	|  |- (theme name)
+//	|- templates
+func LoadWebConfig(c Config) (http.Handler, http.Handler, http.HandlerFunc, *Templates, error) {
+	// fallback to the default theme if the legacy theme name is provided
+	if c.Theme == "coreos" || c.Theme == "tectonic" {
+		c.Theme = ""
+	}
+	if c.Theme == "" {
+		c.Theme = "light"
+	}
+	if c.Issuer == "" {
+		c.Issuer = "dex"
+	}
+	if c.LogoURL == "" {
+		c.LogoURL = "theme/logo.png"
+	}
+
+	staticFiles, err := fs.Sub(c.WebFS, "static")
+	if err != nil {
+		return nil, nil, nil, nil, fmt.Errorf("read static dir: %v", err)
+	}
+	themeFiles, err := fs.Sub(c.WebFS, path.Join("themes", c.Theme))
+	if err != nil {
+		return nil, nil, nil, nil, fmt.Errorf("read themes dir: %v", err)
+	}
+	robotsContent, err := fs.ReadFile(c.WebFS, "robots.txt")
+	if err != nil {
+		return nil, nil, nil, nil, fmt.Errorf("read robots.txt dir: %v", err)
+	}
+
+	static := http.FileServer(http.FS(staticFiles))
+	theme := http.FileServer(http.FS(themeFiles))
+	robots := func(w http.ResponseWriter, r *http.Request) { fmt.Fprint(w, string(robotsContent)) }
+
+	templates, err := loadTemplates(c, "templates")
+
+	return static, theme, robots, templates, err
+}
+
+// loadTemplates parses the expected templates from the provided directory.
+func loadTemplates(c Config, templatesDir string) (*Templates, error) {
+	files, err := fs.ReadDir(c.WebFS, templatesDir)
+	if err != nil {
+		return nil, fmt.Errorf("read dir: %v", err)
+	}
+
+	filenames := []string{}
+	for _, file := range files {
+		if file.IsDir() {
+			continue
+		}
+		filenames = append(filenames, path.Join(templatesDir, file.Name()))
+	}
+	if len(filenames) == 0 {
+		return nil, fmt.Errorf("no files in template dir %q", templatesDir)
+	}
+
+	funcs, err := getFuncMap(c)
+	if err != nil {
+		return nil, err
+	}
+
+	tmpls, err := template.New("").Funcs(funcs).ParseFS(c.WebFS, filenames...)
+	if err != nil {
+		return nil, fmt.Errorf("parse files: %v", err)
+	}
+	missingTmpls := []string{}
+	for _, tmplName := range requiredTmpls {
+		if tmpls.Lookup(tmplName) == nil {
+			missingTmpls = append(missingTmpls, tmplName)
+		}
+	}
+	if len(missingTmpls) > 0 {
+		return nil, fmt.Errorf("missing template(s): %s", missingTmpls)
+	}
+	return &Templates{
+		loginTmpl:          tmpls.Lookup(tmplLogin),
+		approvalTmpl:       tmpls.Lookup(tmplApproval),
+		passwordTmpl:       tmpls.Lookup(tmplPassword),
+		oobTmpl:            tmpls.Lookup(tmplOOB),
+		errorTmpl:          tmpls.Lookup(tmplError),
+		deviceTmpl:         tmpls.Lookup(tmplDevice),
+		deviceSuccessTmpl:  tmpls.Lookup(tmplDeviceSuccess),
+		totpVerifyTmpl:     tmpls.Lookup(tmplTOTPVerify),
+		webauthnVerifyTmpl: tmpls.Lookup(tmplWebAuthnVerify),
+		homeTmpl:           tmpls.Lookup(tmplHome),
+		logoutTmpl:         tmpls.Lookup(tmplLogout),
+	}, nil
+}
+
+// relativeURL returns the URL of the asset relative to the URL of the request path.
+// The serverPath is consulted to trim any prefix due in case it is not listening
+// to the root path.
+//
+// Algorithm:
+// 1. Remove common prefix of serverPath and reqPath
+// 2. Remove common prefix of assetPath and reqPath
+// 3. For each part of reqPath remaining(minus one), go up one level (..)
+// 4. For each part of assetPath remaining, append it to result
+//
+// eg
+// server listens at localhost/dex so serverPath is dex
+// reqPath is /dex/auth
+// assetPath is static/main.css
+// relativeURL("/dex", "/dex/auth", "static/main.css") = "../static/main.css"
+func relativeURL(serverPath, reqPath, assetPath string) string {
+	if u, err := url.ParseRequestURI(assetPath); err == nil && u.Scheme != "" {
+		// assetPath points to the external URL, no changes needed
+		return assetPath
+	}
+
+	splitPath := func(p string) []string {
+		res := []string{}
+		parts := strings.Split(path.Clean(p), "/")
+		for _, part := range parts {
+			if part != "" {
+				res = append(res, part)
+			}
+		}
+		return res
+	}
+
+	stripCommonParts := func(s1, s2 []string) ([]string, []string) {
+		min := len(s1)
+		if len(s2) < min {
+			min = len(s2)
+		}
+
+		splitIndex := min
+		for i := 0; i < min; i++ {
+			if s1[i] != s2[i] {
+				splitIndex = i
+				break
+			}
+		}
+		return s1[splitIndex:], s2[splitIndex:]
+	}
+
+	server, req, asset := splitPath(serverPath), splitPath(reqPath), splitPath(assetPath)
+
+	// Remove common prefix of request path with server path
+	_, req = stripCommonParts(server, req)
+
+	// When the request is at the server root (e.g., reqPath == "/dex"),
+	// the browser treats the last path segment as a file, not a directory.
+	// Prepend the server path so relative URLs resolve correctly.
+	if len(req) == 0 && len(server) > 0 {
+		asset = append(server, asset...)
+	}
+
+	// Remove common prefix of request path with asset path
+	asset, req = stripCommonParts(asset, req)
+
+	// For each part of the request remaining (minus one) -> go up one level (..)
+	// For each part of the asset remaining               -> append it
+	var relativeURL string
+	for i := 0; i < len(req)-1; i++ {
+		relativeURL = path.Join("..", relativeURL)
+	}
+	relativeURL = path.Join(relativeURL, path.Join(asset...))
+
+	return relativeURL
+}
+
+var scopeDescriptions = map[string]string{
+	"offline_access": "Have offline access",
+	"profile":        "View basic profile information",
+	"email":          "View your email address",
+	// 'groups' is not a standard OIDC scope, and Dex only returns groups only if the upstream provider does too.
+	// This warning is added for convenience to show that the user may expose some sensitive data to the application.
+	"groups": "View your groups",
+}
+
+type ConnectorInfo struct {
+	ID   string
+	Name string
+	URL  template.URL
+	Type string
+}
+
+// sortConnectors orders the login screen the way a reader scans it, which is
+// not the way bytes compare: "okta" sorting after "Zendesk" is an artifact of
+// capital letters coming first in ASCII, and connector names are whatever the
+// operator typed. Names that differ only in case keep a stable order.
+func sortConnectors(connectors []ConnectorInfo) {
+	slices.SortStableFunc(connectors, func(a, b ConnectorInfo) int {
+		return cmp.Compare(strings.ToLower(a.Name), strings.ToLower(b.Name))
+	})
+}
+
+func (t *Templates) Device(r *http.Request, w http.ResponseWriter, postURL string, userCode string, lastWasInvalid bool) error {
+	if lastWasInvalid {
+		w.WriteHeader(http.StatusBadRequest)
+	}
+	data := struct {
+		PostURL  string
+		UserCode string
+		Invalid  bool
+		ReqPath  string
+	}{postURL, userCode, lastWasInvalid, r.URL.Path}
+	return renderTemplate(w, t.deviceTmpl, data)
+}
+
+func (t *Templates) DeviceSuccess(r *http.Request, w http.ResponseWriter, clientName string) error {
+	data := struct {
+		ClientName string
+		ReqPath    string
+	}{clientName, r.URL.Path}
+	return renderTemplate(w, t.deviceSuccessTmpl, data)
+}
+
+func (t *Templates) Login(r *http.Request, w http.ResponseWriter, connectors []ConnectorInfo) error {
+	sortConnectors(connectors)
+	data := struct {
+		Connectors []ConnectorInfo
+		ReqPath    string
+	}{connectors, r.URL.Path}
+	return renderTemplate(w, t.loginTmpl, data)
+}
+
+func (t *Templates) Password(r *http.Request, w http.ResponseWriter, postURL, lastUsername, usernamePrompt string, lastWasInvalid bool, backLink string, rememberMe *bool) error {
+	if lastWasInvalid {
+		w.WriteHeader(http.StatusUnauthorized)
+	}
+	data := struct {
+		PostURL           string
+		BackLink          string
+		Username          string
+		UsernamePrompt    string
+		Invalid           bool
+		ReqPath           string
+		ShowRememberMe    bool
+		RememberMeChecked bool
+	}{
+		PostURL:        postURL,
+		BackLink:       backLink,
+		Username:       lastUsername,
+		UsernamePrompt: usernamePrompt,
+		Invalid:        lastWasInvalid,
+		ReqPath:        r.URL.Path,
+		ShowRememberMe: rememberMe != nil,
+	}
+	if rememberMe != nil {
+		data.RememberMeChecked = *rememberMe
+	}
+	return renderTemplate(w, t.passwordTmpl, data)
+}
+
+func (t *Templates) Approval(r *http.Request, w http.ResponseWriter, authReqID, username, clientName string, scopes []string) error {
+	accesses := []string{}
+	for _, scope := range scopes {
+		access, ok := scopeDescriptions[scope]
+		if ok {
+			accesses = append(accesses, access)
+		}
+	}
+	sort.Strings(accesses)
+	data := struct {
+		User      string
+		Client    string
+		AuthReqID string
+		Scopes    []string
+		ReqPath   string
+	}{username, clientName, authReqID, accesses, r.URL.Path}
+	return renderTemplate(w, t.approvalTmpl, data)
+}
+
+func (t *Templates) TOTPVerify(r *http.Request, w http.ResponseWriter, postURL, issuer, connector, qrCode string, lastWasInvalid bool) error {
+	if lastWasInvalid {
+		w.WriteHeader(http.StatusUnauthorized)
+	}
+	data := struct {
+		PostURL   string
+		Invalid   bool
+		Issuer    string
+		Connector string
+		QRCode    string
+		ReqPath   string
+	}{postURL, lastWasInvalid, issuer, connector, qrCode, r.URL.Path}
+	return renderTemplate(w, t.totpVerifyTmpl, data)
+}
+
+type HomeData struct {
+	LoggedIn      bool
+	Username      string
+	Email         string
+	EmailVerified bool
+	Groups        []string
+	ConnectorName string
+	// Each timestamp reaches the page twice: ISO for the <time> element's
+	// datetime attribute, which the page's script reads and restates in the
+	// visitor's timezone, and Text as the UTC rendering shown until (or unless)
+	// that script runs. Empty means the row is omitted.
+	//
+	// SignedIn is when this session began, not the identity's last login: the
+	// page describes one session, and the identity's last login moves when the
+	// same user signs in from somewhere else entirely.
+	SignedInISO        string
+	SignedInText       string
+	SessionExpiresISO  string
+	SessionExpiresText string
+	// SessionExpiryIsIdle says SessionExpiresEpoch is the idle timeout rather
+	// than the absolute one, so the page can say the deadline slides.
+	SessionExpiryIsIdle bool
+	IPAddress           string
+	UserAgent           string
+	LogoutURL           string
+	DiscoveryURL        string
+	ReqPath             string
+}
+
+// HasHome reports whether the home template was loaded.
+func (t *Templates) HasHome() bool {
+	return t.homeTmpl != nil
+}
+
+func (t *Templates) Home(r *http.Request, w http.ResponseWriter, data HomeData) error {
+	data.ReqPath = r.URL.Path
+	return renderTemplate(w, t.homeTmpl, data)
+}
+
+func (t *Templates) Logout(r *http.Request, w http.ResponseWriter, backURL string, loggedOut bool, showConfirmation bool) error {
+	data := struct {
+		BackURL          string
+		LoggedOut        bool
+		ShowConfirmation bool
+		ReqPath          string
+	}{backURL, loggedOut, showConfirmation, r.URL.Path}
+	return renderTemplate(w, t.logoutTmpl, data)
+}
+
+func (t *Templates) WebAuthnVerify(r *http.Request, w http.ResponseWriter, mode, authenticatorID string) error {
+	data := struct {
+		// Mode must be server-controlled ("register" or "login") and never derived
+		// from user input to prevent XSS in the template's script context.
+		Mode            string
+		AuthenticatorID string
+		ReqPath         string
+	}{mode, authenticatorID, r.URL.Path}
+	return renderTemplate(w, t.webauthnVerifyTmpl, data)
+}
+
+func (t *Templates) OOB(r *http.Request, w http.ResponseWriter, code string) error {
+	data := struct {
+		Code    string
+		ReqPath string
+	}{code, r.URL.Path}
+	return renderTemplate(w, t.oobTmpl, data)
+}
+
+// RenderError renders the user-facing error page and reports a template failure
+// to the logger. Every domain handler's renderError delegates here, so the
+// error page and the way a failed render is reported stay in one place.
+func RenderError(t *Templates, logger *slog.Logger, r *http.Request, w http.ResponseWriter, status int, description string) {
+	if err := t.Err(r, w, status, description); err != nil {
+		logger.ErrorContext(r.Context(), "server template error", "err", err)
+	}
+}
+
+func (t *Templates) Err(r *http.Request, w http.ResponseWriter, errCode int, errMsg string) error {
+	w.WriteHeader(errCode)
+	data := struct {
+		ErrType string
+		ErrMsg  string
+		ReqPath string
+	}{http.StatusText(errCode), errMsg, r.URL.Path}
+	if err := t.errorTmpl.Execute(w, data); err != nil {
+		return fmt.Errorf("rendering template %s failed: %s", t.errorTmpl.Name(), err)
+	}
+	return nil
+}
+
+// small io.Writer utility to determine if executing the template wrote to the underlying response writer.
+type writeRecorder struct {
+	wrote bool
+	w     io.Writer
+}
+
+func (w *writeRecorder) Write(p []byte) (n int, err error) {
+	w.wrote = true
+	return w.w.Write(p)
+}
+
+func renderTemplate(w http.ResponseWriter, tmpl *template.Template, data interface{}) error {
+	wr := &writeRecorder{w: w}
+	if err := tmpl.Execute(wr, data); err != nil {
+		if !wr.wrote {
+			// TODO(ericchiang): replace with better internal server error.
+			http.Error(w, "Internal server error", http.StatusInternalServerError)
+		}
+		return fmt.Errorf("rendering template %s failed: %s", tmpl.Name(), err)
+	}
+	return nil
+}
diff --git a/server/templates/templates_test.go b/server/templates/templates_test.go
new file mode 100644
index 0000000000..eb2d54b381
--- /dev/null
+++ b/server/templates/templates_test.go
@@ -0,0 +1,106 @@
+package templates
+
+import "testing"
+
+func TestRelativeURL(t *testing.T) {
+	tests := []struct {
+		name       string
+		serverPath string
+		reqPath    string
+		assetPath  string
+		expected   string
+	}{
+		{
+			name:       "server-root-req-one-level-asset-two-level",
+			serverPath: "/",
+			reqPath:    "/auth",
+			assetPath:  "/theme/main.css",
+			expected:   "theme/main.css",
+		},
+		{
+			name:       "server-one-level-req-one-level-asset-two-level",
+			serverPath: "/dex",
+			reqPath:    "/dex/auth",
+			assetPath:  "/theme/main.css",
+			expected:   "theme/main.css",
+		},
+		{
+			name:       "server-root-req-two-level-asset-three-level",
+			serverPath: "/dex",
+			reqPath:    "/dex/auth/connector",
+			assetPath:  "assets/css/main.css",
+			expected:   "../assets/css/main.css",
+		},
+		{
+			name:       "server-root-page",
+			serverPath: "/dex",
+			reqPath:    "/dex",
+			assetPath:  "static/main.css",
+			expected:   "dex/static/main.css",
+		},
+		{
+			name:       "server-root-page-nested",
+			serverPath: "/dex/idp",
+			reqPath:    "/dex/idp",
+			assetPath:  "theme/styles.css",
+			expected:   "dex/idp/theme/styles.css",
+		},
+		{
+			name:       "server-root-no-subpath",
+			serverPath: "/",
+			reqPath:    "/",
+			assetPath:  "static/main.css",
+			expected:   "static/main.css",
+		},
+		{
+			name:       "external-url",
+			serverPath: "/dex",
+			reqPath:    "/dex/auth/connector",
+			assetPath:  "https://kubernetes.io/images/favicon.png",
+			expected:   "https://kubernetes.io/images/favicon.png",
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			actual := relativeURL(test.serverPath, test.reqPath, test.assetPath)
+			if actual != test.expected {
+				t.Fatalf("Got '%s'. Expected '%s'", actual, test.expected)
+			}
+		})
+	}
+}
+
+func TestSortConnectors(t *testing.T) {
+	connectors := []ConnectorInfo{
+		{ID: "keycloak", Name: "keycloak"},
+		{ID: "okta", Name: "Okta"},
+		{ID: "azure", Name: "azure ad"},
+		{ID: "google", Name: "Google"},
+	}
+
+	sortConnectors(connectors)
+
+	// Byte order would have put both lowercase names below both capitalised
+	// ones, which is a property of ASCII rather than of anything the operator
+	// meant by naming a connector.
+	expected := []string{"azure ad", "Google", "keycloak", "Okta"}
+	for i, name := range expected {
+		if connectors[i].Name != name {
+			t.Fatalf("position %d: got %q, expected %q", i, connectors[i].Name, name)
+		}
+	}
+}
+
+func TestSortConnectorsKeepsCaseVariantsStable(t *testing.T) {
+	connectors := []ConnectorInfo{
+		{ID: "second", Name: "SSO"},
+		{ID: "first", Name: "sso"},
+	}
+
+	sortConnectors(connectors)
+
+	if connectors[0].ID != "second" || connectors[1].ID != "first" {
+		t.Fatalf("names differing only in case were reordered: %q, %q", connectors[0].ID, connectors[1].ID)
+	}
+}
diff --git a/server/templates_test.go b/server/templates_test.go
deleted file mode 100644
index defb2e5e7d..0000000000
--- a/server/templates_test.go
+++ /dev/null
@@ -1,51 +0,0 @@
-package server
-
-import "testing"
-
-func TestRelativeURL(t *testing.T) {
-	tests := []struct {
-		name       string
-		serverPath string
-		reqPath    string
-		assetPath  string
-		expected   string
-	}{
-		{
-			name:       "server-root-req-one-level-asset-two-level",
-			serverPath: "/",
-			reqPath:    "/auth",
-			assetPath:  "/theme/main.css",
-			expected:   "theme/main.css",
-		},
-		{
-			name:       "server-one-level-req-one-level-asset-two-level",
-			serverPath: "/dex",
-			reqPath:    "/dex/auth",
-			assetPath:  "/theme/main.css",
-			expected:   "theme/main.css",
-		},
-		{
-			name:       "server-root-req-two-level-asset-three-level",
-			serverPath: "/dex",
-			reqPath:    "/dex/auth/connector",
-			assetPath:  "assets/css/main.css",
-			expected:   "../assets/css/main.css",
-		},
-		{
-			name:       "external-url",
-			serverPath: "/dex",
-			reqPath:    "/dex/auth/connector",
-			assetPath:  "https://kubernetes.io/images/favicon.png",
-			expected:   "https://kubernetes.io/images/favicon.png",
-		},
-	}
-
-	for _, test := range tests {
-		t.Run(test.name, func(t *testing.T) {
-			actual := relativeURL(test.serverPath, test.reqPath, test.assetPath)
-			if actual != test.expected {
-				t.Fatalf("Got '%s'. Expected '%s'", actual, test.expected)
-			}
-		})
-	}
-}
diff --git a/server/tokens/authorization.go b/server/tokens/authorization.go
new file mode 100644
index 0000000000..385102659b
--- /dev/null
+++ b/server/tokens/authorization.go
@@ -0,0 +1,77 @@
+package tokens
+
+import (
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"strconv"
+	"time"
+
+	"github.com/dexidp/dex/storage"
+)
+
+// Authorization is the result of any grant: an authenticated subject and the
+// permission it grants a client. The issuer turns an Authorization into a TokenSet.
+type Authorization struct {
+	Client        storage.Client
+	Claims        storage.Claims
+	Scopes        []string
+	ConnectorID   string
+	Nonce         string
+	AuthTime      time.Time
+	ConnectorData []byte
+
+	// SessionID is the browser session this authorization belongs to, emitted as
+	// the "sid" claim. Only the flows that actually pass through a browser set it.
+	// Resolving it from the user's identity instead would attach whatever session
+	// that user happens to have open to tokens minted by the password, token
+	// exchange and client credentials grants — none of which joined it.
+	SessionID string
+}
+
+// TokenSet is what the /token endpoint returns for an Authorization.
+type TokenSet struct {
+	AccessToken  string
+	IDToken      string
+	RefreshToken string
+	Expiry       time.Time
+}
+
+type Response struct {
+	AccessToken     string `json:"access_token"`
+	IssuedTokenType string `json:"issued_token_type,omitempty"`
+	TokenType       string `json:"token_type"`
+	ExpiresIn       int    `json:"expires_in,omitempty"`
+	RefreshToken    string `json:"refresh_token,omitempty"`
+	IDToken         string `json:"id_token,omitempty"`
+	Scope           string `json:"scope,omitempty"`
+}
+
+// Response renders the token set as an OAuth2 token response as of now, filling
+// in the bearer token type and the relative expiry. Grant-specific fields
+// (IssuedTokenType, Scope) are left to the caller.
+func (ts TokenSet) Response(now time.Time) Response {
+	return Response{
+		AccessToken:  ts.AccessToken,
+		TokenType:    "bearer",
+		ExpiresIn:    int(ts.Expiry.Sub(now).Seconds()),
+		RefreshToken: ts.RefreshToken,
+		IDToken:      ts.IDToken,
+	}
+}
+
+// Write marshals the response and writes it with the required OAuth2 cache
+// headers (https://tools.ietf.org/html/rfc6749#section-5.1).
+func (r Response) Write(w http.ResponseWriter) error {
+	data, err := json.Marshal(r)
+	if err != nil {
+		return fmt.Errorf("marshal token response: %w", err)
+	}
+
+	w.Header().Set("Content-Type", "application/json")
+	w.Header().Set("Content-Length", strconv.Itoa(len(data)))
+	w.Header().Set("Cache-Control", "no-store")
+	w.Header().Set("Pragma", "no-cache")
+	w.Write(data)
+	return nil
+}
diff --git a/server/tokens/authorization_test.go b/server/tokens/authorization_test.go
new file mode 100644
index 0000000000..70552323b6
--- /dev/null
+++ b/server/tokens/authorization_test.go
@@ -0,0 +1,51 @@
+package tokens
+
+import (
+	"encoding/json"
+	"net/http/httptest"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestTokenSetResponse(t *testing.T) {
+	now := time.Unix(1000, 0)
+	ts := TokenSet{
+		AccessToken:  "at",
+		IDToken:      "id",
+		RefreshToken: "rt",
+		Expiry:       now.Add(time.Hour),
+	}
+
+	resp := ts.Response(now)
+	require.Equal(t, "at", resp.AccessToken)
+	require.Equal(t, "id", resp.IDToken)
+	require.Equal(t, "rt", resp.RefreshToken)
+	require.Equal(t, "bearer", resp.TokenType)
+	require.Equal(t, 3600, resp.ExpiresIn)
+	// Grant-specific fields are left unset.
+	require.Empty(t, resp.IssuedTokenType)
+	require.Empty(t, resp.Scope)
+}
+
+func TestResponseWrite(t *testing.T) {
+	resp := Response{AccessToken: "at", TokenType: "bearer", ExpiresIn: 3600, IDToken: "id"}
+
+	rec := httptest.NewRecorder()
+	require.NoError(t, resp.Write(rec))
+
+	require.Equal(t, "application/json", rec.Header().Get("Content-Type"))
+	require.Equal(t, "no-store", rec.Header().Get("Cache-Control"))
+	require.Equal(t, "no-cache", rec.Header().Get("Pragma"))
+
+	var got map[string]any
+	require.NoError(t, json.Unmarshal(rec.Body.Bytes(), &got))
+	require.Equal(t, "at", got["access_token"])
+	require.Equal(t, "bearer", got["token_type"])
+	require.Equal(t, float64(3600), got["expires_in"])
+	require.Equal(t, "id", got["id_token"])
+	// Omitempty fields absent.
+	_, hasRefresh := got["refresh_token"]
+	require.False(t, hasRefresh)
+}
diff --git a/server/tokens/claims.go b/server/tokens/claims.go
new file mode 100644
index 0000000000..508cb6f607
--- /dev/null
+++ b/server/tokens/claims.go
@@ -0,0 +1,146 @@
+package tokens
+
+import (
+	"crypto/sha256"
+	"crypto/sha512"
+	"encoding/base64"
+	"encoding/json"
+	"fmt"
+	"hash"
+	"io"
+
+	jose "github.com/go-jose/go-jose/v4"
+
+	"github.com/dexidp/dex/server/internal"
+)
+
+var hashForSigAlg = map[jose.SignatureAlgorithm]func() hash.Hash{
+	jose.RS256: sha256.New,
+	jose.RS384: sha512.New384,
+	jose.RS512: sha512.New,
+	jose.ES256: sha256.New,
+	jose.ES384: sha512.New384,
+	jose.ES512: sha512.New,
+}
+
+// AccessTokenHash computes the at_hash/c_hash value for the given signing
+// algorithm: the left-most half of the hash of the token, base64url-encoded.
+func AccessTokenHash(alg jose.SignatureAlgorithm, accessToken string) (string, error) {
+	newHash, ok := hashForSigAlg[alg]
+	if !ok {
+		return "", fmt.Errorf("unsupported signature algorithm: %s", alg)
+	}
+
+	hashFunc := newHash()
+	if _, err := io.WriteString(hashFunc, accessToken); err != nil {
+		return "", fmt.Errorf("computing hash: %v", err)
+	}
+	sum := hashFunc.Sum(nil)
+	return base64.RawURLEncoding.EncodeToString(sum[:len(sum)/2]), nil
+}
+
+// Audience is an ID token's aud claim; it marshals to a single string when there
+// is exactly one entry, otherwise to an array.
+type Audience []string
+
+func (a Audience) contains(aud string) bool {
+	for _, e := range a {
+		if aud == e {
+			return true
+		}
+	}
+	return false
+}
+
+func (a Audience) MarshalJSON() ([]byte, error) {
+	if len(a) == 1 {
+		return json.Marshal(a[0])
+	}
+	return json.Marshal([]string(a))
+}
+
+type IDTokenClaims struct {
+	Issuer           string   `json:"iss"`
+	Subject          string   `json:"sub"`
+	Audience         Audience `json:"aud"`
+	Expiry           int64    `json:"exp"`
+	IssuedAt         int64    `json:"iat"`
+	JWTID            string   `json:"jti,omitempty"`
+	AuthorizingParty string   `json:"azp,omitempty"`
+	Nonce            string   `json:"nonce,omitempty"`
+	AuthTime         int64    `json:"auth_time,omitempty"`
+
+	// SessionID is the OIDC "sid" claim: the browser session this token was issued
+	// under. Present only when sessions are enabled. It lets an RP correlate a
+	// back-channel logout token with the session it holds, and lets dex tell a
+	// current id_token_hint from a stale one at the logout endpoint.
+	SessionID string `json:"sid,omitempty"`
+
+	AccessTokenHash string `json:"at_hash,omitempty"`
+	CodeHash        string `json:"c_hash,omitempty"`
+
+	Email         string `json:"email,omitempty"`
+	EmailVerified *bool  `json:"email_verified,omitempty"`
+
+	Groups []string `json:"groups,omitempty"`
+
+	Name              string `json:"name,omitempty"`
+	PreferredUsername string `json:"preferred_username,omitempty"`
+
+	FederatedIDClaims *FederatedIDClaims `json:"federated_claims,omitempty"`
+}
+
+// FederatedIDClaims carries the upstream connector's identity for the
+// federated:id scope.
+type FederatedIDClaims struct {
+	ConnectorID string `json:"connector_id,omitempty"`
+	UserID      string `json:"user_id,omitempty"`
+}
+
+// GetClientID resolves the requesting client from an audience and azp: the single
+// audience entry, or the azp when the audience holds several clients.
+func GetClientID(aud Audience, azp string) (string, error) {
+	switch len(aud) {
+	case 0:
+		return "", fmt.Errorf("no audience is set, could not find ClientID")
+	case 1:
+		return aud[0], nil
+	default:
+		return azp, nil
+	}
+}
+
+// GetAudience builds the aud claim for a client and its requested scopes,
+// including any cross-client peers the scopes name.
+func GetAudience(clientID string, scopes []string) Audience {
+	var aud Audience
+
+	for _, scope := range scopes {
+		if peerID, ok := ParseCrossClientScope(scope); ok {
+			aud = append(aud, peerID)
+		}
+	}
+
+	if len(aud) == 0 {
+		// Client didn't ask for cross client audience. Set the current
+		// client as the audience.
+		aud = Audience{clientID}
+		// Client asked for cross client audience:
+		// if the current client was not requested explicitly
+	} else if !aud.contains(clientID) {
+		// by default it becomes one of entries in Audience
+		aud = append(aud, clientID)
+	}
+
+	return aud
+}
+
+// GenSubject encodes a (userID, connectorID) pair into an ID token subject.
+func GenSubject(userID string, connID string) (string, error) {
+	sub := &internal.IDTokenSubject{
+		UserId: userID,
+		ConnId: connID,
+	}
+
+	return internal.Marshal(sub)
+}
diff --git a/server/tokens/claims_test.go b/server/tokens/claims_test.go
new file mode 100644
index 0000000000..b3a1f6072a
--- /dev/null
+++ b/server/tokens/claims_test.go
@@ -0,0 +1,47 @@
+package tokens
+
+import (
+	"testing"
+
+	jose "github.com/go-jose/go-jose/v4"
+	"github.com/stretchr/testify/require"
+)
+
+func TestGetClientID(t *testing.T) {
+	cid, err := GetClientID(Audience{}, "")
+	require.Equal(t, "", cid)
+	require.Equal(t, "no audience is set, could not find ClientID", err.Error())
+
+	cid, err = GetClientID(Audience{"a"}, "")
+	require.Equal(t, "a", cid)
+	require.NoError(t, err)
+
+	cid, err = GetClientID(Audience{"a", "b"}, "azp")
+	require.Equal(t, "azp", cid)
+	require.NoError(t, err)
+}
+
+func TestGetAudience(t *testing.T) {
+	require.Equal(t, Audience{"client-id"}, GetAudience("client-id", []string{}))
+	require.Equal(t, Audience{"client-id"}, GetAudience("client-id", []string{"ascope"}))
+	require.Equal(t, Audience{"aa", "bb", "client-id"},
+		GetAudience("client-id", []string{"ascope", "audience:server:client_id:aa", "audience:server:client_id:bb"}))
+}
+
+func TestGenSubject(t *testing.T) {
+	sub, err := GenSubject("foo", "bar")
+	require.NoError(t, err)
+	require.Equal(t, "CgNmb28SA2Jhcg", sub)
+}
+
+func TestAccessTokenHash(t *testing.T) {
+	// at_hash value and access_token returned by Google.
+	const (
+		googleAccessTokenHash = "piwt8oCH-K2D9pXlaS1Y-w"
+		googleAccessToken     = "ya29.CjHSA1l5WUn8xZ6HanHFzzdHdbXm-14rxnC7JHch9eFIsZkQEGoWzaYG4o7k5f6BnPLj"
+	)
+
+	atHash, err := AccessTokenHash(jose.RS256, googleAccessToken)
+	require.NoError(t, err)
+	require.Equal(t, googleAccessTokenHash, atHash)
+}
diff --git a/server/tokens/crossclient.go b/server/tokens/crossclient.go
new file mode 100644
index 0000000000..423b029637
--- /dev/null
+++ b/server/tokens/crossclient.go
@@ -0,0 +1,25 @@
+package tokens
+
+import (
+	"context"
+	"slices"
+
+	"github.com/dexidp/dex/storage"
+)
+
+// CrossClientTrusted reports whether clientID may request an audience scope for
+// peerID: true when clientID is peerID itself, or when peerID lists clientID as
+// a trusted peer.
+func CrossClientTrusted(ctx context.Context, s storage.Storage, clientID, peerID string) (bool, error) {
+	if peerID == clientID {
+		return true, nil
+	}
+	peer, err := s.GetClient(ctx, peerID)
+	if err != nil {
+		if err == storage.ErrNotFound {
+			return false, nil
+		}
+		return false, err
+	}
+	return slices.Contains(peer.TrustedPeers, clientID), nil
+}
diff --git a/server/tokens/doc.go b/server/tokens/doc.go
new file mode 100644
index 0000000000..d99c3666b1
--- /dev/null
+++ b/server/tokens/doc.go
@@ -0,0 +1,3 @@
+// Package tokens owns the token value objects plus token issuance and
+// refresh-token rotation and persistence.
+package tokens
diff --git a/server/tokens/issuer.go b/server/tokens/issuer.go
new file mode 100644
index 0000000000..bd212211bd
--- /dev/null
+++ b/server/tokens/issuer.go
@@ -0,0 +1,210 @@
+package tokens
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"log/slog"
+	"net/url"
+	"time"
+
+	"github.com/google/uuid"
+
+	"github.com/dexidp/dex/server/signer"
+	"github.com/dexidp/dex/storage"
+)
+
+// Issuer turns an Authorization into signed tokens. It mints access and ID
+// tokens (SignAccessToken/SignIDToken) and owns a RefreshStore for refresh-token
+// persistence. The low-level cryptographic signer is an injected dependency.
+type Issuer struct {
+	storage          storage.Storage
+	signer           signer.Signer
+	issuerURL        url.URL
+	idTokensValidFor time.Duration
+	now              func() time.Time
+	logger           *slog.Logger
+
+	// Refresh persists and rotates refresh tokens.
+	Refresh *RefreshStore
+}
+
+// NewIssuer wires an issuer from the shared dependencies.
+func NewIssuer(storage storage.Storage, sig signer.Signer, issuerURL url.URL, idTokensValidFor time.Duration, now func() time.Time, logger *slog.Logger) *Issuer {
+	return &Issuer{
+		storage:          storage,
+		signer:           sig,
+		issuerURL:        issuerURL,
+		idTokensValidFor: idTokensValidFor,
+		now:              now,
+		logger:           logger,
+		Refresh:          NewRefreshStore(storage, now, logger),
+	}
+}
+
+// Issue mints the standard token set for the authorization: an access token,
+// an ID token when the openid scope was requested, and a refresh token when
+// withRefresh is true. code is the authorization code bound into the ID token's
+// c_hash, empty for grants without one. Whether a refresh token is wanted
+// (connector support, grant-type policy, offline_access scope) is a grant
+// decision, so the caller passes it in. This is the single mint every standard
+// OAuth2 grant uses.
+func (i *Issuer) Issue(ctx context.Context, auth Authorization, code string, withRefresh bool) (TokenSet, error) {
+	accessToken, expiry, err := i.SignAccessToken(ctx, auth)
+	if err != nil {
+		return TokenSet{}, fmt.Errorf("create access token: %w", err)
+	}
+
+	ts := TokenSet{AccessToken: accessToken, Expiry: expiry}
+
+	if HasOpenID(auth.Scopes) {
+		ts.IDToken, ts.Expiry, err = i.SignIDToken(ctx, auth, accessToken, code)
+		if err != nil {
+			return TokenSet{}, fmt.Errorf("create id token: %w", err)
+		}
+	}
+
+	if withRefresh {
+		ts.RefreshToken, err = i.Refresh.Create(ctx, auth)
+		if err != nil {
+			return TokenSet{}, fmt.Errorf("create refresh token: %w", err)
+		}
+	}
+	return ts, nil
+}
+
+// IssueResponse mints the standard token set with Issue and renders it as an
+// OAuth2 token response, so a grant handler need not carry a clock of its own.
+func (i *Issuer) IssueResponse(ctx context.Context, auth Authorization, code string, withRefresh bool) (Response, error) {
+	ts, err := i.Issue(ctx, auth, code, withRefresh)
+	if err != nil {
+		return Response{}, err
+	}
+	return ts.Response(i.now()), nil
+}
+
+// SignAccessToken mints an opaque-looking JWT access token. Dex's access token is
+// an ID token bound to a random value, so each access token is unique.
+func (i *Issuer) SignAccessToken(ctx context.Context, auth Authorization) (string, time.Time, error) {
+	return i.SignIDToken(ctx, auth, storage.NewID(), "")
+}
+
+// SignIDToken mints an ID token. accessToken/code, when set, contribute
+// at_hash/c_hash.
+func (i *Issuer) SignIDToken(ctx context.Context, auth Authorization, accessToken, code string) (string, time.Time, error) {
+	issuedAt := i.now()
+	expiry := issuedAt.Add(i.idTokensValidFor)
+
+	subjectString, err := GenSubject(auth.Claims.UserID, auth.ConnectorID)
+	if err != nil {
+		i.logger.ErrorContext(ctx, "failed to marshal offline session ID", "err", err)
+		return "", expiry, fmt.Errorf("failed to marshal offline session ID: %v", err)
+	}
+
+	tok := IDTokenClaims{
+		Issuer:   i.issuerURL.String(),
+		Subject:  subjectString,
+		Nonce:    auth.Nonce,
+		Expiry:   expiry.Unix(),
+		IssuedAt: issuedAt.Unix(),
+		JWTID:    uuid.New().String(),
+	}
+
+	if !auth.AuthTime.IsZero() {
+		tok.AuthTime = auth.AuthTime.Unix()
+	}
+
+	tok.SessionID = auth.SessionID
+
+	signingAlg, err := i.signer.Algorithm(ctx)
+	if err != nil {
+		i.logger.ErrorContext(ctx, "failed to get signing algorithm", "err", err)
+		return "", expiry, fmt.Errorf("failed to get signing algorithm: %v", err)
+	}
+
+	if accessToken != "" {
+		atHash, err := AccessTokenHash(signingAlg, accessToken)
+		if err != nil {
+			i.logger.ErrorContext(ctx, "error computing at_hash", "err", err)
+			return "", expiry, fmt.Errorf("error computing at_hash: %v", err)
+		}
+		tok.AccessTokenHash = atHash
+	}
+
+	if code != "" {
+		cHash, err := AccessTokenHash(signingAlg, code)
+		if err != nil {
+			i.logger.ErrorContext(ctx, "error computing c_hash", "err", err)
+			return "", expiry, fmt.Errorf("error computing c_hash: %v", err)
+		}
+		tok.CodeHash = cHash
+	}
+
+	clientID := auth.Client.ID
+	for _, scope := range auth.Scopes {
+		switch {
+		case scope == ScopeEmail:
+			tok.Email = auth.Claims.Email
+			tok.EmailVerified = &auth.Claims.EmailVerified
+		case scope == ScopeGroups:
+			tok.Groups = auth.Claims.Groups
+		case scope == ScopeProfile:
+			tok.Name = auth.Claims.Username
+			tok.PreferredUsername = auth.Claims.PreferredUsername
+		case scope == ScopeFederatedID:
+			tok.FederatedIDClaims = &FederatedIDClaims{
+				ConnectorID: auth.ConnectorID,
+				UserID:      auth.Claims.UserID,
+			}
+		default:
+			peerID, ok := ParseCrossClientScope(scope)
+			if !ok {
+				continue
+			}
+			isTrusted, err := i.crossClientTrusted(ctx, clientID, peerID)
+			if err != nil {
+				return "", expiry, err
+			}
+			if !isTrusted {
+				return "", expiry, fmt.Errorf("peer (%s) does not trust client", peerID)
+			}
+		}
+	}
+
+	tok.Audience = GetAudience(clientID, auth.Scopes)
+	if len(tok.Audience) > 1 {
+		tok.AuthorizingParty = clientID
+	}
+
+	payload, err := json.Marshal(tok)
+	if err != nil {
+		return "", expiry, fmt.Errorf("could not serialize claims: %v", err)
+	}
+
+	idToken, err := i.signer.Sign(ctx, payload)
+	if err != nil {
+		return "", expiry, fmt.Errorf("failed to sign payload: %v", err)
+	}
+	return idToken, expiry, nil
+}
+
+// crossClientTrusted reports whether peerID's client trusts clientID as a peer.
+func (i *Issuer) crossClientTrusted(ctx context.Context, clientID, peerID string) (bool, error) {
+	if peerID == clientID {
+		return true, nil
+	}
+	peer, err := i.storage.GetClient(ctx, peerID)
+	if err != nil {
+		if err != storage.ErrNotFound {
+			i.logger.ErrorContext(ctx, "failed to get client", "err", err)
+			return false, err
+		}
+		return false, nil
+	}
+	for _, id := range peer.TrustedPeers {
+		if id == clientID {
+			return true, nil
+		}
+	}
+	return false, nil
+}
diff --git a/server/tokens/issuer_test.go b/server/tokens/issuer_test.go
new file mode 100644
index 0000000000..d5540adfcd
--- /dev/null
+++ b/server/tokens/issuer_test.go
@@ -0,0 +1,76 @@
+package tokens
+
+import (
+	"crypto/rand"
+	"crypto/rsa"
+	"log/slog"
+	"net/url"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/require"
+
+	"github.com/dexidp/dex/server/internal"
+	"github.com/dexidp/dex/server/signer"
+	"github.com/dexidp/dex/storage"
+	"github.com/dexidp/dex/storage/memory"
+)
+
+func newTestIssuer(t *testing.T) (*Issuer, storage.Storage) {
+	t.Helper()
+	logger := slog.New(slog.DiscardHandler)
+	store := memory.New(logger)
+
+	key, err := rsa.GenerateKey(rand.Reader, 2048)
+	require.NoError(t, err)
+	sig, err := signer.NewMockSigner(key)
+	require.NoError(t, err)
+
+	issuerURL, err := url.Parse("https://issuer.example.com")
+	require.NoError(t, err)
+
+	return NewIssuer(store, sig, *issuerURL, time.Hour, time.Now, logger), store
+}
+
+func testAuthorization() Authorization {
+	return Authorization{
+		Client:        storage.Client{ID: "client-1"},
+		Claims:        storage.Claims{UserID: "u1", Username: "alice", Email: "alice@example.com"},
+		Scopes:        []string{"openid", "email", "offline_access"},
+		ConnectorID:   "mock",
+		Nonce:         "n",
+		ConnectorData: []byte(`{"conn":"data"}`),
+	}
+}
+
+func TestIssuerIssue(t *testing.T) {
+	ctx := t.Context()
+	iss, store := newTestIssuer(t)
+	auth := testAuthorization()
+
+	// With refresh requested: access + id + refresh, and the refresh token is persisted.
+	ts, err := iss.Issue(ctx, auth, "", true)
+	require.NoError(t, err)
+	require.NotEmpty(t, ts.AccessToken)
+	require.NotEmpty(t, ts.IDToken)
+	require.NotEmpty(t, ts.RefreshToken)
+
+	var rt internal.RefreshToken
+	require.NoError(t, internal.Unmarshal(ts.RefreshToken, &rt))
+	stored, err := store.GetRefresh(ctx, rt.RefreshId)
+	require.NoError(t, err)
+	require.Equal(t, "client-1", stored.ClientID)
+	require.Equal(t, "mock", stored.ConnectorID)
+	require.Equal(t, auth.ConnectorData, stored.ConnectorData)
+
+	sess, err := store.GetOfflineSessions(ctx, "u1", "mock")
+	require.NoError(t, err)
+	require.Contains(t, sess.Refresh, "client-1")
+
+	// Without refresh: access + id only.
+	ts2, err := iss.Issue(ctx, auth, "", false)
+	require.NoError(t, err)
+	require.NotEmpty(t, ts2.AccessToken)
+	require.NotEmpty(t, ts2.IDToken)
+	require.Empty(t, ts2.RefreshToken)
+}
diff --git a/server/tokens/refresh_lookup.go b/server/tokens/refresh_lookup.go
new file mode 100644
index 0000000000..3767a58a58
--- /dev/null
+++ b/server/tokens/refresh_lookup.go
@@ -0,0 +1,71 @@
+package tokens
+
+import (
+	"context"
+	"crypto/subtle"
+	"errors"
+	"fmt"
+	"log/slog"
+
+	"github.com/dexidp/dex/server/internal"
+	"github.com/dexidp/dex/storage"
+)
+
+// Errors a refresh-token lookup can reject a token with. Callers map them to
+// their own response: the refresh grant to OAuth2 errors, introspection to an
+// inactive-token result.
+var (
+	ErrRefreshTokenInvalid              = errors.New("refresh token is invalid or has already been claimed")
+	ErrRefreshTokenExpired              = errors.New("refresh token expired")
+	ErrRefreshTokenClaimedByOtherClient = errors.New("refresh token claimed by another client")
+)
+
+// LookupRefreshToken validates a refresh token against storage: it exists,
+// belongs to clientID when one is given, has not been claimed twice, and has not
+// expired per strategy. It returns one of the Err* sentinels for a rejected
+// token, or a wrapped storage error for infrastructure failures. Both the
+// refresh grant and token introspection use it, so the validation lives in one
+// place.
+func LookupRefreshToken(ctx context.Context, s storage.Storage, strategy *RefreshStrategy, logger *slog.Logger, clientID *string, token *internal.RefreshToken) (*storage.RefreshToken, error) {
+	refresh, err := s.GetRefresh(ctx, token.RefreshId)
+	if err != nil {
+		if err != storage.ErrNotFound {
+			logger.ErrorContext(ctx, "failed to get refresh token", "err", err)
+			return nil, fmt.Errorf("get refresh token: %w", err)
+		}
+		return nil, ErrRefreshTokenInvalid
+	}
+
+	// Only check the client when one was provided (introspection does not).
+	// https://datatracker.ietf.org/doc/html/rfc6749#section-5.2
+	if clientID != nil && refresh.ClientID != *clientID {
+		logger.ErrorContext(ctx, "trying to claim token for different client", "client_id", *clientID, "refresh_client_id", refresh.ClientID)
+		return nil, ErrRefreshTokenClaimedByOtherClient
+	}
+
+	// Constant-time comparison of the token secret: introspection reaches this
+	// path unauthenticated, so a byte-by-byte '!=' would leak the secret via
+	// timing. Matches the client-secret/nonce comparisons elsewhere in the server.
+	if subtle.ConstantTimeCompare([]byte(refresh.Token), []byte(token.Token)) != 1 {
+		switch {
+		case !strategy.AllowedToReuse(refresh.LastUsed):
+			fallthrough
+		case subtle.ConstantTimeCompare([]byte(refresh.ObsoleteToken), []byte(token.Token)) != 1:
+			fallthrough
+		case refresh.ObsoleteToken == "":
+			logger.ErrorContext(ctx, "refresh token claimed twice", "token_id", refresh.ID)
+			return nil, ErrRefreshTokenInvalid
+		}
+	}
+
+	if strategy.CompletelyExpired(refresh.CreatedAt) {
+		logger.ErrorContext(ctx, "refresh token expired", "token_id", refresh.ID)
+		return nil, ErrRefreshTokenExpired
+	}
+	if strategy.ExpiredBecauseUnused(refresh.LastUsed) {
+		logger.ErrorContext(ctx, "refresh token expired due to inactivity", "token_id", refresh.ID)
+		return nil, ErrRefreshTokenExpired
+	}
+
+	return &refresh, nil
+}
diff --git a/server/tokens/refresh_store.go b/server/tokens/refresh_store.go
new file mode 100644
index 0000000000..0201e4ab1f
--- /dev/null
+++ b/server/tokens/refresh_store.go
@@ -0,0 +1,326 @@
+package tokens
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"log/slog"
+	"time"
+
+	"github.com/dexidp/dex/connector"
+	"github.com/dexidp/dex/server/internal"
+	"github.com/dexidp/dex/storage"
+)
+
+// RefreshStore creates, rotates, and revokes refresh tokens, keeping the
+// offline-session references in sync. It is the single owner of refresh-token
+// persistence.
+type RefreshStore struct {
+	storage storage.Storage
+	now     func() time.Time
+	logger  *slog.Logger
+}
+
+// NewRefreshStore returns a store backed by the given storage.
+func NewRefreshStore(storage storage.Storage, now func() time.Time, logger *slog.Logger) *RefreshStore {
+	return &RefreshStore{storage: storage, now: now, logger: logger}
+}
+
+// Create issues a new refresh token for the authorization and records it in the
+// user's offline session. On any offline-session failure the refresh token is
+// rolled back so no orphaned token is left behind.
+func (rt *RefreshStore) Create(ctx context.Context, auth Authorization) (string, error) {
+	refresh := storage.RefreshToken{
+		ID:            storage.NewID(),
+		Token:         storage.NewID(),
+		ClientID:      auth.Client.ID,
+		ConnectorID:   auth.ConnectorID,
+		Scopes:        auth.Scopes,
+		Claims:        auth.Claims,
+		Nonce:         auth.Nonce,
+		ConnectorData: auth.ConnectorData,
+		CreatedAt:     rt.now(),
+		LastUsed:      rt.now(),
+	}
+
+	rawToken, err := internal.Marshal(&internal.RefreshToken{RefreshId: refresh.ID, Token: refresh.Token})
+	if err != nil {
+		return "", fmt.Errorf("marshal refresh token: %w", err)
+	}
+
+	if err := rt.storage.CreateRefresh(ctx, refresh); err != nil {
+		return "", fmt.Errorf("create refresh token: %w", err)
+	}
+
+	// Roll back the just-created refresh token if wiring it into the offline
+	// session fails, so we never leave an orphaned token.
+	rollback := func() {
+		if err := rt.storage.DeleteRefresh(ctx, refresh.ID); err != nil && err != storage.ErrNotFound {
+			rt.logger.ErrorContext(ctx, "failed to roll back refresh token", "err", err)
+		}
+	}
+
+	tokenRef := storage.RefreshTokenRef{
+		ID:        refresh.ID,
+		ClientID:  refresh.ClientID,
+		CreatedAt: refresh.CreatedAt,
+		LastUsed:  refresh.LastUsed,
+		SessionID: auth.SessionID,
+	}
+
+	session, err := rt.storage.GetOfflineSessions(ctx, refresh.Claims.UserID, refresh.ConnectorID)
+	switch {
+	case err != nil && err != storage.ErrNotFound:
+		rollback()
+		return "", fmt.Errorf("get offline session: %w", err)
+	case err != nil: // ErrNotFound: create a fresh offline session.
+		offlineSessions := storage.OfflineSessions{
+			UserID:        refresh.Claims.UserID,
+			ConnID:        refresh.ConnectorID,
+			Refresh:       map[string]*storage.RefreshTokenRef{tokenRef.ClientID: &tokenRef},
+			ConnectorData: auth.ConnectorData,
+		}
+		if err := rt.storage.CreateOfflineSessions(ctx, offlineSessions); err != nil {
+			rollback()
+			return "", fmt.Errorf("create offline session: %w", err)
+		}
+	default:
+		// Replace any existing refresh token for this client.
+		if oldRef, ok := session.Refresh[tokenRef.ClientID]; ok {
+			if err := rt.storage.DeleteRefresh(ctx, oldRef.ID); err != nil && err != storage.ErrNotFound {
+				rollback()
+				return "", fmt.Errorf("delete previous refresh token: %w", err)
+			}
+		}
+		if err := rt.storage.UpdateOfflineSessions(ctx, session.UserID, session.ConnID, func(old storage.OfflineSessions) (storage.OfflineSessions, error) {
+			old.Refresh[tokenRef.ClientID] = &tokenRef
+			if len(auth.ConnectorData) > 0 {
+				old.ConnectorData = auth.ConnectorData
+			}
+			return old, nil
+		}); err != nil {
+			rollback()
+			return "", fmt.Errorf("update offline session: %w", err)
+		}
+	}
+
+	return rawToken, nil
+}
+
+// IdentityFromClaims projects stored claims into a connector identity. The
+// refresh flow intentionally leaves UserID untouched by later updates.
+func IdentityFromClaims(claims storage.Claims) connector.Identity {
+	return connector.Identity{
+		UserID:            claims.UserID,
+		Username:          claims.Username,
+		PreferredUsername: claims.PreferredUsername,
+		Email:             claims.Email,
+		EmailVerified:     claims.EmailVerified,
+		Groups:            claims.Groups,
+	}
+}
+
+// ClaimsFromIdentity maps a freshly authenticated connector identity to ID token
+// claims. It is the inverse of IdentityFromClaims and the single place grants
+// turn an identity into claims.
+func ClaimsFromIdentity(identity connector.Identity) storage.Claims {
+	return storage.Claims{
+		UserID:            identity.UserID,
+		Username:          identity.Username,
+		PreferredUsername: identity.PreferredUsername,
+		Email:             identity.Email,
+		EmailVerified:     identity.EmailVerified,
+		Groups:            identity.Groups,
+	}
+}
+
+// Rotate advances the stored refresh token according to the rotation strategy and
+// syncs the offline session. It returns the marshaled token to hand back to the
+// client and the identity its claims were refreshed to.
+//
+// freshIdentity supplies the up-to-date identity. It is invoked inside the
+// storage transaction, and only when a token is actually minted, so the upstream
+// connector is contacted at most once even under concurrent refreshes.
+func (rt *RefreshStore) Rotate(ctx context.Context, storageToken *storage.RefreshToken, requestToken *internal.RefreshToken, strategy *RefreshStrategy, freshIdentity func(context.Context) (connector.Identity, error)) (string, connector.Identity, error) {
+	var idErr error
+
+	newToken := &internal.RefreshToken{
+		Token:     requestToken.Token,
+		RefreshId: requestToken.RefreshId,
+	}
+
+	lastUsed := rt.now()
+	ident := IdentityFromClaims(storageToken.Claims)
+
+	refreshTokenUpdater := func(old storage.RefreshToken) (storage.RefreshToken, error) {
+		rotationEnabled := strategy.RotationEnabled()
+		reusingAllowed := strategy.AllowedToReuse(old.LastUsed)
+
+		switch {
+		case !rotationEnabled && reusingAllowed:
+			// Rotation disabled and the token was used recently: nothing to advance.
+			old.ConnectorData = nil
+			return old, nil
+
+		case rotationEnabled && reusingAllowed:
+			if old.Token != requestToken.Token && old.ObsoleteToken != requestToken.Token {
+				return old, errors.New("refresh token claimed twice")
+			}
+
+			// Return the previously generated token for requests carrying an obsolete one.
+			if old.ObsoleteToken == requestToken.Token {
+				newToken.Token = old.Token
+			}
+
+			// Do not advance last-used while the token may still be reused.
+			lastUsed = old.LastUsed
+			old.ConnectorData = nil
+			return old, nil
+
+		case rotationEnabled && !reusingAllowed:
+			if old.Token != requestToken.Token {
+				return old, errors.New("refresh token claimed twice")
+			}
+
+			// Issue a new refresh token, keeping the previous one claimable within reuse.
+			old.ObsoleteToken = old.Token
+			newToken.Token = storage.NewID()
+		}
+
+		old.Token = newToken.Token
+		old.LastUsed = lastUsed
+
+		// ConnectorData has been moved to the offline session.
+		old.ConnectorData = nil
+
+		ident, idErr = freshIdentity(ctx)
+		if idErr != nil {
+			return old, idErr
+		}
+
+		// Refresh the stored claims. UserID intentionally left untouched.
+		old.Claims.Username = ident.Username
+		old.Claims.PreferredUsername = ident.PreferredUsername
+		old.Claims.Email = ident.Email
+		old.Claims.EmailVerified = ident.EmailVerified
+		old.Claims.Groups = ident.Groups
+
+		return old, nil
+	}
+
+	if err := rt.storage.UpdateRefreshToken(ctx, storageToken.ID, refreshTokenUpdater); err != nil {
+		rt.logger.ErrorContext(ctx, "failed to update refresh token", "err", err)
+		return "", ident, err
+	}
+
+	if err := rt.updateOfflineSession(ctx, storageToken, ident, lastUsed); err != nil {
+		return "", ident, err
+	}
+
+	rawToken, err := internal.Marshal(newToken)
+	if err != nil {
+		return "", ident, fmt.Errorf("marshal refresh token: %w", err)
+	}
+
+	return rawToken, ident, nil
+}
+
+// updateOfflineSession records the refresh token's new last-used time, and any
+// updated connector data, on the user's offline session.
+func (rt *RefreshStore) updateOfflineSession(ctx context.Context, refresh *storage.RefreshToken, ident connector.Identity, lastUsed time.Time) error {
+	offlineSessionUpdater := func(old storage.OfflineSessions) (storage.OfflineSessions, error) {
+		if old.Refresh[refresh.ClientID].ID != refresh.ID {
+			return old, errors.New("refresh token invalid")
+		}
+
+		old.Refresh[refresh.ClientID].LastUsed = lastUsed
+		if len(ident.ConnectorData) > 0 {
+			old.ConnectorData = ident.ConnectorData
+		}
+
+		rt.logger.DebugContext(ctx, "saved connector data", "user_id", ident.UserID, "connector_data", ident.ConnectorData)
+		return old, nil
+	}
+
+	if err := rt.storage.UpdateOfflineSessions(ctx, refresh.Claims.UserID, refresh.ConnectorID, offlineSessionUpdater); err != nil {
+		rt.logger.ErrorContext(ctx, "failed to update offline session", "err", err)
+		return err
+	}
+
+	return nil
+}
+
+// RevokeClients deletes the refresh tokens issued to the named clients for the
+// user/connector pair, in one pass over the offline session. Every other client's
+// token is left alone. See RevokeAll for the unscoped variant.
+func (rt *RefreshStore) RevokeClients(ctx context.Context, userID, connectorID string, clientIDs []string) {
+	if len(clientIDs) == 0 {
+		return
+	}
+
+	revoking := make(map[string]struct{}, len(clientIDs))
+	for _, id := range clientIDs {
+		if id != "" {
+			revoking[id] = struct{}{}
+		}
+	}
+
+	rt.revoke(ctx, userID, connectorID, func(id string) bool {
+		_, ok := revoking[id]
+		return ok
+	})
+}
+
+// RevokeAll deletes every refresh token for the user/connector pair. This is the
+// administrative hammer, reached through the gRPC API when an operator terminates a
+// user's sessions or deletes their identity — not something an ordinary RP-initiated
+// logout does.
+func (rt *RefreshStore) RevokeAll(ctx context.Context, userID, connectorID string) {
+	rt.revoke(ctx, userID, connectorID, func(string) bool { return true })
+}
+
+// revoke deletes the refresh tokens of every client matching the predicate and
+// clears their references in the offline session, keeping the session object.
+// Errors are logged but not returned: revocation is best-effort.
+//
+// To avoid a race where a token issued between the snapshot and the offline
+// session update would have its reference wiped, we snapshot the token IDs,
+// remove only those references (the updater sees the latest state, so a
+// concurrently added reference survives), then delete the tokens.
+func (rt *RefreshStore) revoke(ctx context.Context, userID, connectorID string, match func(clientID string) bool) {
+	offlineSessions, err := rt.storage.GetOfflineSessions(ctx, userID, connectorID)
+	if err != nil {
+		if !errors.Is(err, storage.ErrNotFound) {
+			rt.logger.ErrorContext(ctx, "failed to get offline sessions", "err", err)
+		}
+		return
+	}
+
+	tokenIDs := make(map[string]struct{}, len(offlineSessions.Refresh))
+	for clientID, ref := range offlineSessions.Refresh {
+		if match(clientID) {
+			tokenIDs[ref.ID] = struct{}{}
+		}
+	}
+
+	if len(tokenIDs) == 0 {
+		return
+	}
+
+	if err := rt.storage.UpdateOfflineSessions(ctx, userID, connectorID, func(old storage.OfflineSessions) (storage.OfflineSessions, error) {
+		for clientID, ref := range old.Refresh {
+			if _, ok := tokenIDs[ref.ID]; ok {
+				delete(old.Refresh, clientID)
+			}
+		}
+		return old, nil
+	}); err != nil {
+		rt.logger.ErrorContext(ctx, "failed to update offline sessions", "err", err)
+	}
+
+	for id := range tokenIDs {
+		if err := rt.storage.DeleteRefresh(ctx, id); err != nil && !errors.Is(err, storage.ErrNotFound) {
+			rt.logger.ErrorContext(ctx, "failed to delete refresh token", "token_id", id, "err", err)
+		}
+	}
+}
diff --git a/server/tokens/refresh_store_test.go b/server/tokens/refresh_store_test.go
new file mode 100644
index 0000000000..67a9693bfe
--- /dev/null
+++ b/server/tokens/refresh_store_test.go
@@ -0,0 +1,139 @@
+package tokens
+
+import (
+	"context"
+	"log/slog"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/require"
+
+	"github.com/dexidp/dex/connector"
+	"github.com/dexidp/dex/server/internal"
+	"github.com/dexidp/dex/storage"
+	"github.com/dexidp/dex/storage/memory"
+)
+
+func newTestStore(t *testing.T) (*RefreshStore, storage.Storage) {
+	t.Helper()
+	logger := slog.New(slog.DiscardHandler)
+	store := memory.New(logger)
+	return NewRefreshStore(store, time.Now, logger), store
+}
+
+func TestRefreshStoreCreate(t *testing.T) {
+	ctx := context.Background()
+	rt, store := newTestStore(t)
+	auth := testAuthorization()
+
+	first, err := rt.Create(ctx, auth)
+	require.NoError(t, err)
+	var firstTok internal.RefreshToken
+	require.NoError(t, internal.Unmarshal(first, &firstTok))
+
+	stored, err := store.GetRefresh(ctx, firstTok.RefreshId)
+	require.NoError(t, err)
+	require.Equal(t, "client-1", stored.ClientID)
+	require.Equal(t, auth.ConnectorData, stored.ConnectorData)
+
+	sess, err := store.GetOfflineSessions(ctx, "u1", "mock")
+	require.NoError(t, err)
+	require.Contains(t, sess.Refresh, "client-1")
+
+	// A second create for the same client replaces the old token.
+	second, err := rt.Create(ctx, auth)
+	require.NoError(t, err)
+	var secondTok internal.RefreshToken
+	require.NoError(t, internal.Unmarshal(second, &secondTok))
+	require.NotEqual(t, firstTok.RefreshId, secondTok.RefreshId)
+
+	_, err = store.GetRefresh(ctx, firstTok.RefreshId)
+	require.ErrorIs(t, err, storage.ErrNotFound)
+
+	sess, err = store.GetOfflineSessions(ctx, "u1", "mock")
+	require.NoError(t, err)
+	require.Equal(t, secondTok.RefreshId, sess.Refresh["client-1"].ID)
+}
+
+func TestRefreshStoreRotate(t *testing.T) {
+	ctx := context.Background()
+	rt, store := newTestStore(t)
+
+	require.NoError(t, store.CreateRefresh(ctx, storage.RefreshToken{
+		ID: "r1", Token: "t1", ClientID: "client-1", ConnectorID: "mock",
+		Claims: storage.Claims{UserID: "u1", Username: "alice"}, CreatedAt: time.Now(), LastUsed: time.Now(),
+	}))
+	require.NoError(t, store.CreateOfflineSessions(ctx, storage.OfflineSessions{
+		UserID: "u1", ConnID: "mock",
+		Refresh: map[string]*storage.RefreshTokenRef{"client-1": {ID: "r1", ClientID: "client-1"}},
+	}))
+	stored, err := store.GetRefresh(ctx, "r1")
+	require.NoError(t, err)
+
+	strategy := NewRefreshStrategy(true, 0, 0, 0, nil) // rotation on, no reuse
+	ident := connector.Identity{UserID: "u1", Username: "bob", Email: "bob@example.com"}
+	freshIdentity := func(context.Context) (connector.Identity, error) { return ident, nil }
+
+	raw, gotIdent, err := rt.Rotate(ctx, &stored, &internal.RefreshToken{RefreshId: "r1", Token: "t1"}, strategy, freshIdentity)
+	require.NoError(t, err)
+	require.Equal(t, ident, gotIdent)
+
+	var newTok internal.RefreshToken
+	require.NoError(t, internal.Unmarshal(raw, &newTok))
+	require.Equal(t, "r1", newTok.RefreshId)
+	require.NotEqual(t, "t1", newTok.Token, "token should have rotated")
+
+	after, err := store.GetRefresh(ctx, "r1")
+	require.NoError(t, err)
+	require.Equal(t, newTok.Token, after.Token)
+	require.Equal(t, "t1", after.ObsoleteToken)
+	require.Equal(t, "bob", after.Claims.Username, "claims refreshed from the identity")
+
+	// Claiming with a token that is neither current nor obsolete is rejected.
+	_, _, err = rt.Rotate(ctx, &after, &internal.RefreshToken{RefreshId: "r1", Token: "wrong"}, strategy, freshIdentity)
+	require.Error(t, err)
+}
+
+func TestRefreshStoreRevoke(t *testing.T) {
+	ctx := context.Background()
+	rt, store := newTestStore(t)
+
+	for _, tc := range []struct{ id, client string }{{"r1", "c1"}, {"r2", "c2"}} {
+		require.NoError(t, store.CreateRefresh(ctx, storage.RefreshToken{
+			ID: tc.id, ClientID: tc.client, ConnectorID: "mock", Claims: storage.Claims{UserID: "u1"},
+		}))
+	}
+	require.NoError(t, store.CreateOfflineSessions(ctx, storage.OfflineSessions{
+		UserID: "u1", ConnID: "mock", ConnectorData: []byte("cd"),
+		Refresh: map[string]*storage.RefreshTokenRef{
+			"c1": {ID: "r1", ClientID: "c1"},
+			"c2": {ID: "r2", ClientID: "c2"},
+		},
+	}))
+
+	// RevokeClients is scoped to the named clients and leaves the rest of the user's
+	// tokens alone.
+	rt.RevokeClients(ctx, "u1", "mock", []string{"c1", "unknown"})
+
+	_, err := store.GetRefresh(ctx, "r1")
+	require.ErrorIs(t, err, storage.ErrNotFound)
+	_, err = store.GetRefresh(ctx, "r2")
+	require.NoError(t, err)
+
+	sess, err := store.GetOfflineSessions(ctx, "u1", "mock")
+	require.NoError(t, err)
+	require.NotContains(t, sess.Refresh, "c1")
+	require.Contains(t, sess.Refresh, "c2")
+
+	// RevokeAll is the unscoped variant. The offline session survives with its refs
+	// cleared and its connector data intact.
+	rt.RevokeAll(ctx, "u1", "mock")
+
+	_, err = store.GetRefresh(ctx, "r2")
+	require.ErrorIs(t, err, storage.ErrNotFound)
+
+	sess, err = store.GetOfflineSessions(ctx, "u1", "mock")
+	require.NoError(t, err)
+	require.Empty(t, sess.Refresh)
+	require.Equal(t, []byte("cd"), sess.ConnectorData)
+}
diff --git a/server/tokens/refresh_strategy.go b/server/tokens/refresh_strategy.go
new file mode 100644
index 0000000000..03c3f1b406
--- /dev/null
+++ b/server/tokens/refresh_strategy.go
@@ -0,0 +1,107 @@
+package tokens
+
+import (
+	"fmt"
+	"log/slog"
+	"time"
+)
+
+// RefreshStrategy decides how a refresh token ages and rotates. It holds only the
+// resolved intervals; parsing them from configuration is the caller's job.
+type RefreshStrategy struct {
+	rotate bool // whether rotation is enabled
+
+	absoluteLifetime  time.Duration // creation to end of life
+	validIfNotUsedFor time.Duration // last use to end of life
+	reuseInterval     time.Duration // window in which an old token may still be reused
+
+	now func() time.Time
+}
+
+// NewRefreshStrategy builds a RefreshStrategy from resolved durations. now defaults to
+// time.Now when nil.
+func NewRefreshStrategy(rotate bool, absoluteLifetime, validIfNotUsedFor, reuseInterval time.Duration, now func() time.Time) *RefreshStrategy {
+	if now == nil {
+		now = time.Now
+	}
+	return &RefreshStrategy{
+		rotate:            rotate,
+		absoluteLifetime:  absoluteLifetime,
+		validIfNotUsedFor: validIfNotUsedFor,
+		reuseInterval:     reuseInterval,
+		now:               now,
+	}
+}
+
+// NewRefreshTokenPolicy parses the refresh-token configuration into a rotation
+// strategy — the config-reading adapter over NewRefreshStrategy.
+func NewRefreshTokenPolicy(logger *slog.Logger, rotation bool, validIfNotUsedFor, absoluteLifetime, reuseInterval string) (*RefreshStrategy, error) {
+	var validDur, absoluteDur, reuseDur time.Duration
+	var err error
+
+	if validIfNotUsedFor != "" {
+		validDur, err = time.ParseDuration(validIfNotUsedFor)
+		if err != nil {
+			return nil, fmt.Errorf("invalid config value %q for refresh token valid if not used for: %v", validIfNotUsedFor, err)
+		}
+		logger.Info("config refresh tokens", "valid_if_not_used_for", validIfNotUsedFor)
+	}
+
+	if absoluteLifetime != "" {
+		absoluteDur, err = time.ParseDuration(absoluteLifetime)
+		if err != nil {
+			return nil, fmt.Errorf("invalid config value %q for refresh tokens absolute lifetime: %v", absoluteLifetime, err)
+		}
+		logger.Info("config refresh tokens", "absolute_lifetime", absoluteLifetime)
+	}
+
+	if reuseInterval != "" {
+		reuseDur, err = time.ParseDuration(reuseInterval)
+		if err != nil {
+			return nil, fmt.Errorf("invalid config value %q for refresh tokens reuse interval: %v", reuseInterval, err)
+		}
+		logger.Info("config refresh tokens", "reuse_interval", reuseInterval)
+	}
+
+	rotate := !rotation
+	logger.Info("config refresh tokens rotation", "enabled", rotate)
+	return NewRefreshStrategy(rotate, absoluteDur, validDur, reuseDur, time.Now), nil
+}
+
+// RotationEnabled reports whether refresh tokens are rotated on use.
+func (s *RefreshStrategy) RotationEnabled() bool {
+	return s.rotate
+}
+
+// AbsoluteLifetime is the interval from creation to the end of a token's life
+// (zero means no absolute expiry).
+func (s *RefreshStrategy) AbsoluteLifetime() time.Duration {
+	return s.absoluteLifetime
+}
+
+// CompletelyExpired reports whether a token created at the given time has passed
+// its absolute lifetime.
+func (s *RefreshStrategy) CompletelyExpired(lastUsed time.Time) bool {
+	if s.absoluteLifetime == 0 {
+		return false // expiration disabled
+	}
+	return s.now().After(lastUsed.Add(s.absoluteLifetime))
+}
+
+// ExpiredBecauseUnused reports whether a token has been idle past its inactivity
+// window.
+func (s *RefreshStrategy) ExpiredBecauseUnused(lastUsed time.Time) bool {
+	if s.validIfNotUsedFor == 0 {
+		return false // expiration disabled
+	}
+	return s.now().After(lastUsed.Add(s.validIfNotUsedFor))
+}
+
+// AllowedToReuse reports whether a just-rotated token may still be reused within
+// the reuse window.
+func (s *RefreshStrategy) AllowedToReuse(lastUsed time.Time) bool {
+	if s.reuseInterval == 0 {
+		return false // reuse disabled
+	}
+	return !s.now().After(lastUsed.Add(s.reuseInterval))
+}
diff --git a/server/tokens/refresh_strategy_test.go b/server/tokens/refresh_strategy_test.go
new file mode 100644
index 0000000000..706701caee
--- /dev/null
+++ b/server/tokens/refresh_strategy_test.go
@@ -0,0 +1,34 @@
+package tokens
+
+import (
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestStrategy(t *testing.T) {
+	lastTime := time.Now()
+
+	t.Run("Allowed", func(t *testing.T) {
+		s := NewRefreshStrategy(false, time.Minute, time.Minute, time.Minute, func() time.Time { return lastTime })
+		require.True(t, s.AllowedToReuse(lastTime))
+		require.False(t, s.ExpiredBecauseUnused(lastTime))
+		require.False(t, s.CompletelyExpired(lastTime))
+	})
+
+	t.Run("Expired", func(t *testing.T) {
+		s := NewRefreshStrategy(false, time.Minute, time.Minute, time.Minute, func() time.Time { return lastTime.Add(2 * time.Minute) })
+		require.False(t, s.AllowedToReuse(lastTime))
+		require.True(t, s.ExpiredBecauseUnused(lastTime))
+		require.True(t, s.CompletelyExpired(lastTime))
+	})
+
+	t.Run("disabled intervals never expire", func(t *testing.T) {
+		s := NewRefreshStrategy(true, 0, 0, 0, nil)
+		require.True(t, s.RotationEnabled())
+		require.False(t, s.CompletelyExpired(lastTime.Add(-100*time.Hour)))
+		require.False(t, s.ExpiredBecauseUnused(lastTime.Add(-100*time.Hour)))
+		require.False(t, s.AllowedToReuse(lastTime))
+	})
+}
diff --git a/server/tokens/scopes.go b/server/tokens/scopes.go
new file mode 100644
index 0000000000..ccdd65b29c
--- /dev/null
+++ b/server/tokens/scopes.go
@@ -0,0 +1,50 @@
+package tokens
+
+import (
+	"slices"
+	"strings"
+
+	"github.com/dexidp/dex/connector"
+)
+
+// OIDC scope values. They all live here so scope handling stays in one place.
+const (
+	ScopeOpenID        = "openid"
+	ScopeOfflineAccess = "offline_access" // Request a refresh token.
+	ScopeGroups        = "groups"
+	ScopeEmail         = "email"
+	ScopeProfile       = "profile"
+	ScopeFederatedID   = "federated:id"
+
+	scopeCrossClientPrefix = "audience:server:client_id:"
+)
+
+// HasOpenID reports whether the openid scope was requested, i.e. whether an
+// ID token should be issued.
+func HasOpenID(scopes []string) bool {
+	return slices.Contains(scopes, ScopeOpenID)
+}
+
+// ParseCrossClientScope extracts the peer client ID from a cross-client audience
+// scope, reporting whether the scope was one.
+func ParseCrossClientScope(scope string) (string, bool) {
+	if !strings.HasPrefix(scope, scopeCrossClientPrefix) {
+		return "", false
+	}
+	return scope[len(scopeCrossClientPrefix):], true
+}
+
+// ParseScopes translates the requested OIDC scopes into the connector.Scopes a
+// connector needs when authenticating or refreshing a user.
+func ParseScopes(scopes []string) connector.Scopes {
+	var s connector.Scopes
+	for _, scope := range scopes {
+		switch scope {
+		case ScopeOfflineAccess:
+			s.OfflineAccess = true
+		case ScopeGroups:
+			s.Groups = true
+		}
+	}
+	return s
+}
diff --git a/server/tokens/scopes_test.go b/server/tokens/scopes_test.go
new file mode 100644
index 0000000000..70ee362620
--- /dev/null
+++ b/server/tokens/scopes_test.go
@@ -0,0 +1,24 @@
+package tokens
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestParseCrossClientScope(t *testing.T) {
+	peer, ok := ParseCrossClientScope("audience:server:client_id:peer-1")
+	require.True(t, ok)
+	require.Equal(t, "peer-1", peer)
+
+	// Empty peer is still a cross-client scope.
+	peer, ok = ParseCrossClientScope("audience:server:client_id:")
+	require.True(t, ok)
+	require.Equal(t, "", peer)
+
+	for _, scope := range []string{"openid", "email", "audience:other", ""} {
+		peer, ok = ParseCrossClientScope(scope)
+		require.False(t, ok, "scope %q", scope)
+		require.Equal(t, "", peer)
+	}
+}
diff --git a/server/userinfo/doc.go b/server/userinfo/doc.go
new file mode 100644
index 0000000000..e80cf701c7
--- /dev/null
+++ b/server/userinfo/doc.go
@@ -0,0 +1,2 @@
+// Package userinfo serves the OIDC /userinfo endpoint.
+package userinfo
diff --git a/server/userinfo/userinfo.go b/server/userinfo/userinfo.go
new file mode 100644
index 0000000000..21ae63f843
--- /dev/null
+++ b/server/userinfo/userinfo.go
@@ -0,0 +1,61 @@
+package userinfo
+
+import (
+	"encoding/json"
+	"log/slog"
+	"net/http"
+	"strings"
+
+	"github.com/coreos/go-oidc/v3/oidc"
+
+	"github.com/dexidp/dex/server/oauth2"
+	"github.com/dexidp/dex/server/router"
+	"github.com/dexidp/dex/server/signer"
+)
+
+// Handler serves the OIDC /userinfo endpoint.
+type Handler struct {
+	Issuer string
+	Signer signer.Signer
+	Logger *slog.Logger
+}
+
+// Mount registers the userinfo route.
+func (h *Handler) Mount(m router.Mux) {
+	m.HandleCORS("/userinfo", h.handle)
+}
+
+func (h *Handler) handle(w http.ResponseWriter, r *http.Request) {
+	ctx := r.Context()
+	const prefix = "Bearer "
+
+	auth := r.Header.Get("authorization")
+	if len(auth) < len(prefix) || !strings.EqualFold(prefix, auth[:len(prefix)]) {
+		w.Header().Set("WWW-Authenticate", "Bearer")
+		h.writeError(w, oauth2.AccessDenied, "Invalid bearer token.", http.StatusUnauthorized)
+		return
+	}
+	rawIDToken := auth[len(prefix):]
+
+	verifier := oidc.NewVerifier(h.Issuer, &signer.KeySet{Signer: h.Signer}, &oidc.Config{SkipClientIDCheck: true})
+	idToken, err := verifier.Verify(ctx, rawIDToken)
+	if err != nil {
+		h.Logger.ErrorContext(ctx, "failed to verify ID token", "err", err)
+		h.writeError(w, oauth2.AccessDenied, "Invalid bearer token.", http.StatusForbidden)
+		return
+	}
+
+	var claims json.RawMessage
+	if err := idToken.Claims(&claims); err != nil {
+		h.Logger.ErrorContext(ctx, "failed to decode ID token claims", "err", err)
+		h.writeError(w, oauth2.ServerError, "", http.StatusInternalServerError)
+		return
+	}
+
+	w.Header().Set("Content-Type", "application/json")
+	w.Write(claims)
+}
+
+func (h *Handler) writeError(w http.ResponseWriter, typ, description string, statusCode int) {
+	oauth2.WriteErrorResponse(h.Logger, w, typ, description, statusCode)
+}
diff --git a/storage/conformance/conformance.go b/storage/conformance/conformance.go
index 9d9766ebd5..734b7a2e19 100644
--- a/storage/conformance/conformance.go
+++ b/storage/conformance/conformance.go
@@ -2,30 +2,38 @@
 package conformance
 
 import (
+	"crypto/ecdsa"
 	"reflect"
 	"sort"
 	"testing"
 	"time"
 
+	jose "github.com/go-jose/go-jose/v4"
 	"github.com/kylelemons/godebug/pretty"
+	"github.com/stretchr/testify/require"
 	"golang.org/x/crypto/bcrypt"
-	jose "gopkg.in/square/go-jose.v2"
 
 	"github.com/dexidp/dex/storage"
 )
 
+const keyRoundTripPayload = "storage-keys-round-trip"
+
 // ensure that values being tested on never expire.
 var neverExpire = time.Now().UTC().Add(time.Hour * 24 * 365 * 100)
 
+// defaultAuthTime is a non-zero time used as AuthTime default in tests.
+// MySQL rejects Go's zero time (0001-01-01), so all test fixtures must use a real value.
+var defaultAuthTime = time.Now().UTC()
+
 type subTest struct {
 	name string
 	run  func(t *testing.T, s storage.Storage)
 }
 
-func runTests(t *testing.T, newStorage func() storage.Storage, tests []subTest) {
+func runTests(t *testing.T, newStorage func(t *testing.T) storage.Storage, tests []subTest) {
 	for _, test := range tests {
 		t.Run(test.name, func(t *testing.T) {
-			s := newStorage()
+			s := newStorage(t)
 			test.run(t, s)
 			s.Close()
 		})
@@ -35,7 +43,7 @@ func runTests(t *testing.T, newStorage func() storage.Storage, tests []subTest)
 // RunTests runs a set of conformance tests against a storage. newStorage should
 // return an initialized but empty storage. The storage will be closed at the
 // end of each test run.
-func RunTests(t *testing.T, newStorage func() storage.Storage) {
+func RunTests(t *testing.T, newStorage func(t *testing.T) storage.Storage) {
 	runTests(t, newStorage, []subTest{
 		{"AuthCodeCRUD", testAuthCodeCRUD},
 		{"AuthRequestCRUD", testAuthRequestCRUD},
@@ -49,6 +57,8 @@ func RunTests(t *testing.T, newStorage func() storage.Storage) {
 		{"TimezoneSupport", testTimezones},
 		{"DeviceRequestCRUD", testDeviceRequestCRUD},
 		{"DeviceTokenCRUD", testDeviceTokenCRUD},
+		{"UserIdentityCRUD", testUserIdentityCRUD},
+		{"AuthSessionCRUD", testAuthSessionCRUD},
 	})
 }
 
@@ -63,7 +73,7 @@ func mustLoadJWK(b string) *jose.JSONWebKey {
 func mustBeErrNotFound(t *testing.T, kind string, err error) {
 	switch {
 	case err == nil:
-		t.Errorf("deleting non-existent %s should return an error", kind)
+		t.Errorf("deleting nonexistent %s should return an error", kind)
 	case err != storage.ErrNotFound:
 		t.Errorf("deleting %s expected storage.ErrNotFound, got %v", kind, err)
 	}
@@ -78,7 +88,47 @@ func mustBeErrAlreadyExists(t *testing.T, kind string, err error) {
 	}
 }
 
+func isES256JWK(jwk *jose.JSONWebKey) bool {
+	if jwk == nil {
+		return false
+	}
+
+	switch jwk.Key.(type) {
+	case *ecdsa.PrivateKey, *ecdsa.PublicKey:
+		return jose.SignatureAlgorithm(jwk.Algorithm) == jose.ES256
+	default:
+		return false
+	}
+}
+
+func requireSigningKeyRoundTripUsable(t *testing.T, keys storage.Keys) {
+	t.Helper()
+
+	if !isES256JWK(keys.SigningKey) {
+		return
+	}
+	require.NotNil(t, keys.SigningKeyPub)
+
+	alg := jose.SignatureAlgorithm(keys.SigningKey.Algorithm)
+	signer, err := jose.NewSigner(jose.SigningKey{Algorithm: alg, Key: keys.SigningKey}, nil)
+	require.NoError(t, err)
+
+	signed, err := signer.Sign([]byte(keyRoundTripPayload))
+	require.NoError(t, err)
+
+	compact, err := signed.CompactSerialize()
+	require.NoError(t, err)
+
+	jws, err := jose.ParseSigned(compact, []jose.SignatureAlgorithm{alg})
+	require.NoError(t, err)
+
+	payload, err := jws.Verify(keys.SigningKeyPub)
+	require.NoError(t, err)
+	require.Equal(t, []byte(keyRoundTripPayload), payload)
+}
+
 func testAuthRequestCRUD(t *testing.T, s storage.Storage) {
+	ctx := t.Context()
 	codeChallenge := storage.PKCE{
 		CodeChallenge:       "code_challenge_test",
 		CodeChallengeMethod: "plain",
@@ -95,6 +145,7 @@ func testAuthRequestCRUD(t *testing.T, s storage.Storage) {
 		ForceApprovalPrompt: true,
 		LoggedIn:            true,
 		Expiry:              neverExpire,
+		AuthTime:            defaultAuthTime,
 		ConnectorID:         "ldap",
 		ConnectorData:       []byte(`{"some":"data"}`),
 		Claims: storage.Claims{
@@ -104,17 +155,18 @@ func testAuthRequestCRUD(t *testing.T, s storage.Storage) {
 			EmailVerified: true,
 			Groups:        []string{"a", "b"},
 		},
-		PKCE: codeChallenge,
+		PKCE:    codeChallenge,
+		HMACKey: []byte("hmac_key"),
 	}
 
 	identity := storage.Claims{Email: "foobar"}
 
-	if err := s.CreateAuthRequest(a1); err != nil {
+	if err := s.CreateAuthRequest(ctx, a1); err != nil {
 		t.Fatalf("failed creating auth request: %v", err)
 	}
 
 	// Attempt to create same AuthRequest twice.
-	err := s.CreateAuthRequest(a1)
+	err := s.CreateAuthRequest(ctx, a1)
 	mustBeErrAlreadyExists(t, "auth request", err)
 
 	a2 := storage.AuthRequest{
@@ -128,6 +180,7 @@ func testAuthRequestCRUD(t *testing.T, s storage.Storage) {
 		ForceApprovalPrompt: true,
 		LoggedIn:            true,
 		Expiry:              neverExpire,
+		AuthTime:            defaultAuthTime,
 		ConnectorID:         "ldap",
 		ConnectorData:       []byte(`{"some":"data"}`),
 		Claims: storage.Claims{
@@ -137,13 +190,14 @@ func testAuthRequestCRUD(t *testing.T, s storage.Storage) {
 			EmailVerified: true,
 			Groups:        []string{"a"},
 		},
+		HMACKey: []byte("hmac_key"),
 	}
 
-	if err := s.CreateAuthRequest(a2); err != nil {
+	if err := s.CreateAuthRequest(ctx, a2); err != nil {
 		t.Fatalf("failed creating auth request: %v", err)
 	}
 
-	if err := s.UpdateAuthRequest(a1.ID, func(old storage.AuthRequest) (storage.AuthRequest, error) {
+	if err := s.UpdateAuthRequest(ctx, a1.ID, func(old storage.AuthRequest) (storage.AuthRequest, error) {
 		old.Claims = identity
 		old.ConnectorID = "connID"
 		return old, nil
@@ -151,7 +205,7 @@ func testAuthRequestCRUD(t *testing.T, s storage.Storage) {
 		t.Fatalf("failed to update auth request: %v", err)
 	}
 
-	got, err := s.GetAuthRequest(a1.ID)
+	got, err := s.GetAuthRequest(ctx, a1.ID)
 	if err != nil {
 		t.Fatalf("failed to get auth req: %v", err)
 	}
@@ -163,26 +217,30 @@ func testAuthRequestCRUD(t *testing.T, s storage.Storage) {
 		t.Fatalf("storage does not support PKCE, wanted challenge=%#v got %#v", codeChallenge, got.PKCE)
 	}
 
-	if err := s.DeleteAuthRequest(a1.ID); err != nil {
+	if err := s.DeleteAuthRequest(ctx, a1.ID); err != nil {
 		t.Fatalf("failed to delete auth request: %v", err)
 	}
 
-	if err := s.DeleteAuthRequest(a2.ID); err != nil {
+	if err := s.DeleteAuthRequest(ctx, a2.ID); err != nil {
 		t.Fatalf("failed to delete auth request: %v", err)
 	}
 
-	_, err = s.GetAuthRequest(a1.ID)
+	_, err = s.GetAuthRequest(ctx, a1.ID)
 	mustBeErrNotFound(t, "auth request", err)
 }
 
 func testAuthCodeCRUD(t *testing.T, s storage.Storage) {
+	ctx := t.Context()
 	a1 := storage.AuthCode{
-		ID:            storage.NewID(),
-		ClientID:      "client1",
-		RedirectURI:   "https://localhost:80/callback",
-		Nonce:         "foobar",
-		Scopes:        []string{"openid", "email"},
-		Expiry:        neverExpire,
+		ID:          storage.NewID(),
+		ClientID:    "client1",
+		RedirectURI: "https://localhost:80/callback",
+		Nonce:       "foobar",
+		Scopes:      []string{"openid", "email"},
+		Expiry:      neverExpire,
+		AuthTime:    defaultAuthTime,
+		// Explicitly persisted: at its zero value it round-trips even when dropped.
+		SessionID:     storage.NewID(),
 		ConnectorID:   "ldap",
 		ConnectorData: []byte(`{"some":"data"}`),
 		PKCE: storage.PKCE{
@@ -198,7 +256,7 @@ func testAuthCodeCRUD(t *testing.T, s storage.Storage) {
 		},
 	}
 
-	if err := s.CreateAuthCode(a1); err != nil {
+	if err := s.CreateAuthCode(ctx, a1); err != nil {
 		t.Fatalf("failed creating auth code: %v", err)
 	}
 
@@ -209,6 +267,7 @@ func testAuthCodeCRUD(t *testing.T, s storage.Storage) {
 		Nonce:         "foobar",
 		Scopes:        []string{"openid", "email"},
 		Expiry:        neverExpire,
+		AuthTime:      defaultAuthTime,
 		ConnectorID:   "ldap",
 		ConnectorData: []byte(`{"some":"data"}`),
 		Claims: storage.Claims{
@@ -221,55 +280,63 @@ func testAuthCodeCRUD(t *testing.T, s storage.Storage) {
 	}
 
 	// Attempt to create same AuthCode twice.
-	err := s.CreateAuthCode(a1)
+	err := s.CreateAuthCode(ctx, a1)
 	mustBeErrAlreadyExists(t, "auth code", err)
 
-	if err := s.CreateAuthCode(a2); err != nil {
+	if err := s.CreateAuthCode(ctx, a2); err != nil {
 		t.Fatalf("failed creating auth code: %v", err)
 	}
 
-	got, err := s.GetAuthCode(a1.ID)
+	got, err := s.GetAuthCode(ctx, a1.ID)
 	if err != nil {
 		t.Fatalf("failed to get auth code: %v", err)
 	}
 	if a1.Expiry.Unix() != got.Expiry.Unix() {
 		t.Errorf("auth code expiry did not match want=%s vs got=%s", a1.Expiry, got.Expiry)
 	}
-	got.Expiry = a1.Expiry // time fields do not compare well
+	got.Expiry = a1.Expiry     // time fields do not compare well
+	got.AuthTime = a1.AuthTime // time fields do not compare well
 	if diff := pretty.Compare(a1, got); diff != "" {
 		t.Errorf("auth code retrieved from storage did not match: %s", diff)
 	}
 
-	if err := s.DeleteAuthCode(a1.ID); err != nil {
+	if err := s.DeleteAuthCode(ctx, a1.ID); err != nil {
 		t.Fatalf("delete auth code: %v", err)
 	}
 
-	if err := s.DeleteAuthCode(a2.ID); err != nil {
+	if err := s.DeleteAuthCode(ctx, a2.ID); err != nil {
 		t.Fatalf("delete auth code: %v", err)
 	}
 
-	_, err = s.GetAuthCode(a1.ID)
+	_, err = s.GetAuthCode(ctx, a1.ID)
 	mustBeErrNotFound(t, "auth code", err)
 }
 
 func testClientCRUD(t *testing.T, s storage.Storage) {
+	ctx := t.Context()
 	id1 := storage.NewID()
 	c1 := storage.Client{
-		ID:           id1,
-		Secret:       "foobar",
-		RedirectURIs: []string{"foo://bar.com/", "https://auth.example.com"},
-		Name:         "dex client",
-		LogoURL:      "https://goo.gl/JIyzIC",
-	}
-	err := s.DeleteClient(id1)
+		ID:                id1,
+		Secret:            "foobar",
+		RedirectURIs:      []string{"foo://bar.com/", "https://auth.example.com"},
+		Name:              "dex client",
+		LogoURL:           "https://goo.gl/JIyzIC",
+		AllowedConnectors: []string{"github", "google"},
+		// Explicitly persisted fields: at their zero values they round-trip even
+		// when a backend drops them.
+		BackchannelLogoutURI:   "https://auth.example.com/backchannel-logout",
+		PostLogoutRedirectURIs: []string{"https://auth.example.com/"},
+		RefreshTokenLifetime:   storage.RefreshTokenLifetimeSession,
+	}
+	err := s.DeleteClient(ctx, id1)
 	mustBeErrNotFound(t, "client", err)
 
-	if err := s.CreateClient(c1); err != nil {
+	if err := s.CreateClient(ctx, c1); err != nil {
 		t.Fatalf("create client: %v", err)
 	}
 
 	// Attempt to create same Client twice.
-	err = s.CreateClient(c1)
+	err = s.CreateClient(ctx, c1)
 	mustBeErrAlreadyExists(t, "client", err)
 
 	id2 := storage.NewID()
@@ -281,12 +348,12 @@ func testClientCRUD(t *testing.T, s storage.Storage) {
 		LogoURL:      "https://goo.gl/JIyzIC",
 	}
 
-	if err := s.CreateClient(c2); err != nil {
+	if err := s.CreateClient(ctx, c2); err != nil {
 		t.Fatalf("create client: %v", err)
 	}
 
 	getAndCompare := func(_ string, want storage.Client) {
-		gc, err := s.GetClient(id1)
+		gc, err := s.GetClient(ctx, id1)
 		if err != nil {
 			t.Errorf("get client: %v", err)
 			return
@@ -299,7 +366,7 @@ func testClientCRUD(t *testing.T, s storage.Storage) {
 	getAndCompare(id1, c1)
 
 	newSecret := "barfoo"
-	err = s.UpdateClient(id1, func(old storage.Client) (storage.Client, error) {
+	err = s.UpdateClient(ctx, id1, func(old storage.Client) (storage.Client, error) {
 		old.Secret = newSecret
 		return old, nil
 	})
@@ -309,19 +376,68 @@ func testClientCRUD(t *testing.T, s storage.Storage) {
 	c1.Secret = newSecret
 	getAndCompare(id1, c1)
 
-	if err := s.DeleteClient(id1); err != nil {
+	// An update carries those same fields, not just the one it changes.
+	err = s.UpdateClient(ctx, id1, func(old storage.Client) (storage.Client, error) {
+		old.RefreshTokenLifetime = storage.RefreshTokenLifetimeStandalone
+		old.BackchannelLogoutURI = "https://auth.example.com/logout-2"
+		return old, nil
+	})
+	if err != nil {
+		t.Errorf("update client: %v", err)
+	}
+	c1.RefreshTokenLifetime = storage.RefreshTokenLifetimeStandalone
+	c1.BackchannelLogoutURI = "https://auth.example.com/logout-2"
+	getAndCompare(id1, c1)
+
+	// Verify SSOSharedWith nil vs empty slice roundtrip.
+	err = s.UpdateClient(ctx, id1, func(old storage.Client) (storage.Client, error) {
+		old.SSOSharedWith = []string{}
+		return old, nil
+	})
+	if err != nil {
+		t.Fatalf("update client ssoSharedWith to empty: %v", err)
+	}
+	gc, err := s.GetClient(ctx, id1)
+	if err != nil {
+		t.Fatalf("get client: %v", err)
+	}
+	if gc.SSOSharedWith == nil {
+		t.Error("expected empty slice for SSOSharedWith, got nil")
+	}
+	if len(gc.SSOSharedWith) != 0 {
+		t.Errorf("expected empty SSOSharedWith, got %v", gc.SSOSharedWith)
+	}
+
+	// Verify nil SSOSharedWith stays nil after roundtrip.
+	err = s.UpdateClient(ctx, id1, func(old storage.Client) (storage.Client, error) {
+		old.SSOSharedWith = nil
+		return old, nil
+	})
+	if err != nil {
+		t.Fatalf("update client ssoSharedWith to nil: %v", err)
+	}
+	gc, err = s.GetClient(ctx, id1)
+	if err != nil {
+		t.Fatalf("get client: %v", err)
+	}
+	if gc.SSOSharedWith != nil {
+		t.Errorf("expected nil SSOSharedWith, got %v", gc.SSOSharedWith)
+	}
+
+	if err := s.DeleteClient(ctx, id1); err != nil {
 		t.Fatalf("delete client: %v", err)
 	}
 
-	if err := s.DeleteClient(id2); err != nil {
+	if err := s.DeleteClient(ctx, id2); err != nil {
 		t.Fatalf("delete client: %v", err)
 	}
 
-	_, err = s.GetClient(id1)
+	_, err = s.GetClient(ctx, id1)
 	mustBeErrNotFound(t, "client", err)
 }
 
 func testRefreshTokenCRUD(t *testing.T, s storage.Storage) {
+	ctx := t.Context()
 	id := storage.NewID()
 	refresh := storage.RefreshToken{
 		ID:            id,
@@ -342,16 +458,16 @@ func testRefreshTokenCRUD(t *testing.T, s storage.Storage) {
 		},
 		ConnectorData: []byte(`{"some":"data"}`),
 	}
-	if err := s.CreateRefresh(refresh); err != nil {
+	if err := s.CreateRefresh(ctx, refresh); err != nil {
 		t.Fatalf("create refresh token: %v", err)
 	}
 
 	// Attempt to create same Refresh Token twice.
-	err := s.CreateRefresh(refresh)
+	err := s.CreateRefresh(ctx, refresh)
 	mustBeErrAlreadyExists(t, "refresh token", err)
 
 	getAndCompare := func(id string, want storage.RefreshToken) {
-		gr, err := s.GetRefresh(id)
+		gr, err := s.GetRefresh(ctx, id)
 		if err != nil {
 			t.Errorf("get refresh: %v", err)
 			return
@@ -398,7 +514,7 @@ func testRefreshTokenCRUD(t *testing.T, s storage.Storage) {
 		ConnectorData: []byte(`{"some":"data"}`),
 	}
 
-	if err := s.CreateRefresh(refresh2); err != nil {
+	if err := s.CreateRefresh(ctx, refresh2); err != nil {
 		t.Fatalf("create second refresh token: %v", err)
 	}
 
@@ -411,7 +527,7 @@ func testRefreshTokenCRUD(t *testing.T, s storage.Storage) {
 		r.LastUsed = updatedAt
 		return r, nil
 	}
-	if err := s.UpdateRefreshToken(id, updater); err != nil {
+	if err := s.UpdateRefreshToken(ctx, id, updater); err != nil {
 		t.Errorf("failed to update refresh token: %v", err)
 	}
 	refresh.Token = "spam"
@@ -421,15 +537,15 @@ func testRefreshTokenCRUD(t *testing.T, s storage.Storage) {
 	// Ensure that updating the first token doesn't impact the second. Issue #847.
 	getAndCompare(id2, refresh2)
 
-	if err := s.DeleteRefresh(id); err != nil {
+	if err := s.DeleteRefresh(ctx, id); err != nil {
 		t.Fatalf("failed to delete refresh request: %v", err)
 	}
 
-	if err := s.DeleteRefresh(id2); err != nil {
+	if err := s.DeleteRefresh(ctx, id2); err != nil {
 		t.Fatalf("failed to delete refresh request: %v", err)
 	}
 
-	_, err = s.GetRefresh(id)
+	_, err = s.GetRefresh(ctx, id)
 	mustBeErrNotFound(t, "refresh token", err)
 }
 
@@ -439,7 +555,12 @@ func (n byEmail) Len() int           { return len(n) }
 func (n byEmail) Less(i, j int) bool { return n[i].Email < n[j].Email }
 func (n byEmail) Swap(i, j int)      { n[i], n[j] = n[j], n[i] }
 
+func boolPtr(v bool) *bool {
+	return &v
+}
+
 func testPasswordCRUD(t *testing.T, s storage.Storage) {
+	ctx := t.Context()
 	// Use bcrypt.MinCost to keep the tests short.
 	passwordHash1, err := bcrypt.GenerateFromPassword([]byte("secret"), bcrypt.MinCost)
 	if err != nil {
@@ -447,17 +568,21 @@ func testPasswordCRUD(t *testing.T, s storage.Storage) {
 	}
 
 	password1 := storage.Password{
-		Email:    "jane@example.com",
-		Hash:     passwordHash1,
-		Username: "jane",
-		UserID:   "foobar",
-	}
-	if err := s.CreatePassword(password1); err != nil {
+		Email:             "jane@example.com",
+		Hash:              passwordHash1,
+		Username:          "jane",
+		Name:              "Jane Doe",
+		PreferredUsername: "jane-public",
+		EmailVerified:     boolPtr(true),
+		UserID:            "foobar",
+		Groups:            []string{"team-a", "team-a/admins"},
+	}
+	if err := s.CreatePassword(ctx, password1); err != nil {
 		t.Fatalf("create password token: %v", err)
 	}
 
 	// Attempt to create same Password twice.
-	err = s.CreatePassword(password1)
+	err = s.CreatePassword(ctx, password1)
 	mustBeErrAlreadyExists(t, "password", err)
 
 	passwordHash2, err := bcrypt.GenerateFromPassword([]byte("password"), bcrypt.MinCost)
@@ -466,17 +591,21 @@ func testPasswordCRUD(t *testing.T, s storage.Storage) {
 	}
 
 	password2 := storage.Password{
-		Email:    "john@example.com",
-		Hash:     passwordHash2,
-		Username: "john",
-		UserID:   "barfoo",
-	}
-	if err := s.CreatePassword(password2); err != nil {
+		Email:             "john@example.com",
+		Hash:              passwordHash2,
+		Username:          "john",
+		Name:              "John Smith",
+		PreferredUsername: "john-public",
+		EmailVerified:     boolPtr(false),
+		UserID:            "barfoo",
+		Groups:            []string{"team-b"},
+	}
+	if err := s.CreatePassword(ctx, password2); err != nil {
 		t.Fatalf("create password token: %v", err)
 	}
 
 	getAndCompare := func(id string, want storage.Password) {
-		gr, err := s.GetPassword(id)
+		gr, err := s.GetPassword(ctx, id)
 		if err != nil {
 			t.Errorf("get password %q: %v", id, err)
 			return
@@ -489,7 +618,7 @@ func testPasswordCRUD(t *testing.T, s storage.Storage) {
 	getAndCompare("jane@example.com", password1)
 	getAndCompare("JANE@example.com", password1) // Emails should be case insensitive
 
-	if err := s.UpdatePassword(password1.Email, func(old storage.Password) (storage.Password, error) {
+	if err := s.UpdatePassword(ctx, password1.Email, func(old storage.Password) (storage.Password, error) {
 		old.Username = "jane doe"
 		return old, nil
 	}); err != nil {
@@ -503,7 +632,7 @@ func testPasswordCRUD(t *testing.T, s storage.Storage) {
 	passwordList = append(passwordList, password1, password2)
 
 	listAndCompare := func(want []storage.Password) {
-		passwords, err := s.ListPasswords()
+		passwords, err := s.ListPasswords(ctx)
 		if err != nil {
 			t.Errorf("list password: %v", err)
 			return
@@ -517,19 +646,20 @@ func testPasswordCRUD(t *testing.T, s storage.Storage) {
 
 	listAndCompare(passwordList)
 
-	if err := s.DeletePassword(password1.Email); err != nil {
+	if err := s.DeletePassword(ctx, password1.Email); err != nil {
 		t.Fatalf("failed to delete password: %v", err)
 	}
 
-	if err := s.DeletePassword(password2.Email); err != nil {
+	if err := s.DeletePassword(ctx, password2.Email); err != nil {
 		t.Fatalf("failed to delete password: %v", err)
 	}
 
-	_, err = s.GetPassword(password1.Email)
+	_, err = s.GetPassword(ctx, password1.Email)
 	mustBeErrNotFound(t, "password", err)
 }
 
 func testOfflineSessionCRUD(t *testing.T, s storage.Storage) {
+	ctx := t.Context()
 	userID1 := storage.NewID()
 	session1 := storage.OfflineSessions{
 		UserID:        userID1,
@@ -540,12 +670,12 @@ func testOfflineSessionCRUD(t *testing.T, s storage.Storage) {
 
 	// Creating an OfflineSession with an empty Refresh list to ensure that
 	// an empty map is translated as expected by the storage.
-	if err := s.CreateOfflineSessions(session1); err != nil {
+	if err := s.CreateOfflineSessions(ctx, session1); err != nil {
 		t.Fatalf("create offline session with UserID = %s: %v", session1.UserID, err)
 	}
 
 	// Attempt to create same OfflineSession twice.
-	err := s.CreateOfflineSessions(session1)
+	err := s.CreateOfflineSessions(ctx, session1)
 	mustBeErrAlreadyExists(t, "offline session", err)
 
 	userID2 := storage.NewID()
@@ -556,12 +686,12 @@ func testOfflineSessionCRUD(t *testing.T, s storage.Storage) {
 		ConnectorData: []byte(`{"some":"data"}`),
 	}
 
-	if err := s.CreateOfflineSessions(session2); err != nil {
+	if err := s.CreateOfflineSessions(ctx, session2); err != nil {
 		t.Fatalf("create offline session with UserID = %s: %v", session2.UserID, err)
 	}
 
 	getAndCompare := func(userID string, connID string, want storage.OfflineSessions) {
-		gr, err := s.GetOfflineSessions(userID, connID)
+		gr, err := s.GetOfflineSessions(ctx, userID, connID)
 		if err != nil {
 			t.Errorf("get offline session: %v", err)
 			return
@@ -582,7 +712,7 @@ func testOfflineSessionCRUD(t *testing.T, s storage.Storage) {
 	}
 	session1.Refresh[tokenRef.ClientID] = &tokenRef
 
-	if err := s.UpdateOfflineSessions(session1.UserID, session1.ConnID, func(old storage.OfflineSessions) (storage.OfflineSessions, error) {
+	if err := s.UpdateOfflineSessions(ctx, session1.UserID, session1.ConnID, func(old storage.OfflineSessions) (storage.OfflineSessions, error) {
 		old.Refresh[tokenRef.ClientID] = &tokenRef
 		return old, nil
 	}); err != nil {
@@ -591,34 +721,36 @@ func testOfflineSessionCRUD(t *testing.T, s storage.Storage) {
 
 	getAndCompare(userID1, "Conn1", session1)
 
-	if err := s.DeleteOfflineSessions(session1.UserID, session1.ConnID); err != nil {
+	if err := s.DeleteOfflineSessions(ctx, session1.UserID, session1.ConnID); err != nil {
 		t.Fatalf("failed to delete offline session: %v", err)
 	}
 
-	if err := s.DeleteOfflineSessions(session2.UserID, session2.ConnID); err != nil {
+	if err := s.DeleteOfflineSessions(ctx, session2.UserID, session2.ConnID); err != nil {
 		t.Fatalf("failed to delete offline session: %v", err)
 	}
 
-	_, err = s.GetOfflineSessions(session1.UserID, session1.ConnID)
+	_, err = s.GetOfflineSessions(ctx, session1.UserID, session1.ConnID)
 	mustBeErrNotFound(t, "offline session", err)
 }
 
 func testConnectorCRUD(t *testing.T, s storage.Storage) {
+	ctx := t.Context()
 	id1 := storage.NewID()
 	config1 := []byte(`{"issuer": "https://accounts.google.com"}`)
 	c1 := storage.Connector{
-		ID:     id1,
-		Type:   "Default",
-		Name:   "Default",
-		Config: config1,
+		ID:         id1,
+		Type:       "Default",
+		Name:       "Default",
+		Config:     config1,
+		GrantTypes: []string{"authorization_code", "refresh_token"},
 	}
 
-	if err := s.CreateConnector(c1); err != nil {
+	if err := s.CreateConnector(ctx, c1); err != nil {
 		t.Fatalf("create connector with ID = %s: %v", c1.ID, err)
 	}
 
 	// Attempt to create same Connector twice.
-	err := s.CreateConnector(c1)
+	err := s.CreateConnector(ctx, c1)
 	mustBeErrAlreadyExists(t, "connector", err)
 
 	id2 := storage.NewID()
@@ -630,12 +762,12 @@ func testConnectorCRUD(t *testing.T, s storage.Storage) {
 		Config: config2,
 	}
 
-	if err := s.CreateConnector(c2); err != nil {
+	if err := s.CreateConnector(ctx, c2); err != nil {
 		t.Fatalf("create connector with ID = %s: %v", c2.ID, err)
 	}
 
 	getAndCompare := func(id string, want storage.Connector) {
-		gr, err := s.GetConnector(id)
+		gr, err := s.GetConnector(ctx, id)
 		if err != nil {
 			t.Errorf("get connector: %v", err)
 			return
@@ -649,19 +781,21 @@ func testConnectorCRUD(t *testing.T, s storage.Storage) {
 
 	getAndCompare(id1, c1)
 
-	if err := s.UpdateConnector(c1.ID, func(old storage.Connector) (storage.Connector, error) {
+	if err := s.UpdateConnector(ctx, c1.ID, func(old storage.Connector) (storage.Connector, error) {
 		old.Type = "oidc"
+		old.GrantTypes = []string{"urn:ietf:params:oauth:grant-type:token-exchange"}
 		return old, nil
 	}); err != nil {
 		t.Fatalf("failed to update Connector: %v", err)
 	}
 
 	c1.Type = "oidc"
+	c1.GrantTypes = []string{"urn:ietf:params:oauth:grant-type:token-exchange"}
 	getAndCompare(id1, c1)
 
 	connectorList := []storage.Connector{c1, c2}
 	listAndCompare := func(want []storage.Connector) {
-		connectors, err := s.ListConnectors()
+		connectors, err := s.ListConnectors(ctx)
 		if err != nil {
 			t.Errorf("list connectors: %v", err)
 			return
@@ -679,68 +813,86 @@ func testConnectorCRUD(t *testing.T, s storage.Storage) {
 	}
 	listAndCompare(connectorList)
 
-	if err := s.DeleteConnector(c1.ID); err != nil {
+	if err := s.DeleteConnector(ctx, c1.ID); err != nil {
 		t.Fatalf("failed to delete connector: %v", err)
 	}
 
-	if err := s.DeleteConnector(c2.ID); err != nil {
+	if err := s.DeleteConnector(ctx, c2.ID); err != nil {
 		t.Fatalf("failed to delete connector: %v", err)
 	}
 
-	_, err = s.GetConnector(c1.ID)
+	_, err = s.GetConnector(ctx, c1.ID)
 	mustBeErrNotFound(t, "connector", err)
 }
 
 func testKeysCRUD(t *testing.T, s storage.Storage) {
-	updateAndCompare := func(k storage.Keys) {
-		err := s.UpdateKeys(func(oldKeys storage.Keys) (storage.Keys, error) {
-			return k, nil
-		})
-		if err != nil {
-			t.Errorf("failed to update keys: %v", err)
-			return
-		}
-
-		if got, err := s.GetKeys(); err != nil {
-			t.Errorf("failed to get keys: %v", err)
-		} else {
-			got.NextRotation = got.NextRotation.UTC()
-			if diff := pretty.Compare(k, got); diff != "" {
-				t.Errorf("got keys did not equal expected: %s", diff)
-			}
-		}
-	}
+	ctx := t.Context()
 
 	// Postgres isn't as accurate with nano seconds as we'd like
 	n := time.Now().UTC().Round(time.Second)
 
-	keys1 := storage.Keys{
-		SigningKey:    jsonWebKeys[0].Private,
-		SigningKeyPub: jsonWebKeys[0].Public,
-		NextRotation:  n,
-	}
-
-	keys2 := storage.Keys{
-		SigningKey:    jsonWebKeys[2].Private,
-		SigningKeyPub: jsonWebKeys[2].Public,
-		NextRotation:  n.Add(time.Hour),
-		VerificationKeys: []storage.VerificationKey{
-			{
-				PublicKey: jsonWebKeys[0].Public,
-				Expiry:    n.Add(time.Hour),
+	tests := []struct {
+		name string
+		keys storage.Keys
+	}{
+		{
+			name: "rsa signing key",
+			keys: storage.Keys{
+				SigningKey:    jsonWebKeys[0].Private,
+				SigningKeyPub: jsonWebKeys[0].Public,
+				NextRotation:  n,
 			},
-			{
-				PublicKey: jsonWebKeys[1].Public,
-				Expiry:    n.Add(time.Hour * 2),
+		},
+		{
+			name: "es256 signing key",
+			keys: storage.Keys{
+				SigningKey:    jsonWebKeys[5].Private,
+				SigningKeyPub: jsonWebKeys[5].Public,
+				NextRotation:  n.Add(time.Hour),
+			},
+		},
+		{
+			name: "mixed verification key algorithms",
+			keys: storage.Keys{
+				SigningKey:    jsonWebKeys[6].Private,
+				SigningKeyPub: jsonWebKeys[6].Public,
+				NextRotation:  n.Add(2 * time.Hour),
+				VerificationKeys: []storage.VerificationKey{
+					{
+						PublicKey: jsonWebKeys[1].Public,
+						Expiry:    n.Add(3 * time.Hour),
+					},
+					{
+						PublicKey: jsonWebKeys[5].Public,
+						Expiry:    n.Add(4 * time.Hour),
+					},
+				},
 			},
 		},
 	}
 
-	updateAndCompare(keys1)
-	updateAndCompare(keys2)
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			err := s.UpdateKeys(ctx, func(oldKeys storage.Keys) (storage.Keys, error) {
+				return tt.keys, nil
+			})
+			require.NoError(t, err)
+
+			got, err := s.GetKeys(ctx)
+			require.NoError(t, err)
+
+			got.NextRotation = got.NextRotation.UTC()
+			if diff := pretty.Compare(tt.keys, got); diff != "" {
+				t.Fatalf("got keys did not equal expected: %s", diff)
+			}
+
+			requireSigningKeyRoundTripUsable(t, got)
+		})
+	}
 }
 
 func testGC(t *testing.T, s storage.Storage) {
+	ctx := t.Context()
 	est, err := time.LoadLocation("America/New_York")
 	if err != nil {
 		t.Fatal(err)
@@ -758,6 +910,7 @@ func testGC(t *testing.T, s storage.Storage) {
 		Nonce:         "foobar",
 		Scopes:        []string{"openid", "email"},
 		Expiry:        expiry,
+		AuthTime:      defaultAuthTime,
 		ConnectorID:   "ldap",
 		ConnectorData: []byte(`{"some":"data"}`),
 		Claims: storage.Claims{
@@ -769,29 +922,29 @@ func testGC(t *testing.T, s storage.Storage) {
 		},
 	}
 
-	if err := s.CreateAuthCode(c); err != nil {
+	if err := s.CreateAuthCode(ctx, c); err != nil {
 		t.Fatalf("failed creating auth code: %v", err)
 	}
 
 	for _, tz := range []*time.Location{time.UTC, est, pst} {
-		result, err := s.GarbageCollect(expiry.Add(-time.Hour).In(tz))
+		result, err := s.GarbageCollect(ctx, expiry.Add(-time.Hour).In(tz))
 		if err != nil {
 			t.Errorf("garbage collection failed: %v", err)
 		} else if result.AuthCodes != 0 || result.AuthRequests != 0 {
 			t.Errorf("expected no garbage collection results, got %#v", result)
 		}
-		if _, err := s.GetAuthCode(c.ID); err != nil {
+		if _, err := s.GetAuthCode(ctx, c.ID); err != nil {
 			t.Errorf("expected to be able to get auth code after GC: %v", err)
 		}
 	}
 
-	if r, err := s.GarbageCollect(expiry.Add(time.Hour)); err != nil {
+	if r, err := s.GarbageCollect(ctx, expiry.Add(time.Hour)); err != nil {
 		t.Errorf("garbage collection failed: %v", err)
 	} else if r.AuthCodes != 1 {
 		t.Errorf("expected to garbage collect 1 objects, got %d", r.AuthCodes)
 	}
 
-	if _, err := s.GetAuthCode(c.ID); err == nil {
+	if _, err := s.GetAuthCode(ctx, c.ID); err == nil {
 		t.Errorf("expected auth code to be GC'd")
 	} else if err != storage.ErrNotFound {
 		t.Errorf("expected storage.ErrNotFound, got %v", err)
@@ -808,6 +961,7 @@ func testGC(t *testing.T, s storage.Storage) {
 		ForceApprovalPrompt: true,
 		LoggedIn:            true,
 		Expiry:              expiry,
+		AuthTime:            defaultAuthTime,
 		ConnectorID:         "ldap",
 		ConnectorData:       []byte(`{"some":"data"}`),
 		Claims: storage.Claims{
@@ -817,31 +971,32 @@ func testGC(t *testing.T, s storage.Storage) {
 			EmailVerified: true,
 			Groups:        []string{"a", "b"},
 		},
+		HMACKey: []byte("hmac_key"),
 	}
 
-	if err := s.CreateAuthRequest(a); err != nil {
+	if err := s.CreateAuthRequest(ctx, a); err != nil {
 		t.Fatalf("failed creating auth request: %v", err)
 	}
 
 	for _, tz := range []*time.Location{time.UTC, est, pst} {
-		result, err := s.GarbageCollect(expiry.Add(-time.Hour).In(tz))
+		result, err := s.GarbageCollect(ctx, expiry.Add(-time.Hour).In(tz))
 		if err != nil {
 			t.Errorf("garbage collection failed: %v", err)
 		} else if result.AuthCodes != 0 || result.AuthRequests != 0 {
 			t.Errorf("expected no garbage collection results, got %#v", result)
 		}
-		if _, err := s.GetAuthRequest(a.ID); err != nil {
+		if _, err := s.GetAuthRequest(ctx, a.ID); err != nil {
 			t.Errorf("expected to be able to get auth request after GC: %v", err)
 		}
 	}
 
-	if r, err := s.GarbageCollect(expiry.Add(time.Hour)); err != nil {
+	if r, err := s.GarbageCollect(ctx, expiry.Add(time.Hour)); err != nil {
 		t.Errorf("garbage collection failed: %v", err)
 	} else if r.AuthRequests != 1 {
 		t.Errorf("expected to garbage collect 1 objects, got %d", r.AuthRequests)
 	}
 
-	if _, err := s.GetAuthRequest(a.ID); err == nil {
+	if _, err := s.GetAuthRequest(ctx, a.ID); err == nil {
 		t.Errorf("expected auth request to be GC'd")
 	} else if err != storage.ErrNotFound {
 		t.Errorf("expected storage.ErrNotFound, got %v", err)
@@ -856,28 +1011,28 @@ func testGC(t *testing.T, s storage.Storage) {
 		Expiry:       expiry,
 	}
 
-	if err := s.CreateDeviceRequest(d); err != nil {
+	if err := s.CreateDeviceRequest(ctx, d); err != nil {
 		t.Fatalf("failed creating device request: %v", err)
 	}
 
 	for _, tz := range []*time.Location{time.UTC, est, pst} {
-		result, err := s.GarbageCollect(expiry.Add(-time.Hour).In(tz))
+		result, err := s.GarbageCollect(ctx, expiry.Add(-time.Hour).In(tz))
 		if err != nil {
 			t.Errorf("garbage collection failed: %v", err)
 		} else if result.DeviceRequests != 0 {
 			t.Errorf("expected no device garbage collection results, got %#v", result)
 		}
-		if _, err := s.GetDeviceRequest(d.UserCode); err != nil {
+		if _, err := s.GetDeviceRequest(ctx, d.UserCode); err != nil {
 			t.Errorf("expected to be able to get auth request after GC: %v", err)
 		}
 	}
-	if r, err := s.GarbageCollect(expiry.Add(time.Hour)); err != nil {
+	if r, err := s.GarbageCollect(ctx, expiry.Add(time.Hour)); err != nil {
 		t.Errorf("garbage collection failed: %v", err)
 	} else if r.DeviceRequests != 1 {
 		t.Errorf("expected to garbage collect 1 device request, got %d", r.DeviceRequests)
 	}
 
-	if _, err := s.GetDeviceRequest(d.UserCode); err == nil {
+	if _, err := s.GetDeviceRequest(ctx, d.UserCode); err == nil {
 		t.Errorf("expected device request to be GC'd")
 	} else if err != storage.ErrNotFound {
 		t.Errorf("expected storage.ErrNotFound, got %v", err)
@@ -896,37 +1051,135 @@ func testGC(t *testing.T, s storage.Storage) {
 		},
 	}
 
-	if err := s.CreateDeviceToken(dt); err != nil {
+	if err := s.CreateDeviceToken(ctx, dt); err != nil {
 		t.Fatalf("failed creating device token: %v", err)
 	}
 
 	for _, tz := range []*time.Location{time.UTC, est, pst} {
-		result, err := s.GarbageCollect(expiry.Add(-time.Hour).In(tz))
+		result, err := s.GarbageCollect(ctx, expiry.Add(-time.Hour).In(tz))
 		if err != nil {
 			t.Errorf("garbage collection failed: %v", err)
 		} else if result.DeviceTokens != 0 {
 			t.Errorf("expected no device token garbage collection results, got %#v", result)
 		}
-		if _, err := s.GetDeviceToken(dt.DeviceCode); err != nil {
+		if _, err := s.GetDeviceToken(ctx, dt.DeviceCode); err != nil {
 			t.Errorf("expected to be able to get device token after GC: %v", err)
 		}
 	}
-	if r, err := s.GarbageCollect(expiry.Add(time.Hour)); err != nil {
+	if r, err := s.GarbageCollect(ctx, expiry.Add(time.Hour)); err != nil {
 		t.Errorf("garbage collection failed: %v", err)
 	} else if r.DeviceTokens != 1 {
 		t.Errorf("expected to garbage collect 1 device token, got %d", r.DeviceTokens)
 	}
 
-	if _, err := s.GetDeviceToken(dt.DeviceCode); err == nil {
+	if _, err := s.GetDeviceToken(ctx, dt.DeviceCode); err == nil {
 		t.Errorf("expected device token to be GC'd")
 	} else if err != storage.ErrNotFound {
 		t.Errorf("expected storage.ErrNotFound, got %v", err)
 	}
+
+	// Test auth session GC.
+	authSession := storage.AuthSession{
+		ID:          storage.NewID(),
+		Secret:      storage.NewID(),
+		UserID:      "gc-user",
+		ConnectorID: "gc-conn",
+		ClientStates: map[string]*storage.ClientAuthState{
+			"client1": {AuthenticatedAt: expiry, LastActivity: expiry},
+		},
+		CreatedAt:      expiry.Add(-time.Hour),
+		LastActivity:   expiry.Add(-time.Hour),
+		AbsoluteExpiry: expiry,
+		IdleExpiry:     expiry,
+	}
+
+	if err := s.CreateAuthSession(ctx, authSession); err != nil {
+		t.Fatalf("failed creating auth session: %v", err)
+	}
+
+	// GC before expiry should not delete.
+	for _, tz := range []*time.Location{time.UTC, est, pst} {
+		result, err := s.GarbageCollect(ctx, expiry.Add(-time.Hour).In(tz))
+		if err != nil {
+			t.Errorf("garbage collection failed: %v", err)
+		} else if result.AuthSessions != 0 {
+			t.Errorf("expected no auth session garbage collection results, got %#v", result)
+		}
+		if _, err := s.GetAuthSession(ctx, authSession.ID); err != nil {
+			t.Errorf("expected to be able to get auth session after GC: %v", err)
+		}
+	}
+
+	// GC after expiry should delete.
+	if r, err := s.GarbageCollect(ctx, expiry.Add(time.Hour)); err != nil {
+		t.Errorf("garbage collection failed: %v", err)
+	} else if r.AuthSessions != 1 {
+		t.Errorf("expected to garbage collect 1 auth session, got %d", r.AuthSessions)
+	}
+
+	if _, err := s.GetAuthSession(ctx, authSession.ID); err == nil {
+		t.Errorf("expected auth session to be GC'd")
+	} else if err != storage.ErrNotFound {
+		t.Errorf("expected storage.ErrNotFound, got %v", err)
+	}
+
+	// Test auth session GC: absolute expired, idle still valid.
+	absExpiredSession := storage.AuthSession{
+		ID:          storage.NewID(),
+		Secret:      storage.NewID(),
+		UserID:      "gc-abs-expired",
+		ConnectorID: "gc-conn",
+		ClientStates: map[string]*storage.ClientAuthState{
+			"client1": {AuthenticatedAt: expiry, LastActivity: expiry},
+		},
+		CreatedAt:      expiry.Add(-25 * time.Hour),
+		LastActivity:   expiry.Add(-time.Minute),
+		AbsoluteExpiry: expiry.Add(-time.Hour), // expired
+		IdleExpiry:     expiry.Add(time.Hour),  // still valid
+	}
+	if err := s.CreateAuthSession(ctx, absExpiredSession); err != nil {
+		t.Fatalf("failed creating abs-expired auth session: %v", err)
+	}
+	if r, err := s.GarbageCollect(ctx, expiry); err != nil {
+		t.Errorf("garbage collection failed: %v", err)
+	} else if r.AuthSessions != 1 {
+		t.Errorf("expected to garbage collect 1 auth session (absolute expired), got %d", r.AuthSessions)
+	}
+	if _, err := s.GetAuthSession(ctx, absExpiredSession.ID); err == nil {
+		t.Errorf("expected abs-expired auth session to be GC'd")
+	}
+
+	// Test auth session GC: absolute still valid, idle expired.
+	idleExpiredSession := storage.AuthSession{
+		ID:          storage.NewID(),
+		Secret:      storage.NewID(),
+		UserID:      "gc-idle-expired",
+		ConnectorID: "gc-conn",
+		ClientStates: map[string]*storage.ClientAuthState{
+			"client1": {AuthenticatedAt: expiry, LastActivity: expiry},
+		},
+		CreatedAt:      expiry.Add(-time.Hour),
+		LastActivity:   expiry.Add(-2 * time.Hour),
+		AbsoluteExpiry: expiry.Add(23 * time.Hour), // still valid
+		IdleExpiry:     expiry.Add(-time.Hour),     // expired
+	}
+	if err := s.CreateAuthSession(ctx, idleExpiredSession); err != nil {
+		t.Fatalf("failed creating idle-expired auth session: %v", err)
+	}
+	if r, err := s.GarbageCollect(ctx, expiry); err != nil {
+		t.Errorf("garbage collection failed: %v", err)
+	} else if r.AuthSessions != 1 {
+		t.Errorf("expected to garbage collect 1 auth session (idle expired), got %d", r.AuthSessions)
+	}
+	if _, err := s.GetAuthSession(ctx, idleExpiredSession.ID); err == nil {
+		t.Errorf("expected idle-expired auth session to be GC'd")
+	}
 }
 
 // testTimezones tests that backends either fully support timezones or
 // do the correct standardization.
 func testTimezones(t *testing.T, s storage.Storage) {
+	ctx := t.Context()
 	est, err := time.LoadLocation("America/New_York")
 	if err != nil {
 		t.Fatal(err)
@@ -942,6 +1195,7 @@ func testTimezones(t *testing.T, s storage.Storage) {
 		Nonce:         "foobar",
 		Scopes:        []string{"openid", "email"},
 		Expiry:        expiry,
+		AuthTime:      defaultAuthTime,
 		ConnectorID:   "ldap",
 		ConnectorData: []byte(`{"some":"data"}`),
 		Claims: storage.Claims{
@@ -952,10 +1206,10 @@ func testTimezones(t *testing.T, s storage.Storage) {
 			Groups:        []string{"a", "b"},
 		},
 	}
-	if err := s.CreateAuthCode(c); err != nil {
+	if err := s.CreateAuthCode(ctx, c); err != nil {
 		t.Fatalf("failed creating auth code: %v", err)
 	}
-	got, err := s.GetAuthCode(c.ID)
+	got, err := s.GetAuthCode(ctx, c.ID)
 	if err != nil {
 		t.Fatalf("failed to get auth code: %v", err)
 	}
@@ -971,28 +1225,45 @@ func testTimezones(t *testing.T, s storage.Storage) {
 }
 
 func testDeviceRequestCRUD(t *testing.T, s storage.Storage) {
+	ctx := t.Context()
 	d1 := storage.DeviceRequest{
 		UserCode:     storage.NewUserCode(),
 		DeviceCode:   storage.NewID(),
 		ClientID:     "client1",
 		ClientSecret: "secret1",
 		Scopes:       []string{"openid", "email"},
-		Expiry:       neverExpire,
+		Expiry:       neverExpire.Round(time.Second),
 	}
 
-	if err := s.CreateDeviceRequest(d1); err != nil {
+	if err := s.CreateDeviceRequest(ctx, d1); err != nil {
 		t.Fatalf("failed creating device request: %v", err)
 	}
 
 	// Attempt to create same DeviceRequest twice.
-	err := s.CreateDeviceRequest(d1)
+	err := s.CreateDeviceRequest(ctx, d1)
 	mustBeErrAlreadyExists(t, "device request", err)
 
+	got, err := s.GetDeviceRequest(ctx, d1.UserCode)
+	if err != nil {
+		t.Fatalf("failed to get device request: %v", err)
+	}
+
+	// Storage backends are not expected to preserve the time.Location of the
+	// stored value, only the instant. Postgres, for example, returns the
+	// expiry in a loaded "Etc/UTC" location rather than the time.UTC
+	// singleton, which makes reflect.DeepEqual (used by require.Equal)
+	// report a difference even though the two times are the same instant.
+	// Normalize to UTC before comparing, matching the other CRUD tests.
+	got.Expiry = got.Expiry.UTC()
+
+	require.Equal(t, d1, got)
+
 	// No manual deletes for device requests, will be handled by garbage collection routines
 	// see testGC
 }
 
 func testDeviceTokenCRUD(t *testing.T, s storage.Storage) {
+	ctx := t.Context()
 	codeChallenge := storage.PKCE{
 		CodeChallenge:       "code_challenge_test",
 		CodeChallengeMethod: "plain",
@@ -1009,16 +1280,16 @@ func testDeviceTokenCRUD(t *testing.T, s storage.Storage) {
 		PKCE:                codeChallenge,
 	}
 
-	if err := s.CreateDeviceToken(d1); err != nil {
+	if err := s.CreateDeviceToken(ctx, d1); err != nil {
 		t.Fatalf("failed creating device token: %v", err)
 	}
 
 	// Attempt to create same Device Token twice.
-	err := s.CreateDeviceToken(d1)
+	err := s.CreateDeviceToken(ctx, d1)
 	mustBeErrAlreadyExists(t, "device token", err)
 
 	// Update the device token, simulate a redemption
-	if err := s.UpdateDeviceToken(d1.DeviceCode, func(old storage.DeviceToken) (storage.DeviceToken, error) {
+	if err := s.UpdateDeviceToken(ctx, d1.DeviceCode, func(old storage.DeviceToken) (storage.DeviceToken, error) {
 		old.Token = "token data"
 		old.Status = "complete"
 		return old, nil
@@ -1027,7 +1298,7 @@ func testDeviceTokenCRUD(t *testing.T, s storage.Storage) {
 	}
 
 	// Retrieve the device token
-	got, err := s.GetDeviceToken(d1.DeviceCode)
+	got, err := s.GetDeviceToken(ctx, d1.DeviceCode)
 	if err != nil {
 		t.Fatalf("failed to get device token: %v", err)
 	}
@@ -1043,3 +1314,195 @@ func testDeviceTokenCRUD(t *testing.T, s storage.Storage) {
 		t.Fatalf("storage does not support PKCE, wanted challenge=%#v got %#v", codeChallenge, got.PKCE)
 	}
 }
+
+func testUserIdentityCRUD(t *testing.T, s storage.Storage) {
+	ctx := t.Context()
+
+	now := time.Now().UTC().Round(time.Millisecond)
+
+	u1 := storage.UserIdentity{
+		UserID:      "user1",
+		ConnectorID: "conn1",
+		Claims: storage.Claims{
+			UserID:        "user1",
+			Username:      "jane",
+			Email:         "jane@example.com",
+			EmailVerified: true,
+			Groups:        []string{"a", "b"},
+		},
+		Consents:     make(map[string][]string),
+		CreatedAt:    now,
+		LastLogin:    now,
+		BlockedUntil: time.Unix(0, 0).UTC(),
+	}
+
+	// Create with empty Consents map.
+	if err := s.CreateUserIdentity(ctx, u1); err != nil {
+		t.Fatalf("create user identity: %v", err)
+	}
+
+	// Duplicate create should return ErrAlreadyExists.
+	err := s.CreateUserIdentity(ctx, u1)
+	mustBeErrAlreadyExists(t, "user identity", err)
+
+	// Get and compare.
+	got, err := s.GetUserIdentity(ctx, u1.UserID, u1.ConnectorID)
+	if err != nil {
+		t.Fatalf("get user identity: %v", err)
+	}
+
+	got.CreatedAt = got.CreatedAt.UTC().Round(time.Millisecond)
+	got.LastLogin = got.LastLogin.UTC().Round(time.Millisecond)
+	got.BlockedUntil = got.BlockedUntil.UTC().Round(time.Millisecond)
+	u1.BlockedUntil = u1.BlockedUntil.UTC().Round(time.Millisecond)
+	if diff := pretty.Compare(u1, got); diff != "" {
+		t.Errorf("user identity retrieved from storage did not match: %s", diff)
+	}
+
+	// Update: add consent entry.
+	if err := s.UpdateUserIdentity(ctx, u1.UserID, u1.ConnectorID, func(old storage.UserIdentity) (storage.UserIdentity, error) {
+		old.Consents["client1"] = []string{"openid", "email"}
+		return old, nil
+	}); err != nil {
+		t.Fatalf("update user identity: %v", err)
+	}
+
+	// Get and verify updated consents.
+	got, err = s.GetUserIdentity(ctx, u1.UserID, u1.ConnectorID)
+	if err != nil {
+		t.Fatalf("get user identity after update: %v", err)
+	}
+	wantConsents := map[string][]string{"client1": {"openid", "email"}}
+	if diff := pretty.Compare(wantConsents, got.Consents); diff != "" {
+		t.Errorf("user identity consents did not match after update: %s", diff)
+	}
+
+	// List and verify.
+	identities, err := s.ListUserIdentities(ctx)
+	if err != nil {
+		t.Fatalf("list user identities: %v", err)
+	}
+	if len(identities) != 1 {
+		t.Fatalf("expected 1 user identity, got %d", len(identities))
+	}
+
+	// Delete.
+	if err := s.DeleteUserIdentity(ctx, u1.UserID, u1.ConnectorID); err != nil {
+		t.Fatalf("delete user identity: %v", err)
+	}
+
+	// Get deleted should return ErrNotFound.
+	_, err = s.GetUserIdentity(ctx, u1.UserID, u1.ConnectorID)
+	mustBeErrNotFound(t, "user identity", err)
+}
+
+func testAuthSessionCRUD(t *testing.T, s storage.Storage) {
+	ctx := t.Context()
+
+	now := time.Now().UTC().Round(time.Millisecond)
+
+	session := storage.AuthSession{
+		ID:          storage.NewID(),
+		Secret:      storage.NewID(),
+		UserID:      "user1",
+		ConnectorID: "conn1",
+		ClientStates: map[string]*storage.ClientAuthState{
+			"client1": {
+				AuthenticatedAt:   now,
+				LastActivity:      now,
+				LastTokenIssuedAt: now,
+			},
+		},
+		CreatedAt:      now,
+		LastActivity:   now,
+		IPAddress:      "192.168.1.1",
+		UserAgent:      "TestBrowser/1.0",
+		AbsoluteExpiry: now.Add(24 * time.Hour),
+		IdleExpiry:     now.Add(1 * time.Hour),
+		// A logout in flight: every backend has to carry it, or the upstream
+		// logout callback finds nothing to finish.
+		LogoutState: &storage.LogoutState{
+			PostLogoutRedirectURI: "https://app.example.com/",
+			State:                 "opaque",
+			ClientID:              "client1",
+			ConnectorID:           "conn1",
+		},
+	}
+
+	// Create.
+	if err := s.CreateAuthSession(ctx, session); err != nil {
+		t.Fatalf("create auth session: %v", err)
+	}
+
+	// Duplicate create should return ErrAlreadyExists.
+	err := s.CreateAuthSession(ctx, session)
+	mustBeErrAlreadyExists(t, "auth session", err)
+
+	// Get and compare.
+	got, err := s.GetAuthSession(ctx, session.ID)
+	if err != nil {
+		t.Fatalf("get auth session: %v", err)
+	}
+
+	got.CreatedAt = got.CreatedAt.UTC().Round(time.Millisecond)
+	got.LastActivity = got.LastActivity.UTC().Round(time.Millisecond)
+	got.AbsoluteExpiry = got.AbsoluteExpiry.UTC().Round(time.Millisecond)
+	got.IdleExpiry = got.IdleExpiry.UTC().Round(time.Millisecond)
+	for _, cs := range got.ClientStates {
+		cs.AuthenticatedAt = cs.AuthenticatedAt.UTC().Round(time.Millisecond)
+		cs.LastActivity = cs.LastActivity.UTC().Round(time.Millisecond)
+		cs.LastTokenIssuedAt = cs.LastTokenIssuedAt.UTC().Round(time.Millisecond)
+	}
+	if diff := pretty.Compare(session, got); diff != "" {
+		t.Errorf("auth session retrieved from storage did not match: %s", diff)
+	}
+
+	// Update: add a new client state.
+	newNow := now.Add(time.Minute)
+	if err := s.UpdateAuthSession(ctx, session.ID, func(old storage.AuthSession) (storage.AuthSession, error) {
+		old.ClientStates["client2"] = &storage.ClientAuthState{
+			AuthenticatedAt: newNow,
+			LastActivity:    newNow,
+		}
+		old.LastActivity = newNow
+		old.IdleExpiry = newNow.Add(time.Hour)
+		return old, nil
+	}); err != nil {
+		t.Fatalf("update auth session: %v", err)
+	}
+
+	// Get and verify update.
+	got, err = s.GetAuthSession(ctx, session.ID)
+	if err != nil {
+		t.Fatalf("get auth session after update: %v", err)
+	}
+	if len(got.ClientStates) != 2 {
+		t.Fatalf("expected 2 client states, got %d", len(got.ClientStates))
+	}
+	if got.ClientStates["client2"] == nil {
+		t.Fatal("expected client2 state to exist")
+	}
+	// The idle timeout has to move with the activity that reset it, or a session
+	// never outlives its first one.
+	if !got.IdleExpiry.UTC().Round(time.Millisecond).Equal(newNow.Add(time.Hour)) {
+		t.Errorf("expected idle expiry %v, got %v", newNow.Add(time.Hour), got.IdleExpiry)
+	}
+
+	// List and verify.
+	sessions, err := s.ListAuthSessions(ctx)
+	if err != nil {
+		t.Fatalf("list auth sessions: %v", err)
+	}
+	if len(sessions) != 1 {
+		t.Fatalf("expected 1 auth session, got %d", len(sessions))
+	}
+
+	// Delete.
+	if err := s.DeleteAuthSession(ctx, session.ID); err != nil {
+		t.Fatalf("delete auth session: %v", err)
+	}
+
+	// Get deleted should return ErrNotFound.
+	_, err = s.GetAuthSession(ctx, session.ID)
+	mustBeErrNotFound(t, "auth session", err)
+}
diff --git a/storage/conformance/gen_jwks.go b/storage/conformance/gen_jwks.go
index 0447e32815..990f3c5412 100644
--- a/storage/conformance/gen_jwks.go
+++ b/storage/conformance/gen_jwks.go
@@ -1,3 +1,4 @@
+//go:build ignore
 // +build ignore
 
 // This file is used to generate static JWKs for tests.
@@ -6,6 +7,9 @@ package main
 
 import (
 	"bytes"
+	"crypto"
+	"crypto/ecdsa"
+	"crypto/elliptic"
 	"crypto/rand"
 	"crypto/rsa"
 	"encoding/hex"
@@ -16,7 +20,7 @@ import (
 	"os"
 	"text/template"
 
-	jose "gopkg.in/square/go-jose.v2"
+	"github.com/go-jose/go-jose/v4"
 )
 
 func newUUID() string {
@@ -36,21 +40,21 @@ var tmpl = template.Must(template.New("jwks.go").Parse(`
 
 package conformance
 
-import jose "gopkg.in/square/go-jose.v2"
+import jose "github.com/go-jose/go-jose/v4"
 
 type keyPair struct {
 	Public  *jose.JSONWebKey
 	Private *jose.JSONWebKey
 }
 
-// keys are generated beforehand so we don't have to generate RSA keys for every test.
+// keys are generated beforehand so tests don't spend time on crypto key generation.
 var jsonWebKeys = []keyPair{
-	{{ range $i, $pair := .Keys }}
+{{- range $i, $pair := .Keys }}
 	{
 		Public:  mustLoadJWK({{ $pair.Public }}),
 		Private: mustLoadJWK({{ $pair.Private }}),
 	},
-	{{ end }}
+{{- end }}
 }
 `[1:])) // Remove the first newline.
 
@@ -59,42 +63,73 @@ type keyPair struct {
 	Private string
 }
 
+type keySpec struct {
+	count     int
+	algorithm string
+	generate  func() (crypto.Signer, error)
+}
+
+func newKeyPair(algorithm string, key crypto.Signer) keyPair {
+	priv := jose.JSONWebKey{
+		Key:       key,
+		KeyID:     newUUID(),
+		Algorithm: algorithm,
+		Use:       "sig",
+	}
+	pub := jose.JSONWebKey{
+		Key:       key.Public(),
+		KeyID:     newUUID(),
+		Algorithm: algorithm,
+		Use:       "sig",
+	}
+
+	privBytes, err := json.MarshalIndent(priv, "\t\t", "\t")
+	if err != nil {
+		log.Fatalf("marshal priv: %v", err)
+	}
+	pubBytes, err := json.MarshalIndent(pub, "\t\t", "\t")
+	if err != nil {
+		log.Fatalf("marshal pub: %v", err)
+	}
+
+	return keyPair{
+		Private: "`" + string(privBytes) + "`",
+		Public:  "`" + string(pubBytes) + "`",
+	}
+}
+
 func main() {
 	var tmplData struct {
 		Keys []keyPair
 	}
-	for i := 0; i < 5; i++ {
-		// TODO(ericchiang): Test with ECDSA keys.
-		key, err := rsa.GenerateKey(rand.Reader, 2048)
-		if err != nil {
-			log.Fatalf("gen rsa key: %v", err)
-		}
-		priv := jose.JSONWebKey{
-			Key:       key,
-			KeyID:     newUUID(),
-			Algorithm: "RS256",
-			Use:       "sig",
-		}
-		pub := jose.JSONWebKey{
-			Key:       key.Public(),
-			KeyID:     newUUID(),
-			Algorithm: "RS256",
-			Use:       "sig",
-		}
 
-		privBytes, err := json.MarshalIndent(priv, "\t\t", "\t")
-		if err != nil {
-			log.Fatalf("marshal priv: %v", err)
-		}
-		pubBytes, err := json.MarshalIndent(pub, "\t\t", "\t")
-		if err != nil {
-			log.Fatalf("marshal pub: %v", err)
+	specs := []keySpec{
+		{
+			count:     5,
+			algorithm: "RS256",
+			generate: func() (crypto.Signer, error) {
+				return rsa.GenerateKey(rand.Reader, 2048)
+			},
+		},
+		{
+			count:     2,
+			algorithm: "ES256",
+			generate: func() (crypto.Signer, error) {
+				return ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
+			},
+		},
+	}
+
+	for _, spec := range specs {
+		for i := 0; i < spec.count; i++ {
+			key, err := spec.generate()
+			if err != nil {
+				log.Fatalf("gen %s key: %v", spec.algorithm, err)
+			}
+			tmplData.Keys = append(tmplData.Keys, newKeyPair(spec.algorithm, key))
 		}
-		tmplData.Keys = append(tmplData.Keys, keyPair{
-			Private: "`" + string(privBytes) + "`",
-			Public:  "`" + string(pubBytes) + "`",
-		})
 	}
+
 	buff := new(bytes.Buffer)
 	if err := tmpl.Execute(buff, tmplData); err != nil {
 		log.Fatalf("execute tmpl: %v", err)
@@ -104,7 +139,7 @@ func main() {
 	if err != nil {
 		log.Fatalf("gofmt failed: %v", err)
 	}
-	if err := os.WriteFile("jwks.go", out, 0644); err != nil {
+	if err := os.WriteFile("jwks.go", out, 0o644); err != nil {
 		log.Fatal(err)
 	}
 }
diff --git a/storage/conformance/jwks.go b/storage/conformance/jwks.go
index 0f05703e1b..afccbc0b8d 100644
--- a/storage/conformance/jwks.go
+++ b/storage/conformance/jwks.go
@@ -1,35 +1,38 @@
-// This file was generaged by gen_jwks.go
+// This file was generated by gen_jwks.go
 
 package conformance
 
-import jose "gopkg.in/square/go-jose.v2"
+import jose "github.com/go-jose/go-jose/v4"
 
 type keyPair struct {
 	Public  *jose.JSONWebKey
 	Private *jose.JSONWebKey
 }
 
-// keys are generated beforehand so we don't have to generate RSA keys for every test.
+// keys are generated beforehand so tests don't spend time on crypto key generation.
 var jsonWebKeys = []keyPair{
 	{
 		Public: mustLoadJWK(`{
 			"use": "sig",
 			"kty": "RSA",
-			"kid": "8145b5b9243c41459a8fdaa12acbd371",
+			"kid": "10cfa7ef3f1d48d4896fd2fcdd4a064d",
 			"alg": "RS256",
-			"n": "34ls8E4onyEU_JKcxl8BMu2N6hK_D6aG2tOuCHJ_ka4rom8NmdJGdOQPC_fvKhcAxWeDktdAPislTT76Q4iMCC7DbM1aQhgRMaecKHBagc5ue2kSPM3oZPLqe6X-CxdxGTfXAvFIZM9JZTbQeJPcXFdn28iZ086xWPMdQKY5QTRKtoHQSN6EAQuuiuZsXrAC3lBZmE4tda6NoeYLb0UayGqiiFmtoIFJQ4NecI-EECT-mcjkPGWG0Ll5dCIUhGDl8sQSUrmBuaTDpPEzLGo-UtM3ay7AN0gOVN0mLIk2oyroXcVOA626LYNLVU0mz9PDpdkhWBeUfLL6i4HjUS3RaQ",
+			"n": "nWwoxydjr1ihXg0jnflEoSwOwyR4VRvHJIkEFnFx8ibt6IQJE0oXdSY1RG0yUddTb0Wfgqwp_-sXHEjG_tQbOTLWQoW2f8wQIw_SF3eq5fhk_uwv_tGB980sMKQA3Er13FEr2qttbWn5xYaoglDgjNC6DmxFGjSgjJaRKZGeQ0zXmt38GSHmA3IIWps2GftWPRnSKXj27NPIhw-ZKLkAibCdm2zcqyzy5YCXitymhnGCnlT6LQUCbKaZ0ocbnAY4Ttb-pg5toYMq-jps9tdn58ETT9hBsoagY7x8fy-nZZgdg_CNwqfBnCRbqLeeFJRUR00fbSaxjRIsf1RtMz54Sw",
 			"e": "AQAB"
 		}`),
 		Private: mustLoadJWK(`{
 			"use": "sig",
 			"kty": "RSA",
-			"kid": "f547defc90b34ec08caeb8b294591216",
+			"kid": "a8481527703a43d8aa8f818b80ae23ba",
 			"alg": "RS256",
-			"n": "34ls8E4onyEU_JKcxl8BMu2N6hK_D6aG2tOuCHJ_ka4rom8NmdJGdOQPC_fvKhcAxWeDktdAPislTT76Q4iMCC7DbM1aQhgRMaecKHBagc5ue2kSPM3oZPLqe6X-CxdxGTfXAvFIZM9JZTbQeJPcXFdn28iZ086xWPMdQKY5QTRKtoHQSN6EAQuuiuZsXrAC3lBZmE4tda6NoeYLb0UayGqiiFmtoIFJQ4NecI-EECT-mcjkPGWG0Ll5dCIUhGDl8sQSUrmBuaTDpPEzLGo-UtM3ay7AN0gOVN0mLIk2oyroXcVOA626LYNLVU0mz9PDpdkhWBeUfLL6i4HjUS3RaQ",
+			"n": "nWwoxydjr1ihXg0jnflEoSwOwyR4VRvHJIkEFnFx8ibt6IQJE0oXdSY1RG0yUddTb0Wfgqwp_-sXHEjG_tQbOTLWQoW2f8wQIw_SF3eq5fhk_uwv_tGB980sMKQA3Er13FEr2qttbWn5xYaoglDgjNC6DmxFGjSgjJaRKZGeQ0zXmt38GSHmA3IIWps2GftWPRnSKXj27NPIhw-ZKLkAibCdm2zcqyzy5YCXitymhnGCnlT6LQUCbKaZ0ocbnAY4Ttb-pg5toYMq-jps9tdn58ETT9hBsoagY7x8fy-nZZgdg_CNwqfBnCRbqLeeFJRUR00fbSaxjRIsf1RtMz54Sw",
 			"e": "AQAB",
-			"d": "3rABHsQ-I4jJZ3SHSfeLMjkFj5JtVCIJZiZK0Y9_Fpn0TjVjz0Fzfy9S7hFo6P1Rf1bH9JkLHuPMnU-H8Y8uMVikxtcse3uOZXEcWAzVnUsRNVBPItPeF_MHNXb_xfzsZrsCL6Q_Am6eJ36b4AMtG7DXflQxKphWhM5s7eKqVxDrkhaDPnALLRFjCvUZ_myQQ3Upn7gMgAbvfIY1fn9rXW_4CfxbxhcPJW5IOcu6bPvpQlfuFkXjF-gGCiNf5kv6Db0lpDOKX5l5T-KFGQ0dIOdasm8vL2GxCKZf55rKRCt0a28fwwH2p94ja-1qtPTc34V8F26LyVRgQgD3e-0aoQ",
-			"p": "_WoAr3sgL5yfaqBL38yqx4hqSPZGdR6xTS64rhgZaVg14_W6xYmlPI7PmVBRW45Fk4tXhXjv9oMZH9HGrH2v4yqXLEq0gJr4VAPvRaN6p_kb_eCfLHCbNCYBAPNVUdFpOTvOmh7m0zYPrku7DZDnZQEN_A9hYcufjy0em-lV6Tc",
-			"q": "4dFfwyYQmns1xwVEPABxpazk6nAluS-7yYSAc9A8D25nqm0mNWdPJvmpJS02xSDjIGfe0FtMr1XlPm3XHdUlIu2Z9Ex-J-kcs3lfs2UKmleQqJRXK4MahAEIV3vp0zG47hAJyzE3Oh4sVLFr3ZK9_-SenolCFv5eIikWa3Xg6l8"
+			"d": "B61Kn8uv9NEhrXB-mCmbyzBW1_VjWOMt5v43kNCfeeukFn654pLuaewfFOMuXQdfLkH68Whr8-sHCX4TFkJJwZRVFpFmwPy2nL8cw8A2OVjPtA7YmFinOepriUO2NwgAzWm39cX-ZCOS5qsWdKR1Duju6d0l0Y1XdwOwuJI9YZK-LE9JusdPHO4ME7JR5NHFmop1VWnt27QPs_VijW6V-_jnSqD-w1p_gnc0tEi3r7cFGjpbOh_JbxWG3WrX8CTmbl7T-j3kCkMkzE9mYAPTxMmHE80ooy4fBXyd4CkoIGeZe8r4JNowUneSCyicI_1t5PlmUAniEv51azq_bM5IIQ",
+			"p": "yn_xAS2PH7Ko6YLbhNrVowAeLBaujYfJFiJxSqYjMlyDwSiLZ_6rhULNFKT6GRI6UPLDUEwH4B8U8ACcSRg8Vpy0N8wQRuT71NBWYUPL39oc3Jp7ajdT_dv8kcRB_hc5u2XPdP84BFkH-sUfl1CzbaBZ5MAA0jqnjYNFanRImu8",
+			"q": "xwNrYABQ8OjiB_RkkjycX-i2c8fgQdrLoCDtPpW30IjmHJD5sdeom7Iu7pfp7JQJ87uh4zEq_JYQEMDMmJp4SyqBbV_FQfVOD2YcOJoyozz09ymmLaRO-WPk0GUjdzLWD9LMhBykMN_LmL2S9MZQ4-V8GOtKOpDaFlvYVHvcKGU",
+			"dp": "eF8XNvkLA--iwrP7o3yl06_lP5X4Cr91hAfTSml5sJ0X4MEmJRpYgO2VlLkAxdh0-9tiyJ95avtu6b-jJzwV2fJqmmReJJZHMFjrkAPJ8_XmhCf8RsY-0j9rYobEJ7NMqR269TQk60i1GpcE0WCyV-8ioHyVwGIHaXJn2ADpi9c",
+			"dq": "eMk6gimu9ohhpzJNV_QxdIRpOBw3n8CLlcRmOXXk-kwcXXogEjAxxU1_7o-FCnFPGP7oYluVG3h4h7J8eqJGIFjL9PYLYtzfY7k1p6Tu1uRISTqeAVWYGQTn-xNnUxEnmrL2Lbi0bnVlvG5Sov06WxcNGpKzmpgPxUI5Kg2CsYE",
+			"qi": "BeF87zRr0j7Ff-pEJMDAYINJou2YcCBsZoyA0COKIohVOh-pkTaKfVkJ4ndWShuGOgatjqSbALxn3Z0NDX6VvTgpnMJSBuMNtkzyzeVHahRA8PftfShar8i2l_xb__gSZmr57-YgNe7ditoDu-EngcaebxmuFV6xQn9YkG1Irkc"
 		}`),
 	},
 
@@ -37,21 +40,24 @@ var jsonWebKeys = []keyPair{
 		Public: mustLoadJWK(`{
 			"use": "sig",
 			"kty": "RSA",
-			"kid": "3a9365e41b114ec1b9288b214196e158",
+			"kid": "21fd15ddab654e3cab72d24f94925ea9",
 			"alg": "RS256",
-			"n": "t3TrxLN5_z-x5X9kebkoPnoYnGAPqAXOVCGBTxcAqev_P8t6SyyeeITDiePhCctYp5dO-WHRkB7_BkUeHZOgoyCBarDkDifQSG7MCtlYDm0yiSij_0vqzJQx-6zlXb5ypwO0P1sAXrO_nO87u69w5yaKf0yEJMpSjU8BDKQ__nskZP2QJJsYwOeAI9aAM2oP8r7Im8KzLy9-mnFSqypxBnL24hFNzKOS_GyHs0tPLjVY7JNDtDOkwPQIQFzsdZSY88n6uYvV-MGu3O-Y3-xLwUqMlJOXFskhmp1AOUnb4JgQ9wEaZ7088PY3Ak0eZkrg2FQ3XRHSWhUCOb2xL5iTvw",
+			"n": "nv9zOaDskza-NEBerrj_TSgbWx_slrra2UXXNcMFLkZASwU0K81G8iipM5cikbSHAd_4z2Y31NLpIz_-mOHPdyqKRCC9kWcWB9bfrZ06ey47Wvf-_wnCuLKXn9wPYZJwhSSPPrvy0146hVEaZOEpDYqMvRHxY5uU_gl_VLkAGqQKrP2YBNf8ubrulkzMEkuWHySHVrBD1KkJorw4gno22vtszRPjPapsdhpfz1Wm9W4NVOTdxyPAHcyQV5j0Tkmj9xPM6BBWHMpl5iLZpXpMoPAGlGCIX26WNZjsrNRoPDTB478g-SrVzuxR4w78HJ56rbazfseqpFLvNMMlXtWmtw",
 			"e": "AQAB"
 		}`),
 		Private: mustLoadJWK(`{
 			"use": "sig",
 			"kty": "RSA",
-			"kid": "c79418aaf8ee439bb2b0e28672d71584",
+			"kid": "d7ea68c557754ae19cb40fa114067137",
 			"alg": "RS256",
-			"n": "t3TrxLN5_z-x5X9kebkoPnoYnGAPqAXOVCGBTxcAqev_P8t6SyyeeITDiePhCctYp5dO-WHRkB7_BkUeHZOgoyCBarDkDifQSG7MCtlYDm0yiSij_0vqzJQx-6zlXb5ypwO0P1sAXrO_nO87u69w5yaKf0yEJMpSjU8BDKQ__nskZP2QJJsYwOeAI9aAM2oP8r7Im8KzLy9-mnFSqypxBnL24hFNzKOS_GyHs0tPLjVY7JNDtDOkwPQIQFzsdZSY88n6uYvV-MGu3O-Y3-xLwUqMlJOXFskhmp1AOUnb4JgQ9wEaZ7088PY3Ak0eZkrg2FQ3XRHSWhUCOb2xL5iTvw",
+			"n": "nv9zOaDskza-NEBerrj_TSgbWx_slrra2UXXNcMFLkZASwU0K81G8iipM5cikbSHAd_4z2Y31NLpIz_-mOHPdyqKRCC9kWcWB9bfrZ06ey47Wvf-_wnCuLKXn9wPYZJwhSSPPrvy0146hVEaZOEpDYqMvRHxY5uU_gl_VLkAGqQKrP2YBNf8ubrulkzMEkuWHySHVrBD1KkJorw4gno22vtszRPjPapsdhpfz1Wm9W4NVOTdxyPAHcyQV5j0Tkmj9xPM6BBWHMpl5iLZpXpMoPAGlGCIX26WNZjsrNRoPDTB478g-SrVzuxR4w78HJ56rbazfseqpFLvNMMlXtWmtw",
 			"e": "AQAB",
-			"d": "T7-y0dIXQV8l7RbAza0wkmAvHKMhiy_i7m2WMZRVRIiDb-77HXyq8sb73ZBC_if4RPogaYYdPCJNSCN5oO_Qz7jMqV119bVW9HW9myW6AqNzaW5SRCNzUTVGuRoCpwqn-nRAwZ3EfmZy8DyK4d61HLaDVC0l8HxHAIiMcztfWjbfD2LjwWF2hF5VRG2-haDfT6Kwtz0zEXblvYxyPqVyKOFtuWDlzX8iP8_ryWaChpR-jTmwtm7663wcu4M9teMkdgubCIqkz0LLtd-97ZUM2ti70WO7AEqE6p1evnjfYt4HZpQlsn0psrgGLvX2oCIvmPQMfTjzmtsEC51F5CU-yQ",
-			"p": "4xi5OdCP9n1ivD3CuMhcaoMrwkC1yVdYnJwaNXjIyuSUT0i_QmuRpViydpZsfiYEoNNczL_PwxlDNdl2ccbelBuoEDbrvAfz0G0-YVYuLJoEKQs_OjenIn_6AZlmn7zSQ0LjoZ1tTjOaKuueB2b8RVtF2pbZ_o1ApyWd3q6QjyU",
-			"q": "zs5SF-jdzP9xThPTEmAa2yh6SI48KuwVwWXGjOQZThXVEfwo-iZNevPjg3b6gwY9fKi71-J75c1ng0QrgdDuRIackHFpSLaWgcIpN31-uyZl5X-uxpBZON1HeiYT8J2JhgbA9ZJ0_SUq3j4YSrFEGKSpBi741mqwS9CZ6NSN5BM"
+			"d": "Cevjy0lM6eTFGqqXneyCVdS2XEnSMBep11wB0WOBe8E7etLwzfjpv-ukn0kDibcLo6TPuFVnD3s3vBDeuLiCgyue5CBs49lcaRHR9Fn2z7_zSTpnaY-43GCckIehWBPUvKIq5B3DScg7-5yzem8IakVmgdfQSchoFDAQh39hz8eqhaz0BsaOhSZKKqDXypkbxEwF4KnTIbqej0CILImjHLW8dTKsQRVuW2t4SRruvn-fQJMTicRbG1CnL4FSuDRY1t41HQDMASYdjEDKxz3IVRW-6LHbR_Lwkz5fR_Fttws2wC-fwXDaruIzs_nDNuv5r9YosnHZpN7ajgtt7NYiWQ",
+			"p": "0jDXyRVaG32RbN3AqeYmLk-Btt-pq7wwLl3ethjfNMT3gMYuExchAsiS86DCoMsS_SV65gyBqsl1jmvVCqR9HZl0vIQ9fuUxtVDVy-EWf5Lx5NxSSzNU4WC4vvbkkRxaN73fKbbIfj-k61BuNU8xL67Dd_eZS3oNNiXGT_6XES8",
+			"q": "waZnXlYWOmUVLGcy7zhj-2Ua5nT6hnhz1Jw3iCrUhw57SdYP4gGvehaU3lvB451r8whs3xsi-7czA0nJ-Idle83j7Knww0BaVBnVdK2pmDqnBm3r35kyfoPgHUo4ujSMFZAdIQpRztvwYdXcpBRfE3toQoheGSJKhDMjxa2dEPk",
+			"dp": "qhC-54IRMCD_I1ig5FbFGb9WssJxI_TV_w4QfsHNB4M-xsCS0vtpyDjFPb4a-8KTkKNctvnziF4Mcbmp3DyOxv48x7MvlpaXC59l_NoYPAyHD6d8JkBYMyrxEAHvmcGY9XT5NWUg_5U7OPIQ2a1DnNMIcO6y57DPM7qIpHzXeh0",
+			"dq": "NGsi1_pdkfkCvj5BH1gYWFiJ65AGsJeyYv7WWVmepeBZpyb2rarfISEzsu0Lkt1t9x90uP_TfGeeu2kh7tBXvCeDZvCpZ3DoApPrn-XSXo6h36-phaEmdfCknckVifHnaX7VI7hzZJdMfm8xhoitI8zn7_qR3iPWH-rn5_6S4aE",
+			"qi": "XMIySQMcYQBr1u8J_X97CJnknxelXWmux5B7hR9jtwvT7r4d0rzzupqNMCApdC3fCsCQrrdJ94JNaOPHOrM5lL_1UL4_OU2n1PYwpxyqj4KPvEfoewGGyTXj-_2NP8uhzW-nATVgX65ZIg_LyxcJt6ym6qVdv-4cdfMJ30jNNIQ"
 		}`),
 	},
 
@@ -59,21 +65,24 @@ var jsonWebKeys = []keyPair{
 		Public: mustLoadJWK(`{
 			"use": "sig",
 			"kty": "RSA",
-			"kid": "4c267fc23c7b44d6973a1722b7201849",
+			"kid": "67c85e968f3240f59a62084fadc8b5ae",
 			"alg": "RS256",
-			"n": "yeZexEF1gOXd71iz9jRQR3EhgM2-o3mVO4O1fJYYQTh5APfrrbMhOGLvgK06vytREiY9_1awL7YfEnZzQynq9WTZpkwlAhYujHYf1RbGPeoXJS2cXKThfIhbeITEyhfepqzwU_f-RhvaLS3bydDi7F74oTO9njtLkGV2qNHH3B2uTFBy2G8VmDeHNQrUa868LQ9omrmWFkLnoZOoVPiLZD-5aZXOKJ0In5sg9B1EX1oaF-xejCTBX_8EJvvvKXH-GUZnHc3g3Rf3k4iXCJi8VMyjA8we3fgP8jp2P3Ofv6VOKG3vh8j5lI3ys_rctc2fu6CaNWNNZs9wbjpDVPuc0w",
+			"n": "tUKibQUIXBTKnBS7MryiW6VPDcAszUwYvKZcVw0eVtQa1wDUITBo1-_VJ6fRXd5KLvKOgDxSg9wJgcN2Qm94HCK_JRvEiNQ-bruVVrQ4rk1V4Y9QkG3wJ3osh-srrO551mAocpKKS4tQ6Dojh9wq7y76TRu__r2bGcylR3Ilotzdp9TckC-6TeW2LT7gkevDZwuJWGojzZEmbmhH-Jt1FTtq2oKP_ZtPbHoyJsJ_HrqluDi8EuiT48j2CwpGnfPOkaKkVtHSpsG39_bcgxTMzwDnEVtALDHTIB2LMAEiKycSvppLaH_lCx6IACJLE3LkJEO4O59JxpNGOfggEKU3Yw",
 			"e": "AQAB"
 		}`),
 		Private: mustLoadJWK(`{
 			"use": "sig",
 			"kty": "RSA",
-			"kid": "eec6ee158cb34d699be4baff419da383",
+			"kid": "10e9bda24041486e83c06e8b804523b5",
 			"alg": "RS256",
-			"n": "yeZexEF1gOXd71iz9jRQR3EhgM2-o3mVO4O1fJYYQTh5APfrrbMhOGLvgK06vytREiY9_1awL7YfEnZzQynq9WTZpkwlAhYujHYf1RbGPeoXJS2cXKThfIhbeITEyhfepqzwU_f-RhvaLS3bydDi7F74oTO9njtLkGV2qNHH3B2uTFBy2G8VmDeHNQrUa868LQ9omrmWFkLnoZOoVPiLZD-5aZXOKJ0In5sg9B1EX1oaF-xejCTBX_8EJvvvKXH-GUZnHc3g3Rf3k4iXCJi8VMyjA8we3fgP8jp2P3Ofv6VOKG3vh8j5lI3ys_rctc2fu6CaNWNNZs9wbjpDVPuc0w",
+			"n": "tUKibQUIXBTKnBS7MryiW6VPDcAszUwYvKZcVw0eVtQa1wDUITBo1-_VJ6fRXd5KLvKOgDxSg9wJgcN2Qm94HCK_JRvEiNQ-bruVVrQ4rk1V4Y9QkG3wJ3osh-srrO551mAocpKKS4tQ6Dojh9wq7y76TRu__r2bGcylR3Ilotzdp9TckC-6TeW2LT7gkevDZwuJWGojzZEmbmhH-Jt1FTtq2oKP_ZtPbHoyJsJ_HrqluDi8EuiT48j2CwpGnfPOkaKkVtHSpsG39_bcgxTMzwDnEVtALDHTIB2LMAEiKycSvppLaH_lCx6IACJLE3LkJEO4O59JxpNGOfggEKU3Yw",
 			"e": "AQAB",
-			"d": "IOFck5eZfElzMFSA0lrIrCnXa_OV1WeqjwuvFcAX6R86TZcSkbI3echa-ti7VYDHbi4-MIQ8oziErOwPb2O3OQmYjIWgDUvxfryKCJjx5glmhY59BXVwp2hJhUISDlt-ziQh63ratS46BNuQDLjxC8-XrCESA1_iuXxcq7emVclRKN2DpGehf2bZyjcZy-OEwvL1jLsvoY2jmY_2JOT4nFLqoelg5vENj69p8IR9Bpdzp0urngLZJ4-HqFGyfx3tEo4ZUF1M5xnoycBc5LMZjmElK66rjBRWPq9UwZwfqaeQh6wEA9siYw1V9yrNRUkq3Q6BErbXNDKBV36bRIiaIQ",
-			"p": "_YirCr3Sfs9FkEFFMNsTZ2Wv8e5napONPtg1WUYOxG36k65EkPtlmZLWmiwmBk6592oND_S5WvbW4BbX5lRbEvNiRy9coVPst6lOOnLe69GJoI_GxoRyu_94qIS-VNPSQkyw4gfA1M-lMdfKpaTMv7fvVolvmDs5xN_fmXpl06M",
-			"q": "y90gdyUcYzDX1u3-fCINzXbDcr80QEO3bjuG8p7feaYY2MP51t6j6MisNsQqcGKY7xFhpc-z8_cEIg1HJ3FSly-yejPj8RGavPX6NVGVHDNGwxxnm_i3kf-4MuDxwRSSHMlgVNAXuoH-3iicz-bNTVYM-5bYucZMvZHC6Ur2JRE"
+			"d": "FCIoJ4LhGFVI4ghdeLfCMvrMKqNXdqBGuSGjbRnsbkmWB560cVFOu_mMTCDUXSBVThysHmtU4QeeWLcM2jlGdp2XbLhGXspwet1EK8LN7vJxISJJmRlVDRWBf8Fr8wP0LY81vvAvA1AgtwLKMouOi03FCK6V52ZJJZb5HtP7gTjmT5omV6KFsIjJK758In498PfoQcGEp028sl9i3mh3NN6U7Q20UGQ2rQ2adhsECc9RLfKZ5-1axOJG39R41Udqa0jzd-WxySaB3Rds1B4QQBI9KS188dTmXoATiLSd3DtbeQQ7qkWv4g4ToYp9a2EhKMFqsKQREfnG5stsVxjWFQ",
+			"p": "zXwRx1uxexVs_Y5K5CLZmnE0NPIHiC4pOUCnmcfbYemLZUcUyEUGNxa2_-R87cMca93Tumc67NBzKtpTLAfHC_XtFBZ7iv_h72wP3Q9EJMPobnqbV5dv_pFzMnGLQk7Rnql7Rg7wF_XTJm15vzHo9MfMxINUQgj0WiZeQ5pGkSc",
+			"q": "4dIIwEihlCFDFXqerLFiFHNOPWUTBxCc-exJMPMSoD_4DS9SFzIVk4Q55yJgODKMPQJDrFGWl_Z6kc-otvdwTzwqFM1RGpcpY1BoIoM9XPBebZoe1pTwPneLfHbIx2g9MsyHWxHg5C33OCjIestYt5KIGRVEKkqBlFTuK4AEVWU",
+			"dp": "YUKUd7Qi8YtWpz0unYURUlS6zUSx4_dVc8_yhItgf5u3axyV7aUeJ_0MaVqQ90kerr-0c8pgza5slJ_6NiEISdUBfjyWBVjQbC7N42hSbMR9w60s0ezQCcJ2sC2mKKB9_4dg3ew8IFsuskWnFqRdC192wJ0YyJjMb88xVvYy6Ik",
+			"dq": "f2v4rCdPpTovlEsghemBonB90X7bAb2KFiwSEKDX_byaxzXQaG5GZnrSAW4QRSWgpDxG21EeXJkkCGrYlIWCxfL4-8vu28Y4AGY6nF7ZnTu0zLuOcx6PgXALMSwFlx9miOeH6QdpktetC-9XUJK1eMAiM6UgVYy9GWnjCoCt8VE",
+			"qi": "vgxFfr9PFlh9zB2FjvLX8ev03Vo-o0G3CXgJC8fTH-RkljzYyvD96PT9MWKjEAZqhG5sMs6oLwh0SNf7arkm50forZGJkVV8cTLrTDPk5ZBqE4YcVsMcmAhC3VdH8ujcFbDbTocO4o5sRiaK3Iyqw-bM8zOOnRxhHQh8cbOjCmI"
 		}`),
 	},
 
@@ -81,21 +90,24 @@ var jsonWebKeys = []keyPair{
 		Public: mustLoadJWK(`{
 			"use": "sig",
 			"kty": "RSA",
-			"kid": "e10385c5384046f395fc6d9027db2f35",
+			"kid": "5942c970c64842d39306c9a359be8ab0",
 			"alg": "RS256",
-			"n": "299cgJgPiu9CK8hGgQw3j8e-Y_u4-Tm6WXKOFHdjCUPV5EAWMOa34cQNt75KN8pxlIcnujnU6TpH4OPRCw1gA44rrk_uczIEULsTnt6UFuMtUY2r-2UW2BWg5rEHyLcNX_QCA80T9DVSxsWeN8S23YcVk9fVputIRU7ee7auOx3b6K3pkoQJBVUk-_ndaqwlX-JU2CQG52CH91CrDzN0WGUPrhMZOdL7ybv94l5ztBrnjaQupkt0FxTA1_m_tXTvxIgzzegaqXrJ1mJM-z2TxPUJUc_04JaGilPUkxU780jk_03d46Op-pdElgbZ52C9JT9b8nRnA-vHq4e2whY8Yw",
+			"n": "3D1Z0EEqUux9HyngYQjFjC09sP53KIt1PG2hXUZJqn3IIsR3UPcUVvpOARlfWOsDss9SlZiInvPLXtTsL3K89AalT9Au34yLYVzr1JnkC1W8rU_ej0EYm3QnqT0EH_6nV4bvupIzip4rB4hx6oDu3EDCb2a83FLmntyKgV7HTFH7HUWoGcIQkZ-X3NczRWAfVnMnsgMIUzSVOtIMdcbJZjgvQoCZYUzMljjd0HKPnxZzrzDp76Syr7cLnkjuApHLUwi2sDSaL38oa4jsYseqCOAq-ItltuyLE42LoS1Hwdz4NI30cDkyvK5dFFu7PI8W-bH0rkNqEUO59kJGJtStFw",
 			"e": "AQAB"
 		}`),
 		Private: mustLoadJWK(`{
 			"use": "sig",
 			"kty": "RSA",
-			"kid": "8165cc507cd1492394be64575dfa8261",
+			"kid": "fe85223c6d054fc4ae0e8cfa38c3eca6",
 			"alg": "RS256",
-			"n": "299cgJgPiu9CK8hGgQw3j8e-Y_u4-Tm6WXKOFHdjCUPV5EAWMOa34cQNt75KN8pxlIcnujnU6TpH4OPRCw1gA44rrk_uczIEULsTnt6UFuMtUY2r-2UW2BWg5rEHyLcNX_QCA80T9DVSxsWeN8S23YcVk9fVputIRU7ee7auOx3b6K3pkoQJBVUk-_ndaqwlX-JU2CQG52CH91CrDzN0WGUPrhMZOdL7ybv94l5ztBrnjaQupkt0FxTA1_m_tXTvxIgzzegaqXrJ1mJM-z2TxPUJUc_04JaGilPUkxU780jk_03d46Op-pdElgbZ52C9JT9b8nRnA-vHq4e2whY8Yw",
+			"n": "3D1Z0EEqUux9HyngYQjFjC09sP53KIt1PG2hXUZJqn3IIsR3UPcUVvpOARlfWOsDss9SlZiInvPLXtTsL3K89AalT9Au34yLYVzr1JnkC1W8rU_ej0EYm3QnqT0EH_6nV4bvupIzip4rB4hx6oDu3EDCb2a83FLmntyKgV7HTFH7HUWoGcIQkZ-X3NczRWAfVnMnsgMIUzSVOtIMdcbJZjgvQoCZYUzMljjd0HKPnxZzrzDp76Syr7cLnkjuApHLUwi2sDSaL38oa4jsYseqCOAq-ItltuyLE42LoS1Hwdz4NI30cDkyvK5dFFu7PI8W-bH0rkNqEUO59kJGJtStFw",
 			"e": "AQAB",
-			"d": "xh587o6WKr2uZV8gUHXettroLpWKtl-TD7hOWBi_j4ClgfdRR50NggwzxCZeH-l18LzcSkyEEefnDriZC5lws6NurrHtjbU6-Dep1VSAIiNwGXVLy8nqDKlog5ZvCigPkC-BhUVMPpexz9QP3faORAzNn5szNCX7yB_qD5WrZy20AUEoWtGPgxGW6xf5Lgu6zg2uQEEB1Z0hKjHV9seIiuQooMrSzpS1D7BLSTHOvM2Y2lXvQQokc3uQXnyT_soHPjHl00bcuJLJaRCmyHRTol7uh9MNe67eMy7pHYmmlwOvTDfW6meKCgoEXd1wKIrS9VRY7WP36ZRpJH6qv8vceQ",
-			"p": "7sWEsknUaSlAJ-bGhsuFr_j15zupV9O-DLnLobASm4Z7Ylt1HhtPN1NCVzYFTCtltPBE_CXGaAPqw3wiERK3tgYSLV8yk57sU1H28Zsq65A1B-vdlO69-F_6djiGegYKTOO4CXt0VYB4hJ6Trwx_BNJmrAD_Ykjqsp5sR0gOrqU",
-			"q": "67y_hzbi81IH2DxmHTQOfHgcLYe-TnrEQLGLQtfx8J0J_REf_fLBDL-pt_jy6WIvTAb-LgUIcieiXfhni1nPUw0f_I1SDNv02EYvP0vkfyQdJBR6sLi4jv0mpqyQxvGif9B4eM9Qjngm2Jclj3-el-RkMZOUyf3zGTNGLI3MmGc"
+			"d": "N03spMAIacRa8x1n69XxDW8645wyveqvKNp6v9prmzV0sU5Wi-1PnTvDpMEDUWfKiPdIzKn9_LRJqGmdWZjdXAXjMzSa4KYBRhS4X625NyNzeq3ovF5jWH4Fi5j31TT0PqVyw439BV0MfxrDSFjSIlrcuG67FDR5FwFYgn4TW9Vu59EaULbno6U53BQHv_a2fuSTIH06zsI1y2Pp3AfCUdxjEviRVbmY-Zdd_qqdJV5b3h8henpABWDhdvMAyXdpOlxJqyTxs9-cud0vUl1MWgR14OUhWOMhGeGbuMK-EMTkaQlYP_-3teaKEzu4sc2YDmlstePBXydYjGSMQzHnEQ",
+			"p": "-jp9GP9Rqk3eB0KISm7sbXganiIXbpgaSFN7o9rYFgWnjMhAHizluRCX_Ffba-oIDPPXgQK9VKTtrmmrz7mNWC2eYuSVzgPfl24TUA8c1xGoUvISBD_Y6lN0HmljoLapx02u_18BEgKvTcskK09aZLN4YSaMf2FOwA-QvNtASg8",
+			"q": "4VHJ6QiX39Lm1BQgZpMOtzXUeB-OVutbMK0h92xBd5JNE8uRKfPo6KHLYqUd6roem012wQ3yww0PKjd0AjsjfPchD0ATg6cRgKI2DBX-sHFVTtWJKn22J2p0Ry2zTTuYKQQmikWocccTJHn0yGK1g-cYKSfKd1fikBhsbYBPlHk",
+			"dp": "qB6j7iects-aXUZWS6w7LVGEkLpXA_ctsWplp7FhfWpPKEdizONddPmxI9njkp2qywkJwaQVkMk-5_AXf3krfhMoV0k9XS09DIDoeOGuftFeRlxdvn0nQEjRu50TUudnKoEHEozCK1eicKILqw2lrgLm3l8IBo1aW7AZjsnAaAE",
+			"dq": "qA1IevZd0CKM50DbqaWlJCCSB8YBc_K2YOfAnbmwWm5T7p-19YRmApwqBbkBR0Dp8wsjt3mfxrrGxMX3UHKrVVk83xL7ewXwl_BkPz9oZlEhP1skovyAD4Xmk_AR-1indHAUDq1FpRbFwD71wz9cArUp4Ag9iiWSZcbRmBpLQIE",
+			"qi": "m0Km_G1VJu47Np_OLubdi16Db--C0np_ILetAQ8uZjePtfE96JQ11n2sl3BY8nj2n_A0Al8C8GAzzwHVn47Yw_l2YncS0SFkyuQuOwt83WyseiUXZqSOIq6aY2UvgeBtsNMJznfBFN0Jo8OrjNpQMyzDy04XxXFgucbYcN_elZ0"
 		}`),
 	},
 
@@ -103,21 +115,68 @@ var jsonWebKeys = []keyPair{
 		Public: mustLoadJWK(`{
 			"use": "sig",
 			"kty": "RSA",
-			"kid": "941861b40500430da0d09ec213e00832",
+			"kid": "e8525274b94b466e87236c8288f3888d",
 			"alg": "RS256",
-			"n": "ub3SiNK-uIvSrUTyIPm1cITzuqPX_CIa6nZTDTP1tJ6PP_KufYz2eGLj9jppWLo_J7XQfKfIAKvET8Mq4HEcLQpNRN90KNyGML17JJtSgYJeLuB38BnalVUxpnycPKeGgoNJMu6t8tKYOtOfxtqTA6x8MnqMeify1cvEc5Tr4QmKjcLLHKcr1yMR7kG48i586bLdchtIBYeB298WXbQaKrgsEjZA0E1exfMnYHyvN12lMBxwhOJtcFu3mngZ7vTh179UKsP3yD8IdO5ITe_RIOmnUKuynW3PdkRUzCK5gS-xuqueGqEzJVIKBv0Hfom3eyDW5DjxpIZxlqkGhGyeNw",
+			"n": "-OaIVgMSRhDe5KZTiTmElFVqlRaUS_pOt4RB6DAQWubMQBxsRktN5ooBZTWJ8uI4yqnrsMoookuf2uFSFfMKQMNi3YBLCorNkrapV6kfwDaX1yD26MbHz8upetBD3452gRMFHOZznbDAOlZOObtNFp2BCVTpzU3FKhN3fK-ejrQfUdHqsjszjazbiDXLLvjnjByGmlCE7olicvUZRQ2ydr7L3HxUEwZ5_U3FxnWQBAzEkERBiwnIB_7LbIUHzt2GaoqkLRoSnXrcJ26yIj0EneRJ9gCAGzvvzFAKhG7eMvaW5nbF5yJ5PnUEBZVC0N0AnoBqr2yXdYn0yQNvwmVzvw",
 			"e": "AQAB"
 		}`),
 		Private: mustLoadJWK(`{
 			"use": "sig",
 			"kty": "RSA",
-			"kid": "c4c09817da9a42ae8d850aaba7b7cd82",
+			"kid": "62a3f70927f04df6a23ee08a6d826276",
 			"alg": "RS256",
-			"n": "ub3SiNK-uIvSrUTyIPm1cITzuqPX_CIa6nZTDTP1tJ6PP_KufYz2eGLj9jppWLo_J7XQfKfIAKvET8Mq4HEcLQpNRN90KNyGML17JJtSgYJeLuB38BnalVUxpnycPKeGgoNJMu6t8tKYOtOfxtqTA6x8MnqMeify1cvEc5Tr4QmKjcLLHKcr1yMR7kG48i586bLdchtIBYeB298WXbQaKrgsEjZA0E1exfMnYHyvN12lMBxwhOJtcFu3mngZ7vTh179UKsP3yD8IdO5ITe_RIOmnUKuynW3PdkRUzCK5gS-xuqueGqEzJVIKBv0Hfom3eyDW5DjxpIZxlqkGhGyeNw",
+			"n": "-OaIVgMSRhDe5KZTiTmElFVqlRaUS_pOt4RB6DAQWubMQBxsRktN5ooBZTWJ8uI4yqnrsMoookuf2uFSFfMKQMNi3YBLCorNkrapV6kfwDaX1yD26MbHz8upetBD3452gRMFHOZznbDAOlZOObtNFp2BCVTpzU3FKhN3fK-ejrQfUdHqsjszjazbiDXLLvjnjByGmlCE7olicvUZRQ2ydr7L3HxUEwZ5_U3FxnWQBAzEkERBiwnIB_7LbIUHzt2GaoqkLRoSnXrcJ26yIj0EneRJ9gCAGzvvzFAKhG7eMvaW5nbF5yJ5PnUEBZVC0N0AnoBqr2yXdYn0yQNvwmVzvw",
 			"e": "AQAB",
-			"d": "29bQWSEWm1bjBDGWY3EqTwMNdtp1yPaU5O0nX3kgV6dT5VxXKkKtdc-WANkh1uKZ3WZUXTY4gpLKx504Im2965FF4z6XPcXFDes21R0BikfDMbh8PLJdBGLRYTwbr66YheDdwmq9d6nKg9X2RmZtmuuMFDL4EZ02zdVfr22TwcSCghC2gnV6CpHHeEatJBWbK1yE6cHqCeY9UTc_QnXmbZ0TYsQi4qCV1HqTJKZDtkzqZMPvMB5EP_my_SCxcfcIzt6qqujmuXCFiS658Up-Z4W5s0RINLoPmePG8zJVFBmWrQ8xiykCeL8z9XSvXoEo6ZJJC-KSjI6s-KsCfQqZ",
-			"p": "8LzUJM2YgP7zG618rrFTav3gB2t1yMwFJy9d3J-pOkVFUq-4-74qEZz6H2RTUw7Ae5XEYdVIbRRQInpo0qO2MfLW8vtRexUNFFt1pBiVykq-KdkWcwPETyRD-huEEqswBhg33lFTUrY7BXRukbfNmVY7YfdagIJ5LZU0I-nGMqs",
-			"q": "xYRoIFTTiXitKBFo0vvHAadqVV8gJq8bCxJZ4lFMpADlU-S8Me7aPmkhPmCDaw-ii940S46bTp9ueh6EJCttmG3cJm8r4YzjK-H1dnqeF_3dpq2pimVFlFILBKWojUHHWC4n0d1IVwdf8-xnDSiUzl9roFZV5IPy4mW1HMTZ4qU"
+			"d": "E9C6oupcrpJSRG7PcLnRCcQhF5x0EvZrBOY1HwiQjMQaF7KLli8RlRyAju-ru1fyQIQ1nN4DTSRrJhBRKikutEg52zuG_eBeDGOZaL6wpetSvFBGB_MnXi4vIHVrKeWcHpuGiS35n2C-dQaA9MyqDvZcGwOVF4CtBTQGi7kpjN-2-vbaBiqvy9MWMPxBJc6lAjqn6d8U4hqzvRcl2Fgh9gykjRX5RhuuqcbFBn-W5iHT2JeQtCUh2tBiBje8S8d2eN_m3B4JdIvdVTX6ONjLYlcm7yaQ2w5yA4inLVkHq3FkrOwWkwcVheMIUOAWUllBe65wQpl5v_7Dg_I0jHaOnQ",
+			"p": "_oXrxZUp99Ym-fqYym6130IFeNT5druZyKpdSUcjec8RaDLXiSeGWECRGdL5S9X09o9cz0wvpravIjemIbuiraCe-dSNd3MOKTI6PezDzmeIJzhAa02xJET0ZGHzLDIH_6uKnGHSiUMxKn6XmXg4gCR10gsAMMzBrfSWKU25xnU",
+			"q": "-lhCcCJOl3gWOz3cGEZkmjE68DUcoVy8VbcVB_nkg8P7qyolOpbdS0xB3r7VFIbEnW63pE6DFnPEpDJnmE4rZ0JCn22HpZzUepPkevCCyvK-5DEzp7MOdZEW34RVnpl5V7L_a64aQdMNkrroNczArH3fUr8UPMiAqjOzlieVUuM",
+			"dp": "m3J7Ts8NNLpsT5xHmMsI9PPDl8qrGWL2R2IVW13BQvG-dd8nWDL1kAzPEfCSJUjlNXjVfB3RtIY6bDGEm3GXp2dD8N1qERwJ-AsfGxbxd6wvsZRfc6mdmMMsZ-qSs9lSnUnNfDkado69BnEOccLE7y5VbxUc5rEHURDibRN1dMk",
+			"dq": "XlcOSmWTSl9VuWN5Yqh8VuMAe-736BMjYgXJZiUUqVccqwcJ2odpw2tsUz2E3ORgiZdkmwV_PuHHk7zu7yVeE96TbrL-8DkmlT7QVkf2cfaCW0nzVloSs9lGTlr3TPo3EQaCXJjSikW3krjesw-C-D3C_9LEFJfWbM1o-sfV7NM",
+			"qi": "otibsKrvyertgnuuxepfzTpPcQ3an31YTdyHwDc32-kaMyvd7WH5SYA_sqZwA2b9IRUNarZ6doEbebcwfwMNJV3I_QRRUNMOs2SDp5XH7cDWUGwtx3SYdziqK56Xt23orNHx95uIfqrkWkYRk1EOo6lRyVREtPwk8HCV_tl5eYY"
+		}`),
+	},
+
+	{
+		Public: mustLoadJWK(`{
+			"use": "sig",
+			"kty": "EC",
+			"kid": "bc23e2a3e81f4a17b751ce423c69a3a4",
+			"crv": "P-256",
+			"alg": "ES256",
+			"x": "bIkaBnOXHj-TYlPLZ4cjZernfP6P73KCEZ6JlXQosz4",
+			"y": "YNyxfwaqsrkAXLIvSRJVsfrJvk9CqvQAJPDIqJ96cNU"
+		}`),
+		Private: mustLoadJWK(`{
+			"use": "sig",
+			"kty": "EC",
+			"kid": "14c1bb757c7940b49ec1401c36a315c7",
+			"crv": "P-256",
+			"alg": "ES256",
+			"x": "bIkaBnOXHj-TYlPLZ4cjZernfP6P73KCEZ6JlXQosz4",
+			"y": "YNyxfwaqsrkAXLIvSRJVsfrJvk9CqvQAJPDIqJ96cNU",
+			"d": "VGryC3cIOaJqzgti9FsWMbSi4LsbZ_3BUmOBdsd8-Xo"
+		}`),
+	},
+
+	{
+		Public: mustLoadJWK(`{
+			"use": "sig",
+			"kty": "EC",
+			"kid": "e0d6ff6492bd4ab39aa68a9e16f99960",
+			"crv": "P-256",
+			"alg": "ES256",
+			"x": "VCg2WFqMoeULMRr2cMgfqlNvORPI0YyIsjFzEHMGBZI",
+			"y": "QyWgq1jIfPUDlQPhA8sT_VWk7Z9-uPek0FJJ285G40s"
+		}`),
+		Private: mustLoadJWK(`{
+			"use": "sig",
+			"kty": "EC",
+			"kid": "df1241b64dba40c18a10aff4a806083d",
+			"crv": "P-256",
+			"alg": "ES256",
+			"x": "VCg2WFqMoeULMRr2cMgfqlNvORPI0YyIsjFzEHMGBZI",
+			"y": "QyWgq1jIfPUDlQPhA8sT_VWk7Z9-uPek0FJJ285G40s",
+			"d": "Eu1dSBbvVRdZwU8wPSWUq_xhSzxFfx43NqSWFAx4Yas"
 		}`),
 	},
 }
diff --git a/storage/conformance/transactions.go b/storage/conformance/transactions.go
index 2fc6755b09..3924e52cec 100644
--- a/storage/conformance/transactions.go
+++ b/storage/conformance/transactions.go
@@ -1,9 +1,13 @@
 package conformance
 
 import (
+	"strconv"
+	"sync"
 	"testing"
 	"time"
 
+	"github.com/kylelemons/godebug/pretty"
+	"github.com/stretchr/testify/require"
 	"golang.org/x/crypto/bcrypt"
 
 	"github.com/dexidp/dex/storage"
@@ -16,7 +20,7 @@ import (
 // This call is separate from RunTests because some storage perform extremely
 // poorly under deadlocks, such as SQLite3, while others may be working towards
 // conformance.
-func RunTransactionTests(t *testing.T, newStorage func() storage.Storage) {
+func RunTransactionTests(t *testing.T, newStorage func(t *testing.T) storage.Storage) {
 	runTests(t, newStorage, []subTest{
 		{"AuthRequestConcurrentUpdate", testAuthRequestConcurrentUpdate},
 		{"ClientConcurrentUpdate", testClientConcurrentUpdate},
@@ -25,7 +29,18 @@ func RunTransactionTests(t *testing.T, newStorage func() storage.Storage) {
 	})
 }
 
+// RunConcurrencyTests runs tests that verify storage implementations handle
+// high-contention parallel updates correctly. Unlike RunTransactionTests,
+// these tests use real goroutine-based parallelism rather than nested calls,
+// and are safe to run on all storage backends (including those with non-reentrant locks).
+func RunConcurrencyTests(t *testing.T, newStorage func(t *testing.T) storage.Storage) {
+	runTests(t, newStorage, []subTest{
+		{"RefreshTokenParallelUpdate", testRefreshTokenParallelUpdate},
+	})
+}
+
 func testClientConcurrentUpdate(t *testing.T, s storage.Storage) {
+	ctx := t.Context()
 	c := storage.Client{
 		ID:           storage.NewID(),
 		Secret:       "foobar",
@@ -34,15 +49,15 @@ func testClientConcurrentUpdate(t *testing.T, s storage.Storage) {
 		LogoURL:      "https://goo.gl/JIyzIC",
 	}
 
-	if err := s.CreateClient(c); err != nil {
+	if err := s.CreateClient(ctx, c); err != nil {
 		t.Fatalf("create client: %v", err)
 	}
 
 	var err1, err2 error
 
-	err1 = s.UpdateClient(c.ID, func(old storage.Client) (storage.Client, error) {
+	err1 = s.UpdateClient(ctx, c.ID, func(old storage.Client) (storage.Client, error) {
 		old.Secret = "new secret 1"
-		err2 = s.UpdateClient(c.ID, func(old storage.Client) (storage.Client, error) {
+		err2 = s.UpdateClient(ctx, c.ID, func(old storage.Client) (storage.Client, error) {
 			old.Secret = "new secret 2"
 			return old, nil
 		})
@@ -55,6 +70,7 @@ func testClientConcurrentUpdate(t *testing.T, s storage.Storage) {
 }
 
 func testAuthRequestConcurrentUpdate(t *testing.T, s storage.Storage) {
+	ctx := t.Context()
 	a := storage.AuthRequest{
 		ID:                  storage.NewID(),
 		ClientID:            "foobar",
@@ -66,6 +82,7 @@ func testAuthRequestConcurrentUpdate(t *testing.T, s storage.Storage) {
 		ForceApprovalPrompt: true,
 		LoggedIn:            true,
 		Expiry:              neverExpire,
+		AuthTime:            defaultAuthTime,
 		ConnectorID:         "ldap",
 		ConnectorData:       []byte(`{"some":"data"}`),
 		Claims: storage.Claims{
@@ -75,17 +92,18 @@ func testAuthRequestConcurrentUpdate(t *testing.T, s storage.Storage) {
 			EmailVerified: true,
 			Groups:        []string{"a", "b"},
 		},
+		HMACKey: []byte("hmac_key"),
 	}
 
-	if err := s.CreateAuthRequest(a); err != nil {
+	if err := s.CreateAuthRequest(ctx, a); err != nil {
 		t.Fatalf("failed creating auth request: %v", err)
 	}
 
 	var err1, err2 error
 
-	err1 = s.UpdateAuthRequest(a.ID, func(old storage.AuthRequest) (storage.AuthRequest, error) {
+	err1 = s.UpdateAuthRequest(ctx, a.ID, func(old storage.AuthRequest) (storage.AuthRequest, error) {
 		old.State = "state 1"
-		err2 = s.UpdateAuthRequest(a.ID, func(old storage.AuthRequest) (storage.AuthRequest, error) {
+		err2 = s.UpdateAuthRequest(ctx, a.ID, func(old storage.AuthRequest) (storage.AuthRequest, error) {
 			old.State = "state 2"
 			return old, nil
 		})
@@ -98,6 +116,7 @@ func testAuthRequestConcurrentUpdate(t *testing.T, s storage.Storage) {
 }
 
 func testPasswordConcurrentUpdate(t *testing.T, s storage.Storage) {
+	ctx := t.Context()
 	// Use bcrypt.MinCost to keep the tests short.
 	passwordHash, err := bcrypt.GenerateFromPassword([]byte("secret"), bcrypt.MinCost)
 	if err != nil {
@@ -105,20 +124,24 @@ func testPasswordConcurrentUpdate(t *testing.T, s storage.Storage) {
 	}
 
 	password := storage.Password{
-		Email:    "jane@example.com",
-		Hash:     passwordHash,
-		Username: "jane",
-		UserID:   "foobar",
+		Email:             "jane@example.com",
+		Hash:              passwordHash,
+		Username:          "jane",
+		Name:              "Jane Doe",
+		PreferredUsername: "jane-public",
+		EmailVerified:     boolPtr(true),
+		UserID:            "foobar",
+		Groups:            []string{"team-a"},
 	}
-	if err := s.CreatePassword(password); err != nil {
+	if err := s.CreatePassword(ctx, password); err != nil {
 		t.Fatalf("create password token: %v", err)
 	}
 
 	var err1, err2 error
 
-	err1 = s.UpdatePassword(password.Email, func(old storage.Password) (storage.Password, error) {
+	err1 = s.UpdatePassword(ctx, password.Email, func(old storage.Password) (storage.Password, error) {
 		old.Username = "user 1"
-		err2 = s.UpdatePassword(password.Email, func(old storage.Password) (storage.Password, error) {
+		err2 = s.UpdatePassword(ctx, password.Email, func(old storage.Password) (storage.Password, error) {
 			old.Username = "user 2"
 			return old, nil
 		})
@@ -131,42 +154,199 @@ func testPasswordConcurrentUpdate(t *testing.T, s storage.Storage) {
 }
 
 func testKeysConcurrentUpdate(t *testing.T, s storage.Storage) {
-	// Test twice. Once for a create, once for an update.
-	for i := 0; i < 2; i++ {
-		n := time.Now().UTC().Round(time.Second)
-		keys1 := storage.Keys{
-			SigningKey:    jsonWebKeys[i].Private,
-			SigningKeyPub: jsonWebKeys[i].Public,
-			NextRotation:  n,
-		}
-
-		keys2 := storage.Keys{
-			SigningKey:    jsonWebKeys[2].Private,
-			SigningKeyPub: jsonWebKeys[2].Public,
-			NextRotation:  n.Add(time.Hour),
-			VerificationKeys: []storage.VerificationKey{
-				{
-					PublicKey: jsonWebKeys[0].Public,
-					Expiry:    n.Add(time.Hour),
+	tests := []struct {
+		name  string
+		keys1 storage.Keys
+		keys2 storage.Keys
+	}{
+		{
+			name: "create with rsa and es256 payloads",
+			keys1: storage.Keys{
+				SigningKey:    jsonWebKeys[0].Private,
+				SigningKeyPub: jsonWebKeys[0].Public,
+			},
+			keys2: storage.Keys{
+				SigningKey:    jsonWebKeys[5].Private,
+				SigningKeyPub: jsonWebKeys[5].Public,
+				VerificationKeys: []storage.VerificationKey{
+					{
+						PublicKey: jsonWebKeys[1].Public,
+					},
+					{
+						PublicKey: jsonWebKeys[6].Public,
+					},
 				},
-				{
-					PublicKey: jsonWebKeys[1].Public,
-					Expiry:    n.Add(time.Hour * 2),
+			},
+		},
+		{
+			name: "update with es256 and rsa payloads",
+			keys1: storage.Keys{
+				SigningKey:    jsonWebKeys[6].Private,
+				SigningKeyPub: jsonWebKeys[6].Public,
+			},
+			keys2: storage.Keys{
+				SigningKey:    jsonWebKeys[2].Private,
+				SigningKeyPub: jsonWebKeys[2].Public,
+				VerificationKeys: []storage.VerificationKey{
+					{
+						PublicKey: jsonWebKeys[5].Public,
+					},
+					{
+						PublicKey: jsonWebKeys[3].Public,
+					},
 				},
 			},
+		},
+	}
+
+	// Run twice against the same storage. The first case exercises row creation,
+	// the second runs with an existing keys row and therefore exercises updates.
+	for _, tt := range tests {
+		n := time.Now().UTC().Round(time.Second)
+		keys1 := tt.keys1
+		keys1.NextRotation = n
+		keys2 := tt.keys2
+		keys2.NextRotation = n.Add(time.Hour)
+
+		for i := range keys2.VerificationKeys {
+			keys2.VerificationKeys[i].Expiry = n.Add(time.Duration(i+1) * time.Hour)
 		}
 
 		var err1, err2 error
 
-		err1 = s.UpdateKeys(func(old storage.Keys) (storage.Keys, error) {
-			err2 = s.UpdateKeys(func(old storage.Keys) (storage.Keys, error) {
+		ctx := t.Context()
+		err1 = s.UpdateKeys(ctx, func(old storage.Keys) (storage.Keys, error) {
+			err2 = s.UpdateKeys(ctx, func(old storage.Keys) (storage.Keys, error) {
 				return keys1, nil
 			})
 			return keys2, nil
 		})
 
 		if (err1 == nil) == (err2 == nil) {
-			t.Errorf("update keys: concurrent updates both returned no error")
+			t.Errorf("%s: concurrent updates both returned no error", tt.name)
 		}
+
+		got, err := s.GetKeys(ctx)
+		require.NoError(t, err)
+
+		got.NextRotation = got.NextRotation.UTC()
+
+		diff1 := pretty.Compare(keys1, got)
+		diff2 := pretty.Compare(keys2, got)
+		match1 := diff1 == ""
+		match2 := diff2 == ""
+		if match1 == match2 {
+			t.Fatalf("%s: final stored keys did not match an expected winner\nkeys1 diff:\n%s\nkeys2 diff:\n%s", tt.name, diff1, diff2)
+		}
+
+		requireSigningKeyRoundTripUsable(t, got)
+	}
+}
+
+// testRefreshTokenParallelUpdate tests that many parallel updates to the same
+// refresh token are serialized correctly by the storage and no updates are lost.
+//
+// Each goroutine atomically increments a counter stored in the Token field.
+// After all goroutines finish, the counter must equal the number of successful updates.
+// A mismatch indicates lost updates due to broken atomicity.
+func testRefreshTokenParallelUpdate(t *testing.T, s storage.Storage) {
+	ctx := t.Context()
+
+	id := storage.NewID()
+	refresh := storage.RefreshToken{
+		ID:          id,
+		Token:       "0",
+		Nonce:       "foo",
+		ClientID:    "client_id",
+		ConnectorID: "connector_id",
+		Scopes:      []string{"openid"},
+		CreatedAt:   time.Now().UTC().Round(time.Millisecond),
+		LastUsed:    time.Now().UTC().Round(time.Millisecond),
+		Claims: storage.Claims{
+			UserID:   "1",
+			Username: "jane",
+			Email:    "jane@example.com",
+		},
+	}
+
+	require.NoError(t, s.CreateRefresh(ctx, refresh))
+
+	const numWorkers = 100
+
+	type updateResult struct {
+		err      error
+		newToken string // token value written by this worker's updater
+	}
+
+	var wg sync.WaitGroup
+	results := make([]updateResult, numWorkers)
+
+	for i := range numWorkers {
+		wg.Add(1)
+		go func() {
+			defer wg.Done()
+			results[i].err = s.UpdateRefreshToken(ctx, id, func(old storage.RefreshToken) (storage.RefreshToken, error) {
+				counter, _ := strconv.Atoi(old.Token)
+				old.Token = strconv.Itoa(counter + 1)
+				results[i].newToken = old.Token
+				return old, nil
+			})
+		}()
+	}
+
+	wg.Wait()
+
+	errCounts := map[string]int{}
+	var successes int
+	writtenTokens := map[string]int{}
+	for _, r := range results {
+		if r.err == nil {
+			successes++
+			writtenTokens[r.newToken]++
+		} else {
+			errCounts[r.err.Error()]++
+		}
+	}
+
+	for msg, count := range errCounts {
+		t.Logf("error (x%d): %s", count, msg)
+	}
+
+	stored, err := s.GetRefresh(ctx, id)
+	require.NoError(t, err)
+
+	counter, err := strconv.Atoi(stored.Token)
+	require.NoError(t, err)
+
+	t.Logf("parallel refresh token updates: %d/%d succeeded, final counter: %d", successes, numWorkers, counter)
+
+	if successes < numWorkers {
+		t.Errorf("not all updates succeeded: %d/%d (some failed under contention)", successes, numWorkers)
+	}
+
+	if counter != successes {
+		t.Errorf("lost updates detected: %d successful updates but counter is %d", successes, counter)
+	}
+
+	// Each successful updater must have seen a unique counter value.
+	// Duplicates would mean two updaters read the same state — a sign of broken atomicity.
+	for token, count := range writtenTokens {
+		if count > 1 {
+			t.Errorf("token %q was written by %d updaters — concurrent updaters saw the same state", token, count)
+		}
+	}
+
+	// Successful updaters must have produced a contiguous sequence 1..N.
+	// A gap would mean an updater saw stale state even though the write succeeded.
+	for i := 1; i <= successes; i++ {
+		if writtenTokens[strconv.Itoa(i)] != 1 {
+			t.Errorf("expected token %q to be written exactly once, got %d", strconv.Itoa(i), writtenTokens[strconv.Itoa(i)])
+		}
+	}
+
+	// The token stored in the database must match the highest value written.
+	// This confirms that the last successful update is the one persisted.
+	if stored.Token != strconv.Itoa(successes) {
+		t.Errorf("stored token %q does not match expected final value %q", stored.Token, strconv.Itoa(successes))
 	}
 }
diff --git a/storage/ent/client/authcode.go b/storage/ent/client/authcode.go
index b6b263bff8..02b7b59a3f 100644
--- a/storage/ent/client/authcode.go
+++ b/storage/ent/client/authcode.go
@@ -7,7 +7,7 @@ import (
 )
 
 // CreateAuthCode saves provided auth code into the database.
-func (d *Database) CreateAuthCode(code storage.AuthCode) error {
+func (d *Database) CreateAuthCode(ctx context.Context, code storage.AuthCode) error {
 	_, err := d.client.AuthCode.Create().
 		SetID(code.ID).
 		SetClientID(code.ClientID).
@@ -26,7 +26,9 @@ func (d *Database) CreateAuthCode(code storage.AuthCode) error {
 		SetExpiry(code.Expiry.UTC()).
 		SetConnectorID(code.ConnectorID).
 		SetConnectorData(code.ConnectorData).
-		Save(context.TODO())
+		SetAuthTime(code.AuthTime).
+		SetSessionID(code.SessionID).
+		Save(ctx)
 	if err != nil {
 		return convertDBError("create auth code: %w", err)
 	}
@@ -34,8 +36,8 @@ func (d *Database) CreateAuthCode(code storage.AuthCode) error {
 }
 
 // GetAuthCode extracts an auth code from the database by id.
-func (d *Database) GetAuthCode(id string) (storage.AuthCode, error) {
-	authCode, err := d.client.AuthCode.Get(context.TODO(), id)
+func (d *Database) GetAuthCode(ctx context.Context, id string) (storage.AuthCode, error) {
+	authCode, err := d.client.AuthCode.Get(ctx, id)
 	if err != nil {
 		return storage.AuthCode{}, convertDBError("get auth code: %w", err)
 	}
@@ -43,8 +45,8 @@ func (d *Database) GetAuthCode(id string) (storage.AuthCode, error) {
 }
 
 // DeleteAuthCode deletes an auth code from the database by id.
-func (d *Database) DeleteAuthCode(id string) error {
-	err := d.client.AuthCode.DeleteOneID(id).Exec(context.TODO())
+func (d *Database) DeleteAuthCode(ctx context.Context, id string) error {
+	err := d.client.AuthCode.DeleteOneID(id).Exec(ctx)
 	if err != nil {
 		return convertDBError("delete auth code: %w", err)
 	}
diff --git a/storage/ent/client/authrequest.go b/storage/ent/client/authrequest.go
index bde37adc27..74b51a1cbc 100644
--- a/storage/ent/client/authrequest.go
+++ b/storage/ent/client/authrequest.go
@@ -8,7 +8,7 @@ import (
 )
 
 // CreateAuthRequest saves provided auth request into the database.
-func (d *Database) CreateAuthRequest(authRequest storage.AuthRequest) error {
+func (d *Database) CreateAuthRequest(ctx context.Context, authRequest storage.AuthRequest) error {
 	_, err := d.client.AuthRequest.Create().
 		SetID(authRequest.ID).
 		SetClientID(authRequest.ClientID).
@@ -31,7 +31,13 @@ func (d *Database) CreateAuthRequest(authRequest storage.AuthRequest) error {
 		SetExpiry(authRequest.Expiry.UTC()).
 		SetConnectorID(authRequest.ConnectorID).
 		SetConnectorData(authRequest.ConnectorData).
-		Save(context.TODO())
+		SetHmacKey(authRequest.HMACKey).
+		SetMfaValidated(authRequest.MFAValidated).
+		SetWebauthnSessionData(authRequest.WebAuthnSessionData).
+		SetPrompt(authRequest.Prompt).
+		SetMaxAge(authRequest.MaxAge).
+		SetAuthTime(authRequest.AuthTime).
+		Save(ctx)
 	if err != nil {
 		return convertDBError("create auth request: %w", err)
 	}
@@ -39,8 +45,8 @@ func (d *Database) CreateAuthRequest(authRequest storage.AuthRequest) error {
 }
 
 // GetAuthRequest extracts an auth request from the database by id.
-func (d *Database) GetAuthRequest(id string) (storage.AuthRequest, error) {
-	authRequest, err := d.client.AuthRequest.Get(context.TODO(), id)
+func (d *Database) GetAuthRequest(ctx context.Context, id string) (storage.AuthRequest, error) {
+	authRequest, err := d.client.AuthRequest.Get(ctx, id)
 	if err != nil {
 		return storage.AuthRequest{}, convertDBError("get auth request: %w", err)
 	}
@@ -48,8 +54,8 @@ func (d *Database) GetAuthRequest(id string) (storage.AuthRequest, error) {
 }
 
 // DeleteAuthRequest deletes an auth request from the database by id.
-func (d *Database) DeleteAuthRequest(id string) error {
-	err := d.client.AuthRequest.DeleteOneID(id).Exec(context.TODO())
+func (d *Database) DeleteAuthRequest(ctx context.Context, id string) error {
+	err := d.client.AuthRequest.DeleteOneID(id).Exec(ctx)
 	if err != nil {
 		return convertDBError("delete auth request: %w", err)
 	}
@@ -57,8 +63,8 @@ func (d *Database) DeleteAuthRequest(id string) error {
 }
 
 // UpdateAuthRequest changes an auth request by id using an updater function and saves it to the database.
-func (d *Database) UpdateAuthRequest(id string, updater func(old storage.AuthRequest) (storage.AuthRequest, error)) error {
-	tx, err := d.BeginTx(context.TODO())
+func (d *Database) UpdateAuthRequest(ctx context.Context, id string, updater func(old storage.AuthRequest) (storage.AuthRequest, error)) error {
+	tx, err := d.BeginTx(ctx)
 	if err != nil {
 		return fmt.Errorf("update auth request tx: %w", err)
 	}
@@ -94,6 +100,12 @@ func (d *Database) UpdateAuthRequest(id string, updater func(old storage.AuthReq
 		SetExpiry(newAuthRequest.Expiry.UTC()).
 		SetConnectorID(newAuthRequest.ConnectorID).
 		SetConnectorData(newAuthRequest.ConnectorData).
+		SetHmacKey(newAuthRequest.HMACKey).
+		SetMfaValidated(newAuthRequest.MFAValidated).
+		SetWebauthnSessionData(newAuthRequest.WebAuthnSessionData).
+		SetPrompt(newAuthRequest.Prompt).
+		SetMaxAge(newAuthRequest.MaxAge).
+		SetAuthTime(newAuthRequest.AuthTime).
 		Save(context.TODO())
 	if err != nil {
 		return rollback(tx, "update auth request uploading: %w", err)
diff --git a/storage/ent/client/authsession.go b/storage/ent/client/authsession.go
new file mode 100644
index 0000000000..8ffa13b746
--- /dev/null
+++ b/storage/ent/client/authsession.go
@@ -0,0 +1,127 @@
+package client
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+
+	"github.com/dexidp/dex/storage"
+)
+
+// CreateAuthSession saves provided auth session into the database.
+func (d *Database) CreateAuthSession(ctx context.Context, session storage.AuthSession) error {
+	if session.ClientStates == nil {
+		session.ClientStates = make(map[string]*storage.ClientAuthState)
+	}
+	encodedStates, err := json.Marshal(session.ClientStates)
+	if err != nil {
+		return fmt.Errorf("encode client states auth session: %w", err)
+	}
+
+	encodedLogoutState, err := json.Marshal(session.LogoutState)
+	if err != nil {
+		return fmt.Errorf("encode logout state auth session: %w", err)
+	}
+
+	_, err = d.client.AuthSession.Create().
+		SetID(session.ID).
+		SetUserID(session.UserID).
+		SetConnectorID(session.ConnectorID).
+		SetSecret(session.Secret).
+		SetClientStates(encodedStates).
+		SetCreatedAt(session.CreatedAt).
+		SetLastActivity(session.LastActivity).
+		SetIPAddress(session.IPAddress).
+		SetUserAgent(session.UserAgent).
+		SetAbsoluteExpiry(session.AbsoluteExpiry.UTC()).
+		SetIdleExpiry(session.IdleExpiry.UTC()).
+		SetLogoutState(encodedLogoutState).
+		Save(ctx)
+	if err != nil {
+		return convertDBError("create auth session: %w", err)
+	}
+	return nil
+}
+
+// GetAuthSession extracts an auth session from the database by its ID.
+func (d *Database) GetAuthSession(ctx context.Context, id string) (storage.AuthSession, error) {
+	authSession, err := d.client.AuthSession.Get(ctx, id)
+	if err != nil {
+		return storage.AuthSession{}, convertDBError("get auth session: %w", err)
+	}
+	return toStorageAuthSession(authSession), nil
+}
+
+// ListAuthSessions extracts all auth sessions from the database.
+func (d *Database) ListAuthSessions(ctx context.Context) ([]storage.AuthSession, error) {
+	authSessions, err := d.client.AuthSession.Query().All(ctx)
+	if err != nil {
+		return nil, convertDBError("list auth sessions: %w", err)
+	}
+
+	storageAuthSessions := make([]storage.AuthSession, 0, len(authSessions))
+	for _, s := range authSessions {
+		storageAuthSessions = append(storageAuthSessions, toStorageAuthSession(s))
+	}
+	return storageAuthSessions, nil
+}
+
+// DeleteAuthSession deletes an auth session from the database by its ID.
+func (d *Database) DeleteAuthSession(ctx context.Context, id string) error {
+	err := d.client.AuthSession.DeleteOneID(id).Exec(ctx)
+	if err != nil {
+		return convertDBError("delete auth session: %w", err)
+	}
+	return nil
+}
+
+// UpdateAuthSession changes an auth session using an updater function.
+func (d *Database) UpdateAuthSession(ctx context.Context, id string, updater func(s storage.AuthSession) (storage.AuthSession, error)) error {
+	tx, err := d.BeginTx(ctx)
+	if err != nil {
+		return convertDBError("update auth session tx: %w", err)
+	}
+
+	authSession, err := tx.AuthSession.Get(ctx, id)
+	if err != nil {
+		return rollback(tx, "update auth session database: %w", err)
+	}
+
+	newSession, err := updater(toStorageAuthSession(authSession))
+	if err != nil {
+		return rollback(tx, "update auth session updating: %w", err)
+	}
+
+	if newSession.ClientStates == nil {
+		newSession.ClientStates = make(map[string]*storage.ClientAuthState)
+	}
+
+	encodedStates, err := json.Marshal(newSession.ClientStates)
+	if err != nil {
+		return rollback(tx, "encode client states auth session: %w", err)
+	}
+
+	encodedLogoutState, err := json.Marshal(newSession.LogoutState)
+	if err != nil {
+		return rollback(tx, "encode logout state auth session: %w", err)
+	}
+
+	_, err = tx.AuthSession.UpdateOneID(id).
+		SetClientStates(encodedStates).
+		SetLastActivity(newSession.LastActivity).
+		SetIPAddress(newSession.IPAddress).
+		SetUserAgent(newSession.UserAgent).
+		SetAbsoluteExpiry(newSession.AbsoluteExpiry.UTC()).
+		SetIdleExpiry(newSession.IdleExpiry.UTC()).
+		SetLogoutState(encodedLogoutState).
+		Save(ctx)
+	if err != nil {
+		return rollback(tx, "update auth session updating: %w", err)
+	}
+
+	if err = tx.Commit(); err != nil {
+		return rollback(tx, "update auth session commit: %w", err)
+	}
+
+	return nil
+}
diff --git a/storage/ent/client/client.go b/storage/ent/client/client.go
index 07434bd60b..ae37774c6f 100644
--- a/storage/ent/client/client.go
+++ b/storage/ent/client/client.go
@@ -7,8 +7,8 @@ import (
 )
 
 // CreateClient saves provided oauth2 client settings into the database.
-func (d *Database) CreateClient(client storage.Client) error {
-	_, err := d.client.OAuth2Client.Create().
+func (d *Database) CreateClient(ctx context.Context, client storage.Client) error {
+	create := d.client.OAuth2Client.Create().
 		SetID(client.ID).
 		SetName(client.Name).
 		SetSecret(client.Secret).
@@ -16,7 +16,16 @@ func (d *Database) CreateClient(client storage.Client) error {
 		SetLogoURL(client.LogoURL).
 		SetRedirectUris(client.RedirectURIs).
 		SetTrustedPeers(client.TrustedPeers).
-		Save(context.TODO())
+		SetAllowedConnectors(client.AllowedConnectors).
+		SetMfaChain(client.MFAChain).
+		SetPostLogoutRedirectUris(client.PostLogoutRedirectURIs).
+		SetSSOSharedWith(client.SSOSharedWith).
+		SetBackchannelLogoutURI(client.BackchannelLogoutURI).
+		SetRefreshTokenLifetime(client.RefreshTokenLifetime)
+	if client.ClientCredentialsClaims != nil {
+		create = create.SetClientCredentialsClaims(client.ClientCredentialsClaims)
+	}
+	_, err := create.Save(ctx)
 	if err != nil {
 		return convertDBError("create oauth2 client: %w", err)
 	}
@@ -24,8 +33,8 @@ func (d *Database) CreateClient(client storage.Client) error {
 }
 
 // ListClients extracts an array of oauth2 clients from the database.
-func (d *Database) ListClients() ([]storage.Client, error) {
-	clients, err := d.client.OAuth2Client.Query().All(context.TODO())
+func (d *Database) ListClients(ctx context.Context) ([]storage.Client, error) {
+	clients, err := d.client.OAuth2Client.Query().All(ctx)
 	if err != nil {
 		return nil, convertDBError("list clients: %w", err)
 	}
@@ -38,8 +47,8 @@ func (d *Database) ListClients() ([]storage.Client, error) {
 }
 
 // GetClient extracts an oauth2 client from the database by id.
-func (d *Database) GetClient(id string) (storage.Client, error) {
-	client, err := d.client.OAuth2Client.Get(context.TODO(), id)
+func (d *Database) GetClient(ctx context.Context, id string) (storage.Client, error) {
+	client, err := d.client.OAuth2Client.Get(ctx, id)
 	if err != nil {
 		return storage.Client{}, convertDBError("get client: %w", err)
 	}
@@ -47,8 +56,8 @@ func (d *Database) GetClient(id string) (storage.Client, error) {
 }
 
 // DeleteClient deletes an oauth2 client from the database by id.
-func (d *Database) DeleteClient(id string) error {
-	err := d.client.OAuth2Client.DeleteOneID(id).Exec(context.TODO())
+func (d *Database) DeleteClient(ctx context.Context, id string) error {
+	err := d.client.OAuth2Client.DeleteOneID(id).Exec(ctx)
 	if err != nil {
 		return convertDBError("delete client: %w", err)
 	}
@@ -56,13 +65,13 @@ func (d *Database) DeleteClient(id string) error {
 }
 
 // UpdateClient changes an oauth2 client by id using an updater function and saves it to the database.
-func (d *Database) UpdateClient(id string, updater func(old storage.Client) (storage.Client, error)) error {
-	tx, err := d.BeginTx(context.TODO())
+func (d *Database) UpdateClient(ctx context.Context, id string, updater func(old storage.Client) (storage.Client, error)) error {
+	tx, err := d.BeginTx(ctx)
 	if err != nil {
 		return convertDBError("update client tx: %w", err)
 	}
 
-	client, err := tx.OAuth2Client.Get(context.TODO(), id)
+	client, err := tx.OAuth2Client.Get(ctx, id)
 	if err != nil {
 		return rollback(tx, "update client database: %w", err)
 	}
@@ -72,14 +81,25 @@ func (d *Database) UpdateClient(id string, updater func(old storage.Client) (sto
 		return rollback(tx, "update client updating: %w", err)
 	}
 
-	_, err = tx.OAuth2Client.UpdateOneID(newClient.ID).
+	update := tx.OAuth2Client.UpdateOneID(newClient.ID).
 		SetName(newClient.Name).
 		SetSecret(newClient.Secret).
 		SetPublic(newClient.Public).
 		SetLogoURL(newClient.LogoURL).
 		SetRedirectUris(newClient.RedirectURIs).
 		SetTrustedPeers(newClient.TrustedPeers).
-		Save(context.TODO())
+		SetAllowedConnectors(newClient.AllowedConnectors).
+		SetMfaChain(newClient.MFAChain).
+		SetPostLogoutRedirectUris(newClient.PostLogoutRedirectURIs).
+		SetSSOSharedWith(newClient.SSOSharedWith).
+		SetBackchannelLogoutURI(newClient.BackchannelLogoutURI).
+		SetRefreshTokenLifetime(newClient.RefreshTokenLifetime)
+	if newClient.ClientCredentialsClaims != nil {
+		update = update.SetClientCredentialsClaims(newClient.ClientCredentialsClaims)
+	} else {
+		update = update.ClearClientCredentialsClaims()
+	}
+	_, err = update.Save(ctx)
 	if err != nil {
 		return rollback(tx, "update client uploading: %w", err)
 	}
diff --git a/storage/ent/client/connector.go b/storage/ent/client/connector.go
index bfec4418dd..21e7aec23c 100644
--- a/storage/ent/client/connector.go
+++ b/storage/ent/client/connector.go
@@ -7,14 +7,15 @@ import (
 )
 
 // CreateConnector saves a connector into the database.
-func (d *Database) CreateConnector(connector storage.Connector) error {
+func (d *Database) CreateConnector(ctx context.Context, connector storage.Connector) error {
 	_, err := d.client.Connector.Create().
 		SetID(connector.ID).
 		SetName(connector.Name).
 		SetType(connector.Type).
 		SetResourceVersion(connector.ResourceVersion).
 		SetConfig(connector.Config).
-		Save(context.TODO())
+		SetGrantTypes(connector.GrantTypes).
+		Save(ctx)
 	if err != nil {
 		return convertDBError("create connector: %w", err)
 	}
@@ -22,8 +23,8 @@ func (d *Database) CreateConnector(connector storage.Connector) error {
 }
 
 // ListConnectors extracts an array of connectors from the database.
-func (d *Database) ListConnectors() ([]storage.Connector, error) {
-	connectors, err := d.client.Connector.Query().All(context.TODO())
+func (d *Database) ListConnectors(ctx context.Context) ([]storage.Connector, error) {
+	connectors, err := d.client.Connector.Query().All(ctx)
 	if err != nil {
 		return nil, convertDBError("list connectors: %w", err)
 	}
@@ -36,8 +37,8 @@ func (d *Database) ListConnectors() ([]storage.Connector, error) {
 }
 
 // GetConnector extracts a connector from the database by id.
-func (d *Database) GetConnector(id string) (storage.Connector, error) {
-	connector, err := d.client.Connector.Get(context.TODO(), id)
+func (d *Database) GetConnector(ctx context.Context, id string) (storage.Connector, error) {
+	connector, err := d.client.Connector.Get(ctx, id)
 	if err != nil {
 		return storage.Connector{}, convertDBError("get connector: %w", err)
 	}
@@ -45,8 +46,8 @@ func (d *Database) GetConnector(id string) (storage.Connector, error) {
 }
 
 // DeleteConnector deletes a connector from the database by id.
-func (d *Database) DeleteConnector(id string) error {
-	err := d.client.Connector.DeleteOneID(id).Exec(context.TODO())
+func (d *Database) DeleteConnector(ctx context.Context, id string) error {
+	err := d.client.Connector.DeleteOneID(id).Exec(ctx)
 	if err != nil {
 		return convertDBError("delete connector: %w", err)
 	}
@@ -54,13 +55,13 @@ func (d *Database) DeleteConnector(id string) error {
 }
 
 // UpdateConnector changes a connector by id using an updater function and saves it to the database.
-func (d *Database) UpdateConnector(id string, updater func(old storage.Connector) (storage.Connector, error)) error {
-	tx, err := d.BeginTx(context.TODO())
+func (d *Database) UpdateConnector(ctx context.Context, id string, updater func(old storage.Connector) (storage.Connector, error)) error {
+	tx, err := d.BeginTx(ctx)
 	if err != nil {
 		return convertDBError("update connector tx: %w", err)
 	}
 
-	connector, err := tx.Connector.Get(context.TODO(), id)
+	connector, err := tx.Connector.Get(ctx, id)
 	if err != nil {
 		return rollback(tx, "update connector database: %w", err)
 	}
@@ -75,7 +76,8 @@ func (d *Database) UpdateConnector(id string, updater func(old storage.Connector
 		SetType(newConnector.Type).
 		SetResourceVersion(newConnector.ResourceVersion).
 		SetConfig(newConnector.Config).
-		Save(context.TODO())
+		SetGrantTypes(newConnector.GrantTypes).
+		Save(ctx)
 	if err != nil {
 		return rollback(tx, "update connector uploading: %w", err)
 	}
diff --git a/storage/ent/client/devicerequest.go b/storage/ent/client/devicerequest.go
index 6e9c25001d..5673395567 100644
--- a/storage/ent/client/devicerequest.go
+++ b/storage/ent/client/devicerequest.go
@@ -8,7 +8,7 @@ import (
 )
 
 // CreateDeviceRequest saves provided device request into the database.
-func (d *Database) CreateDeviceRequest(request storage.DeviceRequest) error {
+func (d *Database) CreateDeviceRequest(ctx context.Context, request storage.DeviceRequest) error {
 	_, err := d.client.DeviceRequest.Create().
 		SetClientID(request.ClientID).
 		SetClientSecret(request.ClientSecret).
@@ -17,7 +17,7 @@ func (d *Database) CreateDeviceRequest(request storage.DeviceRequest) error {
 		SetDeviceCode(request.DeviceCode).
 		// Save utc time into database because ent doesn't support comparing dates with different timezones
 		SetExpiry(request.Expiry.UTC()).
-		Save(context.TODO())
+		Save(ctx)
 	if err != nil {
 		return convertDBError("create device request: %w", err)
 	}
@@ -25,10 +25,10 @@ func (d *Database) CreateDeviceRequest(request storage.DeviceRequest) error {
 }
 
 // GetDeviceRequest extracts a device request from the database by user code.
-func (d *Database) GetDeviceRequest(userCode string) (storage.DeviceRequest, error) {
+func (d *Database) GetDeviceRequest(ctx context.Context, userCode string) (storage.DeviceRequest, error) {
 	deviceRequest, err := d.client.DeviceRequest.Query().
 		Where(devicerequest.UserCode(userCode)).
-		Only(context.TODO())
+		Only(ctx)
 	if err != nil {
 		return storage.DeviceRequest{}, convertDBError("get device request: %w", err)
 	}
diff --git a/storage/ent/client/devicetoken.go b/storage/ent/client/devicetoken.go
index 99cf077d02..759812b196 100644
--- a/storage/ent/client/devicetoken.go
+++ b/storage/ent/client/devicetoken.go
@@ -8,7 +8,7 @@ import (
 )
 
 // CreateDeviceToken saves provided token into the database.
-func (d *Database) CreateDeviceToken(token storage.DeviceToken) error {
+func (d *Database) CreateDeviceToken(ctx context.Context, token storage.DeviceToken) error {
 	_, err := d.client.DeviceToken.Create().
 		SetDeviceCode(token.DeviceCode).
 		SetToken([]byte(token.Token)).
@@ -19,7 +19,7 @@ func (d *Database) CreateDeviceToken(token storage.DeviceToken) error {
 		SetStatus(token.Status).
 		SetCodeChallenge(token.PKCE.CodeChallenge).
 		SetCodeChallengeMethod(token.PKCE.CodeChallengeMethod).
-		Save(context.TODO())
+		Save(ctx)
 	if err != nil {
 		return convertDBError("create device token: %w", err)
 	}
@@ -27,10 +27,10 @@ func (d *Database) CreateDeviceToken(token storage.DeviceToken) error {
 }
 
 // GetDeviceToken extracts a token from the database by device code.
-func (d *Database) GetDeviceToken(deviceCode string) (storage.DeviceToken, error) {
+func (d *Database) GetDeviceToken(ctx context.Context, deviceCode string) (storage.DeviceToken, error) {
 	deviceToken, err := d.client.DeviceToken.Query().
 		Where(devicetoken.DeviceCode(deviceCode)).
-		Only(context.TODO())
+		Only(ctx)
 	if err != nil {
 		return storage.DeviceToken{}, convertDBError("get device token: %w", err)
 	}
@@ -38,15 +38,15 @@ func (d *Database) GetDeviceToken(deviceCode string) (storage.DeviceToken, error
 }
 
 // UpdateDeviceToken changes a token by device code using an updater function and saves it to the database.
-func (d *Database) UpdateDeviceToken(deviceCode string, updater func(old storage.DeviceToken) (storage.DeviceToken, error)) error {
-	tx, err := d.BeginTx(context.TODO())
+func (d *Database) UpdateDeviceToken(ctx context.Context, deviceCode string, updater func(old storage.DeviceToken) (storage.DeviceToken, error)) error {
+	tx, err := d.BeginTx(ctx)
 	if err != nil {
 		return convertDBError("update device token tx: %w", err)
 	}
 
 	token, err := tx.DeviceToken.Query().
 		Where(devicetoken.DeviceCode(deviceCode)).
-		Only(context.TODO())
+		Only(ctx)
 	if err != nil {
 		return rollback(tx, "update device token database: %w", err)
 	}
@@ -67,7 +67,7 @@ func (d *Database) UpdateDeviceToken(deviceCode string, updater func(old storage
 		SetStatus(newToken.Status).
 		SetCodeChallenge(newToken.PKCE.CodeChallenge).
 		SetCodeChallengeMethod(newToken.PKCE.CodeChallengeMethod).
-		Save(context.TODO())
+		Save(ctx)
 	if err != nil {
 		return rollback(tx, "update device token uploading: %w", err)
 	}
diff --git a/storage/ent/client/keys.go b/storage/ent/client/keys.go
index f65d40fc21..c4e972026f 100644
--- a/storage/ent/client/keys.go
+++ b/storage/ent/client/keys.go
@@ -8,8 +8,8 @@ import (
 	"github.com/dexidp/dex/storage/ent/db"
 )
 
-func getKeys(client *db.KeysClient) (storage.Keys, error) {
-	rawKeys, err := client.Get(context.TODO(), keysRowID)
+func getKeys(ctx context.Context, client *db.KeysClient) (storage.Keys, error) {
+	rawKeys, err := client.Get(ctx, keysRowID)
 	if err != nil {
 		return storage.Keys{}, convertDBError("get keys: %w", err)
 	}
@@ -18,20 +18,20 @@ func getKeys(client *db.KeysClient) (storage.Keys, error) {
 }
 
 // GetKeys returns signing keys, public keys and verification keys from the database.
-func (d *Database) GetKeys() (storage.Keys, error) {
-	return getKeys(d.client.Keys)
+func (d *Database) GetKeys(ctx context.Context) (storage.Keys, error) {
+	return getKeys(ctx, d.client.Keys)
 }
 
 // UpdateKeys rotates keys using updater function.
-func (d *Database) UpdateKeys(updater func(old storage.Keys) (storage.Keys, error)) error {
+func (d *Database) UpdateKeys(ctx context.Context, updater func(old storage.Keys) (storage.Keys, error)) error {
 	firstUpdate := false
 
-	tx, err := d.BeginTx(context.TODO())
+	tx, err := d.BeginTx(ctx)
 	if err != nil {
 		return convertDBError("update keys tx: %w", err)
 	}
 
-	storageKeys, err := getKeys(tx.Keys)
+	storageKeys, err := getKeys(ctx, tx.Keys)
 	if err != nil {
 		if !errors.Is(err, storage.ErrNotFound) {
 			return rollback(tx, "update keys get: %w", err)
@@ -53,7 +53,7 @@ func (d *Database) UpdateKeys(updater func(old storage.Keys) (storage.Keys, erro
 			SetSigningKey(*newKeys.SigningKey).
 			SetSigningKeyPub(*newKeys.SigningKeyPub).
 			SetVerificationKeys(newKeys.VerificationKeys).
-			Save(context.TODO())
+			Save(ctx)
 		if err != nil {
 			return rollback(tx, "create keys: %w", err)
 		}
@@ -68,7 +68,7 @@ func (d *Database) UpdateKeys(updater func(old storage.Keys) (storage.Keys, erro
 		SetSigningKey(*newKeys.SigningKey).
 		SetSigningKeyPub(*newKeys.SigningKeyPub).
 		SetVerificationKeys(newKeys.VerificationKeys).
-		Exec(context.TODO())
+		Exec(ctx)
 	if err != nil {
 		return rollback(tx, "update keys uploading: %w", err)
 	}
diff --git a/storage/ent/client/main.go b/storage/ent/client/main.go
index bc4c1600ac..ea9ca297f6 100644
--- a/storage/ent/client/main.go
+++ b/storage/ent/client/main.go
@@ -10,6 +10,7 @@ import (
 	"github.com/dexidp/dex/storage/ent/db"
 	"github.com/dexidp/dex/storage/ent/db/authcode"
 	"github.com/dexidp/dex/storage/ent/db/authrequest"
+	"github.com/dexidp/dex/storage/ent/db/authsession"
 	"github.com/dexidp/dex/storage/ent/db/devicerequest"
 	"github.com/dexidp/dex/storage/ent/db/devicetoken"
 	"github.com/dexidp/dex/storage/ent/db/migrate"
@@ -70,13 +71,13 @@ func (d *Database) BeginTx(ctx context.Context) (*db.Tx, error) {
 }
 
 // GarbageCollect removes expired entities from the database.
-func (d *Database) GarbageCollect(now time.Time) (storage.GCResult, error) {
+func (d *Database) GarbageCollect(ctx context.Context, now time.Time) (storage.GCResult, error) {
 	result := storage.GCResult{}
 	utcNow := now.UTC()
 
 	q, err := d.client.AuthRequest.Delete().
 		Where(authrequest.ExpiryLT(utcNow)).
-		Exec(context.TODO())
+		Exec(ctx)
 	if err != nil {
 		return result, convertDBError("gc auth request: %w", err)
 	}
@@ -84,7 +85,7 @@ func (d *Database) GarbageCollect(now time.Time) (storage.GCResult, error) {
 
 	q, err = d.client.AuthCode.Delete().
 		Where(authcode.ExpiryLT(utcNow)).
-		Exec(context.TODO())
+		Exec(ctx)
 	if err != nil {
 		return result, convertDBError("gc auth code: %w", err)
 	}
@@ -92,7 +93,7 @@ func (d *Database) GarbageCollect(now time.Time) (storage.GCResult, error) {
 
 	q, err = d.client.DeviceRequest.Delete().
 		Where(devicerequest.ExpiryLT(utcNow)).
-		Exec(context.TODO())
+		Exec(ctx)
 	if err != nil {
 		return result, convertDBError("gc device request: %w", err)
 	}
@@ -100,11 +101,24 @@ func (d *Database) GarbageCollect(now time.Time) (storage.GCResult, error) {
 
 	q, err = d.client.DeviceToken.Delete().
 		Where(devicetoken.ExpiryLT(utcNow)).
-		Exec(context.TODO())
+		Exec(ctx)
 	if err != nil {
 		return result, convertDBError("gc device token: %w", err)
 	}
 	result.DeviceTokens = int64(q)
 
+	q, err = d.client.AuthSession.Delete().
+		Where(
+			authsession.Or(
+				authsession.AbsoluteExpiryLT(utcNow),
+				authsession.IdleExpiryLT(utcNow),
+			),
+		).
+		Exec(ctx)
+	if err != nil {
+		return result, convertDBError("gc auth session: %w", err)
+	}
+	result.AuthSessions = int64(q)
+
 	return result, err
 }
diff --git a/storage/ent/client/offlinesession.go b/storage/ent/client/offlinesession.go
index 9f54ea1d3c..c8f18433eb 100644
--- a/storage/ent/client/offlinesession.go
+++ b/storage/ent/client/offlinesession.go
@@ -9,20 +9,20 @@ import (
 )
 
 // CreateOfflineSessions saves provided offline session into the database.
-func (d *Database) CreateOfflineSessions(session storage.OfflineSessions) error {
+func (d *Database) CreateOfflineSessions(ctx context.Context, session storage.OfflineSessions) error {
 	encodedRefresh, err := json.Marshal(session.Refresh)
 	if err != nil {
 		return fmt.Errorf("encode refresh offline session: %w", err)
 	}
 
-	id := offlineSessionID(session.UserID, session.ConnID, d.hasher)
+	id := compositeKeyID(session.UserID, session.ConnID, d.hasher)
 	_, err = d.client.OfflineSession.Create().
 		SetID(id).
 		SetUserID(session.UserID).
 		SetConnID(session.ConnID).
 		SetConnectorData(session.ConnectorData).
 		SetRefresh(encodedRefresh).
-		Save(context.TODO())
+		Save(ctx)
 	if err != nil {
 		return convertDBError("create offline session: %w", err)
 	}
@@ -30,10 +30,10 @@ func (d *Database) CreateOfflineSessions(session storage.OfflineSessions) error
 }
 
 // GetOfflineSessions extracts an offline session from the database by user id and connector id.
-func (d *Database) GetOfflineSessions(userID, connID string) (storage.OfflineSessions, error) {
-	id := offlineSessionID(userID, connID, d.hasher)
+func (d *Database) GetOfflineSessions(ctx context.Context, userID, connID string) (storage.OfflineSessions, error) {
+	id := compositeKeyID(userID, connID, d.hasher)
 
-	offlineSession, err := d.client.OfflineSession.Get(context.TODO(), id)
+	offlineSession, err := d.client.OfflineSession.Get(ctx, id)
 	if err != nil {
 		return storage.OfflineSessions{}, convertDBError("get offline session: %w", err)
 	}
@@ -41,10 +41,10 @@ func (d *Database) GetOfflineSessions(userID, connID string) (storage.OfflineSes
 }
 
 // DeleteOfflineSessions deletes an offline session from the database by user id and connector id.
-func (d *Database) DeleteOfflineSessions(userID, connID string) error {
-	id := offlineSessionID(userID, connID, d.hasher)
+func (d *Database) DeleteOfflineSessions(ctx context.Context, userID, connID string) error {
+	id := compositeKeyID(userID, connID, d.hasher)
 
-	err := d.client.OfflineSession.DeleteOneID(id).Exec(context.TODO())
+	err := d.client.OfflineSession.DeleteOneID(id).Exec(ctx)
 	if err != nil {
 		return convertDBError("delete offline session: %w", err)
 	}
@@ -52,15 +52,15 @@ func (d *Database) DeleteOfflineSessions(userID, connID string) error {
 }
 
 // UpdateOfflineSessions changes an offline session by user id and connector id using an updater function.
-func (d *Database) UpdateOfflineSessions(userID string, connID string, updater func(s storage.OfflineSessions) (storage.OfflineSessions, error)) error {
-	id := offlineSessionID(userID, connID, d.hasher)
+func (d *Database) UpdateOfflineSessions(ctx context.Context, userID string, connID string, updater func(s storage.OfflineSessions) (storage.OfflineSessions, error)) error {
+	id := compositeKeyID(userID, connID, d.hasher)
 
-	tx, err := d.BeginTx(context.TODO())
+	tx, err := d.BeginTx(ctx)
 	if err != nil {
 		return convertDBError("update offline session tx: %w", err)
 	}
 
-	offlineSession, err := tx.OfflineSession.Get(context.TODO(), id)
+	offlineSession, err := tx.OfflineSession.Get(ctx, id)
 	if err != nil {
 		return rollback(tx, "update offline session database: %w", err)
 	}
@@ -80,7 +80,7 @@ func (d *Database) UpdateOfflineSessions(userID string, connID string, updater f
 		SetConnID(newOfflineSession.ConnID).
 		SetConnectorData(newOfflineSession.ConnectorData).
 		SetRefresh(encodedRefresh).
-		Save(context.TODO())
+		Save(ctx)
 	if err != nil {
 		return rollback(tx, "update offline session uploading: %w", err)
 	}
diff --git a/storage/ent/client/password.go b/storage/ent/client/password.go
index daaae30cea..183c5b144d 100644
--- a/storage/ent/client/password.go
+++ b/storage/ent/client/password.go
@@ -9,13 +9,17 @@ import (
 )
 
 // CreatePassword saves provided password into the database.
-func (d *Database) CreatePassword(password storage.Password) error {
+func (d *Database) CreatePassword(ctx context.Context, password storage.Password) error {
 	_, err := d.client.Password.Create().
 		SetEmail(password.Email).
 		SetHash(password.Hash).
 		SetUsername(password.Username).
+		SetName(password.Name).
+		SetPreferredUsername(password.PreferredUsername).
+		SetNillableEmailVerified(password.EmailVerified).
 		SetUserID(password.UserID).
-		Save(context.TODO())
+		SetGroups(password.Groups).
+		Save(ctx)
 	if err != nil {
 		return convertDBError("create password: %w", err)
 	}
@@ -23,8 +27,8 @@ func (d *Database) CreatePassword(password storage.Password) error {
 }
 
 // ListPasswords extracts an array of passwords from the database.
-func (d *Database) ListPasswords() ([]storage.Password, error) {
-	passwords, err := d.client.Password.Query().All(context.TODO())
+func (d *Database) ListPasswords(ctx context.Context) ([]storage.Password, error) {
+	passwords, err := d.client.Password.Query().All(ctx)
 	if err != nil {
 		return nil, convertDBError("list passwords: %w", err)
 	}
@@ -37,11 +41,11 @@ func (d *Database) ListPasswords() ([]storage.Password, error) {
 }
 
 // GetPassword extracts a password from the database by email.
-func (d *Database) GetPassword(email string) (storage.Password, error) {
+func (d *Database) GetPassword(ctx context.Context, email string) (storage.Password, error) {
 	email = strings.ToLower(email)
 	passwordFromStorage, err := d.client.Password.Query().
 		Where(password.Email(email)).
-		Only(context.TODO())
+		Only(ctx)
 	if err != nil {
 		return storage.Password{}, convertDBError("get password: %w", err)
 	}
@@ -49,11 +53,11 @@ func (d *Database) GetPassword(email string) (storage.Password, error) {
 }
 
 // DeletePassword deletes a password from the database by email.
-func (d *Database) DeletePassword(email string) error {
+func (d *Database) DeletePassword(ctx context.Context, email string) error {
 	email = strings.ToLower(email)
 	_, err := d.client.Password.Delete().
 		Where(password.Email(email)).
-		Exec(context.TODO())
+		Exec(ctx)
 	if err != nil {
 		return convertDBError("delete password: %w", err)
 	}
@@ -61,17 +65,17 @@ func (d *Database) DeletePassword(email string) error {
 }
 
 // UpdatePassword changes a password by email using an updater function and saves it to the database.
-func (d *Database) UpdatePassword(email string, updater func(old storage.Password) (storage.Password, error)) error {
+func (d *Database) UpdatePassword(ctx context.Context, email string, updater func(old storage.Password) (storage.Password, error)) error {
 	email = strings.ToLower(email)
 
-	tx, err := d.BeginTx(context.TODO())
+	tx, err := d.BeginTx(ctx)
 	if err != nil {
 		return convertDBError("update connector tx: %w", err)
 	}
 
 	passwordToUpdate, err := tx.Password.Query().
 		Where(password.Email(email)).
-		Only(context.TODO())
+		Only(ctx)
 	if err != nil {
 		return rollback(tx, "update password database: %w", err)
 	}
@@ -86,8 +90,12 @@ func (d *Database) UpdatePassword(email string, updater func(old storage.Passwor
 		SetEmail(newPassword.Email).
 		SetHash(newPassword.Hash).
 		SetUsername(newPassword.Username).
+		SetName(newPassword.Name).
+		SetPreferredUsername(newPassword.PreferredUsername).
+		SetNillableEmailVerified(newPassword.EmailVerified).
 		SetUserID(newPassword.UserID).
-		Save(context.TODO())
+		SetGroups(newPassword.Groups).
+		Save(ctx)
 	if err != nil {
 		return rollback(tx, "update password uploading: %w", err)
 	}
diff --git a/storage/ent/client/refreshtoken.go b/storage/ent/client/refreshtoken.go
index eca048f463..d423565439 100644
--- a/storage/ent/client/refreshtoken.go
+++ b/storage/ent/client/refreshtoken.go
@@ -7,7 +7,7 @@ import (
 )
 
 // CreateRefresh saves provided refresh token into the database.
-func (d *Database) CreateRefresh(refresh storage.RefreshToken) error {
+func (d *Database) CreateRefresh(ctx context.Context, refresh storage.RefreshToken) error {
 	_, err := d.client.RefreshToken.Create().
 		SetID(refresh.ID).
 		SetClientID(refresh.ClientID).
@@ -26,7 +26,7 @@ func (d *Database) CreateRefresh(refresh storage.RefreshToken) error {
 		// Save utc time into database because ent doesn't support comparing dates with different timezones
 		SetLastUsed(refresh.LastUsed.UTC()).
 		SetCreatedAt(refresh.CreatedAt.UTC()).
-		Save(context.TODO())
+		Save(ctx)
 	if err != nil {
 		return convertDBError("create refresh token: %w", err)
 	}
@@ -34,8 +34,8 @@ func (d *Database) CreateRefresh(refresh storage.RefreshToken) error {
 }
 
 // ListRefreshTokens extracts an array of refresh tokens from the database.
-func (d *Database) ListRefreshTokens() ([]storage.RefreshToken, error) {
-	refreshTokens, err := d.client.RefreshToken.Query().All(context.TODO())
+func (d *Database) ListRefreshTokens(ctx context.Context) ([]storage.RefreshToken, error) {
+	refreshTokens, err := d.client.RefreshToken.Query().All(ctx)
 	if err != nil {
 		return nil, convertDBError("list refresh tokens: %w", err)
 	}
@@ -48,8 +48,8 @@ func (d *Database) ListRefreshTokens() ([]storage.RefreshToken, error) {
 }
 
 // GetRefresh extracts a refresh token from the database by id.
-func (d *Database) GetRefresh(id string) (storage.RefreshToken, error) {
-	refreshToken, err := d.client.RefreshToken.Get(context.TODO(), id)
+func (d *Database) GetRefresh(ctx context.Context, id string) (storage.RefreshToken, error) {
+	refreshToken, err := d.client.RefreshToken.Get(ctx, id)
 	if err != nil {
 		return storage.RefreshToken{}, convertDBError("get refresh token: %w", err)
 	}
@@ -57,8 +57,8 @@ func (d *Database) GetRefresh(id string) (storage.RefreshToken, error) {
 }
 
 // DeleteRefresh deletes a refresh token from the database by id.
-func (d *Database) DeleteRefresh(id string) error {
-	err := d.client.RefreshToken.DeleteOneID(id).Exec(context.TODO())
+func (d *Database) DeleteRefresh(ctx context.Context, id string) error {
+	err := d.client.RefreshToken.DeleteOneID(id).Exec(ctx)
 	if err != nil {
 		return convertDBError("delete refresh token: %w", err)
 	}
@@ -66,13 +66,13 @@ func (d *Database) DeleteRefresh(id string) error {
 }
 
 // UpdateRefreshToken changes a refresh token by id using an updater function and saves it to the database.
-func (d *Database) UpdateRefreshToken(id string, updater func(old storage.RefreshToken) (storage.RefreshToken, error)) error {
-	tx, err := d.BeginTx(context.TODO())
+func (d *Database) UpdateRefreshToken(ctx context.Context, id string, updater func(old storage.RefreshToken) (storage.RefreshToken, error)) error {
+	tx, err := d.BeginTx(ctx)
 	if err != nil {
 		return convertDBError("update refresh token tx: %w", err)
 	}
 
-	token, err := tx.RefreshToken.Get(context.TODO(), id)
+	token, err := tx.RefreshToken.Get(ctx, id)
 	if err != nil {
 		return rollback(tx, "update refresh token database: %w", err)
 	}
@@ -99,7 +99,7 @@ func (d *Database) UpdateRefreshToken(id string, updater func(old storage.Refres
 		// Save utc time into database because ent doesn't support comparing dates with different timezones
 		SetLastUsed(newtToken.LastUsed.UTC()).
 		SetCreatedAt(newtToken.CreatedAt.UTC()).
-		Save(context.TODO())
+		Save(ctx)
 	if err != nil {
 		return rollback(tx, "update refresh token uploading: %w", err)
 	}
diff --git a/storage/ent/client/types.go b/storage/ent/client/types.go
index 256bb73dcb..ce1738a133 100644
--- a/storage/ent/client/types.go
+++ b/storage/ent/client/types.go
@@ -45,6 +45,17 @@ func toStorageAuthRequest(a *db.AuthRequest) storage.AuthRequest {
 			CodeChallenge:       a.CodeChallenge,
 			CodeChallengeMethod: a.CodeChallengeMethod,
 		},
+		HMACKey:      a.HmacKey,
+		MFAValidated: a.MfaValidated,
+		WebAuthnSessionData: func() []byte {
+			if a.WebauthnSessionData != nil {
+				return *a.WebauthnSessionData
+			}
+			return nil
+		}(),
+		Prompt:   a.Prompt,
+		MaxAge:   a.MaxAge,
+		AuthTime: a.AuthTime,
 	}
 }
 
@@ -70,27 +81,37 @@ func toStorageAuthCode(a *db.AuthCode) storage.AuthCode {
 			CodeChallenge:       a.CodeChallenge,
 			CodeChallengeMethod: a.CodeChallengeMethod,
 		},
+		AuthTime:  a.AuthTime,
+		SessionID: a.SessionID,
 	}
 }
 
 func toStorageClient(c *db.OAuth2Client) storage.Client {
 	return storage.Client{
-		ID:           c.ID,
-		Secret:       c.Secret,
-		RedirectURIs: c.RedirectUris,
-		TrustedPeers: c.TrustedPeers,
-		Public:       c.Public,
-		Name:         c.Name,
-		LogoURL:      c.LogoURL,
+		ID:                      c.ID,
+		Secret:                  c.Secret,
+		RedirectURIs:            c.RedirectUris,
+		TrustedPeers:            c.TrustedPeers,
+		Public:                  c.Public,
+		Name:                    c.Name,
+		LogoURL:                 c.LogoURL,
+		AllowedConnectors:       c.AllowedConnectors,
+		MFAChain:                c.MfaChain,
+		PostLogoutRedirectURIs:  c.PostLogoutRedirectUris,
+		SSOSharedWith:           c.SSOSharedWith,
+		BackchannelLogoutURI:    c.BackchannelLogoutURI,
+		RefreshTokenLifetime:    c.RefreshTokenLifetime,
+		ClientCredentialsClaims: c.ClientCredentialsClaims,
 	}
 }
 
 func toStorageConnector(c *db.Connector) storage.Connector {
 	return storage.Connector{
-		ID:     c.ID,
-		Type:   c.Type,
-		Name:   c.Name,
-		Config: c.Config,
+		ID:         c.ID,
+		Type:       c.Type,
+		Name:       c.Name,
+		Config:     c.Config,
+		GrantTypes: c.GrantTypes,
 	}
 }
 
@@ -138,10 +159,14 @@ func toStorageRefreshToken(r *db.RefreshToken) storage.RefreshToken {
 
 func toStoragePassword(p *db.Password) storage.Password {
 	return storage.Password{
-		Email:    p.Email,
-		Hash:     p.Hash,
-		Username: p.Username,
-		UserID:   p.UserID,
+		Email:             p.Email,
+		Hash:              p.Hash,
+		Username:          p.Username,
+		Name:              p.Name,
+		PreferredUsername: p.PreferredUsername,
+		EmailVerified:     p.EmailVerified,
+		UserID:            p.UserID,
+		Groups:            p.Groups,
 	}
 }
 
@@ -156,6 +181,94 @@ func toStorageDeviceRequest(r *db.DeviceRequest) storage.DeviceRequest {
 	}
 }
 
+func toStorageUserIdentity(u *db.UserIdentity) storage.UserIdentity {
+	s := storage.UserIdentity{
+		UserID:      u.UserID,
+		ConnectorID: u.ConnectorID,
+		Claims: storage.Claims{
+			UserID:            u.ClaimsUserID,
+			Username:          u.ClaimsUsername,
+			PreferredUsername: u.ClaimsPreferredUsername,
+			Email:             u.ClaimsEmail,
+			EmailVerified:     u.ClaimsEmailVerified,
+			Groups:            u.ClaimsGroups,
+		},
+		CreatedAt:    u.CreatedAt,
+		LastLogin:    u.LastLogin,
+		BlockedUntil: u.BlockedUntil,
+	}
+
+	if u.Consents != nil {
+		if err := json.Unmarshal(u.Consents, &s.Consents); err != nil {
+			// Correctness of json structure is guaranteed on uploading
+			panic(err)
+		}
+		if s.Consents == nil {
+			// Ensure Consents is non-nil even if JSON was "null".
+			s.Consents = make(map[string][]string)
+		}
+	} else {
+		// Server code assumes this will be non-nil.
+		s.Consents = make(map[string][]string)
+	}
+
+	if u.MfaSecrets != nil {
+		if err := json.Unmarshal(*u.MfaSecrets, &s.MFASecrets); err != nil {
+			// Correctness of json structure is guaranteed on uploading
+			panic(err)
+		}
+		if s.MFASecrets == nil {
+			s.MFASecrets = make(map[string]*storage.MFASecret)
+		}
+	} else {
+		s.MFASecrets = make(map[string]*storage.MFASecret)
+	}
+
+	if wc := u.WebauthnCredentials; wc != nil {
+		if err := json.Unmarshal(*wc, &s.WebAuthnCredentials); err != nil {
+			panic(err)
+		}
+	}
+	if s.WebAuthnCredentials == nil {
+		s.WebAuthnCredentials = make(map[string][]storage.WebAuthnCredential)
+	}
+	return s
+}
+
+func toStorageAuthSession(s *db.AuthSession) storage.AuthSession {
+	result := storage.AuthSession{
+		ID:             s.ID,
+		Secret:         s.Secret,
+		UserID:         s.UserID,
+		ConnectorID:    s.ConnectorID,
+		CreatedAt:      s.CreatedAt,
+		LastActivity:   s.LastActivity,
+		IPAddress:      s.IPAddress,
+		UserAgent:      s.UserAgent,
+		AbsoluteExpiry: s.AbsoluteExpiry,
+		IdleExpiry:     s.IdleExpiry,
+	}
+
+	if s.ClientStates != nil {
+		if err := json.Unmarshal(s.ClientStates, &result.ClientStates); err != nil {
+			panic(err)
+		}
+		if result.ClientStates == nil {
+			result.ClientStates = make(map[string]*storage.ClientAuthState)
+		}
+	} else {
+		result.ClientStates = make(map[string]*storage.ClientAuthState)
+	}
+
+	if len(s.LogoutState) > 0 && string(s.LogoutState) != "null" {
+		result.LogoutState = new(storage.LogoutState)
+		if err := json.Unmarshal(s.LogoutState, result.LogoutState); err != nil {
+			panic(err)
+		}
+	}
+	return result
+}
+
 func toStorageDeviceToken(t *db.DeviceToken) storage.DeviceToken {
 	return storage.DeviceToken{
 		DeviceCode:          t.DeviceCode,
diff --git a/storage/ent/client/useridentity.go b/storage/ent/client/useridentity.go
new file mode 100644
index 0000000000..f66f90179a
--- /dev/null
+++ b/storage/ent/client/useridentity.go
@@ -0,0 +1,161 @@
+package client
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+
+	"github.com/dexidp/dex/storage"
+)
+
+// CreateUserIdentity saves provided user identity into the database.
+func (d *Database) CreateUserIdentity(ctx context.Context, identity storage.UserIdentity) error {
+	if identity.Consents == nil {
+		identity.Consents = make(map[string][]string)
+	}
+	encodedConsents, err := json.Marshal(identity.Consents)
+	if err != nil {
+		return fmt.Errorf("encode consents user identity: %w", err)
+	}
+
+	if identity.MFASecrets == nil {
+		identity.MFASecrets = make(map[string]*storage.MFASecret)
+	}
+	encodedMFASecrets, err := json.Marshal(identity.MFASecrets)
+	if err != nil {
+		return fmt.Errorf("encode mfa secrets user identity: %w", err)
+	}
+
+	encodedWebAuthnCreds, err := json.Marshal(identity.WebAuthnCredentials)
+	if err != nil {
+		return fmt.Errorf("encode webauthn credentials user identity: %w", err)
+	}
+
+	id := compositeKeyID(identity.UserID, identity.ConnectorID, d.hasher)
+	_, err = d.client.UserIdentity.Create().
+		SetID(id).
+		SetUserID(identity.UserID).
+		SetConnectorID(identity.ConnectorID).
+		SetClaimsUserID(identity.Claims.UserID).
+		SetClaimsUsername(identity.Claims.Username).
+		SetClaimsPreferredUsername(identity.Claims.PreferredUsername).
+		SetClaimsEmail(identity.Claims.Email).
+		SetClaimsEmailVerified(identity.Claims.EmailVerified).
+		SetClaimsGroups(identity.Claims.Groups).
+		SetConsents(encodedConsents).
+		SetMfaSecrets(encodedMFASecrets).
+		SetWebauthnCredentials(encodedWebAuthnCreds).
+		SetCreatedAt(identity.CreatedAt).
+		SetLastLogin(identity.LastLogin).
+		SetBlockedUntil(identity.BlockedUntil).
+		Save(ctx)
+	if err != nil {
+		return convertDBError("create user identity: %w", err)
+	}
+	return nil
+}
+
+// GetUserIdentity extracts a user identity from the database by user id and connector id.
+func (d *Database) GetUserIdentity(ctx context.Context, userID, connectorID string) (storage.UserIdentity, error) {
+	id := compositeKeyID(userID, connectorID, d.hasher)
+
+	userIdentity, err := d.client.UserIdentity.Get(ctx, id)
+	if err != nil {
+		return storage.UserIdentity{}, convertDBError("get user identity: %w", err)
+	}
+	return toStorageUserIdentity(userIdentity), nil
+}
+
+// DeleteUserIdentity deletes a user identity from the database by user id and connector id.
+func (d *Database) DeleteUserIdentity(ctx context.Context, userID, connectorID string) error {
+	id := compositeKeyID(userID, connectorID, d.hasher)
+
+	err := d.client.UserIdentity.DeleteOneID(id).Exec(ctx)
+	if err != nil {
+		return convertDBError("delete user identity: %w", err)
+	}
+	return nil
+}
+
+// UpdateUserIdentity changes a user identity by user id and connector id using an updater function.
+func (d *Database) UpdateUserIdentity(ctx context.Context, userID string, connectorID string, updater func(u storage.UserIdentity) (storage.UserIdentity, error)) error {
+	id := compositeKeyID(userID, connectorID, d.hasher)
+
+	tx, err := d.BeginTx(ctx)
+	if err != nil {
+		return convertDBError("update user identity tx: %w", err)
+	}
+
+	userIdentity, err := tx.UserIdentity.Get(ctx, id)
+	if err != nil {
+		return rollback(tx, "update user identity database: %w", err)
+	}
+
+	newUserIdentity, err := updater(toStorageUserIdentity(userIdentity))
+	if err != nil {
+		return rollback(tx, "update user identity updating: %w", err)
+	}
+
+	if newUserIdentity.Consents == nil {
+		newUserIdentity.Consents = make(map[string][]string)
+	}
+
+	encodedConsents, err := json.Marshal(newUserIdentity.Consents)
+	if err != nil {
+		return rollback(tx, "encode consents user identity: %w", err)
+	}
+
+	if newUserIdentity.MFASecrets == nil {
+		newUserIdentity.MFASecrets = make(map[string]*storage.MFASecret)
+	}
+
+	encodedMFASecrets, err := json.Marshal(newUserIdentity.MFASecrets)
+	if err != nil {
+		return rollback(tx, "encode mfa secrets user identity: %w", err)
+	}
+
+	encodedWebAuthnCreds, err := json.Marshal(newUserIdentity.WebAuthnCredentials)
+	if err != nil {
+		return rollback(tx, "encode webauthn credentials user identity: %w", err)
+	}
+
+	_, err = tx.UserIdentity.UpdateOneID(id).
+		SetUserID(newUserIdentity.UserID).
+		SetConnectorID(newUserIdentity.ConnectorID).
+		SetClaimsUserID(newUserIdentity.Claims.UserID).
+		SetClaimsUsername(newUserIdentity.Claims.Username).
+		SetClaimsPreferredUsername(newUserIdentity.Claims.PreferredUsername).
+		SetClaimsEmail(newUserIdentity.Claims.Email).
+		SetClaimsEmailVerified(newUserIdentity.Claims.EmailVerified).
+		SetClaimsGroups(newUserIdentity.Claims.Groups).
+		SetConsents(encodedConsents).
+		SetMfaSecrets(encodedMFASecrets).
+		SetWebauthnCredentials(encodedWebAuthnCreds).
+		SetCreatedAt(newUserIdentity.CreatedAt).
+		SetLastLogin(newUserIdentity.LastLogin).
+		SetBlockedUntil(newUserIdentity.BlockedUntil).
+		Save(ctx)
+	if err != nil {
+		return rollback(tx, "update user identity uploading: %w", err)
+	}
+
+	if err = tx.Commit(); err != nil {
+		return rollback(tx, "update user identity commit: %w", err)
+	}
+
+	return nil
+}
+
+// ListUserIdentities lists all user identities in the database.
+func (d *Database) ListUserIdentities(ctx context.Context) ([]storage.UserIdentity, error) {
+	userIdentities, err := d.client.UserIdentity.Query().All(ctx)
+	if err != nil {
+		return nil, convertDBError("list user identities: %w", err)
+	}
+
+	storageUserIdentities := make([]storage.UserIdentity, 0, len(userIdentities))
+	for _, u := range userIdentities {
+		storageUserIdentities = append(storageUserIdentities, toStorageUserIdentity(u))
+	}
+	return storageUserIdentities, nil
+}
diff --git a/storage/ent/client/utils.go b/storage/ent/client/utils.go
index 65c037ac3c..950e612cfa 100644
--- a/storage/ent/client/utils.go
+++ b/storage/ent/client/utils.go
@@ -32,13 +32,13 @@ func convertDBError(t string, err error) error {
 	return fmt.Errorf(t, err)
 }
 
-// compose hashed id from user and connection id to use it as primary key
+// compositeKeyID composes a hashed id from two key parts to use as primary key.
 // ent doesn't support multi-key primary yet
 // https://github.com/facebook/ent/issues/400
-func offlineSessionID(userID string, connID string, hasher func() hash.Hash) string {
+func compositeKeyID(first string, second string, hasher func() hash.Hash) string {
 	h := hasher()
 
-	h.Write([]byte(userID))
-	h.Write([]byte(connID))
+	h.Write([]byte(first))
+	h.Write([]byte(second))
 	return fmt.Sprintf("%x", h.Sum(nil))
 }
diff --git a/storage/ent/db/authcode.go b/storage/ent/db/authcode.go
index 6ddbeb57dc..b79633ff8e 100644
--- a/storage/ent/db/authcode.go
+++ b/storage/ent/db/authcode.go
@@ -8,6 +8,7 @@ import (
 	"strings"
 	"time"
 
+	"entgo.io/ent"
 	"entgo.io/ent/dialect/sql"
 	"github.com/dexidp/dex/storage/ent/db/authcode"
 )
@@ -47,23 +48,28 @@ type AuthCode struct {
 	CodeChallenge string `json:"code_challenge,omitempty"`
 	// CodeChallengeMethod holds the value of the "code_challenge_method" field.
 	CodeChallengeMethod string `json:"code_challenge_method,omitempty"`
+	// AuthTime holds the value of the "auth_time" field.
+	AuthTime time.Time `json:"auth_time,omitempty"`
+	// SessionID holds the value of the "session_id" field.
+	SessionID    string `json:"session_id,omitempty"`
+	selectValues sql.SelectValues
 }
 
 // scanValues returns the types for scanning values from sql.Rows.
-func (*AuthCode) scanValues(columns []string) ([]interface{}, error) {
-	values := make([]interface{}, len(columns))
+func (*AuthCode) scanValues(columns []string) ([]any, error) {
+	values := make([]any, len(columns))
 	for i := range columns {
 		switch columns[i] {
 		case authcode.FieldScopes, authcode.FieldClaimsGroups, authcode.FieldConnectorData:
 			values[i] = new([]byte)
 		case authcode.FieldClaimsEmailVerified:
 			values[i] = new(sql.NullBool)
-		case authcode.FieldID, authcode.FieldClientID, authcode.FieldNonce, authcode.FieldRedirectURI, authcode.FieldClaimsUserID, authcode.FieldClaimsUsername, authcode.FieldClaimsEmail, authcode.FieldClaimsPreferredUsername, authcode.FieldConnectorID, authcode.FieldCodeChallenge, authcode.FieldCodeChallengeMethod:
+		case authcode.FieldID, authcode.FieldClientID, authcode.FieldNonce, authcode.FieldRedirectURI, authcode.FieldClaimsUserID, authcode.FieldClaimsUsername, authcode.FieldClaimsEmail, authcode.FieldClaimsPreferredUsername, authcode.FieldConnectorID, authcode.FieldCodeChallenge, authcode.FieldCodeChallengeMethod, authcode.FieldSessionID:
 			values[i] = new(sql.NullString)
-		case authcode.FieldExpiry:
+		case authcode.FieldExpiry, authcode.FieldAuthTime:
 			values[i] = new(sql.NullTime)
 		default:
-			return nil, fmt.Errorf("unexpected column %q for type AuthCode", columns[i])
+			values[i] = new(sql.UnknownType)
 		}
 	}
 	return values, nil
@@ -71,7 +77,7 @@ func (*AuthCode) scanValues(columns []string) ([]interface{}, error) {
 
 // assignValues assigns the values that were returned from sql.Rows (after scanning)
 // to the AuthCode fields.
-func (ac *AuthCode) assignValues(columns []string, values []interface{}) error {
+func (_m *AuthCode) assignValues(columns []string, values []any) error {
 	if m, n := len(values), len(columns); m < n {
 		return fmt.Errorf("mismatch number of scan values: %d != %d", m, n)
 	}
@@ -81,19 +87,19 @@ func (ac *AuthCode) assignValues(columns []string, values []interface{}) error {
 			if value, ok := values[i].(*sql.NullString); !ok {
 				return fmt.Errorf("unexpected type %T for field id", values[i])
 			} else if value.Valid {
-				ac.ID = value.String
+				_m.ID = value.String
 			}
 		case authcode.FieldClientID:
 			if value, ok := values[i].(*sql.NullString); !ok {
 				return fmt.Errorf("unexpected type %T for field client_id", values[i])
 			} else if value.Valid {
-				ac.ClientID = value.String
+				_m.ClientID = value.String
 			}
 		case authcode.FieldScopes:
 			if value, ok := values[i].(*[]byte); !ok {
 				return fmt.Errorf("unexpected type %T for field scopes", values[i])
 			} else if value != nil && len(*value) > 0 {
-				if err := json.Unmarshal(*value, &ac.Scopes); err != nil {
+				if err := json.Unmarshal(*value, &_m.Scopes); err != nil {
 					return fmt.Errorf("unmarshal field scopes: %w", err)
 				}
 			}
@@ -101,43 +107,43 @@ func (ac *AuthCode) assignValues(columns []string, values []interface{}) error {
 			if value, ok := values[i].(*sql.NullString); !ok {
 				return fmt.Errorf("unexpected type %T for field nonce", values[i])
 			} else if value.Valid {
-				ac.Nonce = value.String
+				_m.Nonce = value.String
 			}
 		case authcode.FieldRedirectURI:
 			if value, ok := values[i].(*sql.NullString); !ok {
 				return fmt.Errorf("unexpected type %T for field redirect_uri", values[i])
 			} else if value.Valid {
-				ac.RedirectURI = value.String
+				_m.RedirectURI = value.String
 			}
 		case authcode.FieldClaimsUserID:
 			if value, ok := values[i].(*sql.NullString); !ok {
 				return fmt.Errorf("unexpected type %T for field claims_user_id", values[i])
 			} else if value.Valid {
-				ac.ClaimsUserID = value.String
+				_m.ClaimsUserID = value.String
 			}
 		case authcode.FieldClaimsUsername:
 			if value, ok := values[i].(*sql.NullString); !ok {
 				return fmt.Errorf("unexpected type %T for field claims_username", values[i])
 			} else if value.Valid {
-				ac.ClaimsUsername = value.String
+				_m.ClaimsUsername = value.String
 			}
 		case authcode.FieldClaimsEmail:
 			if value, ok := values[i].(*sql.NullString); !ok {
 				return fmt.Errorf("unexpected type %T for field claims_email", values[i])
 			} else if value.Valid {
-				ac.ClaimsEmail = value.String
+				_m.ClaimsEmail = value.String
 			}
 		case authcode.FieldClaimsEmailVerified:
 			if value, ok := values[i].(*sql.NullBool); !ok {
 				return fmt.Errorf("unexpected type %T for field claims_email_verified", values[i])
 			} else if value.Valid {
-				ac.ClaimsEmailVerified = value.Bool
+				_m.ClaimsEmailVerified = value.Bool
 			}
 		case authcode.FieldClaimsGroups:
 			if value, ok := values[i].(*[]byte); !ok {
 				return fmt.Errorf("unexpected type %T for field claims_groups", values[i])
 			} else if value != nil && len(*value) > 0 {
-				if err := json.Unmarshal(*value, &ac.ClaimsGroups); err != nil {
+				if err := json.Unmarshal(*value, &_m.ClaimsGroups); err != nil {
 					return fmt.Errorf("unmarshal field claims_groups: %w", err)
 				}
 			}
@@ -145,121 +151,141 @@ func (ac *AuthCode) assignValues(columns []string, values []interface{}) error {
 			if value, ok := values[i].(*sql.NullString); !ok {
 				return fmt.Errorf("unexpected type %T for field claims_preferred_username", values[i])
 			} else if value.Valid {
-				ac.ClaimsPreferredUsername = value.String
+				_m.ClaimsPreferredUsername = value.String
 			}
 		case authcode.FieldConnectorID:
 			if value, ok := values[i].(*sql.NullString); !ok {
 				return fmt.Errorf("unexpected type %T for field connector_id", values[i])
 			} else if value.Valid {
-				ac.ConnectorID = value.String
+				_m.ConnectorID = value.String
 			}
 		case authcode.FieldConnectorData:
 			if value, ok := values[i].(*[]byte); !ok {
 				return fmt.Errorf("unexpected type %T for field connector_data", values[i])
 			} else if value != nil {
-				ac.ConnectorData = value
+				_m.ConnectorData = value
 			}
 		case authcode.FieldExpiry:
 			if value, ok := values[i].(*sql.NullTime); !ok {
 				return fmt.Errorf("unexpected type %T for field expiry", values[i])
 			} else if value.Valid {
-				ac.Expiry = value.Time
+				_m.Expiry = value.Time
 			}
 		case authcode.FieldCodeChallenge:
 			if value, ok := values[i].(*sql.NullString); !ok {
 				return fmt.Errorf("unexpected type %T for field code_challenge", values[i])
 			} else if value.Valid {
-				ac.CodeChallenge = value.String
+				_m.CodeChallenge = value.String
 			}
 		case authcode.FieldCodeChallengeMethod:
 			if value, ok := values[i].(*sql.NullString); !ok {
 				return fmt.Errorf("unexpected type %T for field code_challenge_method", values[i])
 			} else if value.Valid {
-				ac.CodeChallengeMethod = value.String
+				_m.CodeChallengeMethod = value.String
+			}
+		case authcode.FieldAuthTime:
+			if value, ok := values[i].(*sql.NullTime); !ok {
+				return fmt.Errorf("unexpected type %T for field auth_time", values[i])
+			} else if value.Valid {
+				_m.AuthTime = value.Time
 			}
+		case authcode.FieldSessionID:
+			if value, ok := values[i].(*sql.NullString); !ok {
+				return fmt.Errorf("unexpected type %T for field session_id", values[i])
+			} else if value.Valid {
+				_m.SessionID = value.String
+			}
+		default:
+			_m.selectValues.Set(columns[i], values[i])
 		}
 	}
 	return nil
 }
 
+// Value returns the ent.Value that was dynamically selected and assigned to the AuthCode.
+// This includes values selected through modifiers, order, etc.
+func (_m *AuthCode) Value(name string) (ent.Value, error) {
+	return _m.selectValues.Get(name)
+}
+
 // Update returns a builder for updating this AuthCode.
 // Note that you need to call AuthCode.Unwrap() before calling this method if this AuthCode
 // was returned from a transaction, and the transaction was committed or rolled back.
-func (ac *AuthCode) Update() *AuthCodeUpdateOne {
-	return (&AuthCodeClient{config: ac.config}).UpdateOne(ac)
+func (_m *AuthCode) Update() *AuthCodeUpdateOne {
+	return NewAuthCodeClient(_m.config).UpdateOne(_m)
 }
 
 // Unwrap unwraps the AuthCode entity that was returned from a transaction after it was closed,
 // so that all future queries will be executed through the driver which created the transaction.
-func (ac *AuthCode) Unwrap() *AuthCode {
-	_tx, ok := ac.config.driver.(*txDriver)
+func (_m *AuthCode) Unwrap() *AuthCode {
+	_tx, ok := _m.config.driver.(*txDriver)
 	if !ok {
 		panic("db: AuthCode is not a transactional entity")
 	}
-	ac.config.driver = _tx.drv
-	return ac
+	_m.config.driver = _tx.drv
+	return _m
 }
 
 // String implements the fmt.Stringer.
-func (ac *AuthCode) String() string {
+func (_m *AuthCode) String() string {
 	var builder strings.Builder
 	builder.WriteString("AuthCode(")
-	builder.WriteString(fmt.Sprintf("id=%v, ", ac.ID))
+	builder.WriteString(fmt.Sprintf("id=%v, ", _m.ID))
 	builder.WriteString("client_id=")
-	builder.WriteString(ac.ClientID)
+	builder.WriteString(_m.ClientID)
 	builder.WriteString(", ")
 	builder.WriteString("scopes=")
-	builder.WriteString(fmt.Sprintf("%v", ac.Scopes))
+	builder.WriteString(fmt.Sprintf("%v", _m.Scopes))
 	builder.WriteString(", ")
 	builder.WriteString("nonce=")
-	builder.WriteString(ac.Nonce)
+	builder.WriteString(_m.Nonce)
 	builder.WriteString(", ")
 	builder.WriteString("redirect_uri=")
-	builder.WriteString(ac.RedirectURI)
+	builder.WriteString(_m.RedirectURI)
 	builder.WriteString(", ")
 	builder.WriteString("claims_user_id=")
-	builder.WriteString(ac.ClaimsUserID)
+	builder.WriteString(_m.ClaimsUserID)
 	builder.WriteString(", ")
 	builder.WriteString("claims_username=")
-	builder.WriteString(ac.ClaimsUsername)
+	builder.WriteString(_m.ClaimsUsername)
 	builder.WriteString(", ")
 	builder.WriteString("claims_email=")
-	builder.WriteString(ac.ClaimsEmail)
+	builder.WriteString(_m.ClaimsEmail)
 	builder.WriteString(", ")
 	builder.WriteString("claims_email_verified=")
-	builder.WriteString(fmt.Sprintf("%v", ac.ClaimsEmailVerified))
+	builder.WriteString(fmt.Sprintf("%v", _m.ClaimsEmailVerified))
 	builder.WriteString(", ")
 	builder.WriteString("claims_groups=")
-	builder.WriteString(fmt.Sprintf("%v", ac.ClaimsGroups))
+	builder.WriteString(fmt.Sprintf("%v", _m.ClaimsGroups))
 	builder.WriteString(", ")
 	builder.WriteString("claims_preferred_username=")
-	builder.WriteString(ac.ClaimsPreferredUsername)
+	builder.WriteString(_m.ClaimsPreferredUsername)
 	builder.WriteString(", ")
 	builder.WriteString("connector_id=")
-	builder.WriteString(ac.ConnectorID)
+	builder.WriteString(_m.ConnectorID)
 	builder.WriteString(", ")
-	if v := ac.ConnectorData; v != nil {
+	if v := _m.ConnectorData; v != nil {
 		builder.WriteString("connector_data=")
 		builder.WriteString(fmt.Sprintf("%v", *v))
 	}
 	builder.WriteString(", ")
 	builder.WriteString("expiry=")
-	builder.WriteString(ac.Expiry.Format(time.ANSIC))
+	builder.WriteString(_m.Expiry.Format(time.ANSIC))
 	builder.WriteString(", ")
 	builder.WriteString("code_challenge=")
-	builder.WriteString(ac.CodeChallenge)
+	builder.WriteString(_m.CodeChallenge)
 	builder.WriteString(", ")
 	builder.WriteString("code_challenge_method=")
-	builder.WriteString(ac.CodeChallengeMethod)
+	builder.WriteString(_m.CodeChallengeMethod)
+	builder.WriteString(", ")
+	builder.WriteString("auth_time=")
+	builder.WriteString(_m.AuthTime.Format(time.ANSIC))
+	builder.WriteString(", ")
+	builder.WriteString("session_id=")
+	builder.WriteString(_m.SessionID)
 	builder.WriteByte(')')
 	return builder.String()
 }
 
 // AuthCodes is a parsable slice of AuthCode.
 type AuthCodes []*AuthCode
-
-func (ac AuthCodes) config(cfg config) {
-	for _i := range ac {
-		ac[_i].config = cfg
-	}
-}
diff --git a/storage/ent/db/authcode/authcode.go b/storage/ent/db/authcode/authcode.go
index b78eb97027..39f2b38429 100644
--- a/storage/ent/db/authcode/authcode.go
+++ b/storage/ent/db/authcode/authcode.go
@@ -2,6 +2,10 @@
 
 package authcode
 
+import (
+	"entgo.io/ent/dialect/sql"
+)
+
 const (
 	// Label holds the string label denoting the authcode type in the database.
 	Label = "auth_code"
@@ -37,6 +41,10 @@ const (
 	FieldCodeChallenge = "code_challenge"
 	// FieldCodeChallengeMethod holds the string denoting the code_challenge_method field in the database.
 	FieldCodeChallengeMethod = "code_challenge_method"
+	// FieldAuthTime holds the string denoting the auth_time field in the database.
+	FieldAuthTime = "auth_time"
+	// FieldSessionID holds the string denoting the session_id field in the database.
+	FieldSessionID = "session_id"
 	// Table holds the table name of the authcode in the database.
 	Table = "auth_codes"
 )
@@ -59,6 +67,8 @@ var Columns = []string{
 	FieldExpiry,
 	FieldCodeChallenge,
 	FieldCodeChallengeMethod,
+	FieldAuthTime,
+	FieldSessionID,
 }
 
 // ValidColumn reports if the column name is valid (part of the table columns).
@@ -92,6 +102,86 @@ var (
 	DefaultCodeChallenge string
 	// DefaultCodeChallengeMethod holds the default value on creation for the "code_challenge_method" field.
 	DefaultCodeChallengeMethod string
+	// DefaultSessionID holds the default value on creation for the "session_id" field.
+	DefaultSessionID string
 	// IDValidator is a validator for the "id" field. It is called by the builders before save.
 	IDValidator func(string) error
 )
+
+// OrderOption defines the ordering options for the AuthCode queries.
+type OrderOption func(*sql.Selector)
+
+// ByID orders the results by the id field.
+func ByID(opts ...sql.OrderTermOption) OrderOption {
+	return sql.OrderByField(FieldID, opts...).ToFunc()
+}
+
+// ByClientID orders the results by the client_id field.
+func ByClientID(opts ...sql.OrderTermOption) OrderOption {
+	return sql.OrderByField(FieldClientID, opts...).ToFunc()
+}
+
+// ByNonce orders the results by the nonce field.
+func ByNonce(opts ...sql.OrderTermOption) OrderOption {
+	return sql.OrderByField(FieldNonce, opts...).ToFunc()
+}
+
+// ByRedirectURI orders the results by the redirect_uri field.
+func ByRedirectURI(opts ...sql.OrderTermOption) OrderOption {
+	return sql.OrderByField(FieldRedirectURI, opts...).ToFunc()
+}
+
+// ByClaimsUserID orders the results by the claims_user_id field.
+func ByClaimsUserID(opts ...sql.OrderTermOption) OrderOption {
+	return sql.OrderByField(FieldClaimsUserID, opts...).ToFunc()
+}
+
+// ByClaimsUsername orders the results by the claims_username field.
+func ByClaimsUsername(opts ...sql.OrderTermOption) OrderOption {
+	return sql.OrderByField(FieldClaimsUsername, opts...).ToFunc()
+}
+
+// ByClaimsEmail orders the results by the claims_email field.
+func ByClaimsEmail(opts ...sql.OrderTermOption) OrderOption {
+	return sql.OrderByField(FieldClaimsEmail, opts...).ToFunc()
+}
+
+// ByClaimsEmailVerified orders the results by the claims_email_verified field.
+func ByClaimsEmailVerified(opts ...sql.OrderTermOption) OrderOption {
+	return sql.OrderByField(FieldClaimsEmailVerified, opts...).ToFunc()
+}
+
+// ByClaimsPreferredUsername orders the results by the claims_preferred_username field.
+func ByClaimsPreferredUsername(opts ...sql.OrderTermOption) OrderOption {
+	return sql.OrderByField(FieldClaimsPreferredUsername, opts...).ToFunc()
+}
+
+// ByConnectorID orders the results by the connector_id field.
+func ByConnectorID(opts ...sql.OrderTermOption) OrderOption {
+	return sql.OrderByField(FieldConnectorID, opts...).ToFunc()
+}
+
+// ByExpiry orders the results by the expiry field.
+func ByExpiry(opts ...sql.OrderTermOption) OrderOption {
+	return sql.OrderByField(FieldExpiry, opts...).ToFunc()
+}
+
+// ByCodeChallenge orders the results by the code_challenge field.
+func ByCodeChallenge(opts ...sql.OrderTermOption) OrderOption {
+	return sql.OrderByField(FieldCodeChallenge, opts...).ToFunc()
+}
+
+// ByCodeChallengeMethod orders the results by the code_challenge_method field.
+func ByCodeChallengeMethod(opts ...sql.OrderTermOption) OrderOption {
+	return sql.OrderByField(FieldCodeChallengeMethod, opts...).ToFunc()
+}
+
+// ByAuthTime orders the results by the auth_time field.
+func ByAuthTime(opts ...sql.OrderTermOption) OrderOption {
+	return sql.OrderByField(FieldAuthTime, opts...).ToFunc()
+}
+
+// BySessionID orders the results by the session_id field.
+func BySessionID(opts ...sql.OrderTermOption) OrderOption {
+	return sql.OrderByField(FieldSessionID, opts...).ToFunc()
+}
diff --git a/storage/ent/db/authcode/where.go b/storage/ent/db/authcode/where.go
index be1954d7bb..8c1423ebc0 100644
--- a/storage/ent/db/authcode/where.go
+++ b/storage/ent/db/authcode/where.go
@@ -11,1368 +11,1040 @@ import (
 
 // ID filters vertices based on their ID field.
 func ID(id string) predicate.AuthCode {
-	return predicate.AuthCode(func(s *sql.Selector) {
-		s.Where(sql.EQ(s.C(FieldID), id))
-	})
+	return predicate.AuthCode(sql.FieldEQ(FieldID, id))
 }
 
 // IDEQ applies the EQ predicate on the ID field.
 func IDEQ(id string) predicate.AuthCode {
-	return predicate.AuthCode(func(s *sql.Selector) {
-		s.Where(sql.EQ(s.C(FieldID), id))
-	})
+	return predicate.AuthCode(sql.FieldEQ(FieldID, id))
 }
 
 // IDNEQ applies the NEQ predicate on the ID field.
 func IDNEQ(id string) predicate.AuthCode {
-	return predicate.AuthCode(func(s *sql.Selector) {
-		s.Where(sql.NEQ(s.C(FieldID), id))
-	})
+	return predicate.AuthCode(sql.FieldNEQ(FieldID, id))
 }
 
 // IDIn applies the In predicate on the ID field.
 func IDIn(ids ...string) predicate.AuthCode {
-	return predicate.AuthCode(func(s *sql.Selector) {
-		v := make([]interface{}, len(ids))
-		for i := range v {
-			v[i] = ids[i]
-		}
-		s.Where(sql.In(s.C(FieldID), v...))
-	})
+	return predicate.AuthCode(sql.FieldIn(FieldID, ids...))
 }
 
 // IDNotIn applies the NotIn predicate on the ID field.
 func IDNotIn(ids ...string) predicate.AuthCode {
-	return predicate.AuthCode(func(s *sql.Selector) {
-		v := make([]interface{}, len(ids))
-		for i := range v {
-			v[i] = ids[i]
-		}
-		s.Where(sql.NotIn(s.C(FieldID), v...))
-	})
+	return predicate.AuthCode(sql.FieldNotIn(FieldID, ids...))
 }
 
 // IDGT applies the GT predicate on the ID field.
 func IDGT(id string) predicate.AuthCode {
-	return predicate.AuthCode(func(s *sql.Selector) {
-		s.Where(sql.GT(s.C(FieldID), id))
-	})
+	return predicate.AuthCode(sql.FieldGT(FieldID, id))
 }
 
 // IDGTE applies the GTE predicate on the ID field.
 func IDGTE(id string) predicate.AuthCode {
-	return predicate.AuthCode(func(s *sql.Selector) {
-		s.Where(sql.GTE(s.C(FieldID), id))
-	})
+	return predicate.AuthCode(sql.FieldGTE(FieldID, id))
 }
 
 // IDLT applies the LT predicate on the ID field.
 func IDLT(id string) predicate.AuthCode {
-	return predicate.AuthCode(func(s *sql.Selector) {
-		s.Where(sql.LT(s.C(FieldID), id))
-	})
+	return predicate.AuthCode(sql.FieldLT(FieldID, id))
 }
 
 // IDLTE applies the LTE predicate on the ID field.
 func IDLTE(id string) predicate.AuthCode {
-	return predicate.AuthCode(func(s *sql.Selector) {
-		s.Where(sql.LTE(s.C(FieldID), id))
-	})
+	return predicate.AuthCode(sql.FieldLTE(FieldID, id))
+}
+
+// IDEqualFold applies the EqualFold predicate on the ID field.
+func IDEqualFold(id string) predicate.AuthCode {
+	return predicate.AuthCode(sql.FieldEqualFold(FieldID, id))
+}
+
+// IDContainsFold applies the ContainsFold predicate on the ID field.
+func IDContainsFold(id string) predicate.AuthCode {
+	return predicate.AuthCode(sql.FieldContainsFold(FieldID, id))
 }
 
 // ClientID applies equality check predicate on the "client_id" field. It's identical to ClientIDEQ.
 func ClientID(v string) predicate.AuthCode {
-	return predicate.AuthCode(func(s *sql.Selector) {
-		s.Where(sql.EQ(s.C(FieldClientID), v))
-	})
+	return predicate.AuthCode(sql.FieldEQ(FieldClientID, v))
 }
 
 // Nonce applies equality check predicate on the "nonce" field. It's identical to NonceEQ.
 func Nonce(v string) predicate.AuthCode {
-	return predicate.AuthCode(func(s *sql.Selector) {
-		s.Where(sql.EQ(s.C(FieldNonce), v))
-	})
+	return predicate.AuthCode(sql.FieldEQ(FieldNonce, v))
 }
 
 // RedirectURI applies equality check predicate on the "redirect_uri" field. It's identical to RedirectURIEQ.
 func RedirectURI(v string) predicate.AuthCode {
-	return predicate.AuthCode(func(s *sql.Selector) {
-		s.Where(sql.EQ(s.C(FieldRedirectURI), v))
-	})
+	return predicate.AuthCode(sql.FieldEQ(FieldRedirectURI, v))
 }
 
 // ClaimsUserID applies equality check predicate on the "claims_user_id" field. It's identical to ClaimsUserIDEQ.
 func ClaimsUserID(v string) predicate.AuthCode {
-	return predicate.AuthCode(func(s *sql.Selector) {
-		s.Where(sql.EQ(s.C(FieldClaimsUserID), v))
-	})
+	return predicate.AuthCode(sql.FieldEQ(FieldClaimsUserID, v))
 }
 
 // ClaimsUsername applies equality check predicate on the "claims_username" field. It's identical to ClaimsUsernameEQ.
 func ClaimsUsername(v string) predicate.AuthCode {
-	return predicate.AuthCode(func(s *sql.Selector) {
-		s.Where(sql.EQ(s.C(FieldClaimsUsername), v))
-	})
+	return predicate.AuthCode(sql.FieldEQ(FieldClaimsUsername, v))
 }
 
 // ClaimsEmail applies equality check predicate on the "claims_email" field. It's identical to ClaimsEmailEQ.
 func ClaimsEmail(v string) predicate.AuthCode {
-	return predicate.AuthCode(func(s *sql.Selector) {
-		s.Where(sql.EQ(s.C(FieldClaimsEmail), v))
-	})
+	return predicate.AuthCode(sql.FieldEQ(FieldClaimsEmail, v))
 }
 
 // ClaimsEmailVerified applies equality check predicate on the "claims_email_verified" field. It's identical to ClaimsEmailVerifiedEQ.
 func ClaimsEmailVerified(v bool) predicate.AuthCode {
-	return predicate.AuthCode(func(s *sql.Selector) {
-		s.Where(sql.EQ(s.C(FieldClaimsEmailVerified), v))
-	})
+	return predicate.AuthCode(sql.FieldEQ(FieldClaimsEmailVerified, v))
 }
 
 // ClaimsPreferredUsername applies equality check predicate on the "claims_preferred_username" field. It's identical to ClaimsPreferredUsernameEQ.
 func ClaimsPreferredUsername(v string) predicate.AuthCode {
-	return predicate.AuthCode(func(s *sql.Selector) {
-		s.Where(sql.EQ(s.C(FieldClaimsPreferredUsername), v))
-	})
+	return predicate.AuthCode(sql.FieldEQ(FieldClaimsPreferredUsername, v))
 }
 
 // ConnectorID applies equality check predicate on the "connector_id" field. It's identical to ConnectorIDEQ.
 func ConnectorID(v string) predicate.AuthCode {
-	return predicate.AuthCode(func(s *sql.Selector) {
-		s.Where(sql.EQ(s.C(FieldConnectorID), v))
-	})
+	return predicate.AuthCode(sql.FieldEQ(FieldConnectorID, v))
 }
 
 // ConnectorData applies equality check predicate on the "connector_data" field. It's identical to ConnectorDataEQ.
 func ConnectorData(v []byte) predicate.AuthCode {
-	return predicate.AuthCode(func(s *sql.Selector) {
-		s.Where(sql.EQ(s.C(FieldConnectorData), v))
-	})
+	return predicate.AuthCode(sql.FieldEQ(FieldConnectorData, v))
 }
 
 // Expiry applies equality check predicate on the "expiry" field. It's identical to ExpiryEQ.
 func Expiry(v time.Time) predicate.AuthCode {
-	return predicate.AuthCode(func(s *sql.Selector) {
-		s.Where(sql.EQ(s.C(FieldExpiry), v))
-	})
+	return predicate.AuthCode(sql.FieldEQ(FieldExpiry, v))
 }
 
 // CodeChallenge applies equality check predicate on the "code_challenge" field. It's identical to CodeChallengeEQ.
 func CodeChallenge(v string) predicate.AuthCode {
-	return predicate.AuthCode(func(s *sql.Selector) {
-		s.Where(sql.EQ(s.C(FieldCodeChallenge), v))
-	})
+	return predicate.AuthCode(sql.FieldEQ(FieldCodeChallenge, v))
 }
 
 // CodeChallengeMethod applies equality check predicate on the "code_challenge_method" field. It's identical to CodeChallengeMethodEQ.
 func CodeChallengeMethod(v string) predicate.AuthCode {
-	return predicate.AuthCode(func(s *sql.Selector) {
-		s.Where(sql.EQ(s.C(FieldCodeChallengeMethod), v))
-	})
+	return predicate.AuthCode(sql.FieldEQ(FieldCodeChallengeMethod, v))
+}
+
+// AuthTime applies equality check predicate on the "auth_time" field. It's identical to AuthTimeEQ.
+func AuthTime(v time.Time) predicate.AuthCode {
+	return predicate.AuthCode(sql.FieldEQ(FieldAuthTime, v))
+}
+
+// SessionID applies equality check predicate on the "session_id" field. It's identical to SessionIDEQ.
+func SessionID(v string) predicate.AuthCode {
+	return predicate.AuthCode(sql.FieldEQ(FieldSessionID, v))
 }
 
 // ClientIDEQ applies the EQ predicate on the "client_id" field.
 func ClientIDEQ(v string) predicate.AuthCode {
-	return predicate.AuthCode(func(s *sql.Selector) {
-		s.Where(sql.EQ(s.C(FieldClientID), v))
-	})
+	return predicate.AuthCode(sql.FieldEQ(FieldClientID, v))
 }
 
 // ClientIDNEQ applies the NEQ predicate on the "client_id" field.
 func ClientIDNEQ(v string) predicate.AuthCode {
-	return predicate.AuthCode(func(s *sql.Selector) {
-		s.Where(sql.NEQ(s.C(FieldClientID), v))
-	})
+	return predicate.AuthCode(sql.FieldNEQ(FieldClientID, v))
 }
 
 // ClientIDIn applies the In predicate on the "client_id" field.
 func ClientIDIn(vs ...string) predicate.AuthCode {
-	v := make([]interface{}, len(vs))
-	for i := range v {
-		v[i] = vs[i]
-	}
-	return predicate.AuthCode(func(s *sql.Selector) {
-		s.Where(sql.In(s.C(FieldClientID), v...))
-	})
+	return predicate.AuthCode(sql.FieldIn(FieldClientID, vs...))
 }
 
 // ClientIDNotIn applies the NotIn predicate on the "client_id" field.
 func ClientIDNotIn(vs ...string) predicate.AuthCode {
-	v := make([]interface{}, len(vs))
-	for i := range v {
-		v[i] = vs[i]
-	}
-	return predicate.AuthCode(func(s *sql.Selector) {
-		s.Where(sql.NotIn(s.C(FieldClientID), v...))
-	})
+	return predicate.AuthCode(sql.FieldNotIn(FieldClientID, vs...))
 }
 
 // ClientIDGT applies the GT predicate on the "client_id" field.
 func ClientIDGT(v string) predicate.AuthCode {
-	return predicate.AuthCode(func(s *sql.Selector) {
-		s.Where(sql.GT(s.C(FieldClientID), v))
-	})
+	return predicate.AuthCode(sql.FieldGT(FieldClientID, v))
 }
 
 // ClientIDGTE applies the GTE predicate on the "client_id" field.
 func ClientIDGTE(v string) predicate.AuthCode {
-	return predicate.AuthCode(func(s *sql.Selector) {
-		s.Where(sql.GTE(s.C(FieldClientID), v))
-	})
+	return predicate.AuthCode(sql.FieldGTE(FieldClientID, v))
 }
 
 // ClientIDLT applies the LT predicate on the "client_id" field.
 func ClientIDLT(v string) predicate.AuthCode {
-	return predicate.AuthCode(func(s *sql.Selector) {
-		s.Where(sql.LT(s.C(FieldClientID), v))
-	})
+	return predicate.AuthCode(sql.FieldLT(FieldClientID, v))
 }
 
 // ClientIDLTE applies the LTE predicate on the "client_id" field.
 func ClientIDLTE(v string) predicate.AuthCode {
-	return predicate.AuthCode(func(s *sql.Selector) {
-		s.Where(sql.LTE(s.C(FieldClientID), v))
-	})
+	return predicate.AuthCode(sql.FieldLTE(FieldClientID, v))
 }
 
 // ClientIDContains applies the Contains predicate on the "client_id" field.
 func ClientIDContains(v string) predicate.AuthCode {
-	return predicate.AuthCode(func(s *sql.Selector) {
-		s.Where(sql.Contains(s.C(FieldClientID), v))
-	})
+	return predicate.AuthCode(sql.FieldContains(FieldClientID, v))
 }
 
 // ClientIDHasPrefix applies the HasPrefix predicate on the "client_id" field.
 func ClientIDHasPrefix(v string) predicate.AuthCode {
-	return predicate.AuthCode(func(s *sql.Selector) {
-		s.Where(sql.HasPrefix(s.C(FieldClientID), v))
-	})
+	return predicate.AuthCode(sql.FieldHasPrefix(FieldClientID, v))
 }
 
 // ClientIDHasSuffix applies the HasSuffix predicate on the "client_id" field.
 func ClientIDHasSuffix(v string) predicate.AuthCode {
-	return predicate.AuthCode(func(s *sql.Selector) {
-		s.Where(sql.HasSuffix(s.C(FieldClientID), v))
-	})
+	return predicate.AuthCode(sql.FieldHasSuffix(FieldClientID, v))
 }
 
 // ClientIDEqualFold applies the EqualFold predicate on the "client_id" field.
 func ClientIDEqualFold(v string) predicate.AuthCode {
-	return predicate.AuthCode(func(s *sql.Selector) {
-		s.Where(sql.EqualFold(s.C(FieldClientID), v))
-	})
+	return predicate.AuthCode(sql.FieldEqualFold(FieldClientID, v))
 }
 
 // ClientIDContainsFold applies the ContainsFold predicate on the "client_id" field.
 func ClientIDContainsFold(v string) predicate.AuthCode {
-	return predicate.AuthCode(func(s *sql.Selector) {
-		s.Where(sql.ContainsFold(s.C(FieldClientID), v))
-	})
+	return predicate.AuthCode(sql.FieldContainsFold(FieldClientID, v))
 }
 
 // ScopesIsNil applies the IsNil predicate on the "scopes" field.
 func ScopesIsNil() predicate.AuthCode {
-	return predicate.AuthCode(func(s *sql.Selector) {
-		s.Where(sql.IsNull(s.C(FieldScopes)))
-	})
+	return predicate.AuthCode(sql.FieldIsNull(FieldScopes))
 }
 
 // ScopesNotNil applies the NotNil predicate on the "scopes" field.
 func ScopesNotNil() predicate.AuthCode {
-	return predicate.AuthCode(func(s *sql.Selector) {
-		s.Where(sql.NotNull(s.C(FieldScopes)))
-	})
+	return predicate.AuthCode(sql.FieldNotNull(FieldScopes))
 }
 
 // NonceEQ applies the EQ predicate on the "nonce" field.
 func NonceEQ(v string) predicate.AuthCode {
-	return predicate.AuthCode(func(s *sql.Selector) {
-		s.Where(sql.EQ(s.C(FieldNonce), v))
-	})
+	return predicate.AuthCode(sql.FieldEQ(FieldNonce, v))
 }
 
 // NonceNEQ applies the NEQ predicate on the "nonce" field.
 func NonceNEQ(v string) predicate.AuthCode {
-	return predicate.AuthCode(func(s *sql.Selector) {
-		s.Where(sql.NEQ(s.C(FieldNonce), v))
-	})
+	return predicate.AuthCode(sql.FieldNEQ(FieldNonce, v))
 }
 
 // NonceIn applies the In predicate on the "nonce" field.
 func NonceIn(vs ...string) predicate.AuthCode {
-	v := make([]interface{}, len(vs))
-	for i := range v {
-		v[i] = vs[i]
-	}
-	return predicate.AuthCode(func(s *sql.Selector) {
-		s.Where(sql.In(s.C(FieldNonce), v...))
-	})
+	return predicate.AuthCode(sql.FieldIn(FieldNonce, vs...))
 }
 
 // NonceNotIn applies the NotIn predicate on the "nonce" field.
 func NonceNotIn(vs ...string) predicate.AuthCode {
-	v := make([]interface{}, len(vs))
-	for i := range v {
-		v[i] = vs[i]
-	}
-	return predicate.AuthCode(func(s *sql.Selector) {
-		s.Where(sql.NotIn(s.C(FieldNonce), v...))
-	})
+	return predicate.AuthCode(sql.FieldNotIn(FieldNonce, vs...))
 }
 
 // NonceGT applies the GT predicate on the "nonce" field.
 func NonceGT(v string) predicate.AuthCode {
-	return predicate.AuthCode(func(s *sql.Selector) {
-		s.Where(sql.GT(s.C(FieldNonce), v))
-	})
+	return predicate.AuthCode(sql.FieldGT(FieldNonce, v))
 }
 
 // NonceGTE applies the GTE predicate on the "nonce" field.
 func NonceGTE(v string) predicate.AuthCode {
-	return predicate.AuthCode(func(s *sql.Selector) {
-		s.Where(sql.GTE(s.C(FieldNonce), v))
-	})
+	return predicate.AuthCode(sql.FieldGTE(FieldNonce, v))
 }
 
 // NonceLT applies the LT predicate on the "nonce" field.
 func NonceLT(v string) predicate.AuthCode {
-	return predicate.AuthCode(func(s *sql.Selector) {
-		s.Where(sql.LT(s.C(FieldNonce), v))
-	})
+	return predicate.AuthCode(sql.FieldLT(FieldNonce, v))
 }
 
 // NonceLTE applies the LTE predicate on the "nonce" field.
 func NonceLTE(v string) predicate.AuthCode {
-	return predicate.AuthCode(func(s *sql.Selector) {
-		s.Where(sql.LTE(s.C(FieldNonce), v))
-	})
+	return predicate.AuthCode(sql.FieldLTE(FieldNonce, v))
 }
 
 // NonceContains applies the Contains predicate on the "nonce" field.
 func NonceContains(v string) predicate.AuthCode {
-	return predicate.AuthCode(func(s *sql.Selector) {
-		s.Where(sql.Contains(s.C(FieldNonce), v))
-	})
+	return predicate.AuthCode(sql.FieldContains(FieldNonce, v))
 }
 
 // NonceHasPrefix applies the HasPrefix predicate on the "nonce" field.
 func NonceHasPrefix(v string) predicate.AuthCode {
-	return predicate.AuthCode(func(s *sql.Selector) {
-		s.Where(sql.HasPrefix(s.C(FieldNonce), v))
-	})
+	return predicate.AuthCode(sql.FieldHasPrefix(FieldNonce, v))
 }
 
 // NonceHasSuffix applies the HasSuffix predicate on the "nonce" field.
 func NonceHasSuffix(v string) predicate.AuthCode {
-	return predicate.AuthCode(func(s *sql.Selector) {
-		s.Where(sql.HasSuffix(s.C(FieldNonce), v))
-	})
+	return predicate.AuthCode(sql.FieldHasSuffix(FieldNonce, v))
 }
 
 // NonceEqualFold applies the EqualFold predicate on the "nonce" field.
 func NonceEqualFold(v string) predicate.AuthCode {
-	return predicate.AuthCode(func(s *sql.Selector) {
-		s.Where(sql.EqualFold(s.C(FieldNonce), v))
-	})
+	return predicate.AuthCode(sql.FieldEqualFold(FieldNonce, v))
 }
 
 // NonceContainsFold applies the ContainsFold predicate on the "nonce" field.
 func NonceContainsFold(v string) predicate.AuthCode {
-	return predicate.AuthCode(func(s *sql.Selector) {
-		s.Where(sql.ContainsFold(s.C(FieldNonce), v))
-	})
+	return predicate.AuthCode(sql.FieldContainsFold(FieldNonce, v))
 }
 
 // RedirectURIEQ applies the EQ predicate on the "redirect_uri" field.
 func RedirectURIEQ(v string) predicate.AuthCode {
-	return predicate.AuthCode(func(s *sql.Selector) {
-		s.Where(sql.EQ(s.C(FieldRedirectURI), v))
-	})
+	return predicate.AuthCode(sql.FieldEQ(FieldRedirectURI, v))
 }
 
 // RedirectURINEQ applies the NEQ predicate on the "redirect_uri" field.
 func RedirectURINEQ(v string) predicate.AuthCode {
-	return predicate.AuthCode(func(s *sql.Selector) {
-		s.Where(sql.NEQ(s.C(FieldRedirectURI), v))
-	})
+	return predicate.AuthCode(sql.FieldNEQ(FieldRedirectURI, v))
 }
 
 // RedirectURIIn applies the In predicate on the "redirect_uri" field.
 func RedirectURIIn(vs ...string) predicate.AuthCode {
-	v := make([]interface{}, len(vs))
-	for i := range v {
-		v[i] = vs[i]
-	}
-	return predicate.AuthCode(func(s *sql.Selector) {
-		s.Where(sql.In(s.C(FieldRedirectURI), v...))
-	})
+	return predicate.AuthCode(sql.FieldIn(FieldRedirectURI, vs...))
 }
 
 // RedirectURINotIn applies the NotIn predicate on the "redirect_uri" field.
 func RedirectURINotIn(vs ...string) predicate.AuthCode {
-	v := make([]interface{}, len(vs))
-	for i := range v {
-		v[i] = vs[i]
-	}
-	return predicate.AuthCode(func(s *sql.Selector) {
-		s.Where(sql.NotIn(s.C(FieldRedirectURI), v...))
-	})
+	return predicate.AuthCode(sql.FieldNotIn(FieldRedirectURI, vs...))
 }
 
 // RedirectURIGT applies the GT predicate on the "redirect_uri" field.
 func RedirectURIGT(v string) predicate.AuthCode {
-	return predicate.AuthCode(func(s *sql.Selector) {
-		s.Where(sql.GT(s.C(FieldRedirectURI), v))
-	})
+	return predicate.AuthCode(sql.FieldGT(FieldRedirectURI, v))
 }
 
 // RedirectURIGTE applies the GTE predicate on the "redirect_uri" field.
 func RedirectURIGTE(v string) predicate.AuthCode {
-	return predicate.AuthCode(func(s *sql.Selector) {
-		s.Where(sql.GTE(s.C(FieldRedirectURI), v))
-	})
+	return predicate.AuthCode(sql.FieldGTE(FieldRedirectURI, v))
 }
 
 // RedirectURILT applies the LT predicate on the "redirect_uri" field.
 func RedirectURILT(v string) predicate.AuthCode {
-	return predicate.AuthCode(func(s *sql.Selector) {
-		s.Where(sql.LT(s.C(FieldRedirectURI), v))
-	})
+	return predicate.AuthCode(sql.FieldLT(FieldRedirectURI, v))
 }
 
 // RedirectURILTE applies the LTE predicate on the "redirect_uri" field.
 func RedirectURILTE(v string) predicate.AuthCode {
-	return predicate.AuthCode(func(s *sql.Selector) {
-		s.Where(sql.LTE(s.C(FieldRedirectURI), v))
-	})
+	return predicate.AuthCode(sql.FieldLTE(FieldRedirectURI, v))
 }
 
 // RedirectURIContains applies the Contains predicate on the "redirect_uri" field.
 func RedirectURIContains(v string) predicate.AuthCode {
-	return predicate.AuthCode(func(s *sql.Selector) {
-		s.Where(sql.Contains(s.C(FieldRedirectURI), v))
-	})
+	return predicate.AuthCode(sql.FieldContains(FieldRedirectURI, v))
 }
 
 // RedirectURIHasPrefix applies the HasPrefix predicate on the "redirect_uri" field.
 func RedirectURIHasPrefix(v string) predicate.AuthCode {
-	return predicate.AuthCode(func(s *sql.Selector) {
-		s.Where(sql.HasPrefix(s.C(FieldRedirectURI), v))
-	})
+	return predicate.AuthCode(sql.FieldHasPrefix(FieldRedirectURI, v))
 }
 
 // RedirectURIHasSuffix applies the HasSuffix predicate on the "redirect_uri" field.
 func RedirectURIHasSuffix(v string) predicate.AuthCode {
-	return predicate.AuthCode(func(s *sql.Selector) {
-		s.Where(sql.HasSuffix(s.C(FieldRedirectURI), v))
-	})
+	return predicate.AuthCode(sql.FieldHasSuffix(FieldRedirectURI, v))
 }
 
 // RedirectURIEqualFold applies the EqualFold predicate on the "redirect_uri" field.
 func RedirectURIEqualFold(v string) predicate.AuthCode {
-	return predicate.AuthCode(func(s *sql.Selector) {
-		s.Where(sql.EqualFold(s.C(FieldRedirectURI), v))
-	})
+	return predicate.AuthCode(sql.FieldEqualFold(FieldRedirectURI, v))
 }
 
 // RedirectURIContainsFold applies the ContainsFold predicate on the "redirect_uri" field.
 func RedirectURIContainsFold(v string) predicate.AuthCode {
-	return predicate.AuthCode(func(s *sql.Selector) {
-		s.Where(sql.ContainsFold(s.C(FieldRedirectURI), v))
-	})
+	return predicate.AuthCode(sql.FieldContainsFold(FieldRedirectURI, v))
 }
 
 // ClaimsUserIDEQ applies the EQ predicate on the "claims_user_id" field.
 func ClaimsUserIDEQ(v string) predicate.AuthCode {
-	return predicate.AuthCode(func(s *sql.Selector) {
-		s.Where(sql.EQ(s.C(FieldClaimsUserID), v))
-	})
+	return predicate.AuthCode(sql.FieldEQ(FieldClaimsUserID, v))
 }
 
 // ClaimsUserIDNEQ applies the NEQ predicate on the "claims_user_id" field.
 func ClaimsUserIDNEQ(v string) predicate.AuthCode {
-	return predicate.AuthCode(func(s *sql.Selector) {
-		s.Where(sql.NEQ(s.C(FieldClaimsUserID), v))
-	})
+	return predicate.AuthCode(sql.FieldNEQ(FieldClaimsUserID, v))
 }
 
 // ClaimsUserIDIn applies the In predicate on the "claims_user_id" field.
 func ClaimsUserIDIn(vs ...string) predicate.AuthCode {
-	v := make([]interface{}, len(vs))
-	for i := range v {
-		v[i] = vs[i]
-	}
-	return predicate.AuthCode(func(s *sql.Selector) {
-		s.Where(sql.In(s.C(FieldClaimsUserID), v...))
-	})
+	return predicate.AuthCode(sql.FieldIn(FieldClaimsUserID, vs...))
 }
 
 // ClaimsUserIDNotIn applies the NotIn predicate on the "claims_user_id" field.
 func ClaimsUserIDNotIn(vs ...string) predicate.AuthCode {
-	v := make([]interface{}, len(vs))
-	for i := range v {
-		v[i] = vs[i]
-	}
-	return predicate.AuthCode(func(s *sql.Selector) {
-		s.Where(sql.NotIn(s.C(FieldClaimsUserID), v...))
-	})
+	return predicate.AuthCode(sql.FieldNotIn(FieldClaimsUserID, vs...))
 }
 
 // ClaimsUserIDGT applies the GT predicate on the "claims_user_id" field.
 func ClaimsUserIDGT(v string) predicate.AuthCode {
-	return predicate.AuthCode(func(s *sql.Selector) {
-		s.Where(sql.GT(s.C(FieldClaimsUserID), v))
-	})
+	return predicate.AuthCode(sql.FieldGT(FieldClaimsUserID, v))
 }
 
 // ClaimsUserIDGTE applies the GTE predicate on the "claims_user_id" field.
 func ClaimsUserIDGTE(v string) predicate.AuthCode {
-	return predicate.AuthCode(func(s *sql.Selector) {
-		s.Where(sql.GTE(s.C(FieldClaimsUserID), v))
-	})
+	return predicate.AuthCode(sql.FieldGTE(FieldClaimsUserID, v))
 }
 
 // ClaimsUserIDLT applies the LT predicate on the "claims_user_id" field.
 func ClaimsUserIDLT(v string) predicate.AuthCode {
-	return predicate.AuthCode(func(s *sql.Selector) {
-		s.Where(sql.LT(s.C(FieldClaimsUserID), v))
-	})
+	return predicate.AuthCode(sql.FieldLT(FieldClaimsUserID, v))
 }
 
 // ClaimsUserIDLTE applies the LTE predicate on the "claims_user_id" field.
 func ClaimsUserIDLTE(v string) predicate.AuthCode {
-	return predicate.AuthCode(func(s *sql.Selector) {
-		s.Where(sql.LTE(s.C(FieldClaimsUserID), v))
-	})
+	return predicate.AuthCode(sql.FieldLTE(FieldClaimsUserID, v))
 }
 
 // ClaimsUserIDContains applies the Contains predicate on the "claims_user_id" field.
 func ClaimsUserIDContains(v string) predicate.AuthCode {
-	return predicate.AuthCode(func(s *sql.Selector) {
-		s.Where(sql.Contains(s.C(FieldClaimsUserID), v))
-	})
+	return predicate.AuthCode(sql.FieldContains(FieldClaimsUserID, v))
 }
 
 // ClaimsUserIDHasPrefix applies the HasPrefix predicate on the "claims_user_id" field.
 func ClaimsUserIDHasPrefix(v string) predicate.AuthCode {
-	return predicate.AuthCode(func(s *sql.Selector) {
-		s.Where(sql.HasPrefix(s.C(FieldClaimsUserID), v))
-	})
+	return predicate.AuthCode(sql.FieldHasPrefix(FieldClaimsUserID, v))
 }
 
 // ClaimsUserIDHasSuffix applies the HasSuffix predicate on the "claims_user_id" field.
 func ClaimsUserIDHasSuffix(v string) predicate.AuthCode {
-	return predicate.AuthCode(func(s *sql.Selector) {
-		s.Where(sql.HasSuffix(s.C(FieldClaimsUserID), v))
-	})
+	return predicate.AuthCode(sql.FieldHasSuffix(FieldClaimsUserID, v))
 }
 
 // ClaimsUserIDEqualFold applies the EqualFold predicate on the "claims_user_id" field.
 func ClaimsUserIDEqualFold(v string) predicate.AuthCode {
-	return predicate.AuthCode(func(s *sql.Selector) {
-		s.Where(sql.EqualFold(s.C(FieldClaimsUserID), v))
-	})
+	return predicate.AuthCode(sql.FieldEqualFold(FieldClaimsUserID, v))
 }
 
 // ClaimsUserIDContainsFold applies the ContainsFold predicate on the "claims_user_id" field.
 func ClaimsUserIDContainsFold(v string) predicate.AuthCode {
-	return predicate.AuthCode(func(s *sql.Selector) {
-		s.Where(sql.ContainsFold(s.C(FieldClaimsUserID), v))
-	})
+	return predicate.AuthCode(sql.FieldContainsFold(FieldClaimsUserID, v))
 }
 
 // ClaimsUsernameEQ applies the EQ predicate on the "claims_username" field.
 func ClaimsUsernameEQ(v string) predicate.AuthCode {
-	return predicate.AuthCode(func(s *sql.Selector) {
-		s.Where(sql.EQ(s.C(FieldClaimsUsername), v))
-	})
+	return predicate.AuthCode(sql.FieldEQ(FieldClaimsUsername, v))
 }
 
 // ClaimsUsernameNEQ applies the NEQ predicate on the "claims_username" field.
 func ClaimsUsernameNEQ(v string) predicate.AuthCode {
-	return predicate.AuthCode(func(s *sql.Selector) {
-		s.Where(sql.NEQ(s.C(FieldClaimsUsername), v))
-	})
+	return predicate.AuthCode(sql.FieldNEQ(FieldClaimsUsername, v))
 }
 
 // ClaimsUsernameIn applies the In predicate on the "claims_username" field.
 func ClaimsUsernameIn(vs ...string) predicate.AuthCode {
-	v := make([]interface{}, len(vs))
-	for i := range v {
-		v[i] = vs[i]
-	}
-	return predicate.AuthCode(func(s *sql.Selector) {
-		s.Where(sql.In(s.C(FieldClaimsUsername), v...))
-	})
+	return predicate.AuthCode(sql.FieldIn(FieldClaimsUsername, vs...))
 }
 
 // ClaimsUsernameNotIn applies the NotIn predicate on the "claims_username" field.
 func ClaimsUsernameNotIn(vs ...string) predicate.AuthCode {
-	v := make([]interface{}, len(vs))
-	for i := range v {
-		v[i] = vs[i]
-	}
-	return predicate.AuthCode(func(s *sql.Selector) {
-		s.Where(sql.NotIn(s.C(FieldClaimsUsername), v...))
-	})
+	return predicate.AuthCode(sql.FieldNotIn(FieldClaimsUsername, vs...))
 }
 
 // ClaimsUsernameGT applies the GT predicate on the "claims_username" field.
 func ClaimsUsernameGT(v string) predicate.AuthCode {
-	return predicate.AuthCode(func(s *sql.Selector) {
-		s.Where(sql.GT(s.C(FieldClaimsUsername), v))
-	})
+	return predicate.AuthCode(sql.FieldGT(FieldClaimsUsername, v))
 }
 
 // ClaimsUsernameGTE applies the GTE predicate on the "claims_username" field.
 func ClaimsUsernameGTE(v string) predicate.AuthCode {
-	return predicate.AuthCode(func(s *sql.Selector) {
-		s.Where(sql.GTE(s.C(FieldClaimsUsername), v))
-	})
+	return predicate.AuthCode(sql.FieldGTE(FieldClaimsUsername, v))
 }
 
 // ClaimsUsernameLT applies the LT predicate on the "claims_username" field.
 func ClaimsUsernameLT(v string) predicate.AuthCode {
-	return predicate.AuthCode(func(s *sql.Selector) {
-		s.Where(sql.LT(s.C(FieldClaimsUsername), v))
-	})
+	return predicate.AuthCode(sql.FieldLT(FieldClaimsUsername, v))
 }
 
 // ClaimsUsernameLTE applies the LTE predicate on the "claims_username" field.
 func ClaimsUsernameLTE(v string) predicate.AuthCode {
-	return predicate.AuthCode(func(s *sql.Selector) {
-		s.Where(sql.LTE(s.C(FieldClaimsUsername), v))
-	})
+	return predicate.AuthCode(sql.FieldLTE(FieldClaimsUsername, v))
 }
 
 // ClaimsUsernameContains applies the Contains predicate on the "claims_username" field.
 func ClaimsUsernameContains(v string) predicate.AuthCode {
-	return predicate.AuthCode(func(s *sql.Selector) {
-		s.Where(sql.Contains(s.C(FieldClaimsUsername), v))
-	})
+	return predicate.AuthCode(sql.FieldContains(FieldClaimsUsername, v))
 }
 
 // ClaimsUsernameHasPrefix applies the HasPrefix predicate on the "claims_username" field.
 func ClaimsUsernameHasPrefix(v string) predicate.AuthCode {
-	return predicate.AuthCode(func(s *sql.Selector) {
-		s.Where(sql.HasPrefix(s.C(FieldClaimsUsername), v))
-	})
+	return predicate.AuthCode(sql.FieldHasPrefix(FieldClaimsUsername, v))
 }
 
 // ClaimsUsernameHasSuffix applies the HasSuffix predicate on the "claims_username" field.
 func ClaimsUsernameHasSuffix(v string) predicate.AuthCode {
-	return predicate.AuthCode(func(s *sql.Selector) {
-		s.Where(sql.HasSuffix(s.C(FieldClaimsUsername), v))
-	})
+	return predicate.AuthCode(sql.FieldHasSuffix(FieldClaimsUsername, v))
 }
 
 // ClaimsUsernameEqualFold applies the EqualFold predicate on the "claims_username" field.
 func ClaimsUsernameEqualFold(v string) predicate.AuthCode {
-	return predicate.AuthCode(func(s *sql.Selector) {
-		s.Where(sql.EqualFold(s.C(FieldClaimsUsername), v))
-	})
+	return predicate.AuthCode(sql.FieldEqualFold(FieldClaimsUsername, v))
 }
 
 // ClaimsUsernameContainsFold applies the ContainsFold predicate on the "claims_username" field.
 func ClaimsUsernameContainsFold(v string) predicate.AuthCode {
-	return predicate.AuthCode(func(s *sql.Selector) {
-		s.Where(sql.ContainsFold(s.C(FieldClaimsUsername), v))
-	})
+	return predicate.AuthCode(sql.FieldContainsFold(FieldClaimsUsername, v))
 }
 
 // ClaimsEmailEQ applies the EQ predicate on the "claims_email" field.
 func ClaimsEmailEQ(v string) predicate.AuthCode {
-	return predicate.AuthCode(func(s *sql.Selector) {
-		s.Where(sql.EQ(s.C(FieldClaimsEmail), v))
-	})
+	return predicate.AuthCode(sql.FieldEQ(FieldClaimsEmail, v))
 }
 
 // ClaimsEmailNEQ applies the NEQ predicate on the "claims_email" field.
 func ClaimsEmailNEQ(v string) predicate.AuthCode {
-	return predicate.AuthCode(func(s *sql.Selector) {
-		s.Where(sql.NEQ(s.C(FieldClaimsEmail), v))
-	})
+	return predicate.AuthCode(sql.FieldNEQ(FieldClaimsEmail, v))
 }
 
 // ClaimsEmailIn applies the In predicate on the "claims_email" field.
 func ClaimsEmailIn(vs ...string) predicate.AuthCode {
-	v := make([]interface{}, len(vs))
-	for i := range v {
-		v[i] = vs[i]
-	}
-	return predicate.AuthCode(func(s *sql.Selector) {
-		s.Where(sql.In(s.C(FieldClaimsEmail), v...))
-	})
+	return predicate.AuthCode(sql.FieldIn(FieldClaimsEmail, vs...))
 }
 
 // ClaimsEmailNotIn applies the NotIn predicate on the "claims_email" field.
 func ClaimsEmailNotIn(vs ...string) predicate.AuthCode {
-	v := make([]interface{}, len(vs))
-	for i := range v {
-		v[i] = vs[i]
-	}
-	return predicate.AuthCode(func(s *sql.Selector) {
-		s.Where(sql.NotIn(s.C(FieldClaimsEmail), v...))
-	})
+	return predicate.AuthCode(sql.FieldNotIn(FieldClaimsEmail, vs...))
 }
 
 // ClaimsEmailGT applies the GT predicate on the "claims_email" field.
 func ClaimsEmailGT(v string) predicate.AuthCode {
-	return predicate.AuthCode(func(s *sql.Selector) {
-		s.Where(sql.GT(s.C(FieldClaimsEmail), v))
-	})
+	return predicate.AuthCode(sql.FieldGT(FieldClaimsEmail, v))
 }
 
 // ClaimsEmailGTE applies the GTE predicate on the "claims_email" field.
 func ClaimsEmailGTE(v string) predicate.AuthCode {
-	return predicate.AuthCode(func(s *sql.Selector) {
-		s.Where(sql.GTE(s.C(FieldClaimsEmail), v))
-	})
+	return predicate.AuthCode(sql.FieldGTE(FieldClaimsEmail, v))
 }
 
 // ClaimsEmailLT applies the LT predicate on the "claims_email" field.
 func ClaimsEmailLT(v string) predicate.AuthCode {
-	return predicate.AuthCode(func(s *sql.Selector) {
-		s.Where(sql.LT(s.C(FieldClaimsEmail), v))
-	})
+	return predicate.AuthCode(sql.FieldLT(FieldClaimsEmail, v))
 }
 
 // ClaimsEmailLTE applies the LTE predicate on the "claims_email" field.
 func ClaimsEmailLTE(v string) predicate.AuthCode {
-	return predicate.AuthCode(func(s *sql.Selector) {
-		s.Where(sql.LTE(s.C(FieldClaimsEmail), v))
-	})
+	return predicate.AuthCode(sql.FieldLTE(FieldClaimsEmail, v))
 }
 
 // ClaimsEmailContains applies the Contains predicate on the "claims_email" field.
 func ClaimsEmailContains(v string) predicate.AuthCode {
-	return predicate.AuthCode(func(s *sql.Selector) {
-		s.Where(sql.Contains(s.C(FieldClaimsEmail), v))
-	})
+	return predicate.AuthCode(sql.FieldContains(FieldClaimsEmail, v))
 }
 
 // ClaimsEmailHasPrefix applies the HasPrefix predicate on the "claims_email" field.
 func ClaimsEmailHasPrefix(v string) predicate.AuthCode {
-	return predicate.AuthCode(func(s *sql.Selector) {
-		s.Where(sql.HasPrefix(s.C(FieldClaimsEmail), v))
-	})
+	return predicate.AuthCode(sql.FieldHasPrefix(FieldClaimsEmail, v))
 }
 
 // ClaimsEmailHasSuffix applies the HasSuffix predicate on the "claims_email" field.
 func ClaimsEmailHasSuffix(v string) predicate.AuthCode {
-	return predicate.AuthCode(func(s *sql.Selector) {
-		s.Where(sql.HasSuffix(s.C(FieldClaimsEmail), v))
-	})
+	return predicate.AuthCode(sql.FieldHasSuffix(FieldClaimsEmail, v))
 }
 
 // ClaimsEmailEqualFold applies the EqualFold predicate on the "claims_email" field.
 func ClaimsEmailEqualFold(v string) predicate.AuthCode {
-	return predicate.AuthCode(func(s *sql.Selector) {
-		s.Where(sql.EqualFold(s.C(FieldClaimsEmail), v))
-	})
+	return predicate.AuthCode(sql.FieldEqualFold(FieldClaimsEmail, v))
 }
 
 // ClaimsEmailContainsFold applies the ContainsFold predicate on the "claims_email" field.
 func ClaimsEmailContainsFold(v string) predicate.AuthCode {
-	return predicate.AuthCode(func(s *sql.Selector) {
-		s.Where(sql.ContainsFold(s.C(FieldClaimsEmail), v))
-	})
+	return predicate.AuthCode(sql.FieldContainsFold(FieldClaimsEmail, v))
 }
 
 // ClaimsEmailVerifiedEQ applies the EQ predicate on the "claims_email_verified" field.
 func ClaimsEmailVerifiedEQ(v bool) predicate.AuthCode {
-	return predicate.AuthCode(func(s *sql.Selector) {
-		s.Where(sql.EQ(s.C(FieldClaimsEmailVerified), v))
-	})
+	return predicate.AuthCode(sql.FieldEQ(FieldClaimsEmailVerified, v))
 }
 
 // ClaimsEmailVerifiedNEQ applies the NEQ predicate on the "claims_email_verified" field.
 func ClaimsEmailVerifiedNEQ(v bool) predicate.AuthCode {
-	return predicate.AuthCode(func(s *sql.Selector) {
-		s.Where(sql.NEQ(s.C(FieldClaimsEmailVerified), v))
-	})
+	return predicate.AuthCode(sql.FieldNEQ(FieldClaimsEmailVerified, v))
 }
 
 // ClaimsGroupsIsNil applies the IsNil predicate on the "claims_groups" field.
 func ClaimsGroupsIsNil() predicate.AuthCode {
-	return predicate.AuthCode(func(s *sql.Selector) {
-		s.Where(sql.IsNull(s.C(FieldClaimsGroups)))
-	})
+	return predicate.AuthCode(sql.FieldIsNull(FieldClaimsGroups))
 }
 
 // ClaimsGroupsNotNil applies the NotNil predicate on the "claims_groups" field.
 func ClaimsGroupsNotNil() predicate.AuthCode {
-	return predicate.AuthCode(func(s *sql.Selector) {
-		s.Where(sql.NotNull(s.C(FieldClaimsGroups)))
-	})
+	return predicate.AuthCode(sql.FieldNotNull(FieldClaimsGroups))
 }
 
 // ClaimsPreferredUsernameEQ applies the EQ predicate on the "claims_preferred_username" field.
 func ClaimsPreferredUsernameEQ(v string) predicate.AuthCode {
-	return predicate.AuthCode(func(s *sql.Selector) {
-		s.Where(sql.EQ(s.C(FieldClaimsPreferredUsername), v))
-	})
+	return predicate.AuthCode(sql.FieldEQ(FieldClaimsPreferredUsername, v))
 }
 
 // ClaimsPreferredUsernameNEQ applies the NEQ predicate on the "claims_preferred_username" field.
 func ClaimsPreferredUsernameNEQ(v string) predicate.AuthCode {
-	return predicate.AuthCode(func(s *sql.Selector) {
-		s.Where(sql.NEQ(s.C(FieldClaimsPreferredUsername), v))
-	})
+	return predicate.AuthCode(sql.FieldNEQ(FieldClaimsPreferredUsername, v))
 }
 
 // ClaimsPreferredUsernameIn applies the In predicate on the "claims_preferred_username" field.
 func ClaimsPreferredUsernameIn(vs ...string) predicate.AuthCode {
-	v := make([]interface{}, len(vs))
-	for i := range v {
-		v[i] = vs[i]
-	}
-	return predicate.AuthCode(func(s *sql.Selector) {
-		s.Where(sql.In(s.C(FieldClaimsPreferredUsername), v...))
-	})
+	return predicate.AuthCode(sql.FieldIn(FieldClaimsPreferredUsername, vs...))
 }
 
 // ClaimsPreferredUsernameNotIn applies the NotIn predicate on the "claims_preferred_username" field.
 func ClaimsPreferredUsernameNotIn(vs ...string) predicate.AuthCode {
-	v := make([]interface{}, len(vs))
-	for i := range v {
-		v[i] = vs[i]
-	}
-	return predicate.AuthCode(func(s *sql.Selector) {
-		s.Where(sql.NotIn(s.C(FieldClaimsPreferredUsername), v...))
-	})
+	return predicate.AuthCode(sql.FieldNotIn(FieldClaimsPreferredUsername, vs...))
 }
 
 // ClaimsPreferredUsernameGT applies the GT predicate on the "claims_preferred_username" field.
 func ClaimsPreferredUsernameGT(v string) predicate.AuthCode {
-	return predicate.AuthCode(func(s *sql.Selector) {
-		s.Where(sql.GT(s.C(FieldClaimsPreferredUsername), v))
-	})
+	return predicate.AuthCode(sql.FieldGT(FieldClaimsPreferredUsername, v))
 }
 
 // ClaimsPreferredUsernameGTE applies the GTE predicate on the "claims_preferred_username" field.
 func ClaimsPreferredUsernameGTE(v string) predicate.AuthCode {
-	return predicate.AuthCode(func(s *sql.Selector) {
-		s.Where(sql.GTE(s.C(FieldClaimsPreferredUsername), v))
-	})
+	return predicate.AuthCode(sql.FieldGTE(FieldClaimsPreferredUsername, v))
 }
 
 // ClaimsPreferredUsernameLT applies the LT predicate on the "claims_preferred_username" field.
 func ClaimsPreferredUsernameLT(v string) predicate.AuthCode {
-	return predicate.AuthCode(func(s *sql.Selector) {
-		s.Where(sql.LT(s.C(FieldClaimsPreferredUsername), v))
-	})
+	return predicate.AuthCode(sql.FieldLT(FieldClaimsPreferredUsername, v))
 }
 
 // ClaimsPreferredUsernameLTE applies the LTE predicate on the "claims_preferred_username" field.
 func ClaimsPreferredUsernameLTE(v string) predicate.AuthCode {
-	return predicate.AuthCode(func(s *sql.Selector) {
-		s.Where(sql.LTE(s.C(FieldClaimsPreferredUsername), v))
-	})
+	return predicate.AuthCode(sql.FieldLTE(FieldClaimsPreferredUsername, v))
 }
 
 // ClaimsPreferredUsernameContains applies the Contains predicate on the "claims_preferred_username" field.
 func ClaimsPreferredUsernameContains(v string) predicate.AuthCode {
-	return predicate.AuthCode(func(s *sql.Selector) {
-		s.Where(sql.Contains(s.C(FieldClaimsPreferredUsername), v))
-	})
+	return predicate.AuthCode(sql.FieldContains(FieldClaimsPreferredUsername, v))
 }
 
 // ClaimsPreferredUsernameHasPrefix applies the HasPrefix predicate on the "claims_preferred_username" field.
 func ClaimsPreferredUsernameHasPrefix(v string) predicate.AuthCode {
-	return predicate.AuthCode(func(s *sql.Selector) {
-		s.Where(sql.HasPrefix(s.C(FieldClaimsPreferredUsername), v))
-	})
+	return predicate.AuthCode(sql.FieldHasPrefix(FieldClaimsPreferredUsername, v))
 }
 
 // ClaimsPreferredUsernameHasSuffix applies the HasSuffix predicate on the "claims_preferred_username" field.
 func ClaimsPreferredUsernameHasSuffix(v string) predicate.AuthCode {
-	return predicate.AuthCode(func(s *sql.Selector) {
-		s.Where(sql.HasSuffix(s.C(FieldClaimsPreferredUsername), v))
-	})
+	return predicate.AuthCode(sql.FieldHasSuffix(FieldClaimsPreferredUsername, v))
 }
 
 // ClaimsPreferredUsernameEqualFold applies the EqualFold predicate on the "claims_preferred_username" field.
 func ClaimsPreferredUsernameEqualFold(v string) predicate.AuthCode {
-	return predicate.AuthCode(func(s *sql.Selector) {
-		s.Where(sql.EqualFold(s.C(FieldClaimsPreferredUsername), v))
-	})
+	return predicate.AuthCode(sql.FieldEqualFold(FieldClaimsPreferredUsername, v))
 }
 
 // ClaimsPreferredUsernameContainsFold applies the ContainsFold predicate on the "claims_preferred_username" field.
 func ClaimsPreferredUsernameContainsFold(v string) predicate.AuthCode {
-	return predicate.AuthCode(func(s *sql.Selector) {
-		s.Where(sql.ContainsFold(s.C(FieldClaimsPreferredUsername), v))
-	})
+	return predicate.AuthCode(sql.FieldContainsFold(FieldClaimsPreferredUsername, v))
 }
 
 // ConnectorIDEQ applies the EQ predicate on the "connector_id" field.
 func ConnectorIDEQ(v string) predicate.AuthCode {
-	return predicate.AuthCode(func(s *sql.Selector) {
-		s.Where(sql.EQ(s.C(FieldConnectorID), v))
-	})
+	return predicate.AuthCode(sql.FieldEQ(FieldConnectorID, v))
 }
 
 // ConnectorIDNEQ applies the NEQ predicate on the "connector_id" field.
 func ConnectorIDNEQ(v string) predicate.AuthCode {
-	return predicate.AuthCode(func(s *sql.Selector) {
-		s.Where(sql.NEQ(s.C(FieldConnectorID), v))
-	})
+	return predicate.AuthCode(sql.FieldNEQ(FieldConnectorID, v))
 }
 
 // ConnectorIDIn applies the In predicate on the "connector_id" field.
 func ConnectorIDIn(vs ...string) predicate.AuthCode {
-	v := make([]interface{}, len(vs))
-	for i := range v {
-		v[i] = vs[i]
-	}
-	return predicate.AuthCode(func(s *sql.Selector) {
-		s.Where(sql.In(s.C(FieldConnectorID), v...))
-	})
+	return predicate.AuthCode(sql.FieldIn(FieldConnectorID, vs...))
 }
 
 // ConnectorIDNotIn applies the NotIn predicate on the "connector_id" field.
 func ConnectorIDNotIn(vs ...string) predicate.AuthCode {
-	v := make([]interface{}, len(vs))
-	for i := range v {
-		v[i] = vs[i]
-	}
-	return predicate.AuthCode(func(s *sql.Selector) {
-		s.Where(sql.NotIn(s.C(FieldConnectorID), v...))
-	})
+	return predicate.AuthCode(sql.FieldNotIn(FieldConnectorID, vs...))
 }
 
 // ConnectorIDGT applies the GT predicate on the "connector_id" field.
 func ConnectorIDGT(v string) predicate.AuthCode {
-	return predicate.AuthCode(func(s *sql.Selector) {
-		s.Where(sql.GT(s.C(FieldConnectorID), v))
-	})
+	return predicate.AuthCode(sql.FieldGT(FieldConnectorID, v))
 }
 
 // ConnectorIDGTE applies the GTE predicate on the "connector_id" field.
 func ConnectorIDGTE(v string) predicate.AuthCode {
-	return predicate.AuthCode(func(s *sql.Selector) {
-		s.Where(sql.GTE(s.C(FieldConnectorID), v))
-	})
+	return predicate.AuthCode(sql.FieldGTE(FieldConnectorID, v))
 }
 
 // ConnectorIDLT applies the LT predicate on the "connector_id" field.
 func ConnectorIDLT(v string) predicate.AuthCode {
-	return predicate.AuthCode(func(s *sql.Selector) {
-		s.Where(sql.LT(s.C(FieldConnectorID), v))
-	})
+	return predicate.AuthCode(sql.FieldLT(FieldConnectorID, v))
 }
 
 // ConnectorIDLTE applies the LTE predicate on the "connector_id" field.
 func ConnectorIDLTE(v string) predicate.AuthCode {
-	return predicate.AuthCode(func(s *sql.Selector) {
-		s.Where(sql.LTE(s.C(FieldConnectorID), v))
-	})
+	return predicate.AuthCode(sql.FieldLTE(FieldConnectorID, v))
 }
 
 // ConnectorIDContains applies the Contains predicate on the "connector_id" field.
 func ConnectorIDContains(v string) predicate.AuthCode {
-	return predicate.AuthCode(func(s *sql.Selector) {
-		s.Where(sql.Contains(s.C(FieldConnectorID), v))
-	})
+	return predicate.AuthCode(sql.FieldContains(FieldConnectorID, v))
 }
 
 // ConnectorIDHasPrefix applies the HasPrefix predicate on the "connector_id" field.
 func ConnectorIDHasPrefix(v string) predicate.AuthCode {
-	return predicate.AuthCode(func(s *sql.Selector) {
-		s.Where(sql.HasPrefix(s.C(FieldConnectorID), v))
-	})
+	return predicate.AuthCode(sql.FieldHasPrefix(FieldConnectorID, v))
 }
 
 // ConnectorIDHasSuffix applies the HasSuffix predicate on the "connector_id" field.
 func ConnectorIDHasSuffix(v string) predicate.AuthCode {
-	return predicate.AuthCode(func(s *sql.Selector) {
-		s.Where(sql.HasSuffix(s.C(FieldConnectorID), v))
-	})
+	return predicate.AuthCode(sql.FieldHasSuffix(FieldConnectorID, v))
 }
 
 // ConnectorIDEqualFold applies the EqualFold predicate on the "connector_id" field.
 func ConnectorIDEqualFold(v string) predicate.AuthCode {
-	return predicate.AuthCode(func(s *sql.Selector) {
-		s.Where(sql.EqualFold(s.C(FieldConnectorID), v))
-	})
+	return predicate.AuthCode(sql.FieldEqualFold(FieldConnectorID, v))
 }
 
 // ConnectorIDContainsFold applies the ContainsFold predicate on the "connector_id" field.
 func ConnectorIDContainsFold(v string) predicate.AuthCode {
-	return predicate.AuthCode(func(s *sql.Selector) {
-		s.Where(sql.ContainsFold(s.C(FieldConnectorID), v))
-	})
+	return predicate.AuthCode(sql.FieldContainsFold(FieldConnectorID, v))
 }
 
 // ConnectorDataEQ applies the EQ predicate on the "connector_data" field.
 func ConnectorDataEQ(v []byte) predicate.AuthCode {
-	return predicate.AuthCode(func(s *sql.Selector) {
-		s.Where(sql.EQ(s.C(FieldConnectorData), v))
-	})
+	return predicate.AuthCode(sql.FieldEQ(FieldConnectorData, v))
 }
 
 // ConnectorDataNEQ applies the NEQ predicate on the "connector_data" field.
 func ConnectorDataNEQ(v []byte) predicate.AuthCode {
-	return predicate.AuthCode(func(s *sql.Selector) {
-		s.Where(sql.NEQ(s.C(FieldConnectorData), v))
-	})
+	return predicate.AuthCode(sql.FieldNEQ(FieldConnectorData, v))
 }
 
 // ConnectorDataIn applies the In predicate on the "connector_data" field.
 func ConnectorDataIn(vs ...[]byte) predicate.AuthCode {
-	v := make([]interface{}, len(vs))
-	for i := range v {
-		v[i] = vs[i]
-	}
-	return predicate.AuthCode(func(s *sql.Selector) {
-		s.Where(sql.In(s.C(FieldConnectorData), v...))
-	})
+	return predicate.AuthCode(sql.FieldIn(FieldConnectorData, vs...))
 }
 
 // ConnectorDataNotIn applies the NotIn predicate on the "connector_data" field.
 func ConnectorDataNotIn(vs ...[]byte) predicate.AuthCode {
-	v := make([]interface{}, len(vs))
-	for i := range v {
-		v[i] = vs[i]
-	}
-	return predicate.AuthCode(func(s *sql.Selector) {
-		s.Where(sql.NotIn(s.C(FieldConnectorData), v...))
-	})
+	return predicate.AuthCode(sql.FieldNotIn(FieldConnectorData, vs...))
 }
 
 // ConnectorDataGT applies the GT predicate on the "connector_data" field.
 func ConnectorDataGT(v []byte) predicate.AuthCode {
-	return predicate.AuthCode(func(s *sql.Selector) {
-		s.Where(sql.GT(s.C(FieldConnectorData), v))
-	})
+	return predicate.AuthCode(sql.FieldGT(FieldConnectorData, v))
 }
 
 // ConnectorDataGTE applies the GTE predicate on the "connector_data" field.
 func ConnectorDataGTE(v []byte) predicate.AuthCode {
-	return predicate.AuthCode(func(s *sql.Selector) {
-		s.Where(sql.GTE(s.C(FieldConnectorData), v))
-	})
+	return predicate.AuthCode(sql.FieldGTE(FieldConnectorData, v))
 }
 
 // ConnectorDataLT applies the LT predicate on the "connector_data" field.
 func ConnectorDataLT(v []byte) predicate.AuthCode {
-	return predicate.AuthCode(func(s *sql.Selector) {
-		s.Where(sql.LT(s.C(FieldConnectorData), v))
-	})
+	return predicate.AuthCode(sql.FieldLT(FieldConnectorData, v))
 }
 
 // ConnectorDataLTE applies the LTE predicate on the "connector_data" field.
 func ConnectorDataLTE(v []byte) predicate.AuthCode {
-	return predicate.AuthCode(func(s *sql.Selector) {
-		s.Where(sql.LTE(s.C(FieldConnectorData), v))
-	})
+	return predicate.AuthCode(sql.FieldLTE(FieldConnectorData, v))
 }
 
 // ConnectorDataIsNil applies the IsNil predicate on the "connector_data" field.
 func ConnectorDataIsNil() predicate.AuthCode {
-	return predicate.AuthCode(func(s *sql.Selector) {
-		s.Where(sql.IsNull(s.C(FieldConnectorData)))
-	})
+	return predicate.AuthCode(sql.FieldIsNull(FieldConnectorData))
 }
 
 // ConnectorDataNotNil applies the NotNil predicate on the "connector_data" field.
 func ConnectorDataNotNil() predicate.AuthCode {
-	return predicate.AuthCode(func(s *sql.Selector) {
-		s.Where(sql.NotNull(s.C(FieldConnectorData)))
-	})
+	return predicate.AuthCode(sql.FieldNotNull(FieldConnectorData))
 }
 
 // ExpiryEQ applies the EQ predicate on the "expiry" field.
 func ExpiryEQ(v time.Time) predicate.AuthCode {
-	return predicate.AuthCode(func(s *sql.Selector) {
-		s.Where(sql.EQ(s.C(FieldExpiry), v))
-	})
+	return predicate.AuthCode(sql.FieldEQ(FieldExpiry, v))
 }
 
 // ExpiryNEQ applies the NEQ predicate on the "expiry" field.
 func ExpiryNEQ(v time.Time) predicate.AuthCode {
-	return predicate.AuthCode(func(s *sql.Selector) {
-		s.Where(sql.NEQ(s.C(FieldExpiry), v))
-	})
+	return predicate.AuthCode(sql.FieldNEQ(FieldExpiry, v))
 }
 
 // ExpiryIn applies the In predicate on the "expiry" field.
 func ExpiryIn(vs ...time.Time) predicate.AuthCode {
-	v := make([]interface{}, len(vs))
-	for i := range v {
-		v[i] = vs[i]
-	}
-	return predicate.AuthCode(func(s *sql.Selector) {
-		s.Where(sql.In(s.C(FieldExpiry), v...))
-	})
+	return predicate.AuthCode(sql.FieldIn(FieldExpiry, vs...))
 }
 
 // ExpiryNotIn applies the NotIn predicate on the "expiry" field.
 func ExpiryNotIn(vs ...time.Time) predicate.AuthCode {
-	v := make([]interface{}, len(vs))
-	for i := range v {
-		v[i] = vs[i]
-	}
-	return predicate.AuthCode(func(s *sql.Selector) {
-		s.Where(sql.NotIn(s.C(FieldExpiry), v...))
-	})
+	return predicate.AuthCode(sql.FieldNotIn(FieldExpiry, vs...))
 }
 
 // ExpiryGT applies the GT predicate on the "expiry" field.
 func ExpiryGT(v time.Time) predicate.AuthCode {
-	return predicate.AuthCode(func(s *sql.Selector) {
-		s.Where(sql.GT(s.C(FieldExpiry), v))
-	})
+	return predicate.AuthCode(sql.FieldGT(FieldExpiry, v))
 }
 
 // ExpiryGTE applies the GTE predicate on the "expiry" field.
 func ExpiryGTE(v time.Time) predicate.AuthCode {
-	return predicate.AuthCode(func(s *sql.Selector) {
-		s.Where(sql.GTE(s.C(FieldExpiry), v))
-	})
+	return predicate.AuthCode(sql.FieldGTE(FieldExpiry, v))
 }
 
 // ExpiryLT applies the LT predicate on the "expiry" field.
 func ExpiryLT(v time.Time) predicate.AuthCode {
-	return predicate.AuthCode(func(s *sql.Selector) {
-		s.Where(sql.LT(s.C(FieldExpiry), v))
-	})
+	return predicate.AuthCode(sql.FieldLT(FieldExpiry, v))
 }
 
 // ExpiryLTE applies the LTE predicate on the "expiry" field.
 func ExpiryLTE(v time.Time) predicate.AuthCode {
-	return predicate.AuthCode(func(s *sql.Selector) {
-		s.Where(sql.LTE(s.C(FieldExpiry), v))
-	})
+	return predicate.AuthCode(sql.FieldLTE(FieldExpiry, v))
 }
 
 // CodeChallengeEQ applies the EQ predicate on the "code_challenge" field.
 func CodeChallengeEQ(v string) predicate.AuthCode {
-	return predicate.AuthCode(func(s *sql.Selector) {
-		s.Where(sql.EQ(s.C(FieldCodeChallenge), v))
-	})
+	return predicate.AuthCode(sql.FieldEQ(FieldCodeChallenge, v))
 }
 
 // CodeChallengeNEQ applies the NEQ predicate on the "code_challenge" field.
 func CodeChallengeNEQ(v string) predicate.AuthCode {
-	return predicate.AuthCode(func(s *sql.Selector) {
-		s.Where(sql.NEQ(s.C(FieldCodeChallenge), v))
-	})
+	return predicate.AuthCode(sql.FieldNEQ(FieldCodeChallenge, v))
 }
 
 // CodeChallengeIn applies the In predicate on the "code_challenge" field.
 func CodeChallengeIn(vs ...string) predicate.AuthCode {
-	v := make([]interface{}, len(vs))
-	for i := range v {
-		v[i] = vs[i]
-	}
-	return predicate.AuthCode(func(s *sql.Selector) {
-		s.Where(sql.In(s.C(FieldCodeChallenge), v...))
-	})
+	return predicate.AuthCode(sql.FieldIn(FieldCodeChallenge, vs...))
 }
 
 // CodeChallengeNotIn applies the NotIn predicate on the "code_challenge" field.
 func CodeChallengeNotIn(vs ...string) predicate.AuthCode {
-	v := make([]interface{}, len(vs))
-	for i := range v {
-		v[i] = vs[i]
-	}
-	return predicate.AuthCode(func(s *sql.Selector) {
-		s.Where(sql.NotIn(s.C(FieldCodeChallenge), v...))
-	})
+	return predicate.AuthCode(sql.FieldNotIn(FieldCodeChallenge, vs...))
 }
 
 // CodeChallengeGT applies the GT predicate on the "code_challenge" field.
 func CodeChallengeGT(v string) predicate.AuthCode {
-	return predicate.AuthCode(func(s *sql.Selector) {
-		s.Where(sql.GT(s.C(FieldCodeChallenge), v))
-	})
+	return predicate.AuthCode(sql.FieldGT(FieldCodeChallenge, v))
 }
 
 // CodeChallengeGTE applies the GTE predicate on the "code_challenge" field.
 func CodeChallengeGTE(v string) predicate.AuthCode {
-	return predicate.AuthCode(func(s *sql.Selector) {
-		s.Where(sql.GTE(s.C(FieldCodeChallenge), v))
-	})
+	return predicate.AuthCode(sql.FieldGTE(FieldCodeChallenge, v))
 }
 
 // CodeChallengeLT applies the LT predicate on the "code_challenge" field.
 func CodeChallengeLT(v string) predicate.AuthCode {
-	return predicate.AuthCode(func(s *sql.Selector) {
-		s.Where(sql.LT(s.C(FieldCodeChallenge), v))
-	})
+	return predicate.AuthCode(sql.FieldLT(FieldCodeChallenge, v))
 }
 
 // CodeChallengeLTE applies the LTE predicate on the "code_challenge" field.
 func CodeChallengeLTE(v string) predicate.AuthCode {
-	return predicate.AuthCode(func(s *sql.Selector) {
-		s.Where(sql.LTE(s.C(FieldCodeChallenge), v))
-	})
+	return predicate.AuthCode(sql.FieldLTE(FieldCodeChallenge, v))
 }
 
 // CodeChallengeContains applies the Contains predicate on the "code_challenge" field.
 func CodeChallengeContains(v string) predicate.AuthCode {
-	return predicate.AuthCode(func(s *sql.Selector) {
-		s.Where(sql.Contains(s.C(FieldCodeChallenge), v))
-	})
+	return predicate.AuthCode(sql.FieldContains(FieldCodeChallenge, v))
 }
 
 // CodeChallengeHasPrefix applies the HasPrefix predicate on the "code_challenge" field.
 func CodeChallengeHasPrefix(v string) predicate.AuthCode {
-	return predicate.AuthCode(func(s *sql.Selector) {
-		s.Where(sql.HasPrefix(s.C(FieldCodeChallenge), v))
-	})
+	return predicate.AuthCode(sql.FieldHasPrefix(FieldCodeChallenge, v))
 }
 
 // CodeChallengeHasSuffix applies the HasSuffix predicate on the "code_challenge" field.
 func CodeChallengeHasSuffix(v string) predicate.AuthCode {
-	return predicate.AuthCode(func(s *sql.Selector) {
-		s.Where(sql.HasSuffix(s.C(FieldCodeChallenge), v))
-	})
+	return predicate.AuthCode(sql.FieldHasSuffix(FieldCodeChallenge, v))
 }
 
 // CodeChallengeEqualFold applies the EqualFold predicate on the "code_challenge" field.
 func CodeChallengeEqualFold(v string) predicate.AuthCode {
-	return predicate.AuthCode(func(s *sql.Selector) {
-		s.Where(sql.EqualFold(s.C(FieldCodeChallenge), v))
-	})
+	return predicate.AuthCode(sql.FieldEqualFold(FieldCodeChallenge, v))
 }
 
 // CodeChallengeContainsFold applies the ContainsFold predicate on the "code_challenge" field.
 func CodeChallengeContainsFold(v string) predicate.AuthCode {
-	return predicate.AuthCode(func(s *sql.Selector) {
-		s.Where(sql.ContainsFold(s.C(FieldCodeChallenge), v))
-	})
+	return predicate.AuthCode(sql.FieldContainsFold(FieldCodeChallenge, v))
 }
 
 // CodeChallengeMethodEQ applies the EQ predicate on the "code_challenge_method" field.
 func CodeChallengeMethodEQ(v string) predicate.AuthCode {
-	return predicate.AuthCode(func(s *sql.Selector) {
-		s.Where(sql.EQ(s.C(FieldCodeChallengeMethod), v))
-	})
+	return predicate.AuthCode(sql.FieldEQ(FieldCodeChallengeMethod, v))
 }
 
 // CodeChallengeMethodNEQ applies the NEQ predicate on the "code_challenge_method" field.
 func CodeChallengeMethodNEQ(v string) predicate.AuthCode {
-	return predicate.AuthCode(func(s *sql.Selector) {
-		s.Where(sql.NEQ(s.C(FieldCodeChallengeMethod), v))
-	})
+	return predicate.AuthCode(sql.FieldNEQ(FieldCodeChallengeMethod, v))
 }
 
 // CodeChallengeMethodIn applies the In predicate on the "code_challenge_method" field.
 func CodeChallengeMethodIn(vs ...string) predicate.AuthCode {
-	v := make([]interface{}, len(vs))
-	for i := range v {
-		v[i] = vs[i]
-	}
-	return predicate.AuthCode(func(s *sql.Selector) {
-		s.Where(sql.In(s.C(FieldCodeChallengeMethod), v...))
-	})
+	return predicate.AuthCode(sql.FieldIn(FieldCodeChallengeMethod, vs...))
 }
 
 // CodeChallengeMethodNotIn applies the NotIn predicate on the "code_challenge_method" field.
 func CodeChallengeMethodNotIn(vs ...string) predicate.AuthCode {
-	v := make([]interface{}, len(vs))
-	for i := range v {
-		v[i] = vs[i]
-	}
-	return predicate.AuthCode(func(s *sql.Selector) {
-		s.Where(sql.NotIn(s.C(FieldCodeChallengeMethod), v...))
-	})
+	return predicate.AuthCode(sql.FieldNotIn(FieldCodeChallengeMethod, vs...))
 }
 
 // CodeChallengeMethodGT applies the GT predicate on the "code_challenge_method" field.
 func CodeChallengeMethodGT(v string) predicate.AuthCode {
-	return predicate.AuthCode(func(s *sql.Selector) {
-		s.Where(sql.GT(s.C(FieldCodeChallengeMethod), v))
-	})
+	return predicate.AuthCode(sql.FieldGT(FieldCodeChallengeMethod, v))
 }
 
 // CodeChallengeMethodGTE applies the GTE predicate on the "code_challenge_method" field.
 func CodeChallengeMethodGTE(v string) predicate.AuthCode {
-	return predicate.AuthCode(func(s *sql.Selector) {
-		s.Where(sql.GTE(s.C(FieldCodeChallengeMethod), v))
-	})
+	return predicate.AuthCode(sql.FieldGTE(FieldCodeChallengeMethod, v))
 }
 
 // CodeChallengeMethodLT applies the LT predicate on the "code_challenge_method" field.
 func CodeChallengeMethodLT(v string) predicate.AuthCode {
-	return predicate.AuthCode(func(s *sql.Selector) {
-		s.Where(sql.LT(s.C(FieldCodeChallengeMethod), v))
-	})
+	return predicate.AuthCode(sql.FieldLT(FieldCodeChallengeMethod, v))
 }
 
 // CodeChallengeMethodLTE applies the LTE predicate on the "code_challenge_method" field.
 func CodeChallengeMethodLTE(v string) predicate.AuthCode {
-	return predicate.AuthCode(func(s *sql.Selector) {
-		s.Where(sql.LTE(s.C(FieldCodeChallengeMethod), v))
-	})
+	return predicate.AuthCode(sql.FieldLTE(FieldCodeChallengeMethod, v))
 }
 
 // CodeChallengeMethodContains applies the Contains predicate on the "code_challenge_method" field.
 func CodeChallengeMethodContains(v string) predicate.AuthCode {
-	return predicate.AuthCode(func(s *sql.Selector) {
-		s.Where(sql.Contains(s.C(FieldCodeChallengeMethod), v))
-	})
+	return predicate.AuthCode(sql.FieldContains(FieldCodeChallengeMethod, v))
 }
 
 // CodeChallengeMethodHasPrefix applies the HasPrefix predicate on the "code_challenge_method" field.
 func CodeChallengeMethodHasPrefix(v string) predicate.AuthCode {
-	return predicate.AuthCode(func(s *sql.Selector) {
-		s.Where(sql.HasPrefix(s.C(FieldCodeChallengeMethod), v))
-	})
+	return predicate.AuthCode(sql.FieldHasPrefix(FieldCodeChallengeMethod, v))
 }
 
 // CodeChallengeMethodHasSuffix applies the HasSuffix predicate on the "code_challenge_method" field.
 func CodeChallengeMethodHasSuffix(v string) predicate.AuthCode {
-	return predicate.AuthCode(func(s *sql.Selector) {
-		s.Where(sql.HasSuffix(s.C(FieldCodeChallengeMethod), v))
-	})
+	return predicate.AuthCode(sql.FieldHasSuffix(FieldCodeChallengeMethod, v))
 }
 
 // CodeChallengeMethodEqualFold applies the EqualFold predicate on the "code_challenge_method" field.
 func CodeChallengeMethodEqualFold(v string) predicate.AuthCode {
-	return predicate.AuthCode(func(s *sql.Selector) {
-		s.Where(sql.EqualFold(s.C(FieldCodeChallengeMethod), v))
-	})
+	return predicate.AuthCode(sql.FieldEqualFold(FieldCodeChallengeMethod, v))
 }
 
 // CodeChallengeMethodContainsFold applies the ContainsFold predicate on the "code_challenge_method" field.
 func CodeChallengeMethodContainsFold(v string) predicate.AuthCode {
-	return predicate.AuthCode(func(s *sql.Selector) {
-		s.Where(sql.ContainsFold(s.C(FieldCodeChallengeMethod), v))
-	})
+	return predicate.AuthCode(sql.FieldContainsFold(FieldCodeChallengeMethod, v))
+}
+
+// AuthTimeEQ applies the EQ predicate on the "auth_time" field.
+func AuthTimeEQ(v time.Time) predicate.AuthCode {
+	return predicate.AuthCode(sql.FieldEQ(FieldAuthTime, v))
+}
+
+// AuthTimeNEQ applies the NEQ predicate on the "auth_time" field.
+func AuthTimeNEQ(v time.Time) predicate.AuthCode {
+	return predicate.AuthCode(sql.FieldNEQ(FieldAuthTime, v))
+}
+
+// AuthTimeIn applies the In predicate on the "auth_time" field.
+func AuthTimeIn(vs ...time.Time) predicate.AuthCode {
+	return predicate.AuthCode(sql.FieldIn(FieldAuthTime, vs...))
+}
+
+// AuthTimeNotIn applies the NotIn predicate on the "auth_time" field.
+func AuthTimeNotIn(vs ...time.Time) predicate.AuthCode {
+	return predicate.AuthCode(sql.FieldNotIn(FieldAuthTime, vs...))
+}
+
+// AuthTimeGT applies the GT predicate on the "auth_time" field.
+func AuthTimeGT(v time.Time) predicate.AuthCode {
+	return predicate.AuthCode(sql.FieldGT(FieldAuthTime, v))
+}
+
+// AuthTimeGTE applies the GTE predicate on the "auth_time" field.
+func AuthTimeGTE(v time.Time) predicate.AuthCode {
+	return predicate.AuthCode(sql.FieldGTE(FieldAuthTime, v))
+}
+
+// AuthTimeLT applies the LT predicate on the "auth_time" field.
+func AuthTimeLT(v time.Time) predicate.AuthCode {
+	return predicate.AuthCode(sql.FieldLT(FieldAuthTime, v))
+}
+
+// AuthTimeLTE applies the LTE predicate on the "auth_time" field.
+func AuthTimeLTE(v time.Time) predicate.AuthCode {
+	return predicate.AuthCode(sql.FieldLTE(FieldAuthTime, v))
+}
+
+// AuthTimeIsNil applies the IsNil predicate on the "auth_time" field.
+func AuthTimeIsNil() predicate.AuthCode {
+	return predicate.AuthCode(sql.FieldIsNull(FieldAuthTime))
+}
+
+// AuthTimeNotNil applies the NotNil predicate on the "auth_time" field.
+func AuthTimeNotNil() predicate.AuthCode {
+	return predicate.AuthCode(sql.FieldNotNull(FieldAuthTime))
+}
+
+// SessionIDEQ applies the EQ predicate on the "session_id" field.
+func SessionIDEQ(v string) predicate.AuthCode {
+	return predicate.AuthCode(sql.FieldEQ(FieldSessionID, v))
+}
+
+// SessionIDNEQ applies the NEQ predicate on the "session_id" field.
+func SessionIDNEQ(v string) predicate.AuthCode {
+	return predicate.AuthCode(sql.FieldNEQ(FieldSessionID, v))
+}
+
+// SessionIDIn applies the In predicate on the "session_id" field.
+func SessionIDIn(vs ...string) predicate.AuthCode {
+	return predicate.AuthCode(sql.FieldIn(FieldSessionID, vs...))
+}
+
+// SessionIDNotIn applies the NotIn predicate on the "session_id" field.
+func SessionIDNotIn(vs ...string) predicate.AuthCode {
+	return predicate.AuthCode(sql.FieldNotIn(FieldSessionID, vs...))
+}
+
+// SessionIDGT applies the GT predicate on the "session_id" field.
+func SessionIDGT(v string) predicate.AuthCode {
+	return predicate.AuthCode(sql.FieldGT(FieldSessionID, v))
+}
+
+// SessionIDGTE applies the GTE predicate on the "session_id" field.
+func SessionIDGTE(v string) predicate.AuthCode {
+	return predicate.AuthCode(sql.FieldGTE(FieldSessionID, v))
+}
+
+// SessionIDLT applies the LT predicate on the "session_id" field.
+func SessionIDLT(v string) predicate.AuthCode {
+	return predicate.AuthCode(sql.FieldLT(FieldSessionID, v))
+}
+
+// SessionIDLTE applies the LTE predicate on the "session_id" field.
+func SessionIDLTE(v string) predicate.AuthCode {
+	return predicate.AuthCode(sql.FieldLTE(FieldSessionID, v))
+}
+
+// SessionIDContains applies the Contains predicate on the "session_id" field.
+func SessionIDContains(v string) predicate.AuthCode {
+	return predicate.AuthCode(sql.FieldContains(FieldSessionID, v))
+}
+
+// SessionIDHasPrefix applies the HasPrefix predicate on the "session_id" field.
+func SessionIDHasPrefix(v string) predicate.AuthCode {
+	return predicate.AuthCode(sql.FieldHasPrefix(FieldSessionID, v))
+}
+
+// SessionIDHasSuffix applies the HasSuffix predicate on the "session_id" field.
+func SessionIDHasSuffix(v string) predicate.AuthCode {
+	return predicate.AuthCode(sql.FieldHasSuffix(FieldSessionID, v))
+}
+
+// SessionIDIsNil applies the IsNil predicate on the "session_id" field.
+func SessionIDIsNil() predicate.AuthCode {
+	return predicate.AuthCode(sql.FieldIsNull(FieldSessionID))
+}
+
+// SessionIDNotNil applies the NotNil predicate on the "session_id" field.
+func SessionIDNotNil() predicate.AuthCode {
+	return predicate.AuthCode(sql.FieldNotNull(FieldSessionID))
+}
+
+// SessionIDEqualFold applies the EqualFold predicate on the "session_id" field.
+func SessionIDEqualFold(v string) predicate.AuthCode {
+	return predicate.AuthCode(sql.FieldEqualFold(FieldSessionID, v))
+}
+
+// SessionIDContainsFold applies the ContainsFold predicate on the "session_id" field.
+func SessionIDContainsFold(v string) predicate.AuthCode {
+	return predicate.AuthCode(sql.FieldContainsFold(FieldSessionID, v))
 }
 
 // And groups predicates with the AND operator between them.
 func And(predicates ...predicate.AuthCode) predicate.AuthCode {
-	return predicate.AuthCode(func(s *sql.Selector) {
-		s1 := s.Clone().SetP(nil)
-		for _, p := range predicates {
-			p(s1)
-		}
-		s.Where(s1.P())
-	})
+	return predicate.AuthCode(sql.AndPredicates(predicates...))
 }
 
 // Or groups predicates with the OR operator between them.
 func Or(predicates ...predicate.AuthCode) predicate.AuthCode {
-	return predicate.AuthCode(func(s *sql.Selector) {
-		s1 := s.Clone().SetP(nil)
-		for i, p := range predicates {
-			if i > 0 {
-				s1.Or()
-			}
-			p(s1)
-		}
-		s.Where(s1.P())
-	})
+	return predicate.AuthCode(sql.OrPredicates(predicates...))
 }
 
 // Not applies the not operator on the given predicate.
 func Not(p predicate.AuthCode) predicate.AuthCode {
-	return predicate.AuthCode(func(s *sql.Selector) {
-		p(s.Not())
-	})
+	return predicate.AuthCode(sql.NotPredicates(p))
 }
diff --git a/storage/ent/db/authcode_create.go b/storage/ent/db/authcode_create.go
index c075c3d3fc..116f6bd568 100644
--- a/storage/ent/db/authcode_create.go
+++ b/storage/ent/db/authcode_create.go
@@ -21,181 +21,167 @@ type AuthCodeCreate struct {
 }
 
 // SetClientID sets the "client_id" field.
-func (acc *AuthCodeCreate) SetClientID(s string) *AuthCodeCreate {
-	acc.mutation.SetClientID(s)
-	return acc
+func (_c *AuthCodeCreate) SetClientID(v string) *AuthCodeCreate {
+	_c.mutation.SetClientID(v)
+	return _c
 }
 
 // SetScopes sets the "scopes" field.
-func (acc *AuthCodeCreate) SetScopes(s []string) *AuthCodeCreate {
-	acc.mutation.SetScopes(s)
-	return acc
+func (_c *AuthCodeCreate) SetScopes(v []string) *AuthCodeCreate {
+	_c.mutation.SetScopes(v)
+	return _c
 }
 
 // SetNonce sets the "nonce" field.
-func (acc *AuthCodeCreate) SetNonce(s string) *AuthCodeCreate {
-	acc.mutation.SetNonce(s)
-	return acc
+func (_c *AuthCodeCreate) SetNonce(v string) *AuthCodeCreate {
+	_c.mutation.SetNonce(v)
+	return _c
 }
 
 // SetRedirectURI sets the "redirect_uri" field.
-func (acc *AuthCodeCreate) SetRedirectURI(s string) *AuthCodeCreate {
-	acc.mutation.SetRedirectURI(s)
-	return acc
+func (_c *AuthCodeCreate) SetRedirectURI(v string) *AuthCodeCreate {
+	_c.mutation.SetRedirectURI(v)
+	return _c
 }
 
 // SetClaimsUserID sets the "claims_user_id" field.
-func (acc *AuthCodeCreate) SetClaimsUserID(s string) *AuthCodeCreate {
-	acc.mutation.SetClaimsUserID(s)
-	return acc
+func (_c *AuthCodeCreate) SetClaimsUserID(v string) *AuthCodeCreate {
+	_c.mutation.SetClaimsUserID(v)
+	return _c
 }
 
 // SetClaimsUsername sets the "claims_username" field.
-func (acc *AuthCodeCreate) SetClaimsUsername(s string) *AuthCodeCreate {
-	acc.mutation.SetClaimsUsername(s)
-	return acc
+func (_c *AuthCodeCreate) SetClaimsUsername(v string) *AuthCodeCreate {
+	_c.mutation.SetClaimsUsername(v)
+	return _c
 }
 
 // SetClaimsEmail sets the "claims_email" field.
-func (acc *AuthCodeCreate) SetClaimsEmail(s string) *AuthCodeCreate {
-	acc.mutation.SetClaimsEmail(s)
-	return acc
+func (_c *AuthCodeCreate) SetClaimsEmail(v string) *AuthCodeCreate {
+	_c.mutation.SetClaimsEmail(v)
+	return _c
 }
 
 // SetClaimsEmailVerified sets the "claims_email_verified" field.
-func (acc *AuthCodeCreate) SetClaimsEmailVerified(b bool) *AuthCodeCreate {
-	acc.mutation.SetClaimsEmailVerified(b)
-	return acc
+func (_c *AuthCodeCreate) SetClaimsEmailVerified(v bool) *AuthCodeCreate {
+	_c.mutation.SetClaimsEmailVerified(v)
+	return _c
 }
 
 // SetClaimsGroups sets the "claims_groups" field.
-func (acc *AuthCodeCreate) SetClaimsGroups(s []string) *AuthCodeCreate {
-	acc.mutation.SetClaimsGroups(s)
-	return acc
+func (_c *AuthCodeCreate) SetClaimsGroups(v []string) *AuthCodeCreate {
+	_c.mutation.SetClaimsGroups(v)
+	return _c
 }
 
 // SetClaimsPreferredUsername sets the "claims_preferred_username" field.
-func (acc *AuthCodeCreate) SetClaimsPreferredUsername(s string) *AuthCodeCreate {
-	acc.mutation.SetClaimsPreferredUsername(s)
-	return acc
+func (_c *AuthCodeCreate) SetClaimsPreferredUsername(v string) *AuthCodeCreate {
+	_c.mutation.SetClaimsPreferredUsername(v)
+	return _c
 }
 
 // SetNillableClaimsPreferredUsername sets the "claims_preferred_username" field if the given value is not nil.
-func (acc *AuthCodeCreate) SetNillableClaimsPreferredUsername(s *string) *AuthCodeCreate {
-	if s != nil {
-		acc.SetClaimsPreferredUsername(*s)
+func (_c *AuthCodeCreate) SetNillableClaimsPreferredUsername(v *string) *AuthCodeCreate {
+	if v != nil {
+		_c.SetClaimsPreferredUsername(*v)
 	}
-	return acc
+	return _c
 }
 
 // SetConnectorID sets the "connector_id" field.
-func (acc *AuthCodeCreate) SetConnectorID(s string) *AuthCodeCreate {
-	acc.mutation.SetConnectorID(s)
-	return acc
+func (_c *AuthCodeCreate) SetConnectorID(v string) *AuthCodeCreate {
+	_c.mutation.SetConnectorID(v)
+	return _c
 }
 
 // SetConnectorData sets the "connector_data" field.
-func (acc *AuthCodeCreate) SetConnectorData(b []byte) *AuthCodeCreate {
-	acc.mutation.SetConnectorData(b)
-	return acc
+func (_c *AuthCodeCreate) SetConnectorData(v []byte) *AuthCodeCreate {
+	_c.mutation.SetConnectorData(v)
+	return _c
 }
 
 // SetExpiry sets the "expiry" field.
-func (acc *AuthCodeCreate) SetExpiry(t time.Time) *AuthCodeCreate {
-	acc.mutation.SetExpiry(t)
-	return acc
+func (_c *AuthCodeCreate) SetExpiry(v time.Time) *AuthCodeCreate {
+	_c.mutation.SetExpiry(v)
+	return _c
 }
 
 // SetCodeChallenge sets the "code_challenge" field.
-func (acc *AuthCodeCreate) SetCodeChallenge(s string) *AuthCodeCreate {
-	acc.mutation.SetCodeChallenge(s)
-	return acc
+func (_c *AuthCodeCreate) SetCodeChallenge(v string) *AuthCodeCreate {
+	_c.mutation.SetCodeChallenge(v)
+	return _c
 }
 
 // SetNillableCodeChallenge sets the "code_challenge" field if the given value is not nil.
-func (acc *AuthCodeCreate) SetNillableCodeChallenge(s *string) *AuthCodeCreate {
-	if s != nil {
-		acc.SetCodeChallenge(*s)
+func (_c *AuthCodeCreate) SetNillableCodeChallenge(v *string) *AuthCodeCreate {
+	if v != nil {
+		_c.SetCodeChallenge(*v)
 	}
-	return acc
+	return _c
 }
 
 // SetCodeChallengeMethod sets the "code_challenge_method" field.
-func (acc *AuthCodeCreate) SetCodeChallengeMethod(s string) *AuthCodeCreate {
-	acc.mutation.SetCodeChallengeMethod(s)
-	return acc
+func (_c *AuthCodeCreate) SetCodeChallengeMethod(v string) *AuthCodeCreate {
+	_c.mutation.SetCodeChallengeMethod(v)
+	return _c
 }
 
 // SetNillableCodeChallengeMethod sets the "code_challenge_method" field if the given value is not nil.
-func (acc *AuthCodeCreate) SetNillableCodeChallengeMethod(s *string) *AuthCodeCreate {
-	if s != nil {
-		acc.SetCodeChallengeMethod(*s)
+func (_c *AuthCodeCreate) SetNillableCodeChallengeMethod(v *string) *AuthCodeCreate {
+	if v != nil {
+		_c.SetCodeChallengeMethod(*v)
 	}
-	return acc
+	return _c
+}
+
+// SetAuthTime sets the "auth_time" field.
+func (_c *AuthCodeCreate) SetAuthTime(v time.Time) *AuthCodeCreate {
+	_c.mutation.SetAuthTime(v)
+	return _c
+}
+
+// SetNillableAuthTime sets the "auth_time" field if the given value is not nil.
+func (_c *AuthCodeCreate) SetNillableAuthTime(v *time.Time) *AuthCodeCreate {
+	if v != nil {
+		_c.SetAuthTime(*v)
+	}
+	return _c
+}
+
+// SetSessionID sets the "session_id" field.
+func (_c *AuthCodeCreate) SetSessionID(v string) *AuthCodeCreate {
+	_c.mutation.SetSessionID(v)
+	return _c
+}
+
+// SetNillableSessionID sets the "session_id" field if the given value is not nil.
+func (_c *AuthCodeCreate) SetNillableSessionID(v *string) *AuthCodeCreate {
+	if v != nil {
+		_c.SetSessionID(*v)
+	}
+	return _c
 }
 
 // SetID sets the "id" field.
-func (acc *AuthCodeCreate) SetID(s string) *AuthCodeCreate {
-	acc.mutation.SetID(s)
-	return acc
+func (_c *AuthCodeCreate) SetID(v string) *AuthCodeCreate {
+	_c.mutation.SetID(v)
+	return _c
 }
 
 // Mutation returns the AuthCodeMutation object of the builder.
-func (acc *AuthCodeCreate) Mutation() *AuthCodeMutation {
-	return acc.mutation
+func (_c *AuthCodeCreate) Mutation() *AuthCodeMutation {
+	return _c.mutation
 }
 
 // Save creates the AuthCode in the database.
-func (acc *AuthCodeCreate) Save(ctx context.Context) (*AuthCode, error) {
-	var (
-		err  error
-		node *AuthCode
-	)
-	acc.defaults()
-	if len(acc.hooks) == 0 {
-		if err = acc.check(); err != nil {
-			return nil, err
-		}
-		node, err = acc.sqlSave(ctx)
-	} else {
-		var mut Mutator = MutateFunc(func(ctx context.Context, m Mutation) (Value, error) {
-			mutation, ok := m.(*AuthCodeMutation)
-			if !ok {
-				return nil, fmt.Errorf("unexpected mutation type %T", m)
-			}
-			if err = acc.check(); err != nil {
-				return nil, err
-			}
-			acc.mutation = mutation
-			if node, err = acc.sqlSave(ctx); err != nil {
-				return nil, err
-			}
-			mutation.id = &node.ID
-			mutation.done = true
-			return node, err
-		})
-		for i := len(acc.hooks) - 1; i >= 0; i-- {
-			if acc.hooks[i] == nil {
-				return nil, fmt.Errorf("db: uninitialized hook (forgotten import db/runtime?)")
-			}
-			mut = acc.hooks[i](mut)
-		}
-		v, err := mut.Mutate(ctx, acc.mutation)
-		if err != nil {
-			return nil, err
-		}
-		nv, ok := v.(*AuthCode)
-		if !ok {
-			return nil, fmt.Errorf("unexpected node type %T returned from AuthCodeMutation", v)
-		}
-		node = nv
-	}
-	return node, err
+func (_c *AuthCodeCreate) Save(ctx context.Context) (*AuthCode, error) {
+	_c.defaults()
+	return withHooks(ctx, _c.sqlSave, _c.mutation, _c.hooks)
 }
 
 // SaveX calls Save and panics if Save returns an error.
-func (acc *AuthCodeCreate) SaveX(ctx context.Context) *AuthCode {
-	v, err := acc.Save(ctx)
+func (_c *AuthCodeCreate) SaveX(ctx context.Context) *AuthCode {
+	v, err := _c.Save(ctx)
 	if err != nil {
 		panic(err)
 	}
@@ -203,108 +189,112 @@ func (acc *AuthCodeCreate) SaveX(ctx context.Context) *AuthCode {
 }
 
 // Exec executes the query.
-func (acc *AuthCodeCreate) Exec(ctx context.Context) error {
-	_, err := acc.Save(ctx)
+func (_c *AuthCodeCreate) Exec(ctx context.Context) error {
+	_, err := _c.Save(ctx)
 	return err
 }
 
 // ExecX is like Exec, but panics if an error occurs.
-func (acc *AuthCodeCreate) ExecX(ctx context.Context) {
-	if err := acc.Exec(ctx); err != nil {
+func (_c *AuthCodeCreate) ExecX(ctx context.Context) {
+	if err := _c.Exec(ctx); err != nil {
 		panic(err)
 	}
 }
 
 // defaults sets the default values of the builder before save.
-func (acc *AuthCodeCreate) defaults() {
-	if _, ok := acc.mutation.ClaimsPreferredUsername(); !ok {
+func (_c *AuthCodeCreate) defaults() {
+	if _, ok := _c.mutation.ClaimsPreferredUsername(); !ok {
 		v := authcode.DefaultClaimsPreferredUsername
-		acc.mutation.SetClaimsPreferredUsername(v)
+		_c.mutation.SetClaimsPreferredUsername(v)
 	}
-	if _, ok := acc.mutation.CodeChallenge(); !ok {
+	if _, ok := _c.mutation.CodeChallenge(); !ok {
 		v := authcode.DefaultCodeChallenge
-		acc.mutation.SetCodeChallenge(v)
+		_c.mutation.SetCodeChallenge(v)
 	}
-	if _, ok := acc.mutation.CodeChallengeMethod(); !ok {
+	if _, ok := _c.mutation.CodeChallengeMethod(); !ok {
 		v := authcode.DefaultCodeChallengeMethod
-		acc.mutation.SetCodeChallengeMethod(v)
+		_c.mutation.SetCodeChallengeMethod(v)
+	}
+	if _, ok := _c.mutation.SessionID(); !ok {
+		v := authcode.DefaultSessionID
+		_c.mutation.SetSessionID(v)
 	}
 }
 
 // check runs all checks and user-defined validators on the builder.
-func (acc *AuthCodeCreate) check() error {
-	if _, ok := acc.mutation.ClientID(); !ok {
+func (_c *AuthCodeCreate) check() error {
+	if _, ok := _c.mutation.ClientID(); !ok {
 		return &ValidationError{Name: "client_id", err: errors.New(`db: missing required field "AuthCode.client_id"`)}
 	}
-	if v, ok := acc.mutation.ClientID(); ok {
+	if v, ok := _c.mutation.ClientID(); ok {
 		if err := authcode.ClientIDValidator(v); err != nil {
 			return &ValidationError{Name: "client_id", err: fmt.Errorf(`db: validator failed for field "AuthCode.client_id": %w`, err)}
 		}
 	}
-	if _, ok := acc.mutation.Nonce(); !ok {
+	if _, ok := _c.mutation.Nonce(); !ok {
 		return &ValidationError{Name: "nonce", err: errors.New(`db: missing required field "AuthCode.nonce"`)}
 	}
-	if v, ok := acc.mutation.Nonce(); ok {
+	if v, ok := _c.mutation.Nonce(); ok {
 		if err := authcode.NonceValidator(v); err != nil {
 			return &ValidationError{Name: "nonce", err: fmt.Errorf(`db: validator failed for field "AuthCode.nonce": %w`, err)}
 		}
 	}
-	if _, ok := acc.mutation.RedirectURI(); !ok {
+	if _, ok := _c.mutation.RedirectURI(); !ok {
 		return &ValidationError{Name: "redirect_uri", err: errors.New(`db: missing required field "AuthCode.redirect_uri"`)}
 	}
-	if v, ok := acc.mutation.RedirectURI(); ok {
+	if v, ok := _c.mutation.RedirectURI(); ok {
 		if err := authcode.RedirectURIValidator(v); err != nil {
 			return &ValidationError{Name: "redirect_uri", err: fmt.Errorf(`db: validator failed for field "AuthCode.redirect_uri": %w`, err)}
 		}
 	}
-	if _, ok := acc.mutation.ClaimsUserID(); !ok {
+	if _, ok := _c.mutation.ClaimsUserID(); !ok {
 		return &ValidationError{Name: "claims_user_id", err: errors.New(`db: missing required field "AuthCode.claims_user_id"`)}
 	}
-	if v, ok := acc.mutation.ClaimsUserID(); ok {
+	if v, ok := _c.mutation.ClaimsUserID(); ok {
 		if err := authcode.ClaimsUserIDValidator(v); err != nil {
 			return &ValidationError{Name: "claims_user_id", err: fmt.Errorf(`db: validator failed for field "AuthCode.claims_user_id": %w`, err)}
 		}
 	}
-	if _, ok := acc.mutation.ClaimsUsername(); !ok {
+	if _, ok := _c.mutation.ClaimsUsername(); !ok {
 		return &ValidationError{Name: "claims_username", err: errors.New(`db: missing required field "AuthCode.claims_username"`)}
 	}
-	if v, ok := acc.mutation.ClaimsUsername(); ok {
+	if v, ok := _c.mutation.ClaimsUsername(); ok {
 		if err := authcode.ClaimsUsernameValidator(v); err != nil {
 			return &ValidationError{Name: "claims_username", err: fmt.Errorf(`db: validator failed for field "AuthCode.claims_username": %w`, err)}
 		}
 	}
-	if _, ok := acc.mutation.ClaimsEmail(); !ok {
+	if _, ok := _c.mutation.ClaimsEmail(); !ok {
 		return &ValidationError{Name: "claims_email", err: errors.New(`db: missing required field "AuthCode.claims_email"`)}
 	}
-	if v, ok := acc.mutation.ClaimsEmail(); ok {
+	if v, ok := _c.mutation.ClaimsEmail(); ok {
 		if err := authcode.ClaimsEmailValidator(v); err != nil {
 			return &ValidationError{Name: "claims_email", err: fmt.Errorf(`db: validator failed for field "AuthCode.claims_email": %w`, err)}
 		}
 	}
-	if _, ok := acc.mutation.ClaimsEmailVerified(); !ok {
+	if _, ok := _c.mutation.ClaimsEmailVerified(); !ok {
 		return &ValidationError{Name: "claims_email_verified", err: errors.New(`db: missing required field "AuthCode.claims_email_verified"`)}
 	}
-	if _, ok := acc.mutation.ClaimsPreferredUsername(); !ok {
+	if _, ok := _c.mutation.ClaimsPreferredUsername(); !ok {
 		return &ValidationError{Name: "claims_preferred_username", err: errors.New(`db: missing required field "AuthCode.claims_preferred_username"`)}
 	}
-	if _, ok := acc.mutation.ConnectorID(); !ok {
+	if _, ok := _c.mutation.ConnectorID(); !ok {
 		return &ValidationError{Name: "connector_id", err: errors.New(`db: missing required field "AuthCode.connector_id"`)}
 	}
-	if v, ok := acc.mutation.ConnectorID(); ok {
+	if v, ok := _c.mutation.ConnectorID(); ok {
 		if err := authcode.ConnectorIDValidator(v); err != nil {
 			return &ValidationError{Name: "connector_id", err: fmt.Errorf(`db: validator failed for field "AuthCode.connector_id": %w`, err)}
 		}
 	}
-	if _, ok := acc.mutation.Expiry(); !ok {
+	if _, ok := _c.mutation.Expiry(); !ok {
 		return &ValidationError{Name: "expiry", err: errors.New(`db: missing required field "AuthCode.expiry"`)}
 	}
-	if _, ok := acc.mutation.CodeChallenge(); !ok {
+	if _, ok := _c.mutation.CodeChallenge(); !ok {
 		return &ValidationError{Name: "code_challenge", err: errors.New(`db: missing required field "AuthCode.code_challenge"`)}
 	}
-	if _, ok := acc.mutation.CodeChallengeMethod(); !ok {
+	if _, ok := _c.mutation.CodeChallengeMethod(); !ok {
 		return &ValidationError{Name: "code_challenge_method", err: errors.New(`db: missing required field "AuthCode.code_challenge_method"`)}
 	}
-	if v, ok := acc.mutation.ID(); ok {
+	if v, ok := _c.mutation.ID(); ok {
 		if err := authcode.IDValidator(v); err != nil {
 			return &ValidationError{Name: "id", err: fmt.Errorf(`db: validator failed for field "AuthCode.id": %w`, err)}
 		}
@@ -312,9 +302,12 @@ func (acc *AuthCodeCreate) check() error {
 	return nil
 }
 
-func (acc *AuthCodeCreate) sqlSave(ctx context.Context) (*AuthCode, error) {
-	_node, _spec := acc.createSpec()
-	if err := sqlgraph.CreateNode(ctx, acc.driver, _spec); err != nil {
+func (_c *AuthCodeCreate) sqlSave(ctx context.Context) (*AuthCode, error) {
+	if err := _c.check(); err != nil {
+		return nil, err
+	}
+	_node, _spec := _c.createSpec()
+	if err := sqlgraph.CreateNode(ctx, _c.driver, _spec); err != nil {
 		if sqlgraph.IsConstraintError(err) {
 			err = &ConstraintError{msg: err.Error(), wrap: err}
 		}
@@ -327,161 +320,109 @@ func (acc *AuthCodeCreate) sqlSave(ctx context.Context) (*AuthCode, error) {
 			return nil, fmt.Errorf("unexpected AuthCode.ID type: %T", _spec.ID.Value)
 		}
 	}
+	_c.mutation.id = &_node.ID
+	_c.mutation.done = true
 	return _node, nil
 }
 
-func (acc *AuthCodeCreate) createSpec() (*AuthCode, *sqlgraph.CreateSpec) {
+func (_c *AuthCodeCreate) createSpec() (*AuthCode, *sqlgraph.CreateSpec) {
 	var (
-		_node = &AuthCode{config: acc.config}
-		_spec = &sqlgraph.CreateSpec{
-			Table: authcode.Table,
-			ID: &sqlgraph.FieldSpec{
-				Type:   field.TypeString,
-				Column: authcode.FieldID,
-			},
-		}
+		_node = &AuthCode{config: _c.config}
+		_spec = sqlgraph.NewCreateSpec(authcode.Table, sqlgraph.NewFieldSpec(authcode.FieldID, field.TypeString))
 	)
-	if id, ok := acc.mutation.ID(); ok {
+	if id, ok := _c.mutation.ID(); ok {
 		_node.ID = id
 		_spec.ID.Value = id
 	}
-	if value, ok := acc.mutation.ClientID(); ok {
-		_spec.Fields = append(_spec.Fields, &sqlgraph.FieldSpec{
-			Type:   field.TypeString,
-			Value:  value,
-			Column: authcode.FieldClientID,
-		})
+	if value, ok := _c.mutation.ClientID(); ok {
+		_spec.SetField(authcode.FieldClientID, field.TypeString, value)
 		_node.ClientID = value
 	}
-	if value, ok := acc.mutation.Scopes(); ok {
-		_spec.Fields = append(_spec.Fields, &sqlgraph.FieldSpec{
-			Type:   field.TypeJSON,
-			Value:  value,
-			Column: authcode.FieldScopes,
-		})
+	if value, ok := _c.mutation.Scopes(); ok {
+		_spec.SetField(authcode.FieldScopes, field.TypeJSON, value)
 		_node.Scopes = value
 	}
-	if value, ok := acc.mutation.Nonce(); ok {
-		_spec.Fields = append(_spec.Fields, &sqlgraph.FieldSpec{
-			Type:   field.TypeString,
-			Value:  value,
-			Column: authcode.FieldNonce,
-		})
+	if value, ok := _c.mutation.Nonce(); ok {
+		_spec.SetField(authcode.FieldNonce, field.TypeString, value)
 		_node.Nonce = value
 	}
-	if value, ok := acc.mutation.RedirectURI(); ok {
-		_spec.Fields = append(_spec.Fields, &sqlgraph.FieldSpec{
-			Type:   field.TypeString,
-			Value:  value,
-			Column: authcode.FieldRedirectURI,
-		})
+	if value, ok := _c.mutation.RedirectURI(); ok {
+		_spec.SetField(authcode.FieldRedirectURI, field.TypeString, value)
 		_node.RedirectURI = value
 	}
-	if value, ok := acc.mutation.ClaimsUserID(); ok {
-		_spec.Fields = append(_spec.Fields, &sqlgraph.FieldSpec{
-			Type:   field.TypeString,
-			Value:  value,
-			Column: authcode.FieldClaimsUserID,
-		})
+	if value, ok := _c.mutation.ClaimsUserID(); ok {
+		_spec.SetField(authcode.FieldClaimsUserID, field.TypeString, value)
 		_node.ClaimsUserID = value
 	}
-	if value, ok := acc.mutation.ClaimsUsername(); ok {
-		_spec.Fields = append(_spec.Fields, &sqlgraph.FieldSpec{
-			Type:   field.TypeString,
-			Value:  value,
-			Column: authcode.FieldClaimsUsername,
-		})
+	if value, ok := _c.mutation.ClaimsUsername(); ok {
+		_spec.SetField(authcode.FieldClaimsUsername, field.TypeString, value)
 		_node.ClaimsUsername = value
 	}
-	if value, ok := acc.mutation.ClaimsEmail(); ok {
-		_spec.Fields = append(_spec.Fields, &sqlgraph.FieldSpec{
-			Type:   field.TypeString,
-			Value:  value,
-			Column: authcode.FieldClaimsEmail,
-		})
+	if value, ok := _c.mutation.ClaimsEmail(); ok {
+		_spec.SetField(authcode.FieldClaimsEmail, field.TypeString, value)
 		_node.ClaimsEmail = value
 	}
-	if value, ok := acc.mutation.ClaimsEmailVerified(); ok {
-		_spec.Fields = append(_spec.Fields, &sqlgraph.FieldSpec{
-			Type:   field.TypeBool,
-			Value:  value,
-			Column: authcode.FieldClaimsEmailVerified,
-		})
+	if value, ok := _c.mutation.ClaimsEmailVerified(); ok {
+		_spec.SetField(authcode.FieldClaimsEmailVerified, field.TypeBool, value)
 		_node.ClaimsEmailVerified = value
 	}
-	if value, ok := acc.mutation.ClaimsGroups(); ok {
-		_spec.Fields = append(_spec.Fields, &sqlgraph.FieldSpec{
-			Type:   field.TypeJSON,
-			Value:  value,
-			Column: authcode.FieldClaimsGroups,
-		})
+	if value, ok := _c.mutation.ClaimsGroups(); ok {
+		_spec.SetField(authcode.FieldClaimsGroups, field.TypeJSON, value)
 		_node.ClaimsGroups = value
 	}
-	if value, ok := acc.mutation.ClaimsPreferredUsername(); ok {
-		_spec.Fields = append(_spec.Fields, &sqlgraph.FieldSpec{
-			Type:   field.TypeString,
-			Value:  value,
-			Column: authcode.FieldClaimsPreferredUsername,
-		})
+	if value, ok := _c.mutation.ClaimsPreferredUsername(); ok {
+		_spec.SetField(authcode.FieldClaimsPreferredUsername, field.TypeString, value)
 		_node.ClaimsPreferredUsername = value
 	}
-	if value, ok := acc.mutation.ConnectorID(); ok {
-		_spec.Fields = append(_spec.Fields, &sqlgraph.FieldSpec{
-			Type:   field.TypeString,
-			Value:  value,
-			Column: authcode.FieldConnectorID,
-		})
+	if value, ok := _c.mutation.ConnectorID(); ok {
+		_spec.SetField(authcode.FieldConnectorID, field.TypeString, value)
 		_node.ConnectorID = value
 	}
-	if value, ok := acc.mutation.ConnectorData(); ok {
-		_spec.Fields = append(_spec.Fields, &sqlgraph.FieldSpec{
-			Type:   field.TypeBytes,
-			Value:  value,
-			Column: authcode.FieldConnectorData,
-		})
+	if value, ok := _c.mutation.ConnectorData(); ok {
+		_spec.SetField(authcode.FieldConnectorData, field.TypeBytes, value)
 		_node.ConnectorData = &value
 	}
-	if value, ok := acc.mutation.Expiry(); ok {
-		_spec.Fields = append(_spec.Fields, &sqlgraph.FieldSpec{
-			Type:   field.TypeTime,
-			Value:  value,
-			Column: authcode.FieldExpiry,
-		})
+	if value, ok := _c.mutation.Expiry(); ok {
+		_spec.SetField(authcode.FieldExpiry, field.TypeTime, value)
 		_node.Expiry = value
 	}
-	if value, ok := acc.mutation.CodeChallenge(); ok {
-		_spec.Fields = append(_spec.Fields, &sqlgraph.FieldSpec{
-			Type:   field.TypeString,
-			Value:  value,
-			Column: authcode.FieldCodeChallenge,
-		})
+	if value, ok := _c.mutation.CodeChallenge(); ok {
+		_spec.SetField(authcode.FieldCodeChallenge, field.TypeString, value)
 		_node.CodeChallenge = value
 	}
-	if value, ok := acc.mutation.CodeChallengeMethod(); ok {
-		_spec.Fields = append(_spec.Fields, &sqlgraph.FieldSpec{
-			Type:   field.TypeString,
-			Value:  value,
-			Column: authcode.FieldCodeChallengeMethod,
-		})
+	if value, ok := _c.mutation.CodeChallengeMethod(); ok {
+		_spec.SetField(authcode.FieldCodeChallengeMethod, field.TypeString, value)
 		_node.CodeChallengeMethod = value
 	}
+	if value, ok := _c.mutation.AuthTime(); ok {
+		_spec.SetField(authcode.FieldAuthTime, field.TypeTime, value)
+		_node.AuthTime = value
+	}
+	if value, ok := _c.mutation.SessionID(); ok {
+		_spec.SetField(authcode.FieldSessionID, field.TypeString, value)
+		_node.SessionID = value
+	}
 	return _node, _spec
 }
 
 // AuthCodeCreateBulk is the builder for creating many AuthCode entities in bulk.
 type AuthCodeCreateBulk struct {
 	config
+	err      error
 	builders []*AuthCodeCreate
 }
 
 // Save creates the AuthCode entities in the database.
-func (accb *AuthCodeCreateBulk) Save(ctx context.Context) ([]*AuthCode, error) {
-	specs := make([]*sqlgraph.CreateSpec, len(accb.builders))
-	nodes := make([]*AuthCode, len(accb.builders))
-	mutators := make([]Mutator, len(accb.builders))
-	for i := range accb.builders {
+func (_c *AuthCodeCreateBulk) Save(ctx context.Context) ([]*AuthCode, error) {
+	if _c.err != nil {
+		return nil, _c.err
+	}
+	specs := make([]*sqlgraph.CreateSpec, len(_c.builders))
+	nodes := make([]*AuthCode, len(_c.builders))
+	mutators := make([]Mutator, len(_c.builders))
+	for i := range _c.builders {
 		func(i int, root context.Context) {
-			builder := accb.builders[i]
+			builder := _c.builders[i]
 			builder.defaults()
 			var mut Mutator = MutateFunc(func(ctx context.Context, m Mutation) (Value, error) {
 				mutation, ok := m.(*AuthCodeMutation)
@@ -492,14 +433,14 @@ func (accb *AuthCodeCreateBulk) Save(ctx context.Context) ([]*AuthCode, error) {
 					return nil, err
 				}
 				builder.mutation = mutation
-				nodes[i], specs[i] = builder.createSpec()
 				var err error
+				nodes[i], specs[i] = builder.createSpec()
 				if i < len(mutators)-1 {
-					_, err = mutators[i+1].Mutate(root, accb.builders[i+1].mutation)
+					_, err = mutators[i+1].Mutate(root, _c.builders[i+1].mutation)
 				} else {
 					spec := &sqlgraph.BatchCreateSpec{Nodes: specs}
 					// Invoke the actual operation on the latest mutation in the chain.
-					if err = sqlgraph.BatchCreate(ctx, accb.driver, spec); err != nil {
+					if err = sqlgraph.BatchCreate(ctx, _c.driver, spec); err != nil {
 						if sqlgraph.IsConstraintError(err) {
 							err = &ConstraintError{msg: err.Error(), wrap: err}
 						}
@@ -519,7 +460,7 @@ func (accb *AuthCodeCreateBulk) Save(ctx context.Context) ([]*AuthCode, error) {
 		}(i, ctx)
 	}
 	if len(mutators) > 0 {
-		if _, err := mutators[0].Mutate(ctx, accb.builders[0].mutation); err != nil {
+		if _, err := mutators[0].Mutate(ctx, _c.builders[0].mutation); err != nil {
 			return nil, err
 		}
 	}
@@ -527,8 +468,8 @@ func (accb *AuthCodeCreateBulk) Save(ctx context.Context) ([]*AuthCode, error) {
 }
 
 // SaveX is like Save, but panics if an error occurs.
-func (accb *AuthCodeCreateBulk) SaveX(ctx context.Context) []*AuthCode {
-	v, err := accb.Save(ctx)
+func (_c *AuthCodeCreateBulk) SaveX(ctx context.Context) []*AuthCode {
+	v, err := _c.Save(ctx)
 	if err != nil {
 		panic(err)
 	}
@@ -536,14 +477,14 @@ func (accb *AuthCodeCreateBulk) SaveX(ctx context.Context) []*AuthCode {
 }
 
 // Exec executes the query.
-func (accb *AuthCodeCreateBulk) Exec(ctx context.Context) error {
-	_, err := accb.Save(ctx)
+func (_c *AuthCodeCreateBulk) Exec(ctx context.Context) error {
+	_, err := _c.Save(ctx)
 	return err
 }
 
 // ExecX is like Exec, but panics if an error occurs.
-func (accb *AuthCodeCreateBulk) ExecX(ctx context.Context) {
-	if err := accb.Exec(ctx); err != nil {
+func (_c *AuthCodeCreateBulk) ExecX(ctx context.Context) {
+	if err := _c.Exec(ctx); err != nil {
 		panic(err)
 	}
 }
diff --git a/storage/ent/db/authcode_delete.go b/storage/ent/db/authcode_delete.go
index 3471394ad2..8ef0a122fb 100644
--- a/storage/ent/db/authcode_delete.go
+++ b/storage/ent/db/authcode_delete.go
@@ -4,7 +4,6 @@ package db
 
 import (
 	"context"
-	"fmt"
 
 	"entgo.io/ent/dialect/sql"
 	"entgo.io/ent/dialect/sql/sqlgraph"
@@ -21,84 +20,56 @@ type AuthCodeDelete struct {
 }
 
 // Where appends a list predicates to the AuthCodeDelete builder.
-func (acd *AuthCodeDelete) Where(ps ...predicate.AuthCode) *AuthCodeDelete {
-	acd.mutation.Where(ps...)
-	return acd
+func (_d *AuthCodeDelete) Where(ps ...predicate.AuthCode) *AuthCodeDelete {
+	_d.mutation.Where(ps...)
+	return _d
 }
 
 // Exec executes the deletion query and returns how many vertices were deleted.
-func (acd *AuthCodeDelete) Exec(ctx context.Context) (int, error) {
-	var (
-		err      error
-		affected int
-	)
-	if len(acd.hooks) == 0 {
-		affected, err = acd.sqlExec(ctx)
-	} else {
-		var mut Mutator = MutateFunc(func(ctx context.Context, m Mutation) (Value, error) {
-			mutation, ok := m.(*AuthCodeMutation)
-			if !ok {
-				return nil, fmt.Errorf("unexpected mutation type %T", m)
-			}
-			acd.mutation = mutation
-			affected, err = acd.sqlExec(ctx)
-			mutation.done = true
-			return affected, err
-		})
-		for i := len(acd.hooks) - 1; i >= 0; i-- {
-			if acd.hooks[i] == nil {
-				return 0, fmt.Errorf("db: uninitialized hook (forgotten import db/runtime?)")
-			}
-			mut = acd.hooks[i](mut)
-		}
-		if _, err := mut.Mutate(ctx, acd.mutation); err != nil {
-			return 0, err
-		}
-	}
-	return affected, err
+func (_d *AuthCodeDelete) Exec(ctx context.Context) (int, error) {
+	return withHooks(ctx, _d.sqlExec, _d.mutation, _d.hooks)
 }
 
 // ExecX is like Exec, but panics if an error occurs.
-func (acd *AuthCodeDelete) ExecX(ctx context.Context) int {
-	n, err := acd.Exec(ctx)
+func (_d *AuthCodeDelete) ExecX(ctx context.Context) int {
+	n, err := _d.Exec(ctx)
 	if err != nil {
 		panic(err)
 	}
 	return n
 }
 
-func (acd *AuthCodeDelete) sqlExec(ctx context.Context) (int, error) {
-	_spec := &sqlgraph.DeleteSpec{
-		Node: &sqlgraph.NodeSpec{
-			Table: authcode.Table,
-			ID: &sqlgraph.FieldSpec{
-				Type:   field.TypeString,
-				Column: authcode.FieldID,
-			},
-		},
-	}
-	if ps := acd.mutation.predicates; len(ps) > 0 {
+func (_d *AuthCodeDelete) sqlExec(ctx context.Context) (int, error) {
+	_spec := sqlgraph.NewDeleteSpec(authcode.Table, sqlgraph.NewFieldSpec(authcode.FieldID, field.TypeString))
+	if ps := _d.mutation.predicates; len(ps) > 0 {
 		_spec.Predicate = func(selector *sql.Selector) {
 			for i := range ps {
 				ps[i](selector)
 			}
 		}
 	}
-	affected, err := sqlgraph.DeleteNodes(ctx, acd.driver, _spec)
+	affected, err := sqlgraph.DeleteNodes(ctx, _d.driver, _spec)
 	if err != nil && sqlgraph.IsConstraintError(err) {
 		err = &ConstraintError{msg: err.Error(), wrap: err}
 	}
+	_d.mutation.done = true
 	return affected, err
 }
 
 // AuthCodeDeleteOne is the builder for deleting a single AuthCode entity.
 type AuthCodeDeleteOne struct {
-	acd *AuthCodeDelete
+	_d *AuthCodeDelete
+}
+
+// Where appends a list predicates to the AuthCodeDelete builder.
+func (_d *AuthCodeDeleteOne) Where(ps ...predicate.AuthCode) *AuthCodeDeleteOne {
+	_d._d.mutation.Where(ps...)
+	return _d
 }
 
 // Exec executes the deletion query.
-func (acdo *AuthCodeDeleteOne) Exec(ctx context.Context) error {
-	n, err := acdo.acd.Exec(ctx)
+func (_d *AuthCodeDeleteOne) Exec(ctx context.Context) error {
+	n, err := _d._d.Exec(ctx)
 	switch {
 	case err != nil:
 		return err
@@ -110,6 +81,8 @@ func (acdo *AuthCodeDeleteOne) Exec(ctx context.Context) error {
 }
 
 // ExecX is like Exec, but panics if an error occurs.
-func (acdo *AuthCodeDeleteOne) ExecX(ctx context.Context) {
-	acdo.acd.ExecX(ctx)
+func (_d *AuthCodeDeleteOne) ExecX(ctx context.Context) {
+	if err := _d.Exec(ctx); err != nil {
+		panic(err)
+	}
 }
diff --git a/storage/ent/db/authcode_query.go b/storage/ent/db/authcode_query.go
index a82a450686..b7c3ae251c 100644
--- a/storage/ent/db/authcode_query.go
+++ b/storage/ent/db/authcode_query.go
@@ -7,6 +7,7 @@ import (
 	"fmt"
 	"math"
 
+	"entgo.io/ent"
 	"entgo.io/ent/dialect/sql"
 	"entgo.io/ent/dialect/sql/sqlgraph"
 	"entgo.io/ent/schema/field"
@@ -17,11 +18,9 @@ import (
 // AuthCodeQuery is the builder for querying AuthCode entities.
 type AuthCodeQuery struct {
 	config
-	limit      *int
-	offset     *int
-	unique     *bool
-	order      []OrderFunc
-	fields     []string
+	ctx        *QueryContext
+	order      []authcode.OrderOption
+	inters     []Interceptor
 	predicates []predicate.AuthCode
 	// intermediate query (i.e. traversal path).
 	sql  *sql.Selector
@@ -29,40 +28,40 @@ type AuthCodeQuery struct {
 }
 
 // Where adds a new predicate for the AuthCodeQuery builder.
-func (acq *AuthCodeQuery) Where(ps ...predicate.AuthCode) *AuthCodeQuery {
-	acq.predicates = append(acq.predicates, ps...)
-	return acq
+func (_q *AuthCodeQuery) Where(ps ...predicate.AuthCode) *AuthCodeQuery {
+	_q.predicates = append(_q.predicates, ps...)
+	return _q
 }
 
-// Limit adds a limit step to the query.
-func (acq *AuthCodeQuery) Limit(limit int) *AuthCodeQuery {
-	acq.limit = &limit
-	return acq
+// Limit the number of records to be returned by this query.
+func (_q *AuthCodeQuery) Limit(limit int) *AuthCodeQuery {
+	_q.ctx.Limit = &limit
+	return _q
 }
 
-// Offset adds an offset step to the query.
-func (acq *AuthCodeQuery) Offset(offset int) *AuthCodeQuery {
-	acq.offset = &offset
-	return acq
+// Offset to start from.
+func (_q *AuthCodeQuery) Offset(offset int) *AuthCodeQuery {
+	_q.ctx.Offset = &offset
+	return _q
 }
 
 // Unique configures the query builder to filter duplicate records on query.
 // By default, unique is set to true, and can be disabled using this method.
-func (acq *AuthCodeQuery) Unique(unique bool) *AuthCodeQuery {
-	acq.unique = &unique
-	return acq
+func (_q *AuthCodeQuery) Unique(unique bool) *AuthCodeQuery {
+	_q.ctx.Unique = &unique
+	return _q
 }
 
-// Order adds an order step to the query.
-func (acq *AuthCodeQuery) Order(o ...OrderFunc) *AuthCodeQuery {
-	acq.order = append(acq.order, o...)
-	return acq
+// Order specifies how the records should be ordered.
+func (_q *AuthCodeQuery) Order(o ...authcode.OrderOption) *AuthCodeQuery {
+	_q.order = append(_q.order, o...)
+	return _q
 }
 
 // First returns the first AuthCode entity from the query.
 // Returns a *NotFoundError when no AuthCode was found.
-func (acq *AuthCodeQuery) First(ctx context.Context) (*AuthCode, error) {
-	nodes, err := acq.Limit(1).All(ctx)
+func (_q *AuthCodeQuery) First(ctx context.Context) (*AuthCode, error) {
+	nodes, err := _q.Limit(1).All(setContextOp(ctx, _q.ctx, ent.OpQueryFirst))
 	if err != nil {
 		return nil, err
 	}
@@ -73,8 +72,8 @@ func (acq *AuthCodeQuery) First(ctx context.Context) (*AuthCode, error) {
 }
 
 // FirstX is like First, but panics if an error occurs.
-func (acq *AuthCodeQuery) FirstX(ctx context.Context) *AuthCode {
-	node, err := acq.First(ctx)
+func (_q *AuthCodeQuery) FirstX(ctx context.Context) *AuthCode {
+	node, err := _q.First(ctx)
 	if err != nil && !IsNotFound(err) {
 		panic(err)
 	}
@@ -83,9 +82,9 @@ func (acq *AuthCodeQuery) FirstX(ctx context.Context) *AuthCode {
 
 // FirstID returns the first AuthCode ID from the query.
 // Returns a *NotFoundError when no AuthCode ID was found.
-func (acq *AuthCodeQuery) FirstID(ctx context.Context) (id string, err error) {
+func (_q *AuthCodeQuery) FirstID(ctx context.Context) (id string, err error) {
 	var ids []string
-	if ids, err = acq.Limit(1).IDs(ctx); err != nil {
+	if ids, err = _q.Limit(1).IDs(setContextOp(ctx, _q.ctx, ent.OpQueryFirstID)); err != nil {
 		return
 	}
 	if len(ids) == 0 {
@@ -96,8 +95,8 @@ func (acq *AuthCodeQuery) FirstID(ctx context.Context) (id string, err error) {
 }
 
 // FirstIDX is like FirstID, but panics if an error occurs.
-func (acq *AuthCodeQuery) FirstIDX(ctx context.Context) string {
-	id, err := acq.FirstID(ctx)
+func (_q *AuthCodeQuery) FirstIDX(ctx context.Context) string {
+	id, err := _q.FirstID(ctx)
 	if err != nil && !IsNotFound(err) {
 		panic(err)
 	}
@@ -107,8 +106,8 @@ func (acq *AuthCodeQuery) FirstIDX(ctx context.Context) string {
 // Only returns a single AuthCode entity found by the query, ensuring it only returns one.
 // Returns a *NotSingularError when more than one AuthCode entity is found.
 // Returns a *NotFoundError when no AuthCode entities are found.
-func (acq *AuthCodeQuery) Only(ctx context.Context) (*AuthCode, error) {
-	nodes, err := acq.Limit(2).All(ctx)
+func (_q *AuthCodeQuery) Only(ctx context.Context) (*AuthCode, error) {
+	nodes, err := _q.Limit(2).All(setContextOp(ctx, _q.ctx, ent.OpQueryOnly))
 	if err != nil {
 		return nil, err
 	}
@@ -123,8 +122,8 @@ func (acq *AuthCodeQuery) Only(ctx context.Context) (*AuthCode, error) {
 }
 
 // OnlyX is like Only, but panics if an error occurs.
-func (acq *AuthCodeQuery) OnlyX(ctx context.Context) *AuthCode {
-	node, err := acq.Only(ctx)
+func (_q *AuthCodeQuery) OnlyX(ctx context.Context) *AuthCode {
+	node, err := _q.Only(ctx)
 	if err != nil {
 		panic(err)
 	}
@@ -134,9 +133,9 @@ func (acq *AuthCodeQuery) OnlyX(ctx context.Context) *AuthCode {
 // OnlyID is like Only, but returns the only AuthCode ID in the query.
 // Returns a *NotSingularError when more than one AuthCode ID is found.
 // Returns a *NotFoundError when no entities are found.
-func (acq *AuthCodeQuery) OnlyID(ctx context.Context) (id string, err error) {
+func (_q *AuthCodeQuery) OnlyID(ctx context.Context) (id string, err error) {
 	var ids []string
-	if ids, err = acq.Limit(2).IDs(ctx); err != nil {
+	if ids, err = _q.Limit(2).IDs(setContextOp(ctx, _q.ctx, ent.OpQueryOnlyID)); err != nil {
 		return
 	}
 	switch len(ids) {
@@ -151,8 +150,8 @@ func (acq *AuthCodeQuery) OnlyID(ctx context.Context) (id string, err error) {
 }
 
 // OnlyIDX is like OnlyID, but panics if an error occurs.
-func (acq *AuthCodeQuery) OnlyIDX(ctx context.Context) string {
-	id, err := acq.OnlyID(ctx)
+func (_q *AuthCodeQuery) OnlyIDX(ctx context.Context) string {
+	id, err := _q.OnlyID(ctx)
 	if err != nil {
 		panic(err)
 	}
@@ -160,16 +159,18 @@ func (acq *AuthCodeQuery) OnlyIDX(ctx context.Context) string {
 }
 
 // All executes the query and returns a list of AuthCodes.
-func (acq *AuthCodeQuery) All(ctx context.Context) ([]*AuthCode, error) {
-	if err := acq.prepareQuery(ctx); err != nil {
+func (_q *AuthCodeQuery) All(ctx context.Context) ([]*AuthCode, error) {
+	ctx = setContextOp(ctx, _q.ctx, ent.OpQueryAll)
+	if err := _q.prepareQuery(ctx); err != nil {
 		return nil, err
 	}
-	return acq.sqlAll(ctx)
+	qr := querierAll[[]*AuthCode, *AuthCodeQuery]()
+	return withInterceptors[[]*AuthCode](ctx, _q, qr, _q.inters)
 }
 
 // AllX is like All, but panics if an error occurs.
-func (acq *AuthCodeQuery) AllX(ctx context.Context) []*AuthCode {
-	nodes, err := acq.All(ctx)
+func (_q *AuthCodeQuery) AllX(ctx context.Context) []*AuthCode {
+	nodes, err := _q.All(ctx)
 	if err != nil {
 		panic(err)
 	}
@@ -177,17 +178,20 @@ func (acq *AuthCodeQuery) AllX(ctx context.Context) []*AuthCode {
 }
 
 // IDs executes the query and returns a list of AuthCode IDs.
-func (acq *AuthCodeQuery) IDs(ctx context.Context) ([]string, error) {
-	var ids []string
-	if err := acq.Select(authcode.FieldID).Scan(ctx, &ids); err != nil {
+func (_q *AuthCodeQuery) IDs(ctx context.Context) (ids []string, err error) {
+	if _q.ctx.Unique == nil && _q.path != nil {
+		_q.Unique(true)
+	}
+	ctx = setContextOp(ctx, _q.ctx, ent.OpQueryIDs)
+	if err = _q.Select(authcode.FieldID).Scan(ctx, &ids); err != nil {
 		return nil, err
 	}
 	return ids, nil
 }
 
 // IDsX is like IDs, but panics if an error occurs.
-func (acq *AuthCodeQuery) IDsX(ctx context.Context) []string {
-	ids, err := acq.IDs(ctx)
+func (_q *AuthCodeQuery) IDsX(ctx context.Context) []string {
+	ids, err := _q.IDs(ctx)
 	if err != nil {
 		panic(err)
 	}
@@ -195,16 +199,17 @@ func (acq *AuthCodeQuery) IDsX(ctx context.Context) []string {
 }
 
 // Count returns the count of the given query.
-func (acq *AuthCodeQuery) Count(ctx context.Context) (int, error) {
-	if err := acq.prepareQuery(ctx); err != nil {
+func (_q *AuthCodeQuery) Count(ctx context.Context) (int, error) {
+	ctx = setContextOp(ctx, _q.ctx, ent.OpQueryCount)
+	if err := _q.prepareQuery(ctx); err != nil {
 		return 0, err
 	}
-	return acq.sqlCount(ctx)
+	return withInterceptors[int](ctx, _q, querierCount[*AuthCodeQuery](), _q.inters)
 }
 
 // CountX is like Count, but panics if an error occurs.
-func (acq *AuthCodeQuery) CountX(ctx context.Context) int {
-	count, err := acq.Count(ctx)
+func (_q *AuthCodeQuery) CountX(ctx context.Context) int {
+	count, err := _q.Count(ctx)
 	if err != nil {
 		panic(err)
 	}
@@ -212,16 +217,21 @@ func (acq *AuthCodeQuery) CountX(ctx context.Context) int {
 }
 
 // Exist returns true if the query has elements in the graph.
-func (acq *AuthCodeQuery) Exist(ctx context.Context) (bool, error) {
-	if err := acq.prepareQuery(ctx); err != nil {
-		return false, err
+func (_q *AuthCodeQuery) Exist(ctx context.Context) (bool, error) {
+	ctx = setContextOp(ctx, _q.ctx, ent.OpQueryExist)
+	switch _, err := _q.FirstID(ctx); {
+	case IsNotFound(err):
+		return false, nil
+	case err != nil:
+		return false, fmt.Errorf("db: check existence: %w", err)
+	default:
+		return true, nil
 	}
-	return acq.sqlExist(ctx)
 }
 
 // ExistX is like Exist, but panics if an error occurs.
-func (acq *AuthCodeQuery) ExistX(ctx context.Context) bool {
-	exist, err := acq.Exist(ctx)
+func (_q *AuthCodeQuery) ExistX(ctx context.Context) bool {
+	exist, err := _q.Exist(ctx)
 	if err != nil {
 		panic(err)
 	}
@@ -230,20 +240,19 @@ func (acq *AuthCodeQuery) ExistX(ctx context.Context) bool {
 
 // Clone returns a duplicate of the AuthCodeQuery builder, including all associated steps. It can be
 // used to prepare common query builders and use them differently after the clone is made.
-func (acq *AuthCodeQuery) Clone() *AuthCodeQuery {
-	if acq == nil {
+func (_q *AuthCodeQuery) Clone() *AuthCodeQuery {
+	if _q == nil {
 		return nil
 	}
 	return &AuthCodeQuery{
-		config:     acq.config,
-		limit:      acq.limit,
-		offset:     acq.offset,
-		order:      append([]OrderFunc{}, acq.order...),
-		predicates: append([]predicate.AuthCode{}, acq.predicates...),
+		config:     _q.config,
+		ctx:        _q.ctx.Clone(),
+		order:      append([]authcode.OrderOption{}, _q.order...),
+		inters:     append([]Interceptor{}, _q.inters...),
+		predicates: append([]predicate.AuthCode{}, _q.predicates...),
 		// clone intermediate query.
-		sql:    acq.sql.Clone(),
-		path:   acq.path,
-		unique: acq.unique,
+		sql:  _q.sql.Clone(),
+		path: _q.path,
 	}
 }
 
@@ -261,18 +270,12 @@ func (acq *AuthCodeQuery) Clone() *AuthCodeQuery {
 //		GroupBy(authcode.FieldClientID).
 //		Aggregate(db.Count()).
 //		Scan(ctx, &v)
-//
-func (acq *AuthCodeQuery) GroupBy(field string, fields ...string) *AuthCodeGroupBy {
-	grbuild := &AuthCodeGroupBy{config: acq.config}
-	grbuild.fields = append([]string{field}, fields...)
-	grbuild.path = func(ctx context.Context) (prev *sql.Selector, err error) {
-		if err := acq.prepareQuery(ctx); err != nil {
-			return nil, err
-		}
-		return acq.sqlQuery(ctx), nil
-	}
+func (_q *AuthCodeQuery) GroupBy(field string, fields ...string) *AuthCodeGroupBy {
+	_q.ctx.Fields = append([]string{field}, fields...)
+	grbuild := &AuthCodeGroupBy{build: _q}
+	grbuild.flds = &_q.ctx.Fields
 	grbuild.label = authcode.Label
-	grbuild.flds, grbuild.scan = &grbuild.fields, grbuild.Scan
+	grbuild.scan = grbuild.Scan
 	return grbuild
 }
 
@@ -288,48 +291,62 @@ func (acq *AuthCodeQuery) GroupBy(field string, fields ...string) *AuthCodeGroup
 //	client.AuthCode.Query().
 //		Select(authcode.FieldClientID).
 //		Scan(ctx, &v)
-//
-func (acq *AuthCodeQuery) Select(fields ...string) *AuthCodeSelect {
-	acq.fields = append(acq.fields, fields...)
-	selbuild := &AuthCodeSelect{AuthCodeQuery: acq}
-	selbuild.label = authcode.Label
-	selbuild.flds, selbuild.scan = &acq.fields, selbuild.Scan
-	return selbuild
+func (_q *AuthCodeQuery) Select(fields ...string) *AuthCodeSelect {
+	_q.ctx.Fields = append(_q.ctx.Fields, fields...)
+	sbuild := &AuthCodeSelect{AuthCodeQuery: _q}
+	sbuild.label = authcode.Label
+	sbuild.flds, sbuild.scan = &_q.ctx.Fields, sbuild.Scan
+	return sbuild
+}
+
+// Aggregate returns a AuthCodeSelect configured with the given aggregations.
+func (_q *AuthCodeQuery) Aggregate(fns ...AggregateFunc) *AuthCodeSelect {
+	return _q.Select().Aggregate(fns...)
 }
 
-func (acq *AuthCodeQuery) prepareQuery(ctx context.Context) error {
-	for _, f := range acq.fields {
+func (_q *AuthCodeQuery) prepareQuery(ctx context.Context) error {
+	for _, inter := range _q.inters {
+		if inter == nil {
+			return fmt.Errorf("db: uninitialized interceptor (forgotten import db/runtime?)")
+		}
+		if trv, ok := inter.(Traverser); ok {
+			if err := trv.Traverse(ctx, _q); err != nil {
+				return err
+			}
+		}
+	}
+	for _, f := range _q.ctx.Fields {
 		if !authcode.ValidColumn(f) {
 			return &ValidationError{Name: f, err: fmt.Errorf("db: invalid field %q for query", f)}
 		}
 	}
-	if acq.path != nil {
-		prev, err := acq.path(ctx)
+	if _q.path != nil {
+		prev, err := _q.path(ctx)
 		if err != nil {
 			return err
 		}
-		acq.sql = prev
+		_q.sql = prev
 	}
 	return nil
 }
 
-func (acq *AuthCodeQuery) sqlAll(ctx context.Context, hooks ...queryHook) ([]*AuthCode, error) {
+func (_q *AuthCodeQuery) sqlAll(ctx context.Context, hooks ...queryHook) ([]*AuthCode, error) {
 	var (
 		nodes = []*AuthCode{}
-		_spec = acq.querySpec()
+		_spec = _q.querySpec()
 	)
-	_spec.ScanValues = func(columns []string) ([]interface{}, error) {
+	_spec.ScanValues = func(columns []string) ([]any, error) {
 		return (*AuthCode).scanValues(nil, columns)
 	}
-	_spec.Assign = func(columns []string, values []interface{}) error {
-		node := &AuthCode{config: acq.config}
+	_spec.Assign = func(columns []string, values []any) error {
+		node := &AuthCode{config: _q.config}
 		nodes = append(nodes, node)
 		return node.assignValues(columns, values)
 	}
 	for i := range hooks {
 		hooks[i](ctx, _spec)
 	}
-	if err := sqlgraph.QueryNodes(ctx, acq.driver, _spec); err != nil {
+	if err := sqlgraph.QueryNodes(ctx, _q.driver, _spec); err != nil {
 		return nil, err
 	}
 	if len(nodes) == 0 {
@@ -338,40 +355,24 @@ func (acq *AuthCodeQuery) sqlAll(ctx context.Context, hooks ...queryHook) ([]*Au
 	return nodes, nil
 }
 
-func (acq *AuthCodeQuery) sqlCount(ctx context.Context) (int, error) {
-	_spec := acq.querySpec()
-	_spec.Node.Columns = acq.fields
-	if len(acq.fields) > 0 {
-		_spec.Unique = acq.unique != nil && *acq.unique
-	}
-	return sqlgraph.CountNodes(ctx, acq.driver, _spec)
-}
-
-func (acq *AuthCodeQuery) sqlExist(ctx context.Context) (bool, error) {
-	n, err := acq.sqlCount(ctx)
-	if err != nil {
-		return false, fmt.Errorf("db: check existence: %w", err)
+func (_q *AuthCodeQuery) sqlCount(ctx context.Context) (int, error) {
+	_spec := _q.querySpec()
+	_spec.Node.Columns = _q.ctx.Fields
+	if len(_q.ctx.Fields) > 0 {
+		_spec.Unique = _q.ctx.Unique != nil && *_q.ctx.Unique
 	}
-	return n > 0, nil
+	return sqlgraph.CountNodes(ctx, _q.driver, _spec)
 }
 
-func (acq *AuthCodeQuery) querySpec() *sqlgraph.QuerySpec {
-	_spec := &sqlgraph.QuerySpec{
-		Node: &sqlgraph.NodeSpec{
-			Table:   authcode.Table,
-			Columns: authcode.Columns,
-			ID: &sqlgraph.FieldSpec{
-				Type:   field.TypeString,
-				Column: authcode.FieldID,
-			},
-		},
-		From:   acq.sql,
-		Unique: true,
-	}
-	if unique := acq.unique; unique != nil {
+func (_q *AuthCodeQuery) querySpec() *sqlgraph.QuerySpec {
+	_spec := sqlgraph.NewQuerySpec(authcode.Table, authcode.Columns, sqlgraph.NewFieldSpec(authcode.FieldID, field.TypeString))
+	_spec.From = _q.sql
+	if unique := _q.ctx.Unique; unique != nil {
 		_spec.Unique = *unique
+	} else if _q.path != nil {
+		_spec.Unique = true
 	}
-	if fields := acq.fields; len(fields) > 0 {
+	if fields := _q.ctx.Fields; len(fields) > 0 {
 		_spec.Node.Columns = make([]string, 0, len(fields))
 		_spec.Node.Columns = append(_spec.Node.Columns, authcode.FieldID)
 		for i := range fields {
@@ -380,20 +381,20 @@ func (acq *AuthCodeQuery) querySpec() *sqlgraph.QuerySpec {
 			}
 		}
 	}
-	if ps := acq.predicates; len(ps) > 0 {
+	if ps := _q.predicates; len(ps) > 0 {
 		_spec.Predicate = func(selector *sql.Selector) {
 			for i := range ps {
 				ps[i](selector)
 			}
 		}
 	}
-	if limit := acq.limit; limit != nil {
+	if limit := _q.ctx.Limit; limit != nil {
 		_spec.Limit = *limit
 	}
-	if offset := acq.offset; offset != nil {
+	if offset := _q.ctx.Offset; offset != nil {
 		_spec.Offset = *offset
 	}
-	if ps := acq.order; len(ps) > 0 {
+	if ps := _q.order; len(ps) > 0 {
 		_spec.Order = func(selector *sql.Selector) {
 			for i := range ps {
 				ps[i](selector)
@@ -403,33 +404,33 @@ func (acq *AuthCodeQuery) querySpec() *sqlgraph.QuerySpec {
 	return _spec
 }
 
-func (acq *AuthCodeQuery) sqlQuery(ctx context.Context) *sql.Selector {
-	builder := sql.Dialect(acq.driver.Dialect())
+func (_q *AuthCodeQuery) sqlQuery(ctx context.Context) *sql.Selector {
+	builder := sql.Dialect(_q.driver.Dialect())
 	t1 := builder.Table(authcode.Table)
-	columns := acq.fields
+	columns := _q.ctx.Fields
 	if len(columns) == 0 {
 		columns = authcode.Columns
 	}
 	selector := builder.Select(t1.Columns(columns...)...).From(t1)
-	if acq.sql != nil {
-		selector = acq.sql
+	if _q.sql != nil {
+		selector = _q.sql
 		selector.Select(selector.Columns(columns...)...)
 	}
-	if acq.unique != nil && *acq.unique {
+	if _q.ctx.Unique != nil && *_q.ctx.Unique {
 		selector.Distinct()
 	}
-	for _, p := range acq.predicates {
+	for _, p := range _q.predicates {
 		p(selector)
 	}
-	for _, p := range acq.order {
+	for _, p := range _q.order {
 		p(selector)
 	}
-	if offset := acq.offset; offset != nil {
+	if offset := _q.ctx.Offset; offset != nil {
 		// limit is mandatory for offset clause. We start
 		// with default value, and override it below if needed.
 		selector.Offset(*offset).Limit(math.MaxInt32)
 	}
-	if limit := acq.limit; limit != nil {
+	if limit := _q.ctx.Limit; limit != nil {
 		selector.Limit(*limit)
 	}
 	return selector
@@ -437,90 +438,88 @@ func (acq *AuthCodeQuery) sqlQuery(ctx context.Context) *sql.Selector {
 
 // AuthCodeGroupBy is the group-by builder for AuthCode entities.
 type AuthCodeGroupBy struct {
-	config
 	selector
-	fields []string
-	fns    []AggregateFunc
-	// intermediate query (i.e. traversal path).
-	sql  *sql.Selector
-	path func(context.Context) (*sql.Selector, error)
+	build *AuthCodeQuery
 }
 
 // Aggregate adds the given aggregation functions to the group-by query.
-func (acgb *AuthCodeGroupBy) Aggregate(fns ...AggregateFunc) *AuthCodeGroupBy {
-	acgb.fns = append(acgb.fns, fns...)
-	return acgb
+func (_g *AuthCodeGroupBy) Aggregate(fns ...AggregateFunc) *AuthCodeGroupBy {
+	_g.fns = append(_g.fns, fns...)
+	return _g
 }
 
-// Scan applies the group-by query and scans the result into the given value.
-func (acgb *AuthCodeGroupBy) Scan(ctx context.Context, v interface{}) error {
-	query, err := acgb.path(ctx)
-	if err != nil {
+// Scan applies the selector query and scans the result into the given value.
+func (_g *AuthCodeGroupBy) Scan(ctx context.Context, v any) error {
+	ctx = setContextOp(ctx, _g.build.ctx, ent.OpQueryGroupBy)
+	if err := _g.build.prepareQuery(ctx); err != nil {
 		return err
 	}
-	acgb.sql = query
-	return acgb.sqlScan(ctx, v)
+	return scanWithInterceptors[*AuthCodeQuery, *AuthCodeGroupBy](ctx, _g.build, _g, _g.build.inters, v)
 }
 
-func (acgb *AuthCodeGroupBy) sqlScan(ctx context.Context, v interface{}) error {
-	for _, f := range acgb.fields {
-		if !authcode.ValidColumn(f) {
-			return &ValidationError{Name: f, err: fmt.Errorf("invalid field %q for group-by", f)}
+func (_g *AuthCodeGroupBy) sqlScan(ctx context.Context, root *AuthCodeQuery, v any) error {
+	selector := root.sqlQuery(ctx).Select()
+	aggregation := make([]string, 0, len(_g.fns))
+	for _, fn := range _g.fns {
+		aggregation = append(aggregation, fn(selector))
+	}
+	if len(selector.SelectedColumns()) == 0 {
+		columns := make([]string, 0, len(*_g.flds)+len(_g.fns))
+		for _, f := range *_g.flds {
+			columns = append(columns, selector.C(f))
 		}
+		columns = append(columns, aggregation...)
+		selector.Select(columns...)
 	}
-	selector := acgb.sqlQuery()
+	selector.GroupBy(selector.Columns(*_g.flds...)...)
 	if err := selector.Err(); err != nil {
 		return err
 	}
 	rows := &sql.Rows{}
 	query, args := selector.Query()
-	if err := acgb.driver.Query(ctx, query, args, rows); err != nil {
+	if err := _g.build.driver.Query(ctx, query, args, rows); err != nil {
 		return err
 	}
 	defer rows.Close()
 	return sql.ScanSlice(rows, v)
 }
 
-func (acgb *AuthCodeGroupBy) sqlQuery() *sql.Selector {
-	selector := acgb.sql.Select()
-	aggregation := make([]string, 0, len(acgb.fns))
-	for _, fn := range acgb.fns {
-		aggregation = append(aggregation, fn(selector))
-	}
-	// If no columns were selected in a custom aggregation function, the default
-	// selection is the fields used for "group-by", and the aggregation functions.
-	if len(selector.SelectedColumns()) == 0 {
-		columns := make([]string, 0, len(acgb.fields)+len(acgb.fns))
-		for _, f := range acgb.fields {
-			columns = append(columns, selector.C(f))
-		}
-		columns = append(columns, aggregation...)
-		selector.Select(columns...)
-	}
-	return selector.GroupBy(selector.Columns(acgb.fields...)...)
-}
-
 // AuthCodeSelect is the builder for selecting fields of AuthCode entities.
 type AuthCodeSelect struct {
 	*AuthCodeQuery
 	selector
-	// intermediate query (i.e. traversal path).
-	sql *sql.Selector
+}
+
+// Aggregate adds the given aggregation functions to the selector query.
+func (_s *AuthCodeSelect) Aggregate(fns ...AggregateFunc) *AuthCodeSelect {
+	_s.fns = append(_s.fns, fns...)
+	return _s
 }
 
 // Scan applies the selector query and scans the result into the given value.
-func (acs *AuthCodeSelect) Scan(ctx context.Context, v interface{}) error {
-	if err := acs.prepareQuery(ctx); err != nil {
+func (_s *AuthCodeSelect) Scan(ctx context.Context, v any) error {
+	ctx = setContextOp(ctx, _s.ctx, ent.OpQuerySelect)
+	if err := _s.prepareQuery(ctx); err != nil {
 		return err
 	}
-	acs.sql = acs.AuthCodeQuery.sqlQuery(ctx)
-	return acs.sqlScan(ctx, v)
+	return scanWithInterceptors[*AuthCodeQuery, *AuthCodeSelect](ctx, _s.AuthCodeQuery, _s, _s.inters, v)
 }
 
-func (acs *AuthCodeSelect) sqlScan(ctx context.Context, v interface{}) error {
+func (_s *AuthCodeSelect) sqlScan(ctx context.Context, root *AuthCodeQuery, v any) error {
+	selector := root.sqlQuery(ctx)
+	aggregation := make([]string, 0, len(_s.fns))
+	for _, fn := range _s.fns {
+		aggregation = append(aggregation, fn(selector))
+	}
+	switch n := len(*_s.selector.flds); {
+	case n == 0 && len(aggregation) > 0:
+		selector.Select(aggregation...)
+	case n != 0 && len(aggregation) > 0:
+		selector.AppendSelect(aggregation...)
+	}
 	rows := &sql.Rows{}
-	query, args := acs.sql.Query()
-	if err := acs.driver.Query(ctx, query, args, rows); err != nil {
+	query, args := selector.Query()
+	if err := _s.driver.Query(ctx, query, args, rows); err != nil {
 		return err
 	}
 	defer rows.Close()
diff --git a/storage/ent/db/authcode_update.go b/storage/ent/db/authcode_update.go
index 5d9764bcf4..83a24755ee 100644
--- a/storage/ent/db/authcode_update.go
+++ b/storage/ent/db/authcode_update.go
@@ -10,6 +10,7 @@ import (
 
 	"entgo.io/ent/dialect/sql"
 	"entgo.io/ent/dialect/sql/sqlgraph"
+	"entgo.io/ent/dialect/sql/sqljson"
 	"entgo.io/ent/schema/field"
 	"github.com/dexidp/dex/storage/ent/db/authcode"
 	"github.com/dexidp/dex/storage/ent/db/predicate"
@@ -23,189 +24,280 @@ type AuthCodeUpdate struct {
 }
 
 // Where appends a list predicates to the AuthCodeUpdate builder.
-func (acu *AuthCodeUpdate) Where(ps ...predicate.AuthCode) *AuthCodeUpdate {
-	acu.mutation.Where(ps...)
-	return acu
+func (_u *AuthCodeUpdate) Where(ps ...predicate.AuthCode) *AuthCodeUpdate {
+	_u.mutation.Where(ps...)
+	return _u
 }
 
 // SetClientID sets the "client_id" field.
-func (acu *AuthCodeUpdate) SetClientID(s string) *AuthCodeUpdate {
-	acu.mutation.SetClientID(s)
-	return acu
+func (_u *AuthCodeUpdate) SetClientID(v string) *AuthCodeUpdate {
+	_u.mutation.SetClientID(v)
+	return _u
+}
+
+// SetNillableClientID sets the "client_id" field if the given value is not nil.
+func (_u *AuthCodeUpdate) SetNillableClientID(v *string) *AuthCodeUpdate {
+	if v != nil {
+		_u.SetClientID(*v)
+	}
+	return _u
 }
 
 // SetScopes sets the "scopes" field.
-func (acu *AuthCodeUpdate) SetScopes(s []string) *AuthCodeUpdate {
-	acu.mutation.SetScopes(s)
-	return acu
+func (_u *AuthCodeUpdate) SetScopes(v []string) *AuthCodeUpdate {
+	_u.mutation.SetScopes(v)
+	return _u
+}
+
+// AppendScopes appends value to the "scopes" field.
+func (_u *AuthCodeUpdate) AppendScopes(v []string) *AuthCodeUpdate {
+	_u.mutation.AppendScopes(v)
+	return _u
 }
 
 // ClearScopes clears the value of the "scopes" field.
-func (acu *AuthCodeUpdate) ClearScopes() *AuthCodeUpdate {
-	acu.mutation.ClearScopes()
-	return acu
+func (_u *AuthCodeUpdate) ClearScopes() *AuthCodeUpdate {
+	_u.mutation.ClearScopes()
+	return _u
 }
 
 // SetNonce sets the "nonce" field.
-func (acu *AuthCodeUpdate) SetNonce(s string) *AuthCodeUpdate {
-	acu.mutation.SetNonce(s)
-	return acu
+func (_u *AuthCodeUpdate) SetNonce(v string) *AuthCodeUpdate {
+	_u.mutation.SetNonce(v)
+	return _u
+}
+
+// SetNillableNonce sets the "nonce" field if the given value is not nil.
+func (_u *AuthCodeUpdate) SetNillableNonce(v *string) *AuthCodeUpdate {
+	if v != nil {
+		_u.SetNonce(*v)
+	}
+	return _u
 }
 
 // SetRedirectURI sets the "redirect_uri" field.
-func (acu *AuthCodeUpdate) SetRedirectURI(s string) *AuthCodeUpdate {
-	acu.mutation.SetRedirectURI(s)
-	return acu
+func (_u *AuthCodeUpdate) SetRedirectURI(v string) *AuthCodeUpdate {
+	_u.mutation.SetRedirectURI(v)
+	return _u
+}
+
+// SetNillableRedirectURI sets the "redirect_uri" field if the given value is not nil.
+func (_u *AuthCodeUpdate) SetNillableRedirectURI(v *string) *AuthCodeUpdate {
+	if v != nil {
+		_u.SetRedirectURI(*v)
+	}
+	return _u
 }
 
 // SetClaimsUserID sets the "claims_user_id" field.
-func (acu *AuthCodeUpdate) SetClaimsUserID(s string) *AuthCodeUpdate {
-	acu.mutation.SetClaimsUserID(s)
-	return acu
+func (_u *AuthCodeUpdate) SetClaimsUserID(v string) *AuthCodeUpdate {
+	_u.mutation.SetClaimsUserID(v)
+	return _u
+}
+
+// SetNillableClaimsUserID sets the "claims_user_id" field if the given value is not nil.
+func (_u *AuthCodeUpdate) SetNillableClaimsUserID(v *string) *AuthCodeUpdate {
+	if v != nil {
+		_u.SetClaimsUserID(*v)
+	}
+	return _u
 }
 
 // SetClaimsUsername sets the "claims_username" field.
-func (acu *AuthCodeUpdate) SetClaimsUsername(s string) *AuthCodeUpdate {
-	acu.mutation.SetClaimsUsername(s)
-	return acu
+func (_u *AuthCodeUpdate) SetClaimsUsername(v string) *AuthCodeUpdate {
+	_u.mutation.SetClaimsUsername(v)
+	return _u
+}
+
+// SetNillableClaimsUsername sets the "claims_username" field if the given value is not nil.
+func (_u *AuthCodeUpdate) SetNillableClaimsUsername(v *string) *AuthCodeUpdate {
+	if v != nil {
+		_u.SetClaimsUsername(*v)
+	}
+	return _u
 }
 
 // SetClaimsEmail sets the "claims_email" field.
-func (acu *AuthCodeUpdate) SetClaimsEmail(s string) *AuthCodeUpdate {
-	acu.mutation.SetClaimsEmail(s)
-	return acu
+func (_u *AuthCodeUpdate) SetClaimsEmail(v string) *AuthCodeUpdate {
+	_u.mutation.SetClaimsEmail(v)
+	return _u
+}
+
+// SetNillableClaimsEmail sets the "claims_email" field if the given value is not nil.
+func (_u *AuthCodeUpdate) SetNillableClaimsEmail(v *string) *AuthCodeUpdate {
+	if v != nil {
+		_u.SetClaimsEmail(*v)
+	}
+	return _u
 }
 
 // SetClaimsEmailVerified sets the "claims_email_verified" field.
-func (acu *AuthCodeUpdate) SetClaimsEmailVerified(b bool) *AuthCodeUpdate {
-	acu.mutation.SetClaimsEmailVerified(b)
-	return acu
+func (_u *AuthCodeUpdate) SetClaimsEmailVerified(v bool) *AuthCodeUpdate {
+	_u.mutation.SetClaimsEmailVerified(v)
+	return _u
+}
+
+// SetNillableClaimsEmailVerified sets the "claims_email_verified" field if the given value is not nil.
+func (_u *AuthCodeUpdate) SetNillableClaimsEmailVerified(v *bool) *AuthCodeUpdate {
+	if v != nil {
+		_u.SetClaimsEmailVerified(*v)
+	}
+	return _u
 }
 
 // SetClaimsGroups sets the "claims_groups" field.
-func (acu *AuthCodeUpdate) SetClaimsGroups(s []string) *AuthCodeUpdate {
-	acu.mutation.SetClaimsGroups(s)
-	return acu
+func (_u *AuthCodeUpdate) SetClaimsGroups(v []string) *AuthCodeUpdate {
+	_u.mutation.SetClaimsGroups(v)
+	return _u
+}
+
+// AppendClaimsGroups appends value to the "claims_groups" field.
+func (_u *AuthCodeUpdate) AppendClaimsGroups(v []string) *AuthCodeUpdate {
+	_u.mutation.AppendClaimsGroups(v)
+	return _u
 }
 
 // ClearClaimsGroups clears the value of the "claims_groups" field.
-func (acu *AuthCodeUpdate) ClearClaimsGroups() *AuthCodeUpdate {
-	acu.mutation.ClearClaimsGroups()
-	return acu
+func (_u *AuthCodeUpdate) ClearClaimsGroups() *AuthCodeUpdate {
+	_u.mutation.ClearClaimsGroups()
+	return _u
 }
 
 // SetClaimsPreferredUsername sets the "claims_preferred_username" field.
-func (acu *AuthCodeUpdate) SetClaimsPreferredUsername(s string) *AuthCodeUpdate {
-	acu.mutation.SetClaimsPreferredUsername(s)
-	return acu
+func (_u *AuthCodeUpdate) SetClaimsPreferredUsername(v string) *AuthCodeUpdate {
+	_u.mutation.SetClaimsPreferredUsername(v)
+	return _u
 }
 
 // SetNillableClaimsPreferredUsername sets the "claims_preferred_username" field if the given value is not nil.
-func (acu *AuthCodeUpdate) SetNillableClaimsPreferredUsername(s *string) *AuthCodeUpdate {
-	if s != nil {
-		acu.SetClaimsPreferredUsername(*s)
+func (_u *AuthCodeUpdate) SetNillableClaimsPreferredUsername(v *string) *AuthCodeUpdate {
+	if v != nil {
+		_u.SetClaimsPreferredUsername(*v)
 	}
-	return acu
+	return _u
 }
 
 // SetConnectorID sets the "connector_id" field.
-func (acu *AuthCodeUpdate) SetConnectorID(s string) *AuthCodeUpdate {
-	acu.mutation.SetConnectorID(s)
-	return acu
+func (_u *AuthCodeUpdate) SetConnectorID(v string) *AuthCodeUpdate {
+	_u.mutation.SetConnectorID(v)
+	return _u
+}
+
+// SetNillableConnectorID sets the "connector_id" field if the given value is not nil.
+func (_u *AuthCodeUpdate) SetNillableConnectorID(v *string) *AuthCodeUpdate {
+	if v != nil {
+		_u.SetConnectorID(*v)
+	}
+	return _u
 }
 
 // SetConnectorData sets the "connector_data" field.
-func (acu *AuthCodeUpdate) SetConnectorData(b []byte) *AuthCodeUpdate {
-	acu.mutation.SetConnectorData(b)
-	return acu
+func (_u *AuthCodeUpdate) SetConnectorData(v []byte) *AuthCodeUpdate {
+	_u.mutation.SetConnectorData(v)
+	return _u
 }
 
 // ClearConnectorData clears the value of the "connector_data" field.
-func (acu *AuthCodeUpdate) ClearConnectorData() *AuthCodeUpdate {
-	acu.mutation.ClearConnectorData()
-	return acu
+func (_u *AuthCodeUpdate) ClearConnectorData() *AuthCodeUpdate {
+	_u.mutation.ClearConnectorData()
+	return _u
 }
 
 // SetExpiry sets the "expiry" field.
-func (acu *AuthCodeUpdate) SetExpiry(t time.Time) *AuthCodeUpdate {
-	acu.mutation.SetExpiry(t)
-	return acu
+func (_u *AuthCodeUpdate) SetExpiry(v time.Time) *AuthCodeUpdate {
+	_u.mutation.SetExpiry(v)
+	return _u
+}
+
+// SetNillableExpiry sets the "expiry" field if the given value is not nil.
+func (_u *AuthCodeUpdate) SetNillableExpiry(v *time.Time) *AuthCodeUpdate {
+	if v != nil {
+		_u.SetExpiry(*v)
+	}
+	return _u
 }
 
 // SetCodeChallenge sets the "code_challenge" field.
-func (acu *AuthCodeUpdate) SetCodeChallenge(s string) *AuthCodeUpdate {
-	acu.mutation.SetCodeChallenge(s)
-	return acu
+func (_u *AuthCodeUpdate) SetCodeChallenge(v string) *AuthCodeUpdate {
+	_u.mutation.SetCodeChallenge(v)
+	return _u
 }
 
 // SetNillableCodeChallenge sets the "code_challenge" field if the given value is not nil.
-func (acu *AuthCodeUpdate) SetNillableCodeChallenge(s *string) *AuthCodeUpdate {
-	if s != nil {
-		acu.SetCodeChallenge(*s)
+func (_u *AuthCodeUpdate) SetNillableCodeChallenge(v *string) *AuthCodeUpdate {
+	if v != nil {
+		_u.SetCodeChallenge(*v)
 	}
-	return acu
+	return _u
 }
 
 // SetCodeChallengeMethod sets the "code_challenge_method" field.
-func (acu *AuthCodeUpdate) SetCodeChallengeMethod(s string) *AuthCodeUpdate {
-	acu.mutation.SetCodeChallengeMethod(s)
-	return acu
+func (_u *AuthCodeUpdate) SetCodeChallengeMethod(v string) *AuthCodeUpdate {
+	_u.mutation.SetCodeChallengeMethod(v)
+	return _u
 }
 
 // SetNillableCodeChallengeMethod sets the "code_challenge_method" field if the given value is not nil.
-func (acu *AuthCodeUpdate) SetNillableCodeChallengeMethod(s *string) *AuthCodeUpdate {
-	if s != nil {
-		acu.SetCodeChallengeMethod(*s)
+func (_u *AuthCodeUpdate) SetNillableCodeChallengeMethod(v *string) *AuthCodeUpdate {
+	if v != nil {
+		_u.SetCodeChallengeMethod(*v)
+	}
+	return _u
+}
+
+// SetAuthTime sets the "auth_time" field.
+func (_u *AuthCodeUpdate) SetAuthTime(v time.Time) *AuthCodeUpdate {
+	_u.mutation.SetAuthTime(v)
+	return _u
+}
+
+// SetNillableAuthTime sets the "auth_time" field if the given value is not nil.
+func (_u *AuthCodeUpdate) SetNillableAuthTime(v *time.Time) *AuthCodeUpdate {
+	if v != nil {
+		_u.SetAuthTime(*v)
+	}
+	return _u
+}
+
+// ClearAuthTime clears the value of the "auth_time" field.
+func (_u *AuthCodeUpdate) ClearAuthTime() *AuthCodeUpdate {
+	_u.mutation.ClearAuthTime()
+	return _u
+}
+
+// SetSessionID sets the "session_id" field.
+func (_u *AuthCodeUpdate) SetSessionID(v string) *AuthCodeUpdate {
+	_u.mutation.SetSessionID(v)
+	return _u
+}
+
+// SetNillableSessionID sets the "session_id" field if the given value is not nil.
+func (_u *AuthCodeUpdate) SetNillableSessionID(v *string) *AuthCodeUpdate {
+	if v != nil {
+		_u.SetSessionID(*v)
 	}
-	return acu
+	return _u
+}
+
+// ClearSessionID clears the value of the "session_id" field.
+func (_u *AuthCodeUpdate) ClearSessionID() *AuthCodeUpdate {
+	_u.mutation.ClearSessionID()
+	return _u
 }
 
 // Mutation returns the AuthCodeMutation object of the builder.
-func (acu *AuthCodeUpdate) Mutation() *AuthCodeMutation {
-	return acu.mutation
+func (_u *AuthCodeUpdate) Mutation() *AuthCodeMutation {
+	return _u.mutation
 }
 
 // Save executes the query and returns the number of nodes affected by the update operation.
-func (acu *AuthCodeUpdate) Save(ctx context.Context) (int, error) {
-	var (
-		err      error
-		affected int
-	)
-	if len(acu.hooks) == 0 {
-		if err = acu.check(); err != nil {
-			return 0, err
-		}
-		affected, err = acu.sqlSave(ctx)
-	} else {
-		var mut Mutator = MutateFunc(func(ctx context.Context, m Mutation) (Value, error) {
-			mutation, ok := m.(*AuthCodeMutation)
-			if !ok {
-				return nil, fmt.Errorf("unexpected mutation type %T", m)
-			}
-			if err = acu.check(); err != nil {
-				return 0, err
-			}
-			acu.mutation = mutation
-			affected, err = acu.sqlSave(ctx)
-			mutation.done = true
-			return affected, err
-		})
-		for i := len(acu.hooks) - 1; i >= 0; i-- {
-			if acu.hooks[i] == nil {
-				return 0, fmt.Errorf("db: uninitialized hook (forgotten import db/runtime?)")
-			}
-			mut = acu.hooks[i](mut)
-		}
-		if _, err := mut.Mutate(ctx, acu.mutation); err != nil {
-			return 0, err
-		}
-	}
-	return affected, err
+func (_u *AuthCodeUpdate) Save(ctx context.Context) (int, error) {
+	return withHooks(ctx, _u.sqlSave, _u.mutation, _u.hooks)
 }
 
 // SaveX is like Save, but panics if an error occurs.
-func (acu *AuthCodeUpdate) SaveX(ctx context.Context) int {
-	affected, err := acu.Save(ctx)
+func (_u *AuthCodeUpdate) SaveX(ctx context.Context) int {
+	affected, err := _u.Save(ctx)
 	if err != nil {
 		panic(err)
 	}
@@ -213,51 +305,51 @@ func (acu *AuthCodeUpdate) SaveX(ctx context.Context) int {
 }
 
 // Exec executes the query.
-func (acu *AuthCodeUpdate) Exec(ctx context.Context) error {
-	_, err := acu.Save(ctx)
+func (_u *AuthCodeUpdate) Exec(ctx context.Context) error {
+	_, err := _u.Save(ctx)
 	return err
 }
 
 // ExecX is like Exec, but panics if an error occurs.
-func (acu *AuthCodeUpdate) ExecX(ctx context.Context) {
-	if err := acu.Exec(ctx); err != nil {
+func (_u *AuthCodeUpdate) ExecX(ctx context.Context) {
+	if err := _u.Exec(ctx); err != nil {
 		panic(err)
 	}
 }
 
 // check runs all checks and user-defined validators on the builder.
-func (acu *AuthCodeUpdate) check() error {
-	if v, ok := acu.mutation.ClientID(); ok {
+func (_u *AuthCodeUpdate) check() error {
+	if v, ok := _u.mutation.ClientID(); ok {
 		if err := authcode.ClientIDValidator(v); err != nil {
 			return &ValidationError{Name: "client_id", err: fmt.Errorf(`db: validator failed for field "AuthCode.client_id": %w`, err)}
 		}
 	}
-	if v, ok := acu.mutation.Nonce(); ok {
+	if v, ok := _u.mutation.Nonce(); ok {
 		if err := authcode.NonceValidator(v); err != nil {
 			return &ValidationError{Name: "nonce", err: fmt.Errorf(`db: validator failed for field "AuthCode.nonce": %w`, err)}
 		}
 	}
-	if v, ok := acu.mutation.RedirectURI(); ok {
+	if v, ok := _u.mutation.RedirectURI(); ok {
 		if err := authcode.RedirectURIValidator(v); err != nil {
 			return &ValidationError{Name: "redirect_uri", err: fmt.Errorf(`db: validator failed for field "AuthCode.redirect_uri": %w`, err)}
 		}
 	}
-	if v, ok := acu.mutation.ClaimsUserID(); ok {
+	if v, ok := _u.mutation.ClaimsUserID(); ok {
 		if err := authcode.ClaimsUserIDValidator(v); err != nil {
 			return &ValidationError{Name: "claims_user_id", err: fmt.Errorf(`db: validator failed for field "AuthCode.claims_user_id": %w`, err)}
 		}
 	}
-	if v, ok := acu.mutation.ClaimsUsername(); ok {
+	if v, ok := _u.mutation.ClaimsUsername(); ok {
 		if err := authcode.ClaimsUsernameValidator(v); err != nil {
 			return &ValidationError{Name: "claims_username", err: fmt.Errorf(`db: validator failed for field "AuthCode.claims_username": %w`, err)}
 		}
 	}
-	if v, ok := acu.mutation.ClaimsEmail(); ok {
+	if v, ok := _u.mutation.ClaimsEmail(); ok {
 		if err := authcode.ClaimsEmailValidator(v); err != nil {
 			return &ValidationError{Name: "claims_email", err: fmt.Errorf(`db: validator failed for field "AuthCode.claims_email": %w`, err)}
 		}
 	}
-	if v, ok := acu.mutation.ConnectorID(); ok {
+	if v, ok := _u.mutation.ConnectorID(); ok {
 		if err := authcode.ConnectorIDValidator(v); err != nil {
 			return &ValidationError{Name: "connector_id", err: fmt.Errorf(`db: validator failed for field "AuthCode.connector_id": %w`, err)}
 		}
@@ -265,148 +357,95 @@ func (acu *AuthCodeUpdate) check() error {
 	return nil
 }
 
-func (acu *AuthCodeUpdate) sqlSave(ctx context.Context) (n int, err error) {
-	_spec := &sqlgraph.UpdateSpec{
-		Node: &sqlgraph.NodeSpec{
-			Table:   authcode.Table,
-			Columns: authcode.Columns,
-			ID: &sqlgraph.FieldSpec{
-				Type:   field.TypeString,
-				Column: authcode.FieldID,
-			},
-		},
+func (_u *AuthCodeUpdate) sqlSave(ctx context.Context) (_node int, err error) {
+	if err := _u.check(); err != nil {
+		return _node, err
 	}
-	if ps := acu.mutation.predicates; len(ps) > 0 {
+	_spec := sqlgraph.NewUpdateSpec(authcode.Table, authcode.Columns, sqlgraph.NewFieldSpec(authcode.FieldID, field.TypeString))
+	if ps := _u.mutation.predicates; len(ps) > 0 {
 		_spec.Predicate = func(selector *sql.Selector) {
 			for i := range ps {
 				ps[i](selector)
 			}
 		}
 	}
-	if value, ok := acu.mutation.ClientID(); ok {
-		_spec.Fields.Set = append(_spec.Fields.Set, &sqlgraph.FieldSpec{
-			Type:   field.TypeString,
-			Value:  value,
-			Column: authcode.FieldClientID,
-		})
+	if value, ok := _u.mutation.ClientID(); ok {
+		_spec.SetField(authcode.FieldClientID, field.TypeString, value)
 	}
-	if value, ok := acu.mutation.Scopes(); ok {
-		_spec.Fields.Set = append(_spec.Fields.Set, &sqlgraph.FieldSpec{
-			Type:   field.TypeJSON,
-			Value:  value,
-			Column: authcode.FieldScopes,
-		})
+	if value, ok := _u.mutation.Scopes(); ok {
+		_spec.SetField(authcode.FieldScopes, field.TypeJSON, value)
 	}
-	if acu.mutation.ScopesCleared() {
-		_spec.Fields.Clear = append(_spec.Fields.Clear, &sqlgraph.FieldSpec{
-			Type:   field.TypeJSON,
-			Column: authcode.FieldScopes,
+	if value, ok := _u.mutation.AppendedScopes(); ok {
+		_spec.AddModifier(func(u *sql.UpdateBuilder) {
+			sqljson.Append(u, authcode.FieldScopes, value)
 		})
 	}
-	if value, ok := acu.mutation.Nonce(); ok {
-		_spec.Fields.Set = append(_spec.Fields.Set, &sqlgraph.FieldSpec{
-			Type:   field.TypeString,
-			Value:  value,
-			Column: authcode.FieldNonce,
-		})
+	if _u.mutation.ScopesCleared() {
+		_spec.ClearField(authcode.FieldScopes, field.TypeJSON)
 	}
-	if value, ok := acu.mutation.RedirectURI(); ok {
-		_spec.Fields.Set = append(_spec.Fields.Set, &sqlgraph.FieldSpec{
-			Type:   field.TypeString,
-			Value:  value,
-			Column: authcode.FieldRedirectURI,
-		})
+	if value, ok := _u.mutation.Nonce(); ok {
+		_spec.SetField(authcode.FieldNonce, field.TypeString, value)
 	}
-	if value, ok := acu.mutation.ClaimsUserID(); ok {
-		_spec.Fields.Set = append(_spec.Fields.Set, &sqlgraph.FieldSpec{
-			Type:   field.TypeString,
-			Value:  value,
-			Column: authcode.FieldClaimsUserID,
-		})
+	if value, ok := _u.mutation.RedirectURI(); ok {
+		_spec.SetField(authcode.FieldRedirectURI, field.TypeString, value)
 	}
-	if value, ok := acu.mutation.ClaimsUsername(); ok {
-		_spec.Fields.Set = append(_spec.Fields.Set, &sqlgraph.FieldSpec{
-			Type:   field.TypeString,
-			Value:  value,
-			Column: authcode.FieldClaimsUsername,
-		})
+	if value, ok := _u.mutation.ClaimsUserID(); ok {
+		_spec.SetField(authcode.FieldClaimsUserID, field.TypeString, value)
 	}
-	if value, ok := acu.mutation.ClaimsEmail(); ok {
-		_spec.Fields.Set = append(_spec.Fields.Set, &sqlgraph.FieldSpec{
-			Type:   field.TypeString,
-			Value:  value,
-			Column: authcode.FieldClaimsEmail,
-		})
+	if value, ok := _u.mutation.ClaimsUsername(); ok {
+		_spec.SetField(authcode.FieldClaimsUsername, field.TypeString, value)
 	}
-	if value, ok := acu.mutation.ClaimsEmailVerified(); ok {
-		_spec.Fields.Set = append(_spec.Fields.Set, &sqlgraph.FieldSpec{
-			Type:   field.TypeBool,
-			Value:  value,
-			Column: authcode.FieldClaimsEmailVerified,
-		})
+	if value, ok := _u.mutation.ClaimsEmail(); ok {
+		_spec.SetField(authcode.FieldClaimsEmail, field.TypeString, value)
 	}
-	if value, ok := acu.mutation.ClaimsGroups(); ok {
-		_spec.Fields.Set = append(_spec.Fields.Set, &sqlgraph.FieldSpec{
-			Type:   field.TypeJSON,
-			Value:  value,
-			Column: authcode.FieldClaimsGroups,
-		})
+	if value, ok := _u.mutation.ClaimsEmailVerified(); ok {
+		_spec.SetField(authcode.FieldClaimsEmailVerified, field.TypeBool, value)
 	}
-	if acu.mutation.ClaimsGroupsCleared() {
-		_spec.Fields.Clear = append(_spec.Fields.Clear, &sqlgraph.FieldSpec{
-			Type:   field.TypeJSON,
-			Column: authcode.FieldClaimsGroups,
-		})
+	if value, ok := _u.mutation.ClaimsGroups(); ok {
+		_spec.SetField(authcode.FieldClaimsGroups, field.TypeJSON, value)
 	}
-	if value, ok := acu.mutation.ClaimsPreferredUsername(); ok {
-		_spec.Fields.Set = append(_spec.Fields.Set, &sqlgraph.FieldSpec{
-			Type:   field.TypeString,
-			Value:  value,
-			Column: authcode.FieldClaimsPreferredUsername,
+	if value, ok := _u.mutation.AppendedClaimsGroups(); ok {
+		_spec.AddModifier(func(u *sql.UpdateBuilder) {
+			sqljson.Append(u, authcode.FieldClaimsGroups, value)
 		})
 	}
-	if value, ok := acu.mutation.ConnectorID(); ok {
-		_spec.Fields.Set = append(_spec.Fields.Set, &sqlgraph.FieldSpec{
-			Type:   field.TypeString,
-			Value:  value,
-			Column: authcode.FieldConnectorID,
-		})
+	if _u.mutation.ClaimsGroupsCleared() {
+		_spec.ClearField(authcode.FieldClaimsGroups, field.TypeJSON)
 	}
-	if value, ok := acu.mutation.ConnectorData(); ok {
-		_spec.Fields.Set = append(_spec.Fields.Set, &sqlgraph.FieldSpec{
-			Type:   field.TypeBytes,
-			Value:  value,
-			Column: authcode.FieldConnectorData,
-		})
+	if value, ok := _u.mutation.ClaimsPreferredUsername(); ok {
+		_spec.SetField(authcode.FieldClaimsPreferredUsername, field.TypeString, value)
 	}
-	if acu.mutation.ConnectorDataCleared() {
-		_spec.Fields.Clear = append(_spec.Fields.Clear, &sqlgraph.FieldSpec{
-			Type:   field.TypeBytes,
-			Column: authcode.FieldConnectorData,
-		})
+	if value, ok := _u.mutation.ConnectorID(); ok {
+		_spec.SetField(authcode.FieldConnectorID, field.TypeString, value)
 	}
-	if value, ok := acu.mutation.Expiry(); ok {
-		_spec.Fields.Set = append(_spec.Fields.Set, &sqlgraph.FieldSpec{
-			Type:   field.TypeTime,
-			Value:  value,
-			Column: authcode.FieldExpiry,
-		})
+	if value, ok := _u.mutation.ConnectorData(); ok {
+		_spec.SetField(authcode.FieldConnectorData, field.TypeBytes, value)
 	}
-	if value, ok := acu.mutation.CodeChallenge(); ok {
-		_spec.Fields.Set = append(_spec.Fields.Set, &sqlgraph.FieldSpec{
-			Type:   field.TypeString,
-			Value:  value,
-			Column: authcode.FieldCodeChallenge,
-		})
+	if _u.mutation.ConnectorDataCleared() {
+		_spec.ClearField(authcode.FieldConnectorData, field.TypeBytes)
 	}
-	if value, ok := acu.mutation.CodeChallengeMethod(); ok {
-		_spec.Fields.Set = append(_spec.Fields.Set, &sqlgraph.FieldSpec{
-			Type:   field.TypeString,
-			Value:  value,
-			Column: authcode.FieldCodeChallengeMethod,
-		})
+	if value, ok := _u.mutation.Expiry(); ok {
+		_spec.SetField(authcode.FieldExpiry, field.TypeTime, value)
 	}
-	if n, err = sqlgraph.UpdateNodes(ctx, acu.driver, _spec); err != nil {
+	if value, ok := _u.mutation.CodeChallenge(); ok {
+		_spec.SetField(authcode.FieldCodeChallenge, field.TypeString, value)
+	}
+	if value, ok := _u.mutation.CodeChallengeMethod(); ok {
+		_spec.SetField(authcode.FieldCodeChallengeMethod, field.TypeString, value)
+	}
+	if value, ok := _u.mutation.AuthTime(); ok {
+		_spec.SetField(authcode.FieldAuthTime, field.TypeTime, value)
+	}
+	if _u.mutation.AuthTimeCleared() {
+		_spec.ClearField(authcode.FieldAuthTime, field.TypeTime)
+	}
+	if value, ok := _u.mutation.SessionID(); ok {
+		_spec.SetField(authcode.FieldSessionID, field.TypeString, value)
+	}
+	if _u.mutation.SessionIDCleared() {
+		_spec.ClearField(authcode.FieldSessionID, field.TypeString)
+	}
+	if _node, err = sqlgraph.UpdateNodes(ctx, _u.driver, _spec); err != nil {
 		if _, ok := err.(*sqlgraph.NotFoundError); ok {
 			err = &NotFoundError{authcode.Label}
 		} else if sqlgraph.IsConstraintError(err) {
@@ -414,7 +453,8 @@ func (acu *AuthCodeUpdate) sqlSave(ctx context.Context) (n int, err error) {
 		}
 		return 0, err
 	}
-	return n, nil
+	_u.mutation.done = true
+	return _node, nil
 }
 
 // AuthCodeUpdateOne is the builder for updating a single AuthCode entity.
@@ -426,196 +466,287 @@ type AuthCodeUpdateOne struct {
 }
 
 // SetClientID sets the "client_id" field.
-func (acuo *AuthCodeUpdateOne) SetClientID(s string) *AuthCodeUpdateOne {
-	acuo.mutation.SetClientID(s)
-	return acuo
+func (_u *AuthCodeUpdateOne) SetClientID(v string) *AuthCodeUpdateOne {
+	_u.mutation.SetClientID(v)
+	return _u
+}
+
+// SetNillableClientID sets the "client_id" field if the given value is not nil.
+func (_u *AuthCodeUpdateOne) SetNillableClientID(v *string) *AuthCodeUpdateOne {
+	if v != nil {
+		_u.SetClientID(*v)
+	}
+	return _u
 }
 
 // SetScopes sets the "scopes" field.
-func (acuo *AuthCodeUpdateOne) SetScopes(s []string) *AuthCodeUpdateOne {
-	acuo.mutation.SetScopes(s)
-	return acuo
+func (_u *AuthCodeUpdateOne) SetScopes(v []string) *AuthCodeUpdateOne {
+	_u.mutation.SetScopes(v)
+	return _u
+}
+
+// AppendScopes appends value to the "scopes" field.
+func (_u *AuthCodeUpdateOne) AppendScopes(v []string) *AuthCodeUpdateOne {
+	_u.mutation.AppendScopes(v)
+	return _u
 }
 
 // ClearScopes clears the value of the "scopes" field.
-func (acuo *AuthCodeUpdateOne) ClearScopes() *AuthCodeUpdateOne {
-	acuo.mutation.ClearScopes()
-	return acuo
+func (_u *AuthCodeUpdateOne) ClearScopes() *AuthCodeUpdateOne {
+	_u.mutation.ClearScopes()
+	return _u
 }
 
 // SetNonce sets the "nonce" field.
-func (acuo *AuthCodeUpdateOne) SetNonce(s string) *AuthCodeUpdateOne {
-	acuo.mutation.SetNonce(s)
-	return acuo
+func (_u *AuthCodeUpdateOne) SetNonce(v string) *AuthCodeUpdateOne {
+	_u.mutation.SetNonce(v)
+	return _u
+}
+
+// SetNillableNonce sets the "nonce" field if the given value is not nil.
+func (_u *AuthCodeUpdateOne) SetNillableNonce(v *string) *AuthCodeUpdateOne {
+	if v != nil {
+		_u.SetNonce(*v)
+	}
+	return _u
 }
 
 // SetRedirectURI sets the "redirect_uri" field.
-func (acuo *AuthCodeUpdateOne) SetRedirectURI(s string) *AuthCodeUpdateOne {
-	acuo.mutation.SetRedirectURI(s)
-	return acuo
+func (_u *AuthCodeUpdateOne) SetRedirectURI(v string) *AuthCodeUpdateOne {
+	_u.mutation.SetRedirectURI(v)
+	return _u
+}
+
+// SetNillableRedirectURI sets the "redirect_uri" field if the given value is not nil.
+func (_u *AuthCodeUpdateOne) SetNillableRedirectURI(v *string) *AuthCodeUpdateOne {
+	if v != nil {
+		_u.SetRedirectURI(*v)
+	}
+	return _u
 }
 
 // SetClaimsUserID sets the "claims_user_id" field.
-func (acuo *AuthCodeUpdateOne) SetClaimsUserID(s string) *AuthCodeUpdateOne {
-	acuo.mutation.SetClaimsUserID(s)
-	return acuo
+func (_u *AuthCodeUpdateOne) SetClaimsUserID(v string) *AuthCodeUpdateOne {
+	_u.mutation.SetClaimsUserID(v)
+	return _u
+}
+
+// SetNillableClaimsUserID sets the "claims_user_id" field if the given value is not nil.
+func (_u *AuthCodeUpdateOne) SetNillableClaimsUserID(v *string) *AuthCodeUpdateOne {
+	if v != nil {
+		_u.SetClaimsUserID(*v)
+	}
+	return _u
 }
 
 // SetClaimsUsername sets the "claims_username" field.
-func (acuo *AuthCodeUpdateOne) SetClaimsUsername(s string) *AuthCodeUpdateOne {
-	acuo.mutation.SetClaimsUsername(s)
-	return acuo
+func (_u *AuthCodeUpdateOne) SetClaimsUsername(v string) *AuthCodeUpdateOne {
+	_u.mutation.SetClaimsUsername(v)
+	return _u
+}
+
+// SetNillableClaimsUsername sets the "claims_username" field if the given value is not nil.
+func (_u *AuthCodeUpdateOne) SetNillableClaimsUsername(v *string) *AuthCodeUpdateOne {
+	if v != nil {
+		_u.SetClaimsUsername(*v)
+	}
+	return _u
 }
 
 // SetClaimsEmail sets the "claims_email" field.
-func (acuo *AuthCodeUpdateOne) SetClaimsEmail(s string) *AuthCodeUpdateOne {
-	acuo.mutation.SetClaimsEmail(s)
-	return acuo
+func (_u *AuthCodeUpdateOne) SetClaimsEmail(v string) *AuthCodeUpdateOne {
+	_u.mutation.SetClaimsEmail(v)
+	return _u
+}
+
+// SetNillableClaimsEmail sets the "claims_email" field if the given value is not nil.
+func (_u *AuthCodeUpdateOne) SetNillableClaimsEmail(v *string) *AuthCodeUpdateOne {
+	if v != nil {
+		_u.SetClaimsEmail(*v)
+	}
+	return _u
 }
 
 // SetClaimsEmailVerified sets the "claims_email_verified" field.
-func (acuo *AuthCodeUpdateOne) SetClaimsEmailVerified(b bool) *AuthCodeUpdateOne {
-	acuo.mutation.SetClaimsEmailVerified(b)
-	return acuo
+func (_u *AuthCodeUpdateOne) SetClaimsEmailVerified(v bool) *AuthCodeUpdateOne {
+	_u.mutation.SetClaimsEmailVerified(v)
+	return _u
+}
+
+// SetNillableClaimsEmailVerified sets the "claims_email_verified" field if the given value is not nil.
+func (_u *AuthCodeUpdateOne) SetNillableClaimsEmailVerified(v *bool) *AuthCodeUpdateOne {
+	if v != nil {
+		_u.SetClaimsEmailVerified(*v)
+	}
+	return _u
 }
 
 // SetClaimsGroups sets the "claims_groups" field.
-func (acuo *AuthCodeUpdateOne) SetClaimsGroups(s []string) *AuthCodeUpdateOne {
-	acuo.mutation.SetClaimsGroups(s)
-	return acuo
+func (_u *AuthCodeUpdateOne) SetClaimsGroups(v []string) *AuthCodeUpdateOne {
+	_u.mutation.SetClaimsGroups(v)
+	return _u
+}
+
+// AppendClaimsGroups appends value to the "claims_groups" field.
+func (_u *AuthCodeUpdateOne) AppendClaimsGroups(v []string) *AuthCodeUpdateOne {
+	_u.mutation.AppendClaimsGroups(v)
+	return _u
 }
 
 // ClearClaimsGroups clears the value of the "claims_groups" field.
-func (acuo *AuthCodeUpdateOne) ClearClaimsGroups() *AuthCodeUpdateOne {
-	acuo.mutation.ClearClaimsGroups()
-	return acuo
+func (_u *AuthCodeUpdateOne) ClearClaimsGroups() *AuthCodeUpdateOne {
+	_u.mutation.ClearClaimsGroups()
+	return _u
 }
 
 // SetClaimsPreferredUsername sets the "claims_preferred_username" field.
-func (acuo *AuthCodeUpdateOne) SetClaimsPreferredUsername(s string) *AuthCodeUpdateOne {
-	acuo.mutation.SetClaimsPreferredUsername(s)
-	return acuo
+func (_u *AuthCodeUpdateOne) SetClaimsPreferredUsername(v string) *AuthCodeUpdateOne {
+	_u.mutation.SetClaimsPreferredUsername(v)
+	return _u
 }
 
 // SetNillableClaimsPreferredUsername sets the "claims_preferred_username" field if the given value is not nil.
-func (acuo *AuthCodeUpdateOne) SetNillableClaimsPreferredUsername(s *string) *AuthCodeUpdateOne {
-	if s != nil {
-		acuo.SetClaimsPreferredUsername(*s)
+func (_u *AuthCodeUpdateOne) SetNillableClaimsPreferredUsername(v *string) *AuthCodeUpdateOne {
+	if v != nil {
+		_u.SetClaimsPreferredUsername(*v)
 	}
-	return acuo
+	return _u
 }
 
 // SetConnectorID sets the "connector_id" field.
-func (acuo *AuthCodeUpdateOne) SetConnectorID(s string) *AuthCodeUpdateOne {
-	acuo.mutation.SetConnectorID(s)
-	return acuo
+func (_u *AuthCodeUpdateOne) SetConnectorID(v string) *AuthCodeUpdateOne {
+	_u.mutation.SetConnectorID(v)
+	return _u
+}
+
+// SetNillableConnectorID sets the "connector_id" field if the given value is not nil.
+func (_u *AuthCodeUpdateOne) SetNillableConnectorID(v *string) *AuthCodeUpdateOne {
+	if v != nil {
+		_u.SetConnectorID(*v)
+	}
+	return _u
 }
 
 // SetConnectorData sets the "connector_data" field.
-func (acuo *AuthCodeUpdateOne) SetConnectorData(b []byte) *AuthCodeUpdateOne {
-	acuo.mutation.SetConnectorData(b)
-	return acuo
+func (_u *AuthCodeUpdateOne) SetConnectorData(v []byte) *AuthCodeUpdateOne {
+	_u.mutation.SetConnectorData(v)
+	return _u
 }
 
 // ClearConnectorData clears the value of the "connector_data" field.
-func (acuo *AuthCodeUpdateOne) ClearConnectorData() *AuthCodeUpdateOne {
-	acuo.mutation.ClearConnectorData()
-	return acuo
+func (_u *AuthCodeUpdateOne) ClearConnectorData() *AuthCodeUpdateOne {
+	_u.mutation.ClearConnectorData()
+	return _u
 }
 
 // SetExpiry sets the "expiry" field.
-func (acuo *AuthCodeUpdateOne) SetExpiry(t time.Time) *AuthCodeUpdateOne {
-	acuo.mutation.SetExpiry(t)
-	return acuo
+func (_u *AuthCodeUpdateOne) SetExpiry(v time.Time) *AuthCodeUpdateOne {
+	_u.mutation.SetExpiry(v)
+	return _u
+}
+
+// SetNillableExpiry sets the "expiry" field if the given value is not nil.
+func (_u *AuthCodeUpdateOne) SetNillableExpiry(v *time.Time) *AuthCodeUpdateOne {
+	if v != nil {
+		_u.SetExpiry(*v)
+	}
+	return _u
 }
 
 // SetCodeChallenge sets the "code_challenge" field.
-func (acuo *AuthCodeUpdateOne) SetCodeChallenge(s string) *AuthCodeUpdateOne {
-	acuo.mutation.SetCodeChallenge(s)
-	return acuo
+func (_u *AuthCodeUpdateOne) SetCodeChallenge(v string) *AuthCodeUpdateOne {
+	_u.mutation.SetCodeChallenge(v)
+	return _u
 }
 
 // SetNillableCodeChallenge sets the "code_challenge" field if the given value is not nil.
-func (acuo *AuthCodeUpdateOne) SetNillableCodeChallenge(s *string) *AuthCodeUpdateOne {
-	if s != nil {
-		acuo.SetCodeChallenge(*s)
+func (_u *AuthCodeUpdateOne) SetNillableCodeChallenge(v *string) *AuthCodeUpdateOne {
+	if v != nil {
+		_u.SetCodeChallenge(*v)
 	}
-	return acuo
+	return _u
 }
 
 // SetCodeChallengeMethod sets the "code_challenge_method" field.
-func (acuo *AuthCodeUpdateOne) SetCodeChallengeMethod(s string) *AuthCodeUpdateOne {
-	acuo.mutation.SetCodeChallengeMethod(s)
-	return acuo
+func (_u *AuthCodeUpdateOne) SetCodeChallengeMethod(v string) *AuthCodeUpdateOne {
+	_u.mutation.SetCodeChallengeMethod(v)
+	return _u
 }
 
 // SetNillableCodeChallengeMethod sets the "code_challenge_method" field if the given value is not nil.
-func (acuo *AuthCodeUpdateOne) SetNillableCodeChallengeMethod(s *string) *AuthCodeUpdateOne {
-	if s != nil {
-		acuo.SetCodeChallengeMethod(*s)
+func (_u *AuthCodeUpdateOne) SetNillableCodeChallengeMethod(v *string) *AuthCodeUpdateOne {
+	if v != nil {
+		_u.SetCodeChallengeMethod(*v)
 	}
-	return acuo
+	return _u
+}
+
+// SetAuthTime sets the "auth_time" field.
+func (_u *AuthCodeUpdateOne) SetAuthTime(v time.Time) *AuthCodeUpdateOne {
+	_u.mutation.SetAuthTime(v)
+	return _u
+}
+
+// SetNillableAuthTime sets the "auth_time" field if the given value is not nil.
+func (_u *AuthCodeUpdateOne) SetNillableAuthTime(v *time.Time) *AuthCodeUpdateOne {
+	if v != nil {
+		_u.SetAuthTime(*v)
+	}
+	return _u
+}
+
+// ClearAuthTime clears the value of the "auth_time" field.
+func (_u *AuthCodeUpdateOne) ClearAuthTime() *AuthCodeUpdateOne {
+	_u.mutation.ClearAuthTime()
+	return _u
+}
+
+// SetSessionID sets the "session_id" field.
+func (_u *AuthCodeUpdateOne) SetSessionID(v string) *AuthCodeUpdateOne {
+	_u.mutation.SetSessionID(v)
+	return _u
+}
+
+// SetNillableSessionID sets the "session_id" field if the given value is not nil.
+func (_u *AuthCodeUpdateOne) SetNillableSessionID(v *string) *AuthCodeUpdateOne {
+	if v != nil {
+		_u.SetSessionID(*v)
+	}
+	return _u
+}
+
+// ClearSessionID clears the value of the "session_id" field.
+func (_u *AuthCodeUpdateOne) ClearSessionID() *AuthCodeUpdateOne {
+	_u.mutation.ClearSessionID()
+	return _u
 }
 
 // Mutation returns the AuthCodeMutation object of the builder.
-func (acuo *AuthCodeUpdateOne) Mutation() *AuthCodeMutation {
-	return acuo.mutation
+func (_u *AuthCodeUpdateOne) Mutation() *AuthCodeMutation {
+	return _u.mutation
+}
+
+// Where appends a list predicates to the AuthCodeUpdate builder.
+func (_u *AuthCodeUpdateOne) Where(ps ...predicate.AuthCode) *AuthCodeUpdateOne {
+	_u.mutation.Where(ps...)
+	return _u
 }
 
 // Select allows selecting one or more fields (columns) of the returned entity.
 // The default is selecting all fields defined in the entity schema.
-func (acuo *AuthCodeUpdateOne) Select(field string, fields ...string) *AuthCodeUpdateOne {
-	acuo.fields = append([]string{field}, fields...)
-	return acuo
+func (_u *AuthCodeUpdateOne) Select(field string, fields ...string) *AuthCodeUpdateOne {
+	_u.fields = append([]string{field}, fields...)
+	return _u
 }
 
 // Save executes the query and returns the updated AuthCode entity.
-func (acuo *AuthCodeUpdateOne) Save(ctx context.Context) (*AuthCode, error) {
-	var (
-		err  error
-		node *AuthCode
-	)
-	if len(acuo.hooks) == 0 {
-		if err = acuo.check(); err != nil {
-			return nil, err
-		}
-		node, err = acuo.sqlSave(ctx)
-	} else {
-		var mut Mutator = MutateFunc(func(ctx context.Context, m Mutation) (Value, error) {
-			mutation, ok := m.(*AuthCodeMutation)
-			if !ok {
-				return nil, fmt.Errorf("unexpected mutation type %T", m)
-			}
-			if err = acuo.check(); err != nil {
-				return nil, err
-			}
-			acuo.mutation = mutation
-			node, err = acuo.sqlSave(ctx)
-			mutation.done = true
-			return node, err
-		})
-		for i := len(acuo.hooks) - 1; i >= 0; i-- {
-			if acuo.hooks[i] == nil {
-				return nil, fmt.Errorf("db: uninitialized hook (forgotten import db/runtime?)")
-			}
-			mut = acuo.hooks[i](mut)
-		}
-		v, err := mut.Mutate(ctx, acuo.mutation)
-		if err != nil {
-			return nil, err
-		}
-		nv, ok := v.(*AuthCode)
-		if !ok {
-			return nil, fmt.Errorf("unexpected node type %T returned from AuthCodeMutation", v)
-		}
-		node = nv
-	}
-	return node, err
+func (_u *AuthCodeUpdateOne) Save(ctx context.Context) (*AuthCode, error) {
+	return withHooks(ctx, _u.sqlSave, _u.mutation, _u.hooks)
 }
 
 // SaveX is like Save, but panics if an error occurs.
-func (acuo *AuthCodeUpdateOne) SaveX(ctx context.Context) *AuthCode {
-	node, err := acuo.Save(ctx)
+func (_u *AuthCodeUpdateOne) SaveX(ctx context.Context) *AuthCode {
+	node, err := _u.Save(ctx)
 	if err != nil {
 		panic(err)
 	}
@@ -623,51 +754,51 @@ func (acuo *AuthCodeUpdateOne) SaveX(ctx context.Context) *AuthCode {
 }
 
 // Exec executes the query on the entity.
-func (acuo *AuthCodeUpdateOne) Exec(ctx context.Context) error {
-	_, err := acuo.Save(ctx)
+func (_u *AuthCodeUpdateOne) Exec(ctx context.Context) error {
+	_, err := _u.Save(ctx)
 	return err
 }
 
 // ExecX is like Exec, but panics if an error occurs.
-func (acuo *AuthCodeUpdateOne) ExecX(ctx context.Context) {
-	if err := acuo.Exec(ctx); err != nil {
+func (_u *AuthCodeUpdateOne) ExecX(ctx context.Context) {
+	if err := _u.Exec(ctx); err != nil {
 		panic(err)
 	}
 }
 
 // check runs all checks and user-defined validators on the builder.
-func (acuo *AuthCodeUpdateOne) check() error {
-	if v, ok := acuo.mutation.ClientID(); ok {
+func (_u *AuthCodeUpdateOne) check() error {
+	if v, ok := _u.mutation.ClientID(); ok {
 		if err := authcode.ClientIDValidator(v); err != nil {
 			return &ValidationError{Name: "client_id", err: fmt.Errorf(`db: validator failed for field "AuthCode.client_id": %w`, err)}
 		}
 	}
-	if v, ok := acuo.mutation.Nonce(); ok {
+	if v, ok := _u.mutation.Nonce(); ok {
 		if err := authcode.NonceValidator(v); err != nil {
 			return &ValidationError{Name: "nonce", err: fmt.Errorf(`db: validator failed for field "AuthCode.nonce": %w`, err)}
 		}
 	}
-	if v, ok := acuo.mutation.RedirectURI(); ok {
+	if v, ok := _u.mutation.RedirectURI(); ok {
 		if err := authcode.RedirectURIValidator(v); err != nil {
 			return &ValidationError{Name: "redirect_uri", err: fmt.Errorf(`db: validator failed for field "AuthCode.redirect_uri": %w`, err)}
 		}
 	}
-	if v, ok := acuo.mutation.ClaimsUserID(); ok {
+	if v, ok := _u.mutation.ClaimsUserID(); ok {
 		if err := authcode.ClaimsUserIDValidator(v); err != nil {
 			return &ValidationError{Name: "claims_user_id", err: fmt.Errorf(`db: validator failed for field "AuthCode.claims_user_id": %w`, err)}
 		}
 	}
-	if v, ok := acuo.mutation.ClaimsUsername(); ok {
+	if v, ok := _u.mutation.ClaimsUsername(); ok {
 		if err := authcode.ClaimsUsernameValidator(v); err != nil {
 			return &ValidationError{Name: "claims_username", err: fmt.Errorf(`db: validator failed for field "AuthCode.claims_username": %w`, err)}
 		}
 	}
-	if v, ok := acuo.mutation.ClaimsEmail(); ok {
+	if v, ok := _u.mutation.ClaimsEmail(); ok {
 		if err := authcode.ClaimsEmailValidator(v); err != nil {
 			return &ValidationError{Name: "claims_email", err: fmt.Errorf(`db: validator failed for field "AuthCode.claims_email": %w`, err)}
 		}
 	}
-	if v, ok := acuo.mutation.ConnectorID(); ok {
+	if v, ok := _u.mutation.ConnectorID(); ok {
 		if err := authcode.ConnectorIDValidator(v); err != nil {
 			return &ValidationError{Name: "connector_id", err: fmt.Errorf(`db: validator failed for field "AuthCode.connector_id": %w`, err)}
 		}
@@ -675,23 +806,17 @@ func (acuo *AuthCodeUpdateOne) check() error {
 	return nil
 }
 
-func (acuo *AuthCodeUpdateOne) sqlSave(ctx context.Context) (_node *AuthCode, err error) {
-	_spec := &sqlgraph.UpdateSpec{
-		Node: &sqlgraph.NodeSpec{
-			Table:   authcode.Table,
-			Columns: authcode.Columns,
-			ID: &sqlgraph.FieldSpec{
-				Type:   field.TypeString,
-				Column: authcode.FieldID,
-			},
-		},
+func (_u *AuthCodeUpdateOne) sqlSave(ctx context.Context) (_node *AuthCode, err error) {
+	if err := _u.check(); err != nil {
+		return _node, err
 	}
-	id, ok := acuo.mutation.ID()
+	_spec := sqlgraph.NewUpdateSpec(authcode.Table, authcode.Columns, sqlgraph.NewFieldSpec(authcode.FieldID, field.TypeString))
+	id, ok := _u.mutation.ID()
 	if !ok {
 		return nil, &ValidationError{Name: "id", err: errors.New(`db: missing "AuthCode.id" for update`)}
 	}
 	_spec.Node.ID.Value = id
-	if fields := acuo.fields; len(fields) > 0 {
+	if fields := _u.fields; len(fields) > 0 {
 		_spec.Node.Columns = make([]string, 0, len(fields))
 		_spec.Node.Columns = append(_spec.Node.Columns, authcode.FieldID)
 		for _, f := range fields {
@@ -703,140 +828,93 @@ func (acuo *AuthCodeUpdateOne) sqlSave(ctx context.Context) (_node *AuthCode, er
 			}
 		}
 	}
-	if ps := acuo.mutation.predicates; len(ps) > 0 {
+	if ps := _u.mutation.predicates; len(ps) > 0 {
 		_spec.Predicate = func(selector *sql.Selector) {
 			for i := range ps {
 				ps[i](selector)
 			}
 		}
 	}
-	if value, ok := acuo.mutation.ClientID(); ok {
-		_spec.Fields.Set = append(_spec.Fields.Set, &sqlgraph.FieldSpec{
-			Type:   field.TypeString,
-			Value:  value,
-			Column: authcode.FieldClientID,
-		})
+	if value, ok := _u.mutation.ClientID(); ok {
+		_spec.SetField(authcode.FieldClientID, field.TypeString, value)
 	}
-	if value, ok := acuo.mutation.Scopes(); ok {
-		_spec.Fields.Set = append(_spec.Fields.Set, &sqlgraph.FieldSpec{
-			Type:   field.TypeJSON,
-			Value:  value,
-			Column: authcode.FieldScopes,
-		})
+	if value, ok := _u.mutation.Scopes(); ok {
+		_spec.SetField(authcode.FieldScopes, field.TypeJSON, value)
 	}
-	if acuo.mutation.ScopesCleared() {
-		_spec.Fields.Clear = append(_spec.Fields.Clear, &sqlgraph.FieldSpec{
-			Type:   field.TypeJSON,
-			Column: authcode.FieldScopes,
+	if value, ok := _u.mutation.AppendedScopes(); ok {
+		_spec.AddModifier(func(u *sql.UpdateBuilder) {
+			sqljson.Append(u, authcode.FieldScopes, value)
 		})
 	}
-	if value, ok := acuo.mutation.Nonce(); ok {
-		_spec.Fields.Set = append(_spec.Fields.Set, &sqlgraph.FieldSpec{
-			Type:   field.TypeString,
-			Value:  value,
-			Column: authcode.FieldNonce,
-		})
+	if _u.mutation.ScopesCleared() {
+		_spec.ClearField(authcode.FieldScopes, field.TypeJSON)
 	}
-	if value, ok := acuo.mutation.RedirectURI(); ok {
-		_spec.Fields.Set = append(_spec.Fields.Set, &sqlgraph.FieldSpec{
-			Type:   field.TypeString,
-			Value:  value,
-			Column: authcode.FieldRedirectURI,
-		})
+	if value, ok := _u.mutation.Nonce(); ok {
+		_spec.SetField(authcode.FieldNonce, field.TypeString, value)
 	}
-	if value, ok := acuo.mutation.ClaimsUserID(); ok {
-		_spec.Fields.Set = append(_spec.Fields.Set, &sqlgraph.FieldSpec{
-			Type:   field.TypeString,
-			Value:  value,
-			Column: authcode.FieldClaimsUserID,
-		})
+	if value, ok := _u.mutation.RedirectURI(); ok {
+		_spec.SetField(authcode.FieldRedirectURI, field.TypeString, value)
 	}
-	if value, ok := acuo.mutation.ClaimsUsername(); ok {
-		_spec.Fields.Set = append(_spec.Fields.Set, &sqlgraph.FieldSpec{
-			Type:   field.TypeString,
-			Value:  value,
-			Column: authcode.FieldClaimsUsername,
-		})
+	if value, ok := _u.mutation.ClaimsUserID(); ok {
+		_spec.SetField(authcode.FieldClaimsUserID, field.TypeString, value)
 	}
-	if value, ok := acuo.mutation.ClaimsEmail(); ok {
-		_spec.Fields.Set = append(_spec.Fields.Set, &sqlgraph.FieldSpec{
-			Type:   field.TypeString,
-			Value:  value,
-			Column: authcode.FieldClaimsEmail,
-		})
+	if value, ok := _u.mutation.ClaimsUsername(); ok {
+		_spec.SetField(authcode.FieldClaimsUsername, field.TypeString, value)
 	}
-	if value, ok := acuo.mutation.ClaimsEmailVerified(); ok {
-		_spec.Fields.Set = append(_spec.Fields.Set, &sqlgraph.FieldSpec{
-			Type:   field.TypeBool,
-			Value:  value,
-			Column: authcode.FieldClaimsEmailVerified,
-		})
+	if value, ok := _u.mutation.ClaimsEmail(); ok {
+		_spec.SetField(authcode.FieldClaimsEmail, field.TypeString, value)
 	}
-	if value, ok := acuo.mutation.ClaimsGroups(); ok {
-		_spec.Fields.Set = append(_spec.Fields.Set, &sqlgraph.FieldSpec{
-			Type:   field.TypeJSON,
-			Value:  value,
-			Column: authcode.FieldClaimsGroups,
-		})
+	if value, ok := _u.mutation.ClaimsEmailVerified(); ok {
+		_spec.SetField(authcode.FieldClaimsEmailVerified, field.TypeBool, value)
 	}
-	if acuo.mutation.ClaimsGroupsCleared() {
-		_spec.Fields.Clear = append(_spec.Fields.Clear, &sqlgraph.FieldSpec{
-			Type:   field.TypeJSON,
-			Column: authcode.FieldClaimsGroups,
-		})
+	if value, ok := _u.mutation.ClaimsGroups(); ok {
+		_spec.SetField(authcode.FieldClaimsGroups, field.TypeJSON, value)
 	}
-	if value, ok := acuo.mutation.ClaimsPreferredUsername(); ok {
-		_spec.Fields.Set = append(_spec.Fields.Set, &sqlgraph.FieldSpec{
-			Type:   field.TypeString,
-			Value:  value,
-			Column: authcode.FieldClaimsPreferredUsername,
+	if value, ok := _u.mutation.AppendedClaimsGroups(); ok {
+		_spec.AddModifier(func(u *sql.UpdateBuilder) {
+			sqljson.Append(u, authcode.FieldClaimsGroups, value)
 		})
 	}
-	if value, ok := acuo.mutation.ConnectorID(); ok {
-		_spec.Fields.Set = append(_spec.Fields.Set, &sqlgraph.FieldSpec{
-			Type:   field.TypeString,
-			Value:  value,
-			Column: authcode.FieldConnectorID,
-		})
+	if _u.mutation.ClaimsGroupsCleared() {
+		_spec.ClearField(authcode.FieldClaimsGroups, field.TypeJSON)
 	}
-	if value, ok := acuo.mutation.ConnectorData(); ok {
-		_spec.Fields.Set = append(_spec.Fields.Set, &sqlgraph.FieldSpec{
-			Type:   field.TypeBytes,
-			Value:  value,
-			Column: authcode.FieldConnectorData,
-		})
+	if value, ok := _u.mutation.ClaimsPreferredUsername(); ok {
+		_spec.SetField(authcode.FieldClaimsPreferredUsername, field.TypeString, value)
 	}
-	if acuo.mutation.ConnectorDataCleared() {
-		_spec.Fields.Clear = append(_spec.Fields.Clear, &sqlgraph.FieldSpec{
-			Type:   field.TypeBytes,
-			Column: authcode.FieldConnectorData,
-		})
+	if value, ok := _u.mutation.ConnectorID(); ok {
+		_spec.SetField(authcode.FieldConnectorID, field.TypeString, value)
 	}
-	if value, ok := acuo.mutation.Expiry(); ok {
-		_spec.Fields.Set = append(_spec.Fields.Set, &sqlgraph.FieldSpec{
-			Type:   field.TypeTime,
-			Value:  value,
-			Column: authcode.FieldExpiry,
-		})
+	if value, ok := _u.mutation.ConnectorData(); ok {
+		_spec.SetField(authcode.FieldConnectorData, field.TypeBytes, value)
 	}
-	if value, ok := acuo.mutation.CodeChallenge(); ok {
-		_spec.Fields.Set = append(_spec.Fields.Set, &sqlgraph.FieldSpec{
-			Type:   field.TypeString,
-			Value:  value,
-			Column: authcode.FieldCodeChallenge,
-		})
+	if _u.mutation.ConnectorDataCleared() {
+		_spec.ClearField(authcode.FieldConnectorData, field.TypeBytes)
 	}
-	if value, ok := acuo.mutation.CodeChallengeMethod(); ok {
-		_spec.Fields.Set = append(_spec.Fields.Set, &sqlgraph.FieldSpec{
-			Type:   field.TypeString,
-			Value:  value,
-			Column: authcode.FieldCodeChallengeMethod,
-		})
+	if value, ok := _u.mutation.Expiry(); ok {
+		_spec.SetField(authcode.FieldExpiry, field.TypeTime, value)
+	}
+	if value, ok := _u.mutation.CodeChallenge(); ok {
+		_spec.SetField(authcode.FieldCodeChallenge, field.TypeString, value)
+	}
+	if value, ok := _u.mutation.CodeChallengeMethod(); ok {
+		_spec.SetField(authcode.FieldCodeChallengeMethod, field.TypeString, value)
+	}
+	if value, ok := _u.mutation.AuthTime(); ok {
+		_spec.SetField(authcode.FieldAuthTime, field.TypeTime, value)
+	}
+	if _u.mutation.AuthTimeCleared() {
+		_spec.ClearField(authcode.FieldAuthTime, field.TypeTime)
+	}
+	if value, ok := _u.mutation.SessionID(); ok {
+		_spec.SetField(authcode.FieldSessionID, field.TypeString, value)
+	}
+	if _u.mutation.SessionIDCleared() {
+		_spec.ClearField(authcode.FieldSessionID, field.TypeString)
 	}
-	_node = &AuthCode{config: acuo.config}
+	_node = &AuthCode{config: _u.config}
 	_spec.Assign = _node.assignValues
 	_spec.ScanValues = _node.scanValues
-	if err = sqlgraph.UpdateNode(ctx, acuo.driver, _spec); err != nil {
+	if err = sqlgraph.UpdateNode(ctx, _u.driver, _spec); err != nil {
 		if _, ok := err.(*sqlgraph.NotFoundError); ok {
 			err = &NotFoundError{authcode.Label}
 		} else if sqlgraph.IsConstraintError(err) {
@@ -844,5 +922,6 @@ func (acuo *AuthCodeUpdateOne) sqlSave(ctx context.Context) (_node *AuthCode, er
 		}
 		return nil, err
 	}
+	_u.mutation.done = true
 	return _node, nil
 }
diff --git a/storage/ent/db/authrequest.go b/storage/ent/db/authrequest.go
index ecef32d789..938b9e7828 100644
--- a/storage/ent/db/authrequest.go
+++ b/storage/ent/db/authrequest.go
@@ -8,6 +8,7 @@ import (
 	"strings"
 	"time"
 
+	"entgo.io/ent"
 	"entgo.io/ent/dialect/sql"
 	"github.com/dexidp/dex/storage/ent/db/authrequest"
 )
@@ -55,23 +56,38 @@ type AuthRequest struct {
 	CodeChallenge string `json:"code_challenge,omitempty"`
 	// CodeChallengeMethod holds the value of the "code_challenge_method" field.
 	CodeChallengeMethod string `json:"code_challenge_method,omitempty"`
+	// HmacKey holds the value of the "hmac_key" field.
+	HmacKey []byte `json:"hmac_key,omitempty"`
+	// MfaValidated holds the value of the "mfa_validated" field.
+	MfaValidated bool `json:"mfa_validated,omitempty"`
+	// WebauthnSessionData holds the value of the "webauthn_session_data" field.
+	WebauthnSessionData *[]byte `json:"webauthn_session_data,omitempty"`
+	// Prompt holds the value of the "prompt" field.
+	Prompt string `json:"prompt,omitempty"`
+	// MaxAge holds the value of the "max_age" field.
+	MaxAge int `json:"max_age,omitempty"`
+	// AuthTime holds the value of the "auth_time" field.
+	AuthTime     time.Time `json:"auth_time,omitempty"`
+	selectValues sql.SelectValues
 }
 
 // scanValues returns the types for scanning values from sql.Rows.
-func (*AuthRequest) scanValues(columns []string) ([]interface{}, error) {
-	values := make([]interface{}, len(columns))
+func (*AuthRequest) scanValues(columns []string) ([]any, error) {
+	values := make([]any, len(columns))
 	for i := range columns {
 		switch columns[i] {
-		case authrequest.FieldScopes, authrequest.FieldResponseTypes, authrequest.FieldClaimsGroups, authrequest.FieldConnectorData:
+		case authrequest.FieldScopes, authrequest.FieldResponseTypes, authrequest.FieldClaimsGroups, authrequest.FieldConnectorData, authrequest.FieldHmacKey, authrequest.FieldWebauthnSessionData:
 			values[i] = new([]byte)
-		case authrequest.FieldForceApprovalPrompt, authrequest.FieldLoggedIn, authrequest.FieldClaimsEmailVerified:
+		case authrequest.FieldForceApprovalPrompt, authrequest.FieldLoggedIn, authrequest.FieldClaimsEmailVerified, authrequest.FieldMfaValidated:
 			values[i] = new(sql.NullBool)
-		case authrequest.FieldID, authrequest.FieldClientID, authrequest.FieldRedirectURI, authrequest.FieldNonce, authrequest.FieldState, authrequest.FieldClaimsUserID, authrequest.FieldClaimsUsername, authrequest.FieldClaimsEmail, authrequest.FieldClaimsPreferredUsername, authrequest.FieldConnectorID, authrequest.FieldCodeChallenge, authrequest.FieldCodeChallengeMethod:
+		case authrequest.FieldMaxAge:
+			values[i] = new(sql.NullInt64)
+		case authrequest.FieldID, authrequest.FieldClientID, authrequest.FieldRedirectURI, authrequest.FieldNonce, authrequest.FieldState, authrequest.FieldClaimsUserID, authrequest.FieldClaimsUsername, authrequest.FieldClaimsEmail, authrequest.FieldClaimsPreferredUsername, authrequest.FieldConnectorID, authrequest.FieldCodeChallenge, authrequest.FieldCodeChallengeMethod, authrequest.FieldPrompt:
 			values[i] = new(sql.NullString)
-		case authrequest.FieldExpiry:
+		case authrequest.FieldExpiry, authrequest.FieldAuthTime:
 			values[i] = new(sql.NullTime)
 		default:
-			return nil, fmt.Errorf("unexpected column %q for type AuthRequest", columns[i])
+			values[i] = new(sql.UnknownType)
 		}
 	}
 	return values, nil
@@ -79,7 +95,7 @@ func (*AuthRequest) scanValues(columns []string) ([]interface{}, error) {
 
 // assignValues assigns the values that were returned from sql.Rows (after scanning)
 // to the AuthRequest fields.
-func (ar *AuthRequest) assignValues(columns []string, values []interface{}) error {
+func (_m *AuthRequest) assignValues(columns []string, values []any) error {
 	if m, n := len(values), len(columns); m < n {
 		return fmt.Errorf("mismatch number of scan values: %d != %d", m, n)
 	}
@@ -89,19 +105,19 @@ func (ar *AuthRequest) assignValues(columns []string, values []interface{}) erro
 			if value, ok := values[i].(*sql.NullString); !ok {
 				return fmt.Errorf("unexpected type %T for field id", values[i])
 			} else if value.Valid {
-				ar.ID = value.String
+				_m.ID = value.String
 			}
 		case authrequest.FieldClientID:
 			if value, ok := values[i].(*sql.NullString); !ok {
 				return fmt.Errorf("unexpected type %T for field client_id", values[i])
 			} else if value.Valid {
-				ar.ClientID = value.String
+				_m.ClientID = value.String
 			}
 		case authrequest.FieldScopes:
 			if value, ok := values[i].(*[]byte); !ok {
 				return fmt.Errorf("unexpected type %T for field scopes", values[i])
 			} else if value != nil && len(*value) > 0 {
-				if err := json.Unmarshal(*value, &ar.Scopes); err != nil {
+				if err := json.Unmarshal(*value, &_m.Scopes); err != nil {
 					return fmt.Errorf("unmarshal field scopes: %w", err)
 				}
 			}
@@ -109,7 +125,7 @@ func (ar *AuthRequest) assignValues(columns []string, values []interface{}) erro
 			if value, ok := values[i].(*[]byte); !ok {
 				return fmt.Errorf("unexpected type %T for field response_types", values[i])
 			} else if value != nil && len(*value) > 0 {
-				if err := json.Unmarshal(*value, &ar.ResponseTypes); err != nil {
+				if err := json.Unmarshal(*value, &_m.ResponseTypes); err != nil {
 					return fmt.Errorf("unmarshal field response_types: %w", err)
 				}
 			}
@@ -117,61 +133,61 @@ func (ar *AuthRequest) assignValues(columns []string, values []interface{}) erro
 			if value, ok := values[i].(*sql.NullString); !ok {
 				return fmt.Errorf("unexpected type %T for field redirect_uri", values[i])
 			} else if value.Valid {
-				ar.RedirectURI = value.String
+				_m.RedirectURI = value.String
 			}
 		case authrequest.FieldNonce:
 			if value, ok := values[i].(*sql.NullString); !ok {
 				return fmt.Errorf("unexpected type %T for field nonce", values[i])
 			} else if value.Valid {
-				ar.Nonce = value.String
+				_m.Nonce = value.String
 			}
 		case authrequest.FieldState:
 			if value, ok := values[i].(*sql.NullString); !ok {
 				return fmt.Errorf("unexpected type %T for field state", values[i])
 			} else if value.Valid {
-				ar.State = value.String
+				_m.State = value.String
 			}
 		case authrequest.FieldForceApprovalPrompt:
 			if value, ok := values[i].(*sql.NullBool); !ok {
 				return fmt.Errorf("unexpected type %T for field force_approval_prompt", values[i])
 			} else if value.Valid {
-				ar.ForceApprovalPrompt = value.Bool
+				_m.ForceApprovalPrompt = value.Bool
 			}
 		case authrequest.FieldLoggedIn:
 			if value, ok := values[i].(*sql.NullBool); !ok {
 				return fmt.Errorf("unexpected type %T for field logged_in", values[i])
 			} else if value.Valid {
-				ar.LoggedIn = value.Bool
+				_m.LoggedIn = value.Bool
 			}
 		case authrequest.FieldClaimsUserID:
 			if value, ok := values[i].(*sql.NullString); !ok {
 				return fmt.Errorf("unexpected type %T for field claims_user_id", values[i])
 			} else if value.Valid {
-				ar.ClaimsUserID = value.String
+				_m.ClaimsUserID = value.String
 			}
 		case authrequest.FieldClaimsUsername:
 			if value, ok := values[i].(*sql.NullString); !ok {
 				return fmt.Errorf("unexpected type %T for field claims_username", values[i])
 			} else if value.Valid {
-				ar.ClaimsUsername = value.String
+				_m.ClaimsUsername = value.String
 			}
 		case authrequest.FieldClaimsEmail:
 			if value, ok := values[i].(*sql.NullString); !ok {
 				return fmt.Errorf("unexpected type %T for field claims_email", values[i])
 			} else if value.Valid {
-				ar.ClaimsEmail = value.String
+				_m.ClaimsEmail = value.String
 			}
 		case authrequest.FieldClaimsEmailVerified:
 			if value, ok := values[i].(*sql.NullBool); !ok {
 				return fmt.Errorf("unexpected type %T for field claims_email_verified", values[i])
 			} else if value.Valid {
-				ar.ClaimsEmailVerified = value.Bool
+				_m.ClaimsEmailVerified = value.Bool
 			}
 		case authrequest.FieldClaimsGroups:
 			if value, ok := values[i].(*[]byte); !ok {
 				return fmt.Errorf("unexpected type %T for field claims_groups", values[i])
 			} else if value != nil && len(*value) > 0 {
-				if err := json.Unmarshal(*value, &ar.ClaimsGroups); err != nil {
+				if err := json.Unmarshal(*value, &_m.ClaimsGroups); err != nil {
 					return fmt.Errorf("unmarshal field claims_groups: %w", err)
 				}
 			}
@@ -179,133 +195,191 @@ func (ar *AuthRequest) assignValues(columns []string, values []interface{}) erro
 			if value, ok := values[i].(*sql.NullString); !ok {
 				return fmt.Errorf("unexpected type %T for field claims_preferred_username", values[i])
 			} else if value.Valid {
-				ar.ClaimsPreferredUsername = value.String
+				_m.ClaimsPreferredUsername = value.String
 			}
 		case authrequest.FieldConnectorID:
 			if value, ok := values[i].(*sql.NullString); !ok {
 				return fmt.Errorf("unexpected type %T for field connector_id", values[i])
 			} else if value.Valid {
-				ar.ConnectorID = value.String
+				_m.ConnectorID = value.String
 			}
 		case authrequest.FieldConnectorData:
 			if value, ok := values[i].(*[]byte); !ok {
 				return fmt.Errorf("unexpected type %T for field connector_data", values[i])
 			} else if value != nil {
-				ar.ConnectorData = value
+				_m.ConnectorData = value
 			}
 		case authrequest.FieldExpiry:
 			if value, ok := values[i].(*sql.NullTime); !ok {
 				return fmt.Errorf("unexpected type %T for field expiry", values[i])
 			} else if value.Valid {
-				ar.Expiry = value.Time
+				_m.Expiry = value.Time
 			}
 		case authrequest.FieldCodeChallenge:
 			if value, ok := values[i].(*sql.NullString); !ok {
 				return fmt.Errorf("unexpected type %T for field code_challenge", values[i])
 			} else if value.Valid {
-				ar.CodeChallenge = value.String
+				_m.CodeChallenge = value.String
 			}
 		case authrequest.FieldCodeChallengeMethod:
 			if value, ok := values[i].(*sql.NullString); !ok {
 				return fmt.Errorf("unexpected type %T for field code_challenge_method", values[i])
 			} else if value.Valid {
-				ar.CodeChallengeMethod = value.String
+				_m.CodeChallengeMethod = value.String
+			}
+		case authrequest.FieldHmacKey:
+			if value, ok := values[i].(*[]byte); !ok {
+				return fmt.Errorf("unexpected type %T for field hmac_key", values[i])
+			} else if value != nil {
+				_m.HmacKey = *value
+			}
+		case authrequest.FieldMfaValidated:
+			if value, ok := values[i].(*sql.NullBool); !ok {
+				return fmt.Errorf("unexpected type %T for field mfa_validated", values[i])
+			} else if value.Valid {
+				_m.MfaValidated = value.Bool
+			}
+		case authrequest.FieldWebauthnSessionData:
+			if value, ok := values[i].(*[]byte); !ok {
+				return fmt.Errorf("unexpected type %T for field webauthn_session_data", values[i])
+			} else if value != nil {
+				_m.WebauthnSessionData = value
+			}
+		case authrequest.FieldPrompt:
+			if value, ok := values[i].(*sql.NullString); !ok {
+				return fmt.Errorf("unexpected type %T for field prompt", values[i])
+			} else if value.Valid {
+				_m.Prompt = value.String
+			}
+		case authrequest.FieldMaxAge:
+			if value, ok := values[i].(*sql.NullInt64); !ok {
+				return fmt.Errorf("unexpected type %T for field max_age", values[i])
+			} else if value.Valid {
+				_m.MaxAge = int(value.Int64)
+			}
+		case authrequest.FieldAuthTime:
+			if value, ok := values[i].(*sql.NullTime); !ok {
+				return fmt.Errorf("unexpected type %T for field auth_time", values[i])
+			} else if value.Valid {
+				_m.AuthTime = value.Time
 			}
+		default:
+			_m.selectValues.Set(columns[i], values[i])
 		}
 	}
 	return nil
 }
 
+// Value returns the ent.Value that was dynamically selected and assigned to the AuthRequest.
+// This includes values selected through modifiers, order, etc.
+func (_m *AuthRequest) Value(name string) (ent.Value, error) {
+	return _m.selectValues.Get(name)
+}
+
 // Update returns a builder for updating this AuthRequest.
 // Note that you need to call AuthRequest.Unwrap() before calling this method if this AuthRequest
 // was returned from a transaction, and the transaction was committed or rolled back.
-func (ar *AuthRequest) Update() *AuthRequestUpdateOne {
-	return (&AuthRequestClient{config: ar.config}).UpdateOne(ar)
+func (_m *AuthRequest) Update() *AuthRequestUpdateOne {
+	return NewAuthRequestClient(_m.config).UpdateOne(_m)
 }
 
 // Unwrap unwraps the AuthRequest entity that was returned from a transaction after it was closed,
 // so that all future queries will be executed through the driver which created the transaction.
-func (ar *AuthRequest) Unwrap() *AuthRequest {
-	_tx, ok := ar.config.driver.(*txDriver)
+func (_m *AuthRequest) Unwrap() *AuthRequest {
+	_tx, ok := _m.config.driver.(*txDriver)
 	if !ok {
 		panic("db: AuthRequest is not a transactional entity")
 	}
-	ar.config.driver = _tx.drv
-	return ar
+	_m.config.driver = _tx.drv
+	return _m
 }
 
 // String implements the fmt.Stringer.
-func (ar *AuthRequest) String() string {
+func (_m *AuthRequest) String() string {
 	var builder strings.Builder
 	builder.WriteString("AuthRequest(")
-	builder.WriteString(fmt.Sprintf("id=%v, ", ar.ID))
+	builder.WriteString(fmt.Sprintf("id=%v, ", _m.ID))
 	builder.WriteString("client_id=")
-	builder.WriteString(ar.ClientID)
+	builder.WriteString(_m.ClientID)
 	builder.WriteString(", ")
 	builder.WriteString("scopes=")
-	builder.WriteString(fmt.Sprintf("%v", ar.Scopes))
+	builder.WriteString(fmt.Sprintf("%v", _m.Scopes))
 	builder.WriteString(", ")
 	builder.WriteString("response_types=")
-	builder.WriteString(fmt.Sprintf("%v", ar.ResponseTypes))
+	builder.WriteString(fmt.Sprintf("%v", _m.ResponseTypes))
 	builder.WriteString(", ")
 	builder.WriteString("redirect_uri=")
-	builder.WriteString(ar.RedirectURI)
+	builder.WriteString(_m.RedirectURI)
 	builder.WriteString(", ")
 	builder.WriteString("nonce=")
-	builder.WriteString(ar.Nonce)
+	builder.WriteString(_m.Nonce)
 	builder.WriteString(", ")
 	builder.WriteString("state=")
-	builder.WriteString(ar.State)
+	builder.WriteString(_m.State)
 	builder.WriteString(", ")
 	builder.WriteString("force_approval_prompt=")
-	builder.WriteString(fmt.Sprintf("%v", ar.ForceApprovalPrompt))
+	builder.WriteString(fmt.Sprintf("%v", _m.ForceApprovalPrompt))
 	builder.WriteString(", ")
 	builder.WriteString("logged_in=")
-	builder.WriteString(fmt.Sprintf("%v", ar.LoggedIn))
+	builder.WriteString(fmt.Sprintf("%v", _m.LoggedIn))
 	builder.WriteString(", ")
 	builder.WriteString("claims_user_id=")
-	builder.WriteString(ar.ClaimsUserID)
+	builder.WriteString(_m.ClaimsUserID)
 	builder.WriteString(", ")
 	builder.WriteString("claims_username=")
-	builder.WriteString(ar.ClaimsUsername)
+	builder.WriteString(_m.ClaimsUsername)
 	builder.WriteString(", ")
 	builder.WriteString("claims_email=")
-	builder.WriteString(ar.ClaimsEmail)
+	builder.WriteString(_m.ClaimsEmail)
 	builder.WriteString(", ")
 	builder.WriteString("claims_email_verified=")
-	builder.WriteString(fmt.Sprintf("%v", ar.ClaimsEmailVerified))
+	builder.WriteString(fmt.Sprintf("%v", _m.ClaimsEmailVerified))
 	builder.WriteString(", ")
 	builder.WriteString("claims_groups=")
-	builder.WriteString(fmt.Sprintf("%v", ar.ClaimsGroups))
+	builder.WriteString(fmt.Sprintf("%v", _m.ClaimsGroups))
 	builder.WriteString(", ")
 	builder.WriteString("claims_preferred_username=")
-	builder.WriteString(ar.ClaimsPreferredUsername)
+	builder.WriteString(_m.ClaimsPreferredUsername)
 	builder.WriteString(", ")
 	builder.WriteString("connector_id=")
-	builder.WriteString(ar.ConnectorID)
+	builder.WriteString(_m.ConnectorID)
 	builder.WriteString(", ")
-	if v := ar.ConnectorData; v != nil {
+	if v := _m.ConnectorData; v != nil {
 		builder.WriteString("connector_data=")
 		builder.WriteString(fmt.Sprintf("%v", *v))
 	}
 	builder.WriteString(", ")
 	builder.WriteString("expiry=")
-	builder.WriteString(ar.Expiry.Format(time.ANSIC))
+	builder.WriteString(_m.Expiry.Format(time.ANSIC))
 	builder.WriteString(", ")
 	builder.WriteString("code_challenge=")
-	builder.WriteString(ar.CodeChallenge)
+	builder.WriteString(_m.CodeChallenge)
 	builder.WriteString(", ")
 	builder.WriteString("code_challenge_method=")
-	builder.WriteString(ar.CodeChallengeMethod)
+	builder.WriteString(_m.CodeChallengeMethod)
+	builder.WriteString(", ")
+	builder.WriteString("hmac_key=")
+	builder.WriteString(fmt.Sprintf("%v", _m.HmacKey))
+	builder.WriteString(", ")
+	builder.WriteString("mfa_validated=")
+	builder.WriteString(fmt.Sprintf("%v", _m.MfaValidated))
+	builder.WriteString(", ")
+	if v := _m.WebauthnSessionData; v != nil {
+		builder.WriteString("webauthn_session_data=")
+		builder.WriteString(fmt.Sprintf("%v", *v))
+	}
+	builder.WriteString(", ")
+	builder.WriteString("prompt=")
+	builder.WriteString(_m.Prompt)
+	builder.WriteString(", ")
+	builder.WriteString("max_age=")
+	builder.WriteString(fmt.Sprintf("%v", _m.MaxAge))
+	builder.WriteString(", ")
+	builder.WriteString("auth_time=")
+	builder.WriteString(_m.AuthTime.Format(time.ANSIC))
 	builder.WriteByte(')')
 	return builder.String()
 }
 
 // AuthRequests is a parsable slice of AuthRequest.
 type AuthRequests []*AuthRequest
-
-func (ar AuthRequests) config(cfg config) {
-	for _i := range ar {
-		ar[_i].config = cfg
-	}
-}
diff --git a/storage/ent/db/authrequest/authrequest.go b/storage/ent/db/authrequest/authrequest.go
index 528d26b626..5ac1e4b2de 100644
--- a/storage/ent/db/authrequest/authrequest.go
+++ b/storage/ent/db/authrequest/authrequest.go
@@ -2,6 +2,10 @@
 
 package authrequest
 
+import (
+	"entgo.io/ent/dialect/sql"
+)
+
 const (
 	// Label holds the string label denoting the authrequest type in the database.
 	Label = "auth_request"
@@ -45,6 +49,18 @@ const (
 	FieldCodeChallenge = "code_challenge"
 	// FieldCodeChallengeMethod holds the string denoting the code_challenge_method field in the database.
 	FieldCodeChallengeMethod = "code_challenge_method"
+	// FieldHmacKey holds the string denoting the hmac_key field in the database.
+	FieldHmacKey = "hmac_key"
+	// FieldMfaValidated holds the string denoting the mfa_validated field in the database.
+	FieldMfaValidated = "mfa_validated"
+	// FieldWebauthnSessionData holds the string denoting the webauthn_session_data field in the database.
+	FieldWebauthnSessionData = "webauthn_session_data"
+	// FieldPrompt holds the string denoting the prompt field in the database.
+	FieldPrompt = "prompt"
+	// FieldMaxAge holds the string denoting the max_age field in the database.
+	FieldMaxAge = "max_age"
+	// FieldAuthTime holds the string denoting the auth_time field in the database.
+	FieldAuthTime = "auth_time"
 	// Table holds the table name of the authrequest in the database.
 	Table = "auth_requests"
 )
@@ -71,6 +87,12 @@ var Columns = []string{
 	FieldExpiry,
 	FieldCodeChallenge,
 	FieldCodeChallengeMethod,
+	FieldHmacKey,
+	FieldMfaValidated,
+	FieldWebauthnSessionData,
+	FieldPrompt,
+	FieldMaxAge,
+	FieldAuthTime,
 }
 
 // ValidColumn reports if the column name is valid (part of the table columns).
@@ -90,6 +112,115 @@ var (
 	DefaultCodeChallenge string
 	// DefaultCodeChallengeMethod holds the default value on creation for the "code_challenge_method" field.
 	DefaultCodeChallengeMethod string
+	// DefaultMfaValidated holds the default value on creation for the "mfa_validated" field.
+	DefaultMfaValidated bool
+	// DefaultPrompt holds the default value on creation for the "prompt" field.
+	DefaultPrompt string
+	// DefaultMaxAge holds the default value on creation for the "max_age" field.
+	DefaultMaxAge int
 	// IDValidator is a validator for the "id" field. It is called by the builders before save.
 	IDValidator func(string) error
 )
+
+// OrderOption defines the ordering options for the AuthRequest queries.
+type OrderOption func(*sql.Selector)
+
+// ByID orders the results by the id field.
+func ByID(opts ...sql.OrderTermOption) OrderOption {
+	return sql.OrderByField(FieldID, opts...).ToFunc()
+}
+
+// ByClientID orders the results by the client_id field.
+func ByClientID(opts ...sql.OrderTermOption) OrderOption {
+	return sql.OrderByField(FieldClientID, opts...).ToFunc()
+}
+
+// ByRedirectURI orders the results by the redirect_uri field.
+func ByRedirectURI(opts ...sql.OrderTermOption) OrderOption {
+	return sql.OrderByField(FieldRedirectURI, opts...).ToFunc()
+}
+
+// ByNonce orders the results by the nonce field.
+func ByNonce(opts ...sql.OrderTermOption) OrderOption {
+	return sql.OrderByField(FieldNonce, opts...).ToFunc()
+}
+
+// ByState orders the results by the state field.
+func ByState(opts ...sql.OrderTermOption) OrderOption {
+	return sql.OrderByField(FieldState, opts...).ToFunc()
+}
+
+// ByForceApprovalPrompt orders the results by the force_approval_prompt field.
+func ByForceApprovalPrompt(opts ...sql.OrderTermOption) OrderOption {
+	return sql.OrderByField(FieldForceApprovalPrompt, opts...).ToFunc()
+}
+
+// ByLoggedIn orders the results by the logged_in field.
+func ByLoggedIn(opts ...sql.OrderTermOption) OrderOption {
+	return sql.OrderByField(FieldLoggedIn, opts...).ToFunc()
+}
+
+// ByClaimsUserID orders the results by the claims_user_id field.
+func ByClaimsUserID(opts ...sql.OrderTermOption) OrderOption {
+	return sql.OrderByField(FieldClaimsUserID, opts...).ToFunc()
+}
+
+// ByClaimsUsername orders the results by the claims_username field.
+func ByClaimsUsername(opts ...sql.OrderTermOption) OrderOption {
+	return sql.OrderByField(FieldClaimsUsername, opts...).ToFunc()
+}
+
+// ByClaimsEmail orders the results by the claims_email field.
+func ByClaimsEmail(opts ...sql.OrderTermOption) OrderOption {
+	return sql.OrderByField(FieldClaimsEmail, opts...).ToFunc()
+}
+
+// ByClaimsEmailVerified orders the results by the claims_email_verified field.
+func ByClaimsEmailVerified(opts ...sql.OrderTermOption) OrderOption {
+	return sql.OrderByField(FieldClaimsEmailVerified, opts...).ToFunc()
+}
+
+// ByClaimsPreferredUsername orders the results by the claims_preferred_username field.
+func ByClaimsPreferredUsername(opts ...sql.OrderTermOption) OrderOption {
+	return sql.OrderByField(FieldClaimsPreferredUsername, opts...).ToFunc()
+}
+
+// ByConnectorID orders the results by the connector_id field.
+func ByConnectorID(opts ...sql.OrderTermOption) OrderOption {
+	return sql.OrderByField(FieldConnectorID, opts...).ToFunc()
+}
+
+// ByExpiry orders the results by the expiry field.
+func ByExpiry(opts ...sql.OrderTermOption) OrderOption {
+	return sql.OrderByField(FieldExpiry, opts...).ToFunc()
+}
+
+// ByCodeChallenge orders the results by the code_challenge field.
+func ByCodeChallenge(opts ...sql.OrderTermOption) OrderOption {
+	return sql.OrderByField(FieldCodeChallenge, opts...).ToFunc()
+}
+
+// ByCodeChallengeMethod orders the results by the code_challenge_method field.
+func ByCodeChallengeMethod(opts ...sql.OrderTermOption) OrderOption {
+	return sql.OrderByField(FieldCodeChallengeMethod, opts...).ToFunc()
+}
+
+// ByMfaValidated orders the results by the mfa_validated field.
+func ByMfaValidated(opts ...sql.OrderTermOption) OrderOption {
+	return sql.OrderByField(FieldMfaValidated, opts...).ToFunc()
+}
+
+// ByPrompt orders the results by the prompt field.
+func ByPrompt(opts ...sql.OrderTermOption) OrderOption {
+	return sql.OrderByField(FieldPrompt, opts...).ToFunc()
+}
+
+// ByMaxAge orders the results by the max_age field.
+func ByMaxAge(opts ...sql.OrderTermOption) OrderOption {
+	return sql.OrderByField(FieldMaxAge, opts...).ToFunc()
+}
+
+// ByAuthTime orders the results by the auth_time field.
+func ByAuthTime(opts ...sql.OrderTermOption) OrderOption {
+	return sql.OrderByField(FieldAuthTime, opts...).ToFunc()
+}
diff --git a/storage/ent/db/authrequest/where.go b/storage/ent/db/authrequest/where.go
index e31cdcee0f..27fd9131c9 100644
--- a/storage/ent/db/authrequest/where.go
+++ b/storage/ent/db/authrequest/where.go
@@ -11,1530 +11,1300 @@ import (
 
 // ID filters vertices based on their ID field.
 func ID(id string) predicate.AuthRequest {
-	return predicate.AuthRequest(func(s *sql.Selector) {
-		s.Where(sql.EQ(s.C(FieldID), id))
-	})
+	return predicate.AuthRequest(sql.FieldEQ(FieldID, id))
 }
 
 // IDEQ applies the EQ predicate on the ID field.
 func IDEQ(id string) predicate.AuthRequest {
-	return predicate.AuthRequest(func(s *sql.Selector) {
-		s.Where(sql.EQ(s.C(FieldID), id))
-	})
+	return predicate.AuthRequest(sql.FieldEQ(FieldID, id))
 }
 
 // IDNEQ applies the NEQ predicate on the ID field.
 func IDNEQ(id string) predicate.AuthRequest {
-	return predicate.AuthRequest(func(s *sql.Selector) {
-		s.Where(sql.NEQ(s.C(FieldID), id))
-	})
+	return predicate.AuthRequest(sql.FieldNEQ(FieldID, id))
 }
 
 // IDIn applies the In predicate on the ID field.
 func IDIn(ids ...string) predicate.AuthRequest {
-	return predicate.AuthRequest(func(s *sql.Selector) {
-		v := make([]interface{}, len(ids))
-		for i := range v {
-			v[i] = ids[i]
-		}
-		s.Where(sql.In(s.C(FieldID), v...))
-	})
+	return predicate.AuthRequest(sql.FieldIn(FieldID, ids...))
 }
 
 // IDNotIn applies the NotIn predicate on the ID field.
 func IDNotIn(ids ...string) predicate.AuthRequest {
-	return predicate.AuthRequest(func(s *sql.Selector) {
-		v := make([]interface{}, len(ids))
-		for i := range v {
-			v[i] = ids[i]
-		}
-		s.Where(sql.NotIn(s.C(FieldID), v...))
-	})
+	return predicate.AuthRequest(sql.FieldNotIn(FieldID, ids...))
 }
 
 // IDGT applies the GT predicate on the ID field.
 func IDGT(id string) predicate.AuthRequest {
-	return predicate.AuthRequest(func(s *sql.Selector) {
-		s.Where(sql.GT(s.C(FieldID), id))
-	})
+	return predicate.AuthRequest(sql.FieldGT(FieldID, id))
 }
 
 // IDGTE applies the GTE predicate on the ID field.
 func IDGTE(id string) predicate.AuthRequest {
-	return predicate.AuthRequest(func(s *sql.Selector) {
-		s.Where(sql.GTE(s.C(FieldID), id))
-	})
+	return predicate.AuthRequest(sql.FieldGTE(FieldID, id))
 }
 
 // IDLT applies the LT predicate on the ID field.
 func IDLT(id string) predicate.AuthRequest {
-	return predicate.AuthRequest(func(s *sql.Selector) {
-		s.Where(sql.LT(s.C(FieldID), id))
-	})
+	return predicate.AuthRequest(sql.FieldLT(FieldID, id))
 }
 
 // IDLTE applies the LTE predicate on the ID field.
 func IDLTE(id string) predicate.AuthRequest {
-	return predicate.AuthRequest(func(s *sql.Selector) {
-		s.Where(sql.LTE(s.C(FieldID), id))
-	})
+	return predicate.AuthRequest(sql.FieldLTE(FieldID, id))
+}
+
+// IDEqualFold applies the EqualFold predicate on the ID field.
+func IDEqualFold(id string) predicate.AuthRequest {
+	return predicate.AuthRequest(sql.FieldEqualFold(FieldID, id))
+}
+
+// IDContainsFold applies the ContainsFold predicate on the ID field.
+func IDContainsFold(id string) predicate.AuthRequest {
+	return predicate.AuthRequest(sql.FieldContainsFold(FieldID, id))
 }
 
 // ClientID applies equality check predicate on the "client_id" field. It's identical to ClientIDEQ.
 func ClientID(v string) predicate.AuthRequest {
-	return predicate.AuthRequest(func(s *sql.Selector) {
-		s.Where(sql.EQ(s.C(FieldClientID), v))
-	})
+	return predicate.AuthRequest(sql.FieldEQ(FieldClientID, v))
 }
 
 // RedirectURI applies equality check predicate on the "redirect_uri" field. It's identical to RedirectURIEQ.
 func RedirectURI(v string) predicate.AuthRequest {
-	return predicate.AuthRequest(func(s *sql.Selector) {
-		s.Where(sql.EQ(s.C(FieldRedirectURI), v))
-	})
+	return predicate.AuthRequest(sql.FieldEQ(FieldRedirectURI, v))
 }
 
 // Nonce applies equality check predicate on the "nonce" field. It's identical to NonceEQ.
 func Nonce(v string) predicate.AuthRequest {
-	return predicate.AuthRequest(func(s *sql.Selector) {
-		s.Where(sql.EQ(s.C(FieldNonce), v))
-	})
+	return predicate.AuthRequest(sql.FieldEQ(FieldNonce, v))
 }
 
 // State applies equality check predicate on the "state" field. It's identical to StateEQ.
 func State(v string) predicate.AuthRequest {
-	return predicate.AuthRequest(func(s *sql.Selector) {
-		s.Where(sql.EQ(s.C(FieldState), v))
-	})
+	return predicate.AuthRequest(sql.FieldEQ(FieldState, v))
 }
 
 // ForceApprovalPrompt applies equality check predicate on the "force_approval_prompt" field. It's identical to ForceApprovalPromptEQ.
 func ForceApprovalPrompt(v bool) predicate.AuthRequest {
-	return predicate.AuthRequest(func(s *sql.Selector) {
-		s.Where(sql.EQ(s.C(FieldForceApprovalPrompt), v))
-	})
+	return predicate.AuthRequest(sql.FieldEQ(FieldForceApprovalPrompt, v))
 }
 
 // LoggedIn applies equality check predicate on the "logged_in" field. It's identical to LoggedInEQ.
 func LoggedIn(v bool) predicate.AuthRequest {
-	return predicate.AuthRequest(func(s *sql.Selector) {
-		s.Where(sql.EQ(s.C(FieldLoggedIn), v))
-	})
+	return predicate.AuthRequest(sql.FieldEQ(FieldLoggedIn, v))
 }
 
 // ClaimsUserID applies equality check predicate on the "claims_user_id" field. It's identical to ClaimsUserIDEQ.
 func ClaimsUserID(v string) predicate.AuthRequest {
-	return predicate.AuthRequest(func(s *sql.Selector) {
-		s.Where(sql.EQ(s.C(FieldClaimsUserID), v))
-	})
+	return predicate.AuthRequest(sql.FieldEQ(FieldClaimsUserID, v))
 }
 
 // ClaimsUsername applies equality check predicate on the "claims_username" field. It's identical to ClaimsUsernameEQ.
 func ClaimsUsername(v string) predicate.AuthRequest {
-	return predicate.AuthRequest(func(s *sql.Selector) {
-		s.Where(sql.EQ(s.C(FieldClaimsUsername), v))
-	})
+	return predicate.AuthRequest(sql.FieldEQ(FieldClaimsUsername, v))
 }
 
 // ClaimsEmail applies equality check predicate on the "claims_email" field. It's identical to ClaimsEmailEQ.
 func ClaimsEmail(v string) predicate.AuthRequest {
-	return predicate.AuthRequest(func(s *sql.Selector) {
-		s.Where(sql.EQ(s.C(FieldClaimsEmail), v))
-	})
+	return predicate.AuthRequest(sql.FieldEQ(FieldClaimsEmail, v))
 }
 
 // ClaimsEmailVerified applies equality check predicate on the "claims_email_verified" field. It's identical to ClaimsEmailVerifiedEQ.
 func ClaimsEmailVerified(v bool) predicate.AuthRequest {
-	return predicate.AuthRequest(func(s *sql.Selector) {
-		s.Where(sql.EQ(s.C(FieldClaimsEmailVerified), v))
-	})
+	return predicate.AuthRequest(sql.FieldEQ(FieldClaimsEmailVerified, v))
 }
 
 // ClaimsPreferredUsername applies equality check predicate on the "claims_preferred_username" field. It's identical to ClaimsPreferredUsernameEQ.
 func ClaimsPreferredUsername(v string) predicate.AuthRequest {
-	return predicate.AuthRequest(func(s *sql.Selector) {
-		s.Where(sql.EQ(s.C(FieldClaimsPreferredUsername), v))
-	})
+	return predicate.AuthRequest(sql.FieldEQ(FieldClaimsPreferredUsername, v))
 }
 
 // ConnectorID applies equality check predicate on the "connector_id" field. It's identical to ConnectorIDEQ.
 func ConnectorID(v string) predicate.AuthRequest {
-	return predicate.AuthRequest(func(s *sql.Selector) {
-		s.Where(sql.EQ(s.C(FieldConnectorID), v))
-	})
+	return predicate.AuthRequest(sql.FieldEQ(FieldConnectorID, v))
 }
 
 // ConnectorData applies equality check predicate on the "connector_data" field. It's identical to ConnectorDataEQ.
 func ConnectorData(v []byte) predicate.AuthRequest {
-	return predicate.AuthRequest(func(s *sql.Selector) {
-		s.Where(sql.EQ(s.C(FieldConnectorData), v))
-	})
+	return predicate.AuthRequest(sql.FieldEQ(FieldConnectorData, v))
 }
 
 // Expiry applies equality check predicate on the "expiry" field. It's identical to ExpiryEQ.
 func Expiry(v time.Time) predicate.AuthRequest {
-	return predicate.AuthRequest(func(s *sql.Selector) {
-		s.Where(sql.EQ(s.C(FieldExpiry), v))
-	})
+	return predicate.AuthRequest(sql.FieldEQ(FieldExpiry, v))
 }
 
 // CodeChallenge applies equality check predicate on the "code_challenge" field. It's identical to CodeChallengeEQ.
 func CodeChallenge(v string) predicate.AuthRequest {
-	return predicate.AuthRequest(func(s *sql.Selector) {
-		s.Where(sql.EQ(s.C(FieldCodeChallenge), v))
-	})
+	return predicate.AuthRequest(sql.FieldEQ(FieldCodeChallenge, v))
 }
 
 // CodeChallengeMethod applies equality check predicate on the "code_challenge_method" field. It's identical to CodeChallengeMethodEQ.
 func CodeChallengeMethod(v string) predicate.AuthRequest {
-	return predicate.AuthRequest(func(s *sql.Selector) {
-		s.Where(sql.EQ(s.C(FieldCodeChallengeMethod), v))
-	})
+	return predicate.AuthRequest(sql.FieldEQ(FieldCodeChallengeMethod, v))
+}
+
+// HmacKey applies equality check predicate on the "hmac_key" field. It's identical to HmacKeyEQ.
+func HmacKey(v []byte) predicate.AuthRequest {
+	return predicate.AuthRequest(sql.FieldEQ(FieldHmacKey, v))
+}
+
+// MfaValidated applies equality check predicate on the "mfa_validated" field. It's identical to MfaValidatedEQ.
+func MfaValidated(v bool) predicate.AuthRequest {
+	return predicate.AuthRequest(sql.FieldEQ(FieldMfaValidated, v))
+}
+
+// WebauthnSessionData applies equality check predicate on the "webauthn_session_data" field. It's identical to WebauthnSessionDataEQ.
+func WebauthnSessionData(v []byte) predicate.AuthRequest {
+	return predicate.AuthRequest(sql.FieldEQ(FieldWebauthnSessionData, v))
+}
+
+// Prompt applies equality check predicate on the "prompt" field. It's identical to PromptEQ.
+func Prompt(v string) predicate.AuthRequest {
+	return predicate.AuthRequest(sql.FieldEQ(FieldPrompt, v))
+}
+
+// MaxAge applies equality check predicate on the "max_age" field. It's identical to MaxAgeEQ.
+func MaxAge(v int) predicate.AuthRequest {
+	return predicate.AuthRequest(sql.FieldEQ(FieldMaxAge, v))
+}
+
+// AuthTime applies equality check predicate on the "auth_time" field. It's identical to AuthTimeEQ.
+func AuthTime(v time.Time) predicate.AuthRequest {
+	return predicate.AuthRequest(sql.FieldEQ(FieldAuthTime, v))
 }
 
 // ClientIDEQ applies the EQ predicate on the "client_id" field.
 func ClientIDEQ(v string) predicate.AuthRequest {
-	return predicate.AuthRequest(func(s *sql.Selector) {
-		s.Where(sql.EQ(s.C(FieldClientID), v))
-	})
+	return predicate.AuthRequest(sql.FieldEQ(FieldClientID, v))
 }
 
 // ClientIDNEQ applies the NEQ predicate on the "client_id" field.
 func ClientIDNEQ(v string) predicate.AuthRequest {
-	return predicate.AuthRequest(func(s *sql.Selector) {
-		s.Where(sql.NEQ(s.C(FieldClientID), v))
-	})
+	return predicate.AuthRequest(sql.FieldNEQ(FieldClientID, v))
 }
 
 // ClientIDIn applies the In predicate on the "client_id" field.
 func ClientIDIn(vs ...string) predicate.AuthRequest {
-	v := make([]interface{}, len(vs))
-	for i := range v {
-		v[i] = vs[i]
-	}
-	return predicate.AuthRequest(func(s *sql.Selector) {
-		s.Where(sql.In(s.C(FieldClientID), v...))
-	})
+	return predicate.AuthRequest(sql.FieldIn(FieldClientID, vs...))
 }
 
 // ClientIDNotIn applies the NotIn predicate on the "client_id" field.
 func ClientIDNotIn(vs ...string) predicate.AuthRequest {
-	v := make([]interface{}, len(vs))
-	for i := range v {
-		v[i] = vs[i]
-	}
-	return predicate.AuthRequest(func(s *sql.Selector) {
-		s.Where(sql.NotIn(s.C(FieldClientID), v...))
-	})
+	return predicate.AuthRequest(sql.FieldNotIn(FieldClientID, vs...))
 }
 
 // ClientIDGT applies the GT predicate on the "client_id" field.
 func ClientIDGT(v string) predicate.AuthRequest {
-	return predicate.AuthRequest(func(s *sql.Selector) {
-		s.Where(sql.GT(s.C(FieldClientID), v))
-	})
+	return predicate.AuthRequest(sql.FieldGT(FieldClientID, v))
 }
 
 // ClientIDGTE applies the GTE predicate on the "client_id" field.
 func ClientIDGTE(v string) predicate.AuthRequest {
-	return predicate.AuthRequest(func(s *sql.Selector) {
-		s.Where(sql.GTE(s.C(FieldClientID), v))
-	})
+	return predicate.AuthRequest(sql.FieldGTE(FieldClientID, v))
 }
 
 // ClientIDLT applies the LT predicate on the "client_id" field.
 func ClientIDLT(v string) predicate.AuthRequest {
-	return predicate.AuthRequest(func(s *sql.Selector) {
-		s.Where(sql.LT(s.C(FieldClientID), v))
-	})
+	return predicate.AuthRequest(sql.FieldLT(FieldClientID, v))
 }
 
 // ClientIDLTE applies the LTE predicate on the "client_id" field.
 func ClientIDLTE(v string) predicate.AuthRequest {
-	return predicate.AuthRequest(func(s *sql.Selector) {
-		s.Where(sql.LTE(s.C(FieldClientID), v))
-	})
+	return predicate.AuthRequest(sql.FieldLTE(FieldClientID, v))
 }
 
 // ClientIDContains applies the Contains predicate on the "client_id" field.
 func ClientIDContains(v string) predicate.AuthRequest {
-	return predicate.AuthRequest(func(s *sql.Selector) {
-		s.Where(sql.Contains(s.C(FieldClientID), v))
-	})
+	return predicate.AuthRequest(sql.FieldContains(FieldClientID, v))
 }
 
 // ClientIDHasPrefix applies the HasPrefix predicate on the "client_id" field.
 func ClientIDHasPrefix(v string) predicate.AuthRequest {
-	return predicate.AuthRequest(func(s *sql.Selector) {
-		s.Where(sql.HasPrefix(s.C(FieldClientID), v))
-	})
+	return predicate.AuthRequest(sql.FieldHasPrefix(FieldClientID, v))
 }
 
 // ClientIDHasSuffix applies the HasSuffix predicate on the "client_id" field.
 func ClientIDHasSuffix(v string) predicate.AuthRequest {
-	return predicate.AuthRequest(func(s *sql.Selector) {
-		s.Where(sql.HasSuffix(s.C(FieldClientID), v))
-	})
+	return predicate.AuthRequest(sql.FieldHasSuffix(FieldClientID, v))
 }
 
 // ClientIDEqualFold applies the EqualFold predicate on the "client_id" field.
 func ClientIDEqualFold(v string) predicate.AuthRequest {
-	return predicate.AuthRequest(func(s *sql.Selector) {
-		s.Where(sql.EqualFold(s.C(FieldClientID), v))
-	})
+	return predicate.AuthRequest(sql.FieldEqualFold(FieldClientID, v))
 }
 
 // ClientIDContainsFold applies the ContainsFold predicate on the "client_id" field.
 func ClientIDContainsFold(v string) predicate.AuthRequest {
-	return predicate.AuthRequest(func(s *sql.Selector) {
-		s.Where(sql.ContainsFold(s.C(FieldClientID), v))
-	})
+	return predicate.AuthRequest(sql.FieldContainsFold(FieldClientID, v))
 }
 
 // ScopesIsNil applies the IsNil predicate on the "scopes" field.
 func ScopesIsNil() predicate.AuthRequest {
-	return predicate.AuthRequest(func(s *sql.Selector) {
-		s.Where(sql.IsNull(s.C(FieldScopes)))
-	})
+	return predicate.AuthRequest(sql.FieldIsNull(FieldScopes))
 }
 
 // ScopesNotNil applies the NotNil predicate on the "scopes" field.
 func ScopesNotNil() predicate.AuthRequest {
-	return predicate.AuthRequest(func(s *sql.Selector) {
-		s.Where(sql.NotNull(s.C(FieldScopes)))
-	})
+	return predicate.AuthRequest(sql.FieldNotNull(FieldScopes))
 }
 
 // ResponseTypesIsNil applies the IsNil predicate on the "response_types" field.
 func ResponseTypesIsNil() predicate.AuthRequest {
-	return predicate.AuthRequest(func(s *sql.Selector) {
-		s.Where(sql.IsNull(s.C(FieldResponseTypes)))
-	})
+	return predicate.AuthRequest(sql.FieldIsNull(FieldResponseTypes))
 }
 
 // ResponseTypesNotNil applies the NotNil predicate on the "response_types" field.
 func ResponseTypesNotNil() predicate.AuthRequest {
-	return predicate.AuthRequest(func(s *sql.Selector) {
-		s.Where(sql.NotNull(s.C(FieldResponseTypes)))
-	})
+	return predicate.AuthRequest(sql.FieldNotNull(FieldResponseTypes))
 }
 
 // RedirectURIEQ applies the EQ predicate on the "redirect_uri" field.
 func RedirectURIEQ(v string) predicate.AuthRequest {
-	return predicate.AuthRequest(func(s *sql.Selector) {
-		s.Where(sql.EQ(s.C(FieldRedirectURI), v))
-	})
+	return predicate.AuthRequest(sql.FieldEQ(FieldRedirectURI, v))
 }
 
 // RedirectURINEQ applies the NEQ predicate on the "redirect_uri" field.
 func RedirectURINEQ(v string) predicate.AuthRequest {
-	return predicate.AuthRequest(func(s *sql.Selector) {
-		s.Where(sql.NEQ(s.C(FieldRedirectURI), v))
-	})
+	return predicate.AuthRequest(sql.FieldNEQ(FieldRedirectURI, v))
 }
 
 // RedirectURIIn applies the In predicate on the "redirect_uri" field.
 func RedirectURIIn(vs ...string) predicate.AuthRequest {
-	v := make([]interface{}, len(vs))
-	for i := range v {
-		v[i] = vs[i]
-	}
-	return predicate.AuthRequest(func(s *sql.Selector) {
-		s.Where(sql.In(s.C(FieldRedirectURI), v...))
-	})
+	return predicate.AuthRequest(sql.FieldIn(FieldRedirectURI, vs...))
 }
 
 // RedirectURINotIn applies the NotIn predicate on the "redirect_uri" field.
 func RedirectURINotIn(vs ...string) predicate.AuthRequest {
-	v := make([]interface{}, len(vs))
-	for i := range v {
-		v[i] = vs[i]
-	}
-	return predicate.AuthRequest(func(s *sql.Selector) {
-		s.Where(sql.NotIn(s.C(FieldRedirectURI), v...))
-	})
+	return predicate.AuthRequest(sql.FieldNotIn(FieldRedirectURI, vs...))
 }
 
 // RedirectURIGT applies the GT predicate on the "redirect_uri" field.
 func RedirectURIGT(v string) predicate.AuthRequest {
-	return predicate.AuthRequest(func(s *sql.Selector) {
-		s.Where(sql.GT(s.C(FieldRedirectURI), v))
-	})
+	return predicate.AuthRequest(sql.FieldGT(FieldRedirectURI, v))
 }
 
 // RedirectURIGTE applies the GTE predicate on the "redirect_uri" field.
 func RedirectURIGTE(v string) predicate.AuthRequest {
-	return predicate.AuthRequest(func(s *sql.Selector) {
-		s.Where(sql.GTE(s.C(FieldRedirectURI), v))
-	})
+	return predicate.AuthRequest(sql.FieldGTE(FieldRedirectURI, v))
 }
 
 // RedirectURILT applies the LT predicate on the "redirect_uri" field.
 func RedirectURILT(v string) predicate.AuthRequest {
-	return predicate.AuthRequest(func(s *sql.Selector) {
-		s.Where(sql.LT(s.C(FieldRedirectURI), v))
-	})
+	return predicate.AuthRequest(sql.FieldLT(FieldRedirectURI, v))
 }
 
 // RedirectURILTE applies the LTE predicate on the "redirect_uri" field.
 func RedirectURILTE(v string) predicate.AuthRequest {
-	return predicate.AuthRequest(func(s *sql.Selector) {
-		s.Where(sql.LTE(s.C(FieldRedirectURI), v))
-	})
+	return predicate.AuthRequest(sql.FieldLTE(FieldRedirectURI, v))
 }
 
 // RedirectURIContains applies the Contains predicate on the "redirect_uri" field.
 func RedirectURIContains(v string) predicate.AuthRequest {
-	return predicate.AuthRequest(func(s *sql.Selector) {
-		s.Where(sql.Contains(s.C(FieldRedirectURI), v))
-	})
+	return predicate.AuthRequest(sql.FieldContains(FieldRedirectURI, v))
 }
 
 // RedirectURIHasPrefix applies the HasPrefix predicate on the "redirect_uri" field.
 func RedirectURIHasPrefix(v string) predicate.AuthRequest {
-	return predicate.AuthRequest(func(s *sql.Selector) {
-		s.Where(sql.HasPrefix(s.C(FieldRedirectURI), v))
-	})
+	return predicate.AuthRequest(sql.FieldHasPrefix(FieldRedirectURI, v))
 }
 
 // RedirectURIHasSuffix applies the HasSuffix predicate on the "redirect_uri" field.
 func RedirectURIHasSuffix(v string) predicate.AuthRequest {
-	return predicate.AuthRequest(func(s *sql.Selector) {
-		s.Where(sql.HasSuffix(s.C(FieldRedirectURI), v))
-	})
+	return predicate.AuthRequest(sql.FieldHasSuffix(FieldRedirectURI, v))
 }
 
 // RedirectURIEqualFold applies the EqualFold predicate on the "redirect_uri" field.
 func RedirectURIEqualFold(v string) predicate.AuthRequest {
-	return predicate.AuthRequest(func(s *sql.Selector) {
-		s.Where(sql.EqualFold(s.C(FieldRedirectURI), v))
-	})
+	return predicate.AuthRequest(sql.FieldEqualFold(FieldRedirectURI, v))
 }
 
 // RedirectURIContainsFold applies the ContainsFold predicate on the "redirect_uri" field.
 func RedirectURIContainsFold(v string) predicate.AuthRequest {
-	return predicate.AuthRequest(func(s *sql.Selector) {
-		s.Where(sql.ContainsFold(s.C(FieldRedirectURI), v))
-	})
+	return predicate.AuthRequest(sql.FieldContainsFold(FieldRedirectURI, v))
 }
 
 // NonceEQ applies the EQ predicate on the "nonce" field.
 func NonceEQ(v string) predicate.AuthRequest {
-	return predicate.AuthRequest(func(s *sql.Selector) {
-		s.Where(sql.EQ(s.C(FieldNonce), v))
-	})
+	return predicate.AuthRequest(sql.FieldEQ(FieldNonce, v))
 }
 
 // NonceNEQ applies the NEQ predicate on the "nonce" field.
 func NonceNEQ(v string) predicate.AuthRequest {
-	return predicate.AuthRequest(func(s *sql.Selector) {
-		s.Where(sql.NEQ(s.C(FieldNonce), v))
-	})
+	return predicate.AuthRequest(sql.FieldNEQ(FieldNonce, v))
 }
 
 // NonceIn applies the In predicate on the "nonce" field.
 func NonceIn(vs ...string) predicate.AuthRequest {
-	v := make([]interface{}, len(vs))
-	for i := range v {
-		v[i] = vs[i]
-	}
-	return predicate.AuthRequest(func(s *sql.Selector) {
-		s.Where(sql.In(s.C(FieldNonce), v...))
-	})
+	return predicate.AuthRequest(sql.FieldIn(FieldNonce, vs...))
 }
 
 // NonceNotIn applies the NotIn predicate on the "nonce" field.
 func NonceNotIn(vs ...string) predicate.AuthRequest {
-	v := make([]interface{}, len(vs))
-	for i := range v {
-		v[i] = vs[i]
-	}
-	return predicate.AuthRequest(func(s *sql.Selector) {
-		s.Where(sql.NotIn(s.C(FieldNonce), v...))
-	})
+	return predicate.AuthRequest(sql.FieldNotIn(FieldNonce, vs...))
 }
 
 // NonceGT applies the GT predicate on the "nonce" field.
 func NonceGT(v string) predicate.AuthRequest {
-	return predicate.AuthRequest(func(s *sql.Selector) {
-		s.Where(sql.GT(s.C(FieldNonce), v))
-	})
+	return predicate.AuthRequest(sql.FieldGT(FieldNonce, v))
 }
 
 // NonceGTE applies the GTE predicate on the "nonce" field.
 func NonceGTE(v string) predicate.AuthRequest {
-	return predicate.AuthRequest(func(s *sql.Selector) {
-		s.Where(sql.GTE(s.C(FieldNonce), v))
-	})
+	return predicate.AuthRequest(sql.FieldGTE(FieldNonce, v))
 }
 
 // NonceLT applies the LT predicate on the "nonce" field.
 func NonceLT(v string) predicate.AuthRequest {
-	return predicate.AuthRequest(func(s *sql.Selector) {
-		s.Where(sql.LT(s.C(FieldNonce), v))
-	})
+	return predicate.AuthRequest(sql.FieldLT(FieldNonce, v))
 }
 
 // NonceLTE applies the LTE predicate on the "nonce" field.
 func NonceLTE(v string) predicate.AuthRequest {
-	return predicate.AuthRequest(func(s *sql.Selector) {
-		s.Where(sql.LTE(s.C(FieldNonce), v))
-	})
+	return predicate.AuthRequest(sql.FieldLTE(FieldNonce, v))
 }
 
 // NonceContains applies the Contains predicate on the "nonce" field.
 func NonceContains(v string) predicate.AuthRequest {
-	return predicate.AuthRequest(func(s *sql.Selector) {
-		s.Where(sql.Contains(s.C(FieldNonce), v))
-	})
+	return predicate.AuthRequest(sql.FieldContains(FieldNonce, v))
 }
 
 // NonceHasPrefix applies the HasPrefix predicate on the "nonce" field.
 func NonceHasPrefix(v string) predicate.AuthRequest {
-	return predicate.AuthRequest(func(s *sql.Selector) {
-		s.Where(sql.HasPrefix(s.C(FieldNonce), v))
-	})
+	return predicate.AuthRequest(sql.FieldHasPrefix(FieldNonce, v))
 }
 
 // NonceHasSuffix applies the HasSuffix predicate on the "nonce" field.
 func NonceHasSuffix(v string) predicate.AuthRequest {
-	return predicate.AuthRequest(func(s *sql.Selector) {
-		s.Where(sql.HasSuffix(s.C(FieldNonce), v))
-	})
+	return predicate.AuthRequest(sql.FieldHasSuffix(FieldNonce, v))
 }
 
 // NonceEqualFold applies the EqualFold predicate on the "nonce" field.
 func NonceEqualFold(v string) predicate.AuthRequest {
-	return predicate.AuthRequest(func(s *sql.Selector) {
-		s.Where(sql.EqualFold(s.C(FieldNonce), v))
-	})
+	return predicate.AuthRequest(sql.FieldEqualFold(FieldNonce, v))
 }
 
 // NonceContainsFold applies the ContainsFold predicate on the "nonce" field.
 func NonceContainsFold(v string) predicate.AuthRequest {
-	return predicate.AuthRequest(func(s *sql.Selector) {
-		s.Where(sql.ContainsFold(s.C(FieldNonce), v))
-	})
+	return predicate.AuthRequest(sql.FieldContainsFold(FieldNonce, v))
 }
 
 // StateEQ applies the EQ predicate on the "state" field.
 func StateEQ(v string) predicate.AuthRequest {
-	return predicate.AuthRequest(func(s *sql.Selector) {
-		s.Where(sql.EQ(s.C(FieldState), v))
-	})
+	return predicate.AuthRequest(sql.FieldEQ(FieldState, v))
 }
 
 // StateNEQ applies the NEQ predicate on the "state" field.
 func StateNEQ(v string) predicate.AuthRequest {
-	return predicate.AuthRequest(func(s *sql.Selector) {
-		s.Where(sql.NEQ(s.C(FieldState), v))
-	})
+	return predicate.AuthRequest(sql.FieldNEQ(FieldState, v))
 }
 
 // StateIn applies the In predicate on the "state" field.
 func StateIn(vs ...string) predicate.AuthRequest {
-	v := make([]interface{}, len(vs))
-	for i := range v {
-		v[i] = vs[i]
-	}
-	return predicate.AuthRequest(func(s *sql.Selector) {
-		s.Where(sql.In(s.C(FieldState), v...))
-	})
+	return predicate.AuthRequest(sql.FieldIn(FieldState, vs...))
 }
 
 // StateNotIn applies the NotIn predicate on the "state" field.
 func StateNotIn(vs ...string) predicate.AuthRequest {
-	v := make([]interface{}, len(vs))
-	for i := range v {
-		v[i] = vs[i]
-	}
-	return predicate.AuthRequest(func(s *sql.Selector) {
-		s.Where(sql.NotIn(s.C(FieldState), v...))
-	})
+	return predicate.AuthRequest(sql.FieldNotIn(FieldState, vs...))
 }
 
 // StateGT applies the GT predicate on the "state" field.
 func StateGT(v string) predicate.AuthRequest {
-	return predicate.AuthRequest(func(s *sql.Selector) {
-		s.Where(sql.GT(s.C(FieldState), v))
-	})
+	return predicate.AuthRequest(sql.FieldGT(FieldState, v))
 }
 
 // StateGTE applies the GTE predicate on the "state" field.
 func StateGTE(v string) predicate.AuthRequest {
-	return predicate.AuthRequest(func(s *sql.Selector) {
-		s.Where(sql.GTE(s.C(FieldState), v))
-	})
+	return predicate.AuthRequest(sql.FieldGTE(FieldState, v))
 }
 
 // StateLT applies the LT predicate on the "state" field.
 func StateLT(v string) predicate.AuthRequest {
-	return predicate.AuthRequest(func(s *sql.Selector) {
-		s.Where(sql.LT(s.C(FieldState), v))
-	})
+	return predicate.AuthRequest(sql.FieldLT(FieldState, v))
 }
 
 // StateLTE applies the LTE predicate on the "state" field.
 func StateLTE(v string) predicate.AuthRequest {
-	return predicate.AuthRequest(func(s *sql.Selector) {
-		s.Where(sql.LTE(s.C(FieldState), v))
-	})
+	return predicate.AuthRequest(sql.FieldLTE(FieldState, v))
 }
 
 // StateContains applies the Contains predicate on the "state" field.
 func StateContains(v string) predicate.AuthRequest {
-	return predicate.AuthRequest(func(s *sql.Selector) {
-		s.Where(sql.Contains(s.C(FieldState), v))
-	})
+	return predicate.AuthRequest(sql.FieldContains(FieldState, v))
 }
 
 // StateHasPrefix applies the HasPrefix predicate on the "state" field.
 func StateHasPrefix(v string) predicate.AuthRequest {
-	return predicate.AuthRequest(func(s *sql.Selector) {
-		s.Where(sql.HasPrefix(s.C(FieldState), v))
-	})
+	return predicate.AuthRequest(sql.FieldHasPrefix(FieldState, v))
 }
 
 // StateHasSuffix applies the HasSuffix predicate on the "state" field.
 func StateHasSuffix(v string) predicate.AuthRequest {
-	return predicate.AuthRequest(func(s *sql.Selector) {
-		s.Where(sql.HasSuffix(s.C(FieldState), v))
-	})
+	return predicate.AuthRequest(sql.FieldHasSuffix(FieldState, v))
 }
 
 // StateEqualFold applies the EqualFold predicate on the "state" field.
 func StateEqualFold(v string) predicate.AuthRequest {
-	return predicate.AuthRequest(func(s *sql.Selector) {
-		s.Where(sql.EqualFold(s.C(FieldState), v))
-	})
+	return predicate.AuthRequest(sql.FieldEqualFold(FieldState, v))
 }
 
 // StateContainsFold applies the ContainsFold predicate on the "state" field.
 func StateContainsFold(v string) predicate.AuthRequest {
-	return predicate.AuthRequest(func(s *sql.Selector) {
-		s.Where(sql.ContainsFold(s.C(FieldState), v))
-	})
+	return predicate.AuthRequest(sql.FieldContainsFold(FieldState, v))
 }
 
 // ForceApprovalPromptEQ applies the EQ predicate on the "force_approval_prompt" field.
 func ForceApprovalPromptEQ(v bool) predicate.AuthRequest {
-	return predicate.AuthRequest(func(s *sql.Selector) {
-		s.Where(sql.EQ(s.C(FieldForceApprovalPrompt), v))
-	})
+	return predicate.AuthRequest(sql.FieldEQ(FieldForceApprovalPrompt, v))
 }
 
 // ForceApprovalPromptNEQ applies the NEQ predicate on the "force_approval_prompt" field.
 func ForceApprovalPromptNEQ(v bool) predicate.AuthRequest {
-	return predicate.AuthRequest(func(s *sql.Selector) {
-		s.Where(sql.NEQ(s.C(FieldForceApprovalPrompt), v))
-	})
+	return predicate.AuthRequest(sql.FieldNEQ(FieldForceApprovalPrompt, v))
 }
 
 // LoggedInEQ applies the EQ predicate on the "logged_in" field.
 func LoggedInEQ(v bool) predicate.AuthRequest {
-	return predicate.AuthRequest(func(s *sql.Selector) {
-		s.Where(sql.EQ(s.C(FieldLoggedIn), v))
-	})
+	return predicate.AuthRequest(sql.FieldEQ(FieldLoggedIn, v))
 }
 
 // LoggedInNEQ applies the NEQ predicate on the "logged_in" field.
 func LoggedInNEQ(v bool) predicate.AuthRequest {
-	return predicate.AuthRequest(func(s *sql.Selector) {
-		s.Where(sql.NEQ(s.C(FieldLoggedIn), v))
-	})
+	return predicate.AuthRequest(sql.FieldNEQ(FieldLoggedIn, v))
 }
 
 // ClaimsUserIDEQ applies the EQ predicate on the "claims_user_id" field.
 func ClaimsUserIDEQ(v string) predicate.AuthRequest {
-	return predicate.AuthRequest(func(s *sql.Selector) {
-		s.Where(sql.EQ(s.C(FieldClaimsUserID), v))
-	})
+	return predicate.AuthRequest(sql.FieldEQ(FieldClaimsUserID, v))
 }
 
 // ClaimsUserIDNEQ applies the NEQ predicate on the "claims_user_id" field.
 func ClaimsUserIDNEQ(v string) predicate.AuthRequest {
-	return predicate.AuthRequest(func(s *sql.Selector) {
-		s.Where(sql.NEQ(s.C(FieldClaimsUserID), v))
-	})
+	return predicate.AuthRequest(sql.FieldNEQ(FieldClaimsUserID, v))
 }
 
 // ClaimsUserIDIn applies the In predicate on the "claims_user_id" field.
 func ClaimsUserIDIn(vs ...string) predicate.AuthRequest {
-	v := make([]interface{}, len(vs))
-	for i := range v {
-		v[i] = vs[i]
-	}
-	return predicate.AuthRequest(func(s *sql.Selector) {
-		s.Where(sql.In(s.C(FieldClaimsUserID), v...))
-	})
+	return predicate.AuthRequest(sql.FieldIn(FieldClaimsUserID, vs...))
 }
 
 // ClaimsUserIDNotIn applies the NotIn predicate on the "claims_user_id" field.
 func ClaimsUserIDNotIn(vs ...string) predicate.AuthRequest {
-	v := make([]interface{}, len(vs))
-	for i := range v {
-		v[i] = vs[i]
-	}
-	return predicate.AuthRequest(func(s *sql.Selector) {
-		s.Where(sql.NotIn(s.C(FieldClaimsUserID), v...))
-	})
+	return predicate.AuthRequest(sql.FieldNotIn(FieldClaimsUserID, vs...))
 }
 
 // ClaimsUserIDGT applies the GT predicate on the "claims_user_id" field.
 func ClaimsUserIDGT(v string) predicate.AuthRequest {
-	return predicate.AuthRequest(func(s *sql.Selector) {
-		s.Where(sql.GT(s.C(FieldClaimsUserID), v))
-	})
+	return predicate.AuthRequest(sql.FieldGT(FieldClaimsUserID, v))
 }
 
 // ClaimsUserIDGTE applies the GTE predicate on the "claims_user_id" field.
 func ClaimsUserIDGTE(v string) predicate.AuthRequest {
-	return predicate.AuthRequest(func(s *sql.Selector) {
-		s.Where(sql.GTE(s.C(FieldClaimsUserID), v))
-	})
+	return predicate.AuthRequest(sql.FieldGTE(FieldClaimsUserID, v))
 }
 
 // ClaimsUserIDLT applies the LT predicate on the "claims_user_id" field.
 func ClaimsUserIDLT(v string) predicate.AuthRequest {
-	return predicate.AuthRequest(func(s *sql.Selector) {
-		s.Where(sql.LT(s.C(FieldClaimsUserID), v))
-	})
+	return predicate.AuthRequest(sql.FieldLT(FieldClaimsUserID, v))
 }
 
 // ClaimsUserIDLTE applies the LTE predicate on the "claims_user_id" field.
 func ClaimsUserIDLTE(v string) predicate.AuthRequest {
-	return predicate.AuthRequest(func(s *sql.Selector) {
-		s.Where(sql.LTE(s.C(FieldClaimsUserID), v))
-	})
+	return predicate.AuthRequest(sql.FieldLTE(FieldClaimsUserID, v))
 }
 
 // ClaimsUserIDContains applies the Contains predicate on the "claims_user_id" field.
 func ClaimsUserIDContains(v string) predicate.AuthRequest {
-	return predicate.AuthRequest(func(s *sql.Selector) {
-		s.Where(sql.Contains(s.C(FieldClaimsUserID), v))
-	})
+	return predicate.AuthRequest(sql.FieldContains(FieldClaimsUserID, v))
 }
 
 // ClaimsUserIDHasPrefix applies the HasPrefix predicate on the "claims_user_id" field.
 func ClaimsUserIDHasPrefix(v string) predicate.AuthRequest {
-	return predicate.AuthRequest(func(s *sql.Selector) {
-		s.Where(sql.HasPrefix(s.C(FieldClaimsUserID), v))
-	})
+	return predicate.AuthRequest(sql.FieldHasPrefix(FieldClaimsUserID, v))
 }
 
 // ClaimsUserIDHasSuffix applies the HasSuffix predicate on the "claims_user_id" field.
 func ClaimsUserIDHasSuffix(v string) predicate.AuthRequest {
-	return predicate.AuthRequest(func(s *sql.Selector) {
-		s.Where(sql.HasSuffix(s.C(FieldClaimsUserID), v))
-	})
+	return predicate.AuthRequest(sql.FieldHasSuffix(FieldClaimsUserID, v))
 }
 
 // ClaimsUserIDEqualFold applies the EqualFold predicate on the "claims_user_id" field.
 func ClaimsUserIDEqualFold(v string) predicate.AuthRequest {
-	return predicate.AuthRequest(func(s *sql.Selector) {
-		s.Where(sql.EqualFold(s.C(FieldClaimsUserID), v))
-	})
+	return predicate.AuthRequest(sql.FieldEqualFold(FieldClaimsUserID, v))
 }
 
 // ClaimsUserIDContainsFold applies the ContainsFold predicate on the "claims_user_id" field.
 func ClaimsUserIDContainsFold(v string) predicate.AuthRequest {
-	return predicate.AuthRequest(func(s *sql.Selector) {
-		s.Where(sql.ContainsFold(s.C(FieldClaimsUserID), v))
-	})
+	return predicate.AuthRequest(sql.FieldContainsFold(FieldClaimsUserID, v))
 }
 
 // ClaimsUsernameEQ applies the EQ predicate on the "claims_username" field.
 func ClaimsUsernameEQ(v string) predicate.AuthRequest {
-	return predicate.AuthRequest(func(s *sql.Selector) {
-		s.Where(sql.EQ(s.C(FieldClaimsUsername), v))
-	})
+	return predicate.AuthRequest(sql.FieldEQ(FieldClaimsUsername, v))
 }
 
 // ClaimsUsernameNEQ applies the NEQ predicate on the "claims_username" field.
 func ClaimsUsernameNEQ(v string) predicate.AuthRequest {
-	return predicate.AuthRequest(func(s *sql.Selector) {
-		s.Where(sql.NEQ(s.C(FieldClaimsUsername), v))
-	})
+	return predicate.AuthRequest(sql.FieldNEQ(FieldClaimsUsername, v))
 }
 
 // ClaimsUsernameIn applies the In predicate on the "claims_username" field.
 func ClaimsUsernameIn(vs ...string) predicate.AuthRequest {
-	v := make([]interface{}, len(vs))
-	for i := range v {
-		v[i] = vs[i]
-	}
-	return predicate.AuthRequest(func(s *sql.Selector) {
-		s.Where(sql.In(s.C(FieldClaimsUsername), v...))
-	})
+	return predicate.AuthRequest(sql.FieldIn(FieldClaimsUsername, vs...))
 }
 
 // ClaimsUsernameNotIn applies the NotIn predicate on the "claims_username" field.
 func ClaimsUsernameNotIn(vs ...string) predicate.AuthRequest {
-	v := make([]interface{}, len(vs))
-	for i := range v {
-		v[i] = vs[i]
-	}
-	return predicate.AuthRequest(func(s *sql.Selector) {
-		s.Where(sql.NotIn(s.C(FieldClaimsUsername), v...))
-	})
+	return predicate.AuthRequest(sql.FieldNotIn(FieldClaimsUsername, vs...))
 }
 
 // ClaimsUsernameGT applies the GT predicate on the "claims_username" field.
 func ClaimsUsernameGT(v string) predicate.AuthRequest {
-	return predicate.AuthRequest(func(s *sql.Selector) {
-		s.Where(sql.GT(s.C(FieldClaimsUsername), v))
-	})
+	return predicate.AuthRequest(sql.FieldGT(FieldClaimsUsername, v))
 }
 
 // ClaimsUsernameGTE applies the GTE predicate on the "claims_username" field.
 func ClaimsUsernameGTE(v string) predicate.AuthRequest {
-	return predicate.AuthRequest(func(s *sql.Selector) {
-		s.Where(sql.GTE(s.C(FieldClaimsUsername), v))
-	})
+	return predicate.AuthRequest(sql.FieldGTE(FieldClaimsUsername, v))
 }
 
 // ClaimsUsernameLT applies the LT predicate on the "claims_username" field.
 func ClaimsUsernameLT(v string) predicate.AuthRequest {
-	return predicate.AuthRequest(func(s *sql.Selector) {
-		s.Where(sql.LT(s.C(FieldClaimsUsername), v))
-	})
+	return predicate.AuthRequest(sql.FieldLT(FieldClaimsUsername, v))
 }
 
 // ClaimsUsernameLTE applies the LTE predicate on the "claims_username" field.
 func ClaimsUsernameLTE(v string) predicate.AuthRequest {
-	return predicate.AuthRequest(func(s *sql.Selector) {
-		s.Where(sql.LTE(s.C(FieldClaimsUsername), v))
-	})
+	return predicate.AuthRequest(sql.FieldLTE(FieldClaimsUsername, v))
 }
 
 // ClaimsUsernameContains applies the Contains predicate on the "claims_username" field.
 func ClaimsUsernameContains(v string) predicate.AuthRequest {
-	return predicate.AuthRequest(func(s *sql.Selector) {
-		s.Where(sql.Contains(s.C(FieldClaimsUsername), v))
-	})
+	return predicate.AuthRequest(sql.FieldContains(FieldClaimsUsername, v))
 }
 
 // ClaimsUsernameHasPrefix applies the HasPrefix predicate on the "claims_username" field.
 func ClaimsUsernameHasPrefix(v string) predicate.AuthRequest {
-	return predicate.AuthRequest(func(s *sql.Selector) {
-		s.Where(sql.HasPrefix(s.C(FieldClaimsUsername), v))
-	})
+	return predicate.AuthRequest(sql.FieldHasPrefix(FieldClaimsUsername, v))
 }
 
 // ClaimsUsernameHasSuffix applies the HasSuffix predicate on the "claims_username" field.
 func ClaimsUsernameHasSuffix(v string) predicate.AuthRequest {
-	return predicate.AuthRequest(func(s *sql.Selector) {
-		s.Where(sql.HasSuffix(s.C(FieldClaimsUsername), v))
-	})
+	return predicate.AuthRequest(sql.FieldHasSuffix(FieldClaimsUsername, v))
 }
 
 // ClaimsUsernameEqualFold applies the EqualFold predicate on the "claims_username" field.
 func ClaimsUsernameEqualFold(v string) predicate.AuthRequest {
-	return predicate.AuthRequest(func(s *sql.Selector) {
-		s.Where(sql.EqualFold(s.C(FieldClaimsUsername), v))
-	})
+	return predicate.AuthRequest(sql.FieldEqualFold(FieldClaimsUsername, v))
 }
 
 // ClaimsUsernameContainsFold applies the ContainsFold predicate on the "claims_username" field.
 func ClaimsUsernameContainsFold(v string) predicate.AuthRequest {
-	return predicate.AuthRequest(func(s *sql.Selector) {
-		s.Where(sql.ContainsFold(s.C(FieldClaimsUsername), v))
-	})
+	return predicate.AuthRequest(sql.FieldContainsFold(FieldClaimsUsername, v))
 }
 
 // ClaimsEmailEQ applies the EQ predicate on the "claims_email" field.
 func ClaimsEmailEQ(v string) predicate.AuthRequest {
-	return predicate.AuthRequest(func(s *sql.Selector) {
-		s.Where(sql.EQ(s.C(FieldClaimsEmail), v))
-	})
+	return predicate.AuthRequest(sql.FieldEQ(FieldClaimsEmail, v))
 }
 
 // ClaimsEmailNEQ applies the NEQ predicate on the "claims_email" field.
 func ClaimsEmailNEQ(v string) predicate.AuthRequest {
-	return predicate.AuthRequest(func(s *sql.Selector) {
-		s.Where(sql.NEQ(s.C(FieldClaimsEmail), v))
-	})
+	return predicate.AuthRequest(sql.FieldNEQ(FieldClaimsEmail, v))
 }
 
 // ClaimsEmailIn applies the In predicate on the "claims_email" field.
 func ClaimsEmailIn(vs ...string) predicate.AuthRequest {
-	v := make([]interface{}, len(vs))
-	for i := range v {
-		v[i] = vs[i]
-	}
-	return predicate.AuthRequest(func(s *sql.Selector) {
-		s.Where(sql.In(s.C(FieldClaimsEmail), v...))
-	})
+	return predicate.AuthRequest(sql.FieldIn(FieldClaimsEmail, vs...))
 }
 
 // ClaimsEmailNotIn applies the NotIn predicate on the "claims_email" field.
 func ClaimsEmailNotIn(vs ...string) predicate.AuthRequest {
-	v := make([]interface{}, len(vs))
-	for i := range v {
-		v[i] = vs[i]
-	}
-	return predicate.AuthRequest(func(s *sql.Selector) {
-		s.Where(sql.NotIn(s.C(FieldClaimsEmail), v...))
-	})
+	return predicate.AuthRequest(sql.FieldNotIn(FieldClaimsEmail, vs...))
 }
 
 // ClaimsEmailGT applies the GT predicate on the "claims_email" field.
 func ClaimsEmailGT(v string) predicate.AuthRequest {
-	return predicate.AuthRequest(func(s *sql.Selector) {
-		s.Where(sql.GT(s.C(FieldClaimsEmail), v))
-	})
+	return predicate.AuthRequest(sql.FieldGT(FieldClaimsEmail, v))
 }
 
 // ClaimsEmailGTE applies the GTE predicate on the "claims_email" field.
 func ClaimsEmailGTE(v string) predicate.AuthRequest {
-	return predicate.AuthRequest(func(s *sql.Selector) {
-		s.Where(sql.GTE(s.C(FieldClaimsEmail), v))
-	})
+	return predicate.AuthRequest(sql.FieldGTE(FieldClaimsEmail, v))
 }
 
 // ClaimsEmailLT applies the LT predicate on the "claims_email" field.
 func ClaimsEmailLT(v string) predicate.AuthRequest {
-	return predicate.AuthRequest(func(s *sql.Selector) {
-		s.Where(sql.LT(s.C(FieldClaimsEmail), v))
-	})
+	return predicate.AuthRequest(sql.FieldLT(FieldClaimsEmail, v))
 }
 
 // ClaimsEmailLTE applies the LTE predicate on the "claims_email" field.
 func ClaimsEmailLTE(v string) predicate.AuthRequest {
-	return predicate.AuthRequest(func(s *sql.Selector) {
-		s.Where(sql.LTE(s.C(FieldClaimsEmail), v))
-	})
+	return predicate.AuthRequest(sql.FieldLTE(FieldClaimsEmail, v))
 }
 
 // ClaimsEmailContains applies the Contains predicate on the "claims_email" field.
 func ClaimsEmailContains(v string) predicate.AuthRequest {
-	return predicate.AuthRequest(func(s *sql.Selector) {
-		s.Where(sql.Contains(s.C(FieldClaimsEmail), v))
-	})
+	return predicate.AuthRequest(sql.FieldContains(FieldClaimsEmail, v))
 }
 
 // ClaimsEmailHasPrefix applies the HasPrefix predicate on the "claims_email" field.
 func ClaimsEmailHasPrefix(v string) predicate.AuthRequest {
-	return predicate.AuthRequest(func(s *sql.Selector) {
-		s.Where(sql.HasPrefix(s.C(FieldClaimsEmail), v))
-	})
+	return predicate.AuthRequest(sql.FieldHasPrefix(FieldClaimsEmail, v))
 }
 
 // ClaimsEmailHasSuffix applies the HasSuffix predicate on the "claims_email" field.
 func ClaimsEmailHasSuffix(v string) predicate.AuthRequest {
-	return predicate.AuthRequest(func(s *sql.Selector) {
-		s.Where(sql.HasSuffix(s.C(FieldClaimsEmail), v))
-	})
+	return predicate.AuthRequest(sql.FieldHasSuffix(FieldClaimsEmail, v))
 }
 
 // ClaimsEmailEqualFold applies the EqualFold predicate on the "claims_email" field.
 func ClaimsEmailEqualFold(v string) predicate.AuthRequest {
-	return predicate.AuthRequest(func(s *sql.Selector) {
-		s.Where(sql.EqualFold(s.C(FieldClaimsEmail), v))
-	})
+	return predicate.AuthRequest(sql.FieldEqualFold(FieldClaimsEmail, v))
 }
 
 // ClaimsEmailContainsFold applies the ContainsFold predicate on the "claims_email" field.
 func ClaimsEmailContainsFold(v string) predicate.AuthRequest {
-	return predicate.AuthRequest(func(s *sql.Selector) {
-		s.Where(sql.ContainsFold(s.C(FieldClaimsEmail), v))
-	})
+	return predicate.AuthRequest(sql.FieldContainsFold(FieldClaimsEmail, v))
 }
 
 // ClaimsEmailVerifiedEQ applies the EQ predicate on the "claims_email_verified" field.
 func ClaimsEmailVerifiedEQ(v bool) predicate.AuthRequest {
-	return predicate.AuthRequest(func(s *sql.Selector) {
-		s.Where(sql.EQ(s.C(FieldClaimsEmailVerified), v))
-	})
+	return predicate.AuthRequest(sql.FieldEQ(FieldClaimsEmailVerified, v))
 }
 
 // ClaimsEmailVerifiedNEQ applies the NEQ predicate on the "claims_email_verified" field.
 func ClaimsEmailVerifiedNEQ(v bool) predicate.AuthRequest {
-	return predicate.AuthRequest(func(s *sql.Selector) {
-		s.Where(sql.NEQ(s.C(FieldClaimsEmailVerified), v))
-	})
+	return predicate.AuthRequest(sql.FieldNEQ(FieldClaimsEmailVerified, v))
 }
 
 // ClaimsGroupsIsNil applies the IsNil predicate on the "claims_groups" field.
 func ClaimsGroupsIsNil() predicate.AuthRequest {
-	return predicate.AuthRequest(func(s *sql.Selector) {
-		s.Where(sql.IsNull(s.C(FieldClaimsGroups)))
-	})
+	return predicate.AuthRequest(sql.FieldIsNull(FieldClaimsGroups))
 }
 
 // ClaimsGroupsNotNil applies the NotNil predicate on the "claims_groups" field.
 func ClaimsGroupsNotNil() predicate.AuthRequest {
-	return predicate.AuthRequest(func(s *sql.Selector) {
-		s.Where(sql.NotNull(s.C(FieldClaimsGroups)))
-	})
+	return predicate.AuthRequest(sql.FieldNotNull(FieldClaimsGroups))
 }
 
 // ClaimsPreferredUsernameEQ applies the EQ predicate on the "claims_preferred_username" field.
 func ClaimsPreferredUsernameEQ(v string) predicate.AuthRequest {
-	return predicate.AuthRequest(func(s *sql.Selector) {
-		s.Where(sql.EQ(s.C(FieldClaimsPreferredUsername), v))
-	})
+	return predicate.AuthRequest(sql.FieldEQ(FieldClaimsPreferredUsername, v))
 }
 
 // ClaimsPreferredUsernameNEQ applies the NEQ predicate on the "claims_preferred_username" field.
 func ClaimsPreferredUsernameNEQ(v string) predicate.AuthRequest {
-	return predicate.AuthRequest(func(s *sql.Selector) {
-		s.Where(sql.NEQ(s.C(FieldClaimsPreferredUsername), v))
-	})
+	return predicate.AuthRequest(sql.FieldNEQ(FieldClaimsPreferredUsername, v))
 }
 
 // ClaimsPreferredUsernameIn applies the In predicate on the "claims_preferred_username" field.
 func ClaimsPreferredUsernameIn(vs ...string) predicate.AuthRequest {
-	v := make([]interface{}, len(vs))
-	for i := range v {
-		v[i] = vs[i]
-	}
-	return predicate.AuthRequest(func(s *sql.Selector) {
-		s.Where(sql.In(s.C(FieldClaimsPreferredUsername), v...))
-	})
+	return predicate.AuthRequest(sql.FieldIn(FieldClaimsPreferredUsername, vs...))
 }
 
 // ClaimsPreferredUsernameNotIn applies the NotIn predicate on the "claims_preferred_username" field.
 func ClaimsPreferredUsernameNotIn(vs ...string) predicate.AuthRequest {
-	v := make([]interface{}, len(vs))
-	for i := range v {
-		v[i] = vs[i]
-	}
-	return predicate.AuthRequest(func(s *sql.Selector) {
-		s.Where(sql.NotIn(s.C(FieldClaimsPreferredUsername), v...))
-	})
+	return predicate.AuthRequest(sql.FieldNotIn(FieldClaimsPreferredUsername, vs...))
 }
 
 // ClaimsPreferredUsernameGT applies the GT predicate on the "claims_preferred_username" field.
 func ClaimsPreferredUsernameGT(v string) predicate.AuthRequest {
-	return predicate.AuthRequest(func(s *sql.Selector) {
-		s.Where(sql.GT(s.C(FieldClaimsPreferredUsername), v))
-	})
+	return predicate.AuthRequest(sql.FieldGT(FieldClaimsPreferredUsername, v))
 }
 
 // ClaimsPreferredUsernameGTE applies the GTE predicate on the "claims_preferred_username" field.
 func ClaimsPreferredUsernameGTE(v string) predicate.AuthRequest {
-	return predicate.AuthRequest(func(s *sql.Selector) {
-		s.Where(sql.GTE(s.C(FieldClaimsPreferredUsername), v))
-	})
+	return predicate.AuthRequest(sql.FieldGTE(FieldClaimsPreferredUsername, v))
 }
 
 // ClaimsPreferredUsernameLT applies the LT predicate on the "claims_preferred_username" field.
 func ClaimsPreferredUsernameLT(v string) predicate.AuthRequest {
-	return predicate.AuthRequest(func(s *sql.Selector) {
-		s.Where(sql.LT(s.C(FieldClaimsPreferredUsername), v))
-	})
+	return predicate.AuthRequest(sql.FieldLT(FieldClaimsPreferredUsername, v))
 }
 
 // ClaimsPreferredUsernameLTE applies the LTE predicate on the "claims_preferred_username" field.
 func ClaimsPreferredUsernameLTE(v string) predicate.AuthRequest {
-	return predicate.AuthRequest(func(s *sql.Selector) {
-		s.Where(sql.LTE(s.C(FieldClaimsPreferredUsername), v))
-	})
+	return predicate.AuthRequest(sql.FieldLTE(FieldClaimsPreferredUsername, v))
 }
 
 // ClaimsPreferredUsernameContains applies the Contains predicate on the "claims_preferred_username" field.
 func ClaimsPreferredUsernameContains(v string) predicate.AuthRequest {
-	return predicate.AuthRequest(func(s *sql.Selector) {
-		s.Where(sql.Contains(s.C(FieldClaimsPreferredUsername), v))
-	})
+	return predicate.AuthRequest(sql.FieldContains(FieldClaimsPreferredUsername, v))
 }
 
 // ClaimsPreferredUsernameHasPrefix applies the HasPrefix predicate on the "claims_preferred_username" field.
 func ClaimsPreferredUsernameHasPrefix(v string) predicate.AuthRequest {
-	return predicate.AuthRequest(func(s *sql.Selector) {
-		s.Where(sql.HasPrefix(s.C(FieldClaimsPreferredUsername), v))
-	})
+	return predicate.AuthRequest(sql.FieldHasPrefix(FieldClaimsPreferredUsername, v))
 }
 
 // ClaimsPreferredUsernameHasSuffix applies the HasSuffix predicate on the "claims_preferred_username" field.
 func ClaimsPreferredUsernameHasSuffix(v string) predicate.AuthRequest {
-	return predicate.AuthRequest(func(s *sql.Selector) {
-		s.Where(sql.HasSuffix(s.C(FieldClaimsPreferredUsername), v))
-	})
+	return predicate.AuthRequest(sql.FieldHasSuffix(FieldClaimsPreferredUsername, v))
 }
 
 // ClaimsPreferredUsernameEqualFold applies the EqualFold predicate on the "claims_preferred_username" field.
 func ClaimsPreferredUsernameEqualFold(v string) predicate.AuthRequest {
-	return predicate.AuthRequest(func(s *sql.Selector) {
-		s.Where(sql.EqualFold(s.C(FieldClaimsPreferredUsername), v))
-	})
+	return predicate.AuthRequest(sql.FieldEqualFold(FieldClaimsPreferredUsername, v))
 }
 
 // ClaimsPreferredUsernameContainsFold applies the ContainsFold predicate on the "claims_preferred_username" field.
 func ClaimsPreferredUsernameContainsFold(v string) predicate.AuthRequest {
-	return predicate.AuthRequest(func(s *sql.Selector) {
-		s.Where(sql.ContainsFold(s.C(FieldClaimsPreferredUsername), v))
-	})
+	return predicate.AuthRequest(sql.FieldContainsFold(FieldClaimsPreferredUsername, v))
 }
 
 // ConnectorIDEQ applies the EQ predicate on the "connector_id" field.
 func ConnectorIDEQ(v string) predicate.AuthRequest {
-	return predicate.AuthRequest(func(s *sql.Selector) {
-		s.Where(sql.EQ(s.C(FieldConnectorID), v))
-	})
+	return predicate.AuthRequest(sql.FieldEQ(FieldConnectorID, v))
 }
 
 // ConnectorIDNEQ applies the NEQ predicate on the "connector_id" field.
 func ConnectorIDNEQ(v string) predicate.AuthRequest {
-	return predicate.AuthRequest(func(s *sql.Selector) {
-		s.Where(sql.NEQ(s.C(FieldConnectorID), v))
-	})
+	return predicate.AuthRequest(sql.FieldNEQ(FieldConnectorID, v))
 }
 
 // ConnectorIDIn applies the In predicate on the "connector_id" field.
 func ConnectorIDIn(vs ...string) predicate.AuthRequest {
-	v := make([]interface{}, len(vs))
-	for i := range v {
-		v[i] = vs[i]
-	}
-	return predicate.AuthRequest(func(s *sql.Selector) {
-		s.Where(sql.In(s.C(FieldConnectorID), v...))
-	})
+	return predicate.AuthRequest(sql.FieldIn(FieldConnectorID, vs...))
 }
 
 // ConnectorIDNotIn applies the NotIn predicate on the "connector_id" field.
 func ConnectorIDNotIn(vs ...string) predicate.AuthRequest {
-	v := make([]interface{}, len(vs))
-	for i := range v {
-		v[i] = vs[i]
-	}
-	return predicate.AuthRequest(func(s *sql.Selector) {
-		s.Where(sql.NotIn(s.C(FieldConnectorID), v...))
-	})
+	return predicate.AuthRequest(sql.FieldNotIn(FieldConnectorID, vs...))
 }
 
 // ConnectorIDGT applies the GT predicate on the "connector_id" field.
 func ConnectorIDGT(v string) predicate.AuthRequest {
-	return predicate.AuthRequest(func(s *sql.Selector) {
-		s.Where(sql.GT(s.C(FieldConnectorID), v))
-	})
+	return predicate.AuthRequest(sql.FieldGT(FieldConnectorID, v))
 }
 
 // ConnectorIDGTE applies the GTE predicate on the "connector_id" field.
 func ConnectorIDGTE(v string) predicate.AuthRequest {
-	return predicate.AuthRequest(func(s *sql.Selector) {
-		s.Where(sql.GTE(s.C(FieldConnectorID), v))
-	})
+	return predicate.AuthRequest(sql.FieldGTE(FieldConnectorID, v))
 }
 
 // ConnectorIDLT applies the LT predicate on the "connector_id" field.
 func ConnectorIDLT(v string) predicate.AuthRequest {
-	return predicate.AuthRequest(func(s *sql.Selector) {
-		s.Where(sql.LT(s.C(FieldConnectorID), v))
-	})
+	return predicate.AuthRequest(sql.FieldLT(FieldConnectorID, v))
 }
 
 // ConnectorIDLTE applies the LTE predicate on the "connector_id" field.
 func ConnectorIDLTE(v string) predicate.AuthRequest {
-	return predicate.AuthRequest(func(s *sql.Selector) {
-		s.Where(sql.LTE(s.C(FieldConnectorID), v))
-	})
+	return predicate.AuthRequest(sql.FieldLTE(FieldConnectorID, v))
 }
 
 // ConnectorIDContains applies the Contains predicate on the "connector_id" field.
 func ConnectorIDContains(v string) predicate.AuthRequest {
-	return predicate.AuthRequest(func(s *sql.Selector) {
-		s.Where(sql.Contains(s.C(FieldConnectorID), v))
-	})
+	return predicate.AuthRequest(sql.FieldContains(FieldConnectorID, v))
 }
 
 // ConnectorIDHasPrefix applies the HasPrefix predicate on the "connector_id" field.
 func ConnectorIDHasPrefix(v string) predicate.AuthRequest {
-	return predicate.AuthRequest(func(s *sql.Selector) {
-		s.Where(sql.HasPrefix(s.C(FieldConnectorID), v))
-	})
+	return predicate.AuthRequest(sql.FieldHasPrefix(FieldConnectorID, v))
 }
 
 // ConnectorIDHasSuffix applies the HasSuffix predicate on the "connector_id" field.
 func ConnectorIDHasSuffix(v string) predicate.AuthRequest {
-	return predicate.AuthRequest(func(s *sql.Selector) {
-		s.Where(sql.HasSuffix(s.C(FieldConnectorID), v))
-	})
+	return predicate.AuthRequest(sql.FieldHasSuffix(FieldConnectorID, v))
 }
 
 // ConnectorIDEqualFold applies the EqualFold predicate on the "connector_id" field.
 func ConnectorIDEqualFold(v string) predicate.AuthRequest {
-	return predicate.AuthRequest(func(s *sql.Selector) {
-		s.Where(sql.EqualFold(s.C(FieldConnectorID), v))
-	})
+	return predicate.AuthRequest(sql.FieldEqualFold(FieldConnectorID, v))
 }
 
 // ConnectorIDContainsFold applies the ContainsFold predicate on the "connector_id" field.
 func ConnectorIDContainsFold(v string) predicate.AuthRequest {
-	return predicate.AuthRequest(func(s *sql.Selector) {
-		s.Where(sql.ContainsFold(s.C(FieldConnectorID), v))
-	})
+	return predicate.AuthRequest(sql.FieldContainsFold(FieldConnectorID, v))
 }
 
 // ConnectorDataEQ applies the EQ predicate on the "connector_data" field.
 func ConnectorDataEQ(v []byte) predicate.AuthRequest {
-	return predicate.AuthRequest(func(s *sql.Selector) {
-		s.Where(sql.EQ(s.C(FieldConnectorData), v))
-	})
+	return predicate.AuthRequest(sql.FieldEQ(FieldConnectorData, v))
 }
 
 // ConnectorDataNEQ applies the NEQ predicate on the "connector_data" field.
 func ConnectorDataNEQ(v []byte) predicate.AuthRequest {
-	return predicate.AuthRequest(func(s *sql.Selector) {
-		s.Where(sql.NEQ(s.C(FieldConnectorData), v))
-	})
+	return predicate.AuthRequest(sql.FieldNEQ(FieldConnectorData, v))
 }
 
 // ConnectorDataIn applies the In predicate on the "connector_data" field.
 func ConnectorDataIn(vs ...[]byte) predicate.AuthRequest {
-	v := make([]interface{}, len(vs))
-	for i := range v {
-		v[i] = vs[i]
-	}
-	return predicate.AuthRequest(func(s *sql.Selector) {
-		s.Where(sql.In(s.C(FieldConnectorData), v...))
-	})
+	return predicate.AuthRequest(sql.FieldIn(FieldConnectorData, vs...))
 }
 
 // ConnectorDataNotIn applies the NotIn predicate on the "connector_data" field.
 func ConnectorDataNotIn(vs ...[]byte) predicate.AuthRequest {
-	v := make([]interface{}, len(vs))
-	for i := range v {
-		v[i] = vs[i]
-	}
-	return predicate.AuthRequest(func(s *sql.Selector) {
-		s.Where(sql.NotIn(s.C(FieldConnectorData), v...))
-	})
+	return predicate.AuthRequest(sql.FieldNotIn(FieldConnectorData, vs...))
 }
 
 // ConnectorDataGT applies the GT predicate on the "connector_data" field.
 func ConnectorDataGT(v []byte) predicate.AuthRequest {
-	return predicate.AuthRequest(func(s *sql.Selector) {
-		s.Where(sql.GT(s.C(FieldConnectorData), v))
-	})
+	return predicate.AuthRequest(sql.FieldGT(FieldConnectorData, v))
 }
 
 // ConnectorDataGTE applies the GTE predicate on the "connector_data" field.
 func ConnectorDataGTE(v []byte) predicate.AuthRequest {
-	return predicate.AuthRequest(func(s *sql.Selector) {
-		s.Where(sql.GTE(s.C(FieldConnectorData), v))
-	})
+	return predicate.AuthRequest(sql.FieldGTE(FieldConnectorData, v))
 }
 
 // ConnectorDataLT applies the LT predicate on the "connector_data" field.
 func ConnectorDataLT(v []byte) predicate.AuthRequest {
-	return predicate.AuthRequest(func(s *sql.Selector) {
-		s.Where(sql.LT(s.C(FieldConnectorData), v))
-	})
+	return predicate.AuthRequest(sql.FieldLT(FieldConnectorData, v))
 }
 
 // ConnectorDataLTE applies the LTE predicate on the "connector_data" field.
 func ConnectorDataLTE(v []byte) predicate.AuthRequest {
-	return predicate.AuthRequest(func(s *sql.Selector) {
-		s.Where(sql.LTE(s.C(FieldConnectorData), v))
-	})
+	return predicate.AuthRequest(sql.FieldLTE(FieldConnectorData, v))
 }
 
 // ConnectorDataIsNil applies the IsNil predicate on the "connector_data" field.
 func ConnectorDataIsNil() predicate.AuthRequest {
-	return predicate.AuthRequest(func(s *sql.Selector) {
-		s.Where(sql.IsNull(s.C(FieldConnectorData)))
-	})
+	return predicate.AuthRequest(sql.FieldIsNull(FieldConnectorData))
 }
 
 // ConnectorDataNotNil applies the NotNil predicate on the "connector_data" field.
 func ConnectorDataNotNil() predicate.AuthRequest {
-	return predicate.AuthRequest(func(s *sql.Selector) {
-		s.Where(sql.NotNull(s.C(FieldConnectorData)))
-	})
+	return predicate.AuthRequest(sql.FieldNotNull(FieldConnectorData))
 }
 
 // ExpiryEQ applies the EQ predicate on the "expiry" field.
 func ExpiryEQ(v time.Time) predicate.AuthRequest {
-	return predicate.AuthRequest(func(s *sql.Selector) {
-		s.Where(sql.EQ(s.C(FieldExpiry), v))
-	})
+	return predicate.AuthRequest(sql.FieldEQ(FieldExpiry, v))
 }
 
 // ExpiryNEQ applies the NEQ predicate on the "expiry" field.
 func ExpiryNEQ(v time.Time) predicate.AuthRequest {
-	return predicate.AuthRequest(func(s *sql.Selector) {
-		s.Where(sql.NEQ(s.C(FieldExpiry), v))
-	})
+	return predicate.AuthRequest(sql.FieldNEQ(FieldExpiry, v))
 }
 
 // ExpiryIn applies the In predicate on the "expiry" field.
 func ExpiryIn(vs ...time.Time) predicate.AuthRequest {
-	v := make([]interface{}, len(vs))
-	for i := range v {
-		v[i] = vs[i]
-	}
-	return predicate.AuthRequest(func(s *sql.Selector) {
-		s.Where(sql.In(s.C(FieldExpiry), v...))
-	})
+	return predicate.AuthRequest(sql.FieldIn(FieldExpiry, vs...))
 }
 
 // ExpiryNotIn applies the NotIn predicate on the "expiry" field.
 func ExpiryNotIn(vs ...time.Time) predicate.AuthRequest {
-	v := make([]interface{}, len(vs))
-	for i := range v {
-		v[i] = vs[i]
-	}
-	return predicate.AuthRequest(func(s *sql.Selector) {
-		s.Where(sql.NotIn(s.C(FieldExpiry), v...))
-	})
+	return predicate.AuthRequest(sql.FieldNotIn(FieldExpiry, vs...))
 }
 
 // ExpiryGT applies the GT predicate on the "expiry" field.
 func ExpiryGT(v time.Time) predicate.AuthRequest {
-	return predicate.AuthRequest(func(s *sql.Selector) {
-		s.Where(sql.GT(s.C(FieldExpiry), v))
-	})
+	return predicate.AuthRequest(sql.FieldGT(FieldExpiry, v))
 }
 
 // ExpiryGTE applies the GTE predicate on the "expiry" field.
 func ExpiryGTE(v time.Time) predicate.AuthRequest {
-	return predicate.AuthRequest(func(s *sql.Selector) {
-		s.Where(sql.GTE(s.C(FieldExpiry), v))
-	})
+	return predicate.AuthRequest(sql.FieldGTE(FieldExpiry, v))
 }
 
 // ExpiryLT applies the LT predicate on the "expiry" field.
 func ExpiryLT(v time.Time) predicate.AuthRequest {
-	return predicate.AuthRequest(func(s *sql.Selector) {
-		s.Where(sql.LT(s.C(FieldExpiry), v))
-	})
+	return predicate.AuthRequest(sql.FieldLT(FieldExpiry, v))
 }
 
 // ExpiryLTE applies the LTE predicate on the "expiry" field.
 func ExpiryLTE(v time.Time) predicate.AuthRequest {
-	return predicate.AuthRequest(func(s *sql.Selector) {
-		s.Where(sql.LTE(s.C(FieldExpiry), v))
-	})
+	return predicate.AuthRequest(sql.FieldLTE(FieldExpiry, v))
 }
 
 // CodeChallengeEQ applies the EQ predicate on the "code_challenge" field.
 func CodeChallengeEQ(v string) predicate.AuthRequest {
-	return predicate.AuthRequest(func(s *sql.Selector) {
-		s.Where(sql.EQ(s.C(FieldCodeChallenge), v))
-	})
+	return predicate.AuthRequest(sql.FieldEQ(FieldCodeChallenge, v))
 }
 
 // CodeChallengeNEQ applies the NEQ predicate on the "code_challenge" field.
 func CodeChallengeNEQ(v string) predicate.AuthRequest {
-	return predicate.AuthRequest(func(s *sql.Selector) {
-		s.Where(sql.NEQ(s.C(FieldCodeChallenge), v))
-	})
+	return predicate.AuthRequest(sql.FieldNEQ(FieldCodeChallenge, v))
 }
 
 // CodeChallengeIn applies the In predicate on the "code_challenge" field.
 func CodeChallengeIn(vs ...string) predicate.AuthRequest {
-	v := make([]interface{}, len(vs))
-	for i := range v {
-		v[i] = vs[i]
-	}
-	return predicate.AuthRequest(func(s *sql.Selector) {
-		s.Where(sql.In(s.C(FieldCodeChallenge), v...))
-	})
+	return predicate.AuthRequest(sql.FieldIn(FieldCodeChallenge, vs...))
 }
 
 // CodeChallengeNotIn applies the NotIn predicate on the "code_challenge" field.
 func CodeChallengeNotIn(vs ...string) predicate.AuthRequest {
-	v := make([]interface{}, len(vs))
-	for i := range v {
-		v[i] = vs[i]
-	}
-	return predicate.AuthRequest(func(s *sql.Selector) {
-		s.Where(sql.NotIn(s.C(FieldCodeChallenge), v...))
-	})
+	return predicate.AuthRequest(sql.FieldNotIn(FieldCodeChallenge, vs...))
 }
 
 // CodeChallengeGT applies the GT predicate on the "code_challenge" field.
 func CodeChallengeGT(v string) predicate.AuthRequest {
-	return predicate.AuthRequest(func(s *sql.Selector) {
-		s.Where(sql.GT(s.C(FieldCodeChallenge), v))
-	})
+	return predicate.AuthRequest(sql.FieldGT(FieldCodeChallenge, v))
 }
 
 // CodeChallengeGTE applies the GTE predicate on the "code_challenge" field.
 func CodeChallengeGTE(v string) predicate.AuthRequest {
-	return predicate.AuthRequest(func(s *sql.Selector) {
-		s.Where(sql.GTE(s.C(FieldCodeChallenge), v))
-	})
+	return predicate.AuthRequest(sql.FieldGTE(FieldCodeChallenge, v))
 }
 
 // CodeChallengeLT applies the LT predicate on the "code_challenge" field.
 func CodeChallengeLT(v string) predicate.AuthRequest {
-	return predicate.AuthRequest(func(s *sql.Selector) {
-		s.Where(sql.LT(s.C(FieldCodeChallenge), v))
-	})
+	return predicate.AuthRequest(sql.FieldLT(FieldCodeChallenge, v))
 }
 
 // CodeChallengeLTE applies the LTE predicate on the "code_challenge" field.
 func CodeChallengeLTE(v string) predicate.AuthRequest {
-	return predicate.AuthRequest(func(s *sql.Selector) {
-		s.Where(sql.LTE(s.C(FieldCodeChallenge), v))
-	})
+	return predicate.AuthRequest(sql.FieldLTE(FieldCodeChallenge, v))
 }
 
 // CodeChallengeContains applies the Contains predicate on the "code_challenge" field.
 func CodeChallengeContains(v string) predicate.AuthRequest {
-	return predicate.AuthRequest(func(s *sql.Selector) {
-		s.Where(sql.Contains(s.C(FieldCodeChallenge), v))
-	})
+	return predicate.AuthRequest(sql.FieldContains(FieldCodeChallenge, v))
 }
 
 // CodeChallengeHasPrefix applies the HasPrefix predicate on the "code_challenge" field.
 func CodeChallengeHasPrefix(v string) predicate.AuthRequest {
-	return predicate.AuthRequest(func(s *sql.Selector) {
-		s.Where(sql.HasPrefix(s.C(FieldCodeChallenge), v))
-	})
+	return predicate.AuthRequest(sql.FieldHasPrefix(FieldCodeChallenge, v))
 }
 
 // CodeChallengeHasSuffix applies the HasSuffix predicate on the "code_challenge" field.
 func CodeChallengeHasSuffix(v string) predicate.AuthRequest {
-	return predicate.AuthRequest(func(s *sql.Selector) {
-		s.Where(sql.HasSuffix(s.C(FieldCodeChallenge), v))
-	})
+	return predicate.AuthRequest(sql.FieldHasSuffix(FieldCodeChallenge, v))
 }
 
 // CodeChallengeEqualFold applies the EqualFold predicate on the "code_challenge" field.
 func CodeChallengeEqualFold(v string) predicate.AuthRequest {
-	return predicate.AuthRequest(func(s *sql.Selector) {
-		s.Where(sql.EqualFold(s.C(FieldCodeChallenge), v))
-	})
+	return predicate.AuthRequest(sql.FieldEqualFold(FieldCodeChallenge, v))
 }
 
 // CodeChallengeContainsFold applies the ContainsFold predicate on the "code_challenge" field.
 func CodeChallengeContainsFold(v string) predicate.AuthRequest {
-	return predicate.AuthRequest(func(s *sql.Selector) {
-		s.Where(sql.ContainsFold(s.C(FieldCodeChallenge), v))
-	})
+	return predicate.AuthRequest(sql.FieldContainsFold(FieldCodeChallenge, v))
 }
 
 // CodeChallengeMethodEQ applies the EQ predicate on the "code_challenge_method" field.
 func CodeChallengeMethodEQ(v string) predicate.AuthRequest {
-	return predicate.AuthRequest(func(s *sql.Selector) {
-		s.Where(sql.EQ(s.C(FieldCodeChallengeMethod), v))
-	})
+	return predicate.AuthRequest(sql.FieldEQ(FieldCodeChallengeMethod, v))
 }
 
 // CodeChallengeMethodNEQ applies the NEQ predicate on the "code_challenge_method" field.
 func CodeChallengeMethodNEQ(v string) predicate.AuthRequest {
-	return predicate.AuthRequest(func(s *sql.Selector) {
-		s.Where(sql.NEQ(s.C(FieldCodeChallengeMethod), v))
-	})
+	return predicate.AuthRequest(sql.FieldNEQ(FieldCodeChallengeMethod, v))
 }
 
 // CodeChallengeMethodIn applies the In predicate on the "code_challenge_method" field.
 func CodeChallengeMethodIn(vs ...string) predicate.AuthRequest {
-	v := make([]interface{}, len(vs))
-	for i := range v {
-		v[i] = vs[i]
-	}
-	return predicate.AuthRequest(func(s *sql.Selector) {
-		s.Where(sql.In(s.C(FieldCodeChallengeMethod), v...))
-	})
+	return predicate.AuthRequest(sql.FieldIn(FieldCodeChallengeMethod, vs...))
 }
 
 // CodeChallengeMethodNotIn applies the NotIn predicate on the "code_challenge_method" field.
 func CodeChallengeMethodNotIn(vs ...string) predicate.AuthRequest {
-	v := make([]interface{}, len(vs))
-	for i := range v {
-		v[i] = vs[i]
-	}
-	return predicate.AuthRequest(func(s *sql.Selector) {
-		s.Where(sql.NotIn(s.C(FieldCodeChallengeMethod), v...))
-	})
+	return predicate.AuthRequest(sql.FieldNotIn(FieldCodeChallengeMethod, vs...))
 }
 
 // CodeChallengeMethodGT applies the GT predicate on the "code_challenge_method" field.
 func CodeChallengeMethodGT(v string) predicate.AuthRequest {
-	return predicate.AuthRequest(func(s *sql.Selector) {
-		s.Where(sql.GT(s.C(FieldCodeChallengeMethod), v))
-	})
+	return predicate.AuthRequest(sql.FieldGT(FieldCodeChallengeMethod, v))
 }
 
 // CodeChallengeMethodGTE applies the GTE predicate on the "code_challenge_method" field.
 func CodeChallengeMethodGTE(v string) predicate.AuthRequest {
-	return predicate.AuthRequest(func(s *sql.Selector) {
-		s.Where(sql.GTE(s.C(FieldCodeChallengeMethod), v))
-	})
+	return predicate.AuthRequest(sql.FieldGTE(FieldCodeChallengeMethod, v))
 }
 
 // CodeChallengeMethodLT applies the LT predicate on the "code_challenge_method" field.
 func CodeChallengeMethodLT(v string) predicate.AuthRequest {
-	return predicate.AuthRequest(func(s *sql.Selector) {
-		s.Where(sql.LT(s.C(FieldCodeChallengeMethod), v))
-	})
+	return predicate.AuthRequest(sql.FieldLT(FieldCodeChallengeMethod, v))
 }
 
 // CodeChallengeMethodLTE applies the LTE predicate on the "code_challenge_method" field.
 func CodeChallengeMethodLTE(v string) predicate.AuthRequest {
-	return predicate.AuthRequest(func(s *sql.Selector) {
-		s.Where(sql.LTE(s.C(FieldCodeChallengeMethod), v))
-	})
+	return predicate.AuthRequest(sql.FieldLTE(FieldCodeChallengeMethod, v))
 }
 
 // CodeChallengeMethodContains applies the Contains predicate on the "code_challenge_method" field.
 func CodeChallengeMethodContains(v string) predicate.AuthRequest {
-	return predicate.AuthRequest(func(s *sql.Selector) {
-		s.Where(sql.Contains(s.C(FieldCodeChallengeMethod), v))
-	})
+	return predicate.AuthRequest(sql.FieldContains(FieldCodeChallengeMethod, v))
 }
 
 // CodeChallengeMethodHasPrefix applies the HasPrefix predicate on the "code_challenge_method" field.
 func CodeChallengeMethodHasPrefix(v string) predicate.AuthRequest {
-	return predicate.AuthRequest(func(s *sql.Selector) {
-		s.Where(sql.HasPrefix(s.C(FieldCodeChallengeMethod), v))
-	})
+	return predicate.AuthRequest(sql.FieldHasPrefix(FieldCodeChallengeMethod, v))
 }
 
 // CodeChallengeMethodHasSuffix applies the HasSuffix predicate on the "code_challenge_method" field.
 func CodeChallengeMethodHasSuffix(v string) predicate.AuthRequest {
-	return predicate.AuthRequest(func(s *sql.Selector) {
-		s.Where(sql.HasSuffix(s.C(FieldCodeChallengeMethod), v))
-	})
+	return predicate.AuthRequest(sql.FieldHasSuffix(FieldCodeChallengeMethod, v))
 }
 
 // CodeChallengeMethodEqualFold applies the EqualFold predicate on the "code_challenge_method" field.
 func CodeChallengeMethodEqualFold(v string) predicate.AuthRequest {
-	return predicate.AuthRequest(func(s *sql.Selector) {
-		s.Where(sql.EqualFold(s.C(FieldCodeChallengeMethod), v))
-	})
+	return predicate.AuthRequest(sql.FieldEqualFold(FieldCodeChallengeMethod, v))
 }
 
 // CodeChallengeMethodContainsFold applies the ContainsFold predicate on the "code_challenge_method" field.
 func CodeChallengeMethodContainsFold(v string) predicate.AuthRequest {
-	return predicate.AuthRequest(func(s *sql.Selector) {
-		s.Where(sql.ContainsFold(s.C(FieldCodeChallengeMethod), v))
-	})
+	return predicate.AuthRequest(sql.FieldContainsFold(FieldCodeChallengeMethod, v))
+}
+
+// HmacKeyEQ applies the EQ predicate on the "hmac_key" field.
+func HmacKeyEQ(v []byte) predicate.AuthRequest {
+	return predicate.AuthRequest(sql.FieldEQ(FieldHmacKey, v))
+}
+
+// HmacKeyNEQ applies the NEQ predicate on the "hmac_key" field.
+func HmacKeyNEQ(v []byte) predicate.AuthRequest {
+	return predicate.AuthRequest(sql.FieldNEQ(FieldHmacKey, v))
+}
+
+// HmacKeyIn applies the In predicate on the "hmac_key" field.
+func HmacKeyIn(vs ...[]byte) predicate.AuthRequest {
+	return predicate.AuthRequest(sql.FieldIn(FieldHmacKey, vs...))
+}
+
+// HmacKeyNotIn applies the NotIn predicate on the "hmac_key" field.
+func HmacKeyNotIn(vs ...[]byte) predicate.AuthRequest {
+	return predicate.AuthRequest(sql.FieldNotIn(FieldHmacKey, vs...))
+}
+
+// HmacKeyGT applies the GT predicate on the "hmac_key" field.
+func HmacKeyGT(v []byte) predicate.AuthRequest {
+	return predicate.AuthRequest(sql.FieldGT(FieldHmacKey, v))
+}
+
+// HmacKeyGTE applies the GTE predicate on the "hmac_key" field.
+func HmacKeyGTE(v []byte) predicate.AuthRequest {
+	return predicate.AuthRequest(sql.FieldGTE(FieldHmacKey, v))
+}
+
+// HmacKeyLT applies the LT predicate on the "hmac_key" field.
+func HmacKeyLT(v []byte) predicate.AuthRequest {
+	return predicate.AuthRequest(sql.FieldLT(FieldHmacKey, v))
+}
+
+// HmacKeyLTE applies the LTE predicate on the "hmac_key" field.
+func HmacKeyLTE(v []byte) predicate.AuthRequest {
+	return predicate.AuthRequest(sql.FieldLTE(FieldHmacKey, v))
+}
+
+// MfaValidatedEQ applies the EQ predicate on the "mfa_validated" field.
+func MfaValidatedEQ(v bool) predicate.AuthRequest {
+	return predicate.AuthRequest(sql.FieldEQ(FieldMfaValidated, v))
+}
+
+// MfaValidatedNEQ applies the NEQ predicate on the "mfa_validated" field.
+func MfaValidatedNEQ(v bool) predicate.AuthRequest {
+	return predicate.AuthRequest(sql.FieldNEQ(FieldMfaValidated, v))
+}
+
+// WebauthnSessionDataEQ applies the EQ predicate on the "webauthn_session_data" field.
+func WebauthnSessionDataEQ(v []byte) predicate.AuthRequest {
+	return predicate.AuthRequest(sql.FieldEQ(FieldWebauthnSessionData, v))
+}
+
+// WebauthnSessionDataNEQ applies the NEQ predicate on the "webauthn_session_data" field.
+func WebauthnSessionDataNEQ(v []byte) predicate.AuthRequest {
+	return predicate.AuthRequest(sql.FieldNEQ(FieldWebauthnSessionData, v))
+}
+
+// WebauthnSessionDataIn applies the In predicate on the "webauthn_session_data" field.
+func WebauthnSessionDataIn(vs ...[]byte) predicate.AuthRequest {
+	return predicate.AuthRequest(sql.FieldIn(FieldWebauthnSessionData, vs...))
+}
+
+// WebauthnSessionDataNotIn applies the NotIn predicate on the "webauthn_session_data" field.
+func WebauthnSessionDataNotIn(vs ...[]byte) predicate.AuthRequest {
+	return predicate.AuthRequest(sql.FieldNotIn(FieldWebauthnSessionData, vs...))
+}
+
+// WebauthnSessionDataGT applies the GT predicate on the "webauthn_session_data" field.
+func WebauthnSessionDataGT(v []byte) predicate.AuthRequest {
+	return predicate.AuthRequest(sql.FieldGT(FieldWebauthnSessionData, v))
+}
+
+// WebauthnSessionDataGTE applies the GTE predicate on the "webauthn_session_data" field.
+func WebauthnSessionDataGTE(v []byte) predicate.AuthRequest {
+	return predicate.AuthRequest(sql.FieldGTE(FieldWebauthnSessionData, v))
+}
+
+// WebauthnSessionDataLT applies the LT predicate on the "webauthn_session_data" field.
+func WebauthnSessionDataLT(v []byte) predicate.AuthRequest {
+	return predicate.AuthRequest(sql.FieldLT(FieldWebauthnSessionData, v))
+}
+
+// WebauthnSessionDataLTE applies the LTE predicate on the "webauthn_session_data" field.
+func WebauthnSessionDataLTE(v []byte) predicate.AuthRequest {
+	return predicate.AuthRequest(sql.FieldLTE(FieldWebauthnSessionData, v))
+}
+
+// WebauthnSessionDataIsNil applies the IsNil predicate on the "webauthn_session_data" field.
+func WebauthnSessionDataIsNil() predicate.AuthRequest {
+	return predicate.AuthRequest(sql.FieldIsNull(FieldWebauthnSessionData))
+}
+
+// WebauthnSessionDataNotNil applies the NotNil predicate on the "webauthn_session_data" field.
+func WebauthnSessionDataNotNil() predicate.AuthRequest {
+	return predicate.AuthRequest(sql.FieldNotNull(FieldWebauthnSessionData))
+}
+
+// PromptEQ applies the EQ predicate on the "prompt" field.
+func PromptEQ(v string) predicate.AuthRequest {
+	return predicate.AuthRequest(sql.FieldEQ(FieldPrompt, v))
+}
+
+// PromptNEQ applies the NEQ predicate on the "prompt" field.
+func PromptNEQ(v string) predicate.AuthRequest {
+	return predicate.AuthRequest(sql.FieldNEQ(FieldPrompt, v))
+}
+
+// PromptIn applies the In predicate on the "prompt" field.
+func PromptIn(vs ...string) predicate.AuthRequest {
+	return predicate.AuthRequest(sql.FieldIn(FieldPrompt, vs...))
+}
+
+// PromptNotIn applies the NotIn predicate on the "prompt" field.
+func PromptNotIn(vs ...string) predicate.AuthRequest {
+	return predicate.AuthRequest(sql.FieldNotIn(FieldPrompt, vs...))
+}
+
+// PromptGT applies the GT predicate on the "prompt" field.
+func PromptGT(v string) predicate.AuthRequest {
+	return predicate.AuthRequest(sql.FieldGT(FieldPrompt, v))
+}
+
+// PromptGTE applies the GTE predicate on the "prompt" field.
+func PromptGTE(v string) predicate.AuthRequest {
+	return predicate.AuthRequest(sql.FieldGTE(FieldPrompt, v))
+}
+
+// PromptLT applies the LT predicate on the "prompt" field.
+func PromptLT(v string) predicate.AuthRequest {
+	return predicate.AuthRequest(sql.FieldLT(FieldPrompt, v))
+}
+
+// PromptLTE applies the LTE predicate on the "prompt" field.
+func PromptLTE(v string) predicate.AuthRequest {
+	return predicate.AuthRequest(sql.FieldLTE(FieldPrompt, v))
+}
+
+// PromptContains applies the Contains predicate on the "prompt" field.
+func PromptContains(v string) predicate.AuthRequest {
+	return predicate.AuthRequest(sql.FieldContains(FieldPrompt, v))
+}
+
+// PromptHasPrefix applies the HasPrefix predicate on the "prompt" field.
+func PromptHasPrefix(v string) predicate.AuthRequest {
+	return predicate.AuthRequest(sql.FieldHasPrefix(FieldPrompt, v))
+}
+
+// PromptHasSuffix applies the HasSuffix predicate on the "prompt" field.
+func PromptHasSuffix(v string) predicate.AuthRequest {
+	return predicate.AuthRequest(sql.FieldHasSuffix(FieldPrompt, v))
+}
+
+// PromptEqualFold applies the EqualFold predicate on the "prompt" field.
+func PromptEqualFold(v string) predicate.AuthRequest {
+	return predicate.AuthRequest(sql.FieldEqualFold(FieldPrompt, v))
+}
+
+// PromptContainsFold applies the ContainsFold predicate on the "prompt" field.
+func PromptContainsFold(v string) predicate.AuthRequest {
+	return predicate.AuthRequest(sql.FieldContainsFold(FieldPrompt, v))
+}
+
+// MaxAgeEQ applies the EQ predicate on the "max_age" field.
+func MaxAgeEQ(v int) predicate.AuthRequest {
+	return predicate.AuthRequest(sql.FieldEQ(FieldMaxAge, v))
+}
+
+// MaxAgeNEQ applies the NEQ predicate on the "max_age" field.
+func MaxAgeNEQ(v int) predicate.AuthRequest {
+	return predicate.AuthRequest(sql.FieldNEQ(FieldMaxAge, v))
+}
+
+// MaxAgeIn applies the In predicate on the "max_age" field.
+func MaxAgeIn(vs ...int) predicate.AuthRequest {
+	return predicate.AuthRequest(sql.FieldIn(FieldMaxAge, vs...))
+}
+
+// MaxAgeNotIn applies the NotIn predicate on the "max_age" field.
+func MaxAgeNotIn(vs ...int) predicate.AuthRequest {
+	return predicate.AuthRequest(sql.FieldNotIn(FieldMaxAge, vs...))
+}
+
+// MaxAgeGT applies the GT predicate on the "max_age" field.
+func MaxAgeGT(v int) predicate.AuthRequest {
+	return predicate.AuthRequest(sql.FieldGT(FieldMaxAge, v))
+}
+
+// MaxAgeGTE applies the GTE predicate on the "max_age" field.
+func MaxAgeGTE(v int) predicate.AuthRequest {
+	return predicate.AuthRequest(sql.FieldGTE(FieldMaxAge, v))
+}
+
+// MaxAgeLT applies the LT predicate on the "max_age" field.
+func MaxAgeLT(v int) predicate.AuthRequest {
+	return predicate.AuthRequest(sql.FieldLT(FieldMaxAge, v))
+}
+
+// MaxAgeLTE applies the LTE predicate on the "max_age" field.
+func MaxAgeLTE(v int) predicate.AuthRequest {
+	return predicate.AuthRequest(sql.FieldLTE(FieldMaxAge, v))
+}
+
+// AuthTimeEQ applies the EQ predicate on the "auth_time" field.
+func AuthTimeEQ(v time.Time) predicate.AuthRequest {
+	return predicate.AuthRequest(sql.FieldEQ(FieldAuthTime, v))
+}
+
+// AuthTimeNEQ applies the NEQ predicate on the "auth_time" field.
+func AuthTimeNEQ(v time.Time) predicate.AuthRequest {
+	return predicate.AuthRequest(sql.FieldNEQ(FieldAuthTime, v))
+}
+
+// AuthTimeIn applies the In predicate on the "auth_time" field.
+func AuthTimeIn(vs ...time.Time) predicate.AuthRequest {
+	return predicate.AuthRequest(sql.FieldIn(FieldAuthTime, vs...))
+}
+
+// AuthTimeNotIn applies the NotIn predicate on the "auth_time" field.
+func AuthTimeNotIn(vs ...time.Time) predicate.AuthRequest {
+	return predicate.AuthRequest(sql.FieldNotIn(FieldAuthTime, vs...))
+}
+
+// AuthTimeGT applies the GT predicate on the "auth_time" field.
+func AuthTimeGT(v time.Time) predicate.AuthRequest {
+	return predicate.AuthRequest(sql.FieldGT(FieldAuthTime, v))
+}
+
+// AuthTimeGTE applies the GTE predicate on the "auth_time" field.
+func AuthTimeGTE(v time.Time) predicate.AuthRequest {
+	return predicate.AuthRequest(sql.FieldGTE(FieldAuthTime, v))
+}
+
+// AuthTimeLT applies the LT predicate on the "auth_time" field.
+func AuthTimeLT(v time.Time) predicate.AuthRequest {
+	return predicate.AuthRequest(sql.FieldLT(FieldAuthTime, v))
+}
+
+// AuthTimeLTE applies the LTE predicate on the "auth_time" field.
+func AuthTimeLTE(v time.Time) predicate.AuthRequest {
+	return predicate.AuthRequest(sql.FieldLTE(FieldAuthTime, v))
+}
+
+// AuthTimeIsNil applies the IsNil predicate on the "auth_time" field.
+func AuthTimeIsNil() predicate.AuthRequest {
+	return predicate.AuthRequest(sql.FieldIsNull(FieldAuthTime))
+}
+
+// AuthTimeNotNil applies the NotNil predicate on the "auth_time" field.
+func AuthTimeNotNil() predicate.AuthRequest {
+	return predicate.AuthRequest(sql.FieldNotNull(FieldAuthTime))
 }
 
 // And groups predicates with the AND operator between them.
 func And(predicates ...predicate.AuthRequest) predicate.AuthRequest {
-	return predicate.AuthRequest(func(s *sql.Selector) {
-		s1 := s.Clone().SetP(nil)
-		for _, p := range predicates {
-			p(s1)
-		}
-		s.Where(s1.P())
-	})
+	return predicate.AuthRequest(sql.AndPredicates(predicates...))
 }
 
 // Or groups predicates with the OR operator between them.
 func Or(predicates ...predicate.AuthRequest) predicate.AuthRequest {
-	return predicate.AuthRequest(func(s *sql.Selector) {
-		s1 := s.Clone().SetP(nil)
-		for i, p := range predicates {
-			if i > 0 {
-				s1.Or()
-			}
-			p(s1)
-		}
-		s.Where(s1.P())
-	})
+	return predicate.AuthRequest(sql.OrPredicates(predicates...))
 }
 
 // Not applies the not operator on the given predicate.
 func Not(p predicate.AuthRequest) predicate.AuthRequest {
-	return predicate.AuthRequest(func(s *sql.Selector) {
-		p(s.Not())
-	})
+	return predicate.AuthRequest(sql.NotPredicates(p))
 }
diff --git a/storage/ent/db/authrequest_create.go b/storage/ent/db/authrequest_create.go
index 63e0357dc5..1a34153401 100644
--- a/storage/ent/db/authrequest_create.go
+++ b/storage/ent/db/authrequest_create.go
@@ -21,205 +21,231 @@ type AuthRequestCreate struct {
 }
 
 // SetClientID sets the "client_id" field.
-func (arc *AuthRequestCreate) SetClientID(s string) *AuthRequestCreate {
-	arc.mutation.SetClientID(s)
-	return arc
+func (_c *AuthRequestCreate) SetClientID(v string) *AuthRequestCreate {
+	_c.mutation.SetClientID(v)
+	return _c
 }
 
 // SetScopes sets the "scopes" field.
-func (arc *AuthRequestCreate) SetScopes(s []string) *AuthRequestCreate {
-	arc.mutation.SetScopes(s)
-	return arc
+func (_c *AuthRequestCreate) SetScopes(v []string) *AuthRequestCreate {
+	_c.mutation.SetScopes(v)
+	return _c
 }
 
 // SetResponseTypes sets the "response_types" field.
-func (arc *AuthRequestCreate) SetResponseTypes(s []string) *AuthRequestCreate {
-	arc.mutation.SetResponseTypes(s)
-	return arc
+func (_c *AuthRequestCreate) SetResponseTypes(v []string) *AuthRequestCreate {
+	_c.mutation.SetResponseTypes(v)
+	return _c
 }
 
 // SetRedirectURI sets the "redirect_uri" field.
-func (arc *AuthRequestCreate) SetRedirectURI(s string) *AuthRequestCreate {
-	arc.mutation.SetRedirectURI(s)
-	return arc
+func (_c *AuthRequestCreate) SetRedirectURI(v string) *AuthRequestCreate {
+	_c.mutation.SetRedirectURI(v)
+	return _c
 }
 
 // SetNonce sets the "nonce" field.
-func (arc *AuthRequestCreate) SetNonce(s string) *AuthRequestCreate {
-	arc.mutation.SetNonce(s)
-	return arc
+func (_c *AuthRequestCreate) SetNonce(v string) *AuthRequestCreate {
+	_c.mutation.SetNonce(v)
+	return _c
 }
 
 // SetState sets the "state" field.
-func (arc *AuthRequestCreate) SetState(s string) *AuthRequestCreate {
-	arc.mutation.SetState(s)
-	return arc
+func (_c *AuthRequestCreate) SetState(v string) *AuthRequestCreate {
+	_c.mutation.SetState(v)
+	return _c
 }
 
 // SetForceApprovalPrompt sets the "force_approval_prompt" field.
-func (arc *AuthRequestCreate) SetForceApprovalPrompt(b bool) *AuthRequestCreate {
-	arc.mutation.SetForceApprovalPrompt(b)
-	return arc
+func (_c *AuthRequestCreate) SetForceApprovalPrompt(v bool) *AuthRequestCreate {
+	_c.mutation.SetForceApprovalPrompt(v)
+	return _c
 }
 
 // SetLoggedIn sets the "logged_in" field.
-func (arc *AuthRequestCreate) SetLoggedIn(b bool) *AuthRequestCreate {
-	arc.mutation.SetLoggedIn(b)
-	return arc
+func (_c *AuthRequestCreate) SetLoggedIn(v bool) *AuthRequestCreate {
+	_c.mutation.SetLoggedIn(v)
+	return _c
 }
 
 // SetClaimsUserID sets the "claims_user_id" field.
-func (arc *AuthRequestCreate) SetClaimsUserID(s string) *AuthRequestCreate {
-	arc.mutation.SetClaimsUserID(s)
-	return arc
+func (_c *AuthRequestCreate) SetClaimsUserID(v string) *AuthRequestCreate {
+	_c.mutation.SetClaimsUserID(v)
+	return _c
 }
 
 // SetClaimsUsername sets the "claims_username" field.
-func (arc *AuthRequestCreate) SetClaimsUsername(s string) *AuthRequestCreate {
-	arc.mutation.SetClaimsUsername(s)
-	return arc
+func (_c *AuthRequestCreate) SetClaimsUsername(v string) *AuthRequestCreate {
+	_c.mutation.SetClaimsUsername(v)
+	return _c
 }
 
 // SetClaimsEmail sets the "claims_email" field.
-func (arc *AuthRequestCreate) SetClaimsEmail(s string) *AuthRequestCreate {
-	arc.mutation.SetClaimsEmail(s)
-	return arc
+func (_c *AuthRequestCreate) SetClaimsEmail(v string) *AuthRequestCreate {
+	_c.mutation.SetClaimsEmail(v)
+	return _c
 }
 
 // SetClaimsEmailVerified sets the "claims_email_verified" field.
-func (arc *AuthRequestCreate) SetClaimsEmailVerified(b bool) *AuthRequestCreate {
-	arc.mutation.SetClaimsEmailVerified(b)
-	return arc
+func (_c *AuthRequestCreate) SetClaimsEmailVerified(v bool) *AuthRequestCreate {
+	_c.mutation.SetClaimsEmailVerified(v)
+	return _c
 }
 
 // SetClaimsGroups sets the "claims_groups" field.
-func (arc *AuthRequestCreate) SetClaimsGroups(s []string) *AuthRequestCreate {
-	arc.mutation.SetClaimsGroups(s)
-	return arc
+func (_c *AuthRequestCreate) SetClaimsGroups(v []string) *AuthRequestCreate {
+	_c.mutation.SetClaimsGroups(v)
+	return _c
 }
 
 // SetClaimsPreferredUsername sets the "claims_preferred_username" field.
-func (arc *AuthRequestCreate) SetClaimsPreferredUsername(s string) *AuthRequestCreate {
-	arc.mutation.SetClaimsPreferredUsername(s)
-	return arc
+func (_c *AuthRequestCreate) SetClaimsPreferredUsername(v string) *AuthRequestCreate {
+	_c.mutation.SetClaimsPreferredUsername(v)
+	return _c
 }
 
 // SetNillableClaimsPreferredUsername sets the "claims_preferred_username" field if the given value is not nil.
-func (arc *AuthRequestCreate) SetNillableClaimsPreferredUsername(s *string) *AuthRequestCreate {
-	if s != nil {
-		arc.SetClaimsPreferredUsername(*s)
+func (_c *AuthRequestCreate) SetNillableClaimsPreferredUsername(v *string) *AuthRequestCreate {
+	if v != nil {
+		_c.SetClaimsPreferredUsername(*v)
 	}
-	return arc
+	return _c
 }
 
 // SetConnectorID sets the "connector_id" field.
-func (arc *AuthRequestCreate) SetConnectorID(s string) *AuthRequestCreate {
-	arc.mutation.SetConnectorID(s)
-	return arc
+func (_c *AuthRequestCreate) SetConnectorID(v string) *AuthRequestCreate {
+	_c.mutation.SetConnectorID(v)
+	return _c
 }
 
 // SetConnectorData sets the "connector_data" field.
-func (arc *AuthRequestCreate) SetConnectorData(b []byte) *AuthRequestCreate {
-	arc.mutation.SetConnectorData(b)
-	return arc
+func (_c *AuthRequestCreate) SetConnectorData(v []byte) *AuthRequestCreate {
+	_c.mutation.SetConnectorData(v)
+	return _c
 }
 
 // SetExpiry sets the "expiry" field.
-func (arc *AuthRequestCreate) SetExpiry(t time.Time) *AuthRequestCreate {
-	arc.mutation.SetExpiry(t)
-	return arc
+func (_c *AuthRequestCreate) SetExpiry(v time.Time) *AuthRequestCreate {
+	_c.mutation.SetExpiry(v)
+	return _c
 }
 
 // SetCodeChallenge sets the "code_challenge" field.
-func (arc *AuthRequestCreate) SetCodeChallenge(s string) *AuthRequestCreate {
-	arc.mutation.SetCodeChallenge(s)
-	return arc
+func (_c *AuthRequestCreate) SetCodeChallenge(v string) *AuthRequestCreate {
+	_c.mutation.SetCodeChallenge(v)
+	return _c
 }
 
 // SetNillableCodeChallenge sets the "code_challenge" field if the given value is not nil.
-func (arc *AuthRequestCreate) SetNillableCodeChallenge(s *string) *AuthRequestCreate {
-	if s != nil {
-		arc.SetCodeChallenge(*s)
+func (_c *AuthRequestCreate) SetNillableCodeChallenge(v *string) *AuthRequestCreate {
+	if v != nil {
+		_c.SetCodeChallenge(*v)
 	}
-	return arc
+	return _c
 }
 
 // SetCodeChallengeMethod sets the "code_challenge_method" field.
-func (arc *AuthRequestCreate) SetCodeChallengeMethod(s string) *AuthRequestCreate {
-	arc.mutation.SetCodeChallengeMethod(s)
-	return arc
+func (_c *AuthRequestCreate) SetCodeChallengeMethod(v string) *AuthRequestCreate {
+	_c.mutation.SetCodeChallengeMethod(v)
+	return _c
 }
 
 // SetNillableCodeChallengeMethod sets the "code_challenge_method" field if the given value is not nil.
-func (arc *AuthRequestCreate) SetNillableCodeChallengeMethod(s *string) *AuthRequestCreate {
-	if s != nil {
-		arc.SetCodeChallengeMethod(*s)
+func (_c *AuthRequestCreate) SetNillableCodeChallengeMethod(v *string) *AuthRequestCreate {
+	if v != nil {
+		_c.SetCodeChallengeMethod(*v)
 	}
-	return arc
+	return _c
+}
+
+// SetHmacKey sets the "hmac_key" field.
+func (_c *AuthRequestCreate) SetHmacKey(v []byte) *AuthRequestCreate {
+	_c.mutation.SetHmacKey(v)
+	return _c
+}
+
+// SetMfaValidated sets the "mfa_validated" field.
+func (_c *AuthRequestCreate) SetMfaValidated(v bool) *AuthRequestCreate {
+	_c.mutation.SetMfaValidated(v)
+	return _c
+}
+
+// SetNillableMfaValidated sets the "mfa_validated" field if the given value is not nil.
+func (_c *AuthRequestCreate) SetNillableMfaValidated(v *bool) *AuthRequestCreate {
+	if v != nil {
+		_c.SetMfaValidated(*v)
+	}
+	return _c
+}
+
+// SetWebauthnSessionData sets the "webauthn_session_data" field.
+func (_c *AuthRequestCreate) SetWebauthnSessionData(v []byte) *AuthRequestCreate {
+	_c.mutation.SetWebauthnSessionData(v)
+	return _c
+}
+
+// SetPrompt sets the "prompt" field.
+func (_c *AuthRequestCreate) SetPrompt(v string) *AuthRequestCreate {
+	_c.mutation.SetPrompt(v)
+	return _c
+}
+
+// SetNillablePrompt sets the "prompt" field if the given value is not nil.
+func (_c *AuthRequestCreate) SetNillablePrompt(v *string) *AuthRequestCreate {
+	if v != nil {
+		_c.SetPrompt(*v)
+	}
+	return _c
+}
+
+// SetMaxAge sets the "max_age" field.
+func (_c *AuthRequestCreate) SetMaxAge(v int) *AuthRequestCreate {
+	_c.mutation.SetMaxAge(v)
+	return _c
+}
+
+// SetNillableMaxAge sets the "max_age" field if the given value is not nil.
+func (_c *AuthRequestCreate) SetNillableMaxAge(v *int) *AuthRequestCreate {
+	if v != nil {
+		_c.SetMaxAge(*v)
+	}
+	return _c
+}
+
+// SetAuthTime sets the "auth_time" field.
+func (_c *AuthRequestCreate) SetAuthTime(v time.Time) *AuthRequestCreate {
+	_c.mutation.SetAuthTime(v)
+	return _c
+}
+
+// SetNillableAuthTime sets the "auth_time" field if the given value is not nil.
+func (_c *AuthRequestCreate) SetNillableAuthTime(v *time.Time) *AuthRequestCreate {
+	if v != nil {
+		_c.SetAuthTime(*v)
+	}
+	return _c
 }
 
 // SetID sets the "id" field.
-func (arc *AuthRequestCreate) SetID(s string) *AuthRequestCreate {
-	arc.mutation.SetID(s)
-	return arc
+func (_c *AuthRequestCreate) SetID(v string) *AuthRequestCreate {
+	_c.mutation.SetID(v)
+	return _c
 }
 
 // Mutation returns the AuthRequestMutation object of the builder.
-func (arc *AuthRequestCreate) Mutation() *AuthRequestMutation {
-	return arc.mutation
+func (_c *AuthRequestCreate) Mutation() *AuthRequestMutation {
+	return _c.mutation
 }
 
 // Save creates the AuthRequest in the database.
-func (arc *AuthRequestCreate) Save(ctx context.Context) (*AuthRequest, error) {
-	var (
-		err  error
-		node *AuthRequest
-	)
-	arc.defaults()
-	if len(arc.hooks) == 0 {
-		if err = arc.check(); err != nil {
-			return nil, err
-		}
-		node, err = arc.sqlSave(ctx)
-	} else {
-		var mut Mutator = MutateFunc(func(ctx context.Context, m Mutation) (Value, error) {
-			mutation, ok := m.(*AuthRequestMutation)
-			if !ok {
-				return nil, fmt.Errorf("unexpected mutation type %T", m)
-			}
-			if err = arc.check(); err != nil {
-				return nil, err
-			}
-			arc.mutation = mutation
-			if node, err = arc.sqlSave(ctx); err != nil {
-				return nil, err
-			}
-			mutation.id = &node.ID
-			mutation.done = true
-			return node, err
-		})
-		for i := len(arc.hooks) - 1; i >= 0; i-- {
-			if arc.hooks[i] == nil {
-				return nil, fmt.Errorf("db: uninitialized hook (forgotten import db/runtime?)")
-			}
-			mut = arc.hooks[i](mut)
-		}
-		v, err := mut.Mutate(ctx, arc.mutation)
-		if err != nil {
-			return nil, err
-		}
-		nv, ok := v.(*AuthRequest)
-		if !ok {
-			return nil, fmt.Errorf("unexpected node type %T returned from AuthRequestMutation", v)
-		}
-		node = nv
-	}
-	return node, err
+func (_c *AuthRequestCreate) Save(ctx context.Context) (*AuthRequest, error) {
+	_c.defaults()
+	return withHooks(ctx, _c.sqlSave, _c.mutation, _c.hooks)
 }
 
 // SaveX calls Save and panics if Save returns an error.
-func (arc *AuthRequestCreate) SaveX(ctx context.Context) *AuthRequest {
-	v, err := arc.Save(ctx)
+func (_c *AuthRequestCreate) SaveX(ctx context.Context) *AuthRequest {
+	v, err := _c.Save(ctx)
 	if err != nil {
 		panic(err)
 	}
@@ -227,82 +253,106 @@ func (arc *AuthRequestCreate) SaveX(ctx context.Context) *AuthRequest {
 }
 
 // Exec executes the query.
-func (arc *AuthRequestCreate) Exec(ctx context.Context) error {
-	_, err := arc.Save(ctx)
+func (_c *AuthRequestCreate) Exec(ctx context.Context) error {
+	_, err := _c.Save(ctx)
 	return err
 }
 
 // ExecX is like Exec, but panics if an error occurs.
-func (arc *AuthRequestCreate) ExecX(ctx context.Context) {
-	if err := arc.Exec(ctx); err != nil {
+func (_c *AuthRequestCreate) ExecX(ctx context.Context) {
+	if err := _c.Exec(ctx); err != nil {
 		panic(err)
 	}
 }
 
 // defaults sets the default values of the builder before save.
-func (arc *AuthRequestCreate) defaults() {
-	if _, ok := arc.mutation.ClaimsPreferredUsername(); !ok {
+func (_c *AuthRequestCreate) defaults() {
+	if _, ok := _c.mutation.ClaimsPreferredUsername(); !ok {
 		v := authrequest.DefaultClaimsPreferredUsername
-		arc.mutation.SetClaimsPreferredUsername(v)
+		_c.mutation.SetClaimsPreferredUsername(v)
 	}
-	if _, ok := arc.mutation.CodeChallenge(); !ok {
+	if _, ok := _c.mutation.CodeChallenge(); !ok {
 		v := authrequest.DefaultCodeChallenge
-		arc.mutation.SetCodeChallenge(v)
+		_c.mutation.SetCodeChallenge(v)
 	}
-	if _, ok := arc.mutation.CodeChallengeMethod(); !ok {
+	if _, ok := _c.mutation.CodeChallengeMethod(); !ok {
 		v := authrequest.DefaultCodeChallengeMethod
-		arc.mutation.SetCodeChallengeMethod(v)
+		_c.mutation.SetCodeChallengeMethod(v)
+	}
+	if _, ok := _c.mutation.MfaValidated(); !ok {
+		v := authrequest.DefaultMfaValidated
+		_c.mutation.SetMfaValidated(v)
+	}
+	if _, ok := _c.mutation.Prompt(); !ok {
+		v := authrequest.DefaultPrompt
+		_c.mutation.SetPrompt(v)
+	}
+	if _, ok := _c.mutation.MaxAge(); !ok {
+		v := authrequest.DefaultMaxAge
+		_c.mutation.SetMaxAge(v)
 	}
 }
 
 // check runs all checks and user-defined validators on the builder.
-func (arc *AuthRequestCreate) check() error {
-	if _, ok := arc.mutation.ClientID(); !ok {
+func (_c *AuthRequestCreate) check() error {
+	if _, ok := _c.mutation.ClientID(); !ok {
 		return &ValidationError{Name: "client_id", err: errors.New(`db: missing required field "AuthRequest.client_id"`)}
 	}
-	if _, ok := arc.mutation.RedirectURI(); !ok {
+	if _, ok := _c.mutation.RedirectURI(); !ok {
 		return &ValidationError{Name: "redirect_uri", err: errors.New(`db: missing required field "AuthRequest.redirect_uri"`)}
 	}
-	if _, ok := arc.mutation.Nonce(); !ok {
+	if _, ok := _c.mutation.Nonce(); !ok {
 		return &ValidationError{Name: "nonce", err: errors.New(`db: missing required field "AuthRequest.nonce"`)}
 	}
-	if _, ok := arc.mutation.State(); !ok {
+	if _, ok := _c.mutation.State(); !ok {
 		return &ValidationError{Name: "state", err: errors.New(`db: missing required field "AuthRequest.state"`)}
 	}
-	if _, ok := arc.mutation.ForceApprovalPrompt(); !ok {
+	if _, ok := _c.mutation.ForceApprovalPrompt(); !ok {
 		return &ValidationError{Name: "force_approval_prompt", err: errors.New(`db: missing required field "AuthRequest.force_approval_prompt"`)}
 	}
-	if _, ok := arc.mutation.LoggedIn(); !ok {
+	if _, ok := _c.mutation.LoggedIn(); !ok {
 		return &ValidationError{Name: "logged_in", err: errors.New(`db: missing required field "AuthRequest.logged_in"`)}
 	}
-	if _, ok := arc.mutation.ClaimsUserID(); !ok {
+	if _, ok := _c.mutation.ClaimsUserID(); !ok {
 		return &ValidationError{Name: "claims_user_id", err: errors.New(`db: missing required field "AuthRequest.claims_user_id"`)}
 	}
-	if _, ok := arc.mutation.ClaimsUsername(); !ok {
+	if _, ok := _c.mutation.ClaimsUsername(); !ok {
 		return &ValidationError{Name: "claims_username", err: errors.New(`db: missing required field "AuthRequest.claims_username"`)}
 	}
-	if _, ok := arc.mutation.ClaimsEmail(); !ok {
+	if _, ok := _c.mutation.ClaimsEmail(); !ok {
 		return &ValidationError{Name: "claims_email", err: errors.New(`db: missing required field "AuthRequest.claims_email"`)}
 	}
-	if _, ok := arc.mutation.ClaimsEmailVerified(); !ok {
+	if _, ok := _c.mutation.ClaimsEmailVerified(); !ok {
 		return &ValidationError{Name: "claims_email_verified", err: errors.New(`db: missing required field "AuthRequest.claims_email_verified"`)}
 	}
-	if _, ok := arc.mutation.ClaimsPreferredUsername(); !ok {
+	if _, ok := _c.mutation.ClaimsPreferredUsername(); !ok {
 		return &ValidationError{Name: "claims_preferred_username", err: errors.New(`db: missing required field "AuthRequest.claims_preferred_username"`)}
 	}
-	if _, ok := arc.mutation.ConnectorID(); !ok {
+	if _, ok := _c.mutation.ConnectorID(); !ok {
 		return &ValidationError{Name: "connector_id", err: errors.New(`db: missing required field "AuthRequest.connector_id"`)}
 	}
-	if _, ok := arc.mutation.Expiry(); !ok {
+	if _, ok := _c.mutation.Expiry(); !ok {
 		return &ValidationError{Name: "expiry", err: errors.New(`db: missing required field "AuthRequest.expiry"`)}
 	}
-	if _, ok := arc.mutation.CodeChallenge(); !ok {
+	if _, ok := _c.mutation.CodeChallenge(); !ok {
 		return &ValidationError{Name: "code_challenge", err: errors.New(`db: missing required field "AuthRequest.code_challenge"`)}
 	}
-	if _, ok := arc.mutation.CodeChallengeMethod(); !ok {
+	if _, ok := _c.mutation.CodeChallengeMethod(); !ok {
 		return &ValidationError{Name: "code_challenge_method", err: errors.New(`db: missing required field "AuthRequest.code_challenge_method"`)}
 	}
-	if v, ok := arc.mutation.ID(); ok {
+	if _, ok := _c.mutation.HmacKey(); !ok {
+		return &ValidationError{Name: "hmac_key", err: errors.New(`db: missing required field "AuthRequest.hmac_key"`)}
+	}
+	if _, ok := _c.mutation.MfaValidated(); !ok {
+		return &ValidationError{Name: "mfa_validated", err: errors.New(`db: missing required field "AuthRequest.mfa_validated"`)}
+	}
+	if _, ok := _c.mutation.Prompt(); !ok {
+		return &ValidationError{Name: "prompt", err: errors.New(`db: missing required field "AuthRequest.prompt"`)}
+	}
+	if _, ok := _c.mutation.MaxAge(); !ok {
+		return &ValidationError{Name: "max_age", err: errors.New(`db: missing required field "AuthRequest.max_age"`)}
+	}
+	if v, ok := _c.mutation.ID(); ok {
 		if err := authrequest.IDValidator(v); err != nil {
 			return &ValidationError{Name: "id", err: fmt.Errorf(`db: validator failed for field "AuthRequest.id": %w`, err)}
 		}
@@ -310,9 +360,12 @@ func (arc *AuthRequestCreate) check() error {
 	return nil
 }
 
-func (arc *AuthRequestCreate) sqlSave(ctx context.Context) (*AuthRequest, error) {
-	_node, _spec := arc.createSpec()
-	if err := sqlgraph.CreateNode(ctx, arc.driver, _spec); err != nil {
+func (_c *AuthRequestCreate) sqlSave(ctx context.Context) (*AuthRequest, error) {
+	if err := _c.check(); err != nil {
+		return nil, err
+	}
+	_node, _spec := _c.createSpec()
+	if err := sqlgraph.CreateNode(ctx, _c.driver, _spec); err != nil {
 		if sqlgraph.IsConstraintError(err) {
 			err = &ConstraintError{msg: err.Error(), wrap: err}
 		}
@@ -325,193 +378,141 @@ func (arc *AuthRequestCreate) sqlSave(ctx context.Context) (*AuthRequest, error)
 			return nil, fmt.Errorf("unexpected AuthRequest.ID type: %T", _spec.ID.Value)
 		}
 	}
+	_c.mutation.id = &_node.ID
+	_c.mutation.done = true
 	return _node, nil
 }
 
-func (arc *AuthRequestCreate) createSpec() (*AuthRequest, *sqlgraph.CreateSpec) {
+func (_c *AuthRequestCreate) createSpec() (*AuthRequest, *sqlgraph.CreateSpec) {
 	var (
-		_node = &AuthRequest{config: arc.config}
-		_spec = &sqlgraph.CreateSpec{
-			Table: authrequest.Table,
-			ID: &sqlgraph.FieldSpec{
-				Type:   field.TypeString,
-				Column: authrequest.FieldID,
-			},
-		}
+		_node = &AuthRequest{config: _c.config}
+		_spec = sqlgraph.NewCreateSpec(authrequest.Table, sqlgraph.NewFieldSpec(authrequest.FieldID, field.TypeString))
 	)
-	if id, ok := arc.mutation.ID(); ok {
+	if id, ok := _c.mutation.ID(); ok {
 		_node.ID = id
 		_spec.ID.Value = id
 	}
-	if value, ok := arc.mutation.ClientID(); ok {
-		_spec.Fields = append(_spec.Fields, &sqlgraph.FieldSpec{
-			Type:   field.TypeString,
-			Value:  value,
-			Column: authrequest.FieldClientID,
-		})
+	if value, ok := _c.mutation.ClientID(); ok {
+		_spec.SetField(authrequest.FieldClientID, field.TypeString, value)
 		_node.ClientID = value
 	}
-	if value, ok := arc.mutation.Scopes(); ok {
-		_spec.Fields = append(_spec.Fields, &sqlgraph.FieldSpec{
-			Type:   field.TypeJSON,
-			Value:  value,
-			Column: authrequest.FieldScopes,
-		})
+	if value, ok := _c.mutation.Scopes(); ok {
+		_spec.SetField(authrequest.FieldScopes, field.TypeJSON, value)
 		_node.Scopes = value
 	}
-	if value, ok := arc.mutation.ResponseTypes(); ok {
-		_spec.Fields = append(_spec.Fields, &sqlgraph.FieldSpec{
-			Type:   field.TypeJSON,
-			Value:  value,
-			Column: authrequest.FieldResponseTypes,
-		})
+	if value, ok := _c.mutation.ResponseTypes(); ok {
+		_spec.SetField(authrequest.FieldResponseTypes, field.TypeJSON, value)
 		_node.ResponseTypes = value
 	}
-	if value, ok := arc.mutation.RedirectURI(); ok {
-		_spec.Fields = append(_spec.Fields, &sqlgraph.FieldSpec{
-			Type:   field.TypeString,
-			Value:  value,
-			Column: authrequest.FieldRedirectURI,
-		})
+	if value, ok := _c.mutation.RedirectURI(); ok {
+		_spec.SetField(authrequest.FieldRedirectURI, field.TypeString, value)
 		_node.RedirectURI = value
 	}
-	if value, ok := arc.mutation.Nonce(); ok {
-		_spec.Fields = append(_spec.Fields, &sqlgraph.FieldSpec{
-			Type:   field.TypeString,
-			Value:  value,
-			Column: authrequest.FieldNonce,
-		})
+	if value, ok := _c.mutation.Nonce(); ok {
+		_spec.SetField(authrequest.FieldNonce, field.TypeString, value)
 		_node.Nonce = value
 	}
-	if value, ok := arc.mutation.State(); ok {
-		_spec.Fields = append(_spec.Fields, &sqlgraph.FieldSpec{
-			Type:   field.TypeString,
-			Value:  value,
-			Column: authrequest.FieldState,
-		})
+	if value, ok := _c.mutation.State(); ok {
+		_spec.SetField(authrequest.FieldState, field.TypeString, value)
 		_node.State = value
 	}
-	if value, ok := arc.mutation.ForceApprovalPrompt(); ok {
-		_spec.Fields = append(_spec.Fields, &sqlgraph.FieldSpec{
-			Type:   field.TypeBool,
-			Value:  value,
-			Column: authrequest.FieldForceApprovalPrompt,
-		})
+	if value, ok := _c.mutation.ForceApprovalPrompt(); ok {
+		_spec.SetField(authrequest.FieldForceApprovalPrompt, field.TypeBool, value)
 		_node.ForceApprovalPrompt = value
 	}
-	if value, ok := arc.mutation.LoggedIn(); ok {
-		_spec.Fields = append(_spec.Fields, &sqlgraph.FieldSpec{
-			Type:   field.TypeBool,
-			Value:  value,
-			Column: authrequest.FieldLoggedIn,
-		})
+	if value, ok := _c.mutation.LoggedIn(); ok {
+		_spec.SetField(authrequest.FieldLoggedIn, field.TypeBool, value)
 		_node.LoggedIn = value
 	}
-	if value, ok := arc.mutation.ClaimsUserID(); ok {
-		_spec.Fields = append(_spec.Fields, &sqlgraph.FieldSpec{
-			Type:   field.TypeString,
-			Value:  value,
-			Column: authrequest.FieldClaimsUserID,
-		})
+	if value, ok := _c.mutation.ClaimsUserID(); ok {
+		_spec.SetField(authrequest.FieldClaimsUserID, field.TypeString, value)
 		_node.ClaimsUserID = value
 	}
-	if value, ok := arc.mutation.ClaimsUsername(); ok {
-		_spec.Fields = append(_spec.Fields, &sqlgraph.FieldSpec{
-			Type:   field.TypeString,
-			Value:  value,
-			Column: authrequest.FieldClaimsUsername,
-		})
+	if value, ok := _c.mutation.ClaimsUsername(); ok {
+		_spec.SetField(authrequest.FieldClaimsUsername, field.TypeString, value)
 		_node.ClaimsUsername = value
 	}
-	if value, ok := arc.mutation.ClaimsEmail(); ok {
-		_spec.Fields = append(_spec.Fields, &sqlgraph.FieldSpec{
-			Type:   field.TypeString,
-			Value:  value,
-			Column: authrequest.FieldClaimsEmail,
-		})
+	if value, ok := _c.mutation.ClaimsEmail(); ok {
+		_spec.SetField(authrequest.FieldClaimsEmail, field.TypeString, value)
 		_node.ClaimsEmail = value
 	}
-	if value, ok := arc.mutation.ClaimsEmailVerified(); ok {
-		_spec.Fields = append(_spec.Fields, &sqlgraph.FieldSpec{
-			Type:   field.TypeBool,
-			Value:  value,
-			Column: authrequest.FieldClaimsEmailVerified,
-		})
+	if value, ok := _c.mutation.ClaimsEmailVerified(); ok {
+		_spec.SetField(authrequest.FieldClaimsEmailVerified, field.TypeBool, value)
 		_node.ClaimsEmailVerified = value
 	}
-	if value, ok := arc.mutation.ClaimsGroups(); ok {
-		_spec.Fields = append(_spec.Fields, &sqlgraph.FieldSpec{
-			Type:   field.TypeJSON,
-			Value:  value,
-			Column: authrequest.FieldClaimsGroups,
-		})
+	if value, ok := _c.mutation.ClaimsGroups(); ok {
+		_spec.SetField(authrequest.FieldClaimsGroups, field.TypeJSON, value)
 		_node.ClaimsGroups = value
 	}
-	if value, ok := arc.mutation.ClaimsPreferredUsername(); ok {
-		_spec.Fields = append(_spec.Fields, &sqlgraph.FieldSpec{
-			Type:   field.TypeString,
-			Value:  value,
-			Column: authrequest.FieldClaimsPreferredUsername,
-		})
+	if value, ok := _c.mutation.ClaimsPreferredUsername(); ok {
+		_spec.SetField(authrequest.FieldClaimsPreferredUsername, field.TypeString, value)
 		_node.ClaimsPreferredUsername = value
 	}
-	if value, ok := arc.mutation.ConnectorID(); ok {
-		_spec.Fields = append(_spec.Fields, &sqlgraph.FieldSpec{
-			Type:   field.TypeString,
-			Value:  value,
-			Column: authrequest.FieldConnectorID,
-		})
+	if value, ok := _c.mutation.ConnectorID(); ok {
+		_spec.SetField(authrequest.FieldConnectorID, field.TypeString, value)
 		_node.ConnectorID = value
 	}
-	if value, ok := arc.mutation.ConnectorData(); ok {
-		_spec.Fields = append(_spec.Fields, &sqlgraph.FieldSpec{
-			Type:   field.TypeBytes,
-			Value:  value,
-			Column: authrequest.FieldConnectorData,
-		})
+	if value, ok := _c.mutation.ConnectorData(); ok {
+		_spec.SetField(authrequest.FieldConnectorData, field.TypeBytes, value)
 		_node.ConnectorData = &value
 	}
-	if value, ok := arc.mutation.Expiry(); ok {
-		_spec.Fields = append(_spec.Fields, &sqlgraph.FieldSpec{
-			Type:   field.TypeTime,
-			Value:  value,
-			Column: authrequest.FieldExpiry,
-		})
+	if value, ok := _c.mutation.Expiry(); ok {
+		_spec.SetField(authrequest.FieldExpiry, field.TypeTime, value)
 		_node.Expiry = value
 	}
-	if value, ok := arc.mutation.CodeChallenge(); ok {
-		_spec.Fields = append(_spec.Fields, &sqlgraph.FieldSpec{
-			Type:   field.TypeString,
-			Value:  value,
-			Column: authrequest.FieldCodeChallenge,
-		})
+	if value, ok := _c.mutation.CodeChallenge(); ok {
+		_spec.SetField(authrequest.FieldCodeChallenge, field.TypeString, value)
 		_node.CodeChallenge = value
 	}
-	if value, ok := arc.mutation.CodeChallengeMethod(); ok {
-		_spec.Fields = append(_spec.Fields, &sqlgraph.FieldSpec{
-			Type:   field.TypeString,
-			Value:  value,
-			Column: authrequest.FieldCodeChallengeMethod,
-		})
+	if value, ok := _c.mutation.CodeChallengeMethod(); ok {
+		_spec.SetField(authrequest.FieldCodeChallengeMethod, field.TypeString, value)
 		_node.CodeChallengeMethod = value
 	}
+	if value, ok := _c.mutation.HmacKey(); ok {
+		_spec.SetField(authrequest.FieldHmacKey, field.TypeBytes, value)
+		_node.HmacKey = value
+	}
+	if value, ok := _c.mutation.MfaValidated(); ok {
+		_spec.SetField(authrequest.FieldMfaValidated, field.TypeBool, value)
+		_node.MfaValidated = value
+	}
+	if value, ok := _c.mutation.WebauthnSessionData(); ok {
+		_spec.SetField(authrequest.FieldWebauthnSessionData, field.TypeBytes, value)
+		_node.WebauthnSessionData = &value
+	}
+	if value, ok := _c.mutation.Prompt(); ok {
+		_spec.SetField(authrequest.FieldPrompt, field.TypeString, value)
+		_node.Prompt = value
+	}
+	if value, ok := _c.mutation.MaxAge(); ok {
+		_spec.SetField(authrequest.FieldMaxAge, field.TypeInt, value)
+		_node.MaxAge = value
+	}
+	if value, ok := _c.mutation.AuthTime(); ok {
+		_spec.SetField(authrequest.FieldAuthTime, field.TypeTime, value)
+		_node.AuthTime = value
+	}
 	return _node, _spec
 }
 
 // AuthRequestCreateBulk is the builder for creating many AuthRequest entities in bulk.
 type AuthRequestCreateBulk struct {
 	config
+	err      error
 	builders []*AuthRequestCreate
 }
 
 // Save creates the AuthRequest entities in the database.
-func (arcb *AuthRequestCreateBulk) Save(ctx context.Context) ([]*AuthRequest, error) {
-	specs := make([]*sqlgraph.CreateSpec, len(arcb.builders))
-	nodes := make([]*AuthRequest, len(arcb.builders))
-	mutators := make([]Mutator, len(arcb.builders))
-	for i := range arcb.builders {
+func (_c *AuthRequestCreateBulk) Save(ctx context.Context) ([]*AuthRequest, error) {
+	if _c.err != nil {
+		return nil, _c.err
+	}
+	specs := make([]*sqlgraph.CreateSpec, len(_c.builders))
+	nodes := make([]*AuthRequest, len(_c.builders))
+	mutators := make([]Mutator, len(_c.builders))
+	for i := range _c.builders {
 		func(i int, root context.Context) {
-			builder := arcb.builders[i]
+			builder := _c.builders[i]
 			builder.defaults()
 			var mut Mutator = MutateFunc(func(ctx context.Context, m Mutation) (Value, error) {
 				mutation, ok := m.(*AuthRequestMutation)
@@ -522,14 +523,14 @@ func (arcb *AuthRequestCreateBulk) Save(ctx context.Context) ([]*AuthRequest, er
 					return nil, err
 				}
 				builder.mutation = mutation
-				nodes[i], specs[i] = builder.createSpec()
 				var err error
+				nodes[i], specs[i] = builder.createSpec()
 				if i < len(mutators)-1 {
-					_, err = mutators[i+1].Mutate(root, arcb.builders[i+1].mutation)
+					_, err = mutators[i+1].Mutate(root, _c.builders[i+1].mutation)
 				} else {
 					spec := &sqlgraph.BatchCreateSpec{Nodes: specs}
 					// Invoke the actual operation on the latest mutation in the chain.
-					if err = sqlgraph.BatchCreate(ctx, arcb.driver, spec); err != nil {
+					if err = sqlgraph.BatchCreate(ctx, _c.driver, spec); err != nil {
 						if sqlgraph.IsConstraintError(err) {
 							err = &ConstraintError{msg: err.Error(), wrap: err}
 						}
@@ -549,7 +550,7 @@ func (arcb *AuthRequestCreateBulk) Save(ctx context.Context) ([]*AuthRequest, er
 		}(i, ctx)
 	}
 	if len(mutators) > 0 {
-		if _, err := mutators[0].Mutate(ctx, arcb.builders[0].mutation); err != nil {
+		if _, err := mutators[0].Mutate(ctx, _c.builders[0].mutation); err != nil {
 			return nil, err
 		}
 	}
@@ -557,8 +558,8 @@ func (arcb *AuthRequestCreateBulk) Save(ctx context.Context) ([]*AuthRequest, er
 }
 
 // SaveX is like Save, but panics if an error occurs.
-func (arcb *AuthRequestCreateBulk) SaveX(ctx context.Context) []*AuthRequest {
-	v, err := arcb.Save(ctx)
+func (_c *AuthRequestCreateBulk) SaveX(ctx context.Context) []*AuthRequest {
+	v, err := _c.Save(ctx)
 	if err != nil {
 		panic(err)
 	}
@@ -566,14 +567,14 @@ func (arcb *AuthRequestCreateBulk) SaveX(ctx context.Context) []*AuthRequest {
 }
 
 // Exec executes the query.
-func (arcb *AuthRequestCreateBulk) Exec(ctx context.Context) error {
-	_, err := arcb.Save(ctx)
+func (_c *AuthRequestCreateBulk) Exec(ctx context.Context) error {
+	_, err := _c.Save(ctx)
 	return err
 }
 
 // ExecX is like Exec, but panics if an error occurs.
-func (arcb *AuthRequestCreateBulk) ExecX(ctx context.Context) {
-	if err := arcb.Exec(ctx); err != nil {
+func (_c *AuthRequestCreateBulk) ExecX(ctx context.Context) {
+	if err := _c.Exec(ctx); err != nil {
 		panic(err)
 	}
 }
diff --git a/storage/ent/db/authrequest_delete.go b/storage/ent/db/authrequest_delete.go
index 495f467609..b9e2cd59a3 100644
--- a/storage/ent/db/authrequest_delete.go
+++ b/storage/ent/db/authrequest_delete.go
@@ -4,7 +4,6 @@ package db
 
 import (
 	"context"
-	"fmt"
 
 	"entgo.io/ent/dialect/sql"
 	"entgo.io/ent/dialect/sql/sqlgraph"
@@ -21,84 +20,56 @@ type AuthRequestDelete struct {
 }
 
 // Where appends a list predicates to the AuthRequestDelete builder.
-func (ard *AuthRequestDelete) Where(ps ...predicate.AuthRequest) *AuthRequestDelete {
-	ard.mutation.Where(ps...)
-	return ard
+func (_d *AuthRequestDelete) Where(ps ...predicate.AuthRequest) *AuthRequestDelete {
+	_d.mutation.Where(ps...)
+	return _d
 }
 
 // Exec executes the deletion query and returns how many vertices were deleted.
-func (ard *AuthRequestDelete) Exec(ctx context.Context) (int, error) {
-	var (
-		err      error
-		affected int
-	)
-	if len(ard.hooks) == 0 {
-		affected, err = ard.sqlExec(ctx)
-	} else {
-		var mut Mutator = MutateFunc(func(ctx context.Context, m Mutation) (Value, error) {
-			mutation, ok := m.(*AuthRequestMutation)
-			if !ok {
-				return nil, fmt.Errorf("unexpected mutation type %T", m)
-			}
-			ard.mutation = mutation
-			affected, err = ard.sqlExec(ctx)
-			mutation.done = true
-			return affected, err
-		})
-		for i := len(ard.hooks) - 1; i >= 0; i-- {
-			if ard.hooks[i] == nil {
-				return 0, fmt.Errorf("db: uninitialized hook (forgotten import db/runtime?)")
-			}
-			mut = ard.hooks[i](mut)
-		}
-		if _, err := mut.Mutate(ctx, ard.mutation); err != nil {
-			return 0, err
-		}
-	}
-	return affected, err
+func (_d *AuthRequestDelete) Exec(ctx context.Context) (int, error) {
+	return withHooks(ctx, _d.sqlExec, _d.mutation, _d.hooks)
 }
 
 // ExecX is like Exec, but panics if an error occurs.
-func (ard *AuthRequestDelete) ExecX(ctx context.Context) int {
-	n, err := ard.Exec(ctx)
+func (_d *AuthRequestDelete) ExecX(ctx context.Context) int {
+	n, err := _d.Exec(ctx)
 	if err != nil {
 		panic(err)
 	}
 	return n
 }
 
-func (ard *AuthRequestDelete) sqlExec(ctx context.Context) (int, error) {
-	_spec := &sqlgraph.DeleteSpec{
-		Node: &sqlgraph.NodeSpec{
-			Table: authrequest.Table,
-			ID: &sqlgraph.FieldSpec{
-				Type:   field.TypeString,
-				Column: authrequest.FieldID,
-			},
-		},
-	}
-	if ps := ard.mutation.predicates; len(ps) > 0 {
+func (_d *AuthRequestDelete) sqlExec(ctx context.Context) (int, error) {
+	_spec := sqlgraph.NewDeleteSpec(authrequest.Table, sqlgraph.NewFieldSpec(authrequest.FieldID, field.TypeString))
+	if ps := _d.mutation.predicates; len(ps) > 0 {
 		_spec.Predicate = func(selector *sql.Selector) {
 			for i := range ps {
 				ps[i](selector)
 			}
 		}
 	}
-	affected, err := sqlgraph.DeleteNodes(ctx, ard.driver, _spec)
+	affected, err := sqlgraph.DeleteNodes(ctx, _d.driver, _spec)
 	if err != nil && sqlgraph.IsConstraintError(err) {
 		err = &ConstraintError{msg: err.Error(), wrap: err}
 	}
+	_d.mutation.done = true
 	return affected, err
 }
 
 // AuthRequestDeleteOne is the builder for deleting a single AuthRequest entity.
 type AuthRequestDeleteOne struct {
-	ard *AuthRequestDelete
+	_d *AuthRequestDelete
+}
+
+// Where appends a list predicates to the AuthRequestDelete builder.
+func (_d *AuthRequestDeleteOne) Where(ps ...predicate.AuthRequest) *AuthRequestDeleteOne {
+	_d._d.mutation.Where(ps...)
+	return _d
 }
 
 // Exec executes the deletion query.
-func (ardo *AuthRequestDeleteOne) Exec(ctx context.Context) error {
-	n, err := ardo.ard.Exec(ctx)
+func (_d *AuthRequestDeleteOne) Exec(ctx context.Context) error {
+	n, err := _d._d.Exec(ctx)
 	switch {
 	case err != nil:
 		return err
@@ -110,6 +81,8 @@ func (ardo *AuthRequestDeleteOne) Exec(ctx context.Context) error {
 }
 
 // ExecX is like Exec, but panics if an error occurs.
-func (ardo *AuthRequestDeleteOne) ExecX(ctx context.Context) {
-	ardo.ard.ExecX(ctx)
+func (_d *AuthRequestDeleteOne) ExecX(ctx context.Context) {
+	if err := _d.Exec(ctx); err != nil {
+		panic(err)
+	}
 }
diff --git a/storage/ent/db/authrequest_query.go b/storage/ent/db/authrequest_query.go
index 577da17b06..22fd3fb1d2 100644
--- a/storage/ent/db/authrequest_query.go
+++ b/storage/ent/db/authrequest_query.go
@@ -7,6 +7,7 @@ import (
 	"fmt"
 	"math"
 
+	"entgo.io/ent"
 	"entgo.io/ent/dialect/sql"
 	"entgo.io/ent/dialect/sql/sqlgraph"
 	"entgo.io/ent/schema/field"
@@ -17,11 +18,9 @@ import (
 // AuthRequestQuery is the builder for querying AuthRequest entities.
 type AuthRequestQuery struct {
 	config
-	limit      *int
-	offset     *int
-	unique     *bool
-	order      []OrderFunc
-	fields     []string
+	ctx        *QueryContext
+	order      []authrequest.OrderOption
+	inters     []Interceptor
 	predicates []predicate.AuthRequest
 	// intermediate query (i.e. traversal path).
 	sql  *sql.Selector
@@ -29,40 +28,40 @@ type AuthRequestQuery struct {
 }
 
 // Where adds a new predicate for the AuthRequestQuery builder.
-func (arq *AuthRequestQuery) Where(ps ...predicate.AuthRequest) *AuthRequestQuery {
-	arq.predicates = append(arq.predicates, ps...)
-	return arq
+func (_q *AuthRequestQuery) Where(ps ...predicate.AuthRequest) *AuthRequestQuery {
+	_q.predicates = append(_q.predicates, ps...)
+	return _q
 }
 
-// Limit adds a limit step to the query.
-func (arq *AuthRequestQuery) Limit(limit int) *AuthRequestQuery {
-	arq.limit = &limit
-	return arq
+// Limit the number of records to be returned by this query.
+func (_q *AuthRequestQuery) Limit(limit int) *AuthRequestQuery {
+	_q.ctx.Limit = &limit
+	return _q
 }
 
-// Offset adds an offset step to the query.
-func (arq *AuthRequestQuery) Offset(offset int) *AuthRequestQuery {
-	arq.offset = &offset
-	return arq
+// Offset to start from.
+func (_q *AuthRequestQuery) Offset(offset int) *AuthRequestQuery {
+	_q.ctx.Offset = &offset
+	return _q
 }
 
 // Unique configures the query builder to filter duplicate records on query.
 // By default, unique is set to true, and can be disabled using this method.
-func (arq *AuthRequestQuery) Unique(unique bool) *AuthRequestQuery {
-	arq.unique = &unique
-	return arq
+func (_q *AuthRequestQuery) Unique(unique bool) *AuthRequestQuery {
+	_q.ctx.Unique = &unique
+	return _q
 }
 
-// Order adds an order step to the query.
-func (arq *AuthRequestQuery) Order(o ...OrderFunc) *AuthRequestQuery {
-	arq.order = append(arq.order, o...)
-	return arq
+// Order specifies how the records should be ordered.
+func (_q *AuthRequestQuery) Order(o ...authrequest.OrderOption) *AuthRequestQuery {
+	_q.order = append(_q.order, o...)
+	return _q
 }
 
 // First returns the first AuthRequest entity from the query.
 // Returns a *NotFoundError when no AuthRequest was found.
-func (arq *AuthRequestQuery) First(ctx context.Context) (*AuthRequest, error) {
-	nodes, err := arq.Limit(1).All(ctx)
+func (_q *AuthRequestQuery) First(ctx context.Context) (*AuthRequest, error) {
+	nodes, err := _q.Limit(1).All(setContextOp(ctx, _q.ctx, ent.OpQueryFirst))
 	if err != nil {
 		return nil, err
 	}
@@ -73,8 +72,8 @@ func (arq *AuthRequestQuery) First(ctx context.Context) (*AuthRequest, error) {
 }
 
 // FirstX is like First, but panics if an error occurs.
-func (arq *AuthRequestQuery) FirstX(ctx context.Context) *AuthRequest {
-	node, err := arq.First(ctx)
+func (_q *AuthRequestQuery) FirstX(ctx context.Context) *AuthRequest {
+	node, err := _q.First(ctx)
 	if err != nil && !IsNotFound(err) {
 		panic(err)
 	}
@@ -83,9 +82,9 @@ func (arq *AuthRequestQuery) FirstX(ctx context.Context) *AuthRequest {
 
 // FirstID returns the first AuthRequest ID from the query.
 // Returns a *NotFoundError when no AuthRequest ID was found.
-func (arq *AuthRequestQuery) FirstID(ctx context.Context) (id string, err error) {
+func (_q *AuthRequestQuery) FirstID(ctx context.Context) (id string, err error) {
 	var ids []string
-	if ids, err = arq.Limit(1).IDs(ctx); err != nil {
+	if ids, err = _q.Limit(1).IDs(setContextOp(ctx, _q.ctx, ent.OpQueryFirstID)); err != nil {
 		return
 	}
 	if len(ids) == 0 {
@@ -96,8 +95,8 @@ func (arq *AuthRequestQuery) FirstID(ctx context.Context) (id string, err error)
 }
 
 // FirstIDX is like FirstID, but panics if an error occurs.
-func (arq *AuthRequestQuery) FirstIDX(ctx context.Context) string {
-	id, err := arq.FirstID(ctx)
+func (_q *AuthRequestQuery) FirstIDX(ctx context.Context) string {
+	id, err := _q.FirstID(ctx)
 	if err != nil && !IsNotFound(err) {
 		panic(err)
 	}
@@ -107,8 +106,8 @@ func (arq *AuthRequestQuery) FirstIDX(ctx context.Context) string {
 // Only returns a single AuthRequest entity found by the query, ensuring it only returns one.
 // Returns a *NotSingularError when more than one AuthRequest entity is found.
 // Returns a *NotFoundError when no AuthRequest entities are found.
-func (arq *AuthRequestQuery) Only(ctx context.Context) (*AuthRequest, error) {
-	nodes, err := arq.Limit(2).All(ctx)
+func (_q *AuthRequestQuery) Only(ctx context.Context) (*AuthRequest, error) {
+	nodes, err := _q.Limit(2).All(setContextOp(ctx, _q.ctx, ent.OpQueryOnly))
 	if err != nil {
 		return nil, err
 	}
@@ -123,8 +122,8 @@ func (arq *AuthRequestQuery) Only(ctx context.Context) (*AuthRequest, error) {
 }
 
 // OnlyX is like Only, but panics if an error occurs.
-func (arq *AuthRequestQuery) OnlyX(ctx context.Context) *AuthRequest {
-	node, err := arq.Only(ctx)
+func (_q *AuthRequestQuery) OnlyX(ctx context.Context) *AuthRequest {
+	node, err := _q.Only(ctx)
 	if err != nil {
 		panic(err)
 	}
@@ -134,9 +133,9 @@ func (arq *AuthRequestQuery) OnlyX(ctx context.Context) *AuthRequest {
 // OnlyID is like Only, but returns the only AuthRequest ID in the query.
 // Returns a *NotSingularError when more than one AuthRequest ID is found.
 // Returns a *NotFoundError when no entities are found.
-func (arq *AuthRequestQuery) OnlyID(ctx context.Context) (id string, err error) {
+func (_q *AuthRequestQuery) OnlyID(ctx context.Context) (id string, err error) {
 	var ids []string
-	if ids, err = arq.Limit(2).IDs(ctx); err != nil {
+	if ids, err = _q.Limit(2).IDs(setContextOp(ctx, _q.ctx, ent.OpQueryOnlyID)); err != nil {
 		return
 	}
 	switch len(ids) {
@@ -151,8 +150,8 @@ func (arq *AuthRequestQuery) OnlyID(ctx context.Context) (id string, err error)
 }
 
 // OnlyIDX is like OnlyID, but panics if an error occurs.
-func (arq *AuthRequestQuery) OnlyIDX(ctx context.Context) string {
-	id, err := arq.OnlyID(ctx)
+func (_q *AuthRequestQuery) OnlyIDX(ctx context.Context) string {
+	id, err := _q.OnlyID(ctx)
 	if err != nil {
 		panic(err)
 	}
@@ -160,16 +159,18 @@ func (arq *AuthRequestQuery) OnlyIDX(ctx context.Context) string {
 }
 
 // All executes the query and returns a list of AuthRequests.
-func (arq *AuthRequestQuery) All(ctx context.Context) ([]*AuthRequest, error) {
-	if err := arq.prepareQuery(ctx); err != nil {
+func (_q *AuthRequestQuery) All(ctx context.Context) ([]*AuthRequest, error) {
+	ctx = setContextOp(ctx, _q.ctx, ent.OpQueryAll)
+	if err := _q.prepareQuery(ctx); err != nil {
 		return nil, err
 	}
-	return arq.sqlAll(ctx)
+	qr := querierAll[[]*AuthRequest, *AuthRequestQuery]()
+	return withInterceptors[[]*AuthRequest](ctx, _q, qr, _q.inters)
 }
 
 // AllX is like All, but panics if an error occurs.
-func (arq *AuthRequestQuery) AllX(ctx context.Context) []*AuthRequest {
-	nodes, err := arq.All(ctx)
+func (_q *AuthRequestQuery) AllX(ctx context.Context) []*AuthRequest {
+	nodes, err := _q.All(ctx)
 	if err != nil {
 		panic(err)
 	}
@@ -177,17 +178,20 @@ func (arq *AuthRequestQuery) AllX(ctx context.Context) []*AuthRequest {
 }
 
 // IDs executes the query and returns a list of AuthRequest IDs.
-func (arq *AuthRequestQuery) IDs(ctx context.Context) ([]string, error) {
-	var ids []string
-	if err := arq.Select(authrequest.FieldID).Scan(ctx, &ids); err != nil {
+func (_q *AuthRequestQuery) IDs(ctx context.Context) (ids []string, err error) {
+	if _q.ctx.Unique == nil && _q.path != nil {
+		_q.Unique(true)
+	}
+	ctx = setContextOp(ctx, _q.ctx, ent.OpQueryIDs)
+	if err = _q.Select(authrequest.FieldID).Scan(ctx, &ids); err != nil {
 		return nil, err
 	}
 	return ids, nil
 }
 
 // IDsX is like IDs, but panics if an error occurs.
-func (arq *AuthRequestQuery) IDsX(ctx context.Context) []string {
-	ids, err := arq.IDs(ctx)
+func (_q *AuthRequestQuery) IDsX(ctx context.Context) []string {
+	ids, err := _q.IDs(ctx)
 	if err != nil {
 		panic(err)
 	}
@@ -195,16 +199,17 @@ func (arq *AuthRequestQuery) IDsX(ctx context.Context) []string {
 }
 
 // Count returns the count of the given query.
-func (arq *AuthRequestQuery) Count(ctx context.Context) (int, error) {
-	if err := arq.prepareQuery(ctx); err != nil {
+func (_q *AuthRequestQuery) Count(ctx context.Context) (int, error) {
+	ctx = setContextOp(ctx, _q.ctx, ent.OpQueryCount)
+	if err := _q.prepareQuery(ctx); err != nil {
 		return 0, err
 	}
-	return arq.sqlCount(ctx)
+	return withInterceptors[int](ctx, _q, querierCount[*AuthRequestQuery](), _q.inters)
 }
 
 // CountX is like Count, but panics if an error occurs.
-func (arq *AuthRequestQuery) CountX(ctx context.Context) int {
-	count, err := arq.Count(ctx)
+func (_q *AuthRequestQuery) CountX(ctx context.Context) int {
+	count, err := _q.Count(ctx)
 	if err != nil {
 		panic(err)
 	}
@@ -212,16 +217,21 @@ func (arq *AuthRequestQuery) CountX(ctx context.Context) int {
 }
 
 // Exist returns true if the query has elements in the graph.
-func (arq *AuthRequestQuery) Exist(ctx context.Context) (bool, error) {
-	if err := arq.prepareQuery(ctx); err != nil {
-		return false, err
+func (_q *AuthRequestQuery) Exist(ctx context.Context) (bool, error) {
+	ctx = setContextOp(ctx, _q.ctx, ent.OpQueryExist)
+	switch _, err := _q.FirstID(ctx); {
+	case IsNotFound(err):
+		return false, nil
+	case err != nil:
+		return false, fmt.Errorf("db: check existence: %w", err)
+	default:
+		return true, nil
 	}
-	return arq.sqlExist(ctx)
 }
 
 // ExistX is like Exist, but panics if an error occurs.
-func (arq *AuthRequestQuery) ExistX(ctx context.Context) bool {
-	exist, err := arq.Exist(ctx)
+func (_q *AuthRequestQuery) ExistX(ctx context.Context) bool {
+	exist, err := _q.Exist(ctx)
 	if err != nil {
 		panic(err)
 	}
@@ -230,20 +240,19 @@ func (arq *AuthRequestQuery) ExistX(ctx context.Context) bool {
 
 // Clone returns a duplicate of the AuthRequestQuery builder, including all associated steps. It can be
 // used to prepare common query builders and use them differently after the clone is made.
-func (arq *AuthRequestQuery) Clone() *AuthRequestQuery {
-	if arq == nil {
+func (_q *AuthRequestQuery) Clone() *AuthRequestQuery {
+	if _q == nil {
 		return nil
 	}
 	return &AuthRequestQuery{
-		config:     arq.config,
-		limit:      arq.limit,
-		offset:     arq.offset,
-		order:      append([]OrderFunc{}, arq.order...),
-		predicates: append([]predicate.AuthRequest{}, arq.predicates...),
+		config:     _q.config,
+		ctx:        _q.ctx.Clone(),
+		order:      append([]authrequest.OrderOption{}, _q.order...),
+		inters:     append([]Interceptor{}, _q.inters...),
+		predicates: append([]predicate.AuthRequest{}, _q.predicates...),
 		// clone intermediate query.
-		sql:    arq.sql.Clone(),
-		path:   arq.path,
-		unique: arq.unique,
+		sql:  _q.sql.Clone(),
+		path: _q.path,
 	}
 }
 
@@ -261,18 +270,12 @@ func (arq *AuthRequestQuery) Clone() *AuthRequestQuery {
 //		GroupBy(authrequest.FieldClientID).
 //		Aggregate(db.Count()).
 //		Scan(ctx, &v)
-//
-func (arq *AuthRequestQuery) GroupBy(field string, fields ...string) *AuthRequestGroupBy {
-	grbuild := &AuthRequestGroupBy{config: arq.config}
-	grbuild.fields = append([]string{field}, fields...)
-	grbuild.path = func(ctx context.Context) (prev *sql.Selector, err error) {
-		if err := arq.prepareQuery(ctx); err != nil {
-			return nil, err
-		}
-		return arq.sqlQuery(ctx), nil
-	}
+func (_q *AuthRequestQuery) GroupBy(field string, fields ...string) *AuthRequestGroupBy {
+	_q.ctx.Fields = append([]string{field}, fields...)
+	grbuild := &AuthRequestGroupBy{build: _q}
+	grbuild.flds = &_q.ctx.Fields
 	grbuild.label = authrequest.Label
-	grbuild.flds, grbuild.scan = &grbuild.fields, grbuild.Scan
+	grbuild.scan = grbuild.Scan
 	return grbuild
 }
 
@@ -288,48 +291,62 @@ func (arq *AuthRequestQuery) GroupBy(field string, fields ...string) *AuthReques
 //	client.AuthRequest.Query().
 //		Select(authrequest.FieldClientID).
 //		Scan(ctx, &v)
-//
-func (arq *AuthRequestQuery) Select(fields ...string) *AuthRequestSelect {
-	arq.fields = append(arq.fields, fields...)
-	selbuild := &AuthRequestSelect{AuthRequestQuery: arq}
-	selbuild.label = authrequest.Label
-	selbuild.flds, selbuild.scan = &arq.fields, selbuild.Scan
-	return selbuild
+func (_q *AuthRequestQuery) Select(fields ...string) *AuthRequestSelect {
+	_q.ctx.Fields = append(_q.ctx.Fields, fields...)
+	sbuild := &AuthRequestSelect{AuthRequestQuery: _q}
+	sbuild.label = authrequest.Label
+	sbuild.flds, sbuild.scan = &_q.ctx.Fields, sbuild.Scan
+	return sbuild
+}
+
+// Aggregate returns a AuthRequestSelect configured with the given aggregations.
+func (_q *AuthRequestQuery) Aggregate(fns ...AggregateFunc) *AuthRequestSelect {
+	return _q.Select().Aggregate(fns...)
 }
 
-func (arq *AuthRequestQuery) prepareQuery(ctx context.Context) error {
-	for _, f := range arq.fields {
+func (_q *AuthRequestQuery) prepareQuery(ctx context.Context) error {
+	for _, inter := range _q.inters {
+		if inter == nil {
+			return fmt.Errorf("db: uninitialized interceptor (forgotten import db/runtime?)")
+		}
+		if trv, ok := inter.(Traverser); ok {
+			if err := trv.Traverse(ctx, _q); err != nil {
+				return err
+			}
+		}
+	}
+	for _, f := range _q.ctx.Fields {
 		if !authrequest.ValidColumn(f) {
 			return &ValidationError{Name: f, err: fmt.Errorf("db: invalid field %q for query", f)}
 		}
 	}
-	if arq.path != nil {
-		prev, err := arq.path(ctx)
+	if _q.path != nil {
+		prev, err := _q.path(ctx)
 		if err != nil {
 			return err
 		}
-		arq.sql = prev
+		_q.sql = prev
 	}
 	return nil
 }
 
-func (arq *AuthRequestQuery) sqlAll(ctx context.Context, hooks ...queryHook) ([]*AuthRequest, error) {
+func (_q *AuthRequestQuery) sqlAll(ctx context.Context, hooks ...queryHook) ([]*AuthRequest, error) {
 	var (
 		nodes = []*AuthRequest{}
-		_spec = arq.querySpec()
+		_spec = _q.querySpec()
 	)
-	_spec.ScanValues = func(columns []string) ([]interface{}, error) {
+	_spec.ScanValues = func(columns []string) ([]any, error) {
 		return (*AuthRequest).scanValues(nil, columns)
 	}
-	_spec.Assign = func(columns []string, values []interface{}) error {
-		node := &AuthRequest{config: arq.config}
+	_spec.Assign = func(columns []string, values []any) error {
+		node := &AuthRequest{config: _q.config}
 		nodes = append(nodes, node)
 		return node.assignValues(columns, values)
 	}
 	for i := range hooks {
 		hooks[i](ctx, _spec)
 	}
-	if err := sqlgraph.QueryNodes(ctx, arq.driver, _spec); err != nil {
+	if err := sqlgraph.QueryNodes(ctx, _q.driver, _spec); err != nil {
 		return nil, err
 	}
 	if len(nodes) == 0 {
@@ -338,40 +355,24 @@ func (arq *AuthRequestQuery) sqlAll(ctx context.Context, hooks ...queryHook) ([]
 	return nodes, nil
 }
 
-func (arq *AuthRequestQuery) sqlCount(ctx context.Context) (int, error) {
-	_spec := arq.querySpec()
-	_spec.Node.Columns = arq.fields
-	if len(arq.fields) > 0 {
-		_spec.Unique = arq.unique != nil && *arq.unique
-	}
-	return sqlgraph.CountNodes(ctx, arq.driver, _spec)
-}
-
-func (arq *AuthRequestQuery) sqlExist(ctx context.Context) (bool, error) {
-	n, err := arq.sqlCount(ctx)
-	if err != nil {
-		return false, fmt.Errorf("db: check existence: %w", err)
+func (_q *AuthRequestQuery) sqlCount(ctx context.Context) (int, error) {
+	_spec := _q.querySpec()
+	_spec.Node.Columns = _q.ctx.Fields
+	if len(_q.ctx.Fields) > 0 {
+		_spec.Unique = _q.ctx.Unique != nil && *_q.ctx.Unique
 	}
-	return n > 0, nil
+	return sqlgraph.CountNodes(ctx, _q.driver, _spec)
 }
 
-func (arq *AuthRequestQuery) querySpec() *sqlgraph.QuerySpec {
-	_spec := &sqlgraph.QuerySpec{
-		Node: &sqlgraph.NodeSpec{
-			Table:   authrequest.Table,
-			Columns: authrequest.Columns,
-			ID: &sqlgraph.FieldSpec{
-				Type:   field.TypeString,
-				Column: authrequest.FieldID,
-			},
-		},
-		From:   arq.sql,
-		Unique: true,
-	}
-	if unique := arq.unique; unique != nil {
+func (_q *AuthRequestQuery) querySpec() *sqlgraph.QuerySpec {
+	_spec := sqlgraph.NewQuerySpec(authrequest.Table, authrequest.Columns, sqlgraph.NewFieldSpec(authrequest.FieldID, field.TypeString))
+	_spec.From = _q.sql
+	if unique := _q.ctx.Unique; unique != nil {
 		_spec.Unique = *unique
+	} else if _q.path != nil {
+		_spec.Unique = true
 	}
-	if fields := arq.fields; len(fields) > 0 {
+	if fields := _q.ctx.Fields; len(fields) > 0 {
 		_spec.Node.Columns = make([]string, 0, len(fields))
 		_spec.Node.Columns = append(_spec.Node.Columns, authrequest.FieldID)
 		for i := range fields {
@@ -380,20 +381,20 @@ func (arq *AuthRequestQuery) querySpec() *sqlgraph.QuerySpec {
 			}
 		}
 	}
-	if ps := arq.predicates; len(ps) > 0 {
+	if ps := _q.predicates; len(ps) > 0 {
 		_spec.Predicate = func(selector *sql.Selector) {
 			for i := range ps {
 				ps[i](selector)
 			}
 		}
 	}
-	if limit := arq.limit; limit != nil {
+	if limit := _q.ctx.Limit; limit != nil {
 		_spec.Limit = *limit
 	}
-	if offset := arq.offset; offset != nil {
+	if offset := _q.ctx.Offset; offset != nil {
 		_spec.Offset = *offset
 	}
-	if ps := arq.order; len(ps) > 0 {
+	if ps := _q.order; len(ps) > 0 {
 		_spec.Order = func(selector *sql.Selector) {
 			for i := range ps {
 				ps[i](selector)
@@ -403,33 +404,33 @@ func (arq *AuthRequestQuery) querySpec() *sqlgraph.QuerySpec {
 	return _spec
 }
 
-func (arq *AuthRequestQuery) sqlQuery(ctx context.Context) *sql.Selector {
-	builder := sql.Dialect(arq.driver.Dialect())
+func (_q *AuthRequestQuery) sqlQuery(ctx context.Context) *sql.Selector {
+	builder := sql.Dialect(_q.driver.Dialect())
 	t1 := builder.Table(authrequest.Table)
-	columns := arq.fields
+	columns := _q.ctx.Fields
 	if len(columns) == 0 {
 		columns = authrequest.Columns
 	}
 	selector := builder.Select(t1.Columns(columns...)...).From(t1)
-	if arq.sql != nil {
-		selector = arq.sql
+	if _q.sql != nil {
+		selector = _q.sql
 		selector.Select(selector.Columns(columns...)...)
 	}
-	if arq.unique != nil && *arq.unique {
+	if _q.ctx.Unique != nil && *_q.ctx.Unique {
 		selector.Distinct()
 	}
-	for _, p := range arq.predicates {
+	for _, p := range _q.predicates {
 		p(selector)
 	}
-	for _, p := range arq.order {
+	for _, p := range _q.order {
 		p(selector)
 	}
-	if offset := arq.offset; offset != nil {
+	if offset := _q.ctx.Offset; offset != nil {
 		// limit is mandatory for offset clause. We start
 		// with default value, and override it below if needed.
 		selector.Offset(*offset).Limit(math.MaxInt32)
 	}
-	if limit := arq.limit; limit != nil {
+	if limit := _q.ctx.Limit; limit != nil {
 		selector.Limit(*limit)
 	}
 	return selector
@@ -437,90 +438,88 @@ func (arq *AuthRequestQuery) sqlQuery(ctx context.Context) *sql.Selector {
 
 // AuthRequestGroupBy is the group-by builder for AuthRequest entities.
 type AuthRequestGroupBy struct {
-	config
 	selector
-	fields []string
-	fns    []AggregateFunc
-	// intermediate query (i.e. traversal path).
-	sql  *sql.Selector
-	path func(context.Context) (*sql.Selector, error)
+	build *AuthRequestQuery
 }
 
 // Aggregate adds the given aggregation functions to the group-by query.
-func (argb *AuthRequestGroupBy) Aggregate(fns ...AggregateFunc) *AuthRequestGroupBy {
-	argb.fns = append(argb.fns, fns...)
-	return argb
+func (_g *AuthRequestGroupBy) Aggregate(fns ...AggregateFunc) *AuthRequestGroupBy {
+	_g.fns = append(_g.fns, fns...)
+	return _g
 }
 
-// Scan applies the group-by query and scans the result into the given value.
-func (argb *AuthRequestGroupBy) Scan(ctx context.Context, v interface{}) error {
-	query, err := argb.path(ctx)
-	if err != nil {
+// Scan applies the selector query and scans the result into the given value.
+func (_g *AuthRequestGroupBy) Scan(ctx context.Context, v any) error {
+	ctx = setContextOp(ctx, _g.build.ctx, ent.OpQueryGroupBy)
+	if err := _g.build.prepareQuery(ctx); err != nil {
 		return err
 	}
-	argb.sql = query
-	return argb.sqlScan(ctx, v)
+	return scanWithInterceptors[*AuthRequestQuery, *AuthRequestGroupBy](ctx, _g.build, _g, _g.build.inters, v)
 }
 
-func (argb *AuthRequestGroupBy) sqlScan(ctx context.Context, v interface{}) error {
-	for _, f := range argb.fields {
-		if !authrequest.ValidColumn(f) {
-			return &ValidationError{Name: f, err: fmt.Errorf("invalid field %q for group-by", f)}
+func (_g *AuthRequestGroupBy) sqlScan(ctx context.Context, root *AuthRequestQuery, v any) error {
+	selector := root.sqlQuery(ctx).Select()
+	aggregation := make([]string, 0, len(_g.fns))
+	for _, fn := range _g.fns {
+		aggregation = append(aggregation, fn(selector))
+	}
+	if len(selector.SelectedColumns()) == 0 {
+		columns := make([]string, 0, len(*_g.flds)+len(_g.fns))
+		for _, f := range *_g.flds {
+			columns = append(columns, selector.C(f))
 		}
+		columns = append(columns, aggregation...)
+		selector.Select(columns...)
 	}
-	selector := argb.sqlQuery()
+	selector.GroupBy(selector.Columns(*_g.flds...)...)
 	if err := selector.Err(); err != nil {
 		return err
 	}
 	rows := &sql.Rows{}
 	query, args := selector.Query()
-	if err := argb.driver.Query(ctx, query, args, rows); err != nil {
+	if err := _g.build.driver.Query(ctx, query, args, rows); err != nil {
 		return err
 	}
 	defer rows.Close()
 	return sql.ScanSlice(rows, v)
 }
 
-func (argb *AuthRequestGroupBy) sqlQuery() *sql.Selector {
-	selector := argb.sql.Select()
-	aggregation := make([]string, 0, len(argb.fns))
-	for _, fn := range argb.fns {
-		aggregation = append(aggregation, fn(selector))
-	}
-	// If no columns were selected in a custom aggregation function, the default
-	// selection is the fields used for "group-by", and the aggregation functions.
-	if len(selector.SelectedColumns()) == 0 {
-		columns := make([]string, 0, len(argb.fields)+len(argb.fns))
-		for _, f := range argb.fields {
-			columns = append(columns, selector.C(f))
-		}
-		columns = append(columns, aggregation...)
-		selector.Select(columns...)
-	}
-	return selector.GroupBy(selector.Columns(argb.fields...)...)
-}
-
 // AuthRequestSelect is the builder for selecting fields of AuthRequest entities.
 type AuthRequestSelect struct {
 	*AuthRequestQuery
 	selector
-	// intermediate query (i.e. traversal path).
-	sql *sql.Selector
+}
+
+// Aggregate adds the given aggregation functions to the selector query.
+func (_s *AuthRequestSelect) Aggregate(fns ...AggregateFunc) *AuthRequestSelect {
+	_s.fns = append(_s.fns, fns...)
+	return _s
 }
 
 // Scan applies the selector query and scans the result into the given value.
-func (ars *AuthRequestSelect) Scan(ctx context.Context, v interface{}) error {
-	if err := ars.prepareQuery(ctx); err != nil {
+func (_s *AuthRequestSelect) Scan(ctx context.Context, v any) error {
+	ctx = setContextOp(ctx, _s.ctx, ent.OpQuerySelect)
+	if err := _s.prepareQuery(ctx); err != nil {
 		return err
 	}
-	ars.sql = ars.AuthRequestQuery.sqlQuery(ctx)
-	return ars.sqlScan(ctx, v)
+	return scanWithInterceptors[*AuthRequestQuery, *AuthRequestSelect](ctx, _s.AuthRequestQuery, _s, _s.inters, v)
 }
 
-func (ars *AuthRequestSelect) sqlScan(ctx context.Context, v interface{}) error {
+func (_s *AuthRequestSelect) sqlScan(ctx context.Context, root *AuthRequestQuery, v any) error {
+	selector := root.sqlQuery(ctx)
+	aggregation := make([]string, 0, len(_s.fns))
+	for _, fn := range _s.fns {
+		aggregation = append(aggregation, fn(selector))
+	}
+	switch n := len(*_s.selector.flds); {
+	case n == 0 && len(aggregation) > 0:
+		selector.Select(aggregation...)
+	case n != 0 && len(aggregation) > 0:
+		selector.AppendSelect(aggregation...)
+	}
 	rows := &sql.Rows{}
-	query, args := ars.sql.Query()
-	if err := ars.driver.Query(ctx, query, args, rows); err != nil {
+	query, args := selector.Query()
+	if err := _s.driver.Query(ctx, query, args, rows); err != nil {
 		return err
 	}
 	defer rows.Close()
diff --git a/storage/ent/db/authrequest_update.go b/storage/ent/db/authrequest_update.go
index 22dbb24b7c..96595ed5d9 100644
--- a/storage/ent/db/authrequest_update.go
+++ b/storage/ent/db/authrequest_update.go
@@ -10,6 +10,7 @@ import (
 
 	"entgo.io/ent/dialect/sql"
 	"entgo.io/ent/dialect/sql/sqlgraph"
+	"entgo.io/ent/dialect/sql/sqljson"
 	"entgo.io/ent/schema/field"
 	"github.com/dexidp/dex/storage/ent/db/authrequest"
 	"github.com/dexidp/dex/storage/ent/db/predicate"
@@ -23,213 +24,387 @@ type AuthRequestUpdate struct {
 }
 
 // Where appends a list predicates to the AuthRequestUpdate builder.
-func (aru *AuthRequestUpdate) Where(ps ...predicate.AuthRequest) *AuthRequestUpdate {
-	aru.mutation.Where(ps...)
-	return aru
+func (_u *AuthRequestUpdate) Where(ps ...predicate.AuthRequest) *AuthRequestUpdate {
+	_u.mutation.Where(ps...)
+	return _u
 }
 
 // SetClientID sets the "client_id" field.
-func (aru *AuthRequestUpdate) SetClientID(s string) *AuthRequestUpdate {
-	aru.mutation.SetClientID(s)
-	return aru
+func (_u *AuthRequestUpdate) SetClientID(v string) *AuthRequestUpdate {
+	_u.mutation.SetClientID(v)
+	return _u
+}
+
+// SetNillableClientID sets the "client_id" field if the given value is not nil.
+func (_u *AuthRequestUpdate) SetNillableClientID(v *string) *AuthRequestUpdate {
+	if v != nil {
+		_u.SetClientID(*v)
+	}
+	return _u
 }
 
 // SetScopes sets the "scopes" field.
-func (aru *AuthRequestUpdate) SetScopes(s []string) *AuthRequestUpdate {
-	aru.mutation.SetScopes(s)
-	return aru
+func (_u *AuthRequestUpdate) SetScopes(v []string) *AuthRequestUpdate {
+	_u.mutation.SetScopes(v)
+	return _u
+}
+
+// AppendScopes appends value to the "scopes" field.
+func (_u *AuthRequestUpdate) AppendScopes(v []string) *AuthRequestUpdate {
+	_u.mutation.AppendScopes(v)
+	return _u
 }
 
 // ClearScopes clears the value of the "scopes" field.
-func (aru *AuthRequestUpdate) ClearScopes() *AuthRequestUpdate {
-	aru.mutation.ClearScopes()
-	return aru
+func (_u *AuthRequestUpdate) ClearScopes() *AuthRequestUpdate {
+	_u.mutation.ClearScopes()
+	return _u
 }
 
 // SetResponseTypes sets the "response_types" field.
-func (aru *AuthRequestUpdate) SetResponseTypes(s []string) *AuthRequestUpdate {
-	aru.mutation.SetResponseTypes(s)
-	return aru
+func (_u *AuthRequestUpdate) SetResponseTypes(v []string) *AuthRequestUpdate {
+	_u.mutation.SetResponseTypes(v)
+	return _u
+}
+
+// AppendResponseTypes appends value to the "response_types" field.
+func (_u *AuthRequestUpdate) AppendResponseTypes(v []string) *AuthRequestUpdate {
+	_u.mutation.AppendResponseTypes(v)
+	return _u
 }
 
 // ClearResponseTypes clears the value of the "response_types" field.
-func (aru *AuthRequestUpdate) ClearResponseTypes() *AuthRequestUpdate {
-	aru.mutation.ClearResponseTypes()
-	return aru
+func (_u *AuthRequestUpdate) ClearResponseTypes() *AuthRequestUpdate {
+	_u.mutation.ClearResponseTypes()
+	return _u
 }
 
 // SetRedirectURI sets the "redirect_uri" field.
-func (aru *AuthRequestUpdate) SetRedirectURI(s string) *AuthRequestUpdate {
-	aru.mutation.SetRedirectURI(s)
-	return aru
+func (_u *AuthRequestUpdate) SetRedirectURI(v string) *AuthRequestUpdate {
+	_u.mutation.SetRedirectURI(v)
+	return _u
+}
+
+// SetNillableRedirectURI sets the "redirect_uri" field if the given value is not nil.
+func (_u *AuthRequestUpdate) SetNillableRedirectURI(v *string) *AuthRequestUpdate {
+	if v != nil {
+		_u.SetRedirectURI(*v)
+	}
+	return _u
 }
 
 // SetNonce sets the "nonce" field.
-func (aru *AuthRequestUpdate) SetNonce(s string) *AuthRequestUpdate {
-	aru.mutation.SetNonce(s)
-	return aru
+func (_u *AuthRequestUpdate) SetNonce(v string) *AuthRequestUpdate {
+	_u.mutation.SetNonce(v)
+	return _u
+}
+
+// SetNillableNonce sets the "nonce" field if the given value is not nil.
+func (_u *AuthRequestUpdate) SetNillableNonce(v *string) *AuthRequestUpdate {
+	if v != nil {
+		_u.SetNonce(*v)
+	}
+	return _u
 }
 
 // SetState sets the "state" field.
-func (aru *AuthRequestUpdate) SetState(s string) *AuthRequestUpdate {
-	aru.mutation.SetState(s)
-	return aru
+func (_u *AuthRequestUpdate) SetState(v string) *AuthRequestUpdate {
+	_u.mutation.SetState(v)
+	return _u
+}
+
+// SetNillableState sets the "state" field if the given value is not nil.
+func (_u *AuthRequestUpdate) SetNillableState(v *string) *AuthRequestUpdate {
+	if v != nil {
+		_u.SetState(*v)
+	}
+	return _u
 }
 
 // SetForceApprovalPrompt sets the "force_approval_prompt" field.
-func (aru *AuthRequestUpdate) SetForceApprovalPrompt(b bool) *AuthRequestUpdate {
-	aru.mutation.SetForceApprovalPrompt(b)
-	return aru
+func (_u *AuthRequestUpdate) SetForceApprovalPrompt(v bool) *AuthRequestUpdate {
+	_u.mutation.SetForceApprovalPrompt(v)
+	return _u
+}
+
+// SetNillableForceApprovalPrompt sets the "force_approval_prompt" field if the given value is not nil.
+func (_u *AuthRequestUpdate) SetNillableForceApprovalPrompt(v *bool) *AuthRequestUpdate {
+	if v != nil {
+		_u.SetForceApprovalPrompt(*v)
+	}
+	return _u
 }
 
 // SetLoggedIn sets the "logged_in" field.
-func (aru *AuthRequestUpdate) SetLoggedIn(b bool) *AuthRequestUpdate {
-	aru.mutation.SetLoggedIn(b)
-	return aru
+func (_u *AuthRequestUpdate) SetLoggedIn(v bool) *AuthRequestUpdate {
+	_u.mutation.SetLoggedIn(v)
+	return _u
+}
+
+// SetNillableLoggedIn sets the "logged_in" field if the given value is not nil.
+func (_u *AuthRequestUpdate) SetNillableLoggedIn(v *bool) *AuthRequestUpdate {
+	if v != nil {
+		_u.SetLoggedIn(*v)
+	}
+	return _u
 }
 
 // SetClaimsUserID sets the "claims_user_id" field.
-func (aru *AuthRequestUpdate) SetClaimsUserID(s string) *AuthRequestUpdate {
-	aru.mutation.SetClaimsUserID(s)
-	return aru
+func (_u *AuthRequestUpdate) SetClaimsUserID(v string) *AuthRequestUpdate {
+	_u.mutation.SetClaimsUserID(v)
+	return _u
+}
+
+// SetNillableClaimsUserID sets the "claims_user_id" field if the given value is not nil.
+func (_u *AuthRequestUpdate) SetNillableClaimsUserID(v *string) *AuthRequestUpdate {
+	if v != nil {
+		_u.SetClaimsUserID(*v)
+	}
+	return _u
 }
 
 // SetClaimsUsername sets the "claims_username" field.
-func (aru *AuthRequestUpdate) SetClaimsUsername(s string) *AuthRequestUpdate {
-	aru.mutation.SetClaimsUsername(s)
-	return aru
+func (_u *AuthRequestUpdate) SetClaimsUsername(v string) *AuthRequestUpdate {
+	_u.mutation.SetClaimsUsername(v)
+	return _u
+}
+
+// SetNillableClaimsUsername sets the "claims_username" field if the given value is not nil.
+func (_u *AuthRequestUpdate) SetNillableClaimsUsername(v *string) *AuthRequestUpdate {
+	if v != nil {
+		_u.SetClaimsUsername(*v)
+	}
+	return _u
 }
 
 // SetClaimsEmail sets the "claims_email" field.
-func (aru *AuthRequestUpdate) SetClaimsEmail(s string) *AuthRequestUpdate {
-	aru.mutation.SetClaimsEmail(s)
-	return aru
+func (_u *AuthRequestUpdate) SetClaimsEmail(v string) *AuthRequestUpdate {
+	_u.mutation.SetClaimsEmail(v)
+	return _u
+}
+
+// SetNillableClaimsEmail sets the "claims_email" field if the given value is not nil.
+func (_u *AuthRequestUpdate) SetNillableClaimsEmail(v *string) *AuthRequestUpdate {
+	if v != nil {
+		_u.SetClaimsEmail(*v)
+	}
+	return _u
 }
 
 // SetClaimsEmailVerified sets the "claims_email_verified" field.
-func (aru *AuthRequestUpdate) SetClaimsEmailVerified(b bool) *AuthRequestUpdate {
-	aru.mutation.SetClaimsEmailVerified(b)
-	return aru
+func (_u *AuthRequestUpdate) SetClaimsEmailVerified(v bool) *AuthRequestUpdate {
+	_u.mutation.SetClaimsEmailVerified(v)
+	return _u
+}
+
+// SetNillableClaimsEmailVerified sets the "claims_email_verified" field if the given value is not nil.
+func (_u *AuthRequestUpdate) SetNillableClaimsEmailVerified(v *bool) *AuthRequestUpdate {
+	if v != nil {
+		_u.SetClaimsEmailVerified(*v)
+	}
+	return _u
 }
 
 // SetClaimsGroups sets the "claims_groups" field.
-func (aru *AuthRequestUpdate) SetClaimsGroups(s []string) *AuthRequestUpdate {
-	aru.mutation.SetClaimsGroups(s)
-	return aru
+func (_u *AuthRequestUpdate) SetClaimsGroups(v []string) *AuthRequestUpdate {
+	_u.mutation.SetClaimsGroups(v)
+	return _u
+}
+
+// AppendClaimsGroups appends value to the "claims_groups" field.
+func (_u *AuthRequestUpdate) AppendClaimsGroups(v []string) *AuthRequestUpdate {
+	_u.mutation.AppendClaimsGroups(v)
+	return _u
 }
 
 // ClearClaimsGroups clears the value of the "claims_groups" field.
-func (aru *AuthRequestUpdate) ClearClaimsGroups() *AuthRequestUpdate {
-	aru.mutation.ClearClaimsGroups()
-	return aru
+func (_u *AuthRequestUpdate) ClearClaimsGroups() *AuthRequestUpdate {
+	_u.mutation.ClearClaimsGroups()
+	return _u
 }
 
 // SetClaimsPreferredUsername sets the "claims_preferred_username" field.
-func (aru *AuthRequestUpdate) SetClaimsPreferredUsername(s string) *AuthRequestUpdate {
-	aru.mutation.SetClaimsPreferredUsername(s)
-	return aru
+func (_u *AuthRequestUpdate) SetClaimsPreferredUsername(v string) *AuthRequestUpdate {
+	_u.mutation.SetClaimsPreferredUsername(v)
+	return _u
 }
 
 // SetNillableClaimsPreferredUsername sets the "claims_preferred_username" field if the given value is not nil.
-func (aru *AuthRequestUpdate) SetNillableClaimsPreferredUsername(s *string) *AuthRequestUpdate {
-	if s != nil {
-		aru.SetClaimsPreferredUsername(*s)
+func (_u *AuthRequestUpdate) SetNillableClaimsPreferredUsername(v *string) *AuthRequestUpdate {
+	if v != nil {
+		_u.SetClaimsPreferredUsername(*v)
 	}
-	return aru
+	return _u
 }
 
 // SetConnectorID sets the "connector_id" field.
-func (aru *AuthRequestUpdate) SetConnectorID(s string) *AuthRequestUpdate {
-	aru.mutation.SetConnectorID(s)
-	return aru
+func (_u *AuthRequestUpdate) SetConnectorID(v string) *AuthRequestUpdate {
+	_u.mutation.SetConnectorID(v)
+	return _u
+}
+
+// SetNillableConnectorID sets the "connector_id" field if the given value is not nil.
+func (_u *AuthRequestUpdate) SetNillableConnectorID(v *string) *AuthRequestUpdate {
+	if v != nil {
+		_u.SetConnectorID(*v)
+	}
+	return _u
 }
 
 // SetConnectorData sets the "connector_data" field.
-func (aru *AuthRequestUpdate) SetConnectorData(b []byte) *AuthRequestUpdate {
-	aru.mutation.SetConnectorData(b)
-	return aru
+func (_u *AuthRequestUpdate) SetConnectorData(v []byte) *AuthRequestUpdate {
+	_u.mutation.SetConnectorData(v)
+	return _u
 }
 
 // ClearConnectorData clears the value of the "connector_data" field.
-func (aru *AuthRequestUpdate) ClearConnectorData() *AuthRequestUpdate {
-	aru.mutation.ClearConnectorData()
-	return aru
+func (_u *AuthRequestUpdate) ClearConnectorData() *AuthRequestUpdate {
+	_u.mutation.ClearConnectorData()
+	return _u
 }
 
 // SetExpiry sets the "expiry" field.
-func (aru *AuthRequestUpdate) SetExpiry(t time.Time) *AuthRequestUpdate {
-	aru.mutation.SetExpiry(t)
-	return aru
+func (_u *AuthRequestUpdate) SetExpiry(v time.Time) *AuthRequestUpdate {
+	_u.mutation.SetExpiry(v)
+	return _u
+}
+
+// SetNillableExpiry sets the "expiry" field if the given value is not nil.
+func (_u *AuthRequestUpdate) SetNillableExpiry(v *time.Time) *AuthRequestUpdate {
+	if v != nil {
+		_u.SetExpiry(*v)
+	}
+	return _u
 }
 
 // SetCodeChallenge sets the "code_challenge" field.
-func (aru *AuthRequestUpdate) SetCodeChallenge(s string) *AuthRequestUpdate {
-	aru.mutation.SetCodeChallenge(s)
-	return aru
+func (_u *AuthRequestUpdate) SetCodeChallenge(v string) *AuthRequestUpdate {
+	_u.mutation.SetCodeChallenge(v)
+	return _u
 }
 
 // SetNillableCodeChallenge sets the "code_challenge" field if the given value is not nil.
-func (aru *AuthRequestUpdate) SetNillableCodeChallenge(s *string) *AuthRequestUpdate {
-	if s != nil {
-		aru.SetCodeChallenge(*s)
+func (_u *AuthRequestUpdate) SetNillableCodeChallenge(v *string) *AuthRequestUpdate {
+	if v != nil {
+		_u.SetCodeChallenge(*v)
 	}
-	return aru
+	return _u
 }
 
 // SetCodeChallengeMethod sets the "code_challenge_method" field.
-func (aru *AuthRequestUpdate) SetCodeChallengeMethod(s string) *AuthRequestUpdate {
-	aru.mutation.SetCodeChallengeMethod(s)
-	return aru
+func (_u *AuthRequestUpdate) SetCodeChallengeMethod(v string) *AuthRequestUpdate {
+	_u.mutation.SetCodeChallengeMethod(v)
+	return _u
 }
 
 // SetNillableCodeChallengeMethod sets the "code_challenge_method" field if the given value is not nil.
-func (aru *AuthRequestUpdate) SetNillableCodeChallengeMethod(s *string) *AuthRequestUpdate {
-	if s != nil {
-		aru.SetCodeChallengeMethod(*s)
+func (_u *AuthRequestUpdate) SetNillableCodeChallengeMethod(v *string) *AuthRequestUpdate {
+	if v != nil {
+		_u.SetCodeChallengeMethod(*v)
+	}
+	return _u
+}
+
+// SetHmacKey sets the "hmac_key" field.
+func (_u *AuthRequestUpdate) SetHmacKey(v []byte) *AuthRequestUpdate {
+	_u.mutation.SetHmacKey(v)
+	return _u
+}
+
+// SetMfaValidated sets the "mfa_validated" field.
+func (_u *AuthRequestUpdate) SetMfaValidated(v bool) *AuthRequestUpdate {
+	_u.mutation.SetMfaValidated(v)
+	return _u
+}
+
+// SetNillableMfaValidated sets the "mfa_validated" field if the given value is not nil.
+func (_u *AuthRequestUpdate) SetNillableMfaValidated(v *bool) *AuthRequestUpdate {
+	if v != nil {
+		_u.SetMfaValidated(*v)
+	}
+	return _u
+}
+
+// SetWebauthnSessionData sets the "webauthn_session_data" field.
+func (_u *AuthRequestUpdate) SetWebauthnSessionData(v []byte) *AuthRequestUpdate {
+	_u.mutation.SetWebauthnSessionData(v)
+	return _u
+}
+
+// ClearWebauthnSessionData clears the value of the "webauthn_session_data" field.
+func (_u *AuthRequestUpdate) ClearWebauthnSessionData() *AuthRequestUpdate {
+	_u.mutation.ClearWebauthnSessionData()
+	return _u
+}
+
+// SetPrompt sets the "prompt" field.
+func (_u *AuthRequestUpdate) SetPrompt(v string) *AuthRequestUpdate {
+	_u.mutation.SetPrompt(v)
+	return _u
+}
+
+// SetNillablePrompt sets the "prompt" field if the given value is not nil.
+func (_u *AuthRequestUpdate) SetNillablePrompt(v *string) *AuthRequestUpdate {
+	if v != nil {
+		_u.SetPrompt(*v)
+	}
+	return _u
+}
+
+// SetMaxAge sets the "max_age" field.
+func (_u *AuthRequestUpdate) SetMaxAge(v int) *AuthRequestUpdate {
+	_u.mutation.ResetMaxAge()
+	_u.mutation.SetMaxAge(v)
+	return _u
+}
+
+// SetNillableMaxAge sets the "max_age" field if the given value is not nil.
+func (_u *AuthRequestUpdate) SetNillableMaxAge(v *int) *AuthRequestUpdate {
+	if v != nil {
+		_u.SetMaxAge(*v)
 	}
-	return aru
+	return _u
+}
+
+// AddMaxAge adds value to the "max_age" field.
+func (_u *AuthRequestUpdate) AddMaxAge(v int) *AuthRequestUpdate {
+	_u.mutation.AddMaxAge(v)
+	return _u
+}
+
+// SetAuthTime sets the "auth_time" field.
+func (_u *AuthRequestUpdate) SetAuthTime(v time.Time) *AuthRequestUpdate {
+	_u.mutation.SetAuthTime(v)
+	return _u
+}
+
+// SetNillableAuthTime sets the "auth_time" field if the given value is not nil.
+func (_u *AuthRequestUpdate) SetNillableAuthTime(v *time.Time) *AuthRequestUpdate {
+	if v != nil {
+		_u.SetAuthTime(*v)
+	}
+	return _u
+}
+
+// ClearAuthTime clears the value of the "auth_time" field.
+func (_u *AuthRequestUpdate) ClearAuthTime() *AuthRequestUpdate {
+	_u.mutation.ClearAuthTime()
+	return _u
 }
 
 // Mutation returns the AuthRequestMutation object of the builder.
-func (aru *AuthRequestUpdate) Mutation() *AuthRequestMutation {
-	return aru.mutation
+func (_u *AuthRequestUpdate) Mutation() *AuthRequestMutation {
+	return _u.mutation
 }
 
 // Save executes the query and returns the number of nodes affected by the update operation.
-func (aru *AuthRequestUpdate) Save(ctx context.Context) (int, error) {
-	var (
-		err      error
-		affected int
-	)
-	if len(aru.hooks) == 0 {
-		affected, err = aru.sqlSave(ctx)
-	} else {
-		var mut Mutator = MutateFunc(func(ctx context.Context, m Mutation) (Value, error) {
-			mutation, ok := m.(*AuthRequestMutation)
-			if !ok {
-				return nil, fmt.Errorf("unexpected mutation type %T", m)
-			}
-			aru.mutation = mutation
-			affected, err = aru.sqlSave(ctx)
-			mutation.done = true
-			return affected, err
-		})
-		for i := len(aru.hooks) - 1; i >= 0; i-- {
-			if aru.hooks[i] == nil {
-				return 0, fmt.Errorf("db: uninitialized hook (forgotten import db/runtime?)")
-			}
-			mut = aru.hooks[i](mut)
-		}
-		if _, err := mut.Mutate(ctx, aru.mutation); err != nil {
-			return 0, err
-		}
-	}
-	return affected, err
+func (_u *AuthRequestUpdate) Save(ctx context.Context) (int, error) {
+	return withHooks(ctx, _u.sqlSave, _u.mutation, _u.hooks)
 }
 
 // SaveX is like Save, but panics if an error occurs.
-func (aru *AuthRequestUpdate) SaveX(ctx context.Context) int {
-	affected, err := aru.Save(ctx)
+func (_u *AuthRequestUpdate) SaveX(ctx context.Context) int {
+	affected, err := _u.Save(ctx)
 	if err != nil {
 		panic(err)
 	}
@@ -237,194 +412,139 @@ func (aru *AuthRequestUpdate) SaveX(ctx context.Context) int {
 }
 
 // Exec executes the query.
-func (aru *AuthRequestUpdate) Exec(ctx context.Context) error {
-	_, err := aru.Save(ctx)
+func (_u *AuthRequestUpdate) Exec(ctx context.Context) error {
+	_, err := _u.Save(ctx)
 	return err
 }
 
 // ExecX is like Exec, but panics if an error occurs.
-func (aru *AuthRequestUpdate) ExecX(ctx context.Context) {
-	if err := aru.Exec(ctx); err != nil {
+func (_u *AuthRequestUpdate) ExecX(ctx context.Context) {
+	if err := _u.Exec(ctx); err != nil {
 		panic(err)
 	}
 }
 
-func (aru *AuthRequestUpdate) sqlSave(ctx context.Context) (n int, err error) {
-	_spec := &sqlgraph.UpdateSpec{
-		Node: &sqlgraph.NodeSpec{
-			Table:   authrequest.Table,
-			Columns: authrequest.Columns,
-			ID: &sqlgraph.FieldSpec{
-				Type:   field.TypeString,
-				Column: authrequest.FieldID,
-			},
-		},
-	}
-	if ps := aru.mutation.predicates; len(ps) > 0 {
+func (_u *AuthRequestUpdate) sqlSave(ctx context.Context) (_node int, err error) {
+	_spec := sqlgraph.NewUpdateSpec(authrequest.Table, authrequest.Columns, sqlgraph.NewFieldSpec(authrequest.FieldID, field.TypeString))
+	if ps := _u.mutation.predicates; len(ps) > 0 {
 		_spec.Predicate = func(selector *sql.Selector) {
 			for i := range ps {
 				ps[i](selector)
 			}
 		}
 	}
-	if value, ok := aru.mutation.ClientID(); ok {
-		_spec.Fields.Set = append(_spec.Fields.Set, &sqlgraph.FieldSpec{
-			Type:   field.TypeString,
-			Value:  value,
-			Column: authrequest.FieldClientID,
-		})
+	if value, ok := _u.mutation.ClientID(); ok {
+		_spec.SetField(authrequest.FieldClientID, field.TypeString, value)
 	}
-	if value, ok := aru.mutation.Scopes(); ok {
-		_spec.Fields.Set = append(_spec.Fields.Set, &sqlgraph.FieldSpec{
-			Type:   field.TypeJSON,
-			Value:  value,
-			Column: authrequest.FieldScopes,
-		})
+	if value, ok := _u.mutation.Scopes(); ok {
+		_spec.SetField(authrequest.FieldScopes, field.TypeJSON, value)
 	}
-	if aru.mutation.ScopesCleared() {
-		_spec.Fields.Clear = append(_spec.Fields.Clear, &sqlgraph.FieldSpec{
-			Type:   field.TypeJSON,
-			Column: authrequest.FieldScopes,
+	if value, ok := _u.mutation.AppendedScopes(); ok {
+		_spec.AddModifier(func(u *sql.UpdateBuilder) {
+			sqljson.Append(u, authrequest.FieldScopes, value)
 		})
 	}
-	if value, ok := aru.mutation.ResponseTypes(); ok {
-		_spec.Fields.Set = append(_spec.Fields.Set, &sqlgraph.FieldSpec{
-			Type:   field.TypeJSON,
-			Value:  value,
-			Column: authrequest.FieldResponseTypes,
-		})
+	if _u.mutation.ScopesCleared() {
+		_spec.ClearField(authrequest.FieldScopes, field.TypeJSON)
 	}
-	if aru.mutation.ResponseTypesCleared() {
-		_spec.Fields.Clear = append(_spec.Fields.Clear, &sqlgraph.FieldSpec{
-			Type:   field.TypeJSON,
-			Column: authrequest.FieldResponseTypes,
-		})
+	if value, ok := _u.mutation.ResponseTypes(); ok {
+		_spec.SetField(authrequest.FieldResponseTypes, field.TypeJSON, value)
 	}
-	if value, ok := aru.mutation.RedirectURI(); ok {
-		_spec.Fields.Set = append(_spec.Fields.Set, &sqlgraph.FieldSpec{
-			Type:   field.TypeString,
-			Value:  value,
-			Column: authrequest.FieldRedirectURI,
+	if value, ok := _u.mutation.AppendedResponseTypes(); ok {
+		_spec.AddModifier(func(u *sql.UpdateBuilder) {
+			sqljson.Append(u, authrequest.FieldResponseTypes, value)
 		})
 	}
-	if value, ok := aru.mutation.Nonce(); ok {
-		_spec.Fields.Set = append(_spec.Fields.Set, &sqlgraph.FieldSpec{
-			Type:   field.TypeString,
-			Value:  value,
-			Column: authrequest.FieldNonce,
-		})
+	if _u.mutation.ResponseTypesCleared() {
+		_spec.ClearField(authrequest.FieldResponseTypes, field.TypeJSON)
 	}
-	if value, ok := aru.mutation.State(); ok {
-		_spec.Fields.Set = append(_spec.Fields.Set, &sqlgraph.FieldSpec{
-			Type:   field.TypeString,
-			Value:  value,
-			Column: authrequest.FieldState,
-		})
+	if value, ok := _u.mutation.RedirectURI(); ok {
+		_spec.SetField(authrequest.FieldRedirectURI, field.TypeString, value)
 	}
-	if value, ok := aru.mutation.ForceApprovalPrompt(); ok {
-		_spec.Fields.Set = append(_spec.Fields.Set, &sqlgraph.FieldSpec{
-			Type:   field.TypeBool,
-			Value:  value,
-			Column: authrequest.FieldForceApprovalPrompt,
-		})
+	if value, ok := _u.mutation.Nonce(); ok {
+		_spec.SetField(authrequest.FieldNonce, field.TypeString, value)
 	}
-	if value, ok := aru.mutation.LoggedIn(); ok {
-		_spec.Fields.Set = append(_spec.Fields.Set, &sqlgraph.FieldSpec{
-			Type:   field.TypeBool,
-			Value:  value,
-			Column: authrequest.FieldLoggedIn,
-		})
+	if value, ok := _u.mutation.State(); ok {
+		_spec.SetField(authrequest.FieldState, field.TypeString, value)
 	}
-	if value, ok := aru.mutation.ClaimsUserID(); ok {
-		_spec.Fields.Set = append(_spec.Fields.Set, &sqlgraph.FieldSpec{
-			Type:   field.TypeString,
-			Value:  value,
-			Column: authrequest.FieldClaimsUserID,
-		})
+	if value, ok := _u.mutation.ForceApprovalPrompt(); ok {
+		_spec.SetField(authrequest.FieldForceApprovalPrompt, field.TypeBool, value)
 	}
-	if value, ok := aru.mutation.ClaimsUsername(); ok {
-		_spec.Fields.Set = append(_spec.Fields.Set, &sqlgraph.FieldSpec{
-			Type:   field.TypeString,
-			Value:  value,
-			Column: authrequest.FieldClaimsUsername,
-		})
+	if value, ok := _u.mutation.LoggedIn(); ok {
+		_spec.SetField(authrequest.FieldLoggedIn, field.TypeBool, value)
 	}
-	if value, ok := aru.mutation.ClaimsEmail(); ok {
-		_spec.Fields.Set = append(_spec.Fields.Set, &sqlgraph.FieldSpec{
-			Type:   field.TypeString,
-			Value:  value,
-			Column: authrequest.FieldClaimsEmail,
-		})
+	if value, ok := _u.mutation.ClaimsUserID(); ok {
+		_spec.SetField(authrequest.FieldClaimsUserID, field.TypeString, value)
 	}
-	if value, ok := aru.mutation.ClaimsEmailVerified(); ok {
-		_spec.Fields.Set = append(_spec.Fields.Set, &sqlgraph.FieldSpec{
-			Type:   field.TypeBool,
-			Value:  value,
-			Column: authrequest.FieldClaimsEmailVerified,
-		})
+	if value, ok := _u.mutation.ClaimsUsername(); ok {
+		_spec.SetField(authrequest.FieldClaimsUsername, field.TypeString, value)
 	}
-	if value, ok := aru.mutation.ClaimsGroups(); ok {
-		_spec.Fields.Set = append(_spec.Fields.Set, &sqlgraph.FieldSpec{
-			Type:   field.TypeJSON,
-			Value:  value,
-			Column: authrequest.FieldClaimsGroups,
-		})
+	if value, ok := _u.mutation.ClaimsEmail(); ok {
+		_spec.SetField(authrequest.FieldClaimsEmail, field.TypeString, value)
 	}
-	if aru.mutation.ClaimsGroupsCleared() {
-		_spec.Fields.Clear = append(_spec.Fields.Clear, &sqlgraph.FieldSpec{
-			Type:   field.TypeJSON,
-			Column: authrequest.FieldClaimsGroups,
-		})
+	if value, ok := _u.mutation.ClaimsEmailVerified(); ok {
+		_spec.SetField(authrequest.FieldClaimsEmailVerified, field.TypeBool, value)
 	}
-	if value, ok := aru.mutation.ClaimsPreferredUsername(); ok {
-		_spec.Fields.Set = append(_spec.Fields.Set, &sqlgraph.FieldSpec{
-			Type:   field.TypeString,
-			Value:  value,
-			Column: authrequest.FieldClaimsPreferredUsername,
-		})
+	if value, ok := _u.mutation.ClaimsGroups(); ok {
+		_spec.SetField(authrequest.FieldClaimsGroups, field.TypeJSON, value)
 	}
-	if value, ok := aru.mutation.ConnectorID(); ok {
-		_spec.Fields.Set = append(_spec.Fields.Set, &sqlgraph.FieldSpec{
-			Type:   field.TypeString,
-			Value:  value,
-			Column: authrequest.FieldConnectorID,
+	if value, ok := _u.mutation.AppendedClaimsGroups(); ok {
+		_spec.AddModifier(func(u *sql.UpdateBuilder) {
+			sqljson.Append(u, authrequest.FieldClaimsGroups, value)
 		})
 	}
-	if value, ok := aru.mutation.ConnectorData(); ok {
-		_spec.Fields.Set = append(_spec.Fields.Set, &sqlgraph.FieldSpec{
-			Type:   field.TypeBytes,
-			Value:  value,
-			Column: authrequest.FieldConnectorData,
-		})
+	if _u.mutation.ClaimsGroupsCleared() {
+		_spec.ClearField(authrequest.FieldClaimsGroups, field.TypeJSON)
 	}
-	if aru.mutation.ConnectorDataCleared() {
-		_spec.Fields.Clear = append(_spec.Fields.Clear, &sqlgraph.FieldSpec{
-			Type:   field.TypeBytes,
-			Column: authrequest.FieldConnectorData,
-		})
+	if value, ok := _u.mutation.ClaimsPreferredUsername(); ok {
+		_spec.SetField(authrequest.FieldClaimsPreferredUsername, field.TypeString, value)
 	}
-	if value, ok := aru.mutation.Expiry(); ok {
-		_spec.Fields.Set = append(_spec.Fields.Set, &sqlgraph.FieldSpec{
-			Type:   field.TypeTime,
-			Value:  value,
-			Column: authrequest.FieldExpiry,
-		})
+	if value, ok := _u.mutation.ConnectorID(); ok {
+		_spec.SetField(authrequest.FieldConnectorID, field.TypeString, value)
 	}
-	if value, ok := aru.mutation.CodeChallenge(); ok {
-		_spec.Fields.Set = append(_spec.Fields.Set, &sqlgraph.FieldSpec{
-			Type:   field.TypeString,
-			Value:  value,
-			Column: authrequest.FieldCodeChallenge,
-		})
+	if value, ok := _u.mutation.ConnectorData(); ok {
+		_spec.SetField(authrequest.FieldConnectorData, field.TypeBytes, value)
 	}
-	if value, ok := aru.mutation.CodeChallengeMethod(); ok {
-		_spec.Fields.Set = append(_spec.Fields.Set, &sqlgraph.FieldSpec{
-			Type:   field.TypeString,
-			Value:  value,
-			Column: authrequest.FieldCodeChallengeMethod,
-		})
+	if _u.mutation.ConnectorDataCleared() {
+		_spec.ClearField(authrequest.FieldConnectorData, field.TypeBytes)
+	}
+	if value, ok := _u.mutation.Expiry(); ok {
+		_spec.SetField(authrequest.FieldExpiry, field.TypeTime, value)
 	}
-	if n, err = sqlgraph.UpdateNodes(ctx, aru.driver, _spec); err != nil {
+	if value, ok := _u.mutation.CodeChallenge(); ok {
+		_spec.SetField(authrequest.FieldCodeChallenge, field.TypeString, value)
+	}
+	if value, ok := _u.mutation.CodeChallengeMethod(); ok {
+		_spec.SetField(authrequest.FieldCodeChallengeMethod, field.TypeString, value)
+	}
+	if value, ok := _u.mutation.HmacKey(); ok {
+		_spec.SetField(authrequest.FieldHmacKey, field.TypeBytes, value)
+	}
+	if value, ok := _u.mutation.MfaValidated(); ok {
+		_spec.SetField(authrequest.FieldMfaValidated, field.TypeBool, value)
+	}
+	if value, ok := _u.mutation.WebauthnSessionData(); ok {
+		_spec.SetField(authrequest.FieldWebauthnSessionData, field.TypeBytes, value)
+	}
+	if _u.mutation.WebauthnSessionDataCleared() {
+		_spec.ClearField(authrequest.FieldWebauthnSessionData, field.TypeBytes)
+	}
+	if value, ok := _u.mutation.Prompt(); ok {
+		_spec.SetField(authrequest.FieldPrompt, field.TypeString, value)
+	}
+	if value, ok := _u.mutation.MaxAge(); ok {
+		_spec.SetField(authrequest.FieldMaxAge, field.TypeInt, value)
+	}
+	if value, ok := _u.mutation.AddedMaxAge(); ok {
+		_spec.AddField(authrequest.FieldMaxAge, field.TypeInt, value)
+	}
+	if value, ok := _u.mutation.AuthTime(); ok {
+		_spec.SetField(authrequest.FieldAuthTime, field.TypeTime, value)
+	}
+	if _u.mutation.AuthTimeCleared() {
+		_spec.ClearField(authrequest.FieldAuthTime, field.TypeTime)
+	}
+	if _node, err = sqlgraph.UpdateNodes(ctx, _u.driver, _spec); err != nil {
 		if _, ok := err.(*sqlgraph.NotFoundError); ok {
 			err = &NotFoundError{authrequest.Label}
 		} else if sqlgraph.IsConstraintError(err) {
@@ -432,7 +552,8 @@ func (aru *AuthRequestUpdate) sqlSave(ctx context.Context) (n int, err error) {
 		}
 		return 0, err
 	}
-	return n, nil
+	_u.mutation.done = true
+	return _node, nil
 }
 
 // AuthRequestUpdateOne is the builder for updating a single AuthRequest entity.
@@ -444,220 +565,394 @@ type AuthRequestUpdateOne struct {
 }
 
 // SetClientID sets the "client_id" field.
-func (aruo *AuthRequestUpdateOne) SetClientID(s string) *AuthRequestUpdateOne {
-	aruo.mutation.SetClientID(s)
-	return aruo
+func (_u *AuthRequestUpdateOne) SetClientID(v string) *AuthRequestUpdateOne {
+	_u.mutation.SetClientID(v)
+	return _u
+}
+
+// SetNillableClientID sets the "client_id" field if the given value is not nil.
+func (_u *AuthRequestUpdateOne) SetNillableClientID(v *string) *AuthRequestUpdateOne {
+	if v != nil {
+		_u.SetClientID(*v)
+	}
+	return _u
 }
 
 // SetScopes sets the "scopes" field.
-func (aruo *AuthRequestUpdateOne) SetScopes(s []string) *AuthRequestUpdateOne {
-	aruo.mutation.SetScopes(s)
-	return aruo
+func (_u *AuthRequestUpdateOne) SetScopes(v []string) *AuthRequestUpdateOne {
+	_u.mutation.SetScopes(v)
+	return _u
+}
+
+// AppendScopes appends value to the "scopes" field.
+func (_u *AuthRequestUpdateOne) AppendScopes(v []string) *AuthRequestUpdateOne {
+	_u.mutation.AppendScopes(v)
+	return _u
 }
 
 // ClearScopes clears the value of the "scopes" field.
-func (aruo *AuthRequestUpdateOne) ClearScopes() *AuthRequestUpdateOne {
-	aruo.mutation.ClearScopes()
-	return aruo
+func (_u *AuthRequestUpdateOne) ClearScopes() *AuthRequestUpdateOne {
+	_u.mutation.ClearScopes()
+	return _u
 }
 
 // SetResponseTypes sets the "response_types" field.
-func (aruo *AuthRequestUpdateOne) SetResponseTypes(s []string) *AuthRequestUpdateOne {
-	aruo.mutation.SetResponseTypes(s)
-	return aruo
+func (_u *AuthRequestUpdateOne) SetResponseTypes(v []string) *AuthRequestUpdateOne {
+	_u.mutation.SetResponseTypes(v)
+	return _u
+}
+
+// AppendResponseTypes appends value to the "response_types" field.
+func (_u *AuthRequestUpdateOne) AppendResponseTypes(v []string) *AuthRequestUpdateOne {
+	_u.mutation.AppendResponseTypes(v)
+	return _u
 }
 
 // ClearResponseTypes clears the value of the "response_types" field.
-func (aruo *AuthRequestUpdateOne) ClearResponseTypes() *AuthRequestUpdateOne {
-	aruo.mutation.ClearResponseTypes()
-	return aruo
+func (_u *AuthRequestUpdateOne) ClearResponseTypes() *AuthRequestUpdateOne {
+	_u.mutation.ClearResponseTypes()
+	return _u
 }
 
 // SetRedirectURI sets the "redirect_uri" field.
-func (aruo *AuthRequestUpdateOne) SetRedirectURI(s string) *AuthRequestUpdateOne {
-	aruo.mutation.SetRedirectURI(s)
-	return aruo
+func (_u *AuthRequestUpdateOne) SetRedirectURI(v string) *AuthRequestUpdateOne {
+	_u.mutation.SetRedirectURI(v)
+	return _u
+}
+
+// SetNillableRedirectURI sets the "redirect_uri" field if the given value is not nil.
+func (_u *AuthRequestUpdateOne) SetNillableRedirectURI(v *string) *AuthRequestUpdateOne {
+	if v != nil {
+		_u.SetRedirectURI(*v)
+	}
+	return _u
 }
 
 // SetNonce sets the "nonce" field.
-func (aruo *AuthRequestUpdateOne) SetNonce(s string) *AuthRequestUpdateOne {
-	aruo.mutation.SetNonce(s)
-	return aruo
+func (_u *AuthRequestUpdateOne) SetNonce(v string) *AuthRequestUpdateOne {
+	_u.mutation.SetNonce(v)
+	return _u
+}
+
+// SetNillableNonce sets the "nonce" field if the given value is not nil.
+func (_u *AuthRequestUpdateOne) SetNillableNonce(v *string) *AuthRequestUpdateOne {
+	if v != nil {
+		_u.SetNonce(*v)
+	}
+	return _u
 }
 
 // SetState sets the "state" field.
-func (aruo *AuthRequestUpdateOne) SetState(s string) *AuthRequestUpdateOne {
-	aruo.mutation.SetState(s)
-	return aruo
+func (_u *AuthRequestUpdateOne) SetState(v string) *AuthRequestUpdateOne {
+	_u.mutation.SetState(v)
+	return _u
+}
+
+// SetNillableState sets the "state" field if the given value is not nil.
+func (_u *AuthRequestUpdateOne) SetNillableState(v *string) *AuthRequestUpdateOne {
+	if v != nil {
+		_u.SetState(*v)
+	}
+	return _u
 }
 
 // SetForceApprovalPrompt sets the "force_approval_prompt" field.
-func (aruo *AuthRequestUpdateOne) SetForceApprovalPrompt(b bool) *AuthRequestUpdateOne {
-	aruo.mutation.SetForceApprovalPrompt(b)
-	return aruo
+func (_u *AuthRequestUpdateOne) SetForceApprovalPrompt(v bool) *AuthRequestUpdateOne {
+	_u.mutation.SetForceApprovalPrompt(v)
+	return _u
+}
+
+// SetNillableForceApprovalPrompt sets the "force_approval_prompt" field if the given value is not nil.
+func (_u *AuthRequestUpdateOne) SetNillableForceApprovalPrompt(v *bool) *AuthRequestUpdateOne {
+	if v != nil {
+		_u.SetForceApprovalPrompt(*v)
+	}
+	return _u
 }
 
 // SetLoggedIn sets the "logged_in" field.
-func (aruo *AuthRequestUpdateOne) SetLoggedIn(b bool) *AuthRequestUpdateOne {
-	aruo.mutation.SetLoggedIn(b)
-	return aruo
+func (_u *AuthRequestUpdateOne) SetLoggedIn(v bool) *AuthRequestUpdateOne {
+	_u.mutation.SetLoggedIn(v)
+	return _u
+}
+
+// SetNillableLoggedIn sets the "logged_in" field if the given value is not nil.
+func (_u *AuthRequestUpdateOne) SetNillableLoggedIn(v *bool) *AuthRequestUpdateOne {
+	if v != nil {
+		_u.SetLoggedIn(*v)
+	}
+	return _u
 }
 
 // SetClaimsUserID sets the "claims_user_id" field.
-func (aruo *AuthRequestUpdateOne) SetClaimsUserID(s string) *AuthRequestUpdateOne {
-	aruo.mutation.SetClaimsUserID(s)
-	return aruo
+func (_u *AuthRequestUpdateOne) SetClaimsUserID(v string) *AuthRequestUpdateOne {
+	_u.mutation.SetClaimsUserID(v)
+	return _u
+}
+
+// SetNillableClaimsUserID sets the "claims_user_id" field if the given value is not nil.
+func (_u *AuthRequestUpdateOne) SetNillableClaimsUserID(v *string) *AuthRequestUpdateOne {
+	if v != nil {
+		_u.SetClaimsUserID(*v)
+	}
+	return _u
 }
 
 // SetClaimsUsername sets the "claims_username" field.
-func (aruo *AuthRequestUpdateOne) SetClaimsUsername(s string) *AuthRequestUpdateOne {
-	aruo.mutation.SetClaimsUsername(s)
-	return aruo
+func (_u *AuthRequestUpdateOne) SetClaimsUsername(v string) *AuthRequestUpdateOne {
+	_u.mutation.SetClaimsUsername(v)
+	return _u
+}
+
+// SetNillableClaimsUsername sets the "claims_username" field if the given value is not nil.
+func (_u *AuthRequestUpdateOne) SetNillableClaimsUsername(v *string) *AuthRequestUpdateOne {
+	if v != nil {
+		_u.SetClaimsUsername(*v)
+	}
+	return _u
 }
 
 // SetClaimsEmail sets the "claims_email" field.
-func (aruo *AuthRequestUpdateOne) SetClaimsEmail(s string) *AuthRequestUpdateOne {
-	aruo.mutation.SetClaimsEmail(s)
-	return aruo
+func (_u *AuthRequestUpdateOne) SetClaimsEmail(v string) *AuthRequestUpdateOne {
+	_u.mutation.SetClaimsEmail(v)
+	return _u
+}
+
+// SetNillableClaimsEmail sets the "claims_email" field if the given value is not nil.
+func (_u *AuthRequestUpdateOne) SetNillableClaimsEmail(v *string) *AuthRequestUpdateOne {
+	if v != nil {
+		_u.SetClaimsEmail(*v)
+	}
+	return _u
 }
 
 // SetClaimsEmailVerified sets the "claims_email_verified" field.
-func (aruo *AuthRequestUpdateOne) SetClaimsEmailVerified(b bool) *AuthRequestUpdateOne {
-	aruo.mutation.SetClaimsEmailVerified(b)
-	return aruo
+func (_u *AuthRequestUpdateOne) SetClaimsEmailVerified(v bool) *AuthRequestUpdateOne {
+	_u.mutation.SetClaimsEmailVerified(v)
+	return _u
+}
+
+// SetNillableClaimsEmailVerified sets the "claims_email_verified" field if the given value is not nil.
+func (_u *AuthRequestUpdateOne) SetNillableClaimsEmailVerified(v *bool) *AuthRequestUpdateOne {
+	if v != nil {
+		_u.SetClaimsEmailVerified(*v)
+	}
+	return _u
 }
 
 // SetClaimsGroups sets the "claims_groups" field.
-func (aruo *AuthRequestUpdateOne) SetClaimsGroups(s []string) *AuthRequestUpdateOne {
-	aruo.mutation.SetClaimsGroups(s)
-	return aruo
+func (_u *AuthRequestUpdateOne) SetClaimsGroups(v []string) *AuthRequestUpdateOne {
+	_u.mutation.SetClaimsGroups(v)
+	return _u
+}
+
+// AppendClaimsGroups appends value to the "claims_groups" field.
+func (_u *AuthRequestUpdateOne) AppendClaimsGroups(v []string) *AuthRequestUpdateOne {
+	_u.mutation.AppendClaimsGroups(v)
+	return _u
 }
 
 // ClearClaimsGroups clears the value of the "claims_groups" field.
-func (aruo *AuthRequestUpdateOne) ClearClaimsGroups() *AuthRequestUpdateOne {
-	aruo.mutation.ClearClaimsGroups()
-	return aruo
+func (_u *AuthRequestUpdateOne) ClearClaimsGroups() *AuthRequestUpdateOne {
+	_u.mutation.ClearClaimsGroups()
+	return _u
 }
 
 // SetClaimsPreferredUsername sets the "claims_preferred_username" field.
-func (aruo *AuthRequestUpdateOne) SetClaimsPreferredUsername(s string) *AuthRequestUpdateOne {
-	aruo.mutation.SetClaimsPreferredUsername(s)
-	return aruo
+func (_u *AuthRequestUpdateOne) SetClaimsPreferredUsername(v string) *AuthRequestUpdateOne {
+	_u.mutation.SetClaimsPreferredUsername(v)
+	return _u
 }
 
 // SetNillableClaimsPreferredUsername sets the "claims_preferred_username" field if the given value is not nil.
-func (aruo *AuthRequestUpdateOne) SetNillableClaimsPreferredUsername(s *string) *AuthRequestUpdateOne {
-	if s != nil {
-		aruo.SetClaimsPreferredUsername(*s)
+func (_u *AuthRequestUpdateOne) SetNillableClaimsPreferredUsername(v *string) *AuthRequestUpdateOne {
+	if v != nil {
+		_u.SetClaimsPreferredUsername(*v)
 	}
-	return aruo
+	return _u
 }
 
 // SetConnectorID sets the "connector_id" field.
-func (aruo *AuthRequestUpdateOne) SetConnectorID(s string) *AuthRequestUpdateOne {
-	aruo.mutation.SetConnectorID(s)
-	return aruo
+func (_u *AuthRequestUpdateOne) SetConnectorID(v string) *AuthRequestUpdateOne {
+	_u.mutation.SetConnectorID(v)
+	return _u
+}
+
+// SetNillableConnectorID sets the "connector_id" field if the given value is not nil.
+func (_u *AuthRequestUpdateOne) SetNillableConnectorID(v *string) *AuthRequestUpdateOne {
+	if v != nil {
+		_u.SetConnectorID(*v)
+	}
+	return _u
 }
 
 // SetConnectorData sets the "connector_data" field.
-func (aruo *AuthRequestUpdateOne) SetConnectorData(b []byte) *AuthRequestUpdateOne {
-	aruo.mutation.SetConnectorData(b)
-	return aruo
+func (_u *AuthRequestUpdateOne) SetConnectorData(v []byte) *AuthRequestUpdateOne {
+	_u.mutation.SetConnectorData(v)
+	return _u
 }
 
 // ClearConnectorData clears the value of the "connector_data" field.
-func (aruo *AuthRequestUpdateOne) ClearConnectorData() *AuthRequestUpdateOne {
-	aruo.mutation.ClearConnectorData()
-	return aruo
+func (_u *AuthRequestUpdateOne) ClearConnectorData() *AuthRequestUpdateOne {
+	_u.mutation.ClearConnectorData()
+	return _u
 }
 
 // SetExpiry sets the "expiry" field.
-func (aruo *AuthRequestUpdateOne) SetExpiry(t time.Time) *AuthRequestUpdateOne {
-	aruo.mutation.SetExpiry(t)
-	return aruo
+func (_u *AuthRequestUpdateOne) SetExpiry(v time.Time) *AuthRequestUpdateOne {
+	_u.mutation.SetExpiry(v)
+	return _u
+}
+
+// SetNillableExpiry sets the "expiry" field if the given value is not nil.
+func (_u *AuthRequestUpdateOne) SetNillableExpiry(v *time.Time) *AuthRequestUpdateOne {
+	if v != nil {
+		_u.SetExpiry(*v)
+	}
+	return _u
 }
 
 // SetCodeChallenge sets the "code_challenge" field.
-func (aruo *AuthRequestUpdateOne) SetCodeChallenge(s string) *AuthRequestUpdateOne {
-	aruo.mutation.SetCodeChallenge(s)
-	return aruo
+func (_u *AuthRequestUpdateOne) SetCodeChallenge(v string) *AuthRequestUpdateOne {
+	_u.mutation.SetCodeChallenge(v)
+	return _u
 }
 
 // SetNillableCodeChallenge sets the "code_challenge" field if the given value is not nil.
-func (aruo *AuthRequestUpdateOne) SetNillableCodeChallenge(s *string) *AuthRequestUpdateOne {
-	if s != nil {
-		aruo.SetCodeChallenge(*s)
+func (_u *AuthRequestUpdateOne) SetNillableCodeChallenge(v *string) *AuthRequestUpdateOne {
+	if v != nil {
+		_u.SetCodeChallenge(*v)
 	}
-	return aruo
+	return _u
 }
 
 // SetCodeChallengeMethod sets the "code_challenge_method" field.
-func (aruo *AuthRequestUpdateOne) SetCodeChallengeMethod(s string) *AuthRequestUpdateOne {
-	aruo.mutation.SetCodeChallengeMethod(s)
-	return aruo
+func (_u *AuthRequestUpdateOne) SetCodeChallengeMethod(v string) *AuthRequestUpdateOne {
+	_u.mutation.SetCodeChallengeMethod(v)
+	return _u
 }
 
 // SetNillableCodeChallengeMethod sets the "code_challenge_method" field if the given value is not nil.
-func (aruo *AuthRequestUpdateOne) SetNillableCodeChallengeMethod(s *string) *AuthRequestUpdateOne {
-	if s != nil {
-		aruo.SetCodeChallengeMethod(*s)
+func (_u *AuthRequestUpdateOne) SetNillableCodeChallengeMethod(v *string) *AuthRequestUpdateOne {
+	if v != nil {
+		_u.SetCodeChallengeMethod(*v)
+	}
+	return _u
+}
+
+// SetHmacKey sets the "hmac_key" field.
+func (_u *AuthRequestUpdateOne) SetHmacKey(v []byte) *AuthRequestUpdateOne {
+	_u.mutation.SetHmacKey(v)
+	return _u
+}
+
+// SetMfaValidated sets the "mfa_validated" field.
+func (_u *AuthRequestUpdateOne) SetMfaValidated(v bool) *AuthRequestUpdateOne {
+	_u.mutation.SetMfaValidated(v)
+	return _u
+}
+
+// SetNillableMfaValidated sets the "mfa_validated" field if the given value is not nil.
+func (_u *AuthRequestUpdateOne) SetNillableMfaValidated(v *bool) *AuthRequestUpdateOne {
+	if v != nil {
+		_u.SetMfaValidated(*v)
+	}
+	return _u
+}
+
+// SetWebauthnSessionData sets the "webauthn_session_data" field.
+func (_u *AuthRequestUpdateOne) SetWebauthnSessionData(v []byte) *AuthRequestUpdateOne {
+	_u.mutation.SetWebauthnSessionData(v)
+	return _u
+}
+
+// ClearWebauthnSessionData clears the value of the "webauthn_session_data" field.
+func (_u *AuthRequestUpdateOne) ClearWebauthnSessionData() *AuthRequestUpdateOne {
+	_u.mutation.ClearWebauthnSessionData()
+	return _u
+}
+
+// SetPrompt sets the "prompt" field.
+func (_u *AuthRequestUpdateOne) SetPrompt(v string) *AuthRequestUpdateOne {
+	_u.mutation.SetPrompt(v)
+	return _u
+}
+
+// SetNillablePrompt sets the "prompt" field if the given value is not nil.
+func (_u *AuthRequestUpdateOne) SetNillablePrompt(v *string) *AuthRequestUpdateOne {
+	if v != nil {
+		_u.SetPrompt(*v)
 	}
-	return aruo
+	return _u
+}
+
+// SetMaxAge sets the "max_age" field.
+func (_u *AuthRequestUpdateOne) SetMaxAge(v int) *AuthRequestUpdateOne {
+	_u.mutation.ResetMaxAge()
+	_u.mutation.SetMaxAge(v)
+	return _u
+}
+
+// SetNillableMaxAge sets the "max_age" field if the given value is not nil.
+func (_u *AuthRequestUpdateOne) SetNillableMaxAge(v *int) *AuthRequestUpdateOne {
+	if v != nil {
+		_u.SetMaxAge(*v)
+	}
+	return _u
+}
+
+// AddMaxAge adds value to the "max_age" field.
+func (_u *AuthRequestUpdateOne) AddMaxAge(v int) *AuthRequestUpdateOne {
+	_u.mutation.AddMaxAge(v)
+	return _u
+}
+
+// SetAuthTime sets the "auth_time" field.
+func (_u *AuthRequestUpdateOne) SetAuthTime(v time.Time) *AuthRequestUpdateOne {
+	_u.mutation.SetAuthTime(v)
+	return _u
+}
+
+// SetNillableAuthTime sets the "auth_time" field if the given value is not nil.
+func (_u *AuthRequestUpdateOne) SetNillableAuthTime(v *time.Time) *AuthRequestUpdateOne {
+	if v != nil {
+		_u.SetAuthTime(*v)
+	}
+	return _u
+}
+
+// ClearAuthTime clears the value of the "auth_time" field.
+func (_u *AuthRequestUpdateOne) ClearAuthTime() *AuthRequestUpdateOne {
+	_u.mutation.ClearAuthTime()
+	return _u
 }
 
 // Mutation returns the AuthRequestMutation object of the builder.
-func (aruo *AuthRequestUpdateOne) Mutation() *AuthRequestMutation {
-	return aruo.mutation
+func (_u *AuthRequestUpdateOne) Mutation() *AuthRequestMutation {
+	return _u.mutation
+}
+
+// Where appends a list predicates to the AuthRequestUpdate builder.
+func (_u *AuthRequestUpdateOne) Where(ps ...predicate.AuthRequest) *AuthRequestUpdateOne {
+	_u.mutation.Where(ps...)
+	return _u
 }
 
 // Select allows selecting one or more fields (columns) of the returned entity.
 // The default is selecting all fields defined in the entity schema.
-func (aruo *AuthRequestUpdateOne) Select(field string, fields ...string) *AuthRequestUpdateOne {
-	aruo.fields = append([]string{field}, fields...)
-	return aruo
+func (_u *AuthRequestUpdateOne) Select(field string, fields ...string) *AuthRequestUpdateOne {
+	_u.fields = append([]string{field}, fields...)
+	return _u
 }
 
 // Save executes the query and returns the updated AuthRequest entity.
-func (aruo *AuthRequestUpdateOne) Save(ctx context.Context) (*AuthRequest, error) {
-	var (
-		err  error
-		node *AuthRequest
-	)
-	if len(aruo.hooks) == 0 {
-		node, err = aruo.sqlSave(ctx)
-	} else {
-		var mut Mutator = MutateFunc(func(ctx context.Context, m Mutation) (Value, error) {
-			mutation, ok := m.(*AuthRequestMutation)
-			if !ok {
-				return nil, fmt.Errorf("unexpected mutation type %T", m)
-			}
-			aruo.mutation = mutation
-			node, err = aruo.sqlSave(ctx)
-			mutation.done = true
-			return node, err
-		})
-		for i := len(aruo.hooks) - 1; i >= 0; i-- {
-			if aruo.hooks[i] == nil {
-				return nil, fmt.Errorf("db: uninitialized hook (forgotten import db/runtime?)")
-			}
-			mut = aruo.hooks[i](mut)
-		}
-		v, err := mut.Mutate(ctx, aruo.mutation)
-		if err != nil {
-			return nil, err
-		}
-		nv, ok := v.(*AuthRequest)
-		if !ok {
-			return nil, fmt.Errorf("unexpected node type %T returned from AuthRequestMutation", v)
-		}
-		node = nv
-	}
-	return node, err
+func (_u *AuthRequestUpdateOne) Save(ctx context.Context) (*AuthRequest, error) {
+	return withHooks(ctx, _u.sqlSave, _u.mutation, _u.hooks)
 }
 
 // SaveX is like Save, but panics if an error occurs.
-func (aruo *AuthRequestUpdateOne) SaveX(ctx context.Context) *AuthRequest {
-	node, err := aruo.Save(ctx)
+func (_u *AuthRequestUpdateOne) SaveX(ctx context.Context) *AuthRequest {
+	node, err := _u.Save(ctx)
 	if err != nil {
 		panic(err)
 	}
@@ -665,35 +960,26 @@ func (aruo *AuthRequestUpdateOne) SaveX(ctx context.Context) *AuthRequest {
 }
 
 // Exec executes the query on the entity.
-func (aruo *AuthRequestUpdateOne) Exec(ctx context.Context) error {
-	_, err := aruo.Save(ctx)
+func (_u *AuthRequestUpdateOne) Exec(ctx context.Context) error {
+	_, err := _u.Save(ctx)
 	return err
 }
 
 // ExecX is like Exec, but panics if an error occurs.
-func (aruo *AuthRequestUpdateOne) ExecX(ctx context.Context) {
-	if err := aruo.Exec(ctx); err != nil {
+func (_u *AuthRequestUpdateOne) ExecX(ctx context.Context) {
+	if err := _u.Exec(ctx); err != nil {
 		panic(err)
 	}
 }
 
-func (aruo *AuthRequestUpdateOne) sqlSave(ctx context.Context) (_node *AuthRequest, err error) {
-	_spec := &sqlgraph.UpdateSpec{
-		Node: &sqlgraph.NodeSpec{
-			Table:   authrequest.Table,
-			Columns: authrequest.Columns,
-			ID: &sqlgraph.FieldSpec{
-				Type:   field.TypeString,
-				Column: authrequest.FieldID,
-			},
-		},
-	}
-	id, ok := aruo.mutation.ID()
+func (_u *AuthRequestUpdateOne) sqlSave(ctx context.Context) (_node *AuthRequest, err error) {
+	_spec := sqlgraph.NewUpdateSpec(authrequest.Table, authrequest.Columns, sqlgraph.NewFieldSpec(authrequest.FieldID, field.TypeString))
+	id, ok := _u.mutation.ID()
 	if !ok {
 		return nil, &ValidationError{Name: "id", err: errors.New(`db: missing "AuthRequest.id" for update`)}
 	}
 	_spec.Node.ID.Value = id
-	if fields := aruo.fields; len(fields) > 0 {
+	if fields := _u.fields; len(fields) > 0 {
 		_spec.Node.Columns = make([]string, 0, len(fields))
 		_spec.Node.Columns = append(_spec.Node.Columns, authrequest.FieldID)
 		for _, f := range fields {
@@ -705,174 +991,128 @@ func (aruo *AuthRequestUpdateOne) sqlSave(ctx context.Context) (_node *AuthReque
 			}
 		}
 	}
-	if ps := aruo.mutation.predicates; len(ps) > 0 {
+	if ps := _u.mutation.predicates; len(ps) > 0 {
 		_spec.Predicate = func(selector *sql.Selector) {
 			for i := range ps {
 				ps[i](selector)
 			}
 		}
 	}
-	if value, ok := aruo.mutation.ClientID(); ok {
-		_spec.Fields.Set = append(_spec.Fields.Set, &sqlgraph.FieldSpec{
-			Type:   field.TypeString,
-			Value:  value,
-			Column: authrequest.FieldClientID,
-		})
+	if value, ok := _u.mutation.ClientID(); ok {
+		_spec.SetField(authrequest.FieldClientID, field.TypeString, value)
 	}
-	if value, ok := aruo.mutation.Scopes(); ok {
-		_spec.Fields.Set = append(_spec.Fields.Set, &sqlgraph.FieldSpec{
-			Type:   field.TypeJSON,
-			Value:  value,
-			Column: authrequest.FieldScopes,
-		})
+	if value, ok := _u.mutation.Scopes(); ok {
+		_spec.SetField(authrequest.FieldScopes, field.TypeJSON, value)
 	}
-	if aruo.mutation.ScopesCleared() {
-		_spec.Fields.Clear = append(_spec.Fields.Clear, &sqlgraph.FieldSpec{
-			Type:   field.TypeJSON,
-			Column: authrequest.FieldScopes,
+	if value, ok := _u.mutation.AppendedScopes(); ok {
+		_spec.AddModifier(func(u *sql.UpdateBuilder) {
+			sqljson.Append(u, authrequest.FieldScopes, value)
 		})
 	}
-	if value, ok := aruo.mutation.ResponseTypes(); ok {
-		_spec.Fields.Set = append(_spec.Fields.Set, &sqlgraph.FieldSpec{
-			Type:   field.TypeJSON,
-			Value:  value,
-			Column: authrequest.FieldResponseTypes,
-		})
+	if _u.mutation.ScopesCleared() {
+		_spec.ClearField(authrequest.FieldScopes, field.TypeJSON)
 	}
-	if aruo.mutation.ResponseTypesCleared() {
-		_spec.Fields.Clear = append(_spec.Fields.Clear, &sqlgraph.FieldSpec{
-			Type:   field.TypeJSON,
-			Column: authrequest.FieldResponseTypes,
-		})
+	if value, ok := _u.mutation.ResponseTypes(); ok {
+		_spec.SetField(authrequest.FieldResponseTypes, field.TypeJSON, value)
 	}
-	if value, ok := aruo.mutation.RedirectURI(); ok {
-		_spec.Fields.Set = append(_spec.Fields.Set, &sqlgraph.FieldSpec{
-			Type:   field.TypeString,
-			Value:  value,
-			Column: authrequest.FieldRedirectURI,
+	if value, ok := _u.mutation.AppendedResponseTypes(); ok {
+		_spec.AddModifier(func(u *sql.UpdateBuilder) {
+			sqljson.Append(u, authrequest.FieldResponseTypes, value)
 		})
 	}
-	if value, ok := aruo.mutation.Nonce(); ok {
-		_spec.Fields.Set = append(_spec.Fields.Set, &sqlgraph.FieldSpec{
-			Type:   field.TypeString,
-			Value:  value,
-			Column: authrequest.FieldNonce,
-		})
+	if _u.mutation.ResponseTypesCleared() {
+		_spec.ClearField(authrequest.FieldResponseTypes, field.TypeJSON)
 	}
-	if value, ok := aruo.mutation.State(); ok {
-		_spec.Fields.Set = append(_spec.Fields.Set, &sqlgraph.FieldSpec{
-			Type:   field.TypeString,
-			Value:  value,
-			Column: authrequest.FieldState,
-		})
+	if value, ok := _u.mutation.RedirectURI(); ok {
+		_spec.SetField(authrequest.FieldRedirectURI, field.TypeString, value)
 	}
-	if value, ok := aruo.mutation.ForceApprovalPrompt(); ok {
-		_spec.Fields.Set = append(_spec.Fields.Set, &sqlgraph.FieldSpec{
-			Type:   field.TypeBool,
-			Value:  value,
-			Column: authrequest.FieldForceApprovalPrompt,
-		})
+	if value, ok := _u.mutation.Nonce(); ok {
+		_spec.SetField(authrequest.FieldNonce, field.TypeString, value)
 	}
-	if value, ok := aruo.mutation.LoggedIn(); ok {
-		_spec.Fields.Set = append(_spec.Fields.Set, &sqlgraph.FieldSpec{
-			Type:   field.TypeBool,
-			Value:  value,
-			Column: authrequest.FieldLoggedIn,
-		})
+	if value, ok := _u.mutation.State(); ok {
+		_spec.SetField(authrequest.FieldState, field.TypeString, value)
 	}
-	if value, ok := aruo.mutation.ClaimsUserID(); ok {
-		_spec.Fields.Set = append(_spec.Fields.Set, &sqlgraph.FieldSpec{
-			Type:   field.TypeString,
-			Value:  value,
-			Column: authrequest.FieldClaimsUserID,
-		})
+	if value, ok := _u.mutation.ForceApprovalPrompt(); ok {
+		_spec.SetField(authrequest.FieldForceApprovalPrompt, field.TypeBool, value)
 	}
-	if value, ok := aruo.mutation.ClaimsUsername(); ok {
-		_spec.Fields.Set = append(_spec.Fields.Set, &sqlgraph.FieldSpec{
-			Type:   field.TypeString,
-			Value:  value,
-			Column: authrequest.FieldClaimsUsername,
-		})
+	if value, ok := _u.mutation.LoggedIn(); ok {
+		_spec.SetField(authrequest.FieldLoggedIn, field.TypeBool, value)
 	}
-	if value, ok := aruo.mutation.ClaimsEmail(); ok {
-		_spec.Fields.Set = append(_spec.Fields.Set, &sqlgraph.FieldSpec{
-			Type:   field.TypeString,
-			Value:  value,
-			Column: authrequest.FieldClaimsEmail,
-		})
+	if value, ok := _u.mutation.ClaimsUserID(); ok {
+		_spec.SetField(authrequest.FieldClaimsUserID, field.TypeString, value)
 	}
-	if value, ok := aruo.mutation.ClaimsEmailVerified(); ok {
-		_spec.Fields.Set = append(_spec.Fields.Set, &sqlgraph.FieldSpec{
-			Type:   field.TypeBool,
-			Value:  value,
-			Column: authrequest.FieldClaimsEmailVerified,
-		})
+	if value, ok := _u.mutation.ClaimsUsername(); ok {
+		_spec.SetField(authrequest.FieldClaimsUsername, field.TypeString, value)
 	}
-	if value, ok := aruo.mutation.ClaimsGroups(); ok {
-		_spec.Fields.Set = append(_spec.Fields.Set, &sqlgraph.FieldSpec{
-			Type:   field.TypeJSON,
-			Value:  value,
-			Column: authrequest.FieldClaimsGroups,
-		})
+	if value, ok := _u.mutation.ClaimsEmail(); ok {
+		_spec.SetField(authrequest.FieldClaimsEmail, field.TypeString, value)
 	}
-	if aruo.mutation.ClaimsGroupsCleared() {
-		_spec.Fields.Clear = append(_spec.Fields.Clear, &sqlgraph.FieldSpec{
-			Type:   field.TypeJSON,
-			Column: authrequest.FieldClaimsGroups,
-		})
+	if value, ok := _u.mutation.ClaimsEmailVerified(); ok {
+		_spec.SetField(authrequest.FieldClaimsEmailVerified, field.TypeBool, value)
 	}
-	if value, ok := aruo.mutation.ClaimsPreferredUsername(); ok {
-		_spec.Fields.Set = append(_spec.Fields.Set, &sqlgraph.FieldSpec{
-			Type:   field.TypeString,
-			Value:  value,
-			Column: authrequest.FieldClaimsPreferredUsername,
-		})
+	if value, ok := _u.mutation.ClaimsGroups(); ok {
+		_spec.SetField(authrequest.FieldClaimsGroups, field.TypeJSON, value)
 	}
-	if value, ok := aruo.mutation.ConnectorID(); ok {
-		_spec.Fields.Set = append(_spec.Fields.Set, &sqlgraph.FieldSpec{
-			Type:   field.TypeString,
-			Value:  value,
-			Column: authrequest.FieldConnectorID,
+	if value, ok := _u.mutation.AppendedClaimsGroups(); ok {
+		_spec.AddModifier(func(u *sql.UpdateBuilder) {
+			sqljson.Append(u, authrequest.FieldClaimsGroups, value)
 		})
 	}
-	if value, ok := aruo.mutation.ConnectorData(); ok {
-		_spec.Fields.Set = append(_spec.Fields.Set, &sqlgraph.FieldSpec{
-			Type:   field.TypeBytes,
-			Value:  value,
-			Column: authrequest.FieldConnectorData,
-		})
+	if _u.mutation.ClaimsGroupsCleared() {
+		_spec.ClearField(authrequest.FieldClaimsGroups, field.TypeJSON)
 	}
-	if aruo.mutation.ConnectorDataCleared() {
-		_spec.Fields.Clear = append(_spec.Fields.Clear, &sqlgraph.FieldSpec{
-			Type:   field.TypeBytes,
-			Column: authrequest.FieldConnectorData,
-		})
+	if value, ok := _u.mutation.ClaimsPreferredUsername(); ok {
+		_spec.SetField(authrequest.FieldClaimsPreferredUsername, field.TypeString, value)
 	}
-	if value, ok := aruo.mutation.Expiry(); ok {
-		_spec.Fields.Set = append(_spec.Fields.Set, &sqlgraph.FieldSpec{
-			Type:   field.TypeTime,
-			Value:  value,
-			Column: authrequest.FieldExpiry,
-		})
+	if value, ok := _u.mutation.ConnectorID(); ok {
+		_spec.SetField(authrequest.FieldConnectorID, field.TypeString, value)
 	}
-	if value, ok := aruo.mutation.CodeChallenge(); ok {
-		_spec.Fields.Set = append(_spec.Fields.Set, &sqlgraph.FieldSpec{
-			Type:   field.TypeString,
-			Value:  value,
-			Column: authrequest.FieldCodeChallenge,
-		})
+	if value, ok := _u.mutation.ConnectorData(); ok {
+		_spec.SetField(authrequest.FieldConnectorData, field.TypeBytes, value)
 	}
-	if value, ok := aruo.mutation.CodeChallengeMethod(); ok {
-		_spec.Fields.Set = append(_spec.Fields.Set, &sqlgraph.FieldSpec{
-			Type:   field.TypeString,
-			Value:  value,
-			Column: authrequest.FieldCodeChallengeMethod,
-		})
+	if _u.mutation.ConnectorDataCleared() {
+		_spec.ClearField(authrequest.FieldConnectorData, field.TypeBytes)
+	}
+	if value, ok := _u.mutation.Expiry(); ok {
+		_spec.SetField(authrequest.FieldExpiry, field.TypeTime, value)
+	}
+	if value, ok := _u.mutation.CodeChallenge(); ok {
+		_spec.SetField(authrequest.FieldCodeChallenge, field.TypeString, value)
+	}
+	if value, ok := _u.mutation.CodeChallengeMethod(); ok {
+		_spec.SetField(authrequest.FieldCodeChallengeMethod, field.TypeString, value)
+	}
+	if value, ok := _u.mutation.HmacKey(); ok {
+		_spec.SetField(authrequest.FieldHmacKey, field.TypeBytes, value)
+	}
+	if value, ok := _u.mutation.MfaValidated(); ok {
+		_spec.SetField(authrequest.FieldMfaValidated, field.TypeBool, value)
+	}
+	if value, ok := _u.mutation.WebauthnSessionData(); ok {
+		_spec.SetField(authrequest.FieldWebauthnSessionData, field.TypeBytes, value)
+	}
+	if _u.mutation.WebauthnSessionDataCleared() {
+		_spec.ClearField(authrequest.FieldWebauthnSessionData, field.TypeBytes)
+	}
+	if value, ok := _u.mutation.Prompt(); ok {
+		_spec.SetField(authrequest.FieldPrompt, field.TypeString, value)
+	}
+	if value, ok := _u.mutation.MaxAge(); ok {
+		_spec.SetField(authrequest.FieldMaxAge, field.TypeInt, value)
+	}
+	if value, ok := _u.mutation.AddedMaxAge(); ok {
+		_spec.AddField(authrequest.FieldMaxAge, field.TypeInt, value)
+	}
+	if value, ok := _u.mutation.AuthTime(); ok {
+		_spec.SetField(authrequest.FieldAuthTime, field.TypeTime, value)
+	}
+	if _u.mutation.AuthTimeCleared() {
+		_spec.ClearField(authrequest.FieldAuthTime, field.TypeTime)
 	}
-	_node = &AuthRequest{config: aruo.config}
+	_node = &AuthRequest{config: _u.config}
 	_spec.Assign = _node.assignValues
 	_spec.ScanValues = _node.scanValues
-	if err = sqlgraph.UpdateNode(ctx, aruo.driver, _spec); err != nil {
+	if err = sqlgraph.UpdateNode(ctx, _u.driver, _spec); err != nil {
 		if _, ok := err.(*sqlgraph.NotFoundError); ok {
 			err = &NotFoundError{authrequest.Label}
 		} else if sqlgraph.IsConstraintError(err) {
@@ -880,5 +1120,6 @@ func (aruo *AuthRequestUpdateOne) sqlSave(ctx context.Context) (_node *AuthReque
 		}
 		return nil, err
 	}
+	_u.mutation.done = true
 	return _node, nil
 }
diff --git a/storage/ent/db/authsession.go b/storage/ent/db/authsession.go
new file mode 100644
index 0000000000..d332c0f8c3
--- /dev/null
+++ b/storage/ent/db/authsession.go
@@ -0,0 +1,216 @@
+// Code generated by ent, DO NOT EDIT.
+
+package db
+
+import (
+	"fmt"
+	"strings"
+	"time"
+
+	"entgo.io/ent"
+	"entgo.io/ent/dialect/sql"
+	"github.com/dexidp/dex/storage/ent/db/authsession"
+)
+
+// AuthSession is the model entity for the AuthSession schema.
+type AuthSession struct {
+	config `json:"-"`
+	// ID of the ent.
+	ID string `json:"id,omitempty"`
+	// UserID holds the value of the "user_id" field.
+	UserID string `json:"user_id,omitempty"`
+	// ConnectorID holds the value of the "connector_id" field.
+	ConnectorID string `json:"connector_id,omitempty"`
+	// Secret holds the value of the "secret" field.
+	Secret string `json:"secret,omitempty"`
+	// ClientStates holds the value of the "client_states" field.
+	ClientStates []byte `json:"client_states,omitempty"`
+	// CreatedAt holds the value of the "created_at" field.
+	CreatedAt time.Time `json:"created_at,omitempty"`
+	// LastActivity holds the value of the "last_activity" field.
+	LastActivity time.Time `json:"last_activity,omitempty"`
+	// IPAddress holds the value of the "ip_address" field.
+	IPAddress string `json:"ip_address,omitempty"`
+	// UserAgent holds the value of the "user_agent" field.
+	UserAgent string `json:"user_agent,omitempty"`
+	// AbsoluteExpiry holds the value of the "absolute_expiry" field.
+	AbsoluteExpiry time.Time `json:"absolute_expiry,omitempty"`
+	// IdleExpiry holds the value of the "idle_expiry" field.
+	IdleExpiry time.Time `json:"idle_expiry,omitempty"`
+	// LogoutState holds the value of the "logout_state" field.
+	LogoutState  []byte `json:"logout_state,omitempty"`
+	selectValues sql.SelectValues
+}
+
+// scanValues returns the types for scanning values from sql.Rows.
+func (*AuthSession) scanValues(columns []string) ([]any, error) {
+	values := make([]any, len(columns))
+	for i := range columns {
+		switch columns[i] {
+		case authsession.FieldClientStates, authsession.FieldLogoutState:
+			values[i] = new([]byte)
+		case authsession.FieldID, authsession.FieldUserID, authsession.FieldConnectorID, authsession.FieldSecret, authsession.FieldIPAddress, authsession.FieldUserAgent:
+			values[i] = new(sql.NullString)
+		case authsession.FieldCreatedAt, authsession.FieldLastActivity, authsession.FieldAbsoluteExpiry, authsession.FieldIdleExpiry:
+			values[i] = new(sql.NullTime)
+		default:
+			values[i] = new(sql.UnknownType)
+		}
+	}
+	return values, nil
+}
+
+// assignValues assigns the values that were returned from sql.Rows (after scanning)
+// to the AuthSession fields.
+func (_m *AuthSession) assignValues(columns []string, values []any) error {
+	if m, n := len(values), len(columns); m < n {
+		return fmt.Errorf("mismatch number of scan values: %d != %d", m, n)
+	}
+	for i := range columns {
+		switch columns[i] {
+		case authsession.FieldID:
+			if value, ok := values[i].(*sql.NullString); !ok {
+				return fmt.Errorf("unexpected type %T for field id", values[i])
+			} else if value.Valid {
+				_m.ID = value.String
+			}
+		case authsession.FieldUserID:
+			if value, ok := values[i].(*sql.NullString); !ok {
+				return fmt.Errorf("unexpected type %T for field user_id", values[i])
+			} else if value.Valid {
+				_m.UserID = value.String
+			}
+		case authsession.FieldConnectorID:
+			if value, ok := values[i].(*sql.NullString); !ok {
+				return fmt.Errorf("unexpected type %T for field connector_id", values[i])
+			} else if value.Valid {
+				_m.ConnectorID = value.String
+			}
+		case authsession.FieldSecret:
+			if value, ok := values[i].(*sql.NullString); !ok {
+				return fmt.Errorf("unexpected type %T for field secret", values[i])
+			} else if value.Valid {
+				_m.Secret = value.String
+			}
+		case authsession.FieldClientStates:
+			if value, ok := values[i].(*[]byte); !ok {
+				return fmt.Errorf("unexpected type %T for field client_states", values[i])
+			} else if value != nil {
+				_m.ClientStates = *value
+			}
+		case authsession.FieldCreatedAt:
+			if value, ok := values[i].(*sql.NullTime); !ok {
+				return fmt.Errorf("unexpected type %T for field created_at", values[i])
+			} else if value.Valid {
+				_m.CreatedAt = value.Time
+			}
+		case authsession.FieldLastActivity:
+			if value, ok := values[i].(*sql.NullTime); !ok {
+				return fmt.Errorf("unexpected type %T for field last_activity", values[i])
+			} else if value.Valid {
+				_m.LastActivity = value.Time
+			}
+		case authsession.FieldIPAddress:
+			if value, ok := values[i].(*sql.NullString); !ok {
+				return fmt.Errorf("unexpected type %T for field ip_address", values[i])
+			} else if value.Valid {
+				_m.IPAddress = value.String
+			}
+		case authsession.FieldUserAgent:
+			if value, ok := values[i].(*sql.NullString); !ok {
+				return fmt.Errorf("unexpected type %T for field user_agent", values[i])
+			} else if value.Valid {
+				_m.UserAgent = value.String
+			}
+		case authsession.FieldAbsoluteExpiry:
+			if value, ok := values[i].(*sql.NullTime); !ok {
+				return fmt.Errorf("unexpected type %T for field absolute_expiry", values[i])
+			} else if value.Valid {
+				_m.AbsoluteExpiry = value.Time
+			}
+		case authsession.FieldIdleExpiry:
+			if value, ok := values[i].(*sql.NullTime); !ok {
+				return fmt.Errorf("unexpected type %T for field idle_expiry", values[i])
+			} else if value.Valid {
+				_m.IdleExpiry = value.Time
+			}
+		case authsession.FieldLogoutState:
+			if value, ok := values[i].(*[]byte); !ok {
+				return fmt.Errorf("unexpected type %T for field logout_state", values[i])
+			} else if value != nil {
+				_m.LogoutState = *value
+			}
+		default:
+			_m.selectValues.Set(columns[i], values[i])
+		}
+	}
+	return nil
+}
+
+// Value returns the ent.Value that was dynamically selected and assigned to the AuthSession.
+// This includes values selected through modifiers, order, etc.
+func (_m *AuthSession) Value(name string) (ent.Value, error) {
+	return _m.selectValues.Get(name)
+}
+
+// Update returns a builder for updating this AuthSession.
+// Note that you need to call AuthSession.Unwrap() before calling this method if this AuthSession
+// was returned from a transaction, and the transaction was committed or rolled back.
+func (_m *AuthSession) Update() *AuthSessionUpdateOne {
+	return NewAuthSessionClient(_m.config).UpdateOne(_m)
+}
+
+// Unwrap unwraps the AuthSession entity that was returned from a transaction after it was closed,
+// so that all future queries will be executed through the driver which created the transaction.
+func (_m *AuthSession) Unwrap() *AuthSession {
+	_tx, ok := _m.config.driver.(*txDriver)
+	if !ok {
+		panic("db: AuthSession is not a transactional entity")
+	}
+	_m.config.driver = _tx.drv
+	return _m
+}
+
+// String implements the fmt.Stringer.
+func (_m *AuthSession) String() string {
+	var builder strings.Builder
+	builder.WriteString("AuthSession(")
+	builder.WriteString(fmt.Sprintf("id=%v, ", _m.ID))
+	builder.WriteString("user_id=")
+	builder.WriteString(_m.UserID)
+	builder.WriteString(", ")
+	builder.WriteString("connector_id=")
+	builder.WriteString(_m.ConnectorID)
+	builder.WriteString(", ")
+	builder.WriteString("secret=")
+	builder.WriteString(_m.Secret)
+	builder.WriteString(", ")
+	builder.WriteString("client_states=")
+	builder.WriteString(fmt.Sprintf("%v", _m.ClientStates))
+	builder.WriteString(", ")
+	builder.WriteString("created_at=")
+	builder.WriteString(_m.CreatedAt.Format(time.ANSIC))
+	builder.WriteString(", ")
+	builder.WriteString("last_activity=")
+	builder.WriteString(_m.LastActivity.Format(time.ANSIC))
+	builder.WriteString(", ")
+	builder.WriteString("ip_address=")
+	builder.WriteString(_m.IPAddress)
+	builder.WriteString(", ")
+	builder.WriteString("user_agent=")
+	builder.WriteString(_m.UserAgent)
+	builder.WriteString(", ")
+	builder.WriteString("absolute_expiry=")
+	builder.WriteString(_m.AbsoluteExpiry.Format(time.ANSIC))
+	builder.WriteString(", ")
+	builder.WriteString("idle_expiry=")
+	builder.WriteString(_m.IdleExpiry.Format(time.ANSIC))
+	builder.WriteString(", ")
+	builder.WriteString("logout_state=")
+	builder.WriteString(fmt.Sprintf("%v", _m.LogoutState))
+	builder.WriteByte(')')
+	return builder.String()
+}
+
+// AuthSessions is a parsable slice of AuthSession.
+type AuthSessions []*AuthSession
diff --git a/storage/ent/db/authsession/authsession.go b/storage/ent/db/authsession/authsession.go
new file mode 100644
index 0000000000..c8d6e9479f
--- /dev/null
+++ b/storage/ent/db/authsession/authsession.go
@@ -0,0 +1,132 @@
+// Code generated by ent, DO NOT EDIT.
+
+package authsession
+
+import (
+	"entgo.io/ent/dialect/sql"
+)
+
+const (
+	// Label holds the string label denoting the authsession type in the database.
+	Label = "auth_session"
+	// FieldID holds the string denoting the id field in the database.
+	FieldID = "id"
+	// FieldUserID holds the string denoting the user_id field in the database.
+	FieldUserID = "user_id"
+	// FieldConnectorID holds the string denoting the connector_id field in the database.
+	FieldConnectorID = "connector_id"
+	// FieldSecret holds the string denoting the secret field in the database.
+	FieldSecret = "secret"
+	// FieldClientStates holds the string denoting the client_states field in the database.
+	FieldClientStates = "client_states"
+	// FieldCreatedAt holds the string denoting the created_at field in the database.
+	FieldCreatedAt = "created_at"
+	// FieldLastActivity holds the string denoting the last_activity field in the database.
+	FieldLastActivity = "last_activity"
+	// FieldIPAddress holds the string denoting the ip_address field in the database.
+	FieldIPAddress = "ip_address"
+	// FieldUserAgent holds the string denoting the user_agent field in the database.
+	FieldUserAgent = "user_agent"
+	// FieldAbsoluteExpiry holds the string denoting the absolute_expiry field in the database.
+	FieldAbsoluteExpiry = "absolute_expiry"
+	// FieldIdleExpiry holds the string denoting the idle_expiry field in the database.
+	FieldIdleExpiry = "idle_expiry"
+	// FieldLogoutState holds the string denoting the logout_state field in the database.
+	FieldLogoutState = "logout_state"
+	// Table holds the table name of the authsession in the database.
+	Table = "auth_sessions"
+)
+
+// Columns holds all SQL columns for authsession fields.
+var Columns = []string{
+	FieldID,
+	FieldUserID,
+	FieldConnectorID,
+	FieldSecret,
+	FieldClientStates,
+	FieldCreatedAt,
+	FieldLastActivity,
+	FieldIPAddress,
+	FieldUserAgent,
+	FieldAbsoluteExpiry,
+	FieldIdleExpiry,
+	FieldLogoutState,
+}
+
+// ValidColumn reports if the column name is valid (part of the table columns).
+func ValidColumn(column string) bool {
+	for i := range Columns {
+		if column == Columns[i] {
+			return true
+		}
+	}
+	return false
+}
+
+var (
+	// UserIDValidator is a validator for the "user_id" field. It is called by the builders before save.
+	UserIDValidator func(string) error
+	// ConnectorIDValidator is a validator for the "connector_id" field. It is called by the builders before save.
+	ConnectorIDValidator func(string) error
+	// SecretValidator is a validator for the "secret" field. It is called by the builders before save.
+	SecretValidator func(string) error
+	// DefaultIPAddress holds the default value on creation for the "ip_address" field.
+	DefaultIPAddress string
+	// DefaultUserAgent holds the default value on creation for the "user_agent" field.
+	DefaultUserAgent string
+	// IDValidator is a validator for the "id" field. It is called by the builders before save.
+	IDValidator func(string) error
+)
+
+// OrderOption defines the ordering options for the AuthSession queries.
+type OrderOption func(*sql.Selector)
+
+// ByID orders the results by the id field.
+func ByID(opts ...sql.OrderTermOption) OrderOption {
+	return sql.OrderByField(FieldID, opts...).ToFunc()
+}
+
+// ByUserID orders the results by the user_id field.
+func ByUserID(opts ...sql.OrderTermOption) OrderOption {
+	return sql.OrderByField(FieldUserID, opts...).ToFunc()
+}
+
+// ByConnectorID orders the results by the connector_id field.
+func ByConnectorID(opts ...sql.OrderTermOption) OrderOption {
+	return sql.OrderByField(FieldConnectorID, opts...).ToFunc()
+}
+
+// BySecret orders the results by the secret field.
+func BySecret(opts ...sql.OrderTermOption) OrderOption {
+	return sql.OrderByField(FieldSecret, opts...).ToFunc()
+}
+
+// ByCreatedAt orders the results by the created_at field.
+func ByCreatedAt(opts ...sql.OrderTermOption) OrderOption {
+	return sql.OrderByField(FieldCreatedAt, opts...).ToFunc()
+}
+
+// ByLastActivity orders the results by the last_activity field.
+func ByLastActivity(opts ...sql.OrderTermOption) OrderOption {
+	return sql.OrderByField(FieldLastActivity, opts...).ToFunc()
+}
+
+// ByIPAddress orders the results by the ip_address field.
+func ByIPAddress(opts ...sql.OrderTermOption) OrderOption {
+	return sql.OrderByField(FieldIPAddress, opts...).ToFunc()
+}
+
+// ByUserAgent orders the results by the user_agent field.
+func ByUserAgent(opts ...sql.OrderTermOption) OrderOption {
+	return sql.OrderByField(FieldUserAgent, opts...).ToFunc()
+}
+
+// ByAbsoluteExpiry orders the results by the absolute_expiry field.
+func ByAbsoluteExpiry(opts ...sql.OrderTermOption) OrderOption {
+	return sql.OrderByField(FieldAbsoluteExpiry, opts...).ToFunc()
+}
+
+// ByIdleExpiry orders the results by the idle_expiry field.
+func ByIdleExpiry(opts ...sql.OrderTermOption) OrderOption {
+	return sql.OrderByField(FieldIdleExpiry, opts...).ToFunc()
+}
diff --git a/storage/ent/db/authsession/where.go b/storage/ent/db/authsession/where.go
new file mode 100644
index 0000000000..87698ac33e
--- /dev/null
+++ b/storage/ent/db/authsession/where.go
@@ -0,0 +1,710 @@
+// Code generated by ent, DO NOT EDIT.
+
+package authsession
+
+import (
+	"time"
+
+	"entgo.io/ent/dialect/sql"
+	"github.com/dexidp/dex/storage/ent/db/predicate"
+)
+
+// ID filters vertices based on their ID field.
+func ID(id string) predicate.AuthSession {
+	return predicate.AuthSession(sql.FieldEQ(FieldID, id))
+}
+
+// IDEQ applies the EQ predicate on the ID field.
+func IDEQ(id string) predicate.AuthSession {
+	return predicate.AuthSession(sql.FieldEQ(FieldID, id))
+}
+
+// IDNEQ applies the NEQ predicate on the ID field.
+func IDNEQ(id string) predicate.AuthSession {
+	return predicate.AuthSession(sql.FieldNEQ(FieldID, id))
+}
+
+// IDIn applies the In predicate on the ID field.
+func IDIn(ids ...string) predicate.AuthSession {
+	return predicate.AuthSession(sql.FieldIn(FieldID, ids...))
+}
+
+// IDNotIn applies the NotIn predicate on the ID field.
+func IDNotIn(ids ...string) predicate.AuthSession {
+	return predicate.AuthSession(sql.FieldNotIn(FieldID, ids...))
+}
+
+// IDGT applies the GT predicate on the ID field.
+func IDGT(id string) predicate.AuthSession {
+	return predicate.AuthSession(sql.FieldGT(FieldID, id))
+}
+
+// IDGTE applies the GTE predicate on the ID field.
+func IDGTE(id string) predicate.AuthSession {
+	return predicate.AuthSession(sql.FieldGTE(FieldID, id))
+}
+
+// IDLT applies the LT predicate on the ID field.
+func IDLT(id string) predicate.AuthSession {
+	return predicate.AuthSession(sql.FieldLT(FieldID, id))
+}
+
+// IDLTE applies the LTE predicate on the ID field.
+func IDLTE(id string) predicate.AuthSession {
+	return predicate.AuthSession(sql.FieldLTE(FieldID, id))
+}
+
+// IDEqualFold applies the EqualFold predicate on the ID field.
+func IDEqualFold(id string) predicate.AuthSession {
+	return predicate.AuthSession(sql.FieldEqualFold(FieldID, id))
+}
+
+// IDContainsFold applies the ContainsFold predicate on the ID field.
+func IDContainsFold(id string) predicate.AuthSession {
+	return predicate.AuthSession(sql.FieldContainsFold(FieldID, id))
+}
+
+// UserID applies equality check predicate on the "user_id" field. It's identical to UserIDEQ.
+func UserID(v string) predicate.AuthSession {
+	return predicate.AuthSession(sql.FieldEQ(FieldUserID, v))
+}
+
+// ConnectorID applies equality check predicate on the "connector_id" field. It's identical to ConnectorIDEQ.
+func ConnectorID(v string) predicate.AuthSession {
+	return predicate.AuthSession(sql.FieldEQ(FieldConnectorID, v))
+}
+
+// Secret applies equality check predicate on the "secret" field. It's identical to SecretEQ.
+func Secret(v string) predicate.AuthSession {
+	return predicate.AuthSession(sql.FieldEQ(FieldSecret, v))
+}
+
+// ClientStates applies equality check predicate on the "client_states" field. It's identical to ClientStatesEQ.
+func ClientStates(v []byte) predicate.AuthSession {
+	return predicate.AuthSession(sql.FieldEQ(FieldClientStates, v))
+}
+
+// CreatedAt applies equality check predicate on the "created_at" field. It's identical to CreatedAtEQ.
+func CreatedAt(v time.Time) predicate.AuthSession {
+	return predicate.AuthSession(sql.FieldEQ(FieldCreatedAt, v))
+}
+
+// LastActivity applies equality check predicate on the "last_activity" field. It's identical to LastActivityEQ.
+func LastActivity(v time.Time) predicate.AuthSession {
+	return predicate.AuthSession(sql.FieldEQ(FieldLastActivity, v))
+}
+
+// IPAddress applies equality check predicate on the "ip_address" field. It's identical to IPAddressEQ.
+func IPAddress(v string) predicate.AuthSession {
+	return predicate.AuthSession(sql.FieldEQ(FieldIPAddress, v))
+}
+
+// UserAgent applies equality check predicate on the "user_agent" field. It's identical to UserAgentEQ.
+func UserAgent(v string) predicate.AuthSession {
+	return predicate.AuthSession(sql.FieldEQ(FieldUserAgent, v))
+}
+
+// AbsoluteExpiry applies equality check predicate on the "absolute_expiry" field. It's identical to AbsoluteExpiryEQ.
+func AbsoluteExpiry(v time.Time) predicate.AuthSession {
+	return predicate.AuthSession(sql.FieldEQ(FieldAbsoluteExpiry, v))
+}
+
+// IdleExpiry applies equality check predicate on the "idle_expiry" field. It's identical to IdleExpiryEQ.
+func IdleExpiry(v time.Time) predicate.AuthSession {
+	return predicate.AuthSession(sql.FieldEQ(FieldIdleExpiry, v))
+}
+
+// LogoutState applies equality check predicate on the "logout_state" field. It's identical to LogoutStateEQ.
+func LogoutState(v []byte) predicate.AuthSession {
+	return predicate.AuthSession(sql.FieldEQ(FieldLogoutState, v))
+}
+
+// UserIDEQ applies the EQ predicate on the "user_id" field.
+func UserIDEQ(v string) predicate.AuthSession {
+	return predicate.AuthSession(sql.FieldEQ(FieldUserID, v))
+}
+
+// UserIDNEQ applies the NEQ predicate on the "user_id" field.
+func UserIDNEQ(v string) predicate.AuthSession {
+	return predicate.AuthSession(sql.FieldNEQ(FieldUserID, v))
+}
+
+// UserIDIn applies the In predicate on the "user_id" field.
+func UserIDIn(vs ...string) predicate.AuthSession {
+	return predicate.AuthSession(sql.FieldIn(FieldUserID, vs...))
+}
+
+// UserIDNotIn applies the NotIn predicate on the "user_id" field.
+func UserIDNotIn(vs ...string) predicate.AuthSession {
+	return predicate.AuthSession(sql.FieldNotIn(FieldUserID, vs...))
+}
+
+// UserIDGT applies the GT predicate on the "user_id" field.
+func UserIDGT(v string) predicate.AuthSession {
+	return predicate.AuthSession(sql.FieldGT(FieldUserID, v))
+}
+
+// UserIDGTE applies the GTE predicate on the "user_id" field.
+func UserIDGTE(v string) predicate.AuthSession {
+	return predicate.AuthSession(sql.FieldGTE(FieldUserID, v))
+}
+
+// UserIDLT applies the LT predicate on the "user_id" field.
+func UserIDLT(v string) predicate.AuthSession {
+	return predicate.AuthSession(sql.FieldLT(FieldUserID, v))
+}
+
+// UserIDLTE applies the LTE predicate on the "user_id" field.
+func UserIDLTE(v string) predicate.AuthSession {
+	return predicate.AuthSession(sql.FieldLTE(FieldUserID, v))
+}
+
+// UserIDContains applies the Contains predicate on the "user_id" field.
+func UserIDContains(v string) predicate.AuthSession {
+	return predicate.AuthSession(sql.FieldContains(FieldUserID, v))
+}
+
+// UserIDHasPrefix applies the HasPrefix predicate on the "user_id" field.
+func UserIDHasPrefix(v string) predicate.AuthSession {
+	return predicate.AuthSession(sql.FieldHasPrefix(FieldUserID, v))
+}
+
+// UserIDHasSuffix applies the HasSuffix predicate on the "user_id" field.
+func UserIDHasSuffix(v string) predicate.AuthSession {
+	return predicate.AuthSession(sql.FieldHasSuffix(FieldUserID, v))
+}
+
+// UserIDEqualFold applies the EqualFold predicate on the "user_id" field.
+func UserIDEqualFold(v string) predicate.AuthSession {
+	return predicate.AuthSession(sql.FieldEqualFold(FieldUserID, v))
+}
+
+// UserIDContainsFold applies the ContainsFold predicate on the "user_id" field.
+func UserIDContainsFold(v string) predicate.AuthSession {
+	return predicate.AuthSession(sql.FieldContainsFold(FieldUserID, v))
+}
+
+// ConnectorIDEQ applies the EQ predicate on the "connector_id" field.
+func ConnectorIDEQ(v string) predicate.AuthSession {
+	return predicate.AuthSession(sql.FieldEQ(FieldConnectorID, v))
+}
+
+// ConnectorIDNEQ applies the NEQ predicate on the "connector_id" field.
+func ConnectorIDNEQ(v string) predicate.AuthSession {
+	return predicate.AuthSession(sql.FieldNEQ(FieldConnectorID, v))
+}
+
+// ConnectorIDIn applies the In predicate on the "connector_id" field.
+func ConnectorIDIn(vs ...string) predicate.AuthSession {
+	return predicate.AuthSession(sql.FieldIn(FieldConnectorID, vs...))
+}
+
+// ConnectorIDNotIn applies the NotIn predicate on the "connector_id" field.
+func ConnectorIDNotIn(vs ...string) predicate.AuthSession {
+	return predicate.AuthSession(sql.FieldNotIn(FieldConnectorID, vs...))
+}
+
+// ConnectorIDGT applies the GT predicate on the "connector_id" field.
+func ConnectorIDGT(v string) predicate.AuthSession {
+	return predicate.AuthSession(sql.FieldGT(FieldConnectorID, v))
+}
+
+// ConnectorIDGTE applies the GTE predicate on the "connector_id" field.
+func ConnectorIDGTE(v string) predicate.AuthSession {
+	return predicate.AuthSession(sql.FieldGTE(FieldConnectorID, v))
+}
+
+// ConnectorIDLT applies the LT predicate on the "connector_id" field.
+func ConnectorIDLT(v string) predicate.AuthSession {
+	return predicate.AuthSession(sql.FieldLT(FieldConnectorID, v))
+}
+
+// ConnectorIDLTE applies the LTE predicate on the "connector_id" field.
+func ConnectorIDLTE(v string) predicate.AuthSession {
+	return predicate.AuthSession(sql.FieldLTE(FieldConnectorID, v))
+}
+
+// ConnectorIDContains applies the Contains predicate on the "connector_id" field.
+func ConnectorIDContains(v string) predicate.AuthSession {
+	return predicate.AuthSession(sql.FieldContains(FieldConnectorID, v))
+}
+
+// ConnectorIDHasPrefix applies the HasPrefix predicate on the "connector_id" field.
+func ConnectorIDHasPrefix(v string) predicate.AuthSession {
+	return predicate.AuthSession(sql.FieldHasPrefix(FieldConnectorID, v))
+}
+
+// ConnectorIDHasSuffix applies the HasSuffix predicate on the "connector_id" field.
+func ConnectorIDHasSuffix(v string) predicate.AuthSession {
+	return predicate.AuthSession(sql.FieldHasSuffix(FieldConnectorID, v))
+}
+
+// ConnectorIDEqualFold applies the EqualFold predicate on the "connector_id" field.
+func ConnectorIDEqualFold(v string) predicate.AuthSession {
+	return predicate.AuthSession(sql.FieldEqualFold(FieldConnectorID, v))
+}
+
+// ConnectorIDContainsFold applies the ContainsFold predicate on the "connector_id" field.
+func ConnectorIDContainsFold(v string) predicate.AuthSession {
+	return predicate.AuthSession(sql.FieldContainsFold(FieldConnectorID, v))
+}
+
+// SecretEQ applies the EQ predicate on the "secret" field.
+func SecretEQ(v string) predicate.AuthSession {
+	return predicate.AuthSession(sql.FieldEQ(FieldSecret, v))
+}
+
+// SecretNEQ applies the NEQ predicate on the "secret" field.
+func SecretNEQ(v string) predicate.AuthSession {
+	return predicate.AuthSession(sql.FieldNEQ(FieldSecret, v))
+}
+
+// SecretIn applies the In predicate on the "secret" field.
+func SecretIn(vs ...string) predicate.AuthSession {
+	return predicate.AuthSession(sql.FieldIn(FieldSecret, vs...))
+}
+
+// SecretNotIn applies the NotIn predicate on the "secret" field.
+func SecretNotIn(vs ...string) predicate.AuthSession {
+	return predicate.AuthSession(sql.FieldNotIn(FieldSecret, vs...))
+}
+
+// SecretGT applies the GT predicate on the "secret" field.
+func SecretGT(v string) predicate.AuthSession {
+	return predicate.AuthSession(sql.FieldGT(FieldSecret, v))
+}
+
+// SecretGTE applies the GTE predicate on the "secret" field.
+func SecretGTE(v string) predicate.AuthSession {
+	return predicate.AuthSession(sql.FieldGTE(FieldSecret, v))
+}
+
+// SecretLT applies the LT predicate on the "secret" field.
+func SecretLT(v string) predicate.AuthSession {
+	return predicate.AuthSession(sql.FieldLT(FieldSecret, v))
+}
+
+// SecretLTE applies the LTE predicate on the "secret" field.
+func SecretLTE(v string) predicate.AuthSession {
+	return predicate.AuthSession(sql.FieldLTE(FieldSecret, v))
+}
+
+// SecretContains applies the Contains predicate on the "secret" field.
+func SecretContains(v string) predicate.AuthSession {
+	return predicate.AuthSession(sql.FieldContains(FieldSecret, v))
+}
+
+// SecretHasPrefix applies the HasPrefix predicate on the "secret" field.
+func SecretHasPrefix(v string) predicate.AuthSession {
+	return predicate.AuthSession(sql.FieldHasPrefix(FieldSecret, v))
+}
+
+// SecretHasSuffix applies the HasSuffix predicate on the "secret" field.
+func SecretHasSuffix(v string) predicate.AuthSession {
+	return predicate.AuthSession(sql.FieldHasSuffix(FieldSecret, v))
+}
+
+// SecretEqualFold applies the EqualFold predicate on the "secret" field.
+func SecretEqualFold(v string) predicate.AuthSession {
+	return predicate.AuthSession(sql.FieldEqualFold(FieldSecret, v))
+}
+
+// SecretContainsFold applies the ContainsFold predicate on the "secret" field.
+func SecretContainsFold(v string) predicate.AuthSession {
+	return predicate.AuthSession(sql.FieldContainsFold(FieldSecret, v))
+}
+
+// ClientStatesEQ applies the EQ predicate on the "client_states" field.
+func ClientStatesEQ(v []byte) predicate.AuthSession {
+	return predicate.AuthSession(sql.FieldEQ(FieldClientStates, v))
+}
+
+// ClientStatesNEQ applies the NEQ predicate on the "client_states" field.
+func ClientStatesNEQ(v []byte) predicate.AuthSession {
+	return predicate.AuthSession(sql.FieldNEQ(FieldClientStates, v))
+}
+
+// ClientStatesIn applies the In predicate on the "client_states" field.
+func ClientStatesIn(vs ...[]byte) predicate.AuthSession {
+	return predicate.AuthSession(sql.FieldIn(FieldClientStates, vs...))
+}
+
+// ClientStatesNotIn applies the NotIn predicate on the "client_states" field.
+func ClientStatesNotIn(vs ...[]byte) predicate.AuthSession {
+	return predicate.AuthSession(sql.FieldNotIn(FieldClientStates, vs...))
+}
+
+// ClientStatesGT applies the GT predicate on the "client_states" field.
+func ClientStatesGT(v []byte) predicate.AuthSession {
+	return predicate.AuthSession(sql.FieldGT(FieldClientStates, v))
+}
+
+// ClientStatesGTE applies the GTE predicate on the "client_states" field.
+func ClientStatesGTE(v []byte) predicate.AuthSession {
+	return predicate.AuthSession(sql.FieldGTE(FieldClientStates, v))
+}
+
+// ClientStatesLT applies the LT predicate on the "client_states" field.
+func ClientStatesLT(v []byte) predicate.AuthSession {
+	return predicate.AuthSession(sql.FieldLT(FieldClientStates, v))
+}
+
+// ClientStatesLTE applies the LTE predicate on the "client_states" field.
+func ClientStatesLTE(v []byte) predicate.AuthSession {
+	return predicate.AuthSession(sql.FieldLTE(FieldClientStates, v))
+}
+
+// CreatedAtEQ applies the EQ predicate on the "created_at" field.
+func CreatedAtEQ(v time.Time) predicate.AuthSession {
+	return predicate.AuthSession(sql.FieldEQ(FieldCreatedAt, v))
+}
+
+// CreatedAtNEQ applies the NEQ predicate on the "created_at" field.
+func CreatedAtNEQ(v time.Time) predicate.AuthSession {
+	return predicate.AuthSession(sql.FieldNEQ(FieldCreatedAt, v))
+}
+
+// CreatedAtIn applies the In predicate on the "created_at" field.
+func CreatedAtIn(vs ...time.Time) predicate.AuthSession {
+	return predicate.AuthSession(sql.FieldIn(FieldCreatedAt, vs...))
+}
+
+// CreatedAtNotIn applies the NotIn predicate on the "created_at" field.
+func CreatedAtNotIn(vs ...time.Time) predicate.AuthSession {
+	return predicate.AuthSession(sql.FieldNotIn(FieldCreatedAt, vs...))
+}
+
+// CreatedAtGT applies the GT predicate on the "created_at" field.
+func CreatedAtGT(v time.Time) predicate.AuthSession {
+	return predicate.AuthSession(sql.FieldGT(FieldCreatedAt, v))
+}
+
+// CreatedAtGTE applies the GTE predicate on the "created_at" field.
+func CreatedAtGTE(v time.Time) predicate.AuthSession {
+	return predicate.AuthSession(sql.FieldGTE(FieldCreatedAt, v))
+}
+
+// CreatedAtLT applies the LT predicate on the "created_at" field.
+func CreatedAtLT(v time.Time) predicate.AuthSession {
+	return predicate.AuthSession(sql.FieldLT(FieldCreatedAt, v))
+}
+
+// CreatedAtLTE applies the LTE predicate on the "created_at" field.
+func CreatedAtLTE(v time.Time) predicate.AuthSession {
+	return predicate.AuthSession(sql.FieldLTE(FieldCreatedAt, v))
+}
+
+// LastActivityEQ applies the EQ predicate on the "last_activity" field.
+func LastActivityEQ(v time.Time) predicate.AuthSession {
+	return predicate.AuthSession(sql.FieldEQ(FieldLastActivity, v))
+}
+
+// LastActivityNEQ applies the NEQ predicate on the "last_activity" field.
+func LastActivityNEQ(v time.Time) predicate.AuthSession {
+	return predicate.AuthSession(sql.FieldNEQ(FieldLastActivity, v))
+}
+
+// LastActivityIn applies the In predicate on the "last_activity" field.
+func LastActivityIn(vs ...time.Time) predicate.AuthSession {
+	return predicate.AuthSession(sql.FieldIn(FieldLastActivity, vs...))
+}
+
+// LastActivityNotIn applies the NotIn predicate on the "last_activity" field.
+func LastActivityNotIn(vs ...time.Time) predicate.AuthSession {
+	return predicate.AuthSession(sql.FieldNotIn(FieldLastActivity, vs...))
+}
+
+// LastActivityGT applies the GT predicate on the "last_activity" field.
+func LastActivityGT(v time.Time) predicate.AuthSession {
+	return predicate.AuthSession(sql.FieldGT(FieldLastActivity, v))
+}
+
+// LastActivityGTE applies the GTE predicate on the "last_activity" field.
+func LastActivityGTE(v time.Time) predicate.AuthSession {
+	return predicate.AuthSession(sql.FieldGTE(FieldLastActivity, v))
+}
+
+// LastActivityLT applies the LT predicate on the "last_activity" field.
+func LastActivityLT(v time.Time) predicate.AuthSession {
+	return predicate.AuthSession(sql.FieldLT(FieldLastActivity, v))
+}
+
+// LastActivityLTE applies the LTE predicate on the "last_activity" field.
+func LastActivityLTE(v time.Time) predicate.AuthSession {
+	return predicate.AuthSession(sql.FieldLTE(FieldLastActivity, v))
+}
+
+// IPAddressEQ applies the EQ predicate on the "ip_address" field.
+func IPAddressEQ(v string) predicate.AuthSession {
+	return predicate.AuthSession(sql.FieldEQ(FieldIPAddress, v))
+}
+
+// IPAddressNEQ applies the NEQ predicate on the "ip_address" field.
+func IPAddressNEQ(v string) predicate.AuthSession {
+	return predicate.AuthSession(sql.FieldNEQ(FieldIPAddress, v))
+}
+
+// IPAddressIn applies the In predicate on the "ip_address" field.
+func IPAddressIn(vs ...string) predicate.AuthSession {
+	return predicate.AuthSession(sql.FieldIn(FieldIPAddress, vs...))
+}
+
+// IPAddressNotIn applies the NotIn predicate on the "ip_address" field.
+func IPAddressNotIn(vs ...string) predicate.AuthSession {
+	return predicate.AuthSession(sql.FieldNotIn(FieldIPAddress, vs...))
+}
+
+// IPAddressGT applies the GT predicate on the "ip_address" field.
+func IPAddressGT(v string) predicate.AuthSession {
+	return predicate.AuthSession(sql.FieldGT(FieldIPAddress, v))
+}
+
+// IPAddressGTE applies the GTE predicate on the "ip_address" field.
+func IPAddressGTE(v string) predicate.AuthSession {
+	return predicate.AuthSession(sql.FieldGTE(FieldIPAddress, v))
+}
+
+// IPAddressLT applies the LT predicate on the "ip_address" field.
+func IPAddressLT(v string) predicate.AuthSession {
+	return predicate.AuthSession(sql.FieldLT(FieldIPAddress, v))
+}
+
+// IPAddressLTE applies the LTE predicate on the "ip_address" field.
+func IPAddressLTE(v string) predicate.AuthSession {
+	return predicate.AuthSession(sql.FieldLTE(FieldIPAddress, v))
+}
+
+// IPAddressContains applies the Contains predicate on the "ip_address" field.
+func IPAddressContains(v string) predicate.AuthSession {
+	return predicate.AuthSession(sql.FieldContains(FieldIPAddress, v))
+}
+
+// IPAddressHasPrefix applies the HasPrefix predicate on the "ip_address" field.
+func IPAddressHasPrefix(v string) predicate.AuthSession {
+	return predicate.AuthSession(sql.FieldHasPrefix(FieldIPAddress, v))
+}
+
+// IPAddressHasSuffix applies the HasSuffix predicate on the "ip_address" field.
+func IPAddressHasSuffix(v string) predicate.AuthSession {
+	return predicate.AuthSession(sql.FieldHasSuffix(FieldIPAddress, v))
+}
+
+// IPAddressEqualFold applies the EqualFold predicate on the "ip_address" field.
+func IPAddressEqualFold(v string) predicate.AuthSession {
+	return predicate.AuthSession(sql.FieldEqualFold(FieldIPAddress, v))
+}
+
+// IPAddressContainsFold applies the ContainsFold predicate on the "ip_address" field.
+func IPAddressContainsFold(v string) predicate.AuthSession {
+	return predicate.AuthSession(sql.FieldContainsFold(FieldIPAddress, v))
+}
+
+// UserAgentEQ applies the EQ predicate on the "user_agent" field.
+func UserAgentEQ(v string) predicate.AuthSession {
+	return predicate.AuthSession(sql.FieldEQ(FieldUserAgent, v))
+}
+
+// UserAgentNEQ applies the NEQ predicate on the "user_agent" field.
+func UserAgentNEQ(v string) predicate.AuthSession {
+	return predicate.AuthSession(sql.FieldNEQ(FieldUserAgent, v))
+}
+
+// UserAgentIn applies the In predicate on the "user_agent" field.
+func UserAgentIn(vs ...string) predicate.AuthSession {
+	return predicate.AuthSession(sql.FieldIn(FieldUserAgent, vs...))
+}
+
+// UserAgentNotIn applies the NotIn predicate on the "user_agent" field.
+func UserAgentNotIn(vs ...string) predicate.AuthSession {
+	return predicate.AuthSession(sql.FieldNotIn(FieldUserAgent, vs...))
+}
+
+// UserAgentGT applies the GT predicate on the "user_agent" field.
+func UserAgentGT(v string) predicate.AuthSession {
+	return predicate.AuthSession(sql.FieldGT(FieldUserAgent, v))
+}
+
+// UserAgentGTE applies the GTE predicate on the "user_agent" field.
+func UserAgentGTE(v string) predicate.AuthSession {
+	return predicate.AuthSession(sql.FieldGTE(FieldUserAgent, v))
+}
+
+// UserAgentLT applies the LT predicate on the "user_agent" field.
+func UserAgentLT(v string) predicate.AuthSession {
+	return predicate.AuthSession(sql.FieldLT(FieldUserAgent, v))
+}
+
+// UserAgentLTE applies the LTE predicate on the "user_agent" field.
+func UserAgentLTE(v string) predicate.AuthSession {
+	return predicate.AuthSession(sql.FieldLTE(FieldUserAgent, v))
+}
+
+// UserAgentContains applies the Contains predicate on the "user_agent" field.
+func UserAgentContains(v string) predicate.AuthSession {
+	return predicate.AuthSession(sql.FieldContains(FieldUserAgent, v))
+}
+
+// UserAgentHasPrefix applies the HasPrefix predicate on the "user_agent" field.
+func UserAgentHasPrefix(v string) predicate.AuthSession {
+	return predicate.AuthSession(sql.FieldHasPrefix(FieldUserAgent, v))
+}
+
+// UserAgentHasSuffix applies the HasSuffix predicate on the "user_agent" field.
+func UserAgentHasSuffix(v string) predicate.AuthSession {
+	return predicate.AuthSession(sql.FieldHasSuffix(FieldUserAgent, v))
+}
+
+// UserAgentEqualFold applies the EqualFold predicate on the "user_agent" field.
+func UserAgentEqualFold(v string) predicate.AuthSession {
+	return predicate.AuthSession(sql.FieldEqualFold(FieldUserAgent, v))
+}
+
+// UserAgentContainsFold applies the ContainsFold predicate on the "user_agent" field.
+func UserAgentContainsFold(v string) predicate.AuthSession {
+	return predicate.AuthSession(sql.FieldContainsFold(FieldUserAgent, v))
+}
+
+// AbsoluteExpiryEQ applies the EQ predicate on the "absolute_expiry" field.
+func AbsoluteExpiryEQ(v time.Time) predicate.AuthSession {
+	return predicate.AuthSession(sql.FieldEQ(FieldAbsoluteExpiry, v))
+}
+
+// AbsoluteExpiryNEQ applies the NEQ predicate on the "absolute_expiry" field.
+func AbsoluteExpiryNEQ(v time.Time) predicate.AuthSession {
+	return predicate.AuthSession(sql.FieldNEQ(FieldAbsoluteExpiry, v))
+}
+
+// AbsoluteExpiryIn applies the In predicate on the "absolute_expiry" field.
+func AbsoluteExpiryIn(vs ...time.Time) predicate.AuthSession {
+	return predicate.AuthSession(sql.FieldIn(FieldAbsoluteExpiry, vs...))
+}
+
+// AbsoluteExpiryNotIn applies the NotIn predicate on the "absolute_expiry" field.
+func AbsoluteExpiryNotIn(vs ...time.Time) predicate.AuthSession {
+	return predicate.AuthSession(sql.FieldNotIn(FieldAbsoluteExpiry, vs...))
+}
+
+// AbsoluteExpiryGT applies the GT predicate on the "absolute_expiry" field.
+func AbsoluteExpiryGT(v time.Time) predicate.AuthSession {
+	return predicate.AuthSession(sql.FieldGT(FieldAbsoluteExpiry, v))
+}
+
+// AbsoluteExpiryGTE applies the GTE predicate on the "absolute_expiry" field.
+func AbsoluteExpiryGTE(v time.Time) predicate.AuthSession {
+	return predicate.AuthSession(sql.FieldGTE(FieldAbsoluteExpiry, v))
+}
+
+// AbsoluteExpiryLT applies the LT predicate on the "absolute_expiry" field.
+func AbsoluteExpiryLT(v time.Time) predicate.AuthSession {
+	return predicate.AuthSession(sql.FieldLT(FieldAbsoluteExpiry, v))
+}
+
+// AbsoluteExpiryLTE applies the LTE predicate on the "absolute_expiry" field.
+func AbsoluteExpiryLTE(v time.Time) predicate.AuthSession {
+	return predicate.AuthSession(sql.FieldLTE(FieldAbsoluteExpiry, v))
+}
+
+// IdleExpiryEQ applies the EQ predicate on the "idle_expiry" field.
+func IdleExpiryEQ(v time.Time) predicate.AuthSession {
+	return predicate.AuthSession(sql.FieldEQ(FieldIdleExpiry, v))
+}
+
+// IdleExpiryNEQ applies the NEQ predicate on the "idle_expiry" field.
+func IdleExpiryNEQ(v time.Time) predicate.AuthSession {
+	return predicate.AuthSession(sql.FieldNEQ(FieldIdleExpiry, v))
+}
+
+// IdleExpiryIn applies the In predicate on the "idle_expiry" field.
+func IdleExpiryIn(vs ...time.Time) predicate.AuthSession {
+	return predicate.AuthSession(sql.FieldIn(FieldIdleExpiry, vs...))
+}
+
+// IdleExpiryNotIn applies the NotIn predicate on the "idle_expiry" field.
+func IdleExpiryNotIn(vs ...time.Time) predicate.AuthSession {
+	return predicate.AuthSession(sql.FieldNotIn(FieldIdleExpiry, vs...))
+}
+
+// IdleExpiryGT applies the GT predicate on the "idle_expiry" field.
+func IdleExpiryGT(v time.Time) predicate.AuthSession {
+	return predicate.AuthSession(sql.FieldGT(FieldIdleExpiry, v))
+}
+
+// IdleExpiryGTE applies the GTE predicate on the "idle_expiry" field.
+func IdleExpiryGTE(v time.Time) predicate.AuthSession {
+	return predicate.AuthSession(sql.FieldGTE(FieldIdleExpiry, v))
+}
+
+// IdleExpiryLT applies the LT predicate on the "idle_expiry" field.
+func IdleExpiryLT(v time.Time) predicate.AuthSession {
+	return predicate.AuthSession(sql.FieldLT(FieldIdleExpiry, v))
+}
+
+// IdleExpiryLTE applies the LTE predicate on the "idle_expiry" field.
+func IdleExpiryLTE(v time.Time) predicate.AuthSession {
+	return predicate.AuthSession(sql.FieldLTE(FieldIdleExpiry, v))
+}
+
+// LogoutStateEQ applies the EQ predicate on the "logout_state" field.
+func LogoutStateEQ(v []byte) predicate.AuthSession {
+	return predicate.AuthSession(sql.FieldEQ(FieldLogoutState, v))
+}
+
+// LogoutStateNEQ applies the NEQ predicate on the "logout_state" field.
+func LogoutStateNEQ(v []byte) predicate.AuthSession {
+	return predicate.AuthSession(sql.FieldNEQ(FieldLogoutState, v))
+}
+
+// LogoutStateIn applies the In predicate on the "logout_state" field.
+func LogoutStateIn(vs ...[]byte) predicate.AuthSession {
+	return predicate.AuthSession(sql.FieldIn(FieldLogoutState, vs...))
+}
+
+// LogoutStateNotIn applies the NotIn predicate on the "logout_state" field.
+func LogoutStateNotIn(vs ...[]byte) predicate.AuthSession {
+	return predicate.AuthSession(sql.FieldNotIn(FieldLogoutState, vs...))
+}
+
+// LogoutStateGT applies the GT predicate on the "logout_state" field.
+func LogoutStateGT(v []byte) predicate.AuthSession {
+	return predicate.AuthSession(sql.FieldGT(FieldLogoutState, v))
+}
+
+// LogoutStateGTE applies the GTE predicate on the "logout_state" field.
+func LogoutStateGTE(v []byte) predicate.AuthSession {
+	return predicate.AuthSession(sql.FieldGTE(FieldLogoutState, v))
+}
+
+// LogoutStateLT applies the LT predicate on the "logout_state" field.
+func LogoutStateLT(v []byte) predicate.AuthSession {
+	return predicate.AuthSession(sql.FieldLT(FieldLogoutState, v))
+}
+
+// LogoutStateLTE applies the LTE predicate on the "logout_state" field.
+func LogoutStateLTE(v []byte) predicate.AuthSession {
+	return predicate.AuthSession(sql.FieldLTE(FieldLogoutState, v))
+}
+
+// LogoutStateIsNil applies the IsNil predicate on the "logout_state" field.
+func LogoutStateIsNil() predicate.AuthSession {
+	return predicate.AuthSession(sql.FieldIsNull(FieldLogoutState))
+}
+
+// LogoutStateNotNil applies the NotNil predicate on the "logout_state" field.
+func LogoutStateNotNil() predicate.AuthSession {
+	return predicate.AuthSession(sql.FieldNotNull(FieldLogoutState))
+}
+
+// And groups predicates with the AND operator between them.
+func And(predicates ...predicate.AuthSession) predicate.AuthSession {
+	return predicate.AuthSession(sql.AndPredicates(predicates...))
+}
+
+// Or groups predicates with the OR operator between them.
+func Or(predicates ...predicate.AuthSession) predicate.AuthSession {
+	return predicate.AuthSession(sql.OrPredicates(predicates...))
+}
+
+// Not applies the not operator on the given predicate.
+func Not(p predicate.AuthSession) predicate.AuthSession {
+	return predicate.AuthSession(sql.NotPredicates(p))
+}
diff --git a/storage/ent/db/authsession_create.go b/storage/ent/db/authsession_create.go
new file mode 100644
index 0000000000..2e18f6a438
--- /dev/null
+++ b/storage/ent/db/authsession_create.go
@@ -0,0 +1,372 @@
+// Code generated by ent, DO NOT EDIT.
+
+package db
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"time"
+
+	"entgo.io/ent/dialect/sql/sqlgraph"
+	"entgo.io/ent/schema/field"
+	"github.com/dexidp/dex/storage/ent/db/authsession"
+)
+
+// AuthSessionCreate is the builder for creating a AuthSession entity.
+type AuthSessionCreate struct {
+	config
+	mutation *AuthSessionMutation
+	hooks    []Hook
+}
+
+// SetUserID sets the "user_id" field.
+func (_c *AuthSessionCreate) SetUserID(v string) *AuthSessionCreate {
+	_c.mutation.SetUserID(v)
+	return _c
+}
+
+// SetConnectorID sets the "connector_id" field.
+func (_c *AuthSessionCreate) SetConnectorID(v string) *AuthSessionCreate {
+	_c.mutation.SetConnectorID(v)
+	return _c
+}
+
+// SetSecret sets the "secret" field.
+func (_c *AuthSessionCreate) SetSecret(v string) *AuthSessionCreate {
+	_c.mutation.SetSecret(v)
+	return _c
+}
+
+// SetClientStates sets the "client_states" field.
+func (_c *AuthSessionCreate) SetClientStates(v []byte) *AuthSessionCreate {
+	_c.mutation.SetClientStates(v)
+	return _c
+}
+
+// SetCreatedAt sets the "created_at" field.
+func (_c *AuthSessionCreate) SetCreatedAt(v time.Time) *AuthSessionCreate {
+	_c.mutation.SetCreatedAt(v)
+	return _c
+}
+
+// SetLastActivity sets the "last_activity" field.
+func (_c *AuthSessionCreate) SetLastActivity(v time.Time) *AuthSessionCreate {
+	_c.mutation.SetLastActivity(v)
+	return _c
+}
+
+// SetIPAddress sets the "ip_address" field.
+func (_c *AuthSessionCreate) SetIPAddress(v string) *AuthSessionCreate {
+	_c.mutation.SetIPAddress(v)
+	return _c
+}
+
+// SetNillableIPAddress sets the "ip_address" field if the given value is not nil.
+func (_c *AuthSessionCreate) SetNillableIPAddress(v *string) *AuthSessionCreate {
+	if v != nil {
+		_c.SetIPAddress(*v)
+	}
+	return _c
+}
+
+// SetUserAgent sets the "user_agent" field.
+func (_c *AuthSessionCreate) SetUserAgent(v string) *AuthSessionCreate {
+	_c.mutation.SetUserAgent(v)
+	return _c
+}
+
+// SetNillableUserAgent sets the "user_agent" field if the given value is not nil.
+func (_c *AuthSessionCreate) SetNillableUserAgent(v *string) *AuthSessionCreate {
+	if v != nil {
+		_c.SetUserAgent(*v)
+	}
+	return _c
+}
+
+// SetAbsoluteExpiry sets the "absolute_expiry" field.
+func (_c *AuthSessionCreate) SetAbsoluteExpiry(v time.Time) *AuthSessionCreate {
+	_c.mutation.SetAbsoluteExpiry(v)
+	return _c
+}
+
+// SetIdleExpiry sets the "idle_expiry" field.
+func (_c *AuthSessionCreate) SetIdleExpiry(v time.Time) *AuthSessionCreate {
+	_c.mutation.SetIdleExpiry(v)
+	return _c
+}
+
+// SetLogoutState sets the "logout_state" field.
+func (_c *AuthSessionCreate) SetLogoutState(v []byte) *AuthSessionCreate {
+	_c.mutation.SetLogoutState(v)
+	return _c
+}
+
+// SetID sets the "id" field.
+func (_c *AuthSessionCreate) SetID(v string) *AuthSessionCreate {
+	_c.mutation.SetID(v)
+	return _c
+}
+
+// Mutation returns the AuthSessionMutation object of the builder.
+func (_c *AuthSessionCreate) Mutation() *AuthSessionMutation {
+	return _c.mutation
+}
+
+// Save creates the AuthSession in the database.
+func (_c *AuthSessionCreate) Save(ctx context.Context) (*AuthSession, error) {
+	_c.defaults()
+	return withHooks(ctx, _c.sqlSave, _c.mutation, _c.hooks)
+}
+
+// SaveX calls Save and panics if Save returns an error.
+func (_c *AuthSessionCreate) SaveX(ctx context.Context) *AuthSession {
+	v, err := _c.Save(ctx)
+	if err != nil {
+		panic(err)
+	}
+	return v
+}
+
+// Exec executes the query.
+func (_c *AuthSessionCreate) Exec(ctx context.Context) error {
+	_, err := _c.Save(ctx)
+	return err
+}
+
+// ExecX is like Exec, but panics if an error occurs.
+func (_c *AuthSessionCreate) ExecX(ctx context.Context) {
+	if err := _c.Exec(ctx); err != nil {
+		panic(err)
+	}
+}
+
+// defaults sets the default values of the builder before save.
+func (_c *AuthSessionCreate) defaults() {
+	if _, ok := _c.mutation.IPAddress(); !ok {
+		v := authsession.DefaultIPAddress
+		_c.mutation.SetIPAddress(v)
+	}
+	if _, ok := _c.mutation.UserAgent(); !ok {
+		v := authsession.DefaultUserAgent
+		_c.mutation.SetUserAgent(v)
+	}
+}
+
+// check runs all checks and user-defined validators on the builder.
+func (_c *AuthSessionCreate) check() error {
+	if _, ok := _c.mutation.UserID(); !ok {
+		return &ValidationError{Name: "user_id", err: errors.New(`db: missing required field "AuthSession.user_id"`)}
+	}
+	if v, ok := _c.mutation.UserID(); ok {
+		if err := authsession.UserIDValidator(v); err != nil {
+			return &ValidationError{Name: "user_id", err: fmt.Errorf(`db: validator failed for field "AuthSession.user_id": %w`, err)}
+		}
+	}
+	if _, ok := _c.mutation.ConnectorID(); !ok {
+		return &ValidationError{Name: "connector_id", err: errors.New(`db: missing required field "AuthSession.connector_id"`)}
+	}
+	if v, ok := _c.mutation.ConnectorID(); ok {
+		if err := authsession.ConnectorIDValidator(v); err != nil {
+			return &ValidationError{Name: "connector_id", err: fmt.Errorf(`db: validator failed for field "AuthSession.connector_id": %w`, err)}
+		}
+	}
+	if _, ok := _c.mutation.Secret(); !ok {
+		return &ValidationError{Name: "secret", err: errors.New(`db: missing required field "AuthSession.secret"`)}
+	}
+	if v, ok := _c.mutation.Secret(); ok {
+		if err := authsession.SecretValidator(v); err != nil {
+			return &ValidationError{Name: "secret", err: fmt.Errorf(`db: validator failed for field "AuthSession.secret": %w`, err)}
+		}
+	}
+	if _, ok := _c.mutation.ClientStates(); !ok {
+		return &ValidationError{Name: "client_states", err: errors.New(`db: missing required field "AuthSession.client_states"`)}
+	}
+	if _, ok := _c.mutation.CreatedAt(); !ok {
+		return &ValidationError{Name: "created_at", err: errors.New(`db: missing required field "AuthSession.created_at"`)}
+	}
+	if _, ok := _c.mutation.LastActivity(); !ok {
+		return &ValidationError{Name: "last_activity", err: errors.New(`db: missing required field "AuthSession.last_activity"`)}
+	}
+	if _, ok := _c.mutation.IPAddress(); !ok {
+		return &ValidationError{Name: "ip_address", err: errors.New(`db: missing required field "AuthSession.ip_address"`)}
+	}
+	if _, ok := _c.mutation.UserAgent(); !ok {
+		return &ValidationError{Name: "user_agent", err: errors.New(`db: missing required field "AuthSession.user_agent"`)}
+	}
+	if _, ok := _c.mutation.AbsoluteExpiry(); !ok {
+		return &ValidationError{Name: "absolute_expiry", err: errors.New(`db: missing required field "AuthSession.absolute_expiry"`)}
+	}
+	if _, ok := _c.mutation.IdleExpiry(); !ok {
+		return &ValidationError{Name: "idle_expiry", err: errors.New(`db: missing required field "AuthSession.idle_expiry"`)}
+	}
+	if v, ok := _c.mutation.ID(); ok {
+		if err := authsession.IDValidator(v); err != nil {
+			return &ValidationError{Name: "id", err: fmt.Errorf(`db: validator failed for field "AuthSession.id": %w`, err)}
+		}
+	}
+	return nil
+}
+
+func (_c *AuthSessionCreate) sqlSave(ctx context.Context) (*AuthSession, error) {
+	if err := _c.check(); err != nil {
+		return nil, err
+	}
+	_node, _spec := _c.createSpec()
+	if err := sqlgraph.CreateNode(ctx, _c.driver, _spec); err != nil {
+		if sqlgraph.IsConstraintError(err) {
+			err = &ConstraintError{msg: err.Error(), wrap: err}
+		}
+		return nil, err
+	}
+	if _spec.ID.Value != nil {
+		if id, ok := _spec.ID.Value.(string); ok {
+			_node.ID = id
+		} else {
+			return nil, fmt.Errorf("unexpected AuthSession.ID type: %T", _spec.ID.Value)
+		}
+	}
+	_c.mutation.id = &_node.ID
+	_c.mutation.done = true
+	return _node, nil
+}
+
+func (_c *AuthSessionCreate) createSpec() (*AuthSession, *sqlgraph.CreateSpec) {
+	var (
+		_node = &AuthSession{config: _c.config}
+		_spec = sqlgraph.NewCreateSpec(authsession.Table, sqlgraph.NewFieldSpec(authsession.FieldID, field.TypeString))
+	)
+	if id, ok := _c.mutation.ID(); ok {
+		_node.ID = id
+		_spec.ID.Value = id
+	}
+	if value, ok := _c.mutation.UserID(); ok {
+		_spec.SetField(authsession.FieldUserID, field.TypeString, value)
+		_node.UserID = value
+	}
+	if value, ok := _c.mutation.ConnectorID(); ok {
+		_spec.SetField(authsession.FieldConnectorID, field.TypeString, value)
+		_node.ConnectorID = value
+	}
+	if value, ok := _c.mutation.Secret(); ok {
+		_spec.SetField(authsession.FieldSecret, field.TypeString, value)
+		_node.Secret = value
+	}
+	if value, ok := _c.mutation.ClientStates(); ok {
+		_spec.SetField(authsession.FieldClientStates, field.TypeBytes, value)
+		_node.ClientStates = value
+	}
+	if value, ok := _c.mutation.CreatedAt(); ok {
+		_spec.SetField(authsession.FieldCreatedAt, field.TypeTime, value)
+		_node.CreatedAt = value
+	}
+	if value, ok := _c.mutation.LastActivity(); ok {
+		_spec.SetField(authsession.FieldLastActivity, field.TypeTime, value)
+		_node.LastActivity = value
+	}
+	if value, ok := _c.mutation.IPAddress(); ok {
+		_spec.SetField(authsession.FieldIPAddress, field.TypeString, value)
+		_node.IPAddress = value
+	}
+	if value, ok := _c.mutation.UserAgent(); ok {
+		_spec.SetField(authsession.FieldUserAgent, field.TypeString, value)
+		_node.UserAgent = value
+	}
+	if value, ok := _c.mutation.AbsoluteExpiry(); ok {
+		_spec.SetField(authsession.FieldAbsoluteExpiry, field.TypeTime, value)
+		_node.AbsoluteExpiry = value
+	}
+	if value, ok := _c.mutation.IdleExpiry(); ok {
+		_spec.SetField(authsession.FieldIdleExpiry, field.TypeTime, value)
+		_node.IdleExpiry = value
+	}
+	if value, ok := _c.mutation.LogoutState(); ok {
+		_spec.SetField(authsession.FieldLogoutState, field.TypeBytes, value)
+		_node.LogoutState = value
+	}
+	return _node, _spec
+}
+
+// AuthSessionCreateBulk is the builder for creating many AuthSession entities in bulk.
+type AuthSessionCreateBulk struct {
+	config
+	err      error
+	builders []*AuthSessionCreate
+}
+
+// Save creates the AuthSession entities in the database.
+func (_c *AuthSessionCreateBulk) Save(ctx context.Context) ([]*AuthSession, error) {
+	if _c.err != nil {
+		return nil, _c.err
+	}
+	specs := make([]*sqlgraph.CreateSpec, len(_c.builders))
+	nodes := make([]*AuthSession, len(_c.builders))
+	mutators := make([]Mutator, len(_c.builders))
+	for i := range _c.builders {
+		func(i int, root context.Context) {
+			builder := _c.builders[i]
+			builder.defaults()
+			var mut Mutator = MutateFunc(func(ctx context.Context, m Mutation) (Value, error) {
+				mutation, ok := m.(*AuthSessionMutation)
+				if !ok {
+					return nil, fmt.Errorf("unexpected mutation type %T", m)
+				}
+				if err := builder.check(); err != nil {
+					return nil, err
+				}
+				builder.mutation = mutation
+				var err error
+				nodes[i], specs[i] = builder.createSpec()
+				if i < len(mutators)-1 {
+					_, err = mutators[i+1].Mutate(root, _c.builders[i+1].mutation)
+				} else {
+					spec := &sqlgraph.BatchCreateSpec{Nodes: specs}
+					// Invoke the actual operation on the latest mutation in the chain.
+					if err = sqlgraph.BatchCreate(ctx, _c.driver, spec); err != nil {
+						if sqlgraph.IsConstraintError(err) {
+							err = &ConstraintError{msg: err.Error(), wrap: err}
+						}
+					}
+				}
+				if err != nil {
+					return nil, err
+				}
+				mutation.id = &nodes[i].ID
+				mutation.done = true
+				return nodes[i], nil
+			})
+			for i := len(builder.hooks) - 1; i >= 0; i-- {
+				mut = builder.hooks[i](mut)
+			}
+			mutators[i] = mut
+		}(i, ctx)
+	}
+	if len(mutators) > 0 {
+		if _, err := mutators[0].Mutate(ctx, _c.builders[0].mutation); err != nil {
+			return nil, err
+		}
+	}
+	return nodes, nil
+}
+
+// SaveX is like Save, but panics if an error occurs.
+func (_c *AuthSessionCreateBulk) SaveX(ctx context.Context) []*AuthSession {
+	v, err := _c.Save(ctx)
+	if err != nil {
+		panic(err)
+	}
+	return v
+}
+
+// Exec executes the query.
+func (_c *AuthSessionCreateBulk) Exec(ctx context.Context) error {
+	_, err := _c.Save(ctx)
+	return err
+}
+
+// ExecX is like Exec, but panics if an error occurs.
+func (_c *AuthSessionCreateBulk) ExecX(ctx context.Context) {
+	if err := _c.Exec(ctx); err != nil {
+		panic(err)
+	}
+}
diff --git a/storage/ent/db/authsession_delete.go b/storage/ent/db/authsession_delete.go
new file mode 100644
index 0000000000..63116fb41d
--- /dev/null
+++ b/storage/ent/db/authsession_delete.go
@@ -0,0 +1,88 @@
+// Code generated by ent, DO NOT EDIT.
+
+package db
+
+import (
+	"context"
+
+	"entgo.io/ent/dialect/sql"
+	"entgo.io/ent/dialect/sql/sqlgraph"
+	"entgo.io/ent/schema/field"
+	"github.com/dexidp/dex/storage/ent/db/authsession"
+	"github.com/dexidp/dex/storage/ent/db/predicate"
+)
+
+// AuthSessionDelete is the builder for deleting a AuthSession entity.
+type AuthSessionDelete struct {
+	config
+	hooks    []Hook
+	mutation *AuthSessionMutation
+}
+
+// Where appends a list predicates to the AuthSessionDelete builder.
+func (_d *AuthSessionDelete) Where(ps ...predicate.AuthSession) *AuthSessionDelete {
+	_d.mutation.Where(ps...)
+	return _d
+}
+
+// Exec executes the deletion query and returns how many vertices were deleted.
+func (_d *AuthSessionDelete) Exec(ctx context.Context) (int, error) {
+	return withHooks(ctx, _d.sqlExec, _d.mutation, _d.hooks)
+}
+
+// ExecX is like Exec, but panics if an error occurs.
+func (_d *AuthSessionDelete) ExecX(ctx context.Context) int {
+	n, err := _d.Exec(ctx)
+	if err != nil {
+		panic(err)
+	}
+	return n
+}
+
+func (_d *AuthSessionDelete) sqlExec(ctx context.Context) (int, error) {
+	_spec := sqlgraph.NewDeleteSpec(authsession.Table, sqlgraph.NewFieldSpec(authsession.FieldID, field.TypeString))
+	if ps := _d.mutation.predicates; len(ps) > 0 {
+		_spec.Predicate = func(selector *sql.Selector) {
+			for i := range ps {
+				ps[i](selector)
+			}
+		}
+	}
+	affected, err := sqlgraph.DeleteNodes(ctx, _d.driver, _spec)
+	if err != nil && sqlgraph.IsConstraintError(err) {
+		err = &ConstraintError{msg: err.Error(), wrap: err}
+	}
+	_d.mutation.done = true
+	return affected, err
+}
+
+// AuthSessionDeleteOne is the builder for deleting a single AuthSession entity.
+type AuthSessionDeleteOne struct {
+	_d *AuthSessionDelete
+}
+
+// Where appends a list predicates to the AuthSessionDelete builder.
+func (_d *AuthSessionDeleteOne) Where(ps ...predicate.AuthSession) *AuthSessionDeleteOne {
+	_d._d.mutation.Where(ps...)
+	return _d
+}
+
+// Exec executes the deletion query.
+func (_d *AuthSessionDeleteOne) Exec(ctx context.Context) error {
+	n, err := _d._d.Exec(ctx)
+	switch {
+	case err != nil:
+		return err
+	case n == 0:
+		return &NotFoundError{authsession.Label}
+	default:
+		return nil
+	}
+}
+
+// ExecX is like Exec, but panics if an error occurs.
+func (_d *AuthSessionDeleteOne) ExecX(ctx context.Context) {
+	if err := _d.Exec(ctx); err != nil {
+		panic(err)
+	}
+}
diff --git a/storage/ent/db/authsession_query.go b/storage/ent/db/authsession_query.go
new file mode 100644
index 0000000000..6550b55d1d
--- /dev/null
+++ b/storage/ent/db/authsession_query.go
@@ -0,0 +1,527 @@
+// Code generated by ent, DO NOT EDIT.
+
+package db
+
+import (
+	"context"
+	"fmt"
+	"math"
+
+	"entgo.io/ent"
+	"entgo.io/ent/dialect/sql"
+	"entgo.io/ent/dialect/sql/sqlgraph"
+	"entgo.io/ent/schema/field"
+	"github.com/dexidp/dex/storage/ent/db/authsession"
+	"github.com/dexidp/dex/storage/ent/db/predicate"
+)
+
+// AuthSessionQuery is the builder for querying AuthSession entities.
+type AuthSessionQuery struct {
+	config
+	ctx        *QueryContext
+	order      []authsession.OrderOption
+	inters     []Interceptor
+	predicates []predicate.AuthSession
+	// intermediate query (i.e. traversal path).
+	sql  *sql.Selector
+	path func(context.Context) (*sql.Selector, error)
+}
+
+// Where adds a new predicate for the AuthSessionQuery builder.
+func (_q *AuthSessionQuery) Where(ps ...predicate.AuthSession) *AuthSessionQuery {
+	_q.predicates = append(_q.predicates, ps...)
+	return _q
+}
+
+// Limit the number of records to be returned by this query.
+func (_q *AuthSessionQuery) Limit(limit int) *AuthSessionQuery {
+	_q.ctx.Limit = &limit
+	return _q
+}
+
+// Offset to start from.
+func (_q *AuthSessionQuery) Offset(offset int) *AuthSessionQuery {
+	_q.ctx.Offset = &offset
+	return _q
+}
+
+// Unique configures the query builder to filter duplicate records on query.
+// By default, unique is set to true, and can be disabled using this method.
+func (_q *AuthSessionQuery) Unique(unique bool) *AuthSessionQuery {
+	_q.ctx.Unique = &unique
+	return _q
+}
+
+// Order specifies how the records should be ordered.
+func (_q *AuthSessionQuery) Order(o ...authsession.OrderOption) *AuthSessionQuery {
+	_q.order = append(_q.order, o...)
+	return _q
+}
+
+// First returns the first AuthSession entity from the query.
+// Returns a *NotFoundError when no AuthSession was found.
+func (_q *AuthSessionQuery) First(ctx context.Context) (*AuthSession, error) {
+	nodes, err := _q.Limit(1).All(setContextOp(ctx, _q.ctx, ent.OpQueryFirst))
+	if err != nil {
+		return nil, err
+	}
+	if len(nodes) == 0 {
+		return nil, &NotFoundError{authsession.Label}
+	}
+	return nodes[0], nil
+}
+
+// FirstX is like First, but panics if an error occurs.
+func (_q *AuthSessionQuery) FirstX(ctx context.Context) *AuthSession {
+	node, err := _q.First(ctx)
+	if err != nil && !IsNotFound(err) {
+		panic(err)
+	}
+	return node
+}
+
+// FirstID returns the first AuthSession ID from the query.
+// Returns a *NotFoundError when no AuthSession ID was found.
+func (_q *AuthSessionQuery) FirstID(ctx context.Context) (id string, err error) {
+	var ids []string
+	if ids, err = _q.Limit(1).IDs(setContextOp(ctx, _q.ctx, ent.OpQueryFirstID)); err != nil {
+		return
+	}
+	if len(ids) == 0 {
+		err = &NotFoundError{authsession.Label}
+		return
+	}
+	return ids[0], nil
+}
+
+// FirstIDX is like FirstID, but panics if an error occurs.
+func (_q *AuthSessionQuery) FirstIDX(ctx context.Context) string {
+	id, err := _q.FirstID(ctx)
+	if err != nil && !IsNotFound(err) {
+		panic(err)
+	}
+	return id
+}
+
+// Only returns a single AuthSession entity found by the query, ensuring it only returns one.
+// Returns a *NotSingularError when more than one AuthSession entity is found.
+// Returns a *NotFoundError when no AuthSession entities are found.
+func (_q *AuthSessionQuery) Only(ctx context.Context) (*AuthSession, error) {
+	nodes, err := _q.Limit(2).All(setContextOp(ctx, _q.ctx, ent.OpQueryOnly))
+	if err != nil {
+		return nil, err
+	}
+	switch len(nodes) {
+	case 1:
+		return nodes[0], nil
+	case 0:
+		return nil, &NotFoundError{authsession.Label}
+	default:
+		return nil, &NotSingularError{authsession.Label}
+	}
+}
+
+// OnlyX is like Only, but panics if an error occurs.
+func (_q *AuthSessionQuery) OnlyX(ctx context.Context) *AuthSession {
+	node, err := _q.Only(ctx)
+	if err != nil {
+		panic(err)
+	}
+	return node
+}
+
+// OnlyID is like Only, but returns the only AuthSession ID in the query.
+// Returns a *NotSingularError when more than one AuthSession ID is found.
+// Returns a *NotFoundError when no entities are found.
+func (_q *AuthSessionQuery) OnlyID(ctx context.Context) (id string, err error) {
+	var ids []string
+	if ids, err = _q.Limit(2).IDs(setContextOp(ctx, _q.ctx, ent.OpQueryOnlyID)); err != nil {
+		return
+	}
+	switch len(ids) {
+	case 1:
+		id = ids[0]
+	case 0:
+		err = &NotFoundError{authsession.Label}
+	default:
+		err = &NotSingularError{authsession.Label}
+	}
+	return
+}
+
+// OnlyIDX is like OnlyID, but panics if an error occurs.
+func (_q *AuthSessionQuery) OnlyIDX(ctx context.Context) string {
+	id, err := _q.OnlyID(ctx)
+	if err != nil {
+		panic(err)
+	}
+	return id
+}
+
+// All executes the query and returns a list of AuthSessions.
+func (_q *AuthSessionQuery) All(ctx context.Context) ([]*AuthSession, error) {
+	ctx = setContextOp(ctx, _q.ctx, ent.OpQueryAll)
+	if err := _q.prepareQuery(ctx); err != nil {
+		return nil, err
+	}
+	qr := querierAll[[]*AuthSession, *AuthSessionQuery]()
+	return withInterceptors[[]*AuthSession](ctx, _q, qr, _q.inters)
+}
+
+// AllX is like All, but panics if an error occurs.
+func (_q *AuthSessionQuery) AllX(ctx context.Context) []*AuthSession {
+	nodes, err := _q.All(ctx)
+	if err != nil {
+		panic(err)
+	}
+	return nodes
+}
+
+// IDs executes the query and returns a list of AuthSession IDs.
+func (_q *AuthSessionQuery) IDs(ctx context.Context) (ids []string, err error) {
+	if _q.ctx.Unique == nil && _q.path != nil {
+		_q.Unique(true)
+	}
+	ctx = setContextOp(ctx, _q.ctx, ent.OpQueryIDs)
+	if err = _q.Select(authsession.FieldID).Scan(ctx, &ids); err != nil {
+		return nil, err
+	}
+	return ids, nil
+}
+
+// IDsX is like IDs, but panics if an error occurs.
+func (_q *AuthSessionQuery) IDsX(ctx context.Context) []string {
+	ids, err := _q.IDs(ctx)
+	if err != nil {
+		panic(err)
+	}
+	return ids
+}
+
+// Count returns the count of the given query.
+func (_q *AuthSessionQuery) Count(ctx context.Context) (int, error) {
+	ctx = setContextOp(ctx, _q.ctx, ent.OpQueryCount)
+	if err := _q.prepareQuery(ctx); err != nil {
+		return 0, err
+	}
+	return withInterceptors[int](ctx, _q, querierCount[*AuthSessionQuery](), _q.inters)
+}
+
+// CountX is like Count, but panics if an error occurs.
+func (_q *AuthSessionQuery) CountX(ctx context.Context) int {
+	count, err := _q.Count(ctx)
+	if err != nil {
+		panic(err)
+	}
+	return count
+}
+
+// Exist returns true if the query has elements in the graph.
+func (_q *AuthSessionQuery) Exist(ctx context.Context) (bool, error) {
+	ctx = setContextOp(ctx, _q.ctx, ent.OpQueryExist)
+	switch _, err := _q.FirstID(ctx); {
+	case IsNotFound(err):
+		return false, nil
+	case err != nil:
+		return false, fmt.Errorf("db: check existence: %w", err)
+	default:
+		return true, nil
+	}
+}
+
+// ExistX is like Exist, but panics if an error occurs.
+func (_q *AuthSessionQuery) ExistX(ctx context.Context) bool {
+	exist, err := _q.Exist(ctx)
+	if err != nil {
+		panic(err)
+	}
+	return exist
+}
+
+// Clone returns a duplicate of the AuthSessionQuery builder, including all associated steps. It can be
+// used to prepare common query builders and use them differently after the clone is made.
+func (_q *AuthSessionQuery) Clone() *AuthSessionQuery {
+	if _q == nil {
+		return nil
+	}
+	return &AuthSessionQuery{
+		config:     _q.config,
+		ctx:        _q.ctx.Clone(),
+		order:      append([]authsession.OrderOption{}, _q.order...),
+		inters:     append([]Interceptor{}, _q.inters...),
+		predicates: append([]predicate.AuthSession{}, _q.predicates...),
+		// clone intermediate query.
+		sql:  _q.sql.Clone(),
+		path: _q.path,
+	}
+}
+
+// GroupBy is used to group vertices by one or more fields/columns.
+// It is often used with aggregate functions, like: count, max, mean, min, sum.
+//
+// Example:
+//
+//	var v []struct {
+//		UserID string `json:"user_id,omitempty"`
+//		Count int `json:"count,omitempty"`
+//	}
+//
+//	client.AuthSession.Query().
+//		GroupBy(authsession.FieldUserID).
+//		Aggregate(db.Count()).
+//		Scan(ctx, &v)
+func (_q *AuthSessionQuery) GroupBy(field string, fields ...string) *AuthSessionGroupBy {
+	_q.ctx.Fields = append([]string{field}, fields...)
+	grbuild := &AuthSessionGroupBy{build: _q}
+	grbuild.flds = &_q.ctx.Fields
+	grbuild.label = authsession.Label
+	grbuild.scan = grbuild.Scan
+	return grbuild
+}
+
+// Select allows the selection one or more fields/columns for the given query,
+// instead of selecting all fields in the entity.
+//
+// Example:
+//
+//	var v []struct {
+//		UserID string `json:"user_id,omitempty"`
+//	}
+//
+//	client.AuthSession.Query().
+//		Select(authsession.FieldUserID).
+//		Scan(ctx, &v)
+func (_q *AuthSessionQuery) Select(fields ...string) *AuthSessionSelect {
+	_q.ctx.Fields = append(_q.ctx.Fields, fields...)
+	sbuild := &AuthSessionSelect{AuthSessionQuery: _q}
+	sbuild.label = authsession.Label
+	sbuild.flds, sbuild.scan = &_q.ctx.Fields, sbuild.Scan
+	return sbuild
+}
+
+// Aggregate returns a AuthSessionSelect configured with the given aggregations.
+func (_q *AuthSessionQuery) Aggregate(fns ...AggregateFunc) *AuthSessionSelect {
+	return _q.Select().Aggregate(fns...)
+}
+
+func (_q *AuthSessionQuery) prepareQuery(ctx context.Context) error {
+	for _, inter := range _q.inters {
+		if inter == nil {
+			return fmt.Errorf("db: uninitialized interceptor (forgotten import db/runtime?)")
+		}
+		if trv, ok := inter.(Traverser); ok {
+			if err := trv.Traverse(ctx, _q); err != nil {
+				return err
+			}
+		}
+	}
+	for _, f := range _q.ctx.Fields {
+		if !authsession.ValidColumn(f) {
+			return &ValidationError{Name: f, err: fmt.Errorf("db: invalid field %q for query", f)}
+		}
+	}
+	if _q.path != nil {
+		prev, err := _q.path(ctx)
+		if err != nil {
+			return err
+		}
+		_q.sql = prev
+	}
+	return nil
+}
+
+func (_q *AuthSessionQuery) sqlAll(ctx context.Context, hooks ...queryHook) ([]*AuthSession, error) {
+	var (
+		nodes = []*AuthSession{}
+		_spec = _q.querySpec()
+	)
+	_spec.ScanValues = func(columns []string) ([]any, error) {
+		return (*AuthSession).scanValues(nil, columns)
+	}
+	_spec.Assign = func(columns []string, values []any) error {
+		node := &AuthSession{config: _q.config}
+		nodes = append(nodes, node)
+		return node.assignValues(columns, values)
+	}
+	for i := range hooks {
+		hooks[i](ctx, _spec)
+	}
+	if err := sqlgraph.QueryNodes(ctx, _q.driver, _spec); err != nil {
+		return nil, err
+	}
+	if len(nodes) == 0 {
+		return nodes, nil
+	}
+	return nodes, nil
+}
+
+func (_q *AuthSessionQuery) sqlCount(ctx context.Context) (int, error) {
+	_spec := _q.querySpec()
+	_spec.Node.Columns = _q.ctx.Fields
+	if len(_q.ctx.Fields) > 0 {
+		_spec.Unique = _q.ctx.Unique != nil && *_q.ctx.Unique
+	}
+	return sqlgraph.CountNodes(ctx, _q.driver, _spec)
+}
+
+func (_q *AuthSessionQuery) querySpec() *sqlgraph.QuerySpec {
+	_spec := sqlgraph.NewQuerySpec(authsession.Table, authsession.Columns, sqlgraph.NewFieldSpec(authsession.FieldID, field.TypeString))
+	_spec.From = _q.sql
+	if unique := _q.ctx.Unique; unique != nil {
+		_spec.Unique = *unique
+	} else if _q.path != nil {
+		_spec.Unique = true
+	}
+	if fields := _q.ctx.Fields; len(fields) > 0 {
+		_spec.Node.Columns = make([]string, 0, len(fields))
+		_spec.Node.Columns = append(_spec.Node.Columns, authsession.FieldID)
+		for i := range fields {
+			if fields[i] != authsession.FieldID {
+				_spec.Node.Columns = append(_spec.Node.Columns, fields[i])
+			}
+		}
+	}
+	if ps := _q.predicates; len(ps) > 0 {
+		_spec.Predicate = func(selector *sql.Selector) {
+			for i := range ps {
+				ps[i](selector)
+			}
+		}
+	}
+	if limit := _q.ctx.Limit; limit != nil {
+		_spec.Limit = *limit
+	}
+	if offset := _q.ctx.Offset; offset != nil {
+		_spec.Offset = *offset
+	}
+	if ps := _q.order; len(ps) > 0 {
+		_spec.Order = func(selector *sql.Selector) {
+			for i := range ps {
+				ps[i](selector)
+			}
+		}
+	}
+	return _spec
+}
+
+func (_q *AuthSessionQuery) sqlQuery(ctx context.Context) *sql.Selector {
+	builder := sql.Dialect(_q.driver.Dialect())
+	t1 := builder.Table(authsession.Table)
+	columns := _q.ctx.Fields
+	if len(columns) == 0 {
+		columns = authsession.Columns
+	}
+	selector := builder.Select(t1.Columns(columns...)...).From(t1)
+	if _q.sql != nil {
+		selector = _q.sql
+		selector.Select(selector.Columns(columns...)...)
+	}
+	if _q.ctx.Unique != nil && *_q.ctx.Unique {
+		selector.Distinct()
+	}
+	for _, p := range _q.predicates {
+		p(selector)
+	}
+	for _, p := range _q.order {
+		p(selector)
+	}
+	if offset := _q.ctx.Offset; offset != nil {
+		// limit is mandatory for offset clause. We start
+		// with default value, and override it below if needed.
+		selector.Offset(*offset).Limit(math.MaxInt32)
+	}
+	if limit := _q.ctx.Limit; limit != nil {
+		selector.Limit(*limit)
+	}
+	return selector
+}
+
+// AuthSessionGroupBy is the group-by builder for AuthSession entities.
+type AuthSessionGroupBy struct {
+	selector
+	build *AuthSessionQuery
+}
+
+// Aggregate adds the given aggregation functions to the group-by query.
+func (_g *AuthSessionGroupBy) Aggregate(fns ...AggregateFunc) *AuthSessionGroupBy {
+	_g.fns = append(_g.fns, fns...)
+	return _g
+}
+
+// Scan applies the selector query and scans the result into the given value.
+func (_g *AuthSessionGroupBy) Scan(ctx context.Context, v any) error {
+	ctx = setContextOp(ctx, _g.build.ctx, ent.OpQueryGroupBy)
+	if err := _g.build.prepareQuery(ctx); err != nil {
+		return err
+	}
+	return scanWithInterceptors[*AuthSessionQuery, *AuthSessionGroupBy](ctx, _g.build, _g, _g.build.inters, v)
+}
+
+func (_g *AuthSessionGroupBy) sqlScan(ctx context.Context, root *AuthSessionQuery, v any) error {
+	selector := root.sqlQuery(ctx).Select()
+	aggregation := make([]string, 0, len(_g.fns))
+	for _, fn := range _g.fns {
+		aggregation = append(aggregation, fn(selector))
+	}
+	if len(selector.SelectedColumns()) == 0 {
+		columns := make([]string, 0, len(*_g.flds)+len(_g.fns))
+		for _, f := range *_g.flds {
+			columns = append(columns, selector.C(f))
+		}
+		columns = append(columns, aggregation...)
+		selector.Select(columns...)
+	}
+	selector.GroupBy(selector.Columns(*_g.flds...)...)
+	if err := selector.Err(); err != nil {
+		return err
+	}
+	rows := &sql.Rows{}
+	query, args := selector.Query()
+	if err := _g.build.driver.Query(ctx, query, args, rows); err != nil {
+		return err
+	}
+	defer rows.Close()
+	return sql.ScanSlice(rows, v)
+}
+
+// AuthSessionSelect is the builder for selecting fields of AuthSession entities.
+type AuthSessionSelect struct {
+	*AuthSessionQuery
+	selector
+}
+
+// Aggregate adds the given aggregation functions to the selector query.
+func (_s *AuthSessionSelect) Aggregate(fns ...AggregateFunc) *AuthSessionSelect {
+	_s.fns = append(_s.fns, fns...)
+	return _s
+}
+
+// Scan applies the selector query and scans the result into the given value.
+func (_s *AuthSessionSelect) Scan(ctx context.Context, v any) error {
+	ctx = setContextOp(ctx, _s.ctx, ent.OpQuerySelect)
+	if err := _s.prepareQuery(ctx); err != nil {
+		return err
+	}
+	return scanWithInterceptors[*AuthSessionQuery, *AuthSessionSelect](ctx, _s.AuthSessionQuery, _s, _s.inters, v)
+}
+
+func (_s *AuthSessionSelect) sqlScan(ctx context.Context, root *AuthSessionQuery, v any) error {
+	selector := root.sqlQuery(ctx)
+	aggregation := make([]string, 0, len(_s.fns))
+	for _, fn := range _s.fns {
+		aggregation = append(aggregation, fn(selector))
+	}
+	switch n := len(*_s.selector.flds); {
+	case n == 0 && len(aggregation) > 0:
+		selector.Select(aggregation...)
+	case n != 0 && len(aggregation) > 0:
+		selector.AppendSelect(aggregation...)
+	}
+	rows := &sql.Rows{}
+	query, args := selector.Query()
+	if err := _s.driver.Query(ctx, query, args, rows); err != nil {
+		return err
+	}
+	defer rows.Close()
+	return sql.ScanSlice(rows, v)
+}
diff --git a/storage/ent/db/authsession_update.go b/storage/ent/db/authsession_update.go
new file mode 100644
index 0000000000..389a92c977
--- /dev/null
+++ b/storage/ent/db/authsession_update.go
@@ -0,0 +1,582 @@
+// Code generated by ent, DO NOT EDIT.
+
+package db
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"time"
+
+	"entgo.io/ent/dialect/sql"
+	"entgo.io/ent/dialect/sql/sqlgraph"
+	"entgo.io/ent/schema/field"
+	"github.com/dexidp/dex/storage/ent/db/authsession"
+	"github.com/dexidp/dex/storage/ent/db/predicate"
+)
+
+// AuthSessionUpdate is the builder for updating AuthSession entities.
+type AuthSessionUpdate struct {
+	config
+	hooks    []Hook
+	mutation *AuthSessionMutation
+}
+
+// Where appends a list predicates to the AuthSessionUpdate builder.
+func (_u *AuthSessionUpdate) Where(ps ...predicate.AuthSession) *AuthSessionUpdate {
+	_u.mutation.Where(ps...)
+	return _u
+}
+
+// SetUserID sets the "user_id" field.
+func (_u *AuthSessionUpdate) SetUserID(v string) *AuthSessionUpdate {
+	_u.mutation.SetUserID(v)
+	return _u
+}
+
+// SetNillableUserID sets the "user_id" field if the given value is not nil.
+func (_u *AuthSessionUpdate) SetNillableUserID(v *string) *AuthSessionUpdate {
+	if v != nil {
+		_u.SetUserID(*v)
+	}
+	return _u
+}
+
+// SetConnectorID sets the "connector_id" field.
+func (_u *AuthSessionUpdate) SetConnectorID(v string) *AuthSessionUpdate {
+	_u.mutation.SetConnectorID(v)
+	return _u
+}
+
+// SetNillableConnectorID sets the "connector_id" field if the given value is not nil.
+func (_u *AuthSessionUpdate) SetNillableConnectorID(v *string) *AuthSessionUpdate {
+	if v != nil {
+		_u.SetConnectorID(*v)
+	}
+	return _u
+}
+
+// SetSecret sets the "secret" field.
+func (_u *AuthSessionUpdate) SetSecret(v string) *AuthSessionUpdate {
+	_u.mutation.SetSecret(v)
+	return _u
+}
+
+// SetNillableSecret sets the "secret" field if the given value is not nil.
+func (_u *AuthSessionUpdate) SetNillableSecret(v *string) *AuthSessionUpdate {
+	if v != nil {
+		_u.SetSecret(*v)
+	}
+	return _u
+}
+
+// SetClientStates sets the "client_states" field.
+func (_u *AuthSessionUpdate) SetClientStates(v []byte) *AuthSessionUpdate {
+	_u.mutation.SetClientStates(v)
+	return _u
+}
+
+// SetCreatedAt sets the "created_at" field.
+func (_u *AuthSessionUpdate) SetCreatedAt(v time.Time) *AuthSessionUpdate {
+	_u.mutation.SetCreatedAt(v)
+	return _u
+}
+
+// SetNillableCreatedAt sets the "created_at" field if the given value is not nil.
+func (_u *AuthSessionUpdate) SetNillableCreatedAt(v *time.Time) *AuthSessionUpdate {
+	if v != nil {
+		_u.SetCreatedAt(*v)
+	}
+	return _u
+}
+
+// SetLastActivity sets the "last_activity" field.
+func (_u *AuthSessionUpdate) SetLastActivity(v time.Time) *AuthSessionUpdate {
+	_u.mutation.SetLastActivity(v)
+	return _u
+}
+
+// SetNillableLastActivity sets the "last_activity" field if the given value is not nil.
+func (_u *AuthSessionUpdate) SetNillableLastActivity(v *time.Time) *AuthSessionUpdate {
+	if v != nil {
+		_u.SetLastActivity(*v)
+	}
+	return _u
+}
+
+// SetIPAddress sets the "ip_address" field.
+func (_u *AuthSessionUpdate) SetIPAddress(v string) *AuthSessionUpdate {
+	_u.mutation.SetIPAddress(v)
+	return _u
+}
+
+// SetNillableIPAddress sets the "ip_address" field if the given value is not nil.
+func (_u *AuthSessionUpdate) SetNillableIPAddress(v *string) *AuthSessionUpdate {
+	if v != nil {
+		_u.SetIPAddress(*v)
+	}
+	return _u
+}
+
+// SetUserAgent sets the "user_agent" field.
+func (_u *AuthSessionUpdate) SetUserAgent(v string) *AuthSessionUpdate {
+	_u.mutation.SetUserAgent(v)
+	return _u
+}
+
+// SetNillableUserAgent sets the "user_agent" field if the given value is not nil.
+func (_u *AuthSessionUpdate) SetNillableUserAgent(v *string) *AuthSessionUpdate {
+	if v != nil {
+		_u.SetUserAgent(*v)
+	}
+	return _u
+}
+
+// SetAbsoluteExpiry sets the "absolute_expiry" field.
+func (_u *AuthSessionUpdate) SetAbsoluteExpiry(v time.Time) *AuthSessionUpdate {
+	_u.mutation.SetAbsoluteExpiry(v)
+	return _u
+}
+
+// SetNillableAbsoluteExpiry sets the "absolute_expiry" field if the given value is not nil.
+func (_u *AuthSessionUpdate) SetNillableAbsoluteExpiry(v *time.Time) *AuthSessionUpdate {
+	if v != nil {
+		_u.SetAbsoluteExpiry(*v)
+	}
+	return _u
+}
+
+// SetIdleExpiry sets the "idle_expiry" field.
+func (_u *AuthSessionUpdate) SetIdleExpiry(v time.Time) *AuthSessionUpdate {
+	_u.mutation.SetIdleExpiry(v)
+	return _u
+}
+
+// SetNillableIdleExpiry sets the "idle_expiry" field if the given value is not nil.
+func (_u *AuthSessionUpdate) SetNillableIdleExpiry(v *time.Time) *AuthSessionUpdate {
+	if v != nil {
+		_u.SetIdleExpiry(*v)
+	}
+	return _u
+}
+
+// SetLogoutState sets the "logout_state" field.
+func (_u *AuthSessionUpdate) SetLogoutState(v []byte) *AuthSessionUpdate {
+	_u.mutation.SetLogoutState(v)
+	return _u
+}
+
+// ClearLogoutState clears the value of the "logout_state" field.
+func (_u *AuthSessionUpdate) ClearLogoutState() *AuthSessionUpdate {
+	_u.mutation.ClearLogoutState()
+	return _u
+}
+
+// Mutation returns the AuthSessionMutation object of the builder.
+func (_u *AuthSessionUpdate) Mutation() *AuthSessionMutation {
+	return _u.mutation
+}
+
+// Save executes the query and returns the number of nodes affected by the update operation.
+func (_u *AuthSessionUpdate) Save(ctx context.Context) (int, error) {
+	return withHooks(ctx, _u.sqlSave, _u.mutation, _u.hooks)
+}
+
+// SaveX is like Save, but panics if an error occurs.
+func (_u *AuthSessionUpdate) SaveX(ctx context.Context) int {
+	affected, err := _u.Save(ctx)
+	if err != nil {
+		panic(err)
+	}
+	return affected
+}
+
+// Exec executes the query.
+func (_u *AuthSessionUpdate) Exec(ctx context.Context) error {
+	_, err := _u.Save(ctx)
+	return err
+}
+
+// ExecX is like Exec, but panics if an error occurs.
+func (_u *AuthSessionUpdate) ExecX(ctx context.Context) {
+	if err := _u.Exec(ctx); err != nil {
+		panic(err)
+	}
+}
+
+// check runs all checks and user-defined validators on the builder.
+func (_u *AuthSessionUpdate) check() error {
+	if v, ok := _u.mutation.UserID(); ok {
+		if err := authsession.UserIDValidator(v); err != nil {
+			return &ValidationError{Name: "user_id", err: fmt.Errorf(`db: validator failed for field "AuthSession.user_id": %w`, err)}
+		}
+	}
+	if v, ok := _u.mutation.ConnectorID(); ok {
+		if err := authsession.ConnectorIDValidator(v); err != nil {
+			return &ValidationError{Name: "connector_id", err: fmt.Errorf(`db: validator failed for field "AuthSession.connector_id": %w`, err)}
+		}
+	}
+	if v, ok := _u.mutation.Secret(); ok {
+		if err := authsession.SecretValidator(v); err != nil {
+			return &ValidationError{Name: "secret", err: fmt.Errorf(`db: validator failed for field "AuthSession.secret": %w`, err)}
+		}
+	}
+	return nil
+}
+
+func (_u *AuthSessionUpdate) sqlSave(ctx context.Context) (_node int, err error) {
+	if err := _u.check(); err != nil {
+		return _node, err
+	}
+	_spec := sqlgraph.NewUpdateSpec(authsession.Table, authsession.Columns, sqlgraph.NewFieldSpec(authsession.FieldID, field.TypeString))
+	if ps := _u.mutation.predicates; len(ps) > 0 {
+		_spec.Predicate = func(selector *sql.Selector) {
+			for i := range ps {
+				ps[i](selector)
+			}
+		}
+	}
+	if value, ok := _u.mutation.UserID(); ok {
+		_spec.SetField(authsession.FieldUserID, field.TypeString, value)
+	}
+	if value, ok := _u.mutation.ConnectorID(); ok {
+		_spec.SetField(authsession.FieldConnectorID, field.TypeString, value)
+	}
+	if value, ok := _u.mutation.Secret(); ok {
+		_spec.SetField(authsession.FieldSecret, field.TypeString, value)
+	}
+	if value, ok := _u.mutation.ClientStates(); ok {
+		_spec.SetField(authsession.FieldClientStates, field.TypeBytes, value)
+	}
+	if value, ok := _u.mutation.CreatedAt(); ok {
+		_spec.SetField(authsession.FieldCreatedAt, field.TypeTime, value)
+	}
+	if value, ok := _u.mutation.LastActivity(); ok {
+		_spec.SetField(authsession.FieldLastActivity, field.TypeTime, value)
+	}
+	if value, ok := _u.mutation.IPAddress(); ok {
+		_spec.SetField(authsession.FieldIPAddress, field.TypeString, value)
+	}
+	if value, ok := _u.mutation.UserAgent(); ok {
+		_spec.SetField(authsession.FieldUserAgent, field.TypeString, value)
+	}
+	if value, ok := _u.mutation.AbsoluteExpiry(); ok {
+		_spec.SetField(authsession.FieldAbsoluteExpiry, field.TypeTime, value)
+	}
+	if value, ok := _u.mutation.IdleExpiry(); ok {
+		_spec.SetField(authsession.FieldIdleExpiry, field.TypeTime, value)
+	}
+	if value, ok := _u.mutation.LogoutState(); ok {
+		_spec.SetField(authsession.FieldLogoutState, field.TypeBytes, value)
+	}
+	if _u.mutation.LogoutStateCleared() {
+		_spec.ClearField(authsession.FieldLogoutState, field.TypeBytes)
+	}
+	if _node, err = sqlgraph.UpdateNodes(ctx, _u.driver, _spec); err != nil {
+		if _, ok := err.(*sqlgraph.NotFoundError); ok {
+			err = &NotFoundError{authsession.Label}
+		} else if sqlgraph.IsConstraintError(err) {
+			err = &ConstraintError{msg: err.Error(), wrap: err}
+		}
+		return 0, err
+	}
+	_u.mutation.done = true
+	return _node, nil
+}
+
+// AuthSessionUpdateOne is the builder for updating a single AuthSession entity.
+type AuthSessionUpdateOne struct {
+	config
+	fields   []string
+	hooks    []Hook
+	mutation *AuthSessionMutation
+}
+
+// SetUserID sets the "user_id" field.
+func (_u *AuthSessionUpdateOne) SetUserID(v string) *AuthSessionUpdateOne {
+	_u.mutation.SetUserID(v)
+	return _u
+}
+
+// SetNillableUserID sets the "user_id" field if the given value is not nil.
+func (_u *AuthSessionUpdateOne) SetNillableUserID(v *string) *AuthSessionUpdateOne {
+	if v != nil {
+		_u.SetUserID(*v)
+	}
+	return _u
+}
+
+// SetConnectorID sets the "connector_id" field.
+func (_u *AuthSessionUpdateOne) SetConnectorID(v string) *AuthSessionUpdateOne {
+	_u.mutation.SetConnectorID(v)
+	return _u
+}
+
+// SetNillableConnectorID sets the "connector_id" field if the given value is not nil.
+func (_u *AuthSessionUpdateOne) SetNillableConnectorID(v *string) *AuthSessionUpdateOne {
+	if v != nil {
+		_u.SetConnectorID(*v)
+	}
+	return _u
+}
+
+// SetSecret sets the "secret" field.
+func (_u *AuthSessionUpdateOne) SetSecret(v string) *AuthSessionUpdateOne {
+	_u.mutation.SetSecret(v)
+	return _u
+}
+
+// SetNillableSecret sets the "secret" field if the given value is not nil.
+func (_u *AuthSessionUpdateOne) SetNillableSecret(v *string) *AuthSessionUpdateOne {
+	if v != nil {
+		_u.SetSecret(*v)
+	}
+	return _u
+}
+
+// SetClientStates sets the "client_states" field.
+func (_u *AuthSessionUpdateOne) SetClientStates(v []byte) *AuthSessionUpdateOne {
+	_u.mutation.SetClientStates(v)
+	return _u
+}
+
+// SetCreatedAt sets the "created_at" field.
+func (_u *AuthSessionUpdateOne) SetCreatedAt(v time.Time) *AuthSessionUpdateOne {
+	_u.mutation.SetCreatedAt(v)
+	return _u
+}
+
+// SetNillableCreatedAt sets the "created_at" field if the given value is not nil.
+func (_u *AuthSessionUpdateOne) SetNillableCreatedAt(v *time.Time) *AuthSessionUpdateOne {
+	if v != nil {
+		_u.SetCreatedAt(*v)
+	}
+	return _u
+}
+
+// SetLastActivity sets the "last_activity" field.
+func (_u *AuthSessionUpdateOne) SetLastActivity(v time.Time) *AuthSessionUpdateOne {
+	_u.mutation.SetLastActivity(v)
+	return _u
+}
+
+// SetNillableLastActivity sets the "last_activity" field if the given value is not nil.
+func (_u *AuthSessionUpdateOne) SetNillableLastActivity(v *time.Time) *AuthSessionUpdateOne {
+	if v != nil {
+		_u.SetLastActivity(*v)
+	}
+	return _u
+}
+
+// SetIPAddress sets the "ip_address" field.
+func (_u *AuthSessionUpdateOne) SetIPAddress(v string) *AuthSessionUpdateOne {
+	_u.mutation.SetIPAddress(v)
+	return _u
+}
+
+// SetNillableIPAddress sets the "ip_address" field if the given value is not nil.
+func (_u *AuthSessionUpdateOne) SetNillableIPAddress(v *string) *AuthSessionUpdateOne {
+	if v != nil {
+		_u.SetIPAddress(*v)
+	}
+	return _u
+}
+
+// SetUserAgent sets the "user_agent" field.
+func (_u *AuthSessionUpdateOne) SetUserAgent(v string) *AuthSessionUpdateOne {
+	_u.mutation.SetUserAgent(v)
+	return _u
+}
+
+// SetNillableUserAgent sets the "user_agent" field if the given value is not nil.
+func (_u *AuthSessionUpdateOne) SetNillableUserAgent(v *string) *AuthSessionUpdateOne {
+	if v != nil {
+		_u.SetUserAgent(*v)
+	}
+	return _u
+}
+
+// SetAbsoluteExpiry sets the "absolute_expiry" field.
+func (_u *AuthSessionUpdateOne) SetAbsoluteExpiry(v time.Time) *AuthSessionUpdateOne {
+	_u.mutation.SetAbsoluteExpiry(v)
+	return _u
+}
+
+// SetNillableAbsoluteExpiry sets the "absolute_expiry" field if the given value is not nil.
+func (_u *AuthSessionUpdateOne) SetNillableAbsoluteExpiry(v *time.Time) *AuthSessionUpdateOne {
+	if v != nil {
+		_u.SetAbsoluteExpiry(*v)
+	}
+	return _u
+}
+
+// SetIdleExpiry sets the "idle_expiry" field.
+func (_u *AuthSessionUpdateOne) SetIdleExpiry(v time.Time) *AuthSessionUpdateOne {
+	_u.mutation.SetIdleExpiry(v)
+	return _u
+}
+
+// SetNillableIdleExpiry sets the "idle_expiry" field if the given value is not nil.
+func (_u *AuthSessionUpdateOne) SetNillableIdleExpiry(v *time.Time) *AuthSessionUpdateOne {
+	if v != nil {
+		_u.SetIdleExpiry(*v)
+	}
+	return _u
+}
+
+// SetLogoutState sets the "logout_state" field.
+func (_u *AuthSessionUpdateOne) SetLogoutState(v []byte) *AuthSessionUpdateOne {
+	_u.mutation.SetLogoutState(v)
+	return _u
+}
+
+// ClearLogoutState clears the value of the "logout_state" field.
+func (_u *AuthSessionUpdateOne) ClearLogoutState() *AuthSessionUpdateOne {
+	_u.mutation.ClearLogoutState()
+	return _u
+}
+
+// Mutation returns the AuthSessionMutation object of the builder.
+func (_u *AuthSessionUpdateOne) Mutation() *AuthSessionMutation {
+	return _u.mutation
+}
+
+// Where appends a list predicates to the AuthSessionUpdate builder.
+func (_u *AuthSessionUpdateOne) Where(ps ...predicate.AuthSession) *AuthSessionUpdateOne {
+	_u.mutation.Where(ps...)
+	return _u
+}
+
+// Select allows selecting one or more fields (columns) of the returned entity.
+// The default is selecting all fields defined in the entity schema.
+func (_u *AuthSessionUpdateOne) Select(field string, fields ...string) *AuthSessionUpdateOne {
+	_u.fields = append([]string{field}, fields...)
+	return _u
+}
+
+// Save executes the query and returns the updated AuthSession entity.
+func (_u *AuthSessionUpdateOne) Save(ctx context.Context) (*AuthSession, error) {
+	return withHooks(ctx, _u.sqlSave, _u.mutation, _u.hooks)
+}
+
+// SaveX is like Save, but panics if an error occurs.
+func (_u *AuthSessionUpdateOne) SaveX(ctx context.Context) *AuthSession {
+	node, err := _u.Save(ctx)
+	if err != nil {
+		panic(err)
+	}
+	return node
+}
+
+// Exec executes the query on the entity.
+func (_u *AuthSessionUpdateOne) Exec(ctx context.Context) error {
+	_, err := _u.Save(ctx)
+	return err
+}
+
+// ExecX is like Exec, but panics if an error occurs.
+func (_u *AuthSessionUpdateOne) ExecX(ctx context.Context) {
+	if err := _u.Exec(ctx); err != nil {
+		panic(err)
+	}
+}
+
+// check runs all checks and user-defined validators on the builder.
+func (_u *AuthSessionUpdateOne) check() error {
+	if v, ok := _u.mutation.UserID(); ok {
+		if err := authsession.UserIDValidator(v); err != nil {
+			return &ValidationError{Name: "user_id", err: fmt.Errorf(`db: validator failed for field "AuthSession.user_id": %w`, err)}
+		}
+	}
+	if v, ok := _u.mutation.ConnectorID(); ok {
+		if err := authsession.ConnectorIDValidator(v); err != nil {
+			return &ValidationError{Name: "connector_id", err: fmt.Errorf(`db: validator failed for field "AuthSession.connector_id": %w`, err)}
+		}
+	}
+	if v, ok := _u.mutation.Secret(); ok {
+		if err := authsession.SecretValidator(v); err != nil {
+			return &ValidationError{Name: "secret", err: fmt.Errorf(`db: validator failed for field "AuthSession.secret": %w`, err)}
+		}
+	}
+	return nil
+}
+
+func (_u *AuthSessionUpdateOne) sqlSave(ctx context.Context) (_node *AuthSession, err error) {
+	if err := _u.check(); err != nil {
+		return _node, err
+	}
+	_spec := sqlgraph.NewUpdateSpec(authsession.Table, authsession.Columns, sqlgraph.NewFieldSpec(authsession.FieldID, field.TypeString))
+	id, ok := _u.mutation.ID()
+	if !ok {
+		return nil, &ValidationError{Name: "id", err: errors.New(`db: missing "AuthSession.id" for update`)}
+	}
+	_spec.Node.ID.Value = id
+	if fields := _u.fields; len(fields) > 0 {
+		_spec.Node.Columns = make([]string, 0, len(fields))
+		_spec.Node.Columns = append(_spec.Node.Columns, authsession.FieldID)
+		for _, f := range fields {
+			if !authsession.ValidColumn(f) {
+				return nil, &ValidationError{Name: f, err: fmt.Errorf("db: invalid field %q for query", f)}
+			}
+			if f != authsession.FieldID {
+				_spec.Node.Columns = append(_spec.Node.Columns, f)
+			}
+		}
+	}
+	if ps := _u.mutation.predicates; len(ps) > 0 {
+		_spec.Predicate = func(selector *sql.Selector) {
+			for i := range ps {
+				ps[i](selector)
+			}
+		}
+	}
+	if value, ok := _u.mutation.UserID(); ok {
+		_spec.SetField(authsession.FieldUserID, field.TypeString, value)
+	}
+	if value, ok := _u.mutation.ConnectorID(); ok {
+		_spec.SetField(authsession.FieldConnectorID, field.TypeString, value)
+	}
+	if value, ok := _u.mutation.Secret(); ok {
+		_spec.SetField(authsession.FieldSecret, field.TypeString, value)
+	}
+	if value, ok := _u.mutation.ClientStates(); ok {
+		_spec.SetField(authsession.FieldClientStates, field.TypeBytes, value)
+	}
+	if value, ok := _u.mutation.CreatedAt(); ok {
+		_spec.SetField(authsession.FieldCreatedAt, field.TypeTime, value)
+	}
+	if value, ok := _u.mutation.LastActivity(); ok {
+		_spec.SetField(authsession.FieldLastActivity, field.TypeTime, value)
+	}
+	if value, ok := _u.mutation.IPAddress(); ok {
+		_spec.SetField(authsession.FieldIPAddress, field.TypeString, value)
+	}
+	if value, ok := _u.mutation.UserAgent(); ok {
+		_spec.SetField(authsession.FieldUserAgent, field.TypeString, value)
+	}
+	if value, ok := _u.mutation.AbsoluteExpiry(); ok {
+		_spec.SetField(authsession.FieldAbsoluteExpiry, field.TypeTime, value)
+	}
+	if value, ok := _u.mutation.IdleExpiry(); ok {
+		_spec.SetField(authsession.FieldIdleExpiry, field.TypeTime, value)
+	}
+	if value, ok := _u.mutation.LogoutState(); ok {
+		_spec.SetField(authsession.FieldLogoutState, field.TypeBytes, value)
+	}
+	if _u.mutation.LogoutStateCleared() {
+		_spec.ClearField(authsession.FieldLogoutState, field.TypeBytes)
+	}
+	_node = &AuthSession{config: _u.config}
+	_spec.Assign = _node.assignValues
+	_spec.ScanValues = _node.scanValues
+	if err = sqlgraph.UpdateNode(ctx, _u.driver, _spec); err != nil {
+		if _, ok := err.(*sqlgraph.NotFoundError); ok {
+			err = &NotFoundError{authsession.Label}
+		} else if sqlgraph.IsConstraintError(err) {
+			err = &ConstraintError{msg: err.Error(), wrap: err}
+		}
+		return nil, err
+	}
+	_u.mutation.done = true
+	return _node, nil
+}
diff --git a/storage/ent/db/client.go b/storage/ent/db/client.go
index 4bf5586513..ffd70adda5 100644
--- a/storage/ent/db/client.go
+++ b/storage/ent/db/client.go
@@ -7,11 +7,16 @@ import (
 	"errors"
 	"fmt"
 	"log"
+	"reflect"
 
 	"github.com/dexidp/dex/storage/ent/db/migrate"
 
+	"entgo.io/ent"
+	"entgo.io/ent/dialect"
+	"entgo.io/ent/dialect/sql"
 	"github.com/dexidp/dex/storage/ent/db/authcode"
 	"github.com/dexidp/dex/storage/ent/db/authrequest"
+	"github.com/dexidp/dex/storage/ent/db/authsession"
 	"github.com/dexidp/dex/storage/ent/db/connector"
 	"github.com/dexidp/dex/storage/ent/db/devicerequest"
 	"github.com/dexidp/dex/storage/ent/db/devicetoken"
@@ -20,9 +25,7 @@ import (
 	"github.com/dexidp/dex/storage/ent/db/offlinesession"
 	"github.com/dexidp/dex/storage/ent/db/password"
 	"github.com/dexidp/dex/storage/ent/db/refreshtoken"
-
-	"entgo.io/ent/dialect"
-	"entgo.io/ent/dialect/sql"
+	"github.com/dexidp/dex/storage/ent/db/useridentity"
 )
 
 // Client is the client that holds all ent builders.
@@ -34,6 +37,8 @@ type Client struct {
 	AuthCode *AuthCodeClient
 	// AuthRequest is the client for interacting with the AuthRequest builders.
 	AuthRequest *AuthRequestClient
+	// AuthSession is the client for interacting with the AuthSession builders.
+	AuthSession *AuthSessionClient
 	// Connector is the client for interacting with the Connector builders.
 	Connector *ConnectorClient
 	// DeviceRequest is the client for interacting with the DeviceRequest builders.
@@ -50,13 +55,13 @@ type Client struct {
 	Password *PasswordClient
 	// RefreshToken is the client for interacting with the RefreshToken builders.
 	RefreshToken *RefreshTokenClient
+	// UserIdentity is the client for interacting with the UserIdentity builders.
+	UserIdentity *UserIdentityClient
 }
 
 // NewClient creates a new client configured with the given options.
 func NewClient(opts ...Option) *Client {
-	cfg := config{log: log.Println, hooks: &hooks{}}
-	cfg.options(opts...)
-	client := &Client{config: cfg}
+	client := &Client{config: newConfig(opts...)}
 	client.init()
 	return client
 }
@@ -65,6 +70,7 @@ func (c *Client) init() {
 	c.Schema = migrate.NewSchema(c.driver)
 	c.AuthCode = NewAuthCodeClient(c.config)
 	c.AuthRequest = NewAuthRequestClient(c.config)
+	c.AuthSession = NewAuthSessionClient(c.config)
 	c.Connector = NewConnectorClient(c.config)
 	c.DeviceRequest = NewDeviceRequestClient(c.config)
 	c.DeviceToken = NewDeviceTokenClient(c.config)
@@ -73,6 +79,63 @@ func (c *Client) init() {
 	c.OfflineSession = NewOfflineSessionClient(c.config)
 	c.Password = NewPasswordClient(c.config)
 	c.RefreshToken = NewRefreshTokenClient(c.config)
+	c.UserIdentity = NewUserIdentityClient(c.config)
+}
+
+type (
+	// config is the configuration for the client and its builder.
+	config struct {
+		// driver used for executing database requests.
+		driver dialect.Driver
+		// debug enable a debug logging.
+		debug bool
+		// log used for logging on debug mode.
+		log func(...any)
+		// hooks to execute on mutations.
+		hooks *hooks
+		// interceptors to execute on queries.
+		inters *inters
+	}
+	// Option function to configure the client.
+	Option func(*config)
+)
+
+// newConfig creates a new config for the client.
+func newConfig(opts ...Option) config {
+	cfg := config{log: log.Println, hooks: &hooks{}, inters: &inters{}}
+	cfg.options(opts...)
+	return cfg
+}
+
+// options applies the options on the config object.
+func (c *config) options(opts ...Option) {
+	for _, opt := range opts {
+		opt(c)
+	}
+	if c.debug {
+		c.driver = dialect.Debug(c.driver, c.log)
+	}
+}
+
+// Debug enables debug logging on the ent.Driver.
+func Debug() Option {
+	return func(c *config) {
+		c.debug = true
+	}
+}
+
+// Log sets the logging function for debug mode.
+func Log(fn func(...any)) Option {
+	return func(c *config) {
+		c.log = fn
+	}
+}
+
+// Driver configures the client driver.
+func Driver(driver dialect.Driver) Option {
+	return func(c *config) {
+		c.driver = driver
+	}
 }
 
 // Open opens a database/sql.DB specified by the driver name and
@@ -91,11 +154,14 @@ func Open(driverName, dataSourceName string, options ...Option) (*Client, error)
 	}
 }
 
+// ErrTxStarted is returned when trying to start a new transaction from a transactional client.
+var ErrTxStarted = errors.New("db: cannot start a transaction within a transaction")
+
 // Tx returns a new transactional client. The provided context
 // is used until the transaction is committed or rolled back.
 func (c *Client) Tx(ctx context.Context) (*Tx, error) {
 	if _, ok := c.driver.(*txDriver); ok {
-		return nil, errors.New("db: cannot start a transaction within a transaction")
+		return nil, ErrTxStarted
 	}
 	tx, err := newTx(ctx, c.driver)
 	if err != nil {
@@ -108,6 +174,7 @@ func (c *Client) Tx(ctx context.Context) (*Tx, error) {
 		config:         cfg,
 		AuthCode:       NewAuthCodeClient(cfg),
 		AuthRequest:    NewAuthRequestClient(cfg),
+		AuthSession:    NewAuthSessionClient(cfg),
 		Connector:      NewConnectorClient(cfg),
 		DeviceRequest:  NewDeviceRequestClient(cfg),
 		DeviceToken:    NewDeviceTokenClient(cfg),
@@ -116,6 +183,7 @@ func (c *Client) Tx(ctx context.Context) (*Tx, error) {
 		OfflineSession: NewOfflineSessionClient(cfg),
 		Password:       NewPasswordClient(cfg),
 		RefreshToken:   NewRefreshTokenClient(cfg),
+		UserIdentity:   NewUserIdentityClient(cfg),
 	}, nil
 }
 
@@ -137,6 +205,7 @@ func (c *Client) BeginTx(ctx context.Context, opts *sql.TxOptions) (*Tx, error)
 		config:         cfg,
 		AuthCode:       NewAuthCodeClient(cfg),
 		AuthRequest:    NewAuthRequestClient(cfg),
+		AuthSession:    NewAuthSessionClient(cfg),
 		Connector:      NewConnectorClient(cfg),
 		DeviceRequest:  NewDeviceRequestClient(cfg),
 		DeviceToken:    NewDeviceTokenClient(cfg),
@@ -145,6 +214,7 @@ func (c *Client) BeginTx(ctx context.Context, opts *sql.TxOptions) (*Tx, error)
 		OfflineSession: NewOfflineSessionClient(cfg),
 		Password:       NewPasswordClient(cfg),
 		RefreshToken:   NewRefreshTokenClient(cfg),
+		UserIdentity:   NewUserIdentityClient(cfg),
 	}, nil
 }
 
@@ -154,7 +224,6 @@ func (c *Client) BeginTx(ctx context.Context, opts *sql.TxOptions) (*Tx, error)
 //		AuthCode.
 //		Query().
 //		Count(ctx)
-//
 func (c *Client) Debug() *Client {
 	if c.debug {
 		return c
@@ -174,16 +243,57 @@ func (c *Client) Close() error {
 // Use adds the mutation hooks to all the entity clients.
 // In order to add hooks to a specific client, call: `client.Node.Use(...)`.
 func (c *Client) Use(hooks ...Hook) {
-	c.AuthCode.Use(hooks...)
-	c.AuthRequest.Use(hooks...)
-	c.Connector.Use(hooks...)
-	c.DeviceRequest.Use(hooks...)
-	c.DeviceToken.Use(hooks...)
-	c.Keys.Use(hooks...)
-	c.OAuth2Client.Use(hooks...)
-	c.OfflineSession.Use(hooks...)
-	c.Password.Use(hooks...)
-	c.RefreshToken.Use(hooks...)
+	for _, n := range []interface{ Use(...Hook) }{
+		c.AuthCode, c.AuthRequest, c.AuthSession, c.Connector, c.DeviceRequest,
+		c.DeviceToken, c.Keys, c.OAuth2Client, c.OfflineSession, c.Password,
+		c.RefreshToken, c.UserIdentity,
+	} {
+		n.Use(hooks...)
+	}
+}
+
+// Intercept adds the query interceptors to all the entity clients.
+// In order to add interceptors to a specific client, call: `client.Node.Intercept(...)`.
+func (c *Client) Intercept(interceptors ...Interceptor) {
+	for _, n := range []interface{ Intercept(...Interceptor) }{
+		c.AuthCode, c.AuthRequest, c.AuthSession, c.Connector, c.DeviceRequest,
+		c.DeviceToken, c.Keys, c.OAuth2Client, c.OfflineSession, c.Password,
+		c.RefreshToken, c.UserIdentity,
+	} {
+		n.Intercept(interceptors...)
+	}
+}
+
+// Mutate implements the ent.Mutator interface.
+func (c *Client) Mutate(ctx context.Context, m Mutation) (Value, error) {
+	switch m := m.(type) {
+	case *AuthCodeMutation:
+		return c.AuthCode.mutate(ctx, m)
+	case *AuthRequestMutation:
+		return c.AuthRequest.mutate(ctx, m)
+	case *AuthSessionMutation:
+		return c.AuthSession.mutate(ctx, m)
+	case *ConnectorMutation:
+		return c.Connector.mutate(ctx, m)
+	case *DeviceRequestMutation:
+		return c.DeviceRequest.mutate(ctx, m)
+	case *DeviceTokenMutation:
+		return c.DeviceToken.mutate(ctx, m)
+	case *KeysMutation:
+		return c.Keys.mutate(ctx, m)
+	case *OAuth2ClientMutation:
+		return c.OAuth2Client.mutate(ctx, m)
+	case *OfflineSessionMutation:
+		return c.OfflineSession.mutate(ctx, m)
+	case *PasswordMutation:
+		return c.Password.mutate(ctx, m)
+	case *RefreshTokenMutation:
+		return c.RefreshToken.mutate(ctx, m)
+	case *UserIdentityMutation:
+		return c.UserIdentity.mutate(ctx, m)
+	default:
+		return nil, fmt.Errorf("db: unknown mutation type %T", m)
+	}
 }
 
 // AuthCodeClient is a client for the AuthCode schema.
@@ -202,6 +312,12 @@ func (c *AuthCodeClient) Use(hooks ...Hook) {
 	c.hooks.AuthCode = append(c.hooks.AuthCode, hooks...)
 }
 
+// Intercept adds a list of query interceptors to the interceptors stack.
+// A call to `Intercept(f, g, h)` equals to `authcode.Intercept(f(g(h())))`.
+func (c *AuthCodeClient) Intercept(interceptors ...Interceptor) {
+	c.inters.AuthCode = append(c.inters.AuthCode, interceptors...)
+}
+
 // Create returns a builder for creating a AuthCode entity.
 func (c *AuthCodeClient) Create() *AuthCodeCreate {
 	mutation := newAuthCodeMutation(c.config, OpCreate)
@@ -213,6 +329,21 @@ func (c *AuthCodeClient) CreateBulk(builders ...*AuthCodeCreate) *AuthCodeCreate
 	return &AuthCodeCreateBulk{config: c.config, builders: builders}
 }
 
+// MapCreateBulk creates a bulk creation builder from the given slice. For each item in the slice, the function creates
+// a builder and applies setFunc on it.
+func (c *AuthCodeClient) MapCreateBulk(slice any, setFunc func(*AuthCodeCreate, int)) *AuthCodeCreateBulk {
+	rv := reflect.ValueOf(slice)
+	if rv.Kind() != reflect.Slice {
+		return &AuthCodeCreateBulk{err: fmt.Errorf("calling to AuthCodeClient.MapCreateBulk with wrong type %T, need slice", slice)}
+	}
+	builders := make([]*AuthCodeCreate, rv.Len())
+	for i := 0; i < rv.Len(); i++ {
+		builders[i] = c.Create()
+		setFunc(builders[i], i)
+	}
+	return &AuthCodeCreateBulk{config: c.config, builders: builders}
+}
+
 // Update returns an update builder for AuthCode.
 func (c *AuthCodeClient) Update() *AuthCodeUpdate {
 	mutation := newAuthCodeMutation(c.config, OpUpdate)
@@ -220,8 +351,8 @@ func (c *AuthCodeClient) Update() *AuthCodeUpdate {
 }
 
 // UpdateOne returns an update builder for the given entity.
-func (c *AuthCodeClient) UpdateOne(ac *AuthCode) *AuthCodeUpdateOne {
-	mutation := newAuthCodeMutation(c.config, OpUpdateOne, withAuthCode(ac))
+func (c *AuthCodeClient) UpdateOne(_m *AuthCode) *AuthCodeUpdateOne {
+	mutation := newAuthCodeMutation(c.config, OpUpdateOne, withAuthCode(_m))
 	return &AuthCodeUpdateOne{config: c.config, hooks: c.Hooks(), mutation: mutation}
 }
 
@@ -238,11 +369,11 @@ func (c *AuthCodeClient) Delete() *AuthCodeDelete {
 }
 
 // DeleteOne returns a builder for deleting the given entity.
-func (c *AuthCodeClient) DeleteOne(ac *AuthCode) *AuthCodeDeleteOne {
-	return c.DeleteOneID(ac.ID)
+func (c *AuthCodeClient) DeleteOne(_m *AuthCode) *AuthCodeDeleteOne {
+	return c.DeleteOneID(_m.ID)
 }
 
-// DeleteOne returns a builder for deleting the given entity by its id.
+// DeleteOneID returns a builder for deleting the given entity by its id.
 func (c *AuthCodeClient) DeleteOneID(id string) *AuthCodeDeleteOne {
 	builder := c.Delete().Where(authcode.ID(id))
 	builder.mutation.id = &id
@@ -254,6 +385,8 @@ func (c *AuthCodeClient) DeleteOneID(id string) *AuthCodeDeleteOne {
 func (c *AuthCodeClient) Query() *AuthCodeQuery {
 	return &AuthCodeQuery{
 		config: c.config,
+		ctx:    &QueryContext{Type: TypeAuthCode},
+		inters: c.Interceptors(),
 	}
 }
 
@@ -276,6 +409,26 @@ func (c *AuthCodeClient) Hooks() []Hook {
 	return c.hooks.AuthCode
 }
 
+// Interceptors returns the client interceptors.
+func (c *AuthCodeClient) Interceptors() []Interceptor {
+	return c.inters.AuthCode
+}
+
+func (c *AuthCodeClient) mutate(ctx context.Context, m *AuthCodeMutation) (Value, error) {
+	switch m.Op() {
+	case OpCreate:
+		return (&AuthCodeCreate{config: c.config, hooks: c.Hooks(), mutation: m}).Save(ctx)
+	case OpUpdate:
+		return (&AuthCodeUpdate{config: c.config, hooks: c.Hooks(), mutation: m}).Save(ctx)
+	case OpUpdateOne:
+		return (&AuthCodeUpdateOne{config: c.config, hooks: c.Hooks(), mutation: m}).Save(ctx)
+	case OpDelete, OpDeleteOne:
+		return (&AuthCodeDelete{config: c.config, hooks: c.Hooks(), mutation: m}).Exec(ctx)
+	default:
+		return nil, fmt.Errorf("db: unknown AuthCode mutation op: %q", m.Op())
+	}
+}
+
 // AuthRequestClient is a client for the AuthRequest schema.
 type AuthRequestClient struct {
 	config
@@ -292,6 +445,12 @@ func (c *AuthRequestClient) Use(hooks ...Hook) {
 	c.hooks.AuthRequest = append(c.hooks.AuthRequest, hooks...)
 }
 
+// Intercept adds a list of query interceptors to the interceptors stack.
+// A call to `Intercept(f, g, h)` equals to `authrequest.Intercept(f(g(h())))`.
+func (c *AuthRequestClient) Intercept(interceptors ...Interceptor) {
+	c.inters.AuthRequest = append(c.inters.AuthRequest, interceptors...)
+}
+
 // Create returns a builder for creating a AuthRequest entity.
 func (c *AuthRequestClient) Create() *AuthRequestCreate {
 	mutation := newAuthRequestMutation(c.config, OpCreate)
@@ -303,6 +462,21 @@ func (c *AuthRequestClient) CreateBulk(builders ...*AuthRequestCreate) *AuthRequ
 	return &AuthRequestCreateBulk{config: c.config, builders: builders}
 }
 
+// MapCreateBulk creates a bulk creation builder from the given slice. For each item in the slice, the function creates
+// a builder and applies setFunc on it.
+func (c *AuthRequestClient) MapCreateBulk(slice any, setFunc func(*AuthRequestCreate, int)) *AuthRequestCreateBulk {
+	rv := reflect.ValueOf(slice)
+	if rv.Kind() != reflect.Slice {
+		return &AuthRequestCreateBulk{err: fmt.Errorf("calling to AuthRequestClient.MapCreateBulk with wrong type %T, need slice", slice)}
+	}
+	builders := make([]*AuthRequestCreate, rv.Len())
+	for i := 0; i < rv.Len(); i++ {
+		builders[i] = c.Create()
+		setFunc(builders[i], i)
+	}
+	return &AuthRequestCreateBulk{config: c.config, builders: builders}
+}
+
 // Update returns an update builder for AuthRequest.
 func (c *AuthRequestClient) Update() *AuthRequestUpdate {
 	mutation := newAuthRequestMutation(c.config, OpUpdate)
@@ -310,8 +484,8 @@ func (c *AuthRequestClient) Update() *AuthRequestUpdate {
 }
 
 // UpdateOne returns an update builder for the given entity.
-func (c *AuthRequestClient) UpdateOne(ar *AuthRequest) *AuthRequestUpdateOne {
-	mutation := newAuthRequestMutation(c.config, OpUpdateOne, withAuthRequest(ar))
+func (c *AuthRequestClient) UpdateOne(_m *AuthRequest) *AuthRequestUpdateOne {
+	mutation := newAuthRequestMutation(c.config, OpUpdateOne, withAuthRequest(_m))
 	return &AuthRequestUpdateOne{config: c.config, hooks: c.Hooks(), mutation: mutation}
 }
 
@@ -328,11 +502,11 @@ func (c *AuthRequestClient) Delete() *AuthRequestDelete {
 }
 
 // DeleteOne returns a builder for deleting the given entity.
-func (c *AuthRequestClient) DeleteOne(ar *AuthRequest) *AuthRequestDeleteOne {
-	return c.DeleteOneID(ar.ID)
+func (c *AuthRequestClient) DeleteOne(_m *AuthRequest) *AuthRequestDeleteOne {
+	return c.DeleteOneID(_m.ID)
 }
 
-// DeleteOne returns a builder for deleting the given entity by its id.
+// DeleteOneID returns a builder for deleting the given entity by its id.
 func (c *AuthRequestClient) DeleteOneID(id string) *AuthRequestDeleteOne {
 	builder := c.Delete().Where(authrequest.ID(id))
 	builder.mutation.id = &id
@@ -344,6 +518,8 @@ func (c *AuthRequestClient) DeleteOneID(id string) *AuthRequestDeleteOne {
 func (c *AuthRequestClient) Query() *AuthRequestQuery {
 	return &AuthRequestQuery{
 		config: c.config,
+		ctx:    &QueryContext{Type: TypeAuthRequest},
+		inters: c.Interceptors(),
 	}
 }
 
@@ -366,6 +542,159 @@ func (c *AuthRequestClient) Hooks() []Hook {
 	return c.hooks.AuthRequest
 }
 
+// Interceptors returns the client interceptors.
+func (c *AuthRequestClient) Interceptors() []Interceptor {
+	return c.inters.AuthRequest
+}
+
+func (c *AuthRequestClient) mutate(ctx context.Context, m *AuthRequestMutation) (Value, error) {
+	switch m.Op() {
+	case OpCreate:
+		return (&AuthRequestCreate{config: c.config, hooks: c.Hooks(), mutation: m}).Save(ctx)
+	case OpUpdate:
+		return (&AuthRequestUpdate{config: c.config, hooks: c.Hooks(), mutation: m}).Save(ctx)
+	case OpUpdateOne:
+		return (&AuthRequestUpdateOne{config: c.config, hooks: c.Hooks(), mutation: m}).Save(ctx)
+	case OpDelete, OpDeleteOne:
+		return (&AuthRequestDelete{config: c.config, hooks: c.Hooks(), mutation: m}).Exec(ctx)
+	default:
+		return nil, fmt.Errorf("db: unknown AuthRequest mutation op: %q", m.Op())
+	}
+}
+
+// AuthSessionClient is a client for the AuthSession schema.
+type AuthSessionClient struct {
+	config
+}
+
+// NewAuthSessionClient returns a client for the AuthSession from the given config.
+func NewAuthSessionClient(c config) *AuthSessionClient {
+	return &AuthSessionClient{config: c}
+}
+
+// Use adds a list of mutation hooks to the hooks stack.
+// A call to `Use(f, g, h)` equals to `authsession.Hooks(f(g(h())))`.
+func (c *AuthSessionClient) Use(hooks ...Hook) {
+	c.hooks.AuthSession = append(c.hooks.AuthSession, hooks...)
+}
+
+// Intercept adds a list of query interceptors to the interceptors stack.
+// A call to `Intercept(f, g, h)` equals to `authsession.Intercept(f(g(h())))`.
+func (c *AuthSessionClient) Intercept(interceptors ...Interceptor) {
+	c.inters.AuthSession = append(c.inters.AuthSession, interceptors...)
+}
+
+// Create returns a builder for creating a AuthSession entity.
+func (c *AuthSessionClient) Create() *AuthSessionCreate {
+	mutation := newAuthSessionMutation(c.config, OpCreate)
+	return &AuthSessionCreate{config: c.config, hooks: c.Hooks(), mutation: mutation}
+}
+
+// CreateBulk returns a builder for creating a bulk of AuthSession entities.
+func (c *AuthSessionClient) CreateBulk(builders ...*AuthSessionCreate) *AuthSessionCreateBulk {
+	return &AuthSessionCreateBulk{config: c.config, builders: builders}
+}
+
+// MapCreateBulk creates a bulk creation builder from the given slice. For each item in the slice, the function creates
+// a builder and applies setFunc on it.
+func (c *AuthSessionClient) MapCreateBulk(slice any, setFunc func(*AuthSessionCreate, int)) *AuthSessionCreateBulk {
+	rv := reflect.ValueOf(slice)
+	if rv.Kind() != reflect.Slice {
+		return &AuthSessionCreateBulk{err: fmt.Errorf("calling to AuthSessionClient.MapCreateBulk with wrong type %T, need slice", slice)}
+	}
+	builders := make([]*AuthSessionCreate, rv.Len())
+	for i := 0; i < rv.Len(); i++ {
+		builders[i] = c.Create()
+		setFunc(builders[i], i)
+	}
+	return &AuthSessionCreateBulk{config: c.config, builders: builders}
+}
+
+// Update returns an update builder for AuthSession.
+func (c *AuthSessionClient) Update() *AuthSessionUpdate {
+	mutation := newAuthSessionMutation(c.config, OpUpdate)
+	return &AuthSessionUpdate{config: c.config, hooks: c.Hooks(), mutation: mutation}
+}
+
+// UpdateOne returns an update builder for the given entity.
+func (c *AuthSessionClient) UpdateOne(_m *AuthSession) *AuthSessionUpdateOne {
+	mutation := newAuthSessionMutation(c.config, OpUpdateOne, withAuthSession(_m))
+	return &AuthSessionUpdateOne{config: c.config, hooks: c.Hooks(), mutation: mutation}
+}
+
+// UpdateOneID returns an update builder for the given id.
+func (c *AuthSessionClient) UpdateOneID(id string) *AuthSessionUpdateOne {
+	mutation := newAuthSessionMutation(c.config, OpUpdateOne, withAuthSessionID(id))
+	return &AuthSessionUpdateOne{config: c.config, hooks: c.Hooks(), mutation: mutation}
+}
+
+// Delete returns a delete builder for AuthSession.
+func (c *AuthSessionClient) Delete() *AuthSessionDelete {
+	mutation := newAuthSessionMutation(c.config, OpDelete)
+	return &AuthSessionDelete{config: c.config, hooks: c.Hooks(), mutation: mutation}
+}
+
+// DeleteOne returns a builder for deleting the given entity.
+func (c *AuthSessionClient) DeleteOne(_m *AuthSession) *AuthSessionDeleteOne {
+	return c.DeleteOneID(_m.ID)
+}
+
+// DeleteOneID returns a builder for deleting the given entity by its id.
+func (c *AuthSessionClient) DeleteOneID(id string) *AuthSessionDeleteOne {
+	builder := c.Delete().Where(authsession.ID(id))
+	builder.mutation.id = &id
+	builder.mutation.op = OpDeleteOne
+	return &AuthSessionDeleteOne{builder}
+}
+
+// Query returns a query builder for AuthSession.
+func (c *AuthSessionClient) Query() *AuthSessionQuery {
+	return &AuthSessionQuery{
+		config: c.config,
+		ctx:    &QueryContext{Type: TypeAuthSession},
+		inters: c.Interceptors(),
+	}
+}
+
+// Get returns a AuthSession entity by its id.
+func (c *AuthSessionClient) Get(ctx context.Context, id string) (*AuthSession, error) {
+	return c.Query().Where(authsession.ID(id)).Only(ctx)
+}
+
+// GetX is like Get, but panics if an error occurs.
+func (c *AuthSessionClient) GetX(ctx context.Context, id string) *AuthSession {
+	obj, err := c.Get(ctx, id)
+	if err != nil {
+		panic(err)
+	}
+	return obj
+}
+
+// Hooks returns the client hooks.
+func (c *AuthSessionClient) Hooks() []Hook {
+	return c.hooks.AuthSession
+}
+
+// Interceptors returns the client interceptors.
+func (c *AuthSessionClient) Interceptors() []Interceptor {
+	return c.inters.AuthSession
+}
+
+func (c *AuthSessionClient) mutate(ctx context.Context, m *AuthSessionMutation) (Value, error) {
+	switch m.Op() {
+	case OpCreate:
+		return (&AuthSessionCreate{config: c.config, hooks: c.Hooks(), mutation: m}).Save(ctx)
+	case OpUpdate:
+		return (&AuthSessionUpdate{config: c.config, hooks: c.Hooks(), mutation: m}).Save(ctx)
+	case OpUpdateOne:
+		return (&AuthSessionUpdateOne{config: c.config, hooks: c.Hooks(), mutation: m}).Save(ctx)
+	case OpDelete, OpDeleteOne:
+		return (&AuthSessionDelete{config: c.config, hooks: c.Hooks(), mutation: m}).Exec(ctx)
+	default:
+		return nil, fmt.Errorf("db: unknown AuthSession mutation op: %q", m.Op())
+	}
+}
+
 // ConnectorClient is a client for the Connector schema.
 type ConnectorClient struct {
 	config
@@ -382,6 +711,12 @@ func (c *ConnectorClient) Use(hooks ...Hook) {
 	c.hooks.Connector = append(c.hooks.Connector, hooks...)
 }
 
+// Intercept adds a list of query interceptors to the interceptors stack.
+// A call to `Intercept(f, g, h)` equals to `connector.Intercept(f(g(h())))`.
+func (c *ConnectorClient) Intercept(interceptors ...Interceptor) {
+	c.inters.Connector = append(c.inters.Connector, interceptors...)
+}
+
 // Create returns a builder for creating a Connector entity.
 func (c *ConnectorClient) Create() *ConnectorCreate {
 	mutation := newConnectorMutation(c.config, OpCreate)
@@ -393,6 +728,21 @@ func (c *ConnectorClient) CreateBulk(builders ...*ConnectorCreate) *ConnectorCre
 	return &ConnectorCreateBulk{config: c.config, builders: builders}
 }
 
+// MapCreateBulk creates a bulk creation builder from the given slice. For each item in the slice, the function creates
+// a builder and applies setFunc on it.
+func (c *ConnectorClient) MapCreateBulk(slice any, setFunc func(*ConnectorCreate, int)) *ConnectorCreateBulk {
+	rv := reflect.ValueOf(slice)
+	if rv.Kind() != reflect.Slice {
+		return &ConnectorCreateBulk{err: fmt.Errorf("calling to ConnectorClient.MapCreateBulk with wrong type %T, need slice", slice)}
+	}
+	builders := make([]*ConnectorCreate, rv.Len())
+	for i := 0; i < rv.Len(); i++ {
+		builders[i] = c.Create()
+		setFunc(builders[i], i)
+	}
+	return &ConnectorCreateBulk{config: c.config, builders: builders}
+}
+
 // Update returns an update builder for Connector.
 func (c *ConnectorClient) Update() *ConnectorUpdate {
 	mutation := newConnectorMutation(c.config, OpUpdate)
@@ -400,8 +750,8 @@ func (c *ConnectorClient) Update() *ConnectorUpdate {
 }
 
 // UpdateOne returns an update builder for the given entity.
-func (c *ConnectorClient) UpdateOne(co *Connector) *ConnectorUpdateOne {
-	mutation := newConnectorMutation(c.config, OpUpdateOne, withConnector(co))
+func (c *ConnectorClient) UpdateOne(_m *Connector) *ConnectorUpdateOne {
+	mutation := newConnectorMutation(c.config, OpUpdateOne, withConnector(_m))
 	return &ConnectorUpdateOne{config: c.config, hooks: c.Hooks(), mutation: mutation}
 }
 
@@ -418,11 +768,11 @@ func (c *ConnectorClient) Delete() *ConnectorDelete {
 }
 
 // DeleteOne returns a builder for deleting the given entity.
-func (c *ConnectorClient) DeleteOne(co *Connector) *ConnectorDeleteOne {
-	return c.DeleteOneID(co.ID)
+func (c *ConnectorClient) DeleteOne(_m *Connector) *ConnectorDeleteOne {
+	return c.DeleteOneID(_m.ID)
 }
 
-// DeleteOne returns a builder for deleting the given entity by its id.
+// DeleteOneID returns a builder for deleting the given entity by its id.
 func (c *ConnectorClient) DeleteOneID(id string) *ConnectorDeleteOne {
 	builder := c.Delete().Where(connector.ID(id))
 	builder.mutation.id = &id
@@ -434,6 +784,8 @@ func (c *ConnectorClient) DeleteOneID(id string) *ConnectorDeleteOne {
 func (c *ConnectorClient) Query() *ConnectorQuery {
 	return &ConnectorQuery{
 		config: c.config,
+		ctx:    &QueryContext{Type: TypeConnector},
+		inters: c.Interceptors(),
 	}
 }
 
@@ -456,6 +808,26 @@ func (c *ConnectorClient) Hooks() []Hook {
 	return c.hooks.Connector
 }
 
+// Interceptors returns the client interceptors.
+func (c *ConnectorClient) Interceptors() []Interceptor {
+	return c.inters.Connector
+}
+
+func (c *ConnectorClient) mutate(ctx context.Context, m *ConnectorMutation) (Value, error) {
+	switch m.Op() {
+	case OpCreate:
+		return (&ConnectorCreate{config: c.config, hooks: c.Hooks(), mutation: m}).Save(ctx)
+	case OpUpdate:
+		return (&ConnectorUpdate{config: c.config, hooks: c.Hooks(), mutation: m}).Save(ctx)
+	case OpUpdateOne:
+		return (&ConnectorUpdateOne{config: c.config, hooks: c.Hooks(), mutation: m}).Save(ctx)
+	case OpDelete, OpDeleteOne:
+		return (&ConnectorDelete{config: c.config, hooks: c.Hooks(), mutation: m}).Exec(ctx)
+	default:
+		return nil, fmt.Errorf("db: unknown Connector mutation op: %q", m.Op())
+	}
+}
+
 // DeviceRequestClient is a client for the DeviceRequest schema.
 type DeviceRequestClient struct {
 	config
@@ -472,6 +844,12 @@ func (c *DeviceRequestClient) Use(hooks ...Hook) {
 	c.hooks.DeviceRequest = append(c.hooks.DeviceRequest, hooks...)
 }
 
+// Intercept adds a list of query interceptors to the interceptors stack.
+// A call to `Intercept(f, g, h)` equals to `devicerequest.Intercept(f(g(h())))`.
+func (c *DeviceRequestClient) Intercept(interceptors ...Interceptor) {
+	c.inters.DeviceRequest = append(c.inters.DeviceRequest, interceptors...)
+}
+
 // Create returns a builder for creating a DeviceRequest entity.
 func (c *DeviceRequestClient) Create() *DeviceRequestCreate {
 	mutation := newDeviceRequestMutation(c.config, OpCreate)
@@ -483,6 +861,21 @@ func (c *DeviceRequestClient) CreateBulk(builders ...*DeviceRequestCreate) *Devi
 	return &DeviceRequestCreateBulk{config: c.config, builders: builders}
 }
 
+// MapCreateBulk creates a bulk creation builder from the given slice. For each item in the slice, the function creates
+// a builder and applies setFunc on it.
+func (c *DeviceRequestClient) MapCreateBulk(slice any, setFunc func(*DeviceRequestCreate, int)) *DeviceRequestCreateBulk {
+	rv := reflect.ValueOf(slice)
+	if rv.Kind() != reflect.Slice {
+		return &DeviceRequestCreateBulk{err: fmt.Errorf("calling to DeviceRequestClient.MapCreateBulk with wrong type %T, need slice", slice)}
+	}
+	builders := make([]*DeviceRequestCreate, rv.Len())
+	for i := 0; i < rv.Len(); i++ {
+		builders[i] = c.Create()
+		setFunc(builders[i], i)
+	}
+	return &DeviceRequestCreateBulk{config: c.config, builders: builders}
+}
+
 // Update returns an update builder for DeviceRequest.
 func (c *DeviceRequestClient) Update() *DeviceRequestUpdate {
 	mutation := newDeviceRequestMutation(c.config, OpUpdate)
@@ -490,8 +883,8 @@ func (c *DeviceRequestClient) Update() *DeviceRequestUpdate {
 }
 
 // UpdateOne returns an update builder for the given entity.
-func (c *DeviceRequestClient) UpdateOne(dr *DeviceRequest) *DeviceRequestUpdateOne {
-	mutation := newDeviceRequestMutation(c.config, OpUpdateOne, withDeviceRequest(dr))
+func (c *DeviceRequestClient) UpdateOne(_m *DeviceRequest) *DeviceRequestUpdateOne {
+	mutation := newDeviceRequestMutation(c.config, OpUpdateOne, withDeviceRequest(_m))
 	return &DeviceRequestUpdateOne{config: c.config, hooks: c.Hooks(), mutation: mutation}
 }
 
@@ -508,11 +901,11 @@ func (c *DeviceRequestClient) Delete() *DeviceRequestDelete {
 }
 
 // DeleteOne returns a builder for deleting the given entity.
-func (c *DeviceRequestClient) DeleteOne(dr *DeviceRequest) *DeviceRequestDeleteOne {
-	return c.DeleteOneID(dr.ID)
+func (c *DeviceRequestClient) DeleteOne(_m *DeviceRequest) *DeviceRequestDeleteOne {
+	return c.DeleteOneID(_m.ID)
 }
 
-// DeleteOne returns a builder for deleting the given entity by its id.
+// DeleteOneID returns a builder for deleting the given entity by its id.
 func (c *DeviceRequestClient) DeleteOneID(id int) *DeviceRequestDeleteOne {
 	builder := c.Delete().Where(devicerequest.ID(id))
 	builder.mutation.id = &id
@@ -524,6 +917,8 @@ func (c *DeviceRequestClient) DeleteOneID(id int) *DeviceRequestDeleteOne {
 func (c *DeviceRequestClient) Query() *DeviceRequestQuery {
 	return &DeviceRequestQuery{
 		config: c.config,
+		ctx:    &QueryContext{Type: TypeDeviceRequest},
+		inters: c.Interceptors(),
 	}
 }
 
@@ -546,6 +941,26 @@ func (c *DeviceRequestClient) Hooks() []Hook {
 	return c.hooks.DeviceRequest
 }
 
+// Interceptors returns the client interceptors.
+func (c *DeviceRequestClient) Interceptors() []Interceptor {
+	return c.inters.DeviceRequest
+}
+
+func (c *DeviceRequestClient) mutate(ctx context.Context, m *DeviceRequestMutation) (Value, error) {
+	switch m.Op() {
+	case OpCreate:
+		return (&DeviceRequestCreate{config: c.config, hooks: c.Hooks(), mutation: m}).Save(ctx)
+	case OpUpdate:
+		return (&DeviceRequestUpdate{config: c.config, hooks: c.Hooks(), mutation: m}).Save(ctx)
+	case OpUpdateOne:
+		return (&DeviceRequestUpdateOne{config: c.config, hooks: c.Hooks(), mutation: m}).Save(ctx)
+	case OpDelete, OpDeleteOne:
+		return (&DeviceRequestDelete{config: c.config, hooks: c.Hooks(), mutation: m}).Exec(ctx)
+	default:
+		return nil, fmt.Errorf("db: unknown DeviceRequest mutation op: %q", m.Op())
+	}
+}
+
 // DeviceTokenClient is a client for the DeviceToken schema.
 type DeviceTokenClient struct {
 	config
@@ -562,6 +977,12 @@ func (c *DeviceTokenClient) Use(hooks ...Hook) {
 	c.hooks.DeviceToken = append(c.hooks.DeviceToken, hooks...)
 }
 
+// Intercept adds a list of query interceptors to the interceptors stack.
+// A call to `Intercept(f, g, h)` equals to `devicetoken.Intercept(f(g(h())))`.
+func (c *DeviceTokenClient) Intercept(interceptors ...Interceptor) {
+	c.inters.DeviceToken = append(c.inters.DeviceToken, interceptors...)
+}
+
 // Create returns a builder for creating a DeviceToken entity.
 func (c *DeviceTokenClient) Create() *DeviceTokenCreate {
 	mutation := newDeviceTokenMutation(c.config, OpCreate)
@@ -573,6 +994,21 @@ func (c *DeviceTokenClient) CreateBulk(builders ...*DeviceTokenCreate) *DeviceTo
 	return &DeviceTokenCreateBulk{config: c.config, builders: builders}
 }
 
+// MapCreateBulk creates a bulk creation builder from the given slice. For each item in the slice, the function creates
+// a builder and applies setFunc on it.
+func (c *DeviceTokenClient) MapCreateBulk(slice any, setFunc func(*DeviceTokenCreate, int)) *DeviceTokenCreateBulk {
+	rv := reflect.ValueOf(slice)
+	if rv.Kind() != reflect.Slice {
+		return &DeviceTokenCreateBulk{err: fmt.Errorf("calling to DeviceTokenClient.MapCreateBulk with wrong type %T, need slice", slice)}
+	}
+	builders := make([]*DeviceTokenCreate, rv.Len())
+	for i := 0; i < rv.Len(); i++ {
+		builders[i] = c.Create()
+		setFunc(builders[i], i)
+	}
+	return &DeviceTokenCreateBulk{config: c.config, builders: builders}
+}
+
 // Update returns an update builder for DeviceToken.
 func (c *DeviceTokenClient) Update() *DeviceTokenUpdate {
 	mutation := newDeviceTokenMutation(c.config, OpUpdate)
@@ -580,8 +1016,8 @@ func (c *DeviceTokenClient) Update() *DeviceTokenUpdate {
 }
 
 // UpdateOne returns an update builder for the given entity.
-func (c *DeviceTokenClient) UpdateOne(dt *DeviceToken) *DeviceTokenUpdateOne {
-	mutation := newDeviceTokenMutation(c.config, OpUpdateOne, withDeviceToken(dt))
+func (c *DeviceTokenClient) UpdateOne(_m *DeviceToken) *DeviceTokenUpdateOne {
+	mutation := newDeviceTokenMutation(c.config, OpUpdateOne, withDeviceToken(_m))
 	return &DeviceTokenUpdateOne{config: c.config, hooks: c.Hooks(), mutation: mutation}
 }
 
@@ -598,11 +1034,11 @@ func (c *DeviceTokenClient) Delete() *DeviceTokenDelete {
 }
 
 // DeleteOne returns a builder for deleting the given entity.
-func (c *DeviceTokenClient) DeleteOne(dt *DeviceToken) *DeviceTokenDeleteOne {
-	return c.DeleteOneID(dt.ID)
+func (c *DeviceTokenClient) DeleteOne(_m *DeviceToken) *DeviceTokenDeleteOne {
+	return c.DeleteOneID(_m.ID)
 }
 
-// DeleteOne returns a builder for deleting the given entity by its id.
+// DeleteOneID returns a builder for deleting the given entity by its id.
 func (c *DeviceTokenClient) DeleteOneID(id int) *DeviceTokenDeleteOne {
 	builder := c.Delete().Where(devicetoken.ID(id))
 	builder.mutation.id = &id
@@ -614,6 +1050,8 @@ func (c *DeviceTokenClient) DeleteOneID(id int) *DeviceTokenDeleteOne {
 func (c *DeviceTokenClient) Query() *DeviceTokenQuery {
 	return &DeviceTokenQuery{
 		config: c.config,
+		ctx:    &QueryContext{Type: TypeDeviceToken},
+		inters: c.Interceptors(),
 	}
 }
 
@@ -636,6 +1074,26 @@ func (c *DeviceTokenClient) Hooks() []Hook {
 	return c.hooks.DeviceToken
 }
 
+// Interceptors returns the client interceptors.
+func (c *DeviceTokenClient) Interceptors() []Interceptor {
+	return c.inters.DeviceToken
+}
+
+func (c *DeviceTokenClient) mutate(ctx context.Context, m *DeviceTokenMutation) (Value, error) {
+	switch m.Op() {
+	case OpCreate:
+		return (&DeviceTokenCreate{config: c.config, hooks: c.Hooks(), mutation: m}).Save(ctx)
+	case OpUpdate:
+		return (&DeviceTokenUpdate{config: c.config, hooks: c.Hooks(), mutation: m}).Save(ctx)
+	case OpUpdateOne:
+		return (&DeviceTokenUpdateOne{config: c.config, hooks: c.Hooks(), mutation: m}).Save(ctx)
+	case OpDelete, OpDeleteOne:
+		return (&DeviceTokenDelete{config: c.config, hooks: c.Hooks(), mutation: m}).Exec(ctx)
+	default:
+		return nil, fmt.Errorf("db: unknown DeviceToken mutation op: %q", m.Op())
+	}
+}
+
 // KeysClient is a client for the Keys schema.
 type KeysClient struct {
 	config
@@ -652,6 +1110,12 @@ func (c *KeysClient) Use(hooks ...Hook) {
 	c.hooks.Keys = append(c.hooks.Keys, hooks...)
 }
 
+// Intercept adds a list of query interceptors to the interceptors stack.
+// A call to `Intercept(f, g, h)` equals to `keys.Intercept(f(g(h())))`.
+func (c *KeysClient) Intercept(interceptors ...Interceptor) {
+	c.inters.Keys = append(c.inters.Keys, interceptors...)
+}
+
 // Create returns a builder for creating a Keys entity.
 func (c *KeysClient) Create() *KeysCreate {
 	mutation := newKeysMutation(c.config, OpCreate)
@@ -663,6 +1127,21 @@ func (c *KeysClient) CreateBulk(builders ...*KeysCreate) *KeysCreateBulk {
 	return &KeysCreateBulk{config: c.config, builders: builders}
 }
 
+// MapCreateBulk creates a bulk creation builder from the given slice. For each item in the slice, the function creates
+// a builder and applies setFunc on it.
+func (c *KeysClient) MapCreateBulk(slice any, setFunc func(*KeysCreate, int)) *KeysCreateBulk {
+	rv := reflect.ValueOf(slice)
+	if rv.Kind() != reflect.Slice {
+		return &KeysCreateBulk{err: fmt.Errorf("calling to KeysClient.MapCreateBulk with wrong type %T, need slice", slice)}
+	}
+	builders := make([]*KeysCreate, rv.Len())
+	for i := 0; i < rv.Len(); i++ {
+		builders[i] = c.Create()
+		setFunc(builders[i], i)
+	}
+	return &KeysCreateBulk{config: c.config, builders: builders}
+}
+
 // Update returns an update builder for Keys.
 func (c *KeysClient) Update() *KeysUpdate {
 	mutation := newKeysMutation(c.config, OpUpdate)
@@ -670,8 +1149,8 @@ func (c *KeysClient) Update() *KeysUpdate {
 }
 
 // UpdateOne returns an update builder for the given entity.
-func (c *KeysClient) UpdateOne(k *Keys) *KeysUpdateOne {
-	mutation := newKeysMutation(c.config, OpUpdateOne, withKeys(k))
+func (c *KeysClient) UpdateOne(_m *Keys) *KeysUpdateOne {
+	mutation := newKeysMutation(c.config, OpUpdateOne, withKeys(_m))
 	return &KeysUpdateOne{config: c.config, hooks: c.Hooks(), mutation: mutation}
 }
 
@@ -688,11 +1167,11 @@ func (c *KeysClient) Delete() *KeysDelete {
 }
 
 // DeleteOne returns a builder for deleting the given entity.
-func (c *KeysClient) DeleteOne(k *Keys) *KeysDeleteOne {
-	return c.DeleteOneID(k.ID)
+func (c *KeysClient) DeleteOne(_m *Keys) *KeysDeleteOne {
+	return c.DeleteOneID(_m.ID)
 }
 
-// DeleteOne returns a builder for deleting the given entity by its id.
+// DeleteOneID returns a builder for deleting the given entity by its id.
 func (c *KeysClient) DeleteOneID(id string) *KeysDeleteOne {
 	builder := c.Delete().Where(keys.ID(id))
 	builder.mutation.id = &id
@@ -704,6 +1183,8 @@ func (c *KeysClient) DeleteOneID(id string) *KeysDeleteOne {
 func (c *KeysClient) Query() *KeysQuery {
 	return &KeysQuery{
 		config: c.config,
+		ctx:    &QueryContext{Type: TypeKeys},
+		inters: c.Interceptors(),
 	}
 }
 
@@ -726,6 +1207,26 @@ func (c *KeysClient) Hooks() []Hook {
 	return c.hooks.Keys
 }
 
+// Interceptors returns the client interceptors.
+func (c *KeysClient) Interceptors() []Interceptor {
+	return c.inters.Keys
+}
+
+func (c *KeysClient) mutate(ctx context.Context, m *KeysMutation) (Value, error) {
+	switch m.Op() {
+	case OpCreate:
+		return (&KeysCreate{config: c.config, hooks: c.Hooks(), mutation: m}).Save(ctx)
+	case OpUpdate:
+		return (&KeysUpdate{config: c.config, hooks: c.Hooks(), mutation: m}).Save(ctx)
+	case OpUpdateOne:
+		return (&KeysUpdateOne{config: c.config, hooks: c.Hooks(), mutation: m}).Save(ctx)
+	case OpDelete, OpDeleteOne:
+		return (&KeysDelete{config: c.config, hooks: c.Hooks(), mutation: m}).Exec(ctx)
+	default:
+		return nil, fmt.Errorf("db: unknown Keys mutation op: %q", m.Op())
+	}
+}
+
 // OAuth2ClientClient is a client for the OAuth2Client schema.
 type OAuth2ClientClient struct {
 	config
@@ -742,6 +1243,12 @@ func (c *OAuth2ClientClient) Use(hooks ...Hook) {
 	c.hooks.OAuth2Client = append(c.hooks.OAuth2Client, hooks...)
 }
 
+// Intercept adds a list of query interceptors to the interceptors stack.
+// A call to `Intercept(f, g, h)` equals to `oauth2client.Intercept(f(g(h())))`.
+func (c *OAuth2ClientClient) Intercept(interceptors ...Interceptor) {
+	c.inters.OAuth2Client = append(c.inters.OAuth2Client, interceptors...)
+}
+
 // Create returns a builder for creating a OAuth2Client entity.
 func (c *OAuth2ClientClient) Create() *OAuth2ClientCreate {
 	mutation := newOAuth2ClientMutation(c.config, OpCreate)
@@ -753,6 +1260,21 @@ func (c *OAuth2ClientClient) CreateBulk(builders ...*OAuth2ClientCreate) *OAuth2
 	return &OAuth2ClientCreateBulk{config: c.config, builders: builders}
 }
 
+// MapCreateBulk creates a bulk creation builder from the given slice. For each item in the slice, the function creates
+// a builder and applies setFunc on it.
+func (c *OAuth2ClientClient) MapCreateBulk(slice any, setFunc func(*OAuth2ClientCreate, int)) *OAuth2ClientCreateBulk {
+	rv := reflect.ValueOf(slice)
+	if rv.Kind() != reflect.Slice {
+		return &OAuth2ClientCreateBulk{err: fmt.Errorf("calling to OAuth2ClientClient.MapCreateBulk with wrong type %T, need slice", slice)}
+	}
+	builders := make([]*OAuth2ClientCreate, rv.Len())
+	for i := 0; i < rv.Len(); i++ {
+		builders[i] = c.Create()
+		setFunc(builders[i], i)
+	}
+	return &OAuth2ClientCreateBulk{config: c.config, builders: builders}
+}
+
 // Update returns an update builder for OAuth2Client.
 func (c *OAuth2ClientClient) Update() *OAuth2ClientUpdate {
 	mutation := newOAuth2ClientMutation(c.config, OpUpdate)
@@ -760,8 +1282,8 @@ func (c *OAuth2ClientClient) Update() *OAuth2ClientUpdate {
 }
 
 // UpdateOne returns an update builder for the given entity.
-func (c *OAuth2ClientClient) UpdateOne(o *OAuth2Client) *OAuth2ClientUpdateOne {
-	mutation := newOAuth2ClientMutation(c.config, OpUpdateOne, withOAuth2Client(o))
+func (c *OAuth2ClientClient) UpdateOne(_m *OAuth2Client) *OAuth2ClientUpdateOne {
+	mutation := newOAuth2ClientMutation(c.config, OpUpdateOne, withOAuth2Client(_m))
 	return &OAuth2ClientUpdateOne{config: c.config, hooks: c.Hooks(), mutation: mutation}
 }
 
@@ -778,11 +1300,11 @@ func (c *OAuth2ClientClient) Delete() *OAuth2ClientDelete {
 }
 
 // DeleteOne returns a builder for deleting the given entity.
-func (c *OAuth2ClientClient) DeleteOne(o *OAuth2Client) *OAuth2ClientDeleteOne {
-	return c.DeleteOneID(o.ID)
+func (c *OAuth2ClientClient) DeleteOne(_m *OAuth2Client) *OAuth2ClientDeleteOne {
+	return c.DeleteOneID(_m.ID)
 }
 
-// DeleteOne returns a builder for deleting the given entity by its id.
+// DeleteOneID returns a builder for deleting the given entity by its id.
 func (c *OAuth2ClientClient) DeleteOneID(id string) *OAuth2ClientDeleteOne {
 	builder := c.Delete().Where(oauth2client.ID(id))
 	builder.mutation.id = &id
@@ -794,6 +1316,8 @@ func (c *OAuth2ClientClient) DeleteOneID(id string) *OAuth2ClientDeleteOne {
 func (c *OAuth2ClientClient) Query() *OAuth2ClientQuery {
 	return &OAuth2ClientQuery{
 		config: c.config,
+		ctx:    &QueryContext{Type: TypeOAuth2Client},
+		inters: c.Interceptors(),
 	}
 }
 
@@ -816,6 +1340,26 @@ func (c *OAuth2ClientClient) Hooks() []Hook {
 	return c.hooks.OAuth2Client
 }
 
+// Interceptors returns the client interceptors.
+func (c *OAuth2ClientClient) Interceptors() []Interceptor {
+	return c.inters.OAuth2Client
+}
+
+func (c *OAuth2ClientClient) mutate(ctx context.Context, m *OAuth2ClientMutation) (Value, error) {
+	switch m.Op() {
+	case OpCreate:
+		return (&OAuth2ClientCreate{config: c.config, hooks: c.Hooks(), mutation: m}).Save(ctx)
+	case OpUpdate:
+		return (&OAuth2ClientUpdate{config: c.config, hooks: c.Hooks(), mutation: m}).Save(ctx)
+	case OpUpdateOne:
+		return (&OAuth2ClientUpdateOne{config: c.config, hooks: c.Hooks(), mutation: m}).Save(ctx)
+	case OpDelete, OpDeleteOne:
+		return (&OAuth2ClientDelete{config: c.config, hooks: c.Hooks(), mutation: m}).Exec(ctx)
+	default:
+		return nil, fmt.Errorf("db: unknown OAuth2Client mutation op: %q", m.Op())
+	}
+}
+
 // OfflineSessionClient is a client for the OfflineSession schema.
 type OfflineSessionClient struct {
 	config
@@ -832,6 +1376,12 @@ func (c *OfflineSessionClient) Use(hooks ...Hook) {
 	c.hooks.OfflineSession = append(c.hooks.OfflineSession, hooks...)
 }
 
+// Intercept adds a list of query interceptors to the interceptors stack.
+// A call to `Intercept(f, g, h)` equals to `offlinesession.Intercept(f(g(h())))`.
+func (c *OfflineSessionClient) Intercept(interceptors ...Interceptor) {
+	c.inters.OfflineSession = append(c.inters.OfflineSession, interceptors...)
+}
+
 // Create returns a builder for creating a OfflineSession entity.
 func (c *OfflineSessionClient) Create() *OfflineSessionCreate {
 	mutation := newOfflineSessionMutation(c.config, OpCreate)
@@ -843,6 +1393,21 @@ func (c *OfflineSessionClient) CreateBulk(builders ...*OfflineSessionCreate) *Of
 	return &OfflineSessionCreateBulk{config: c.config, builders: builders}
 }
 
+// MapCreateBulk creates a bulk creation builder from the given slice. For each item in the slice, the function creates
+// a builder and applies setFunc on it.
+func (c *OfflineSessionClient) MapCreateBulk(slice any, setFunc func(*OfflineSessionCreate, int)) *OfflineSessionCreateBulk {
+	rv := reflect.ValueOf(slice)
+	if rv.Kind() != reflect.Slice {
+		return &OfflineSessionCreateBulk{err: fmt.Errorf("calling to OfflineSessionClient.MapCreateBulk with wrong type %T, need slice", slice)}
+	}
+	builders := make([]*OfflineSessionCreate, rv.Len())
+	for i := 0; i < rv.Len(); i++ {
+		builders[i] = c.Create()
+		setFunc(builders[i], i)
+	}
+	return &OfflineSessionCreateBulk{config: c.config, builders: builders}
+}
+
 // Update returns an update builder for OfflineSession.
 func (c *OfflineSessionClient) Update() *OfflineSessionUpdate {
 	mutation := newOfflineSessionMutation(c.config, OpUpdate)
@@ -850,8 +1415,8 @@ func (c *OfflineSessionClient) Update() *OfflineSessionUpdate {
 }
 
 // UpdateOne returns an update builder for the given entity.
-func (c *OfflineSessionClient) UpdateOne(os *OfflineSession) *OfflineSessionUpdateOne {
-	mutation := newOfflineSessionMutation(c.config, OpUpdateOne, withOfflineSession(os))
+func (c *OfflineSessionClient) UpdateOne(_m *OfflineSession) *OfflineSessionUpdateOne {
+	mutation := newOfflineSessionMutation(c.config, OpUpdateOne, withOfflineSession(_m))
 	return &OfflineSessionUpdateOne{config: c.config, hooks: c.Hooks(), mutation: mutation}
 }
 
@@ -868,11 +1433,11 @@ func (c *OfflineSessionClient) Delete() *OfflineSessionDelete {
 }
 
 // DeleteOne returns a builder for deleting the given entity.
-func (c *OfflineSessionClient) DeleteOne(os *OfflineSession) *OfflineSessionDeleteOne {
-	return c.DeleteOneID(os.ID)
+func (c *OfflineSessionClient) DeleteOne(_m *OfflineSession) *OfflineSessionDeleteOne {
+	return c.DeleteOneID(_m.ID)
 }
 
-// DeleteOne returns a builder for deleting the given entity by its id.
+// DeleteOneID returns a builder for deleting the given entity by its id.
 func (c *OfflineSessionClient) DeleteOneID(id string) *OfflineSessionDeleteOne {
 	builder := c.Delete().Where(offlinesession.ID(id))
 	builder.mutation.id = &id
@@ -884,6 +1449,8 @@ func (c *OfflineSessionClient) DeleteOneID(id string) *OfflineSessionDeleteOne {
 func (c *OfflineSessionClient) Query() *OfflineSessionQuery {
 	return &OfflineSessionQuery{
 		config: c.config,
+		ctx:    &QueryContext{Type: TypeOfflineSession},
+		inters: c.Interceptors(),
 	}
 }
 
@@ -906,6 +1473,26 @@ func (c *OfflineSessionClient) Hooks() []Hook {
 	return c.hooks.OfflineSession
 }
 
+// Interceptors returns the client interceptors.
+func (c *OfflineSessionClient) Interceptors() []Interceptor {
+	return c.inters.OfflineSession
+}
+
+func (c *OfflineSessionClient) mutate(ctx context.Context, m *OfflineSessionMutation) (Value, error) {
+	switch m.Op() {
+	case OpCreate:
+		return (&OfflineSessionCreate{config: c.config, hooks: c.Hooks(), mutation: m}).Save(ctx)
+	case OpUpdate:
+		return (&OfflineSessionUpdate{config: c.config, hooks: c.Hooks(), mutation: m}).Save(ctx)
+	case OpUpdateOne:
+		return (&OfflineSessionUpdateOne{config: c.config, hooks: c.Hooks(), mutation: m}).Save(ctx)
+	case OpDelete, OpDeleteOne:
+		return (&OfflineSessionDelete{config: c.config, hooks: c.Hooks(), mutation: m}).Exec(ctx)
+	default:
+		return nil, fmt.Errorf("db: unknown OfflineSession mutation op: %q", m.Op())
+	}
+}
+
 // PasswordClient is a client for the Password schema.
 type PasswordClient struct {
 	config
@@ -922,6 +1509,12 @@ func (c *PasswordClient) Use(hooks ...Hook) {
 	c.hooks.Password = append(c.hooks.Password, hooks...)
 }
 
+// Intercept adds a list of query interceptors to the interceptors stack.
+// A call to `Intercept(f, g, h)` equals to `password.Intercept(f(g(h())))`.
+func (c *PasswordClient) Intercept(interceptors ...Interceptor) {
+	c.inters.Password = append(c.inters.Password, interceptors...)
+}
+
 // Create returns a builder for creating a Password entity.
 func (c *PasswordClient) Create() *PasswordCreate {
 	mutation := newPasswordMutation(c.config, OpCreate)
@@ -933,6 +1526,21 @@ func (c *PasswordClient) CreateBulk(builders ...*PasswordCreate) *PasswordCreate
 	return &PasswordCreateBulk{config: c.config, builders: builders}
 }
 
+// MapCreateBulk creates a bulk creation builder from the given slice. For each item in the slice, the function creates
+// a builder and applies setFunc on it.
+func (c *PasswordClient) MapCreateBulk(slice any, setFunc func(*PasswordCreate, int)) *PasswordCreateBulk {
+	rv := reflect.ValueOf(slice)
+	if rv.Kind() != reflect.Slice {
+		return &PasswordCreateBulk{err: fmt.Errorf("calling to PasswordClient.MapCreateBulk with wrong type %T, need slice", slice)}
+	}
+	builders := make([]*PasswordCreate, rv.Len())
+	for i := 0; i < rv.Len(); i++ {
+		builders[i] = c.Create()
+		setFunc(builders[i], i)
+	}
+	return &PasswordCreateBulk{config: c.config, builders: builders}
+}
+
 // Update returns an update builder for Password.
 func (c *PasswordClient) Update() *PasswordUpdate {
 	mutation := newPasswordMutation(c.config, OpUpdate)
@@ -940,8 +1548,8 @@ func (c *PasswordClient) Update() *PasswordUpdate {
 }
 
 // UpdateOne returns an update builder for the given entity.
-func (c *PasswordClient) UpdateOne(pa *Password) *PasswordUpdateOne {
-	mutation := newPasswordMutation(c.config, OpUpdateOne, withPassword(pa))
+func (c *PasswordClient) UpdateOne(_m *Password) *PasswordUpdateOne {
+	mutation := newPasswordMutation(c.config, OpUpdateOne, withPassword(_m))
 	return &PasswordUpdateOne{config: c.config, hooks: c.Hooks(), mutation: mutation}
 }
 
@@ -958,11 +1566,11 @@ func (c *PasswordClient) Delete() *PasswordDelete {
 }
 
 // DeleteOne returns a builder for deleting the given entity.
-func (c *PasswordClient) DeleteOne(pa *Password) *PasswordDeleteOne {
-	return c.DeleteOneID(pa.ID)
+func (c *PasswordClient) DeleteOne(_m *Password) *PasswordDeleteOne {
+	return c.DeleteOneID(_m.ID)
 }
 
-// DeleteOne returns a builder for deleting the given entity by its id.
+// DeleteOneID returns a builder for deleting the given entity by its id.
 func (c *PasswordClient) DeleteOneID(id int) *PasswordDeleteOne {
 	builder := c.Delete().Where(password.ID(id))
 	builder.mutation.id = &id
@@ -974,6 +1582,8 @@ func (c *PasswordClient) DeleteOneID(id int) *PasswordDeleteOne {
 func (c *PasswordClient) Query() *PasswordQuery {
 	return &PasswordQuery{
 		config: c.config,
+		ctx:    &QueryContext{Type: TypePassword},
+		inters: c.Interceptors(),
 	}
 }
 
@@ -996,6 +1606,26 @@ func (c *PasswordClient) Hooks() []Hook {
 	return c.hooks.Password
 }
 
+// Interceptors returns the client interceptors.
+func (c *PasswordClient) Interceptors() []Interceptor {
+	return c.inters.Password
+}
+
+func (c *PasswordClient) mutate(ctx context.Context, m *PasswordMutation) (Value, error) {
+	switch m.Op() {
+	case OpCreate:
+		return (&PasswordCreate{config: c.config, hooks: c.Hooks(), mutation: m}).Save(ctx)
+	case OpUpdate:
+		return (&PasswordUpdate{config: c.config, hooks: c.Hooks(), mutation: m}).Save(ctx)
+	case OpUpdateOne:
+		return (&PasswordUpdateOne{config: c.config, hooks: c.Hooks(), mutation: m}).Save(ctx)
+	case OpDelete, OpDeleteOne:
+		return (&PasswordDelete{config: c.config, hooks: c.Hooks(), mutation: m}).Exec(ctx)
+	default:
+		return nil, fmt.Errorf("db: unknown Password mutation op: %q", m.Op())
+	}
+}
+
 // RefreshTokenClient is a client for the RefreshToken schema.
 type RefreshTokenClient struct {
 	config
@@ -1012,6 +1642,12 @@ func (c *RefreshTokenClient) Use(hooks ...Hook) {
 	c.hooks.RefreshToken = append(c.hooks.RefreshToken, hooks...)
 }
 
+// Intercept adds a list of query interceptors to the interceptors stack.
+// A call to `Intercept(f, g, h)` equals to `refreshtoken.Intercept(f(g(h())))`.
+func (c *RefreshTokenClient) Intercept(interceptors ...Interceptor) {
+	c.inters.RefreshToken = append(c.inters.RefreshToken, interceptors...)
+}
+
 // Create returns a builder for creating a RefreshToken entity.
 func (c *RefreshTokenClient) Create() *RefreshTokenCreate {
 	mutation := newRefreshTokenMutation(c.config, OpCreate)
@@ -1023,6 +1659,21 @@ func (c *RefreshTokenClient) CreateBulk(builders ...*RefreshTokenCreate) *Refres
 	return &RefreshTokenCreateBulk{config: c.config, builders: builders}
 }
 
+// MapCreateBulk creates a bulk creation builder from the given slice. For each item in the slice, the function creates
+// a builder and applies setFunc on it.
+func (c *RefreshTokenClient) MapCreateBulk(slice any, setFunc func(*RefreshTokenCreate, int)) *RefreshTokenCreateBulk {
+	rv := reflect.ValueOf(slice)
+	if rv.Kind() != reflect.Slice {
+		return &RefreshTokenCreateBulk{err: fmt.Errorf("calling to RefreshTokenClient.MapCreateBulk with wrong type %T, need slice", slice)}
+	}
+	builders := make([]*RefreshTokenCreate, rv.Len())
+	for i := 0; i < rv.Len(); i++ {
+		builders[i] = c.Create()
+		setFunc(builders[i], i)
+	}
+	return &RefreshTokenCreateBulk{config: c.config, builders: builders}
+}
+
 // Update returns an update builder for RefreshToken.
 func (c *RefreshTokenClient) Update() *RefreshTokenUpdate {
 	mutation := newRefreshTokenMutation(c.config, OpUpdate)
@@ -1030,8 +1681,8 @@ func (c *RefreshTokenClient) Update() *RefreshTokenUpdate {
 }
 
 // UpdateOne returns an update builder for the given entity.
-func (c *RefreshTokenClient) UpdateOne(rt *RefreshToken) *RefreshTokenUpdateOne {
-	mutation := newRefreshTokenMutation(c.config, OpUpdateOne, withRefreshToken(rt))
+func (c *RefreshTokenClient) UpdateOne(_m *RefreshToken) *RefreshTokenUpdateOne {
+	mutation := newRefreshTokenMutation(c.config, OpUpdateOne, withRefreshToken(_m))
 	return &RefreshTokenUpdateOne{config: c.config, hooks: c.Hooks(), mutation: mutation}
 }
 
@@ -1048,11 +1699,11 @@ func (c *RefreshTokenClient) Delete() *RefreshTokenDelete {
 }
 
 // DeleteOne returns a builder for deleting the given entity.
-func (c *RefreshTokenClient) DeleteOne(rt *RefreshToken) *RefreshTokenDeleteOne {
-	return c.DeleteOneID(rt.ID)
+func (c *RefreshTokenClient) DeleteOne(_m *RefreshToken) *RefreshTokenDeleteOne {
+	return c.DeleteOneID(_m.ID)
 }
 
-// DeleteOne returns a builder for deleting the given entity by its id.
+// DeleteOneID returns a builder for deleting the given entity by its id.
 func (c *RefreshTokenClient) DeleteOneID(id string) *RefreshTokenDeleteOne {
 	builder := c.Delete().Where(refreshtoken.ID(id))
 	builder.mutation.id = &id
@@ -1064,6 +1715,8 @@ func (c *RefreshTokenClient) DeleteOneID(id string) *RefreshTokenDeleteOne {
 func (c *RefreshTokenClient) Query() *RefreshTokenQuery {
 	return &RefreshTokenQuery{
 		config: c.config,
+		ctx:    &QueryContext{Type: TypeRefreshToken},
+		inters: c.Interceptors(),
 	}
 }
 
@@ -1085,3 +1738,169 @@ func (c *RefreshTokenClient) GetX(ctx context.Context, id string) *RefreshToken
 func (c *RefreshTokenClient) Hooks() []Hook {
 	return c.hooks.RefreshToken
 }
+
+// Interceptors returns the client interceptors.
+func (c *RefreshTokenClient) Interceptors() []Interceptor {
+	return c.inters.RefreshToken
+}
+
+func (c *RefreshTokenClient) mutate(ctx context.Context, m *RefreshTokenMutation) (Value, error) {
+	switch m.Op() {
+	case OpCreate:
+		return (&RefreshTokenCreate{config: c.config, hooks: c.Hooks(), mutation: m}).Save(ctx)
+	case OpUpdate:
+		return (&RefreshTokenUpdate{config: c.config, hooks: c.Hooks(), mutation: m}).Save(ctx)
+	case OpUpdateOne:
+		return (&RefreshTokenUpdateOne{config: c.config, hooks: c.Hooks(), mutation: m}).Save(ctx)
+	case OpDelete, OpDeleteOne:
+		return (&RefreshTokenDelete{config: c.config, hooks: c.Hooks(), mutation: m}).Exec(ctx)
+	default:
+		return nil, fmt.Errorf("db: unknown RefreshToken mutation op: %q", m.Op())
+	}
+}
+
+// UserIdentityClient is a client for the UserIdentity schema.
+type UserIdentityClient struct {
+	config
+}
+
+// NewUserIdentityClient returns a client for the UserIdentity from the given config.
+func NewUserIdentityClient(c config) *UserIdentityClient {
+	return &UserIdentityClient{config: c}
+}
+
+// Use adds a list of mutation hooks to the hooks stack.
+// A call to `Use(f, g, h)` equals to `useridentity.Hooks(f(g(h())))`.
+func (c *UserIdentityClient) Use(hooks ...Hook) {
+	c.hooks.UserIdentity = append(c.hooks.UserIdentity, hooks...)
+}
+
+// Intercept adds a list of query interceptors to the interceptors stack.
+// A call to `Intercept(f, g, h)` equals to `useridentity.Intercept(f(g(h())))`.
+func (c *UserIdentityClient) Intercept(interceptors ...Interceptor) {
+	c.inters.UserIdentity = append(c.inters.UserIdentity, interceptors...)
+}
+
+// Create returns a builder for creating a UserIdentity entity.
+func (c *UserIdentityClient) Create() *UserIdentityCreate {
+	mutation := newUserIdentityMutation(c.config, OpCreate)
+	return &UserIdentityCreate{config: c.config, hooks: c.Hooks(), mutation: mutation}
+}
+
+// CreateBulk returns a builder for creating a bulk of UserIdentity entities.
+func (c *UserIdentityClient) CreateBulk(builders ...*UserIdentityCreate) *UserIdentityCreateBulk {
+	return &UserIdentityCreateBulk{config: c.config, builders: builders}
+}
+
+// MapCreateBulk creates a bulk creation builder from the given slice. For each item in the slice, the function creates
+// a builder and applies setFunc on it.
+func (c *UserIdentityClient) MapCreateBulk(slice any, setFunc func(*UserIdentityCreate, int)) *UserIdentityCreateBulk {
+	rv := reflect.ValueOf(slice)
+	if rv.Kind() != reflect.Slice {
+		return &UserIdentityCreateBulk{err: fmt.Errorf("calling to UserIdentityClient.MapCreateBulk with wrong type %T, need slice", slice)}
+	}
+	builders := make([]*UserIdentityCreate, rv.Len())
+	for i := 0; i < rv.Len(); i++ {
+		builders[i] = c.Create()
+		setFunc(builders[i], i)
+	}
+	return &UserIdentityCreateBulk{config: c.config, builders: builders}
+}
+
+// Update returns an update builder for UserIdentity.
+func (c *UserIdentityClient) Update() *UserIdentityUpdate {
+	mutation := newUserIdentityMutation(c.config, OpUpdate)
+	return &UserIdentityUpdate{config: c.config, hooks: c.Hooks(), mutation: mutation}
+}
+
+// UpdateOne returns an update builder for the given entity.
+func (c *UserIdentityClient) UpdateOne(_m *UserIdentity) *UserIdentityUpdateOne {
+	mutation := newUserIdentityMutation(c.config, OpUpdateOne, withUserIdentity(_m))
+	return &UserIdentityUpdateOne{config: c.config, hooks: c.Hooks(), mutation: mutation}
+}
+
+// UpdateOneID returns an update builder for the given id.
+func (c *UserIdentityClient) UpdateOneID(id string) *UserIdentityUpdateOne {
+	mutation := newUserIdentityMutation(c.config, OpUpdateOne, withUserIdentityID(id))
+	return &UserIdentityUpdateOne{config: c.config, hooks: c.Hooks(), mutation: mutation}
+}
+
+// Delete returns a delete builder for UserIdentity.
+func (c *UserIdentityClient) Delete() *UserIdentityDelete {
+	mutation := newUserIdentityMutation(c.config, OpDelete)
+	return &UserIdentityDelete{config: c.config, hooks: c.Hooks(), mutation: mutation}
+}
+
+// DeleteOne returns a builder for deleting the given entity.
+func (c *UserIdentityClient) DeleteOne(_m *UserIdentity) *UserIdentityDeleteOne {
+	return c.DeleteOneID(_m.ID)
+}
+
+// DeleteOneID returns a builder for deleting the given entity by its id.
+func (c *UserIdentityClient) DeleteOneID(id string) *UserIdentityDeleteOne {
+	builder := c.Delete().Where(useridentity.ID(id))
+	builder.mutation.id = &id
+	builder.mutation.op = OpDeleteOne
+	return &UserIdentityDeleteOne{builder}
+}
+
+// Query returns a query builder for UserIdentity.
+func (c *UserIdentityClient) Query() *UserIdentityQuery {
+	return &UserIdentityQuery{
+		config: c.config,
+		ctx:    &QueryContext{Type: TypeUserIdentity},
+		inters: c.Interceptors(),
+	}
+}
+
+// Get returns a UserIdentity entity by its id.
+func (c *UserIdentityClient) Get(ctx context.Context, id string) (*UserIdentity, error) {
+	return c.Query().Where(useridentity.ID(id)).Only(ctx)
+}
+
+// GetX is like Get, but panics if an error occurs.
+func (c *UserIdentityClient) GetX(ctx context.Context, id string) *UserIdentity {
+	obj, err := c.Get(ctx, id)
+	if err != nil {
+		panic(err)
+	}
+	return obj
+}
+
+// Hooks returns the client hooks.
+func (c *UserIdentityClient) Hooks() []Hook {
+	return c.hooks.UserIdentity
+}
+
+// Interceptors returns the client interceptors.
+func (c *UserIdentityClient) Interceptors() []Interceptor {
+	return c.inters.UserIdentity
+}
+
+func (c *UserIdentityClient) mutate(ctx context.Context, m *UserIdentityMutation) (Value, error) {
+	switch m.Op() {
+	case OpCreate:
+		return (&UserIdentityCreate{config: c.config, hooks: c.Hooks(), mutation: m}).Save(ctx)
+	case OpUpdate:
+		return (&UserIdentityUpdate{config: c.config, hooks: c.Hooks(), mutation: m}).Save(ctx)
+	case OpUpdateOne:
+		return (&UserIdentityUpdateOne{config: c.config, hooks: c.Hooks(), mutation: m}).Save(ctx)
+	case OpDelete, OpDeleteOne:
+		return (&UserIdentityDelete{config: c.config, hooks: c.Hooks(), mutation: m}).Exec(ctx)
+	default:
+		return nil, fmt.Errorf("db: unknown UserIdentity mutation op: %q", m.Op())
+	}
+}
+
+// hooks and interceptors per client, for fast access.
+type (
+	hooks struct {
+		AuthCode, AuthRequest, AuthSession, Connector, DeviceRequest, DeviceToken, Keys,
+		OAuth2Client, OfflineSession, Password, RefreshToken, UserIdentity []ent.Hook
+	}
+	inters struct {
+		AuthCode, AuthRequest, AuthSession, Connector, DeviceRequest, DeviceToken, Keys,
+		OAuth2Client, OfflineSession, Password, RefreshToken,
+		UserIdentity []ent.Interceptor
+	}
+)
diff --git a/storage/ent/db/config.go b/storage/ent/db/config.go
deleted file mode 100644
index b26f166d29..0000000000
--- a/storage/ent/db/config.go
+++ /dev/null
@@ -1,68 +0,0 @@
-// Code generated by ent, DO NOT EDIT.
-
-package db
-
-import (
-	"entgo.io/ent"
-	"entgo.io/ent/dialect"
-)
-
-// Option function to configure the client.
-type Option func(*config)
-
-// Config is the configuration for the client and its builder.
-type config struct {
-	// driver used for executing database requests.
-	driver dialect.Driver
-	// debug enable a debug logging.
-	debug bool
-	// log used for logging on debug mode.
-	log func(...interface{})
-	// hooks to execute on mutations.
-	hooks *hooks
-}
-
-// hooks per client, for fast access.
-type hooks struct {
-	AuthCode       []ent.Hook
-	AuthRequest    []ent.Hook
-	Connector      []ent.Hook
-	DeviceRequest  []ent.Hook
-	DeviceToken    []ent.Hook
-	Keys           []ent.Hook
-	OAuth2Client   []ent.Hook
-	OfflineSession []ent.Hook
-	Password       []ent.Hook
-	RefreshToken   []ent.Hook
-}
-
-// Options applies the options on the config object.
-func (c *config) options(opts ...Option) {
-	for _, opt := range opts {
-		opt(c)
-	}
-	if c.debug {
-		c.driver = dialect.Debug(c.driver, c.log)
-	}
-}
-
-// Debug enables debug logging on the ent.Driver.
-func Debug() Option {
-	return func(c *config) {
-		c.debug = true
-	}
-}
-
-// Log sets the logging function for debug mode.
-func Log(fn func(...interface{})) Option {
-	return func(c *config) {
-		c.log = fn
-	}
-}
-
-// Driver configures the client driver.
-func Driver(driver dialect.Driver) Option {
-	return func(c *config) {
-		c.driver = driver
-	}
-}
diff --git a/storage/ent/db/connector.go b/storage/ent/db/connector.go
index 65cd4d25e8..812b45f704 100644
--- a/storage/ent/db/connector.go
+++ b/storage/ent/db/connector.go
@@ -3,9 +3,11 @@
 package db
 
 import (
+	"encoding/json"
 	"fmt"
 	"strings"
 
+	"entgo.io/ent"
 	"entgo.io/ent/dialect/sql"
 	"github.com/dexidp/dex/storage/ent/db/connector"
 )
@@ -23,19 +25,22 @@ type Connector struct {
 	ResourceVersion string `json:"resource_version,omitempty"`
 	// Config holds the value of the "config" field.
 	Config []byte `json:"config,omitempty"`
+	// GrantTypes holds the value of the "grant_types" field.
+	GrantTypes   []string `json:"grant_types,omitempty"`
+	selectValues sql.SelectValues
 }
 
 // scanValues returns the types for scanning values from sql.Rows.
-func (*Connector) scanValues(columns []string) ([]interface{}, error) {
-	values := make([]interface{}, len(columns))
+func (*Connector) scanValues(columns []string) ([]any, error) {
+	values := make([]any, len(columns))
 	for i := range columns {
 		switch columns[i] {
-		case connector.FieldConfig:
+		case connector.FieldConfig, connector.FieldGrantTypes:
 			values[i] = new([]byte)
 		case connector.FieldID, connector.FieldType, connector.FieldName, connector.FieldResourceVersion:
 			values[i] = new(sql.NullString)
 		default:
-			return nil, fmt.Errorf("unexpected column %q for type Connector", columns[i])
+			values[i] = new(sql.UnknownType)
 		}
 	}
 	return values, nil
@@ -43,7 +48,7 @@ func (*Connector) scanValues(columns []string) ([]interface{}, error) {
 
 // assignValues assigns the values that were returned from sql.Rows (after scanning)
 // to the Connector fields.
-func (c *Connector) assignValues(columns []string, values []interface{}) error {
+func (_m *Connector) assignValues(columns []string, values []any) error {
 	if m, n := len(values), len(columns); m < n {
 		return fmt.Errorf("mismatch number of scan values: %d != %d", m, n)
 	}
@@ -53,80 +58,93 @@ func (c *Connector) assignValues(columns []string, values []interface{}) error {
 			if value, ok := values[i].(*sql.NullString); !ok {
 				return fmt.Errorf("unexpected type %T for field id", values[i])
 			} else if value.Valid {
-				c.ID = value.String
+				_m.ID = value.String
 			}
 		case connector.FieldType:
 			if value, ok := values[i].(*sql.NullString); !ok {
 				return fmt.Errorf("unexpected type %T for field type", values[i])
 			} else if value.Valid {
-				c.Type = value.String
+				_m.Type = value.String
 			}
 		case connector.FieldName:
 			if value, ok := values[i].(*sql.NullString); !ok {
 				return fmt.Errorf("unexpected type %T for field name", values[i])
 			} else if value.Valid {
-				c.Name = value.String
+				_m.Name = value.String
 			}
 		case connector.FieldResourceVersion:
 			if value, ok := values[i].(*sql.NullString); !ok {
 				return fmt.Errorf("unexpected type %T for field resource_version", values[i])
 			} else if value.Valid {
-				c.ResourceVersion = value.String
+				_m.ResourceVersion = value.String
 			}
 		case connector.FieldConfig:
 			if value, ok := values[i].(*[]byte); !ok {
 				return fmt.Errorf("unexpected type %T for field config", values[i])
 			} else if value != nil {
-				c.Config = *value
+				_m.Config = *value
+			}
+		case connector.FieldGrantTypes:
+			if value, ok := values[i].(*[]byte); !ok {
+				return fmt.Errorf("unexpected type %T for field grant_types", values[i])
+			} else if value != nil && len(*value) > 0 {
+				if err := json.Unmarshal(*value, &_m.GrantTypes); err != nil {
+					return fmt.Errorf("unmarshal field grant_types: %w", err)
+				}
 			}
+		default:
+			_m.selectValues.Set(columns[i], values[i])
 		}
 	}
 	return nil
 }
 
+// Value returns the ent.Value that was dynamically selected and assigned to the Connector.
+// This includes values selected through modifiers, order, etc.
+func (_m *Connector) Value(name string) (ent.Value, error) {
+	return _m.selectValues.Get(name)
+}
+
 // Update returns a builder for updating this Connector.
 // Note that you need to call Connector.Unwrap() before calling this method if this Connector
 // was returned from a transaction, and the transaction was committed or rolled back.
-func (c *Connector) Update() *ConnectorUpdateOne {
-	return (&ConnectorClient{config: c.config}).UpdateOne(c)
+func (_m *Connector) Update() *ConnectorUpdateOne {
+	return NewConnectorClient(_m.config).UpdateOne(_m)
 }
 
 // Unwrap unwraps the Connector entity that was returned from a transaction after it was closed,
 // so that all future queries will be executed through the driver which created the transaction.
-func (c *Connector) Unwrap() *Connector {
-	_tx, ok := c.config.driver.(*txDriver)
+func (_m *Connector) Unwrap() *Connector {
+	_tx, ok := _m.config.driver.(*txDriver)
 	if !ok {
 		panic("db: Connector is not a transactional entity")
 	}
-	c.config.driver = _tx.drv
-	return c
+	_m.config.driver = _tx.drv
+	return _m
 }
 
 // String implements the fmt.Stringer.
-func (c *Connector) String() string {
+func (_m *Connector) String() string {
 	var builder strings.Builder
 	builder.WriteString("Connector(")
-	builder.WriteString(fmt.Sprintf("id=%v, ", c.ID))
+	builder.WriteString(fmt.Sprintf("id=%v, ", _m.ID))
 	builder.WriteString("type=")
-	builder.WriteString(c.Type)
+	builder.WriteString(_m.Type)
 	builder.WriteString(", ")
 	builder.WriteString("name=")
-	builder.WriteString(c.Name)
+	builder.WriteString(_m.Name)
 	builder.WriteString(", ")
 	builder.WriteString("resource_version=")
-	builder.WriteString(c.ResourceVersion)
+	builder.WriteString(_m.ResourceVersion)
 	builder.WriteString(", ")
 	builder.WriteString("config=")
-	builder.WriteString(fmt.Sprintf("%v", c.Config))
+	builder.WriteString(fmt.Sprintf("%v", _m.Config))
+	builder.WriteString(", ")
+	builder.WriteString("grant_types=")
+	builder.WriteString(fmt.Sprintf("%v", _m.GrantTypes))
 	builder.WriteByte(')')
 	return builder.String()
 }
 
 // Connectors is a parsable slice of Connector.
 type Connectors []*Connector
-
-func (c Connectors) config(cfg config) {
-	for _i := range c {
-		c[_i].config = cfg
-	}
-}
diff --git a/storage/ent/db/connector/connector.go b/storage/ent/db/connector/connector.go
index 8f52a8f710..ca603f4dc3 100644
--- a/storage/ent/db/connector/connector.go
+++ b/storage/ent/db/connector/connector.go
@@ -2,6 +2,10 @@
 
 package connector
 
+import (
+	"entgo.io/ent/dialect/sql"
+)
+
 const (
 	// Label holds the string label denoting the connector type in the database.
 	Label = "connector"
@@ -15,6 +19,8 @@ const (
 	FieldResourceVersion = "resource_version"
 	// FieldConfig holds the string denoting the config field in the database.
 	FieldConfig = "config"
+	// FieldGrantTypes holds the string denoting the grant_types field in the database.
+	FieldGrantTypes = "grant_types"
 	// Table holds the table name of the connector in the database.
 	Table = "connectors"
 )
@@ -26,6 +32,7 @@ var Columns = []string{
 	FieldName,
 	FieldResourceVersion,
 	FieldConfig,
+	FieldGrantTypes,
 }
 
 // ValidColumn reports if the column name is valid (part of the table columns).
@@ -46,3 +53,26 @@ var (
 	// IDValidator is a validator for the "id" field. It is called by the builders before save.
 	IDValidator func(string) error
 )
+
+// OrderOption defines the ordering options for the Connector queries.
+type OrderOption func(*sql.Selector)
+
+// ByID orders the results by the id field.
+func ByID(opts ...sql.OrderTermOption) OrderOption {
+	return sql.OrderByField(FieldID, opts...).ToFunc()
+}
+
+// ByType orders the results by the type field.
+func ByType(opts ...sql.OrderTermOption) OrderOption {
+	return sql.OrderByField(FieldType, opts...).ToFunc()
+}
+
+// ByName orders the results by the name field.
+func ByName(opts ...sql.OrderTermOption) OrderOption {
+	return sql.OrderByField(FieldName, opts...).ToFunc()
+}
+
+// ByResourceVersion orders the results by the resource_version field.
+func ByResourceVersion(opts ...sql.OrderTermOption) OrderOption {
+	return sql.OrderByField(FieldResourceVersion, opts...).ToFunc()
+}
diff --git a/storage/ent/db/connector/where.go b/storage/ent/db/connector/where.go
index e48576de93..a09bec6087 100644
--- a/storage/ent/db/connector/where.go
+++ b/storage/ent/db/connector/where.go
@@ -9,492 +9,335 @@ import (
 
 // ID filters vertices based on their ID field.
 func ID(id string) predicate.Connector {
-	return predicate.Connector(func(s *sql.Selector) {
-		s.Where(sql.EQ(s.C(FieldID), id))
-	})
+	return predicate.Connector(sql.FieldEQ(FieldID, id))
 }
 
 // IDEQ applies the EQ predicate on the ID field.
 func IDEQ(id string) predicate.Connector {
-	return predicate.Connector(func(s *sql.Selector) {
-		s.Where(sql.EQ(s.C(FieldID), id))
-	})
+	return predicate.Connector(sql.FieldEQ(FieldID, id))
 }
 
 // IDNEQ applies the NEQ predicate on the ID field.
 func IDNEQ(id string) predicate.Connector {
-	return predicate.Connector(func(s *sql.Selector) {
-		s.Where(sql.NEQ(s.C(FieldID), id))
-	})
+	return predicate.Connector(sql.FieldNEQ(FieldID, id))
 }
 
 // IDIn applies the In predicate on the ID field.
 func IDIn(ids ...string) predicate.Connector {
-	return predicate.Connector(func(s *sql.Selector) {
-		v := make([]interface{}, len(ids))
-		for i := range v {
-			v[i] = ids[i]
-		}
-		s.Where(sql.In(s.C(FieldID), v...))
-	})
+	return predicate.Connector(sql.FieldIn(FieldID, ids...))
 }
 
 // IDNotIn applies the NotIn predicate on the ID field.
 func IDNotIn(ids ...string) predicate.Connector {
-	return predicate.Connector(func(s *sql.Selector) {
-		v := make([]interface{}, len(ids))
-		for i := range v {
-			v[i] = ids[i]
-		}
-		s.Where(sql.NotIn(s.C(FieldID), v...))
-	})
+	return predicate.Connector(sql.FieldNotIn(FieldID, ids...))
 }
 
 // IDGT applies the GT predicate on the ID field.
 func IDGT(id string) predicate.Connector {
-	return predicate.Connector(func(s *sql.Selector) {
-		s.Where(sql.GT(s.C(FieldID), id))
-	})
+	return predicate.Connector(sql.FieldGT(FieldID, id))
 }
 
 // IDGTE applies the GTE predicate on the ID field.
 func IDGTE(id string) predicate.Connector {
-	return predicate.Connector(func(s *sql.Selector) {
-		s.Where(sql.GTE(s.C(FieldID), id))
-	})
+	return predicate.Connector(sql.FieldGTE(FieldID, id))
 }
 
 // IDLT applies the LT predicate on the ID field.
 func IDLT(id string) predicate.Connector {
-	return predicate.Connector(func(s *sql.Selector) {
-		s.Where(sql.LT(s.C(FieldID), id))
-	})
+	return predicate.Connector(sql.FieldLT(FieldID, id))
 }
 
 // IDLTE applies the LTE predicate on the ID field.
 func IDLTE(id string) predicate.Connector {
-	return predicate.Connector(func(s *sql.Selector) {
-		s.Where(sql.LTE(s.C(FieldID), id))
-	})
+	return predicate.Connector(sql.FieldLTE(FieldID, id))
+}
+
+// IDEqualFold applies the EqualFold predicate on the ID field.
+func IDEqualFold(id string) predicate.Connector {
+	return predicate.Connector(sql.FieldEqualFold(FieldID, id))
+}
+
+// IDContainsFold applies the ContainsFold predicate on the ID field.
+func IDContainsFold(id string) predicate.Connector {
+	return predicate.Connector(sql.FieldContainsFold(FieldID, id))
 }
 
 // Type applies equality check predicate on the "type" field. It's identical to TypeEQ.
 func Type(v string) predicate.Connector {
-	return predicate.Connector(func(s *sql.Selector) {
-		s.Where(sql.EQ(s.C(FieldType), v))
-	})
+	return predicate.Connector(sql.FieldEQ(FieldType, v))
 }
 
 // Name applies equality check predicate on the "name" field. It's identical to NameEQ.
 func Name(v string) predicate.Connector {
-	return predicate.Connector(func(s *sql.Selector) {
-		s.Where(sql.EQ(s.C(FieldName), v))
-	})
+	return predicate.Connector(sql.FieldEQ(FieldName, v))
 }
 
 // ResourceVersion applies equality check predicate on the "resource_version" field. It's identical to ResourceVersionEQ.
 func ResourceVersion(v string) predicate.Connector {
-	return predicate.Connector(func(s *sql.Selector) {
-		s.Where(sql.EQ(s.C(FieldResourceVersion), v))
-	})
+	return predicate.Connector(sql.FieldEQ(FieldResourceVersion, v))
 }
 
 // Config applies equality check predicate on the "config" field. It's identical to ConfigEQ.
 func Config(v []byte) predicate.Connector {
-	return predicate.Connector(func(s *sql.Selector) {
-		s.Where(sql.EQ(s.C(FieldConfig), v))
-	})
+	return predicate.Connector(sql.FieldEQ(FieldConfig, v))
 }
 
 // TypeEQ applies the EQ predicate on the "type" field.
 func TypeEQ(v string) predicate.Connector {
-	return predicate.Connector(func(s *sql.Selector) {
-		s.Where(sql.EQ(s.C(FieldType), v))
-	})
+	return predicate.Connector(sql.FieldEQ(FieldType, v))
 }
 
 // TypeNEQ applies the NEQ predicate on the "type" field.
 func TypeNEQ(v string) predicate.Connector {
-	return predicate.Connector(func(s *sql.Selector) {
-		s.Where(sql.NEQ(s.C(FieldType), v))
-	})
+	return predicate.Connector(sql.FieldNEQ(FieldType, v))
 }
 
 // TypeIn applies the In predicate on the "type" field.
 func TypeIn(vs ...string) predicate.Connector {
-	v := make([]interface{}, len(vs))
-	for i := range v {
-		v[i] = vs[i]
-	}
-	return predicate.Connector(func(s *sql.Selector) {
-		s.Where(sql.In(s.C(FieldType), v...))
-	})
+	return predicate.Connector(sql.FieldIn(FieldType, vs...))
 }
 
 // TypeNotIn applies the NotIn predicate on the "type" field.
 func TypeNotIn(vs ...string) predicate.Connector {
-	v := make([]interface{}, len(vs))
-	for i := range v {
-		v[i] = vs[i]
-	}
-	return predicate.Connector(func(s *sql.Selector) {
-		s.Where(sql.NotIn(s.C(FieldType), v...))
-	})
+	return predicate.Connector(sql.FieldNotIn(FieldType, vs...))
 }
 
 // TypeGT applies the GT predicate on the "type" field.
 func TypeGT(v string) predicate.Connector {
-	return predicate.Connector(func(s *sql.Selector) {
-		s.Where(sql.GT(s.C(FieldType), v))
-	})
+	return predicate.Connector(sql.FieldGT(FieldType, v))
 }
 
 // TypeGTE applies the GTE predicate on the "type" field.
 func TypeGTE(v string) predicate.Connector {
-	return predicate.Connector(func(s *sql.Selector) {
-		s.Where(sql.GTE(s.C(FieldType), v))
-	})
+	return predicate.Connector(sql.FieldGTE(FieldType, v))
 }
 
 // TypeLT applies the LT predicate on the "type" field.
 func TypeLT(v string) predicate.Connector {
-	return predicate.Connector(func(s *sql.Selector) {
-		s.Where(sql.LT(s.C(FieldType), v))
-	})
+	return predicate.Connector(sql.FieldLT(FieldType, v))
 }
 
 // TypeLTE applies the LTE predicate on the "type" field.
 func TypeLTE(v string) predicate.Connector {
-	return predicate.Connector(func(s *sql.Selector) {
-		s.Where(sql.LTE(s.C(FieldType), v))
-	})
+	return predicate.Connector(sql.FieldLTE(FieldType, v))
 }
 
 // TypeContains applies the Contains predicate on the "type" field.
 func TypeContains(v string) predicate.Connector {
-	return predicate.Connector(func(s *sql.Selector) {
-		s.Where(sql.Contains(s.C(FieldType), v))
-	})
+	return predicate.Connector(sql.FieldContains(FieldType, v))
 }
 
 // TypeHasPrefix applies the HasPrefix predicate on the "type" field.
 func TypeHasPrefix(v string) predicate.Connector {
-	return predicate.Connector(func(s *sql.Selector) {
-		s.Where(sql.HasPrefix(s.C(FieldType), v))
-	})
+	return predicate.Connector(sql.FieldHasPrefix(FieldType, v))
 }
 
 // TypeHasSuffix applies the HasSuffix predicate on the "type" field.
 func TypeHasSuffix(v string) predicate.Connector {
-	return predicate.Connector(func(s *sql.Selector) {
-		s.Where(sql.HasSuffix(s.C(FieldType), v))
-	})
+	return predicate.Connector(sql.FieldHasSuffix(FieldType, v))
 }
 
 // TypeEqualFold applies the EqualFold predicate on the "type" field.
 func TypeEqualFold(v string) predicate.Connector {
-	return predicate.Connector(func(s *sql.Selector) {
-		s.Where(sql.EqualFold(s.C(FieldType), v))
-	})
+	return predicate.Connector(sql.FieldEqualFold(FieldType, v))
 }
 
 // TypeContainsFold applies the ContainsFold predicate on the "type" field.
 func TypeContainsFold(v string) predicate.Connector {
-	return predicate.Connector(func(s *sql.Selector) {
-		s.Where(sql.ContainsFold(s.C(FieldType), v))
-	})
+	return predicate.Connector(sql.FieldContainsFold(FieldType, v))
 }
 
 // NameEQ applies the EQ predicate on the "name" field.
 func NameEQ(v string) predicate.Connector {
-	return predicate.Connector(func(s *sql.Selector) {
-		s.Where(sql.EQ(s.C(FieldName), v))
-	})
+	return predicate.Connector(sql.FieldEQ(FieldName, v))
 }
 
 // NameNEQ applies the NEQ predicate on the "name" field.
 func NameNEQ(v string) predicate.Connector {
-	return predicate.Connector(func(s *sql.Selector) {
-		s.Where(sql.NEQ(s.C(FieldName), v))
-	})
+	return predicate.Connector(sql.FieldNEQ(FieldName, v))
 }
 
 // NameIn applies the In predicate on the "name" field.
 func NameIn(vs ...string) predicate.Connector {
-	v := make([]interface{}, len(vs))
-	for i := range v {
-		v[i] = vs[i]
-	}
-	return predicate.Connector(func(s *sql.Selector) {
-		s.Where(sql.In(s.C(FieldName), v...))
-	})
+	return predicate.Connector(sql.FieldIn(FieldName, vs...))
 }
 
 // NameNotIn applies the NotIn predicate on the "name" field.
 func NameNotIn(vs ...string) predicate.Connector {
-	v := make([]interface{}, len(vs))
-	for i := range v {
-		v[i] = vs[i]
-	}
-	return predicate.Connector(func(s *sql.Selector) {
-		s.Where(sql.NotIn(s.C(FieldName), v...))
-	})
+	return predicate.Connector(sql.FieldNotIn(FieldName, vs...))
 }
 
 // NameGT applies the GT predicate on the "name" field.
 func NameGT(v string) predicate.Connector {
-	return predicate.Connector(func(s *sql.Selector) {
-		s.Where(sql.GT(s.C(FieldName), v))
-	})
+	return predicate.Connector(sql.FieldGT(FieldName, v))
 }
 
 // NameGTE applies the GTE predicate on the "name" field.
 func NameGTE(v string) predicate.Connector {
-	return predicate.Connector(func(s *sql.Selector) {
-		s.Where(sql.GTE(s.C(FieldName), v))
-	})
+	return predicate.Connector(sql.FieldGTE(FieldName, v))
 }
 
 // NameLT applies the LT predicate on the "name" field.
 func NameLT(v string) predicate.Connector {
-	return predicate.Connector(func(s *sql.Selector) {
-		s.Where(sql.LT(s.C(FieldName), v))
-	})
+	return predicate.Connector(sql.FieldLT(FieldName, v))
 }
 
 // NameLTE applies the LTE predicate on the "name" field.
 func NameLTE(v string) predicate.Connector {
-	return predicate.Connector(func(s *sql.Selector) {
-		s.Where(sql.LTE(s.C(FieldName), v))
-	})
+	return predicate.Connector(sql.FieldLTE(FieldName, v))
 }
 
 // NameContains applies the Contains predicate on the "name" field.
 func NameContains(v string) predicate.Connector {
-	return predicate.Connector(func(s *sql.Selector) {
-		s.Where(sql.Contains(s.C(FieldName), v))
-	})
+	return predicate.Connector(sql.FieldContains(FieldName, v))
 }
 
 // NameHasPrefix applies the HasPrefix predicate on the "name" field.
 func NameHasPrefix(v string) predicate.Connector {
-	return predicate.Connector(func(s *sql.Selector) {
-		s.Where(sql.HasPrefix(s.C(FieldName), v))
-	})
+	return predicate.Connector(sql.FieldHasPrefix(FieldName, v))
 }
 
 // NameHasSuffix applies the HasSuffix predicate on the "name" field.
 func NameHasSuffix(v string) predicate.Connector {
-	return predicate.Connector(func(s *sql.Selector) {
-		s.Where(sql.HasSuffix(s.C(FieldName), v))
-	})
+	return predicate.Connector(sql.FieldHasSuffix(FieldName, v))
 }
 
 // NameEqualFold applies the EqualFold predicate on the "name" field.
 func NameEqualFold(v string) predicate.Connector {
-	return predicate.Connector(func(s *sql.Selector) {
-		s.Where(sql.EqualFold(s.C(FieldName), v))
-	})
+	return predicate.Connector(sql.FieldEqualFold(FieldName, v))
 }
 
 // NameContainsFold applies the ContainsFold predicate on the "name" field.
 func NameContainsFold(v string) predicate.Connector {
-	return predicate.Connector(func(s *sql.Selector) {
-		s.Where(sql.ContainsFold(s.C(FieldName), v))
-	})
+	return predicate.Connector(sql.FieldContainsFold(FieldName, v))
 }
 
 // ResourceVersionEQ applies the EQ predicate on the "resource_version" field.
 func ResourceVersionEQ(v string) predicate.Connector {
-	return predicate.Connector(func(s *sql.Selector) {
-		s.Where(sql.EQ(s.C(FieldResourceVersion), v))
-	})
+	return predicate.Connector(sql.FieldEQ(FieldResourceVersion, v))
 }
 
 // ResourceVersionNEQ applies the NEQ predicate on the "resource_version" field.
 func ResourceVersionNEQ(v string) predicate.Connector {
-	return predicate.Connector(func(s *sql.Selector) {
-		s.Where(sql.NEQ(s.C(FieldResourceVersion), v))
-	})
+	return predicate.Connector(sql.FieldNEQ(FieldResourceVersion, v))
 }
 
 // ResourceVersionIn applies the In predicate on the "resource_version" field.
 func ResourceVersionIn(vs ...string) predicate.Connector {
-	v := make([]interface{}, len(vs))
-	for i := range v {
-		v[i] = vs[i]
-	}
-	return predicate.Connector(func(s *sql.Selector) {
-		s.Where(sql.In(s.C(FieldResourceVersion), v...))
-	})
+	return predicate.Connector(sql.FieldIn(FieldResourceVersion, vs...))
 }
 
 // ResourceVersionNotIn applies the NotIn predicate on the "resource_version" field.
 func ResourceVersionNotIn(vs ...string) predicate.Connector {
-	v := make([]interface{}, len(vs))
-	for i := range v {
-		v[i] = vs[i]
-	}
-	return predicate.Connector(func(s *sql.Selector) {
-		s.Where(sql.NotIn(s.C(FieldResourceVersion), v...))
-	})
+	return predicate.Connector(sql.FieldNotIn(FieldResourceVersion, vs...))
 }
 
 // ResourceVersionGT applies the GT predicate on the "resource_version" field.
 func ResourceVersionGT(v string) predicate.Connector {
-	return predicate.Connector(func(s *sql.Selector) {
-		s.Where(sql.GT(s.C(FieldResourceVersion), v))
-	})
+	return predicate.Connector(sql.FieldGT(FieldResourceVersion, v))
 }
 
 // ResourceVersionGTE applies the GTE predicate on the "resource_version" field.
 func ResourceVersionGTE(v string) predicate.Connector {
-	return predicate.Connector(func(s *sql.Selector) {
-		s.Where(sql.GTE(s.C(FieldResourceVersion), v))
-	})
+	return predicate.Connector(sql.FieldGTE(FieldResourceVersion, v))
 }
 
 // ResourceVersionLT applies the LT predicate on the "resource_version" field.
 func ResourceVersionLT(v string) predicate.Connector {
-	return predicate.Connector(func(s *sql.Selector) {
-		s.Where(sql.LT(s.C(FieldResourceVersion), v))
-	})
+	return predicate.Connector(sql.FieldLT(FieldResourceVersion, v))
 }
 
 // ResourceVersionLTE applies the LTE predicate on the "resource_version" field.
 func ResourceVersionLTE(v string) predicate.Connector {
-	return predicate.Connector(func(s *sql.Selector) {
-		s.Where(sql.LTE(s.C(FieldResourceVersion), v))
-	})
+	return predicate.Connector(sql.FieldLTE(FieldResourceVersion, v))
 }
 
 // ResourceVersionContains applies the Contains predicate on the "resource_version" field.
 func ResourceVersionContains(v string) predicate.Connector {
-	return predicate.Connector(func(s *sql.Selector) {
-		s.Where(sql.Contains(s.C(FieldResourceVersion), v))
-	})
+	return predicate.Connector(sql.FieldContains(FieldResourceVersion, v))
 }
 
 // ResourceVersionHasPrefix applies the HasPrefix predicate on the "resource_version" field.
 func ResourceVersionHasPrefix(v string) predicate.Connector {
-	return predicate.Connector(func(s *sql.Selector) {
-		s.Where(sql.HasPrefix(s.C(FieldResourceVersion), v))
-	})
+	return predicate.Connector(sql.FieldHasPrefix(FieldResourceVersion, v))
 }
 
 // ResourceVersionHasSuffix applies the HasSuffix predicate on the "resource_version" field.
 func ResourceVersionHasSuffix(v string) predicate.Connector {
-	return predicate.Connector(func(s *sql.Selector) {
-		s.Where(sql.HasSuffix(s.C(FieldResourceVersion), v))
-	})
+	return predicate.Connector(sql.FieldHasSuffix(FieldResourceVersion, v))
 }
 
 // ResourceVersionEqualFold applies the EqualFold predicate on the "resource_version" field.
 func ResourceVersionEqualFold(v string) predicate.Connector {
-	return predicate.Connector(func(s *sql.Selector) {
-		s.Where(sql.EqualFold(s.C(FieldResourceVersion), v))
-	})
+	return predicate.Connector(sql.FieldEqualFold(FieldResourceVersion, v))
 }
 
 // ResourceVersionContainsFold applies the ContainsFold predicate on the "resource_version" field.
 func ResourceVersionContainsFold(v string) predicate.Connector {
-	return predicate.Connector(func(s *sql.Selector) {
-		s.Where(sql.ContainsFold(s.C(FieldResourceVersion), v))
-	})
+	return predicate.Connector(sql.FieldContainsFold(FieldResourceVersion, v))
 }
 
 // ConfigEQ applies the EQ predicate on the "config" field.
 func ConfigEQ(v []byte) predicate.Connector {
-	return predicate.Connector(func(s *sql.Selector) {
-		s.Where(sql.EQ(s.C(FieldConfig), v))
-	})
+	return predicate.Connector(sql.FieldEQ(FieldConfig, v))
 }
 
 // ConfigNEQ applies the NEQ predicate on the "config" field.
 func ConfigNEQ(v []byte) predicate.Connector {
-	return predicate.Connector(func(s *sql.Selector) {
-		s.Where(sql.NEQ(s.C(FieldConfig), v))
-	})
+	return predicate.Connector(sql.FieldNEQ(FieldConfig, v))
 }
 
 // ConfigIn applies the In predicate on the "config" field.
 func ConfigIn(vs ...[]byte) predicate.Connector {
-	v := make([]interface{}, len(vs))
-	for i := range v {
-		v[i] = vs[i]
-	}
-	return predicate.Connector(func(s *sql.Selector) {
-		s.Where(sql.In(s.C(FieldConfig), v...))
-	})
+	return predicate.Connector(sql.FieldIn(FieldConfig, vs...))
 }
 
 // ConfigNotIn applies the NotIn predicate on the "config" field.
 func ConfigNotIn(vs ...[]byte) predicate.Connector {
-	v := make([]interface{}, len(vs))
-	for i := range v {
-		v[i] = vs[i]
-	}
-	return predicate.Connector(func(s *sql.Selector) {
-		s.Where(sql.NotIn(s.C(FieldConfig), v...))
-	})
+	return predicate.Connector(sql.FieldNotIn(FieldConfig, vs...))
 }
 
 // ConfigGT applies the GT predicate on the "config" field.
 func ConfigGT(v []byte) predicate.Connector {
-	return predicate.Connector(func(s *sql.Selector) {
-		s.Where(sql.GT(s.C(FieldConfig), v))
-	})
+	return predicate.Connector(sql.FieldGT(FieldConfig, v))
 }
 
 // ConfigGTE applies the GTE predicate on the "config" field.
 func ConfigGTE(v []byte) predicate.Connector {
-	return predicate.Connector(func(s *sql.Selector) {
-		s.Where(sql.GTE(s.C(FieldConfig), v))
-	})
+	return predicate.Connector(sql.FieldGTE(FieldConfig, v))
 }
 
 // ConfigLT applies the LT predicate on the "config" field.
 func ConfigLT(v []byte) predicate.Connector {
-	return predicate.Connector(func(s *sql.Selector) {
-		s.Where(sql.LT(s.C(FieldConfig), v))
-	})
+	return predicate.Connector(sql.FieldLT(FieldConfig, v))
 }
 
 // ConfigLTE applies the LTE predicate on the "config" field.
 func ConfigLTE(v []byte) predicate.Connector {
-	return predicate.Connector(func(s *sql.Selector) {
-		s.Where(sql.LTE(s.C(FieldConfig), v))
-	})
+	return predicate.Connector(sql.FieldLTE(FieldConfig, v))
+}
+
+// GrantTypesIsNil applies the IsNil predicate on the "grant_types" field.
+func GrantTypesIsNil() predicate.Connector {
+	return predicate.Connector(sql.FieldIsNull(FieldGrantTypes))
+}
+
+// GrantTypesNotNil applies the NotNil predicate on the "grant_types" field.
+func GrantTypesNotNil() predicate.Connector {
+	return predicate.Connector(sql.FieldNotNull(FieldGrantTypes))
 }
 
 // And groups predicates with the AND operator between them.
 func And(predicates ...predicate.Connector) predicate.Connector {
-	return predicate.Connector(func(s *sql.Selector) {
-		s1 := s.Clone().SetP(nil)
-		for _, p := range predicates {
-			p(s1)
-		}
-		s.Where(s1.P())
-	})
+	return predicate.Connector(sql.AndPredicates(predicates...))
 }
 
 // Or groups predicates with the OR operator between them.
 func Or(predicates ...predicate.Connector) predicate.Connector {
-	return predicate.Connector(func(s *sql.Selector) {
-		s1 := s.Clone().SetP(nil)
-		for i, p := range predicates {
-			if i > 0 {
-				s1.Or()
-			}
-			p(s1)
-		}
-		s.Where(s1.P())
-	})
+	return predicate.Connector(sql.OrPredicates(predicates...))
 }
 
 // Not applies the not operator on the given predicate.
 func Not(p predicate.Connector) predicate.Connector {
-	return predicate.Connector(func(s *sql.Selector) {
-		p(s.Not())
-	})
+	return predicate.Connector(sql.NotPredicates(p))
 }
diff --git a/storage/ent/db/connector_create.go b/storage/ent/db/connector_create.go
index ecff1c2f18..4e9cc35b47 100644
--- a/storage/ent/db/connector_create.go
+++ b/storage/ent/db/connector_create.go
@@ -20,90 +20,54 @@ type ConnectorCreate struct {
 }
 
 // SetType sets the "type" field.
-func (cc *ConnectorCreate) SetType(s string) *ConnectorCreate {
-	cc.mutation.SetType(s)
-	return cc
+func (_c *ConnectorCreate) SetType(v string) *ConnectorCreate {
+	_c.mutation.SetType(v)
+	return _c
 }
 
 // SetName sets the "name" field.
-func (cc *ConnectorCreate) SetName(s string) *ConnectorCreate {
-	cc.mutation.SetName(s)
-	return cc
+func (_c *ConnectorCreate) SetName(v string) *ConnectorCreate {
+	_c.mutation.SetName(v)
+	return _c
 }
 
 // SetResourceVersion sets the "resource_version" field.
-func (cc *ConnectorCreate) SetResourceVersion(s string) *ConnectorCreate {
-	cc.mutation.SetResourceVersion(s)
-	return cc
+func (_c *ConnectorCreate) SetResourceVersion(v string) *ConnectorCreate {
+	_c.mutation.SetResourceVersion(v)
+	return _c
 }
 
 // SetConfig sets the "config" field.
-func (cc *ConnectorCreate) SetConfig(b []byte) *ConnectorCreate {
-	cc.mutation.SetConfig(b)
-	return cc
+func (_c *ConnectorCreate) SetConfig(v []byte) *ConnectorCreate {
+	_c.mutation.SetConfig(v)
+	return _c
+}
+
+// SetGrantTypes sets the "grant_types" field.
+func (_c *ConnectorCreate) SetGrantTypes(v []string) *ConnectorCreate {
+	_c.mutation.SetGrantTypes(v)
+	return _c
 }
 
 // SetID sets the "id" field.
-func (cc *ConnectorCreate) SetID(s string) *ConnectorCreate {
-	cc.mutation.SetID(s)
-	return cc
+func (_c *ConnectorCreate) SetID(v string) *ConnectorCreate {
+	_c.mutation.SetID(v)
+	return _c
 }
 
 // Mutation returns the ConnectorMutation object of the builder.
-func (cc *ConnectorCreate) Mutation() *ConnectorMutation {
-	return cc.mutation
+func (_c *ConnectorCreate) Mutation() *ConnectorMutation {
+	return _c.mutation
 }
 
 // Save creates the Connector in the database.
-func (cc *ConnectorCreate) Save(ctx context.Context) (*Connector, error) {
-	var (
-		err  error
-		node *Connector
-	)
-	if len(cc.hooks) == 0 {
-		if err = cc.check(); err != nil {
-			return nil, err
-		}
-		node, err = cc.sqlSave(ctx)
-	} else {
-		var mut Mutator = MutateFunc(func(ctx context.Context, m Mutation) (Value, error) {
-			mutation, ok := m.(*ConnectorMutation)
-			if !ok {
-				return nil, fmt.Errorf("unexpected mutation type %T", m)
-			}
-			if err = cc.check(); err != nil {
-				return nil, err
-			}
-			cc.mutation = mutation
-			if node, err = cc.sqlSave(ctx); err != nil {
-				return nil, err
-			}
-			mutation.id = &node.ID
-			mutation.done = true
-			return node, err
-		})
-		for i := len(cc.hooks) - 1; i >= 0; i-- {
-			if cc.hooks[i] == nil {
-				return nil, fmt.Errorf("db: uninitialized hook (forgotten import db/runtime?)")
-			}
-			mut = cc.hooks[i](mut)
-		}
-		v, err := mut.Mutate(ctx, cc.mutation)
-		if err != nil {
-			return nil, err
-		}
-		nv, ok := v.(*Connector)
-		if !ok {
-			return nil, fmt.Errorf("unexpected node type %T returned from ConnectorMutation", v)
-		}
-		node = nv
-	}
-	return node, err
+func (_c *ConnectorCreate) Save(ctx context.Context) (*Connector, error) {
+	return withHooks(ctx, _c.sqlSave, _c.mutation, _c.hooks)
 }
 
 // SaveX calls Save and panics if Save returns an error.
-func (cc *ConnectorCreate) SaveX(ctx context.Context) *Connector {
-	v, err := cc.Save(ctx)
+func (_c *ConnectorCreate) SaveX(ctx context.Context) *Connector {
+	v, err := _c.Save(ctx)
 	if err != nil {
 		panic(err)
 	}
@@ -111,43 +75,43 @@ func (cc *ConnectorCreate) SaveX(ctx context.Context) *Connector {
 }
 
 // Exec executes the query.
-func (cc *ConnectorCreate) Exec(ctx context.Context) error {
-	_, err := cc.Save(ctx)
+func (_c *ConnectorCreate) Exec(ctx context.Context) error {
+	_, err := _c.Save(ctx)
 	return err
 }
 
 // ExecX is like Exec, but panics if an error occurs.
-func (cc *ConnectorCreate) ExecX(ctx context.Context) {
-	if err := cc.Exec(ctx); err != nil {
+func (_c *ConnectorCreate) ExecX(ctx context.Context) {
+	if err := _c.Exec(ctx); err != nil {
 		panic(err)
 	}
 }
 
 // check runs all checks and user-defined validators on the builder.
-func (cc *ConnectorCreate) check() error {
-	if _, ok := cc.mutation.GetType(); !ok {
+func (_c *ConnectorCreate) check() error {
+	if _, ok := _c.mutation.GetType(); !ok {
 		return &ValidationError{Name: "type", err: errors.New(`db: missing required field "Connector.type"`)}
 	}
-	if v, ok := cc.mutation.GetType(); ok {
+	if v, ok := _c.mutation.GetType(); ok {
 		if err := connector.TypeValidator(v); err != nil {
 			return &ValidationError{Name: "type", err: fmt.Errorf(`db: validator failed for field "Connector.type": %w`, err)}
 		}
 	}
-	if _, ok := cc.mutation.Name(); !ok {
+	if _, ok := _c.mutation.Name(); !ok {
 		return &ValidationError{Name: "name", err: errors.New(`db: missing required field "Connector.name"`)}
 	}
-	if v, ok := cc.mutation.Name(); ok {
+	if v, ok := _c.mutation.Name(); ok {
 		if err := connector.NameValidator(v); err != nil {
 			return &ValidationError{Name: "name", err: fmt.Errorf(`db: validator failed for field "Connector.name": %w`, err)}
 		}
 	}
-	if _, ok := cc.mutation.ResourceVersion(); !ok {
+	if _, ok := _c.mutation.ResourceVersion(); !ok {
 		return &ValidationError{Name: "resource_version", err: errors.New(`db: missing required field "Connector.resource_version"`)}
 	}
-	if _, ok := cc.mutation.Config(); !ok {
+	if _, ok := _c.mutation.Config(); !ok {
 		return &ValidationError{Name: "config", err: errors.New(`db: missing required field "Connector.config"`)}
 	}
-	if v, ok := cc.mutation.ID(); ok {
+	if v, ok := _c.mutation.ID(); ok {
 		if err := connector.IDValidator(v); err != nil {
 			return &ValidationError{Name: "id", err: fmt.Errorf(`db: validator failed for field "Connector.id": %w`, err)}
 		}
@@ -155,9 +119,12 @@ func (cc *ConnectorCreate) check() error {
 	return nil
 }
 
-func (cc *ConnectorCreate) sqlSave(ctx context.Context) (*Connector, error) {
-	_node, _spec := cc.createSpec()
-	if err := sqlgraph.CreateNode(ctx, cc.driver, _spec); err != nil {
+func (_c *ConnectorCreate) sqlSave(ctx context.Context) (*Connector, error) {
+	if err := _c.check(); err != nil {
+		return nil, err
+	}
+	_node, _spec := _c.createSpec()
+	if err := sqlgraph.CreateNode(ctx, _c.driver, _spec); err != nil {
 		if sqlgraph.IsConstraintError(err) {
 			err = &ConstraintError{msg: err.Error(), wrap: err}
 		}
@@ -170,73 +137,61 @@ func (cc *ConnectorCreate) sqlSave(ctx context.Context) (*Connector, error) {
 			return nil, fmt.Errorf("unexpected Connector.ID type: %T", _spec.ID.Value)
 		}
 	}
+	_c.mutation.id = &_node.ID
+	_c.mutation.done = true
 	return _node, nil
 }
 
-func (cc *ConnectorCreate) createSpec() (*Connector, *sqlgraph.CreateSpec) {
+func (_c *ConnectorCreate) createSpec() (*Connector, *sqlgraph.CreateSpec) {
 	var (
-		_node = &Connector{config: cc.config}
-		_spec = &sqlgraph.CreateSpec{
-			Table: connector.Table,
-			ID: &sqlgraph.FieldSpec{
-				Type:   field.TypeString,
-				Column: connector.FieldID,
-			},
-		}
+		_node = &Connector{config: _c.config}
+		_spec = sqlgraph.NewCreateSpec(connector.Table, sqlgraph.NewFieldSpec(connector.FieldID, field.TypeString))
 	)
-	if id, ok := cc.mutation.ID(); ok {
+	if id, ok := _c.mutation.ID(); ok {
 		_node.ID = id
 		_spec.ID.Value = id
 	}
-	if value, ok := cc.mutation.GetType(); ok {
-		_spec.Fields = append(_spec.Fields, &sqlgraph.FieldSpec{
-			Type:   field.TypeString,
-			Value:  value,
-			Column: connector.FieldType,
-		})
+	if value, ok := _c.mutation.GetType(); ok {
+		_spec.SetField(connector.FieldType, field.TypeString, value)
 		_node.Type = value
 	}
-	if value, ok := cc.mutation.Name(); ok {
-		_spec.Fields = append(_spec.Fields, &sqlgraph.FieldSpec{
-			Type:   field.TypeString,
-			Value:  value,
-			Column: connector.FieldName,
-		})
+	if value, ok := _c.mutation.Name(); ok {
+		_spec.SetField(connector.FieldName, field.TypeString, value)
 		_node.Name = value
 	}
-	if value, ok := cc.mutation.ResourceVersion(); ok {
-		_spec.Fields = append(_spec.Fields, &sqlgraph.FieldSpec{
-			Type:   field.TypeString,
-			Value:  value,
-			Column: connector.FieldResourceVersion,
-		})
+	if value, ok := _c.mutation.ResourceVersion(); ok {
+		_spec.SetField(connector.FieldResourceVersion, field.TypeString, value)
 		_node.ResourceVersion = value
 	}
-	if value, ok := cc.mutation.Config(); ok {
-		_spec.Fields = append(_spec.Fields, &sqlgraph.FieldSpec{
-			Type:   field.TypeBytes,
-			Value:  value,
-			Column: connector.FieldConfig,
-		})
+	if value, ok := _c.mutation.Config(); ok {
+		_spec.SetField(connector.FieldConfig, field.TypeBytes, value)
 		_node.Config = value
 	}
+	if value, ok := _c.mutation.GrantTypes(); ok {
+		_spec.SetField(connector.FieldGrantTypes, field.TypeJSON, value)
+		_node.GrantTypes = value
+	}
 	return _node, _spec
 }
 
 // ConnectorCreateBulk is the builder for creating many Connector entities in bulk.
 type ConnectorCreateBulk struct {
 	config
+	err      error
 	builders []*ConnectorCreate
 }
 
 // Save creates the Connector entities in the database.
-func (ccb *ConnectorCreateBulk) Save(ctx context.Context) ([]*Connector, error) {
-	specs := make([]*sqlgraph.CreateSpec, len(ccb.builders))
-	nodes := make([]*Connector, len(ccb.builders))
-	mutators := make([]Mutator, len(ccb.builders))
-	for i := range ccb.builders {
+func (_c *ConnectorCreateBulk) Save(ctx context.Context) ([]*Connector, error) {
+	if _c.err != nil {
+		return nil, _c.err
+	}
+	specs := make([]*sqlgraph.CreateSpec, len(_c.builders))
+	nodes := make([]*Connector, len(_c.builders))
+	mutators := make([]Mutator, len(_c.builders))
+	for i := range _c.builders {
 		func(i int, root context.Context) {
-			builder := ccb.builders[i]
+			builder := _c.builders[i]
 			var mut Mutator = MutateFunc(func(ctx context.Context, m Mutation) (Value, error) {
 				mutation, ok := m.(*ConnectorMutation)
 				if !ok {
@@ -246,14 +201,14 @@ func (ccb *ConnectorCreateBulk) Save(ctx context.Context) ([]*Connector, error)
 					return nil, err
 				}
 				builder.mutation = mutation
-				nodes[i], specs[i] = builder.createSpec()
 				var err error
+				nodes[i], specs[i] = builder.createSpec()
 				if i < len(mutators)-1 {
-					_, err = mutators[i+1].Mutate(root, ccb.builders[i+1].mutation)
+					_, err = mutators[i+1].Mutate(root, _c.builders[i+1].mutation)
 				} else {
 					spec := &sqlgraph.BatchCreateSpec{Nodes: specs}
 					// Invoke the actual operation on the latest mutation in the chain.
-					if err = sqlgraph.BatchCreate(ctx, ccb.driver, spec); err != nil {
+					if err = sqlgraph.BatchCreate(ctx, _c.driver, spec); err != nil {
 						if sqlgraph.IsConstraintError(err) {
 							err = &ConstraintError{msg: err.Error(), wrap: err}
 						}
@@ -273,7 +228,7 @@ func (ccb *ConnectorCreateBulk) Save(ctx context.Context) ([]*Connector, error)
 		}(i, ctx)
 	}
 	if len(mutators) > 0 {
-		if _, err := mutators[0].Mutate(ctx, ccb.builders[0].mutation); err != nil {
+		if _, err := mutators[0].Mutate(ctx, _c.builders[0].mutation); err != nil {
 			return nil, err
 		}
 	}
@@ -281,8 +236,8 @@ func (ccb *ConnectorCreateBulk) Save(ctx context.Context) ([]*Connector, error)
 }
 
 // SaveX is like Save, but panics if an error occurs.
-func (ccb *ConnectorCreateBulk) SaveX(ctx context.Context) []*Connector {
-	v, err := ccb.Save(ctx)
+func (_c *ConnectorCreateBulk) SaveX(ctx context.Context) []*Connector {
+	v, err := _c.Save(ctx)
 	if err != nil {
 		panic(err)
 	}
@@ -290,14 +245,14 @@ func (ccb *ConnectorCreateBulk) SaveX(ctx context.Context) []*Connector {
 }
 
 // Exec executes the query.
-func (ccb *ConnectorCreateBulk) Exec(ctx context.Context) error {
-	_, err := ccb.Save(ctx)
+func (_c *ConnectorCreateBulk) Exec(ctx context.Context) error {
+	_, err := _c.Save(ctx)
 	return err
 }
 
 // ExecX is like Exec, but panics if an error occurs.
-func (ccb *ConnectorCreateBulk) ExecX(ctx context.Context) {
-	if err := ccb.Exec(ctx); err != nil {
+func (_c *ConnectorCreateBulk) ExecX(ctx context.Context) {
+	if err := _c.Exec(ctx); err != nil {
 		panic(err)
 	}
 }
diff --git a/storage/ent/db/connector_delete.go b/storage/ent/db/connector_delete.go
index 0c5381eef5..4290b8db03 100644
--- a/storage/ent/db/connector_delete.go
+++ b/storage/ent/db/connector_delete.go
@@ -4,7 +4,6 @@ package db
 
 import (
 	"context"
-	"fmt"
 
 	"entgo.io/ent/dialect/sql"
 	"entgo.io/ent/dialect/sql/sqlgraph"
@@ -21,84 +20,56 @@ type ConnectorDelete struct {
 }
 
 // Where appends a list predicates to the ConnectorDelete builder.
-func (cd *ConnectorDelete) Where(ps ...predicate.Connector) *ConnectorDelete {
-	cd.mutation.Where(ps...)
-	return cd
+func (_d *ConnectorDelete) Where(ps ...predicate.Connector) *ConnectorDelete {
+	_d.mutation.Where(ps...)
+	return _d
 }
 
 // Exec executes the deletion query and returns how many vertices were deleted.
-func (cd *ConnectorDelete) Exec(ctx context.Context) (int, error) {
-	var (
-		err      error
-		affected int
-	)
-	if len(cd.hooks) == 0 {
-		affected, err = cd.sqlExec(ctx)
-	} else {
-		var mut Mutator = MutateFunc(func(ctx context.Context, m Mutation) (Value, error) {
-			mutation, ok := m.(*ConnectorMutation)
-			if !ok {
-				return nil, fmt.Errorf("unexpected mutation type %T", m)
-			}
-			cd.mutation = mutation
-			affected, err = cd.sqlExec(ctx)
-			mutation.done = true
-			return affected, err
-		})
-		for i := len(cd.hooks) - 1; i >= 0; i-- {
-			if cd.hooks[i] == nil {
-				return 0, fmt.Errorf("db: uninitialized hook (forgotten import db/runtime?)")
-			}
-			mut = cd.hooks[i](mut)
-		}
-		if _, err := mut.Mutate(ctx, cd.mutation); err != nil {
-			return 0, err
-		}
-	}
-	return affected, err
+func (_d *ConnectorDelete) Exec(ctx context.Context) (int, error) {
+	return withHooks(ctx, _d.sqlExec, _d.mutation, _d.hooks)
 }
 
 // ExecX is like Exec, but panics if an error occurs.
-func (cd *ConnectorDelete) ExecX(ctx context.Context) int {
-	n, err := cd.Exec(ctx)
+func (_d *ConnectorDelete) ExecX(ctx context.Context) int {
+	n, err := _d.Exec(ctx)
 	if err != nil {
 		panic(err)
 	}
 	return n
 }
 
-func (cd *ConnectorDelete) sqlExec(ctx context.Context) (int, error) {
-	_spec := &sqlgraph.DeleteSpec{
-		Node: &sqlgraph.NodeSpec{
-			Table: connector.Table,
-			ID: &sqlgraph.FieldSpec{
-				Type:   field.TypeString,
-				Column: connector.FieldID,
-			},
-		},
-	}
-	if ps := cd.mutation.predicates; len(ps) > 0 {
+func (_d *ConnectorDelete) sqlExec(ctx context.Context) (int, error) {
+	_spec := sqlgraph.NewDeleteSpec(connector.Table, sqlgraph.NewFieldSpec(connector.FieldID, field.TypeString))
+	if ps := _d.mutation.predicates; len(ps) > 0 {
 		_spec.Predicate = func(selector *sql.Selector) {
 			for i := range ps {
 				ps[i](selector)
 			}
 		}
 	}
-	affected, err := sqlgraph.DeleteNodes(ctx, cd.driver, _spec)
+	affected, err := sqlgraph.DeleteNodes(ctx, _d.driver, _spec)
 	if err != nil && sqlgraph.IsConstraintError(err) {
 		err = &ConstraintError{msg: err.Error(), wrap: err}
 	}
+	_d.mutation.done = true
 	return affected, err
 }
 
 // ConnectorDeleteOne is the builder for deleting a single Connector entity.
 type ConnectorDeleteOne struct {
-	cd *ConnectorDelete
+	_d *ConnectorDelete
+}
+
+// Where appends a list predicates to the ConnectorDelete builder.
+func (_d *ConnectorDeleteOne) Where(ps ...predicate.Connector) *ConnectorDeleteOne {
+	_d._d.mutation.Where(ps...)
+	return _d
 }
 
 // Exec executes the deletion query.
-func (cdo *ConnectorDeleteOne) Exec(ctx context.Context) error {
-	n, err := cdo.cd.Exec(ctx)
+func (_d *ConnectorDeleteOne) Exec(ctx context.Context) error {
+	n, err := _d._d.Exec(ctx)
 	switch {
 	case err != nil:
 		return err
@@ -110,6 +81,8 @@ func (cdo *ConnectorDeleteOne) Exec(ctx context.Context) error {
 }
 
 // ExecX is like Exec, but panics if an error occurs.
-func (cdo *ConnectorDeleteOne) ExecX(ctx context.Context) {
-	cdo.cd.ExecX(ctx)
+func (_d *ConnectorDeleteOne) ExecX(ctx context.Context) {
+	if err := _d.Exec(ctx); err != nil {
+		panic(err)
+	}
 }
diff --git a/storage/ent/db/connector_query.go b/storage/ent/db/connector_query.go
index 32d6020499..9f5e5dc2df 100644
--- a/storage/ent/db/connector_query.go
+++ b/storage/ent/db/connector_query.go
@@ -7,6 +7,7 @@ import (
 	"fmt"
 	"math"
 
+	"entgo.io/ent"
 	"entgo.io/ent/dialect/sql"
 	"entgo.io/ent/dialect/sql/sqlgraph"
 	"entgo.io/ent/schema/field"
@@ -17,11 +18,9 @@ import (
 // ConnectorQuery is the builder for querying Connector entities.
 type ConnectorQuery struct {
 	config
-	limit      *int
-	offset     *int
-	unique     *bool
-	order      []OrderFunc
-	fields     []string
+	ctx        *QueryContext
+	order      []connector.OrderOption
+	inters     []Interceptor
 	predicates []predicate.Connector
 	// intermediate query (i.e. traversal path).
 	sql  *sql.Selector
@@ -29,40 +28,40 @@ type ConnectorQuery struct {
 }
 
 // Where adds a new predicate for the ConnectorQuery builder.
-func (cq *ConnectorQuery) Where(ps ...predicate.Connector) *ConnectorQuery {
-	cq.predicates = append(cq.predicates, ps...)
-	return cq
+func (_q *ConnectorQuery) Where(ps ...predicate.Connector) *ConnectorQuery {
+	_q.predicates = append(_q.predicates, ps...)
+	return _q
 }
 
-// Limit adds a limit step to the query.
-func (cq *ConnectorQuery) Limit(limit int) *ConnectorQuery {
-	cq.limit = &limit
-	return cq
+// Limit the number of records to be returned by this query.
+func (_q *ConnectorQuery) Limit(limit int) *ConnectorQuery {
+	_q.ctx.Limit = &limit
+	return _q
 }
 
-// Offset adds an offset step to the query.
-func (cq *ConnectorQuery) Offset(offset int) *ConnectorQuery {
-	cq.offset = &offset
-	return cq
+// Offset to start from.
+func (_q *ConnectorQuery) Offset(offset int) *ConnectorQuery {
+	_q.ctx.Offset = &offset
+	return _q
 }
 
 // Unique configures the query builder to filter duplicate records on query.
 // By default, unique is set to true, and can be disabled using this method.
-func (cq *ConnectorQuery) Unique(unique bool) *ConnectorQuery {
-	cq.unique = &unique
-	return cq
+func (_q *ConnectorQuery) Unique(unique bool) *ConnectorQuery {
+	_q.ctx.Unique = &unique
+	return _q
 }
 
-// Order adds an order step to the query.
-func (cq *ConnectorQuery) Order(o ...OrderFunc) *ConnectorQuery {
-	cq.order = append(cq.order, o...)
-	return cq
+// Order specifies how the records should be ordered.
+func (_q *ConnectorQuery) Order(o ...connector.OrderOption) *ConnectorQuery {
+	_q.order = append(_q.order, o...)
+	return _q
 }
 
 // First returns the first Connector entity from the query.
 // Returns a *NotFoundError when no Connector was found.
-func (cq *ConnectorQuery) First(ctx context.Context) (*Connector, error) {
-	nodes, err := cq.Limit(1).All(ctx)
+func (_q *ConnectorQuery) First(ctx context.Context) (*Connector, error) {
+	nodes, err := _q.Limit(1).All(setContextOp(ctx, _q.ctx, ent.OpQueryFirst))
 	if err != nil {
 		return nil, err
 	}
@@ -73,8 +72,8 @@ func (cq *ConnectorQuery) First(ctx context.Context) (*Connector, error) {
 }
 
 // FirstX is like First, but panics if an error occurs.
-func (cq *ConnectorQuery) FirstX(ctx context.Context) *Connector {
-	node, err := cq.First(ctx)
+func (_q *ConnectorQuery) FirstX(ctx context.Context) *Connector {
+	node, err := _q.First(ctx)
 	if err != nil && !IsNotFound(err) {
 		panic(err)
 	}
@@ -83,9 +82,9 @@ func (cq *ConnectorQuery) FirstX(ctx context.Context) *Connector {
 
 // FirstID returns the first Connector ID from the query.
 // Returns a *NotFoundError when no Connector ID was found.
-func (cq *ConnectorQuery) FirstID(ctx context.Context) (id string, err error) {
+func (_q *ConnectorQuery) FirstID(ctx context.Context) (id string, err error) {
 	var ids []string
-	if ids, err = cq.Limit(1).IDs(ctx); err != nil {
+	if ids, err = _q.Limit(1).IDs(setContextOp(ctx, _q.ctx, ent.OpQueryFirstID)); err != nil {
 		return
 	}
 	if len(ids) == 0 {
@@ -96,8 +95,8 @@ func (cq *ConnectorQuery) FirstID(ctx context.Context) (id string, err error) {
 }
 
 // FirstIDX is like FirstID, but panics if an error occurs.
-func (cq *ConnectorQuery) FirstIDX(ctx context.Context) string {
-	id, err := cq.FirstID(ctx)
+func (_q *ConnectorQuery) FirstIDX(ctx context.Context) string {
+	id, err := _q.FirstID(ctx)
 	if err != nil && !IsNotFound(err) {
 		panic(err)
 	}
@@ -107,8 +106,8 @@ func (cq *ConnectorQuery) FirstIDX(ctx context.Context) string {
 // Only returns a single Connector entity found by the query, ensuring it only returns one.
 // Returns a *NotSingularError when more than one Connector entity is found.
 // Returns a *NotFoundError when no Connector entities are found.
-func (cq *ConnectorQuery) Only(ctx context.Context) (*Connector, error) {
-	nodes, err := cq.Limit(2).All(ctx)
+func (_q *ConnectorQuery) Only(ctx context.Context) (*Connector, error) {
+	nodes, err := _q.Limit(2).All(setContextOp(ctx, _q.ctx, ent.OpQueryOnly))
 	if err != nil {
 		return nil, err
 	}
@@ -123,8 +122,8 @@ func (cq *ConnectorQuery) Only(ctx context.Context) (*Connector, error) {
 }
 
 // OnlyX is like Only, but panics if an error occurs.
-func (cq *ConnectorQuery) OnlyX(ctx context.Context) *Connector {
-	node, err := cq.Only(ctx)
+func (_q *ConnectorQuery) OnlyX(ctx context.Context) *Connector {
+	node, err := _q.Only(ctx)
 	if err != nil {
 		panic(err)
 	}
@@ -134,9 +133,9 @@ func (cq *ConnectorQuery) OnlyX(ctx context.Context) *Connector {
 // OnlyID is like Only, but returns the only Connector ID in the query.
 // Returns a *NotSingularError when more than one Connector ID is found.
 // Returns a *NotFoundError when no entities are found.
-func (cq *ConnectorQuery) OnlyID(ctx context.Context) (id string, err error) {
+func (_q *ConnectorQuery) OnlyID(ctx context.Context) (id string, err error) {
 	var ids []string
-	if ids, err = cq.Limit(2).IDs(ctx); err != nil {
+	if ids, err = _q.Limit(2).IDs(setContextOp(ctx, _q.ctx, ent.OpQueryOnlyID)); err != nil {
 		return
 	}
 	switch len(ids) {
@@ -151,8 +150,8 @@ func (cq *ConnectorQuery) OnlyID(ctx context.Context) (id string, err error) {
 }
 
 // OnlyIDX is like OnlyID, but panics if an error occurs.
-func (cq *ConnectorQuery) OnlyIDX(ctx context.Context) string {
-	id, err := cq.OnlyID(ctx)
+func (_q *ConnectorQuery) OnlyIDX(ctx context.Context) string {
+	id, err := _q.OnlyID(ctx)
 	if err != nil {
 		panic(err)
 	}
@@ -160,16 +159,18 @@ func (cq *ConnectorQuery) OnlyIDX(ctx context.Context) string {
 }
 
 // All executes the query and returns a list of Connectors.
-func (cq *ConnectorQuery) All(ctx context.Context) ([]*Connector, error) {
-	if err := cq.prepareQuery(ctx); err != nil {
+func (_q *ConnectorQuery) All(ctx context.Context) ([]*Connector, error) {
+	ctx = setContextOp(ctx, _q.ctx, ent.OpQueryAll)
+	if err := _q.prepareQuery(ctx); err != nil {
 		return nil, err
 	}
-	return cq.sqlAll(ctx)
+	qr := querierAll[[]*Connector, *ConnectorQuery]()
+	return withInterceptors[[]*Connector](ctx, _q, qr, _q.inters)
 }
 
 // AllX is like All, but panics if an error occurs.
-func (cq *ConnectorQuery) AllX(ctx context.Context) []*Connector {
-	nodes, err := cq.All(ctx)
+func (_q *ConnectorQuery) AllX(ctx context.Context) []*Connector {
+	nodes, err := _q.All(ctx)
 	if err != nil {
 		panic(err)
 	}
@@ -177,17 +178,20 @@ func (cq *ConnectorQuery) AllX(ctx context.Context) []*Connector {
 }
 
 // IDs executes the query and returns a list of Connector IDs.
-func (cq *ConnectorQuery) IDs(ctx context.Context) ([]string, error) {
-	var ids []string
-	if err := cq.Select(connector.FieldID).Scan(ctx, &ids); err != nil {
+func (_q *ConnectorQuery) IDs(ctx context.Context) (ids []string, err error) {
+	if _q.ctx.Unique == nil && _q.path != nil {
+		_q.Unique(true)
+	}
+	ctx = setContextOp(ctx, _q.ctx, ent.OpQueryIDs)
+	if err = _q.Select(connector.FieldID).Scan(ctx, &ids); err != nil {
 		return nil, err
 	}
 	return ids, nil
 }
 
 // IDsX is like IDs, but panics if an error occurs.
-func (cq *ConnectorQuery) IDsX(ctx context.Context) []string {
-	ids, err := cq.IDs(ctx)
+func (_q *ConnectorQuery) IDsX(ctx context.Context) []string {
+	ids, err := _q.IDs(ctx)
 	if err != nil {
 		panic(err)
 	}
@@ -195,16 +199,17 @@ func (cq *ConnectorQuery) IDsX(ctx context.Context) []string {
 }
 
 // Count returns the count of the given query.
-func (cq *ConnectorQuery) Count(ctx context.Context) (int, error) {
-	if err := cq.prepareQuery(ctx); err != nil {
+func (_q *ConnectorQuery) Count(ctx context.Context) (int, error) {
+	ctx = setContextOp(ctx, _q.ctx, ent.OpQueryCount)
+	if err := _q.prepareQuery(ctx); err != nil {
 		return 0, err
 	}
-	return cq.sqlCount(ctx)
+	return withInterceptors[int](ctx, _q, querierCount[*ConnectorQuery](), _q.inters)
 }
 
 // CountX is like Count, but panics if an error occurs.
-func (cq *ConnectorQuery) CountX(ctx context.Context) int {
-	count, err := cq.Count(ctx)
+func (_q *ConnectorQuery) CountX(ctx context.Context) int {
+	count, err := _q.Count(ctx)
 	if err != nil {
 		panic(err)
 	}
@@ -212,16 +217,21 @@ func (cq *ConnectorQuery) CountX(ctx context.Context) int {
 }
 
 // Exist returns true if the query has elements in the graph.
-func (cq *ConnectorQuery) Exist(ctx context.Context) (bool, error) {
-	if err := cq.prepareQuery(ctx); err != nil {
-		return false, err
+func (_q *ConnectorQuery) Exist(ctx context.Context) (bool, error) {
+	ctx = setContextOp(ctx, _q.ctx, ent.OpQueryExist)
+	switch _, err := _q.FirstID(ctx); {
+	case IsNotFound(err):
+		return false, nil
+	case err != nil:
+		return false, fmt.Errorf("db: check existence: %w", err)
+	default:
+		return true, nil
 	}
-	return cq.sqlExist(ctx)
 }
 
 // ExistX is like Exist, but panics if an error occurs.
-func (cq *ConnectorQuery) ExistX(ctx context.Context) bool {
-	exist, err := cq.Exist(ctx)
+func (_q *ConnectorQuery) ExistX(ctx context.Context) bool {
+	exist, err := _q.Exist(ctx)
 	if err != nil {
 		panic(err)
 	}
@@ -230,20 +240,19 @@ func (cq *ConnectorQuery) ExistX(ctx context.Context) bool {
 
 // Clone returns a duplicate of the ConnectorQuery builder, including all associated steps. It can be
 // used to prepare common query builders and use them differently after the clone is made.
-func (cq *ConnectorQuery) Clone() *ConnectorQuery {
-	if cq == nil {
+func (_q *ConnectorQuery) Clone() *ConnectorQuery {
+	if _q == nil {
 		return nil
 	}
 	return &ConnectorQuery{
-		config:     cq.config,
-		limit:      cq.limit,
-		offset:     cq.offset,
-		order:      append([]OrderFunc{}, cq.order...),
-		predicates: append([]predicate.Connector{}, cq.predicates...),
+		config:     _q.config,
+		ctx:        _q.ctx.Clone(),
+		order:      append([]connector.OrderOption{}, _q.order...),
+		inters:     append([]Interceptor{}, _q.inters...),
+		predicates: append([]predicate.Connector{}, _q.predicates...),
 		// clone intermediate query.
-		sql:    cq.sql.Clone(),
-		path:   cq.path,
-		unique: cq.unique,
+		sql:  _q.sql.Clone(),
+		path: _q.path,
 	}
 }
 
@@ -261,18 +270,12 @@ func (cq *ConnectorQuery) Clone() *ConnectorQuery {
 //		GroupBy(connector.FieldType).
 //		Aggregate(db.Count()).
 //		Scan(ctx, &v)
-//
-func (cq *ConnectorQuery) GroupBy(field string, fields ...string) *ConnectorGroupBy {
-	grbuild := &ConnectorGroupBy{config: cq.config}
-	grbuild.fields = append([]string{field}, fields...)
-	grbuild.path = func(ctx context.Context) (prev *sql.Selector, err error) {
-		if err := cq.prepareQuery(ctx); err != nil {
-			return nil, err
-		}
-		return cq.sqlQuery(ctx), nil
-	}
+func (_q *ConnectorQuery) GroupBy(field string, fields ...string) *ConnectorGroupBy {
+	_q.ctx.Fields = append([]string{field}, fields...)
+	grbuild := &ConnectorGroupBy{build: _q}
+	grbuild.flds = &_q.ctx.Fields
 	grbuild.label = connector.Label
-	grbuild.flds, grbuild.scan = &grbuild.fields, grbuild.Scan
+	grbuild.scan = grbuild.Scan
 	return grbuild
 }
 
@@ -288,48 +291,62 @@ func (cq *ConnectorQuery) GroupBy(field string, fields ...string) *ConnectorGrou
 //	client.Connector.Query().
 //		Select(connector.FieldType).
 //		Scan(ctx, &v)
-//
-func (cq *ConnectorQuery) Select(fields ...string) *ConnectorSelect {
-	cq.fields = append(cq.fields, fields...)
-	selbuild := &ConnectorSelect{ConnectorQuery: cq}
-	selbuild.label = connector.Label
-	selbuild.flds, selbuild.scan = &cq.fields, selbuild.Scan
-	return selbuild
+func (_q *ConnectorQuery) Select(fields ...string) *ConnectorSelect {
+	_q.ctx.Fields = append(_q.ctx.Fields, fields...)
+	sbuild := &ConnectorSelect{ConnectorQuery: _q}
+	sbuild.label = connector.Label
+	sbuild.flds, sbuild.scan = &_q.ctx.Fields, sbuild.Scan
+	return sbuild
+}
+
+// Aggregate returns a ConnectorSelect configured with the given aggregations.
+func (_q *ConnectorQuery) Aggregate(fns ...AggregateFunc) *ConnectorSelect {
+	return _q.Select().Aggregate(fns...)
 }
 
-func (cq *ConnectorQuery) prepareQuery(ctx context.Context) error {
-	for _, f := range cq.fields {
+func (_q *ConnectorQuery) prepareQuery(ctx context.Context) error {
+	for _, inter := range _q.inters {
+		if inter == nil {
+			return fmt.Errorf("db: uninitialized interceptor (forgotten import db/runtime?)")
+		}
+		if trv, ok := inter.(Traverser); ok {
+			if err := trv.Traverse(ctx, _q); err != nil {
+				return err
+			}
+		}
+	}
+	for _, f := range _q.ctx.Fields {
 		if !connector.ValidColumn(f) {
 			return &ValidationError{Name: f, err: fmt.Errorf("db: invalid field %q for query", f)}
 		}
 	}
-	if cq.path != nil {
-		prev, err := cq.path(ctx)
+	if _q.path != nil {
+		prev, err := _q.path(ctx)
 		if err != nil {
 			return err
 		}
-		cq.sql = prev
+		_q.sql = prev
 	}
 	return nil
 }
 
-func (cq *ConnectorQuery) sqlAll(ctx context.Context, hooks ...queryHook) ([]*Connector, error) {
+func (_q *ConnectorQuery) sqlAll(ctx context.Context, hooks ...queryHook) ([]*Connector, error) {
 	var (
 		nodes = []*Connector{}
-		_spec = cq.querySpec()
+		_spec = _q.querySpec()
 	)
-	_spec.ScanValues = func(columns []string) ([]interface{}, error) {
+	_spec.ScanValues = func(columns []string) ([]any, error) {
 		return (*Connector).scanValues(nil, columns)
 	}
-	_spec.Assign = func(columns []string, values []interface{}) error {
-		node := &Connector{config: cq.config}
+	_spec.Assign = func(columns []string, values []any) error {
+		node := &Connector{config: _q.config}
 		nodes = append(nodes, node)
 		return node.assignValues(columns, values)
 	}
 	for i := range hooks {
 		hooks[i](ctx, _spec)
 	}
-	if err := sqlgraph.QueryNodes(ctx, cq.driver, _spec); err != nil {
+	if err := sqlgraph.QueryNodes(ctx, _q.driver, _spec); err != nil {
 		return nil, err
 	}
 	if len(nodes) == 0 {
@@ -338,40 +355,24 @@ func (cq *ConnectorQuery) sqlAll(ctx context.Context, hooks ...queryHook) ([]*Co
 	return nodes, nil
 }
 
-func (cq *ConnectorQuery) sqlCount(ctx context.Context) (int, error) {
-	_spec := cq.querySpec()
-	_spec.Node.Columns = cq.fields
-	if len(cq.fields) > 0 {
-		_spec.Unique = cq.unique != nil && *cq.unique
-	}
-	return sqlgraph.CountNodes(ctx, cq.driver, _spec)
-}
-
-func (cq *ConnectorQuery) sqlExist(ctx context.Context) (bool, error) {
-	n, err := cq.sqlCount(ctx)
-	if err != nil {
-		return false, fmt.Errorf("db: check existence: %w", err)
+func (_q *ConnectorQuery) sqlCount(ctx context.Context) (int, error) {
+	_spec := _q.querySpec()
+	_spec.Node.Columns = _q.ctx.Fields
+	if len(_q.ctx.Fields) > 0 {
+		_spec.Unique = _q.ctx.Unique != nil && *_q.ctx.Unique
 	}
-	return n > 0, nil
+	return sqlgraph.CountNodes(ctx, _q.driver, _spec)
 }
 
-func (cq *ConnectorQuery) querySpec() *sqlgraph.QuerySpec {
-	_spec := &sqlgraph.QuerySpec{
-		Node: &sqlgraph.NodeSpec{
-			Table:   connector.Table,
-			Columns: connector.Columns,
-			ID: &sqlgraph.FieldSpec{
-				Type:   field.TypeString,
-				Column: connector.FieldID,
-			},
-		},
-		From:   cq.sql,
-		Unique: true,
-	}
-	if unique := cq.unique; unique != nil {
+func (_q *ConnectorQuery) querySpec() *sqlgraph.QuerySpec {
+	_spec := sqlgraph.NewQuerySpec(connector.Table, connector.Columns, sqlgraph.NewFieldSpec(connector.FieldID, field.TypeString))
+	_spec.From = _q.sql
+	if unique := _q.ctx.Unique; unique != nil {
 		_spec.Unique = *unique
+	} else if _q.path != nil {
+		_spec.Unique = true
 	}
-	if fields := cq.fields; len(fields) > 0 {
+	if fields := _q.ctx.Fields; len(fields) > 0 {
 		_spec.Node.Columns = make([]string, 0, len(fields))
 		_spec.Node.Columns = append(_spec.Node.Columns, connector.FieldID)
 		for i := range fields {
@@ -380,20 +381,20 @@ func (cq *ConnectorQuery) querySpec() *sqlgraph.QuerySpec {
 			}
 		}
 	}
-	if ps := cq.predicates; len(ps) > 0 {
+	if ps := _q.predicates; len(ps) > 0 {
 		_spec.Predicate = func(selector *sql.Selector) {
 			for i := range ps {
 				ps[i](selector)
 			}
 		}
 	}
-	if limit := cq.limit; limit != nil {
+	if limit := _q.ctx.Limit; limit != nil {
 		_spec.Limit = *limit
 	}
-	if offset := cq.offset; offset != nil {
+	if offset := _q.ctx.Offset; offset != nil {
 		_spec.Offset = *offset
 	}
-	if ps := cq.order; len(ps) > 0 {
+	if ps := _q.order; len(ps) > 0 {
 		_spec.Order = func(selector *sql.Selector) {
 			for i := range ps {
 				ps[i](selector)
@@ -403,33 +404,33 @@ func (cq *ConnectorQuery) querySpec() *sqlgraph.QuerySpec {
 	return _spec
 }
 
-func (cq *ConnectorQuery) sqlQuery(ctx context.Context) *sql.Selector {
-	builder := sql.Dialect(cq.driver.Dialect())
+func (_q *ConnectorQuery) sqlQuery(ctx context.Context) *sql.Selector {
+	builder := sql.Dialect(_q.driver.Dialect())
 	t1 := builder.Table(connector.Table)
-	columns := cq.fields
+	columns := _q.ctx.Fields
 	if len(columns) == 0 {
 		columns = connector.Columns
 	}
 	selector := builder.Select(t1.Columns(columns...)...).From(t1)
-	if cq.sql != nil {
-		selector = cq.sql
+	if _q.sql != nil {
+		selector = _q.sql
 		selector.Select(selector.Columns(columns...)...)
 	}
-	if cq.unique != nil && *cq.unique {
+	if _q.ctx.Unique != nil && *_q.ctx.Unique {
 		selector.Distinct()
 	}
-	for _, p := range cq.predicates {
+	for _, p := range _q.predicates {
 		p(selector)
 	}
-	for _, p := range cq.order {
+	for _, p := range _q.order {
 		p(selector)
 	}
-	if offset := cq.offset; offset != nil {
+	if offset := _q.ctx.Offset; offset != nil {
 		// limit is mandatory for offset clause. We start
 		// with default value, and override it below if needed.
 		selector.Offset(*offset).Limit(math.MaxInt32)
 	}
-	if limit := cq.limit; limit != nil {
+	if limit := _q.ctx.Limit; limit != nil {
 		selector.Limit(*limit)
 	}
 	return selector
@@ -437,90 +438,88 @@ func (cq *ConnectorQuery) sqlQuery(ctx context.Context) *sql.Selector {
 
 // ConnectorGroupBy is the group-by builder for Connector entities.
 type ConnectorGroupBy struct {
-	config
 	selector
-	fields []string
-	fns    []AggregateFunc
-	// intermediate query (i.e. traversal path).
-	sql  *sql.Selector
-	path func(context.Context) (*sql.Selector, error)
+	build *ConnectorQuery
 }
 
 // Aggregate adds the given aggregation functions to the group-by query.
-func (cgb *ConnectorGroupBy) Aggregate(fns ...AggregateFunc) *ConnectorGroupBy {
-	cgb.fns = append(cgb.fns, fns...)
-	return cgb
+func (_g *ConnectorGroupBy) Aggregate(fns ...AggregateFunc) *ConnectorGroupBy {
+	_g.fns = append(_g.fns, fns...)
+	return _g
 }
 
-// Scan applies the group-by query and scans the result into the given value.
-func (cgb *ConnectorGroupBy) Scan(ctx context.Context, v interface{}) error {
-	query, err := cgb.path(ctx)
-	if err != nil {
+// Scan applies the selector query and scans the result into the given value.
+func (_g *ConnectorGroupBy) Scan(ctx context.Context, v any) error {
+	ctx = setContextOp(ctx, _g.build.ctx, ent.OpQueryGroupBy)
+	if err := _g.build.prepareQuery(ctx); err != nil {
 		return err
 	}
-	cgb.sql = query
-	return cgb.sqlScan(ctx, v)
+	return scanWithInterceptors[*ConnectorQuery, *ConnectorGroupBy](ctx, _g.build, _g, _g.build.inters, v)
 }
 
-func (cgb *ConnectorGroupBy) sqlScan(ctx context.Context, v interface{}) error {
-	for _, f := range cgb.fields {
-		if !connector.ValidColumn(f) {
-			return &ValidationError{Name: f, err: fmt.Errorf("invalid field %q for group-by", f)}
+func (_g *ConnectorGroupBy) sqlScan(ctx context.Context, root *ConnectorQuery, v any) error {
+	selector := root.sqlQuery(ctx).Select()
+	aggregation := make([]string, 0, len(_g.fns))
+	for _, fn := range _g.fns {
+		aggregation = append(aggregation, fn(selector))
+	}
+	if len(selector.SelectedColumns()) == 0 {
+		columns := make([]string, 0, len(*_g.flds)+len(_g.fns))
+		for _, f := range *_g.flds {
+			columns = append(columns, selector.C(f))
 		}
+		columns = append(columns, aggregation...)
+		selector.Select(columns...)
 	}
-	selector := cgb.sqlQuery()
+	selector.GroupBy(selector.Columns(*_g.flds...)...)
 	if err := selector.Err(); err != nil {
 		return err
 	}
 	rows := &sql.Rows{}
 	query, args := selector.Query()
-	if err := cgb.driver.Query(ctx, query, args, rows); err != nil {
+	if err := _g.build.driver.Query(ctx, query, args, rows); err != nil {
 		return err
 	}
 	defer rows.Close()
 	return sql.ScanSlice(rows, v)
 }
 
-func (cgb *ConnectorGroupBy) sqlQuery() *sql.Selector {
-	selector := cgb.sql.Select()
-	aggregation := make([]string, 0, len(cgb.fns))
-	for _, fn := range cgb.fns {
-		aggregation = append(aggregation, fn(selector))
-	}
-	// If no columns were selected in a custom aggregation function, the default
-	// selection is the fields used for "group-by", and the aggregation functions.
-	if len(selector.SelectedColumns()) == 0 {
-		columns := make([]string, 0, len(cgb.fields)+len(cgb.fns))
-		for _, f := range cgb.fields {
-			columns = append(columns, selector.C(f))
-		}
-		columns = append(columns, aggregation...)
-		selector.Select(columns...)
-	}
-	return selector.GroupBy(selector.Columns(cgb.fields...)...)
-}
-
 // ConnectorSelect is the builder for selecting fields of Connector entities.
 type ConnectorSelect struct {
 	*ConnectorQuery
 	selector
-	// intermediate query (i.e. traversal path).
-	sql *sql.Selector
+}
+
+// Aggregate adds the given aggregation functions to the selector query.
+func (_s *ConnectorSelect) Aggregate(fns ...AggregateFunc) *ConnectorSelect {
+	_s.fns = append(_s.fns, fns...)
+	return _s
 }
 
 // Scan applies the selector query and scans the result into the given value.
-func (cs *ConnectorSelect) Scan(ctx context.Context, v interface{}) error {
-	if err := cs.prepareQuery(ctx); err != nil {
+func (_s *ConnectorSelect) Scan(ctx context.Context, v any) error {
+	ctx = setContextOp(ctx, _s.ctx, ent.OpQuerySelect)
+	if err := _s.prepareQuery(ctx); err != nil {
 		return err
 	}
-	cs.sql = cs.ConnectorQuery.sqlQuery(ctx)
-	return cs.sqlScan(ctx, v)
+	return scanWithInterceptors[*ConnectorQuery, *ConnectorSelect](ctx, _s.ConnectorQuery, _s, _s.inters, v)
 }
 
-func (cs *ConnectorSelect) sqlScan(ctx context.Context, v interface{}) error {
+func (_s *ConnectorSelect) sqlScan(ctx context.Context, root *ConnectorQuery, v any) error {
+	selector := root.sqlQuery(ctx)
+	aggregation := make([]string, 0, len(_s.fns))
+	for _, fn := range _s.fns {
+		aggregation = append(aggregation, fn(selector))
+	}
+	switch n := len(*_s.selector.flds); {
+	case n == 0 && len(aggregation) > 0:
+		selector.Select(aggregation...)
+	case n != 0 && len(aggregation) > 0:
+		selector.AppendSelect(aggregation...)
+	}
 	rows := &sql.Rows{}
-	query, args := cs.sql.Query()
-	if err := cs.driver.Query(ctx, query, args, rows); err != nil {
+	query, args := selector.Query()
+	if err := _s.driver.Query(ctx, query, args, rows); err != nil {
 		return err
 	}
 	defer rows.Close()
diff --git a/storage/ent/db/connector_update.go b/storage/ent/db/connector_update.go
index 736d0a62fb..d9b58d04f7 100644
--- a/storage/ent/db/connector_update.go
+++ b/storage/ent/db/connector_update.go
@@ -9,6 +9,7 @@ import (
 
 	"entgo.io/ent/dialect/sql"
 	"entgo.io/ent/dialect/sql/sqlgraph"
+	"entgo.io/ent/dialect/sql/sqljson"
 	"entgo.io/ent/schema/field"
 	"github.com/dexidp/dex/storage/ent/db/connector"
 	"github.com/dexidp/dex/storage/ent/db/predicate"
@@ -22,81 +23,90 @@ type ConnectorUpdate struct {
 }
 
 // Where appends a list predicates to the ConnectorUpdate builder.
-func (cu *ConnectorUpdate) Where(ps ...predicate.Connector) *ConnectorUpdate {
-	cu.mutation.Where(ps...)
-	return cu
+func (_u *ConnectorUpdate) Where(ps ...predicate.Connector) *ConnectorUpdate {
+	_u.mutation.Where(ps...)
+	return _u
 }
 
 // SetType sets the "type" field.
-func (cu *ConnectorUpdate) SetType(s string) *ConnectorUpdate {
-	cu.mutation.SetType(s)
-	return cu
+func (_u *ConnectorUpdate) SetType(v string) *ConnectorUpdate {
+	_u.mutation.SetType(v)
+	return _u
+}
+
+// SetNillableType sets the "type" field if the given value is not nil.
+func (_u *ConnectorUpdate) SetNillableType(v *string) *ConnectorUpdate {
+	if v != nil {
+		_u.SetType(*v)
+	}
+	return _u
 }
 
 // SetName sets the "name" field.
-func (cu *ConnectorUpdate) SetName(s string) *ConnectorUpdate {
-	cu.mutation.SetName(s)
-	return cu
+func (_u *ConnectorUpdate) SetName(v string) *ConnectorUpdate {
+	_u.mutation.SetName(v)
+	return _u
+}
+
+// SetNillableName sets the "name" field if the given value is not nil.
+func (_u *ConnectorUpdate) SetNillableName(v *string) *ConnectorUpdate {
+	if v != nil {
+		_u.SetName(*v)
+	}
+	return _u
 }
 
 // SetResourceVersion sets the "resource_version" field.
-func (cu *ConnectorUpdate) SetResourceVersion(s string) *ConnectorUpdate {
-	cu.mutation.SetResourceVersion(s)
-	return cu
+func (_u *ConnectorUpdate) SetResourceVersion(v string) *ConnectorUpdate {
+	_u.mutation.SetResourceVersion(v)
+	return _u
+}
+
+// SetNillableResourceVersion sets the "resource_version" field if the given value is not nil.
+func (_u *ConnectorUpdate) SetNillableResourceVersion(v *string) *ConnectorUpdate {
+	if v != nil {
+		_u.SetResourceVersion(*v)
+	}
+	return _u
 }
 
 // SetConfig sets the "config" field.
-func (cu *ConnectorUpdate) SetConfig(b []byte) *ConnectorUpdate {
-	cu.mutation.SetConfig(b)
-	return cu
+func (_u *ConnectorUpdate) SetConfig(v []byte) *ConnectorUpdate {
+	_u.mutation.SetConfig(v)
+	return _u
+}
+
+// SetGrantTypes sets the "grant_types" field.
+func (_u *ConnectorUpdate) SetGrantTypes(v []string) *ConnectorUpdate {
+	_u.mutation.SetGrantTypes(v)
+	return _u
+}
+
+// AppendGrantTypes appends value to the "grant_types" field.
+func (_u *ConnectorUpdate) AppendGrantTypes(v []string) *ConnectorUpdate {
+	_u.mutation.AppendGrantTypes(v)
+	return _u
+}
+
+// ClearGrantTypes clears the value of the "grant_types" field.
+func (_u *ConnectorUpdate) ClearGrantTypes() *ConnectorUpdate {
+	_u.mutation.ClearGrantTypes()
+	return _u
 }
 
 // Mutation returns the ConnectorMutation object of the builder.
-func (cu *ConnectorUpdate) Mutation() *ConnectorMutation {
-	return cu.mutation
+func (_u *ConnectorUpdate) Mutation() *ConnectorMutation {
+	return _u.mutation
 }
 
 // Save executes the query and returns the number of nodes affected by the update operation.
-func (cu *ConnectorUpdate) Save(ctx context.Context) (int, error) {
-	var (
-		err      error
-		affected int
-	)
-	if len(cu.hooks) == 0 {
-		if err = cu.check(); err != nil {
-			return 0, err
-		}
-		affected, err = cu.sqlSave(ctx)
-	} else {
-		var mut Mutator = MutateFunc(func(ctx context.Context, m Mutation) (Value, error) {
-			mutation, ok := m.(*ConnectorMutation)
-			if !ok {
-				return nil, fmt.Errorf("unexpected mutation type %T", m)
-			}
-			if err = cu.check(); err != nil {
-				return 0, err
-			}
-			cu.mutation = mutation
-			affected, err = cu.sqlSave(ctx)
-			mutation.done = true
-			return affected, err
-		})
-		for i := len(cu.hooks) - 1; i >= 0; i-- {
-			if cu.hooks[i] == nil {
-				return 0, fmt.Errorf("db: uninitialized hook (forgotten import db/runtime?)")
-			}
-			mut = cu.hooks[i](mut)
-		}
-		if _, err := mut.Mutate(ctx, cu.mutation); err != nil {
-			return 0, err
-		}
-	}
-	return affected, err
+func (_u *ConnectorUpdate) Save(ctx context.Context) (int, error) {
+	return withHooks(ctx, _u.sqlSave, _u.mutation, _u.hooks)
 }
 
 // SaveX is like Save, but panics if an error occurs.
-func (cu *ConnectorUpdate) SaveX(ctx context.Context) int {
-	affected, err := cu.Save(ctx)
+func (_u *ConnectorUpdate) SaveX(ctx context.Context) int {
+	affected, err := _u.Save(ctx)
 	if err != nil {
 		panic(err)
 	}
@@ -104,26 +114,26 @@ func (cu *ConnectorUpdate) SaveX(ctx context.Context) int {
 }
 
 // Exec executes the query.
-func (cu *ConnectorUpdate) Exec(ctx context.Context) error {
-	_, err := cu.Save(ctx)
+func (_u *ConnectorUpdate) Exec(ctx context.Context) error {
+	_, err := _u.Save(ctx)
 	return err
 }
 
 // ExecX is like Exec, but panics if an error occurs.
-func (cu *ConnectorUpdate) ExecX(ctx context.Context) {
-	if err := cu.Exec(ctx); err != nil {
+func (_u *ConnectorUpdate) ExecX(ctx context.Context) {
+	if err := _u.Exec(ctx); err != nil {
 		panic(err)
 	}
 }
 
 // check runs all checks and user-defined validators on the builder.
-func (cu *ConnectorUpdate) check() error {
-	if v, ok := cu.mutation.GetType(); ok {
+func (_u *ConnectorUpdate) check() error {
+	if v, ok := _u.mutation.GetType(); ok {
 		if err := connector.TypeValidator(v); err != nil {
 			return &ValidationError{Name: "type", err: fmt.Errorf(`db: validator failed for field "Connector.type": %w`, err)}
 		}
 	}
-	if v, ok := cu.mutation.Name(); ok {
+	if v, ok := _u.mutation.Name(); ok {
 		if err := connector.NameValidator(v); err != nil {
 			return &ValidationError{Name: "name", err: fmt.Errorf(`db: validator failed for field "Connector.name": %w`, err)}
 		}
@@ -131,53 +141,42 @@ func (cu *ConnectorUpdate) check() error {
 	return nil
 }
 
-func (cu *ConnectorUpdate) sqlSave(ctx context.Context) (n int, err error) {
-	_spec := &sqlgraph.UpdateSpec{
-		Node: &sqlgraph.NodeSpec{
-			Table:   connector.Table,
-			Columns: connector.Columns,
-			ID: &sqlgraph.FieldSpec{
-				Type:   field.TypeString,
-				Column: connector.FieldID,
-			},
-		},
+func (_u *ConnectorUpdate) sqlSave(ctx context.Context) (_node int, err error) {
+	if err := _u.check(); err != nil {
+		return _node, err
 	}
-	if ps := cu.mutation.predicates; len(ps) > 0 {
+	_spec := sqlgraph.NewUpdateSpec(connector.Table, connector.Columns, sqlgraph.NewFieldSpec(connector.FieldID, field.TypeString))
+	if ps := _u.mutation.predicates; len(ps) > 0 {
 		_spec.Predicate = func(selector *sql.Selector) {
 			for i := range ps {
 				ps[i](selector)
 			}
 		}
 	}
-	if value, ok := cu.mutation.GetType(); ok {
-		_spec.Fields.Set = append(_spec.Fields.Set, &sqlgraph.FieldSpec{
-			Type:   field.TypeString,
-			Value:  value,
-			Column: connector.FieldType,
-		})
+	if value, ok := _u.mutation.GetType(); ok {
+		_spec.SetField(connector.FieldType, field.TypeString, value)
 	}
-	if value, ok := cu.mutation.Name(); ok {
-		_spec.Fields.Set = append(_spec.Fields.Set, &sqlgraph.FieldSpec{
-			Type:   field.TypeString,
-			Value:  value,
-			Column: connector.FieldName,
-		})
+	if value, ok := _u.mutation.Name(); ok {
+		_spec.SetField(connector.FieldName, field.TypeString, value)
 	}
-	if value, ok := cu.mutation.ResourceVersion(); ok {
-		_spec.Fields.Set = append(_spec.Fields.Set, &sqlgraph.FieldSpec{
-			Type:   field.TypeString,
-			Value:  value,
-			Column: connector.FieldResourceVersion,
-		})
+	if value, ok := _u.mutation.ResourceVersion(); ok {
+		_spec.SetField(connector.FieldResourceVersion, field.TypeString, value)
+	}
+	if value, ok := _u.mutation.Config(); ok {
+		_spec.SetField(connector.FieldConfig, field.TypeBytes, value)
+	}
+	if value, ok := _u.mutation.GrantTypes(); ok {
+		_spec.SetField(connector.FieldGrantTypes, field.TypeJSON, value)
 	}
-	if value, ok := cu.mutation.Config(); ok {
-		_spec.Fields.Set = append(_spec.Fields.Set, &sqlgraph.FieldSpec{
-			Type:   field.TypeBytes,
-			Value:  value,
-			Column: connector.FieldConfig,
+	if value, ok := _u.mutation.AppendedGrantTypes(); ok {
+		_spec.AddModifier(func(u *sql.UpdateBuilder) {
+			sqljson.Append(u, connector.FieldGrantTypes, value)
 		})
 	}
-	if n, err = sqlgraph.UpdateNodes(ctx, cu.driver, _spec); err != nil {
+	if _u.mutation.GrantTypesCleared() {
+		_spec.ClearField(connector.FieldGrantTypes, field.TypeJSON)
+	}
+	if _node, err = sqlgraph.UpdateNodes(ctx, _u.driver, _spec); err != nil {
 		if _, ok := err.(*sqlgraph.NotFoundError); ok {
 			err = &NotFoundError{connector.Label}
 		} else if sqlgraph.IsConstraintError(err) {
@@ -185,7 +184,8 @@ func (cu *ConnectorUpdate) sqlSave(ctx context.Context) (n int, err error) {
 		}
 		return 0, err
 	}
-	return n, nil
+	_u.mutation.done = true
+	return _node, nil
 }
 
 // ConnectorUpdateOne is the builder for updating a single Connector entity.
@@ -197,88 +197,97 @@ type ConnectorUpdateOne struct {
 }
 
 // SetType sets the "type" field.
-func (cuo *ConnectorUpdateOne) SetType(s string) *ConnectorUpdateOne {
-	cuo.mutation.SetType(s)
-	return cuo
+func (_u *ConnectorUpdateOne) SetType(v string) *ConnectorUpdateOne {
+	_u.mutation.SetType(v)
+	return _u
+}
+
+// SetNillableType sets the "type" field if the given value is not nil.
+func (_u *ConnectorUpdateOne) SetNillableType(v *string) *ConnectorUpdateOne {
+	if v != nil {
+		_u.SetType(*v)
+	}
+	return _u
 }
 
 // SetName sets the "name" field.
-func (cuo *ConnectorUpdateOne) SetName(s string) *ConnectorUpdateOne {
-	cuo.mutation.SetName(s)
-	return cuo
+func (_u *ConnectorUpdateOne) SetName(v string) *ConnectorUpdateOne {
+	_u.mutation.SetName(v)
+	return _u
+}
+
+// SetNillableName sets the "name" field if the given value is not nil.
+func (_u *ConnectorUpdateOne) SetNillableName(v *string) *ConnectorUpdateOne {
+	if v != nil {
+		_u.SetName(*v)
+	}
+	return _u
 }
 
 // SetResourceVersion sets the "resource_version" field.
-func (cuo *ConnectorUpdateOne) SetResourceVersion(s string) *ConnectorUpdateOne {
-	cuo.mutation.SetResourceVersion(s)
-	return cuo
+func (_u *ConnectorUpdateOne) SetResourceVersion(v string) *ConnectorUpdateOne {
+	_u.mutation.SetResourceVersion(v)
+	return _u
+}
+
+// SetNillableResourceVersion sets the "resource_version" field if the given value is not nil.
+func (_u *ConnectorUpdateOne) SetNillableResourceVersion(v *string) *ConnectorUpdateOne {
+	if v != nil {
+		_u.SetResourceVersion(*v)
+	}
+	return _u
 }
 
 // SetConfig sets the "config" field.
-func (cuo *ConnectorUpdateOne) SetConfig(b []byte) *ConnectorUpdateOne {
-	cuo.mutation.SetConfig(b)
-	return cuo
+func (_u *ConnectorUpdateOne) SetConfig(v []byte) *ConnectorUpdateOne {
+	_u.mutation.SetConfig(v)
+	return _u
+}
+
+// SetGrantTypes sets the "grant_types" field.
+func (_u *ConnectorUpdateOne) SetGrantTypes(v []string) *ConnectorUpdateOne {
+	_u.mutation.SetGrantTypes(v)
+	return _u
+}
+
+// AppendGrantTypes appends value to the "grant_types" field.
+func (_u *ConnectorUpdateOne) AppendGrantTypes(v []string) *ConnectorUpdateOne {
+	_u.mutation.AppendGrantTypes(v)
+	return _u
+}
+
+// ClearGrantTypes clears the value of the "grant_types" field.
+func (_u *ConnectorUpdateOne) ClearGrantTypes() *ConnectorUpdateOne {
+	_u.mutation.ClearGrantTypes()
+	return _u
 }
 
 // Mutation returns the ConnectorMutation object of the builder.
-func (cuo *ConnectorUpdateOne) Mutation() *ConnectorMutation {
-	return cuo.mutation
+func (_u *ConnectorUpdateOne) Mutation() *ConnectorMutation {
+	return _u.mutation
+}
+
+// Where appends a list predicates to the ConnectorUpdate builder.
+func (_u *ConnectorUpdateOne) Where(ps ...predicate.Connector) *ConnectorUpdateOne {
+	_u.mutation.Where(ps...)
+	return _u
 }
 
 // Select allows selecting one or more fields (columns) of the returned entity.
 // The default is selecting all fields defined in the entity schema.
-func (cuo *ConnectorUpdateOne) Select(field string, fields ...string) *ConnectorUpdateOne {
-	cuo.fields = append([]string{field}, fields...)
-	return cuo
+func (_u *ConnectorUpdateOne) Select(field string, fields ...string) *ConnectorUpdateOne {
+	_u.fields = append([]string{field}, fields...)
+	return _u
 }
 
 // Save executes the query and returns the updated Connector entity.
-func (cuo *ConnectorUpdateOne) Save(ctx context.Context) (*Connector, error) {
-	var (
-		err  error
-		node *Connector
-	)
-	if len(cuo.hooks) == 0 {
-		if err = cuo.check(); err != nil {
-			return nil, err
-		}
-		node, err = cuo.sqlSave(ctx)
-	} else {
-		var mut Mutator = MutateFunc(func(ctx context.Context, m Mutation) (Value, error) {
-			mutation, ok := m.(*ConnectorMutation)
-			if !ok {
-				return nil, fmt.Errorf("unexpected mutation type %T", m)
-			}
-			if err = cuo.check(); err != nil {
-				return nil, err
-			}
-			cuo.mutation = mutation
-			node, err = cuo.sqlSave(ctx)
-			mutation.done = true
-			return node, err
-		})
-		for i := len(cuo.hooks) - 1; i >= 0; i-- {
-			if cuo.hooks[i] == nil {
-				return nil, fmt.Errorf("db: uninitialized hook (forgotten import db/runtime?)")
-			}
-			mut = cuo.hooks[i](mut)
-		}
-		v, err := mut.Mutate(ctx, cuo.mutation)
-		if err != nil {
-			return nil, err
-		}
-		nv, ok := v.(*Connector)
-		if !ok {
-			return nil, fmt.Errorf("unexpected node type %T returned from ConnectorMutation", v)
-		}
-		node = nv
-	}
-	return node, err
+func (_u *ConnectorUpdateOne) Save(ctx context.Context) (*Connector, error) {
+	return withHooks(ctx, _u.sqlSave, _u.mutation, _u.hooks)
 }
 
 // SaveX is like Save, but panics if an error occurs.
-func (cuo *ConnectorUpdateOne) SaveX(ctx context.Context) *Connector {
-	node, err := cuo.Save(ctx)
+func (_u *ConnectorUpdateOne) SaveX(ctx context.Context) *Connector {
+	node, err := _u.Save(ctx)
 	if err != nil {
 		panic(err)
 	}
@@ -286,26 +295,26 @@ func (cuo *ConnectorUpdateOne) SaveX(ctx context.Context) *Connector {
 }
 
 // Exec executes the query on the entity.
-func (cuo *ConnectorUpdateOne) Exec(ctx context.Context) error {
-	_, err := cuo.Save(ctx)
+func (_u *ConnectorUpdateOne) Exec(ctx context.Context) error {
+	_, err := _u.Save(ctx)
 	return err
 }
 
 // ExecX is like Exec, but panics if an error occurs.
-func (cuo *ConnectorUpdateOne) ExecX(ctx context.Context) {
-	if err := cuo.Exec(ctx); err != nil {
+func (_u *ConnectorUpdateOne) ExecX(ctx context.Context) {
+	if err := _u.Exec(ctx); err != nil {
 		panic(err)
 	}
 }
 
 // check runs all checks and user-defined validators on the builder.
-func (cuo *ConnectorUpdateOne) check() error {
-	if v, ok := cuo.mutation.GetType(); ok {
+func (_u *ConnectorUpdateOne) check() error {
+	if v, ok := _u.mutation.GetType(); ok {
 		if err := connector.TypeValidator(v); err != nil {
 			return &ValidationError{Name: "type", err: fmt.Errorf(`db: validator failed for field "Connector.type": %w`, err)}
 		}
 	}
-	if v, ok := cuo.mutation.Name(); ok {
+	if v, ok := _u.mutation.Name(); ok {
 		if err := connector.NameValidator(v); err != nil {
 			return &ValidationError{Name: "name", err: fmt.Errorf(`db: validator failed for field "Connector.name": %w`, err)}
 		}
@@ -313,23 +322,17 @@ func (cuo *ConnectorUpdateOne) check() error {
 	return nil
 }
 
-func (cuo *ConnectorUpdateOne) sqlSave(ctx context.Context) (_node *Connector, err error) {
-	_spec := &sqlgraph.UpdateSpec{
-		Node: &sqlgraph.NodeSpec{
-			Table:   connector.Table,
-			Columns: connector.Columns,
-			ID: &sqlgraph.FieldSpec{
-				Type:   field.TypeString,
-				Column: connector.FieldID,
-			},
-		},
+func (_u *ConnectorUpdateOne) sqlSave(ctx context.Context) (_node *Connector, err error) {
+	if err := _u.check(); err != nil {
+		return _node, err
 	}
-	id, ok := cuo.mutation.ID()
+	_spec := sqlgraph.NewUpdateSpec(connector.Table, connector.Columns, sqlgraph.NewFieldSpec(connector.FieldID, field.TypeString))
+	id, ok := _u.mutation.ID()
 	if !ok {
 		return nil, &ValidationError{Name: "id", err: errors.New(`db: missing "Connector.id" for update`)}
 	}
 	_spec.Node.ID.Value = id
-	if fields := cuo.fields; len(fields) > 0 {
+	if fields := _u.fields; len(fields) > 0 {
 		_spec.Node.Columns = make([]string, 0, len(fields))
 		_spec.Node.Columns = append(_spec.Node.Columns, connector.FieldID)
 		for _, f := range fields {
@@ -341,45 +344,40 @@ func (cuo *ConnectorUpdateOne) sqlSave(ctx context.Context) (_node *Connector, e
 			}
 		}
 	}
-	if ps := cuo.mutation.predicates; len(ps) > 0 {
+	if ps := _u.mutation.predicates; len(ps) > 0 {
 		_spec.Predicate = func(selector *sql.Selector) {
 			for i := range ps {
 				ps[i](selector)
 			}
 		}
 	}
-	if value, ok := cuo.mutation.GetType(); ok {
-		_spec.Fields.Set = append(_spec.Fields.Set, &sqlgraph.FieldSpec{
-			Type:   field.TypeString,
-			Value:  value,
-			Column: connector.FieldType,
-		})
+	if value, ok := _u.mutation.GetType(); ok {
+		_spec.SetField(connector.FieldType, field.TypeString, value)
 	}
-	if value, ok := cuo.mutation.Name(); ok {
-		_spec.Fields.Set = append(_spec.Fields.Set, &sqlgraph.FieldSpec{
-			Type:   field.TypeString,
-			Value:  value,
-			Column: connector.FieldName,
-		})
+	if value, ok := _u.mutation.Name(); ok {
+		_spec.SetField(connector.FieldName, field.TypeString, value)
 	}
-	if value, ok := cuo.mutation.ResourceVersion(); ok {
-		_spec.Fields.Set = append(_spec.Fields.Set, &sqlgraph.FieldSpec{
-			Type:   field.TypeString,
-			Value:  value,
-			Column: connector.FieldResourceVersion,
-		})
+	if value, ok := _u.mutation.ResourceVersion(); ok {
+		_spec.SetField(connector.FieldResourceVersion, field.TypeString, value)
 	}
-	if value, ok := cuo.mutation.Config(); ok {
-		_spec.Fields.Set = append(_spec.Fields.Set, &sqlgraph.FieldSpec{
-			Type:   field.TypeBytes,
-			Value:  value,
-			Column: connector.FieldConfig,
+	if value, ok := _u.mutation.Config(); ok {
+		_spec.SetField(connector.FieldConfig, field.TypeBytes, value)
+	}
+	if value, ok := _u.mutation.GrantTypes(); ok {
+		_spec.SetField(connector.FieldGrantTypes, field.TypeJSON, value)
+	}
+	if value, ok := _u.mutation.AppendedGrantTypes(); ok {
+		_spec.AddModifier(func(u *sql.UpdateBuilder) {
+			sqljson.Append(u, connector.FieldGrantTypes, value)
 		})
 	}
-	_node = &Connector{config: cuo.config}
+	if _u.mutation.GrantTypesCleared() {
+		_spec.ClearField(connector.FieldGrantTypes, field.TypeJSON)
+	}
+	_node = &Connector{config: _u.config}
 	_spec.Assign = _node.assignValues
 	_spec.ScanValues = _node.scanValues
-	if err = sqlgraph.UpdateNode(ctx, cuo.driver, _spec); err != nil {
+	if err = sqlgraph.UpdateNode(ctx, _u.driver, _spec); err != nil {
 		if _, ok := err.(*sqlgraph.NotFoundError); ok {
 			err = &NotFoundError{connector.Label}
 		} else if sqlgraph.IsConstraintError(err) {
@@ -387,5 +385,6 @@ func (cuo *ConnectorUpdateOne) sqlSave(ctx context.Context) (_node *Connector, e
 		}
 		return nil, err
 	}
+	_u.mutation.done = true
 	return _node, nil
 }
diff --git a/storage/ent/db/context.go b/storage/ent/db/context.go
deleted file mode 100644
index 95e1ad8b09..0000000000
--- a/storage/ent/db/context.go
+++ /dev/null
@@ -1,33 +0,0 @@
-// Code generated by ent, DO NOT EDIT.
-
-package db
-
-import (
-	"context"
-)
-
-type clientCtxKey struct{}
-
-// FromContext returns a Client stored inside a context, or nil if there isn't one.
-func FromContext(ctx context.Context) *Client {
-	c, _ := ctx.Value(clientCtxKey{}).(*Client)
-	return c
-}
-
-// NewContext returns a new context with the given Client attached.
-func NewContext(parent context.Context, c *Client) context.Context {
-	return context.WithValue(parent, clientCtxKey{}, c)
-}
-
-type txCtxKey struct{}
-
-// TxFromContext returns a Tx stored inside a context, or nil if there isn't one.
-func TxFromContext(ctx context.Context) *Tx {
-	tx, _ := ctx.Value(txCtxKey{}).(*Tx)
-	return tx
-}
-
-// NewTxContext returns a new context with the given Tx attached.
-func NewTxContext(parent context.Context, tx *Tx) context.Context {
-	return context.WithValue(parent, txCtxKey{}, tx)
-}
diff --git a/storage/ent/db/devicerequest.go b/storage/ent/db/devicerequest.go
index d358f1741f..ca502a2cd5 100644
--- a/storage/ent/db/devicerequest.go
+++ b/storage/ent/db/devicerequest.go
@@ -8,6 +8,7 @@ import (
 	"strings"
 	"time"
 
+	"entgo.io/ent"
 	"entgo.io/ent/dialect/sql"
 	"github.com/dexidp/dex/storage/ent/db/devicerequest"
 )
@@ -28,12 +29,13 @@ type DeviceRequest struct {
 	// Scopes holds the value of the "scopes" field.
 	Scopes []string `json:"scopes,omitempty"`
 	// Expiry holds the value of the "expiry" field.
-	Expiry time.Time `json:"expiry,omitempty"`
+	Expiry       time.Time `json:"expiry,omitempty"`
+	selectValues sql.SelectValues
 }
 
 // scanValues returns the types for scanning values from sql.Rows.
-func (*DeviceRequest) scanValues(columns []string) ([]interface{}, error) {
-	values := make([]interface{}, len(columns))
+func (*DeviceRequest) scanValues(columns []string) ([]any, error) {
+	values := make([]any, len(columns))
 	for i := range columns {
 		switch columns[i] {
 		case devicerequest.FieldScopes:
@@ -45,7 +47,7 @@ func (*DeviceRequest) scanValues(columns []string) ([]interface{}, error) {
 		case devicerequest.FieldExpiry:
 			values[i] = new(sql.NullTime)
 		default:
-			return nil, fmt.Errorf("unexpected column %q for type DeviceRequest", columns[i])
+			values[i] = new(sql.UnknownType)
 		}
 	}
 	return values, nil
@@ -53,7 +55,7 @@ func (*DeviceRequest) scanValues(columns []string) ([]interface{}, error) {
 
 // assignValues assigns the values that were returned from sql.Rows (after scanning)
 // to the DeviceRequest fields.
-func (dr *DeviceRequest) assignValues(columns []string, values []interface{}) error {
+func (_m *DeviceRequest) assignValues(columns []string, values []any) error {
 	if m, n := len(values), len(columns); m < n {
 		return fmt.Errorf("mismatch number of scan values: %d != %d", m, n)
 	}
@@ -64,36 +66,36 @@ func (dr *DeviceRequest) assignValues(columns []string, values []interface{}) er
 			if !ok {
 				return fmt.Errorf("unexpected type %T for field id", value)
 			}
-			dr.ID = int(value.Int64)
+			_m.ID = int(value.Int64)
 		case devicerequest.FieldUserCode:
 			if value, ok := values[i].(*sql.NullString); !ok {
 				return fmt.Errorf("unexpected type %T for field user_code", values[i])
 			} else if value.Valid {
-				dr.UserCode = value.String
+				_m.UserCode = value.String
 			}
 		case devicerequest.FieldDeviceCode:
 			if value, ok := values[i].(*sql.NullString); !ok {
 				return fmt.Errorf("unexpected type %T for field device_code", values[i])
 			} else if value.Valid {
-				dr.DeviceCode = value.String
+				_m.DeviceCode = value.String
 			}
 		case devicerequest.FieldClientID:
 			if value, ok := values[i].(*sql.NullString); !ok {
 				return fmt.Errorf("unexpected type %T for field client_id", values[i])
 			} else if value.Valid {
-				dr.ClientID = value.String
+				_m.ClientID = value.String
 			}
 		case devicerequest.FieldClientSecret:
 			if value, ok := values[i].(*sql.NullString); !ok {
 				return fmt.Errorf("unexpected type %T for field client_secret", values[i])
 			} else if value.Valid {
-				dr.ClientSecret = value.String
+				_m.ClientSecret = value.String
 			}
 		case devicerequest.FieldScopes:
 			if value, ok := values[i].(*[]byte); !ok {
 				return fmt.Errorf("unexpected type %T for field scopes", values[i])
 			} else if value != nil && len(*value) > 0 {
-				if err := json.Unmarshal(*value, &dr.Scopes); err != nil {
+				if err := json.Unmarshal(*value, &_m.Scopes); err != nil {
 					return fmt.Errorf("unmarshal field scopes: %w", err)
 				}
 			}
@@ -101,62 +103,64 @@ func (dr *DeviceRequest) assignValues(columns []string, values []interface{}) er
 			if value, ok := values[i].(*sql.NullTime); !ok {
 				return fmt.Errorf("unexpected type %T for field expiry", values[i])
 			} else if value.Valid {
-				dr.Expiry = value.Time
+				_m.Expiry = value.Time
 			}
+		default:
+			_m.selectValues.Set(columns[i], values[i])
 		}
 	}
 	return nil
 }
 
+// Value returns the ent.Value that was dynamically selected and assigned to the DeviceRequest.
+// This includes values selected through modifiers, order, etc.
+func (_m *DeviceRequest) Value(name string) (ent.Value, error) {
+	return _m.selectValues.Get(name)
+}
+
 // Update returns a builder for updating this DeviceRequest.
 // Note that you need to call DeviceRequest.Unwrap() before calling this method if this DeviceRequest
 // was returned from a transaction, and the transaction was committed or rolled back.
-func (dr *DeviceRequest) Update() *DeviceRequestUpdateOne {
-	return (&DeviceRequestClient{config: dr.config}).UpdateOne(dr)
+func (_m *DeviceRequest) Update() *DeviceRequestUpdateOne {
+	return NewDeviceRequestClient(_m.config).UpdateOne(_m)
 }
 
 // Unwrap unwraps the DeviceRequest entity that was returned from a transaction after it was closed,
 // so that all future queries will be executed through the driver which created the transaction.
-func (dr *DeviceRequest) Unwrap() *DeviceRequest {
-	_tx, ok := dr.config.driver.(*txDriver)
+func (_m *DeviceRequest) Unwrap() *DeviceRequest {
+	_tx, ok := _m.config.driver.(*txDriver)
 	if !ok {
 		panic("db: DeviceRequest is not a transactional entity")
 	}
-	dr.config.driver = _tx.drv
-	return dr
+	_m.config.driver = _tx.drv
+	return _m
 }
 
 // String implements the fmt.Stringer.
-func (dr *DeviceRequest) String() string {
+func (_m *DeviceRequest) String() string {
 	var builder strings.Builder
 	builder.WriteString("DeviceRequest(")
-	builder.WriteString(fmt.Sprintf("id=%v, ", dr.ID))
+	builder.WriteString(fmt.Sprintf("id=%v, ", _m.ID))
 	builder.WriteString("user_code=")
-	builder.WriteString(dr.UserCode)
+	builder.WriteString(_m.UserCode)
 	builder.WriteString(", ")
 	builder.WriteString("device_code=")
-	builder.WriteString(dr.DeviceCode)
+	builder.WriteString(_m.DeviceCode)
 	builder.WriteString(", ")
 	builder.WriteString("client_id=")
-	builder.WriteString(dr.ClientID)
+	builder.WriteString(_m.ClientID)
 	builder.WriteString(", ")
 	builder.WriteString("client_secret=")
-	builder.WriteString(dr.ClientSecret)
+	builder.WriteString(_m.ClientSecret)
 	builder.WriteString(", ")
 	builder.WriteString("scopes=")
-	builder.WriteString(fmt.Sprintf("%v", dr.Scopes))
+	builder.WriteString(fmt.Sprintf("%v", _m.Scopes))
 	builder.WriteString(", ")
 	builder.WriteString("expiry=")
-	builder.WriteString(dr.Expiry.Format(time.ANSIC))
+	builder.WriteString(_m.Expiry.Format(time.ANSIC))
 	builder.WriteByte(')')
 	return builder.String()
 }
 
 // DeviceRequests is a parsable slice of DeviceRequest.
 type DeviceRequests []*DeviceRequest
-
-func (dr DeviceRequests) config(cfg config) {
-	for _i := range dr {
-		dr[_i].config = cfg
-	}
-}
diff --git a/storage/ent/db/devicerequest/devicerequest.go b/storage/ent/db/devicerequest/devicerequest.go
index 5dd032d613..d27f3971ca 100644
--- a/storage/ent/db/devicerequest/devicerequest.go
+++ b/storage/ent/db/devicerequest/devicerequest.go
@@ -2,6 +2,10 @@
 
 package devicerequest
 
+import (
+	"entgo.io/ent/dialect/sql"
+)
+
 const (
 	// Label holds the string label denoting the devicerequest type in the database.
 	Label = "device_request"
@@ -54,3 +58,36 @@ var (
 	// ClientSecretValidator is a validator for the "client_secret" field. It is called by the builders before save.
 	ClientSecretValidator func(string) error
 )
+
+// OrderOption defines the ordering options for the DeviceRequest queries.
+type OrderOption func(*sql.Selector)
+
+// ByID orders the results by the id field.
+func ByID(opts ...sql.OrderTermOption) OrderOption {
+	return sql.OrderByField(FieldID, opts...).ToFunc()
+}
+
+// ByUserCode orders the results by the user_code field.
+func ByUserCode(opts ...sql.OrderTermOption) OrderOption {
+	return sql.OrderByField(FieldUserCode, opts...).ToFunc()
+}
+
+// ByDeviceCode orders the results by the device_code field.
+func ByDeviceCode(opts ...sql.OrderTermOption) OrderOption {
+	return sql.OrderByField(FieldDeviceCode, opts...).ToFunc()
+}
+
+// ByClientID orders the results by the client_id field.
+func ByClientID(opts ...sql.OrderTermOption) OrderOption {
+	return sql.OrderByField(FieldClientID, opts...).ToFunc()
+}
+
+// ByClientSecret orders the results by the client_secret field.
+func ByClientSecret(opts ...sql.OrderTermOption) OrderOption {
+	return sql.OrderByField(FieldClientSecret, opts...).ToFunc()
+}
+
+// ByExpiry orders the results by the expiry field.
+func ByExpiry(opts ...sql.OrderTermOption) OrderOption {
+	return sql.OrderByField(FieldExpiry, opts...).ToFunc()
+}
diff --git a/storage/ent/db/devicerequest/where.go b/storage/ent/db/devicerequest/where.go
index 5cb5ce4489..47a578fc3c 100644
--- a/storage/ent/db/devicerequest/where.go
+++ b/storage/ent/db/devicerequest/where.go
@@ -11,612 +11,395 @@ import (
 
 // ID filters vertices based on their ID field.
 func ID(id int) predicate.DeviceRequest {
-	return predicate.DeviceRequest(func(s *sql.Selector) {
-		s.Where(sql.EQ(s.C(FieldID), id))
-	})
+	return predicate.DeviceRequest(sql.FieldEQ(FieldID, id))
 }
 
 // IDEQ applies the EQ predicate on the ID field.
 func IDEQ(id int) predicate.DeviceRequest {
-	return predicate.DeviceRequest(func(s *sql.Selector) {
-		s.Where(sql.EQ(s.C(FieldID), id))
-	})
+	return predicate.DeviceRequest(sql.FieldEQ(FieldID, id))
 }
 
 // IDNEQ applies the NEQ predicate on the ID field.
 func IDNEQ(id int) predicate.DeviceRequest {
-	return predicate.DeviceRequest(func(s *sql.Selector) {
-		s.Where(sql.NEQ(s.C(FieldID), id))
-	})
+	return predicate.DeviceRequest(sql.FieldNEQ(FieldID, id))
 }
 
 // IDIn applies the In predicate on the ID field.
 func IDIn(ids ...int) predicate.DeviceRequest {
-	return predicate.DeviceRequest(func(s *sql.Selector) {
-		v := make([]interface{}, len(ids))
-		for i := range v {
-			v[i] = ids[i]
-		}
-		s.Where(sql.In(s.C(FieldID), v...))
-	})
+	return predicate.DeviceRequest(sql.FieldIn(FieldID, ids...))
 }
 
 // IDNotIn applies the NotIn predicate on the ID field.
 func IDNotIn(ids ...int) predicate.DeviceRequest {
-	return predicate.DeviceRequest(func(s *sql.Selector) {
-		v := make([]interface{}, len(ids))
-		for i := range v {
-			v[i] = ids[i]
-		}
-		s.Where(sql.NotIn(s.C(FieldID), v...))
-	})
+	return predicate.DeviceRequest(sql.FieldNotIn(FieldID, ids...))
 }
 
 // IDGT applies the GT predicate on the ID field.
 func IDGT(id int) predicate.DeviceRequest {
-	return predicate.DeviceRequest(func(s *sql.Selector) {
-		s.Where(sql.GT(s.C(FieldID), id))
-	})
+	return predicate.DeviceRequest(sql.FieldGT(FieldID, id))
 }
 
 // IDGTE applies the GTE predicate on the ID field.
 func IDGTE(id int) predicate.DeviceRequest {
-	return predicate.DeviceRequest(func(s *sql.Selector) {
-		s.Where(sql.GTE(s.C(FieldID), id))
-	})
+	return predicate.DeviceRequest(sql.FieldGTE(FieldID, id))
 }
 
 // IDLT applies the LT predicate on the ID field.
 func IDLT(id int) predicate.DeviceRequest {
-	return predicate.DeviceRequest(func(s *sql.Selector) {
-		s.Where(sql.LT(s.C(FieldID), id))
-	})
+	return predicate.DeviceRequest(sql.FieldLT(FieldID, id))
 }
 
 // IDLTE applies the LTE predicate on the ID field.
 func IDLTE(id int) predicate.DeviceRequest {
-	return predicate.DeviceRequest(func(s *sql.Selector) {
-		s.Where(sql.LTE(s.C(FieldID), id))
-	})
+	return predicate.DeviceRequest(sql.FieldLTE(FieldID, id))
 }
 
 // UserCode applies equality check predicate on the "user_code" field. It's identical to UserCodeEQ.
 func UserCode(v string) predicate.DeviceRequest {
-	return predicate.DeviceRequest(func(s *sql.Selector) {
-		s.Where(sql.EQ(s.C(FieldUserCode), v))
-	})
+	return predicate.DeviceRequest(sql.FieldEQ(FieldUserCode, v))
 }
 
 // DeviceCode applies equality check predicate on the "device_code" field. It's identical to DeviceCodeEQ.
 func DeviceCode(v string) predicate.DeviceRequest {
-	return predicate.DeviceRequest(func(s *sql.Selector) {
-		s.Where(sql.EQ(s.C(FieldDeviceCode), v))
-	})
+	return predicate.DeviceRequest(sql.FieldEQ(FieldDeviceCode, v))
 }
 
 // ClientID applies equality check predicate on the "client_id" field. It's identical to ClientIDEQ.
 func ClientID(v string) predicate.DeviceRequest {
-	return predicate.DeviceRequest(func(s *sql.Selector) {
-		s.Where(sql.EQ(s.C(FieldClientID), v))
-	})
+	return predicate.DeviceRequest(sql.FieldEQ(FieldClientID, v))
 }
 
 // ClientSecret applies equality check predicate on the "client_secret" field. It's identical to ClientSecretEQ.
 func ClientSecret(v string) predicate.DeviceRequest {
-	return predicate.DeviceRequest(func(s *sql.Selector) {
-		s.Where(sql.EQ(s.C(FieldClientSecret), v))
-	})
+	return predicate.DeviceRequest(sql.FieldEQ(FieldClientSecret, v))
 }
 
 // Expiry applies equality check predicate on the "expiry" field. It's identical to ExpiryEQ.
 func Expiry(v time.Time) predicate.DeviceRequest {
-	return predicate.DeviceRequest(func(s *sql.Selector) {
-		s.Where(sql.EQ(s.C(FieldExpiry), v))
-	})
+	return predicate.DeviceRequest(sql.FieldEQ(FieldExpiry, v))
 }
 
 // UserCodeEQ applies the EQ predicate on the "user_code" field.
 func UserCodeEQ(v string) predicate.DeviceRequest {
-	return predicate.DeviceRequest(func(s *sql.Selector) {
-		s.Where(sql.EQ(s.C(FieldUserCode), v))
-	})
+	return predicate.DeviceRequest(sql.FieldEQ(FieldUserCode, v))
 }
 
 // UserCodeNEQ applies the NEQ predicate on the "user_code" field.
 func UserCodeNEQ(v string) predicate.DeviceRequest {
-	return predicate.DeviceRequest(func(s *sql.Selector) {
-		s.Where(sql.NEQ(s.C(FieldUserCode), v))
-	})
+	return predicate.DeviceRequest(sql.FieldNEQ(FieldUserCode, v))
 }
 
 // UserCodeIn applies the In predicate on the "user_code" field.
 func UserCodeIn(vs ...string) predicate.DeviceRequest {
-	v := make([]interface{}, len(vs))
-	for i := range v {
-		v[i] = vs[i]
-	}
-	return predicate.DeviceRequest(func(s *sql.Selector) {
-		s.Where(sql.In(s.C(FieldUserCode), v...))
-	})
+	return predicate.DeviceRequest(sql.FieldIn(FieldUserCode, vs...))
 }
 
 // UserCodeNotIn applies the NotIn predicate on the "user_code" field.
 func UserCodeNotIn(vs ...string) predicate.DeviceRequest {
-	v := make([]interface{}, len(vs))
-	for i := range v {
-		v[i] = vs[i]
-	}
-	return predicate.DeviceRequest(func(s *sql.Selector) {
-		s.Where(sql.NotIn(s.C(FieldUserCode), v...))
-	})
+	return predicate.DeviceRequest(sql.FieldNotIn(FieldUserCode, vs...))
 }
 
 // UserCodeGT applies the GT predicate on the "user_code" field.
 func UserCodeGT(v string) predicate.DeviceRequest {
-	return predicate.DeviceRequest(func(s *sql.Selector) {
-		s.Where(sql.GT(s.C(FieldUserCode), v))
-	})
+	return predicate.DeviceRequest(sql.FieldGT(FieldUserCode, v))
 }
 
 // UserCodeGTE applies the GTE predicate on the "user_code" field.
 func UserCodeGTE(v string) predicate.DeviceRequest {
-	return predicate.DeviceRequest(func(s *sql.Selector) {
-		s.Where(sql.GTE(s.C(FieldUserCode), v))
-	})
+	return predicate.DeviceRequest(sql.FieldGTE(FieldUserCode, v))
 }
 
 // UserCodeLT applies the LT predicate on the "user_code" field.
 func UserCodeLT(v string) predicate.DeviceRequest {
-	return predicate.DeviceRequest(func(s *sql.Selector) {
-		s.Where(sql.LT(s.C(FieldUserCode), v))
-	})
+	return predicate.DeviceRequest(sql.FieldLT(FieldUserCode, v))
 }
 
 // UserCodeLTE applies the LTE predicate on the "user_code" field.
 func UserCodeLTE(v string) predicate.DeviceRequest {
-	return predicate.DeviceRequest(func(s *sql.Selector) {
-		s.Where(sql.LTE(s.C(FieldUserCode), v))
-	})
+	return predicate.DeviceRequest(sql.FieldLTE(FieldUserCode, v))
 }
 
 // UserCodeContains applies the Contains predicate on the "user_code" field.
 func UserCodeContains(v string) predicate.DeviceRequest {
-	return predicate.DeviceRequest(func(s *sql.Selector) {
-		s.Where(sql.Contains(s.C(FieldUserCode), v))
-	})
+	return predicate.DeviceRequest(sql.FieldContains(FieldUserCode, v))
 }
 
 // UserCodeHasPrefix applies the HasPrefix predicate on the "user_code" field.
 func UserCodeHasPrefix(v string) predicate.DeviceRequest {
-	return predicate.DeviceRequest(func(s *sql.Selector) {
-		s.Where(sql.HasPrefix(s.C(FieldUserCode), v))
-	})
+	return predicate.DeviceRequest(sql.FieldHasPrefix(FieldUserCode, v))
 }
 
 // UserCodeHasSuffix applies the HasSuffix predicate on the "user_code" field.
 func UserCodeHasSuffix(v string) predicate.DeviceRequest {
-	return predicate.DeviceRequest(func(s *sql.Selector) {
-		s.Where(sql.HasSuffix(s.C(FieldUserCode), v))
-	})
+	return predicate.DeviceRequest(sql.FieldHasSuffix(FieldUserCode, v))
 }
 
 // UserCodeEqualFold applies the EqualFold predicate on the "user_code" field.
 func UserCodeEqualFold(v string) predicate.DeviceRequest {
-	return predicate.DeviceRequest(func(s *sql.Selector) {
-		s.Where(sql.EqualFold(s.C(FieldUserCode), v))
-	})
+	return predicate.DeviceRequest(sql.FieldEqualFold(FieldUserCode, v))
 }
 
 // UserCodeContainsFold applies the ContainsFold predicate on the "user_code" field.
 func UserCodeContainsFold(v string) predicate.DeviceRequest {
-	return predicate.DeviceRequest(func(s *sql.Selector) {
-		s.Where(sql.ContainsFold(s.C(FieldUserCode), v))
-	})
+	return predicate.DeviceRequest(sql.FieldContainsFold(FieldUserCode, v))
 }
 
 // DeviceCodeEQ applies the EQ predicate on the "device_code" field.
 func DeviceCodeEQ(v string) predicate.DeviceRequest {
-	return predicate.DeviceRequest(func(s *sql.Selector) {
-		s.Where(sql.EQ(s.C(FieldDeviceCode), v))
-	})
+	return predicate.DeviceRequest(sql.FieldEQ(FieldDeviceCode, v))
 }
 
 // DeviceCodeNEQ applies the NEQ predicate on the "device_code" field.
 func DeviceCodeNEQ(v string) predicate.DeviceRequest {
-	return predicate.DeviceRequest(func(s *sql.Selector) {
-		s.Where(sql.NEQ(s.C(FieldDeviceCode), v))
-	})
+	return predicate.DeviceRequest(sql.FieldNEQ(FieldDeviceCode, v))
 }
 
 // DeviceCodeIn applies the In predicate on the "device_code" field.
 func DeviceCodeIn(vs ...string) predicate.DeviceRequest {
-	v := make([]interface{}, len(vs))
-	for i := range v {
-		v[i] = vs[i]
-	}
-	return predicate.DeviceRequest(func(s *sql.Selector) {
-		s.Where(sql.In(s.C(FieldDeviceCode), v...))
-	})
+	return predicate.DeviceRequest(sql.FieldIn(FieldDeviceCode, vs...))
 }
 
 // DeviceCodeNotIn applies the NotIn predicate on the "device_code" field.
 func DeviceCodeNotIn(vs ...string) predicate.DeviceRequest {
-	v := make([]interface{}, len(vs))
-	for i := range v {
-		v[i] = vs[i]
-	}
-	return predicate.DeviceRequest(func(s *sql.Selector) {
-		s.Where(sql.NotIn(s.C(FieldDeviceCode), v...))
-	})
+	return predicate.DeviceRequest(sql.FieldNotIn(FieldDeviceCode, vs...))
 }
 
 // DeviceCodeGT applies the GT predicate on the "device_code" field.
 func DeviceCodeGT(v string) predicate.DeviceRequest {
-	return predicate.DeviceRequest(func(s *sql.Selector) {
-		s.Where(sql.GT(s.C(FieldDeviceCode), v))
-	})
+	return predicate.DeviceRequest(sql.FieldGT(FieldDeviceCode, v))
 }
 
 // DeviceCodeGTE applies the GTE predicate on the "device_code" field.
 func DeviceCodeGTE(v string) predicate.DeviceRequest {
-	return predicate.DeviceRequest(func(s *sql.Selector) {
-		s.Where(sql.GTE(s.C(FieldDeviceCode), v))
-	})
+	return predicate.DeviceRequest(sql.FieldGTE(FieldDeviceCode, v))
 }
 
 // DeviceCodeLT applies the LT predicate on the "device_code" field.
 func DeviceCodeLT(v string) predicate.DeviceRequest {
-	return predicate.DeviceRequest(func(s *sql.Selector) {
-		s.Where(sql.LT(s.C(FieldDeviceCode), v))
-	})
+	return predicate.DeviceRequest(sql.FieldLT(FieldDeviceCode, v))
 }
 
 // DeviceCodeLTE applies the LTE predicate on the "device_code" field.
 func DeviceCodeLTE(v string) predicate.DeviceRequest {
-	return predicate.DeviceRequest(func(s *sql.Selector) {
-		s.Where(sql.LTE(s.C(FieldDeviceCode), v))
-	})
+	return predicate.DeviceRequest(sql.FieldLTE(FieldDeviceCode, v))
 }
 
 // DeviceCodeContains applies the Contains predicate on the "device_code" field.
 func DeviceCodeContains(v string) predicate.DeviceRequest {
-	return predicate.DeviceRequest(func(s *sql.Selector) {
-		s.Where(sql.Contains(s.C(FieldDeviceCode), v))
-	})
+	return predicate.DeviceRequest(sql.FieldContains(FieldDeviceCode, v))
 }
 
 // DeviceCodeHasPrefix applies the HasPrefix predicate on the "device_code" field.
 func DeviceCodeHasPrefix(v string) predicate.DeviceRequest {
-	return predicate.DeviceRequest(func(s *sql.Selector) {
-		s.Where(sql.HasPrefix(s.C(FieldDeviceCode), v))
-	})
+	return predicate.DeviceRequest(sql.FieldHasPrefix(FieldDeviceCode, v))
 }
 
 // DeviceCodeHasSuffix applies the HasSuffix predicate on the "device_code" field.
 func DeviceCodeHasSuffix(v string) predicate.DeviceRequest {
-	return predicate.DeviceRequest(func(s *sql.Selector) {
-		s.Where(sql.HasSuffix(s.C(FieldDeviceCode), v))
-	})
+	return predicate.DeviceRequest(sql.FieldHasSuffix(FieldDeviceCode, v))
 }
 
 // DeviceCodeEqualFold applies the EqualFold predicate on the "device_code" field.
 func DeviceCodeEqualFold(v string) predicate.DeviceRequest {
-	return predicate.DeviceRequest(func(s *sql.Selector) {
-		s.Where(sql.EqualFold(s.C(FieldDeviceCode), v))
-	})
+	return predicate.DeviceRequest(sql.FieldEqualFold(FieldDeviceCode, v))
 }
 
 // DeviceCodeContainsFold applies the ContainsFold predicate on the "device_code" field.
 func DeviceCodeContainsFold(v string) predicate.DeviceRequest {
-	return predicate.DeviceRequest(func(s *sql.Selector) {
-		s.Where(sql.ContainsFold(s.C(FieldDeviceCode), v))
-	})
+	return predicate.DeviceRequest(sql.FieldContainsFold(FieldDeviceCode, v))
 }
 
 // ClientIDEQ applies the EQ predicate on the "client_id" field.
 func ClientIDEQ(v string) predicate.DeviceRequest {
-	return predicate.DeviceRequest(func(s *sql.Selector) {
-		s.Where(sql.EQ(s.C(FieldClientID), v))
-	})
+	return predicate.DeviceRequest(sql.FieldEQ(FieldClientID, v))
 }
 
 // ClientIDNEQ applies the NEQ predicate on the "client_id" field.
 func ClientIDNEQ(v string) predicate.DeviceRequest {
-	return predicate.DeviceRequest(func(s *sql.Selector) {
-		s.Where(sql.NEQ(s.C(FieldClientID), v))
-	})
+	return predicate.DeviceRequest(sql.FieldNEQ(FieldClientID, v))
 }
 
 // ClientIDIn applies the In predicate on the "client_id" field.
 func ClientIDIn(vs ...string) predicate.DeviceRequest {
-	v := make([]interface{}, len(vs))
-	for i := range v {
-		v[i] = vs[i]
-	}
-	return predicate.DeviceRequest(func(s *sql.Selector) {
-		s.Where(sql.In(s.C(FieldClientID), v...))
-	})
+	return predicate.DeviceRequest(sql.FieldIn(FieldClientID, vs...))
 }
 
 // ClientIDNotIn applies the NotIn predicate on the "client_id" field.
 func ClientIDNotIn(vs ...string) predicate.DeviceRequest {
-	v := make([]interface{}, len(vs))
-	for i := range v {
-		v[i] = vs[i]
-	}
-	return predicate.DeviceRequest(func(s *sql.Selector) {
-		s.Where(sql.NotIn(s.C(FieldClientID), v...))
-	})
+	return predicate.DeviceRequest(sql.FieldNotIn(FieldClientID, vs...))
 }
 
 // ClientIDGT applies the GT predicate on the "client_id" field.
 func ClientIDGT(v string) predicate.DeviceRequest {
-	return predicate.DeviceRequest(func(s *sql.Selector) {
-		s.Where(sql.GT(s.C(FieldClientID), v))
-	})
+	return predicate.DeviceRequest(sql.FieldGT(FieldClientID, v))
 }
 
 // ClientIDGTE applies the GTE predicate on the "client_id" field.
 func ClientIDGTE(v string) predicate.DeviceRequest {
-	return predicate.DeviceRequest(func(s *sql.Selector) {
-		s.Where(sql.GTE(s.C(FieldClientID), v))
-	})
+	return predicate.DeviceRequest(sql.FieldGTE(FieldClientID, v))
 }
 
 // ClientIDLT applies the LT predicate on the "client_id" field.
 func ClientIDLT(v string) predicate.DeviceRequest {
-	return predicate.DeviceRequest(func(s *sql.Selector) {
-		s.Where(sql.LT(s.C(FieldClientID), v))
-	})
+	return predicate.DeviceRequest(sql.FieldLT(FieldClientID, v))
 }
 
 // ClientIDLTE applies the LTE predicate on the "client_id" field.
 func ClientIDLTE(v string) predicate.DeviceRequest {
-	return predicate.DeviceRequest(func(s *sql.Selector) {
-		s.Where(sql.LTE(s.C(FieldClientID), v))
-	})
+	return predicate.DeviceRequest(sql.FieldLTE(FieldClientID, v))
 }
 
 // ClientIDContains applies the Contains predicate on the "client_id" field.
 func ClientIDContains(v string) predicate.DeviceRequest {
-	return predicate.DeviceRequest(func(s *sql.Selector) {
-		s.Where(sql.Contains(s.C(FieldClientID), v))
-	})
+	return predicate.DeviceRequest(sql.FieldContains(FieldClientID, v))
 }
 
 // ClientIDHasPrefix applies the HasPrefix predicate on the "client_id" field.
 func ClientIDHasPrefix(v string) predicate.DeviceRequest {
-	return predicate.DeviceRequest(func(s *sql.Selector) {
-		s.Where(sql.HasPrefix(s.C(FieldClientID), v))
-	})
+	return predicate.DeviceRequest(sql.FieldHasPrefix(FieldClientID, v))
 }
 
 // ClientIDHasSuffix applies the HasSuffix predicate on the "client_id" field.
 func ClientIDHasSuffix(v string) predicate.DeviceRequest {
-	return predicate.DeviceRequest(func(s *sql.Selector) {
-		s.Where(sql.HasSuffix(s.C(FieldClientID), v))
-	})
+	return predicate.DeviceRequest(sql.FieldHasSuffix(FieldClientID, v))
 }
 
 // ClientIDEqualFold applies the EqualFold predicate on the "client_id" field.
 func ClientIDEqualFold(v string) predicate.DeviceRequest {
-	return predicate.DeviceRequest(func(s *sql.Selector) {
-		s.Where(sql.EqualFold(s.C(FieldClientID), v))
-	})
+	return predicate.DeviceRequest(sql.FieldEqualFold(FieldClientID, v))
 }
 
 // ClientIDContainsFold applies the ContainsFold predicate on the "client_id" field.
 func ClientIDContainsFold(v string) predicate.DeviceRequest {
-	return predicate.DeviceRequest(func(s *sql.Selector) {
-		s.Where(sql.ContainsFold(s.C(FieldClientID), v))
-	})
+	return predicate.DeviceRequest(sql.FieldContainsFold(FieldClientID, v))
 }
 
 // ClientSecretEQ applies the EQ predicate on the "client_secret" field.
 func ClientSecretEQ(v string) predicate.DeviceRequest {
-	return predicate.DeviceRequest(func(s *sql.Selector) {
-		s.Where(sql.EQ(s.C(FieldClientSecret), v))
-	})
+	return predicate.DeviceRequest(sql.FieldEQ(FieldClientSecret, v))
 }
 
 // ClientSecretNEQ applies the NEQ predicate on the "client_secret" field.
 func ClientSecretNEQ(v string) predicate.DeviceRequest {
-	return predicate.DeviceRequest(func(s *sql.Selector) {
-		s.Where(sql.NEQ(s.C(FieldClientSecret), v))
-	})
+	return predicate.DeviceRequest(sql.FieldNEQ(FieldClientSecret, v))
 }
 
 // ClientSecretIn applies the In predicate on the "client_secret" field.
 func ClientSecretIn(vs ...string) predicate.DeviceRequest {
-	v := make([]interface{}, len(vs))
-	for i := range v {
-		v[i] = vs[i]
-	}
-	return predicate.DeviceRequest(func(s *sql.Selector) {
-		s.Where(sql.In(s.C(FieldClientSecret), v...))
-	})
+	return predicate.DeviceRequest(sql.FieldIn(FieldClientSecret, vs...))
 }
 
 // ClientSecretNotIn applies the NotIn predicate on the "client_secret" field.
 func ClientSecretNotIn(vs ...string) predicate.DeviceRequest {
-	v := make([]interface{}, len(vs))
-	for i := range v {
-		v[i] = vs[i]
-	}
-	return predicate.DeviceRequest(func(s *sql.Selector) {
-		s.Where(sql.NotIn(s.C(FieldClientSecret), v...))
-	})
+	return predicate.DeviceRequest(sql.FieldNotIn(FieldClientSecret, vs...))
 }
 
 // ClientSecretGT applies the GT predicate on the "client_secret" field.
 func ClientSecretGT(v string) predicate.DeviceRequest {
-	return predicate.DeviceRequest(func(s *sql.Selector) {
-		s.Where(sql.GT(s.C(FieldClientSecret), v))
-	})
+	return predicate.DeviceRequest(sql.FieldGT(FieldClientSecret, v))
 }
 
 // ClientSecretGTE applies the GTE predicate on the "client_secret" field.
 func ClientSecretGTE(v string) predicate.DeviceRequest {
-	return predicate.DeviceRequest(func(s *sql.Selector) {
-		s.Where(sql.GTE(s.C(FieldClientSecret), v))
-	})
+	return predicate.DeviceRequest(sql.FieldGTE(FieldClientSecret, v))
 }
 
 // ClientSecretLT applies the LT predicate on the "client_secret" field.
 func ClientSecretLT(v string) predicate.DeviceRequest {
-	return predicate.DeviceRequest(func(s *sql.Selector) {
-		s.Where(sql.LT(s.C(FieldClientSecret), v))
-	})
+	return predicate.DeviceRequest(sql.FieldLT(FieldClientSecret, v))
 }
 
 // ClientSecretLTE applies the LTE predicate on the "client_secret" field.
 func ClientSecretLTE(v string) predicate.DeviceRequest {
-	return predicate.DeviceRequest(func(s *sql.Selector) {
-		s.Where(sql.LTE(s.C(FieldClientSecret), v))
-	})
+	return predicate.DeviceRequest(sql.FieldLTE(FieldClientSecret, v))
 }
 
 // ClientSecretContains applies the Contains predicate on the "client_secret" field.
 func ClientSecretContains(v string) predicate.DeviceRequest {
-	return predicate.DeviceRequest(func(s *sql.Selector) {
-		s.Where(sql.Contains(s.C(FieldClientSecret), v))
-	})
+	return predicate.DeviceRequest(sql.FieldContains(FieldClientSecret, v))
 }
 
 // ClientSecretHasPrefix applies the HasPrefix predicate on the "client_secret" field.
 func ClientSecretHasPrefix(v string) predicate.DeviceRequest {
-	return predicate.DeviceRequest(func(s *sql.Selector) {
-		s.Where(sql.HasPrefix(s.C(FieldClientSecret), v))
-	})
+	return predicate.DeviceRequest(sql.FieldHasPrefix(FieldClientSecret, v))
 }
 
 // ClientSecretHasSuffix applies the HasSuffix predicate on the "client_secret" field.
 func ClientSecretHasSuffix(v string) predicate.DeviceRequest {
-	return predicate.DeviceRequest(func(s *sql.Selector) {
-		s.Where(sql.HasSuffix(s.C(FieldClientSecret), v))
-	})
+	return predicate.DeviceRequest(sql.FieldHasSuffix(FieldClientSecret, v))
 }
 
 // ClientSecretEqualFold applies the EqualFold predicate on the "client_secret" field.
 func ClientSecretEqualFold(v string) predicate.DeviceRequest {
-	return predicate.DeviceRequest(func(s *sql.Selector) {
-		s.Where(sql.EqualFold(s.C(FieldClientSecret), v))
-	})
+	return predicate.DeviceRequest(sql.FieldEqualFold(FieldClientSecret, v))
 }
 
 // ClientSecretContainsFold applies the ContainsFold predicate on the "client_secret" field.
 func ClientSecretContainsFold(v string) predicate.DeviceRequest {
-	return predicate.DeviceRequest(func(s *sql.Selector) {
-		s.Where(sql.ContainsFold(s.C(FieldClientSecret), v))
-	})
+	return predicate.DeviceRequest(sql.FieldContainsFold(FieldClientSecret, v))
 }
 
 // ScopesIsNil applies the IsNil predicate on the "scopes" field.
 func ScopesIsNil() predicate.DeviceRequest {
-	return predicate.DeviceRequest(func(s *sql.Selector) {
-		s.Where(sql.IsNull(s.C(FieldScopes)))
-	})
+	return predicate.DeviceRequest(sql.FieldIsNull(FieldScopes))
 }
 
 // ScopesNotNil applies the NotNil predicate on the "scopes" field.
 func ScopesNotNil() predicate.DeviceRequest {
-	return predicate.DeviceRequest(func(s *sql.Selector) {
-		s.Where(sql.NotNull(s.C(FieldScopes)))
-	})
+	return predicate.DeviceRequest(sql.FieldNotNull(FieldScopes))
 }
 
 // ExpiryEQ applies the EQ predicate on the "expiry" field.
 func ExpiryEQ(v time.Time) predicate.DeviceRequest {
-	return predicate.DeviceRequest(func(s *sql.Selector) {
-		s.Where(sql.EQ(s.C(FieldExpiry), v))
-	})
+	return predicate.DeviceRequest(sql.FieldEQ(FieldExpiry, v))
 }
 
 // ExpiryNEQ applies the NEQ predicate on the "expiry" field.
 func ExpiryNEQ(v time.Time) predicate.DeviceRequest {
-	return predicate.DeviceRequest(func(s *sql.Selector) {
-		s.Where(sql.NEQ(s.C(FieldExpiry), v))
-	})
+	return predicate.DeviceRequest(sql.FieldNEQ(FieldExpiry, v))
 }
 
 // ExpiryIn applies the In predicate on the "expiry" field.
 func ExpiryIn(vs ...time.Time) predicate.DeviceRequest {
-	v := make([]interface{}, len(vs))
-	for i := range v {
-		v[i] = vs[i]
-	}
-	return predicate.DeviceRequest(func(s *sql.Selector) {
-		s.Where(sql.In(s.C(FieldExpiry), v...))
-	})
+	return predicate.DeviceRequest(sql.FieldIn(FieldExpiry, vs...))
 }
 
 // ExpiryNotIn applies the NotIn predicate on the "expiry" field.
 func ExpiryNotIn(vs ...time.Time) predicate.DeviceRequest {
-	v := make([]interface{}, len(vs))
-	for i := range v {
-		v[i] = vs[i]
-	}
-	return predicate.DeviceRequest(func(s *sql.Selector) {
-		s.Where(sql.NotIn(s.C(FieldExpiry), v...))
-	})
+	return predicate.DeviceRequest(sql.FieldNotIn(FieldExpiry, vs...))
 }
 
 // ExpiryGT applies the GT predicate on the "expiry" field.
 func ExpiryGT(v time.Time) predicate.DeviceRequest {
-	return predicate.DeviceRequest(func(s *sql.Selector) {
-		s.Where(sql.GT(s.C(FieldExpiry), v))
-	})
+	return predicate.DeviceRequest(sql.FieldGT(FieldExpiry, v))
 }
 
 // ExpiryGTE applies the GTE predicate on the "expiry" field.
 func ExpiryGTE(v time.Time) predicate.DeviceRequest {
-	return predicate.DeviceRequest(func(s *sql.Selector) {
-		s.Where(sql.GTE(s.C(FieldExpiry), v))
-	})
+	return predicate.DeviceRequest(sql.FieldGTE(FieldExpiry, v))
 }
 
 // ExpiryLT applies the LT predicate on the "expiry" field.
 func ExpiryLT(v time.Time) predicate.DeviceRequest {
-	return predicate.DeviceRequest(func(s *sql.Selector) {
-		s.Where(sql.LT(s.C(FieldExpiry), v))
-	})
+	return predicate.DeviceRequest(sql.FieldLT(FieldExpiry, v))
 }
 
 // ExpiryLTE applies the LTE predicate on the "expiry" field.
 func ExpiryLTE(v time.Time) predicate.DeviceRequest {
-	return predicate.DeviceRequest(func(s *sql.Selector) {
-		s.Where(sql.LTE(s.C(FieldExpiry), v))
-	})
+	return predicate.DeviceRequest(sql.FieldLTE(FieldExpiry, v))
 }
 
 // And groups predicates with the AND operator between them.
 func And(predicates ...predicate.DeviceRequest) predicate.DeviceRequest {
-	return predicate.DeviceRequest(func(s *sql.Selector) {
-		s1 := s.Clone().SetP(nil)
-		for _, p := range predicates {
-			p(s1)
-		}
-		s.Where(s1.P())
-	})
+	return predicate.DeviceRequest(sql.AndPredicates(predicates...))
 }
 
 // Or groups predicates with the OR operator between them.
 func Or(predicates ...predicate.DeviceRequest) predicate.DeviceRequest {
-	return predicate.DeviceRequest(func(s *sql.Selector) {
-		s1 := s.Clone().SetP(nil)
-		for i, p := range predicates {
-			if i > 0 {
-				s1.Or()
-			}
-			p(s1)
-		}
-		s.Where(s1.P())
-	})
+	return predicate.DeviceRequest(sql.OrPredicates(predicates...))
 }
 
 // Not applies the not operator on the given predicate.
 func Not(p predicate.DeviceRequest) predicate.DeviceRequest {
-	return predicate.DeviceRequest(func(s *sql.Selector) {
-		p(s.Not())
-	})
+	return predicate.DeviceRequest(sql.NotPredicates(p))
 }
diff --git a/storage/ent/db/devicerequest_create.go b/storage/ent/db/devicerequest_create.go
index ae7644ca0c..75a94c1781 100644
--- a/storage/ent/db/devicerequest_create.go
+++ b/storage/ent/db/devicerequest_create.go
@@ -21,96 +21,54 @@ type DeviceRequestCreate struct {
 }
 
 // SetUserCode sets the "user_code" field.
-func (drc *DeviceRequestCreate) SetUserCode(s string) *DeviceRequestCreate {
-	drc.mutation.SetUserCode(s)
-	return drc
+func (_c *DeviceRequestCreate) SetUserCode(v string) *DeviceRequestCreate {
+	_c.mutation.SetUserCode(v)
+	return _c
 }
 
 // SetDeviceCode sets the "device_code" field.
-func (drc *DeviceRequestCreate) SetDeviceCode(s string) *DeviceRequestCreate {
-	drc.mutation.SetDeviceCode(s)
-	return drc
+func (_c *DeviceRequestCreate) SetDeviceCode(v string) *DeviceRequestCreate {
+	_c.mutation.SetDeviceCode(v)
+	return _c
 }
 
 // SetClientID sets the "client_id" field.
-func (drc *DeviceRequestCreate) SetClientID(s string) *DeviceRequestCreate {
-	drc.mutation.SetClientID(s)
-	return drc
+func (_c *DeviceRequestCreate) SetClientID(v string) *DeviceRequestCreate {
+	_c.mutation.SetClientID(v)
+	return _c
 }
 
 // SetClientSecret sets the "client_secret" field.
-func (drc *DeviceRequestCreate) SetClientSecret(s string) *DeviceRequestCreate {
-	drc.mutation.SetClientSecret(s)
-	return drc
+func (_c *DeviceRequestCreate) SetClientSecret(v string) *DeviceRequestCreate {
+	_c.mutation.SetClientSecret(v)
+	return _c
 }
 
 // SetScopes sets the "scopes" field.
-func (drc *DeviceRequestCreate) SetScopes(s []string) *DeviceRequestCreate {
-	drc.mutation.SetScopes(s)
-	return drc
+func (_c *DeviceRequestCreate) SetScopes(v []string) *DeviceRequestCreate {
+	_c.mutation.SetScopes(v)
+	return _c
 }
 
 // SetExpiry sets the "expiry" field.
-func (drc *DeviceRequestCreate) SetExpiry(t time.Time) *DeviceRequestCreate {
-	drc.mutation.SetExpiry(t)
-	return drc
+func (_c *DeviceRequestCreate) SetExpiry(v time.Time) *DeviceRequestCreate {
+	_c.mutation.SetExpiry(v)
+	return _c
 }
 
 // Mutation returns the DeviceRequestMutation object of the builder.
-func (drc *DeviceRequestCreate) Mutation() *DeviceRequestMutation {
-	return drc.mutation
+func (_c *DeviceRequestCreate) Mutation() *DeviceRequestMutation {
+	return _c.mutation
 }
 
 // Save creates the DeviceRequest in the database.
-func (drc *DeviceRequestCreate) Save(ctx context.Context) (*DeviceRequest, error) {
-	var (
-		err  error
-		node *DeviceRequest
-	)
-	if len(drc.hooks) == 0 {
-		if err = drc.check(); err != nil {
-			return nil, err
-		}
-		node, err = drc.sqlSave(ctx)
-	} else {
-		var mut Mutator = MutateFunc(func(ctx context.Context, m Mutation) (Value, error) {
-			mutation, ok := m.(*DeviceRequestMutation)
-			if !ok {
-				return nil, fmt.Errorf("unexpected mutation type %T", m)
-			}
-			if err = drc.check(); err != nil {
-				return nil, err
-			}
-			drc.mutation = mutation
-			if node, err = drc.sqlSave(ctx); err != nil {
-				return nil, err
-			}
-			mutation.id = &node.ID
-			mutation.done = true
-			return node, err
-		})
-		for i := len(drc.hooks) - 1; i >= 0; i-- {
-			if drc.hooks[i] == nil {
-				return nil, fmt.Errorf("db: uninitialized hook (forgotten import db/runtime?)")
-			}
-			mut = drc.hooks[i](mut)
-		}
-		v, err := mut.Mutate(ctx, drc.mutation)
-		if err != nil {
-			return nil, err
-		}
-		nv, ok := v.(*DeviceRequest)
-		if !ok {
-			return nil, fmt.Errorf("unexpected node type %T returned from DeviceRequestMutation", v)
-		}
-		node = nv
-	}
-	return node, err
+func (_c *DeviceRequestCreate) Save(ctx context.Context) (*DeviceRequest, error) {
+	return withHooks(ctx, _c.sqlSave, _c.mutation, _c.hooks)
 }
 
 // SaveX calls Save and panics if Save returns an error.
-func (drc *DeviceRequestCreate) SaveX(ctx context.Context) *DeviceRequest {
-	v, err := drc.Save(ctx)
+func (_c *DeviceRequestCreate) SaveX(ctx context.Context) *DeviceRequest {
+	v, err := _c.Save(ctx)
 	if err != nil {
 		panic(err)
 	}
@@ -118,61 +76,64 @@ func (drc *DeviceRequestCreate) SaveX(ctx context.Context) *DeviceRequest {
 }
 
 // Exec executes the query.
-func (drc *DeviceRequestCreate) Exec(ctx context.Context) error {
-	_, err := drc.Save(ctx)
+func (_c *DeviceRequestCreate) Exec(ctx context.Context) error {
+	_, err := _c.Save(ctx)
 	return err
 }
 
 // ExecX is like Exec, but panics if an error occurs.
-func (drc *DeviceRequestCreate) ExecX(ctx context.Context) {
-	if err := drc.Exec(ctx); err != nil {
+func (_c *DeviceRequestCreate) ExecX(ctx context.Context) {
+	if err := _c.Exec(ctx); err != nil {
 		panic(err)
 	}
 }
 
 // check runs all checks and user-defined validators on the builder.
-func (drc *DeviceRequestCreate) check() error {
-	if _, ok := drc.mutation.UserCode(); !ok {
+func (_c *DeviceRequestCreate) check() error {
+	if _, ok := _c.mutation.UserCode(); !ok {
 		return &ValidationError{Name: "user_code", err: errors.New(`db: missing required field "DeviceRequest.user_code"`)}
 	}
-	if v, ok := drc.mutation.UserCode(); ok {
+	if v, ok := _c.mutation.UserCode(); ok {
 		if err := devicerequest.UserCodeValidator(v); err != nil {
 			return &ValidationError{Name: "user_code", err: fmt.Errorf(`db: validator failed for field "DeviceRequest.user_code": %w`, err)}
 		}
 	}
-	if _, ok := drc.mutation.DeviceCode(); !ok {
+	if _, ok := _c.mutation.DeviceCode(); !ok {
 		return &ValidationError{Name: "device_code", err: errors.New(`db: missing required field "DeviceRequest.device_code"`)}
 	}
-	if v, ok := drc.mutation.DeviceCode(); ok {
+	if v, ok := _c.mutation.DeviceCode(); ok {
 		if err := devicerequest.DeviceCodeValidator(v); err != nil {
 			return &ValidationError{Name: "device_code", err: fmt.Errorf(`db: validator failed for field "DeviceRequest.device_code": %w`, err)}
 		}
 	}
-	if _, ok := drc.mutation.ClientID(); !ok {
+	if _, ok := _c.mutation.ClientID(); !ok {
 		return &ValidationError{Name: "client_id", err: errors.New(`db: missing required field "DeviceRequest.client_id"`)}
 	}
-	if v, ok := drc.mutation.ClientID(); ok {
+	if v, ok := _c.mutation.ClientID(); ok {
 		if err := devicerequest.ClientIDValidator(v); err != nil {
 			return &ValidationError{Name: "client_id", err: fmt.Errorf(`db: validator failed for field "DeviceRequest.client_id": %w`, err)}
 		}
 	}
-	if _, ok := drc.mutation.ClientSecret(); !ok {
+	if _, ok := _c.mutation.ClientSecret(); !ok {
 		return &ValidationError{Name: "client_secret", err: errors.New(`db: missing required field "DeviceRequest.client_secret"`)}
 	}
-	if v, ok := drc.mutation.ClientSecret(); ok {
+	if v, ok := _c.mutation.ClientSecret(); ok {
 		if err := devicerequest.ClientSecretValidator(v); err != nil {
 			return &ValidationError{Name: "client_secret", err: fmt.Errorf(`db: validator failed for field "DeviceRequest.client_secret": %w`, err)}
 		}
 	}
-	if _, ok := drc.mutation.Expiry(); !ok {
+	if _, ok := _c.mutation.Expiry(); !ok {
 		return &ValidationError{Name: "expiry", err: errors.New(`db: missing required field "DeviceRequest.expiry"`)}
 	}
 	return nil
 }
 
-func (drc *DeviceRequestCreate) sqlSave(ctx context.Context) (*DeviceRequest, error) {
-	_node, _spec := drc.createSpec()
-	if err := sqlgraph.CreateNode(ctx, drc.driver, _spec); err != nil {
+func (_c *DeviceRequestCreate) sqlSave(ctx context.Context) (*DeviceRequest, error) {
+	if err := _c.check(); err != nil {
+		return nil, err
+	}
+	_node, _spec := _c.createSpec()
+	if err := sqlgraph.CreateNode(ctx, _c.driver, _spec); err != nil {
 		if sqlgraph.IsConstraintError(err) {
 			err = &ConstraintError{msg: err.Error(), wrap: err}
 		}
@@ -180,66 +141,38 @@ func (drc *DeviceRequestCreate) sqlSave(ctx context.Context) (*DeviceRequest, er
 	}
 	id := _spec.ID.Value.(int64)
 	_node.ID = int(id)
+	_c.mutation.id = &_node.ID
+	_c.mutation.done = true
 	return _node, nil
 }
 
-func (drc *DeviceRequestCreate) createSpec() (*DeviceRequest, *sqlgraph.CreateSpec) {
+func (_c *DeviceRequestCreate) createSpec() (*DeviceRequest, *sqlgraph.CreateSpec) {
 	var (
-		_node = &DeviceRequest{config: drc.config}
-		_spec = &sqlgraph.CreateSpec{
-			Table: devicerequest.Table,
-			ID: &sqlgraph.FieldSpec{
-				Type:   field.TypeInt,
-				Column: devicerequest.FieldID,
-			},
-		}
+		_node = &DeviceRequest{config: _c.config}
+		_spec = sqlgraph.NewCreateSpec(devicerequest.Table, sqlgraph.NewFieldSpec(devicerequest.FieldID, field.TypeInt))
 	)
-	if value, ok := drc.mutation.UserCode(); ok {
-		_spec.Fields = append(_spec.Fields, &sqlgraph.FieldSpec{
-			Type:   field.TypeString,
-			Value:  value,
-			Column: devicerequest.FieldUserCode,
-		})
+	if value, ok := _c.mutation.UserCode(); ok {
+		_spec.SetField(devicerequest.FieldUserCode, field.TypeString, value)
 		_node.UserCode = value
 	}
-	if value, ok := drc.mutation.DeviceCode(); ok {
-		_spec.Fields = append(_spec.Fields, &sqlgraph.FieldSpec{
-			Type:   field.TypeString,
-			Value:  value,
-			Column: devicerequest.FieldDeviceCode,
-		})
+	if value, ok := _c.mutation.DeviceCode(); ok {
+		_spec.SetField(devicerequest.FieldDeviceCode, field.TypeString, value)
 		_node.DeviceCode = value
 	}
-	if value, ok := drc.mutation.ClientID(); ok {
-		_spec.Fields = append(_spec.Fields, &sqlgraph.FieldSpec{
-			Type:   field.TypeString,
-			Value:  value,
-			Column: devicerequest.FieldClientID,
-		})
+	if value, ok := _c.mutation.ClientID(); ok {
+		_spec.SetField(devicerequest.FieldClientID, field.TypeString, value)
 		_node.ClientID = value
 	}
-	if value, ok := drc.mutation.ClientSecret(); ok {
-		_spec.Fields = append(_spec.Fields, &sqlgraph.FieldSpec{
-			Type:   field.TypeString,
-			Value:  value,
-			Column: devicerequest.FieldClientSecret,
-		})
+	if value, ok := _c.mutation.ClientSecret(); ok {
+		_spec.SetField(devicerequest.FieldClientSecret, field.TypeString, value)
 		_node.ClientSecret = value
 	}
-	if value, ok := drc.mutation.Scopes(); ok {
-		_spec.Fields = append(_spec.Fields, &sqlgraph.FieldSpec{
-			Type:   field.TypeJSON,
-			Value:  value,
-			Column: devicerequest.FieldScopes,
-		})
+	if value, ok := _c.mutation.Scopes(); ok {
+		_spec.SetField(devicerequest.FieldScopes, field.TypeJSON, value)
 		_node.Scopes = value
 	}
-	if value, ok := drc.mutation.Expiry(); ok {
-		_spec.Fields = append(_spec.Fields, &sqlgraph.FieldSpec{
-			Type:   field.TypeTime,
-			Value:  value,
-			Column: devicerequest.FieldExpiry,
-		})
+	if value, ok := _c.mutation.Expiry(); ok {
+		_spec.SetField(devicerequest.FieldExpiry, field.TypeTime, value)
 		_node.Expiry = value
 	}
 	return _node, _spec
@@ -248,17 +181,21 @@ func (drc *DeviceRequestCreate) createSpec() (*DeviceRequest, *sqlgraph.CreateSp
 // DeviceRequestCreateBulk is the builder for creating many DeviceRequest entities in bulk.
 type DeviceRequestCreateBulk struct {
 	config
+	err      error
 	builders []*DeviceRequestCreate
 }
 
 // Save creates the DeviceRequest entities in the database.
-func (drcb *DeviceRequestCreateBulk) Save(ctx context.Context) ([]*DeviceRequest, error) {
-	specs := make([]*sqlgraph.CreateSpec, len(drcb.builders))
-	nodes := make([]*DeviceRequest, len(drcb.builders))
-	mutators := make([]Mutator, len(drcb.builders))
-	for i := range drcb.builders {
+func (_c *DeviceRequestCreateBulk) Save(ctx context.Context) ([]*DeviceRequest, error) {
+	if _c.err != nil {
+		return nil, _c.err
+	}
+	specs := make([]*sqlgraph.CreateSpec, len(_c.builders))
+	nodes := make([]*DeviceRequest, len(_c.builders))
+	mutators := make([]Mutator, len(_c.builders))
+	for i := range _c.builders {
 		func(i int, root context.Context) {
-			builder := drcb.builders[i]
+			builder := _c.builders[i]
 			var mut Mutator = MutateFunc(func(ctx context.Context, m Mutation) (Value, error) {
 				mutation, ok := m.(*DeviceRequestMutation)
 				if !ok {
@@ -268,14 +205,14 @@ func (drcb *DeviceRequestCreateBulk) Save(ctx context.Context) ([]*DeviceRequest
 					return nil, err
 				}
 				builder.mutation = mutation
-				nodes[i], specs[i] = builder.createSpec()
 				var err error
+				nodes[i], specs[i] = builder.createSpec()
 				if i < len(mutators)-1 {
-					_, err = mutators[i+1].Mutate(root, drcb.builders[i+1].mutation)
+					_, err = mutators[i+1].Mutate(root, _c.builders[i+1].mutation)
 				} else {
 					spec := &sqlgraph.BatchCreateSpec{Nodes: specs}
 					// Invoke the actual operation on the latest mutation in the chain.
-					if err = sqlgraph.BatchCreate(ctx, drcb.driver, spec); err != nil {
+					if err = sqlgraph.BatchCreate(ctx, _c.driver, spec); err != nil {
 						if sqlgraph.IsConstraintError(err) {
 							err = &ConstraintError{msg: err.Error(), wrap: err}
 						}
@@ -299,7 +236,7 @@ func (drcb *DeviceRequestCreateBulk) Save(ctx context.Context) ([]*DeviceRequest
 		}(i, ctx)
 	}
 	if len(mutators) > 0 {
-		if _, err := mutators[0].Mutate(ctx, drcb.builders[0].mutation); err != nil {
+		if _, err := mutators[0].Mutate(ctx, _c.builders[0].mutation); err != nil {
 			return nil, err
 		}
 	}
@@ -307,8 +244,8 @@ func (drcb *DeviceRequestCreateBulk) Save(ctx context.Context) ([]*DeviceRequest
 }
 
 // SaveX is like Save, but panics if an error occurs.
-func (drcb *DeviceRequestCreateBulk) SaveX(ctx context.Context) []*DeviceRequest {
-	v, err := drcb.Save(ctx)
+func (_c *DeviceRequestCreateBulk) SaveX(ctx context.Context) []*DeviceRequest {
+	v, err := _c.Save(ctx)
 	if err != nil {
 		panic(err)
 	}
@@ -316,14 +253,14 @@ func (drcb *DeviceRequestCreateBulk) SaveX(ctx context.Context) []*DeviceRequest
 }
 
 // Exec executes the query.
-func (drcb *DeviceRequestCreateBulk) Exec(ctx context.Context) error {
-	_, err := drcb.Save(ctx)
+func (_c *DeviceRequestCreateBulk) Exec(ctx context.Context) error {
+	_, err := _c.Save(ctx)
 	return err
 }
 
 // ExecX is like Exec, but panics if an error occurs.
-func (drcb *DeviceRequestCreateBulk) ExecX(ctx context.Context) {
-	if err := drcb.Exec(ctx); err != nil {
+func (_c *DeviceRequestCreateBulk) ExecX(ctx context.Context) {
+	if err := _c.Exec(ctx); err != nil {
 		panic(err)
 	}
 }
diff --git a/storage/ent/db/devicerequest_delete.go b/storage/ent/db/devicerequest_delete.go
index 635a8a498d..97ddacf72e 100644
--- a/storage/ent/db/devicerequest_delete.go
+++ b/storage/ent/db/devicerequest_delete.go
@@ -4,7 +4,6 @@ package db
 
 import (
 	"context"
-	"fmt"
 
 	"entgo.io/ent/dialect/sql"
 	"entgo.io/ent/dialect/sql/sqlgraph"
@@ -21,84 +20,56 @@ type DeviceRequestDelete struct {
 }
 
 // Where appends a list predicates to the DeviceRequestDelete builder.
-func (drd *DeviceRequestDelete) Where(ps ...predicate.DeviceRequest) *DeviceRequestDelete {
-	drd.mutation.Where(ps...)
-	return drd
+func (_d *DeviceRequestDelete) Where(ps ...predicate.DeviceRequest) *DeviceRequestDelete {
+	_d.mutation.Where(ps...)
+	return _d
 }
 
 // Exec executes the deletion query and returns how many vertices were deleted.
-func (drd *DeviceRequestDelete) Exec(ctx context.Context) (int, error) {
-	var (
-		err      error
-		affected int
-	)
-	if len(drd.hooks) == 0 {
-		affected, err = drd.sqlExec(ctx)
-	} else {
-		var mut Mutator = MutateFunc(func(ctx context.Context, m Mutation) (Value, error) {
-			mutation, ok := m.(*DeviceRequestMutation)
-			if !ok {
-				return nil, fmt.Errorf("unexpected mutation type %T", m)
-			}
-			drd.mutation = mutation
-			affected, err = drd.sqlExec(ctx)
-			mutation.done = true
-			return affected, err
-		})
-		for i := len(drd.hooks) - 1; i >= 0; i-- {
-			if drd.hooks[i] == nil {
-				return 0, fmt.Errorf("db: uninitialized hook (forgotten import db/runtime?)")
-			}
-			mut = drd.hooks[i](mut)
-		}
-		if _, err := mut.Mutate(ctx, drd.mutation); err != nil {
-			return 0, err
-		}
-	}
-	return affected, err
+func (_d *DeviceRequestDelete) Exec(ctx context.Context) (int, error) {
+	return withHooks(ctx, _d.sqlExec, _d.mutation, _d.hooks)
 }
 
 // ExecX is like Exec, but panics if an error occurs.
-func (drd *DeviceRequestDelete) ExecX(ctx context.Context) int {
-	n, err := drd.Exec(ctx)
+func (_d *DeviceRequestDelete) ExecX(ctx context.Context) int {
+	n, err := _d.Exec(ctx)
 	if err != nil {
 		panic(err)
 	}
 	return n
 }
 
-func (drd *DeviceRequestDelete) sqlExec(ctx context.Context) (int, error) {
-	_spec := &sqlgraph.DeleteSpec{
-		Node: &sqlgraph.NodeSpec{
-			Table: devicerequest.Table,
-			ID: &sqlgraph.FieldSpec{
-				Type:   field.TypeInt,
-				Column: devicerequest.FieldID,
-			},
-		},
-	}
-	if ps := drd.mutation.predicates; len(ps) > 0 {
+func (_d *DeviceRequestDelete) sqlExec(ctx context.Context) (int, error) {
+	_spec := sqlgraph.NewDeleteSpec(devicerequest.Table, sqlgraph.NewFieldSpec(devicerequest.FieldID, field.TypeInt))
+	if ps := _d.mutation.predicates; len(ps) > 0 {
 		_spec.Predicate = func(selector *sql.Selector) {
 			for i := range ps {
 				ps[i](selector)
 			}
 		}
 	}
-	affected, err := sqlgraph.DeleteNodes(ctx, drd.driver, _spec)
+	affected, err := sqlgraph.DeleteNodes(ctx, _d.driver, _spec)
 	if err != nil && sqlgraph.IsConstraintError(err) {
 		err = &ConstraintError{msg: err.Error(), wrap: err}
 	}
+	_d.mutation.done = true
 	return affected, err
 }
 
 // DeviceRequestDeleteOne is the builder for deleting a single DeviceRequest entity.
 type DeviceRequestDeleteOne struct {
-	drd *DeviceRequestDelete
+	_d *DeviceRequestDelete
+}
+
+// Where appends a list predicates to the DeviceRequestDelete builder.
+func (_d *DeviceRequestDeleteOne) Where(ps ...predicate.DeviceRequest) *DeviceRequestDeleteOne {
+	_d._d.mutation.Where(ps...)
+	return _d
 }
 
 // Exec executes the deletion query.
-func (drdo *DeviceRequestDeleteOne) Exec(ctx context.Context) error {
-	n, err := drdo.drd.Exec(ctx)
+func (_d *DeviceRequestDeleteOne) Exec(ctx context.Context) error {
+	n, err := _d._d.Exec(ctx)
 	switch {
 	case err != nil:
 		return err
@@ -110,6 +81,8 @@ func (drdo *DeviceRequestDeleteOne) Exec(ctx context.Context) error {
 }
 
 // ExecX is like Exec, but panics if an error occurs.
-func (drdo *DeviceRequestDeleteOne) ExecX(ctx context.Context) {
-	drdo.drd.ExecX(ctx)
+func (_d *DeviceRequestDeleteOne) ExecX(ctx context.Context) {
+	if err := _d.Exec(ctx); err != nil {
+		panic(err)
+	}
 }
diff --git a/storage/ent/db/devicerequest_query.go b/storage/ent/db/devicerequest_query.go
index 3fd43dd89d..93093d2a1c 100644
--- a/storage/ent/db/devicerequest_query.go
+++ b/storage/ent/db/devicerequest_query.go
@@ -7,6 +7,7 @@ import (
 	"fmt"
 	"math"
 
+	"entgo.io/ent"
 	"entgo.io/ent/dialect/sql"
 	"entgo.io/ent/dialect/sql/sqlgraph"
 	"entgo.io/ent/schema/field"
@@ -17,11 +18,9 @@ import (
 // DeviceRequestQuery is the builder for querying DeviceRequest entities.
 type DeviceRequestQuery struct {
 	config
-	limit      *int
-	offset     *int
-	unique     *bool
-	order      []OrderFunc
-	fields     []string
+	ctx        *QueryContext
+	order      []devicerequest.OrderOption
+	inters     []Interceptor
 	predicates []predicate.DeviceRequest
 	// intermediate query (i.e. traversal path).
 	sql  *sql.Selector
@@ -29,40 +28,40 @@ type DeviceRequestQuery struct {
 }
 
 // Where adds a new predicate for the DeviceRequestQuery builder.
-func (drq *DeviceRequestQuery) Where(ps ...predicate.DeviceRequest) *DeviceRequestQuery {
-	drq.predicates = append(drq.predicates, ps...)
-	return drq
+func (_q *DeviceRequestQuery) Where(ps ...predicate.DeviceRequest) *DeviceRequestQuery {
+	_q.predicates = append(_q.predicates, ps...)
+	return _q
 }
 
-// Limit adds a limit step to the query.
-func (drq *DeviceRequestQuery) Limit(limit int) *DeviceRequestQuery {
-	drq.limit = &limit
-	return drq
+// Limit the number of records to be returned by this query.
+func (_q *DeviceRequestQuery) Limit(limit int) *DeviceRequestQuery {
+	_q.ctx.Limit = &limit
+	return _q
 }
 
-// Offset adds an offset step to the query.
-func (drq *DeviceRequestQuery) Offset(offset int) *DeviceRequestQuery {
-	drq.offset = &offset
-	return drq
+// Offset to start from.
+func (_q *DeviceRequestQuery) Offset(offset int) *DeviceRequestQuery {
+	_q.ctx.Offset = &offset
+	return _q
 }
 
 // Unique configures the query builder to filter duplicate records on query.
 // By default, unique is set to true, and can be disabled using this method.
-func (drq *DeviceRequestQuery) Unique(unique bool) *DeviceRequestQuery {
-	drq.unique = &unique
-	return drq
+func (_q *DeviceRequestQuery) Unique(unique bool) *DeviceRequestQuery {
+	_q.ctx.Unique = &unique
+	return _q
 }
 
-// Order adds an order step to the query.
-func (drq *DeviceRequestQuery) Order(o ...OrderFunc) *DeviceRequestQuery {
-	drq.order = append(drq.order, o...)
-	return drq
+// Order specifies how the records should be ordered.
+func (_q *DeviceRequestQuery) Order(o ...devicerequest.OrderOption) *DeviceRequestQuery {
+	_q.order = append(_q.order, o...)
+	return _q
 }
 
 // First returns the first DeviceRequest entity from the query.
 // Returns a *NotFoundError when no DeviceRequest was found.
-func (drq *DeviceRequestQuery) First(ctx context.Context) (*DeviceRequest, error) {
-	nodes, err := drq.Limit(1).All(ctx)
+func (_q *DeviceRequestQuery) First(ctx context.Context) (*DeviceRequest, error) {
+	nodes, err := _q.Limit(1).All(setContextOp(ctx, _q.ctx, ent.OpQueryFirst))
 	if err != nil {
 		return nil, err
 	}
@@ -73,8 +72,8 @@ func (drq *DeviceRequestQuery) First(ctx context.Context) (*DeviceRequest, error
 }
 
 // FirstX is like First, but panics if an error occurs.
-func (drq *DeviceRequestQuery) FirstX(ctx context.Context) *DeviceRequest {
-	node, err := drq.First(ctx)
+func (_q *DeviceRequestQuery) FirstX(ctx context.Context) *DeviceRequest {
+	node, err := _q.First(ctx)
 	if err != nil && !IsNotFound(err) {
 		panic(err)
 	}
@@ -83,9 +82,9 @@ func (drq *DeviceRequestQuery) FirstX(ctx context.Context) *DeviceRequest {
 
 // FirstID returns the first DeviceRequest ID from the query.
 // Returns a *NotFoundError when no DeviceRequest ID was found.
-func (drq *DeviceRequestQuery) FirstID(ctx context.Context) (id int, err error) {
+func (_q *DeviceRequestQuery) FirstID(ctx context.Context) (id int, err error) {
 	var ids []int
-	if ids, err = drq.Limit(1).IDs(ctx); err != nil {
+	if ids, err = _q.Limit(1).IDs(setContextOp(ctx, _q.ctx, ent.OpQueryFirstID)); err != nil {
 		return
 	}
 	if len(ids) == 0 {
@@ -96,8 +95,8 @@ func (drq *DeviceRequestQuery) FirstID(ctx context.Context) (id int, err error)
 }
 
 // FirstIDX is like FirstID, but panics if an error occurs.
-func (drq *DeviceRequestQuery) FirstIDX(ctx context.Context) int {
-	id, err := drq.FirstID(ctx)
+func (_q *DeviceRequestQuery) FirstIDX(ctx context.Context) int {
+	id, err := _q.FirstID(ctx)
 	if err != nil && !IsNotFound(err) {
 		panic(err)
 	}
@@ -107,8 +106,8 @@ func (drq *DeviceRequestQuery) FirstIDX(ctx context.Context) int {
 // Only returns a single DeviceRequest entity found by the query, ensuring it only returns one.
 // Returns a *NotSingularError when more than one DeviceRequest entity is found.
 // Returns a *NotFoundError when no DeviceRequest entities are found.
-func (drq *DeviceRequestQuery) Only(ctx context.Context) (*DeviceRequest, error) {
-	nodes, err := drq.Limit(2).All(ctx)
+func (_q *DeviceRequestQuery) Only(ctx context.Context) (*DeviceRequest, error) {
+	nodes, err := _q.Limit(2).All(setContextOp(ctx, _q.ctx, ent.OpQueryOnly))
 	if err != nil {
 		return nil, err
 	}
@@ -123,8 +122,8 @@ func (drq *DeviceRequestQuery) Only(ctx context.Context) (*DeviceRequest, error)
 }
 
 // OnlyX is like Only, but panics if an error occurs.
-func (drq *DeviceRequestQuery) OnlyX(ctx context.Context) *DeviceRequest {
-	node, err := drq.Only(ctx)
+func (_q *DeviceRequestQuery) OnlyX(ctx context.Context) *DeviceRequest {
+	node, err := _q.Only(ctx)
 	if err != nil {
 		panic(err)
 	}
@@ -134,9 +133,9 @@ func (drq *DeviceRequestQuery) OnlyX(ctx context.Context) *DeviceRequest {
 // OnlyID is like Only, but returns the only DeviceRequest ID in the query.
 // Returns a *NotSingularError when more than one DeviceRequest ID is found.
 // Returns a *NotFoundError when no entities are found.
-func (drq *DeviceRequestQuery) OnlyID(ctx context.Context) (id int, err error) {
+func (_q *DeviceRequestQuery) OnlyID(ctx context.Context) (id int, err error) {
 	var ids []int
-	if ids, err = drq.Limit(2).IDs(ctx); err != nil {
+	if ids, err = _q.Limit(2).IDs(setContextOp(ctx, _q.ctx, ent.OpQueryOnlyID)); err != nil {
 		return
 	}
 	switch len(ids) {
@@ -151,8 +150,8 @@ func (drq *DeviceRequestQuery) OnlyID(ctx context.Context) (id int, err error) {
 }
 
 // OnlyIDX is like OnlyID, but panics if an error occurs.
-func (drq *DeviceRequestQuery) OnlyIDX(ctx context.Context) int {
-	id, err := drq.OnlyID(ctx)
+func (_q *DeviceRequestQuery) OnlyIDX(ctx context.Context) int {
+	id, err := _q.OnlyID(ctx)
 	if err != nil {
 		panic(err)
 	}
@@ -160,16 +159,18 @@ func (drq *DeviceRequestQuery) OnlyIDX(ctx context.Context) int {
 }
 
 // All executes the query and returns a list of DeviceRequests.
-func (drq *DeviceRequestQuery) All(ctx context.Context) ([]*DeviceRequest, error) {
-	if err := drq.prepareQuery(ctx); err != nil {
+func (_q *DeviceRequestQuery) All(ctx context.Context) ([]*DeviceRequest, error) {
+	ctx = setContextOp(ctx, _q.ctx, ent.OpQueryAll)
+	if err := _q.prepareQuery(ctx); err != nil {
 		return nil, err
 	}
-	return drq.sqlAll(ctx)
+	qr := querierAll[[]*DeviceRequest, *DeviceRequestQuery]()
+	return withInterceptors[[]*DeviceRequest](ctx, _q, qr, _q.inters)
 }
 
 // AllX is like All, but panics if an error occurs.
-func (drq *DeviceRequestQuery) AllX(ctx context.Context) []*DeviceRequest {
-	nodes, err := drq.All(ctx)
+func (_q *DeviceRequestQuery) AllX(ctx context.Context) []*DeviceRequest {
+	nodes, err := _q.All(ctx)
 	if err != nil {
 		panic(err)
 	}
@@ -177,17 +178,20 @@ func (drq *DeviceRequestQuery) AllX(ctx context.Context) []*DeviceRequest {
 }
 
 // IDs executes the query and returns a list of DeviceRequest IDs.
-func (drq *DeviceRequestQuery) IDs(ctx context.Context) ([]int, error) {
-	var ids []int
-	if err := drq.Select(devicerequest.FieldID).Scan(ctx, &ids); err != nil {
+func (_q *DeviceRequestQuery) IDs(ctx context.Context) (ids []int, err error) {
+	if _q.ctx.Unique == nil && _q.path != nil {
+		_q.Unique(true)
+	}
+	ctx = setContextOp(ctx, _q.ctx, ent.OpQueryIDs)
+	if err = _q.Select(devicerequest.FieldID).Scan(ctx, &ids); err != nil {
 		return nil, err
 	}
 	return ids, nil
 }
 
 // IDsX is like IDs, but panics if an error occurs.
-func (drq *DeviceRequestQuery) IDsX(ctx context.Context) []int {
-	ids, err := drq.IDs(ctx)
+func (_q *DeviceRequestQuery) IDsX(ctx context.Context) []int {
+	ids, err := _q.IDs(ctx)
 	if err != nil {
 		panic(err)
 	}
@@ -195,16 +199,17 @@ func (drq *DeviceRequestQuery) IDsX(ctx context.Context) []int {
 }
 
 // Count returns the count of the given query.
-func (drq *DeviceRequestQuery) Count(ctx context.Context) (int, error) {
-	if err := drq.prepareQuery(ctx); err != nil {
+func (_q *DeviceRequestQuery) Count(ctx context.Context) (int, error) {
+	ctx = setContextOp(ctx, _q.ctx, ent.OpQueryCount)
+	if err := _q.prepareQuery(ctx); err != nil {
 		return 0, err
 	}
-	return drq.sqlCount(ctx)
+	return withInterceptors[int](ctx, _q, querierCount[*DeviceRequestQuery](), _q.inters)
 }
 
 // CountX is like Count, but panics if an error occurs.
-func (drq *DeviceRequestQuery) CountX(ctx context.Context) int {
-	count, err := drq.Count(ctx)
+func (_q *DeviceRequestQuery) CountX(ctx context.Context) int {
+	count, err := _q.Count(ctx)
 	if err != nil {
 		panic(err)
 	}
@@ -212,16 +217,21 @@ func (drq *DeviceRequestQuery) CountX(ctx context.Context) int {
 }
 
 // Exist returns true if the query has elements in the graph.
-func (drq *DeviceRequestQuery) Exist(ctx context.Context) (bool, error) {
-	if err := drq.prepareQuery(ctx); err != nil {
-		return false, err
+func (_q *DeviceRequestQuery) Exist(ctx context.Context) (bool, error) {
+	ctx = setContextOp(ctx, _q.ctx, ent.OpQueryExist)
+	switch _, err := _q.FirstID(ctx); {
+	case IsNotFound(err):
+		return false, nil
+	case err != nil:
+		return false, fmt.Errorf("db: check existence: %w", err)
+	default:
+		return true, nil
 	}
-	return drq.sqlExist(ctx)
 }
 
 // ExistX is like Exist, but panics if an error occurs.
-func (drq *DeviceRequestQuery) ExistX(ctx context.Context) bool {
-	exist, err := drq.Exist(ctx)
+func (_q *DeviceRequestQuery) ExistX(ctx context.Context) bool {
+	exist, err := _q.Exist(ctx)
 	if err != nil {
 		panic(err)
 	}
@@ -230,20 +240,19 @@ func (drq *DeviceRequestQuery) ExistX(ctx context.Context) bool {
 
 // Clone returns a duplicate of the DeviceRequestQuery builder, including all associated steps. It can be
 // used to prepare common query builders and use them differently after the clone is made.
-func (drq *DeviceRequestQuery) Clone() *DeviceRequestQuery {
-	if drq == nil {
+func (_q *DeviceRequestQuery) Clone() *DeviceRequestQuery {
+	if _q == nil {
 		return nil
 	}
 	return &DeviceRequestQuery{
-		config:     drq.config,
-		limit:      drq.limit,
-		offset:     drq.offset,
-		order:      append([]OrderFunc{}, drq.order...),
-		predicates: append([]predicate.DeviceRequest{}, drq.predicates...),
+		config:     _q.config,
+		ctx:        _q.ctx.Clone(),
+		order:      append([]devicerequest.OrderOption{}, _q.order...),
+		inters:     append([]Interceptor{}, _q.inters...),
+		predicates: append([]predicate.DeviceRequest{}, _q.predicates...),
 		// clone intermediate query.
-		sql:    drq.sql.Clone(),
-		path:   drq.path,
-		unique: drq.unique,
+		sql:  _q.sql.Clone(),
+		path: _q.path,
 	}
 }
 
@@ -261,18 +270,12 @@ func (drq *DeviceRequestQuery) Clone() *DeviceRequestQuery {
 //		GroupBy(devicerequest.FieldUserCode).
 //		Aggregate(db.Count()).
 //		Scan(ctx, &v)
-//
-func (drq *DeviceRequestQuery) GroupBy(field string, fields ...string) *DeviceRequestGroupBy {
-	grbuild := &DeviceRequestGroupBy{config: drq.config}
-	grbuild.fields = append([]string{field}, fields...)
-	grbuild.path = func(ctx context.Context) (prev *sql.Selector, err error) {
-		if err := drq.prepareQuery(ctx); err != nil {
-			return nil, err
-		}
-		return drq.sqlQuery(ctx), nil
-	}
+func (_q *DeviceRequestQuery) GroupBy(field string, fields ...string) *DeviceRequestGroupBy {
+	_q.ctx.Fields = append([]string{field}, fields...)
+	grbuild := &DeviceRequestGroupBy{build: _q}
+	grbuild.flds = &_q.ctx.Fields
 	grbuild.label = devicerequest.Label
-	grbuild.flds, grbuild.scan = &grbuild.fields, grbuild.Scan
+	grbuild.scan = grbuild.Scan
 	return grbuild
 }
 
@@ -288,48 +291,62 @@ func (drq *DeviceRequestQuery) GroupBy(field string, fields ...string) *DeviceRe
 //	client.DeviceRequest.Query().
 //		Select(devicerequest.FieldUserCode).
 //		Scan(ctx, &v)
-//
-func (drq *DeviceRequestQuery) Select(fields ...string) *DeviceRequestSelect {
-	drq.fields = append(drq.fields, fields...)
-	selbuild := &DeviceRequestSelect{DeviceRequestQuery: drq}
-	selbuild.label = devicerequest.Label
-	selbuild.flds, selbuild.scan = &drq.fields, selbuild.Scan
-	return selbuild
+func (_q *DeviceRequestQuery) Select(fields ...string) *DeviceRequestSelect {
+	_q.ctx.Fields = append(_q.ctx.Fields, fields...)
+	sbuild := &DeviceRequestSelect{DeviceRequestQuery: _q}
+	sbuild.label = devicerequest.Label
+	sbuild.flds, sbuild.scan = &_q.ctx.Fields, sbuild.Scan
+	return sbuild
+}
+
+// Aggregate returns a DeviceRequestSelect configured with the given aggregations.
+func (_q *DeviceRequestQuery) Aggregate(fns ...AggregateFunc) *DeviceRequestSelect {
+	return _q.Select().Aggregate(fns...)
 }
 
-func (drq *DeviceRequestQuery) prepareQuery(ctx context.Context) error {
-	for _, f := range drq.fields {
+func (_q *DeviceRequestQuery) prepareQuery(ctx context.Context) error {
+	for _, inter := range _q.inters {
+		if inter == nil {
+			return fmt.Errorf("db: uninitialized interceptor (forgotten import db/runtime?)")
+		}
+		if trv, ok := inter.(Traverser); ok {
+			if err := trv.Traverse(ctx, _q); err != nil {
+				return err
+			}
+		}
+	}
+	for _, f := range _q.ctx.Fields {
 		if !devicerequest.ValidColumn(f) {
 			return &ValidationError{Name: f, err: fmt.Errorf("db: invalid field %q for query", f)}
 		}
 	}
-	if drq.path != nil {
-		prev, err := drq.path(ctx)
+	if _q.path != nil {
+		prev, err := _q.path(ctx)
 		if err != nil {
 			return err
 		}
-		drq.sql = prev
+		_q.sql = prev
 	}
 	return nil
 }
 
-func (drq *DeviceRequestQuery) sqlAll(ctx context.Context, hooks ...queryHook) ([]*DeviceRequest, error) {
+func (_q *DeviceRequestQuery) sqlAll(ctx context.Context, hooks ...queryHook) ([]*DeviceRequest, error) {
 	var (
 		nodes = []*DeviceRequest{}
-		_spec = drq.querySpec()
+		_spec = _q.querySpec()
 	)
-	_spec.ScanValues = func(columns []string) ([]interface{}, error) {
+	_spec.ScanValues = func(columns []string) ([]any, error) {
 		return (*DeviceRequest).scanValues(nil, columns)
 	}
-	_spec.Assign = func(columns []string, values []interface{}) error {
-		node := &DeviceRequest{config: drq.config}
+	_spec.Assign = func(columns []string, values []any) error {
+		node := &DeviceRequest{config: _q.config}
 		nodes = append(nodes, node)
 		return node.assignValues(columns, values)
 	}
 	for i := range hooks {
 		hooks[i](ctx, _spec)
 	}
-	if err := sqlgraph.QueryNodes(ctx, drq.driver, _spec); err != nil {
+	if err := sqlgraph.QueryNodes(ctx, _q.driver, _spec); err != nil {
 		return nil, err
 	}
 	if len(nodes) == 0 {
@@ -338,40 +355,24 @@ func (drq *DeviceRequestQuery) sqlAll(ctx context.Context, hooks ...queryHook) (
 	return nodes, nil
 }
 
-func (drq *DeviceRequestQuery) sqlCount(ctx context.Context) (int, error) {
-	_spec := drq.querySpec()
-	_spec.Node.Columns = drq.fields
-	if len(drq.fields) > 0 {
-		_spec.Unique = drq.unique != nil && *drq.unique
-	}
-	return sqlgraph.CountNodes(ctx, drq.driver, _spec)
-}
-
-func (drq *DeviceRequestQuery) sqlExist(ctx context.Context) (bool, error) {
-	n, err := drq.sqlCount(ctx)
-	if err != nil {
-		return false, fmt.Errorf("db: check existence: %w", err)
+func (_q *DeviceRequestQuery) sqlCount(ctx context.Context) (int, error) {
+	_spec := _q.querySpec()
+	_spec.Node.Columns = _q.ctx.Fields
+	if len(_q.ctx.Fields) > 0 {
+		_spec.Unique = _q.ctx.Unique != nil && *_q.ctx.Unique
 	}
-	return n > 0, nil
+	return sqlgraph.CountNodes(ctx, _q.driver, _spec)
 }
 
-func (drq *DeviceRequestQuery) querySpec() *sqlgraph.QuerySpec {
-	_spec := &sqlgraph.QuerySpec{
-		Node: &sqlgraph.NodeSpec{
-			Table:   devicerequest.Table,
-			Columns: devicerequest.Columns,
-			ID: &sqlgraph.FieldSpec{
-				Type:   field.TypeInt,
-				Column: devicerequest.FieldID,
-			},
-		},
-		From:   drq.sql,
-		Unique: true,
-	}
-	if unique := drq.unique; unique != nil {
+func (_q *DeviceRequestQuery) querySpec() *sqlgraph.QuerySpec {
+	_spec := sqlgraph.NewQuerySpec(devicerequest.Table, devicerequest.Columns, sqlgraph.NewFieldSpec(devicerequest.FieldID, field.TypeInt))
+	_spec.From = _q.sql
+	if unique := _q.ctx.Unique; unique != nil {
 		_spec.Unique = *unique
+	} else if _q.path != nil {
+		_spec.Unique = true
 	}
-	if fields := drq.fields; len(fields) > 0 {
+	if fields := _q.ctx.Fields; len(fields) > 0 {
 		_spec.Node.Columns = make([]string, 0, len(fields))
 		_spec.Node.Columns = append(_spec.Node.Columns, devicerequest.FieldID)
 		for i := range fields {
@@ -380,20 +381,20 @@ func (drq *DeviceRequestQuery) querySpec() *sqlgraph.QuerySpec {
 			}
 		}
 	}
-	if ps := drq.predicates; len(ps) > 0 {
+	if ps := _q.predicates; len(ps) > 0 {
 		_spec.Predicate = func(selector *sql.Selector) {
 			for i := range ps {
 				ps[i](selector)
 			}
 		}
 	}
-	if limit := drq.limit; limit != nil {
+	if limit := _q.ctx.Limit; limit != nil {
 		_spec.Limit = *limit
 	}
-	if offset := drq.offset; offset != nil {
+	if offset := _q.ctx.Offset; offset != nil {
 		_spec.Offset = *offset
 	}
-	if ps := drq.order; len(ps) > 0 {
+	if ps := _q.order; len(ps) > 0 {
 		_spec.Order = func(selector *sql.Selector) {
 			for i := range ps {
 				ps[i](selector)
@@ -403,33 +404,33 @@ func (drq *DeviceRequestQuery) querySpec() *sqlgraph.QuerySpec {
 	return _spec
 }
 
-func (drq *DeviceRequestQuery) sqlQuery(ctx context.Context) *sql.Selector {
-	builder := sql.Dialect(drq.driver.Dialect())
+func (_q *DeviceRequestQuery) sqlQuery(ctx context.Context) *sql.Selector {
+	builder := sql.Dialect(_q.driver.Dialect())
 	t1 := builder.Table(devicerequest.Table)
-	columns := drq.fields
+	columns := _q.ctx.Fields
 	if len(columns) == 0 {
 		columns = devicerequest.Columns
 	}
 	selector := builder.Select(t1.Columns(columns...)...).From(t1)
-	if drq.sql != nil {
-		selector = drq.sql
+	if _q.sql != nil {
+		selector = _q.sql
 		selector.Select(selector.Columns(columns...)...)
 	}
-	if drq.unique != nil && *drq.unique {
+	if _q.ctx.Unique != nil && *_q.ctx.Unique {
 		selector.Distinct()
 	}
-	for _, p := range drq.predicates {
+	for _, p := range _q.predicates {
 		p(selector)
 	}
-	for _, p := range drq.order {
+	for _, p := range _q.order {
 		p(selector)
 	}
-	if offset := drq.offset; offset != nil {
+	if offset := _q.ctx.Offset; offset != nil {
 		// limit is mandatory for offset clause. We start
 		// with default value, and override it below if needed.
 		selector.Offset(*offset).Limit(math.MaxInt32)
 	}
-	if limit := drq.limit; limit != nil {
+	if limit := _q.ctx.Limit; limit != nil {
 		selector.Limit(*limit)
 	}
 	return selector
@@ -437,90 +438,88 @@ func (drq *DeviceRequestQuery) sqlQuery(ctx context.Context) *sql.Selector {
 
 // DeviceRequestGroupBy is the group-by builder for DeviceRequest entities.
 type DeviceRequestGroupBy struct {
-	config
 	selector
-	fields []string
-	fns    []AggregateFunc
-	// intermediate query (i.e. traversal path).
-	sql  *sql.Selector
-	path func(context.Context) (*sql.Selector, error)
+	build *DeviceRequestQuery
 }
 
 // Aggregate adds the given aggregation functions to the group-by query.
-func (drgb *DeviceRequestGroupBy) Aggregate(fns ...AggregateFunc) *DeviceRequestGroupBy {
-	drgb.fns = append(drgb.fns, fns...)
-	return drgb
+func (_g *DeviceRequestGroupBy) Aggregate(fns ...AggregateFunc) *DeviceRequestGroupBy {
+	_g.fns = append(_g.fns, fns...)
+	return _g
 }
 
-// Scan applies the group-by query and scans the result into the given value.
-func (drgb *DeviceRequestGroupBy) Scan(ctx context.Context, v interface{}) error {
-	query, err := drgb.path(ctx)
-	if err != nil {
+// Scan applies the selector query and scans the result into the given value.
+func (_g *DeviceRequestGroupBy) Scan(ctx context.Context, v any) error {
+	ctx = setContextOp(ctx, _g.build.ctx, ent.OpQueryGroupBy)
+	if err := _g.build.prepareQuery(ctx); err != nil {
 		return err
 	}
-	drgb.sql = query
-	return drgb.sqlScan(ctx, v)
+	return scanWithInterceptors[*DeviceRequestQuery, *DeviceRequestGroupBy](ctx, _g.build, _g, _g.build.inters, v)
 }
 
-func (drgb *DeviceRequestGroupBy) sqlScan(ctx context.Context, v interface{}) error {
-	for _, f := range drgb.fields {
-		if !devicerequest.ValidColumn(f) {
-			return &ValidationError{Name: f, err: fmt.Errorf("invalid field %q for group-by", f)}
+func (_g *DeviceRequestGroupBy) sqlScan(ctx context.Context, root *DeviceRequestQuery, v any) error {
+	selector := root.sqlQuery(ctx).Select()
+	aggregation := make([]string, 0, len(_g.fns))
+	for _, fn := range _g.fns {
+		aggregation = append(aggregation, fn(selector))
+	}
+	if len(selector.SelectedColumns()) == 0 {
+		columns := make([]string, 0, len(*_g.flds)+len(_g.fns))
+		for _, f := range *_g.flds {
+			columns = append(columns, selector.C(f))
 		}
+		columns = append(columns, aggregation...)
+		selector.Select(columns...)
 	}
-	selector := drgb.sqlQuery()
+	selector.GroupBy(selector.Columns(*_g.flds...)...)
 	if err := selector.Err(); err != nil {
 		return err
 	}
 	rows := &sql.Rows{}
 	query, args := selector.Query()
-	if err := drgb.driver.Query(ctx, query, args, rows); err != nil {
+	if err := _g.build.driver.Query(ctx, query, args, rows); err != nil {
 		return err
 	}
 	defer rows.Close()
 	return sql.ScanSlice(rows, v)
 }
 
-func (drgb *DeviceRequestGroupBy) sqlQuery() *sql.Selector {
-	selector := drgb.sql.Select()
-	aggregation := make([]string, 0, len(drgb.fns))
-	for _, fn := range drgb.fns {
-		aggregation = append(aggregation, fn(selector))
-	}
-	// If no columns were selected in a custom aggregation function, the default
-	// selection is the fields used for "group-by", and the aggregation functions.
-	if len(selector.SelectedColumns()) == 0 {
-		columns := make([]string, 0, len(drgb.fields)+len(drgb.fns))
-		for _, f := range drgb.fields {
-			columns = append(columns, selector.C(f))
-		}
-		columns = append(columns, aggregation...)
-		selector.Select(columns...)
-	}
-	return selector.GroupBy(selector.Columns(drgb.fields...)...)
-}
-
 // DeviceRequestSelect is the builder for selecting fields of DeviceRequest entities.
 type DeviceRequestSelect struct {
 	*DeviceRequestQuery
 	selector
-	// intermediate query (i.e. traversal path).
-	sql *sql.Selector
+}
+
+// Aggregate adds the given aggregation functions to the selector query.
+func (_s *DeviceRequestSelect) Aggregate(fns ...AggregateFunc) *DeviceRequestSelect {
+	_s.fns = append(_s.fns, fns...)
+	return _s
 }
 
 // Scan applies the selector query and scans the result into the given value.
-func (drs *DeviceRequestSelect) Scan(ctx context.Context, v interface{}) error {
-	if err := drs.prepareQuery(ctx); err != nil {
+func (_s *DeviceRequestSelect) Scan(ctx context.Context, v any) error {
+	ctx = setContextOp(ctx, _s.ctx, ent.OpQuerySelect)
+	if err := _s.prepareQuery(ctx); err != nil {
 		return err
 	}
-	drs.sql = drs.DeviceRequestQuery.sqlQuery(ctx)
-	return drs.sqlScan(ctx, v)
+	return scanWithInterceptors[*DeviceRequestQuery, *DeviceRequestSelect](ctx, _s.DeviceRequestQuery, _s, _s.inters, v)
 }
 
-func (drs *DeviceRequestSelect) sqlScan(ctx context.Context, v interface{}) error {
+func (_s *DeviceRequestSelect) sqlScan(ctx context.Context, root *DeviceRequestQuery, v any) error {
+	selector := root.sqlQuery(ctx)
+	aggregation := make([]string, 0, len(_s.fns))
+	for _, fn := range _s.fns {
+		aggregation = append(aggregation, fn(selector))
+	}
+	switch n := len(*_s.selector.flds); {
+	case n == 0 && len(aggregation) > 0:
+		selector.Select(aggregation...)
+	case n != 0 && len(aggregation) > 0:
+		selector.AppendSelect(aggregation...)
+	}
 	rows := &sql.Rows{}
-	query, args := drs.sql.Query()
-	if err := drs.driver.Query(ctx, query, args, rows); err != nil {
+	query, args := selector.Query()
+	if err := _s.driver.Query(ctx, query, args, rows); err != nil {
 		return err
 	}
 	defer rows.Close()
diff --git a/storage/ent/db/devicerequest_update.go b/storage/ent/db/devicerequest_update.go
index 2bf38af697..9447f4e532 100644
--- a/storage/ent/db/devicerequest_update.go
+++ b/storage/ent/db/devicerequest_update.go
@@ -10,6 +10,7 @@ import (
 
 	"entgo.io/ent/dialect/sql"
 	"entgo.io/ent/dialect/sql/sqlgraph"
+	"entgo.io/ent/dialect/sql/sqljson"
 	"entgo.io/ent/schema/field"
 	"github.com/dexidp/dex/storage/ent/db/devicerequest"
 	"github.com/dexidp/dex/storage/ent/db/predicate"
@@ -23,99 +24,112 @@ type DeviceRequestUpdate struct {
 }
 
 // Where appends a list predicates to the DeviceRequestUpdate builder.
-func (dru *DeviceRequestUpdate) Where(ps ...predicate.DeviceRequest) *DeviceRequestUpdate {
-	dru.mutation.Where(ps...)
-	return dru
+func (_u *DeviceRequestUpdate) Where(ps ...predicate.DeviceRequest) *DeviceRequestUpdate {
+	_u.mutation.Where(ps...)
+	return _u
 }
 
 // SetUserCode sets the "user_code" field.
-func (dru *DeviceRequestUpdate) SetUserCode(s string) *DeviceRequestUpdate {
-	dru.mutation.SetUserCode(s)
-	return dru
+func (_u *DeviceRequestUpdate) SetUserCode(v string) *DeviceRequestUpdate {
+	_u.mutation.SetUserCode(v)
+	return _u
+}
+
+// SetNillableUserCode sets the "user_code" field if the given value is not nil.
+func (_u *DeviceRequestUpdate) SetNillableUserCode(v *string) *DeviceRequestUpdate {
+	if v != nil {
+		_u.SetUserCode(*v)
+	}
+	return _u
 }
 
 // SetDeviceCode sets the "device_code" field.
-func (dru *DeviceRequestUpdate) SetDeviceCode(s string) *DeviceRequestUpdate {
-	dru.mutation.SetDeviceCode(s)
-	return dru
+func (_u *DeviceRequestUpdate) SetDeviceCode(v string) *DeviceRequestUpdate {
+	_u.mutation.SetDeviceCode(v)
+	return _u
+}
+
+// SetNillableDeviceCode sets the "device_code" field if the given value is not nil.
+func (_u *DeviceRequestUpdate) SetNillableDeviceCode(v *string) *DeviceRequestUpdate {
+	if v != nil {
+		_u.SetDeviceCode(*v)
+	}
+	return _u
 }
 
 // SetClientID sets the "client_id" field.
-func (dru *DeviceRequestUpdate) SetClientID(s string) *DeviceRequestUpdate {
-	dru.mutation.SetClientID(s)
-	return dru
+func (_u *DeviceRequestUpdate) SetClientID(v string) *DeviceRequestUpdate {
+	_u.mutation.SetClientID(v)
+	return _u
+}
+
+// SetNillableClientID sets the "client_id" field if the given value is not nil.
+func (_u *DeviceRequestUpdate) SetNillableClientID(v *string) *DeviceRequestUpdate {
+	if v != nil {
+		_u.SetClientID(*v)
+	}
+	return _u
 }
 
 // SetClientSecret sets the "client_secret" field.
-func (dru *DeviceRequestUpdate) SetClientSecret(s string) *DeviceRequestUpdate {
-	dru.mutation.SetClientSecret(s)
-	return dru
+func (_u *DeviceRequestUpdate) SetClientSecret(v string) *DeviceRequestUpdate {
+	_u.mutation.SetClientSecret(v)
+	return _u
+}
+
+// SetNillableClientSecret sets the "client_secret" field if the given value is not nil.
+func (_u *DeviceRequestUpdate) SetNillableClientSecret(v *string) *DeviceRequestUpdate {
+	if v != nil {
+		_u.SetClientSecret(*v)
+	}
+	return _u
 }
 
 // SetScopes sets the "scopes" field.
-func (dru *DeviceRequestUpdate) SetScopes(s []string) *DeviceRequestUpdate {
-	dru.mutation.SetScopes(s)
-	return dru
+func (_u *DeviceRequestUpdate) SetScopes(v []string) *DeviceRequestUpdate {
+	_u.mutation.SetScopes(v)
+	return _u
+}
+
+// AppendScopes appends value to the "scopes" field.
+func (_u *DeviceRequestUpdate) AppendScopes(v []string) *DeviceRequestUpdate {
+	_u.mutation.AppendScopes(v)
+	return _u
 }
 
 // ClearScopes clears the value of the "scopes" field.
-func (dru *DeviceRequestUpdate) ClearScopes() *DeviceRequestUpdate {
-	dru.mutation.ClearScopes()
-	return dru
+func (_u *DeviceRequestUpdate) ClearScopes() *DeviceRequestUpdate {
+	_u.mutation.ClearScopes()
+	return _u
 }
 
 // SetExpiry sets the "expiry" field.
-func (dru *DeviceRequestUpdate) SetExpiry(t time.Time) *DeviceRequestUpdate {
-	dru.mutation.SetExpiry(t)
-	return dru
+func (_u *DeviceRequestUpdate) SetExpiry(v time.Time) *DeviceRequestUpdate {
+	_u.mutation.SetExpiry(v)
+	return _u
+}
+
+// SetNillableExpiry sets the "expiry" field if the given value is not nil.
+func (_u *DeviceRequestUpdate) SetNillableExpiry(v *time.Time) *DeviceRequestUpdate {
+	if v != nil {
+		_u.SetExpiry(*v)
+	}
+	return _u
 }
 
 // Mutation returns the DeviceRequestMutation object of the builder.
-func (dru *DeviceRequestUpdate) Mutation() *DeviceRequestMutation {
-	return dru.mutation
+func (_u *DeviceRequestUpdate) Mutation() *DeviceRequestMutation {
+	return _u.mutation
 }
 
 // Save executes the query and returns the number of nodes affected by the update operation.
-func (dru *DeviceRequestUpdate) Save(ctx context.Context) (int, error) {
-	var (
-		err      error
-		affected int
-	)
-	if len(dru.hooks) == 0 {
-		if err = dru.check(); err != nil {
-			return 0, err
-		}
-		affected, err = dru.sqlSave(ctx)
-	} else {
-		var mut Mutator = MutateFunc(func(ctx context.Context, m Mutation) (Value, error) {
-			mutation, ok := m.(*DeviceRequestMutation)
-			if !ok {
-				return nil, fmt.Errorf("unexpected mutation type %T", m)
-			}
-			if err = dru.check(); err != nil {
-				return 0, err
-			}
-			dru.mutation = mutation
-			affected, err = dru.sqlSave(ctx)
-			mutation.done = true
-			return affected, err
-		})
-		for i := len(dru.hooks) - 1; i >= 0; i-- {
-			if dru.hooks[i] == nil {
-				return 0, fmt.Errorf("db: uninitialized hook (forgotten import db/runtime?)")
-			}
-			mut = dru.hooks[i](mut)
-		}
-		if _, err := mut.Mutate(ctx, dru.mutation); err != nil {
-			return 0, err
-		}
-	}
-	return affected, err
+func (_u *DeviceRequestUpdate) Save(ctx context.Context) (int, error) {
+	return withHooks(ctx, _u.sqlSave, _u.mutation, _u.hooks)
 }
 
 // SaveX is like Save, but panics if an error occurs.
-func (dru *DeviceRequestUpdate) SaveX(ctx context.Context) int {
-	affected, err := dru.Save(ctx)
+func (_u *DeviceRequestUpdate) SaveX(ctx context.Context) int {
+	affected, err := _u.Save(ctx)
 	if err != nil {
 		panic(err)
 	}
@@ -123,36 +137,36 @@ func (dru *DeviceRequestUpdate) SaveX(ctx context.Context) int {
 }
 
 // Exec executes the query.
-func (dru *DeviceRequestUpdate) Exec(ctx context.Context) error {
-	_, err := dru.Save(ctx)
+func (_u *DeviceRequestUpdate) Exec(ctx context.Context) error {
+	_, err := _u.Save(ctx)
 	return err
 }
 
 // ExecX is like Exec, but panics if an error occurs.
-func (dru *DeviceRequestUpdate) ExecX(ctx context.Context) {
-	if err := dru.Exec(ctx); err != nil {
+func (_u *DeviceRequestUpdate) ExecX(ctx context.Context) {
+	if err := _u.Exec(ctx); err != nil {
 		panic(err)
 	}
 }
 
 // check runs all checks and user-defined validators on the builder.
-func (dru *DeviceRequestUpdate) check() error {
-	if v, ok := dru.mutation.UserCode(); ok {
+func (_u *DeviceRequestUpdate) check() error {
+	if v, ok := _u.mutation.UserCode(); ok {
 		if err := devicerequest.UserCodeValidator(v); err != nil {
 			return &ValidationError{Name: "user_code", err: fmt.Errorf(`db: validator failed for field "DeviceRequest.user_code": %w`, err)}
 		}
 	}
-	if v, ok := dru.mutation.DeviceCode(); ok {
+	if v, ok := _u.mutation.DeviceCode(); ok {
 		if err := devicerequest.DeviceCodeValidator(v); err != nil {
 			return &ValidationError{Name: "device_code", err: fmt.Errorf(`db: validator failed for field "DeviceRequest.device_code": %w`, err)}
 		}
 	}
-	if v, ok := dru.mutation.ClientID(); ok {
+	if v, ok := _u.mutation.ClientID(); ok {
 		if err := devicerequest.ClientIDValidator(v); err != nil {
 			return &ValidationError{Name: "client_id", err: fmt.Errorf(`db: validator failed for field "DeviceRequest.client_id": %w`, err)}
 		}
 	}
-	if v, ok := dru.mutation.ClientSecret(); ok {
+	if v, ok := _u.mutation.ClientSecret(); ok {
 		if err := devicerequest.ClientSecretValidator(v); err != nil {
 			return &ValidationError{Name: "client_secret", err: fmt.Errorf(`db: validator failed for field "DeviceRequest.client_secret": %w`, err)}
 		}
@@ -160,73 +174,45 @@ func (dru *DeviceRequestUpdate) check() error {
 	return nil
 }
 
-func (dru *DeviceRequestUpdate) sqlSave(ctx context.Context) (n int, err error) {
-	_spec := &sqlgraph.UpdateSpec{
-		Node: &sqlgraph.NodeSpec{
-			Table:   devicerequest.Table,
-			Columns: devicerequest.Columns,
-			ID: &sqlgraph.FieldSpec{
-				Type:   field.TypeInt,
-				Column: devicerequest.FieldID,
-			},
-		},
+func (_u *DeviceRequestUpdate) sqlSave(ctx context.Context) (_node int, err error) {
+	if err := _u.check(); err != nil {
+		return _node, err
 	}
-	if ps := dru.mutation.predicates; len(ps) > 0 {
+	_spec := sqlgraph.NewUpdateSpec(devicerequest.Table, devicerequest.Columns, sqlgraph.NewFieldSpec(devicerequest.FieldID, field.TypeInt))
+	if ps := _u.mutation.predicates; len(ps) > 0 {
 		_spec.Predicate = func(selector *sql.Selector) {
 			for i := range ps {
 				ps[i](selector)
 			}
 		}
 	}
-	if value, ok := dru.mutation.UserCode(); ok {
-		_spec.Fields.Set = append(_spec.Fields.Set, &sqlgraph.FieldSpec{
-			Type:   field.TypeString,
-			Value:  value,
-			Column: devicerequest.FieldUserCode,
-		})
+	if value, ok := _u.mutation.UserCode(); ok {
+		_spec.SetField(devicerequest.FieldUserCode, field.TypeString, value)
 	}
-	if value, ok := dru.mutation.DeviceCode(); ok {
-		_spec.Fields.Set = append(_spec.Fields.Set, &sqlgraph.FieldSpec{
-			Type:   field.TypeString,
-			Value:  value,
-			Column: devicerequest.FieldDeviceCode,
-		})
+	if value, ok := _u.mutation.DeviceCode(); ok {
+		_spec.SetField(devicerequest.FieldDeviceCode, field.TypeString, value)
 	}
-	if value, ok := dru.mutation.ClientID(); ok {
-		_spec.Fields.Set = append(_spec.Fields.Set, &sqlgraph.FieldSpec{
-			Type:   field.TypeString,
-			Value:  value,
-			Column: devicerequest.FieldClientID,
-		})
+	if value, ok := _u.mutation.ClientID(); ok {
+		_spec.SetField(devicerequest.FieldClientID, field.TypeString, value)
 	}
-	if value, ok := dru.mutation.ClientSecret(); ok {
-		_spec.Fields.Set = append(_spec.Fields.Set, &sqlgraph.FieldSpec{
-			Type:   field.TypeString,
-			Value:  value,
-			Column: devicerequest.FieldClientSecret,
-		})
+	if value, ok := _u.mutation.ClientSecret(); ok {
+		_spec.SetField(devicerequest.FieldClientSecret, field.TypeString, value)
 	}
-	if value, ok := dru.mutation.Scopes(); ok {
-		_spec.Fields.Set = append(_spec.Fields.Set, &sqlgraph.FieldSpec{
-			Type:   field.TypeJSON,
-			Value:  value,
-			Column: devicerequest.FieldScopes,
-		})
+	if value, ok := _u.mutation.Scopes(); ok {
+		_spec.SetField(devicerequest.FieldScopes, field.TypeJSON, value)
 	}
-	if dru.mutation.ScopesCleared() {
-		_spec.Fields.Clear = append(_spec.Fields.Clear, &sqlgraph.FieldSpec{
-			Type:   field.TypeJSON,
-			Column: devicerequest.FieldScopes,
+	if value, ok := _u.mutation.AppendedScopes(); ok {
+		_spec.AddModifier(func(u *sql.UpdateBuilder) {
+			sqljson.Append(u, devicerequest.FieldScopes, value)
 		})
 	}
-	if value, ok := dru.mutation.Expiry(); ok {
-		_spec.Fields.Set = append(_spec.Fields.Set, &sqlgraph.FieldSpec{
-			Type:   field.TypeTime,
-			Value:  value,
-			Column: devicerequest.FieldExpiry,
-		})
+	if _u.mutation.ScopesCleared() {
+		_spec.ClearField(devicerequest.FieldScopes, field.TypeJSON)
 	}
-	if n, err = sqlgraph.UpdateNodes(ctx, dru.driver, _spec); err != nil {
+	if value, ok := _u.mutation.Expiry(); ok {
+		_spec.SetField(devicerequest.FieldExpiry, field.TypeTime, value)
+	}
+	if _node, err = sqlgraph.UpdateNodes(ctx, _u.driver, _spec); err != nil {
 		if _, ok := err.(*sqlgraph.NotFoundError); ok {
 			err = &NotFoundError{devicerequest.Label}
 		} else if sqlgraph.IsConstraintError(err) {
@@ -234,7 +220,8 @@ func (dru *DeviceRequestUpdate) sqlSave(ctx context.Context) (n int, err error)
 		}
 		return 0, err
 	}
-	return n, nil
+	_u.mutation.done = true
+	return _node, nil
 }
 
 // DeviceRequestUpdateOne is the builder for updating a single DeviceRequest entity.
@@ -246,106 +233,119 @@ type DeviceRequestUpdateOne struct {
 }
 
 // SetUserCode sets the "user_code" field.
-func (druo *DeviceRequestUpdateOne) SetUserCode(s string) *DeviceRequestUpdateOne {
-	druo.mutation.SetUserCode(s)
-	return druo
+func (_u *DeviceRequestUpdateOne) SetUserCode(v string) *DeviceRequestUpdateOne {
+	_u.mutation.SetUserCode(v)
+	return _u
+}
+
+// SetNillableUserCode sets the "user_code" field if the given value is not nil.
+func (_u *DeviceRequestUpdateOne) SetNillableUserCode(v *string) *DeviceRequestUpdateOne {
+	if v != nil {
+		_u.SetUserCode(*v)
+	}
+	return _u
 }
 
 // SetDeviceCode sets the "device_code" field.
-func (druo *DeviceRequestUpdateOne) SetDeviceCode(s string) *DeviceRequestUpdateOne {
-	druo.mutation.SetDeviceCode(s)
-	return druo
+func (_u *DeviceRequestUpdateOne) SetDeviceCode(v string) *DeviceRequestUpdateOne {
+	_u.mutation.SetDeviceCode(v)
+	return _u
+}
+
+// SetNillableDeviceCode sets the "device_code" field if the given value is not nil.
+func (_u *DeviceRequestUpdateOne) SetNillableDeviceCode(v *string) *DeviceRequestUpdateOne {
+	if v != nil {
+		_u.SetDeviceCode(*v)
+	}
+	return _u
 }
 
 // SetClientID sets the "client_id" field.
-func (druo *DeviceRequestUpdateOne) SetClientID(s string) *DeviceRequestUpdateOne {
-	druo.mutation.SetClientID(s)
-	return druo
+func (_u *DeviceRequestUpdateOne) SetClientID(v string) *DeviceRequestUpdateOne {
+	_u.mutation.SetClientID(v)
+	return _u
+}
+
+// SetNillableClientID sets the "client_id" field if the given value is not nil.
+func (_u *DeviceRequestUpdateOne) SetNillableClientID(v *string) *DeviceRequestUpdateOne {
+	if v != nil {
+		_u.SetClientID(*v)
+	}
+	return _u
 }
 
 // SetClientSecret sets the "client_secret" field.
-func (druo *DeviceRequestUpdateOne) SetClientSecret(s string) *DeviceRequestUpdateOne {
-	druo.mutation.SetClientSecret(s)
-	return druo
+func (_u *DeviceRequestUpdateOne) SetClientSecret(v string) *DeviceRequestUpdateOne {
+	_u.mutation.SetClientSecret(v)
+	return _u
+}
+
+// SetNillableClientSecret sets the "client_secret" field if the given value is not nil.
+func (_u *DeviceRequestUpdateOne) SetNillableClientSecret(v *string) *DeviceRequestUpdateOne {
+	if v != nil {
+		_u.SetClientSecret(*v)
+	}
+	return _u
 }
 
 // SetScopes sets the "scopes" field.
-func (druo *DeviceRequestUpdateOne) SetScopes(s []string) *DeviceRequestUpdateOne {
-	druo.mutation.SetScopes(s)
-	return druo
+func (_u *DeviceRequestUpdateOne) SetScopes(v []string) *DeviceRequestUpdateOne {
+	_u.mutation.SetScopes(v)
+	return _u
+}
+
+// AppendScopes appends value to the "scopes" field.
+func (_u *DeviceRequestUpdateOne) AppendScopes(v []string) *DeviceRequestUpdateOne {
+	_u.mutation.AppendScopes(v)
+	return _u
 }
 
 // ClearScopes clears the value of the "scopes" field.
-func (druo *DeviceRequestUpdateOne) ClearScopes() *DeviceRequestUpdateOne {
-	druo.mutation.ClearScopes()
-	return druo
+func (_u *DeviceRequestUpdateOne) ClearScopes() *DeviceRequestUpdateOne {
+	_u.mutation.ClearScopes()
+	return _u
 }
 
 // SetExpiry sets the "expiry" field.
-func (druo *DeviceRequestUpdateOne) SetExpiry(t time.Time) *DeviceRequestUpdateOne {
-	druo.mutation.SetExpiry(t)
-	return druo
+func (_u *DeviceRequestUpdateOne) SetExpiry(v time.Time) *DeviceRequestUpdateOne {
+	_u.mutation.SetExpiry(v)
+	return _u
+}
+
+// SetNillableExpiry sets the "expiry" field if the given value is not nil.
+func (_u *DeviceRequestUpdateOne) SetNillableExpiry(v *time.Time) *DeviceRequestUpdateOne {
+	if v != nil {
+		_u.SetExpiry(*v)
+	}
+	return _u
 }
 
 // Mutation returns the DeviceRequestMutation object of the builder.
-func (druo *DeviceRequestUpdateOne) Mutation() *DeviceRequestMutation {
-	return druo.mutation
+func (_u *DeviceRequestUpdateOne) Mutation() *DeviceRequestMutation {
+	return _u.mutation
+}
+
+// Where appends a list predicates to the DeviceRequestUpdate builder.
+func (_u *DeviceRequestUpdateOne) Where(ps ...predicate.DeviceRequest) *DeviceRequestUpdateOne {
+	_u.mutation.Where(ps...)
+	return _u
 }
 
 // Select allows selecting one or more fields (columns) of the returned entity.
 // The default is selecting all fields defined in the entity schema.
-func (druo *DeviceRequestUpdateOne) Select(field string, fields ...string) *DeviceRequestUpdateOne {
-	druo.fields = append([]string{field}, fields...)
-	return druo
+func (_u *DeviceRequestUpdateOne) Select(field string, fields ...string) *DeviceRequestUpdateOne {
+	_u.fields = append([]string{field}, fields...)
+	return _u
 }
 
 // Save executes the query and returns the updated DeviceRequest entity.
-func (druo *DeviceRequestUpdateOne) Save(ctx context.Context) (*DeviceRequest, error) {
-	var (
-		err  error
-		node *DeviceRequest
-	)
-	if len(druo.hooks) == 0 {
-		if err = druo.check(); err != nil {
-			return nil, err
-		}
-		node, err = druo.sqlSave(ctx)
-	} else {
-		var mut Mutator = MutateFunc(func(ctx context.Context, m Mutation) (Value, error) {
-			mutation, ok := m.(*DeviceRequestMutation)
-			if !ok {
-				return nil, fmt.Errorf("unexpected mutation type %T", m)
-			}
-			if err = druo.check(); err != nil {
-				return nil, err
-			}
-			druo.mutation = mutation
-			node, err = druo.sqlSave(ctx)
-			mutation.done = true
-			return node, err
-		})
-		for i := len(druo.hooks) - 1; i >= 0; i-- {
-			if druo.hooks[i] == nil {
-				return nil, fmt.Errorf("db: uninitialized hook (forgotten import db/runtime?)")
-			}
-			mut = druo.hooks[i](mut)
-		}
-		v, err := mut.Mutate(ctx, druo.mutation)
-		if err != nil {
-			return nil, err
-		}
-		nv, ok := v.(*DeviceRequest)
-		if !ok {
-			return nil, fmt.Errorf("unexpected node type %T returned from DeviceRequestMutation", v)
-		}
-		node = nv
-	}
-	return node, err
+func (_u *DeviceRequestUpdateOne) Save(ctx context.Context) (*DeviceRequest, error) {
+	return withHooks(ctx, _u.sqlSave, _u.mutation, _u.hooks)
 }
 
 // SaveX is like Save, but panics if an error occurs.
-func (druo *DeviceRequestUpdateOne) SaveX(ctx context.Context) *DeviceRequest {
-	node, err := druo.Save(ctx)
+func (_u *DeviceRequestUpdateOne) SaveX(ctx context.Context) *DeviceRequest {
+	node, err := _u.Save(ctx)
 	if err != nil {
 		panic(err)
 	}
@@ -353,36 +353,36 @@ func (druo *DeviceRequestUpdateOne) SaveX(ctx context.Context) *DeviceRequest {
 }
 
 // Exec executes the query on the entity.
-func (druo *DeviceRequestUpdateOne) Exec(ctx context.Context) error {
-	_, err := druo.Save(ctx)
+func (_u *DeviceRequestUpdateOne) Exec(ctx context.Context) error {
+	_, err := _u.Save(ctx)
 	return err
 }
 
 // ExecX is like Exec, but panics if an error occurs.
-func (druo *DeviceRequestUpdateOne) ExecX(ctx context.Context) {
-	if err := druo.Exec(ctx); err != nil {
+func (_u *DeviceRequestUpdateOne) ExecX(ctx context.Context) {
+	if err := _u.Exec(ctx); err != nil {
 		panic(err)
 	}
 }
 
 // check runs all checks and user-defined validators on the builder.
-func (druo *DeviceRequestUpdateOne) check() error {
-	if v, ok := druo.mutation.UserCode(); ok {
+func (_u *DeviceRequestUpdateOne) check() error {
+	if v, ok := _u.mutation.UserCode(); ok {
 		if err := devicerequest.UserCodeValidator(v); err != nil {
 			return &ValidationError{Name: "user_code", err: fmt.Errorf(`db: validator failed for field "DeviceRequest.user_code": %w`, err)}
 		}
 	}
-	if v, ok := druo.mutation.DeviceCode(); ok {
+	if v, ok := _u.mutation.DeviceCode(); ok {
 		if err := devicerequest.DeviceCodeValidator(v); err != nil {
 			return &ValidationError{Name: "device_code", err: fmt.Errorf(`db: validator failed for field "DeviceRequest.device_code": %w`, err)}
 		}
 	}
-	if v, ok := druo.mutation.ClientID(); ok {
+	if v, ok := _u.mutation.ClientID(); ok {
 		if err := devicerequest.ClientIDValidator(v); err != nil {
 			return &ValidationError{Name: "client_id", err: fmt.Errorf(`db: validator failed for field "DeviceRequest.client_id": %w`, err)}
 		}
 	}
-	if v, ok := druo.mutation.ClientSecret(); ok {
+	if v, ok := _u.mutation.ClientSecret(); ok {
 		if err := devicerequest.ClientSecretValidator(v); err != nil {
 			return &ValidationError{Name: "client_secret", err: fmt.Errorf(`db: validator failed for field "DeviceRequest.client_secret": %w`, err)}
 		}
@@ -390,23 +390,17 @@ func (druo *DeviceRequestUpdateOne) check() error {
 	return nil
 }
 
-func (druo *DeviceRequestUpdateOne) sqlSave(ctx context.Context) (_node *DeviceRequest, err error) {
-	_spec := &sqlgraph.UpdateSpec{
-		Node: &sqlgraph.NodeSpec{
-			Table:   devicerequest.Table,
-			Columns: devicerequest.Columns,
-			ID: &sqlgraph.FieldSpec{
-				Type:   field.TypeInt,
-				Column: devicerequest.FieldID,
-			},
-		},
+func (_u *DeviceRequestUpdateOne) sqlSave(ctx context.Context) (_node *DeviceRequest, err error) {
+	if err := _u.check(); err != nil {
+		return _node, err
 	}
-	id, ok := druo.mutation.ID()
+	_spec := sqlgraph.NewUpdateSpec(devicerequest.Table, devicerequest.Columns, sqlgraph.NewFieldSpec(devicerequest.FieldID, field.TypeInt))
+	id, ok := _u.mutation.ID()
 	if !ok {
 		return nil, &ValidationError{Name: "id", err: errors.New(`db: missing "DeviceRequest.id" for update`)}
 	}
 	_spec.Node.ID.Value = id
-	if fields := druo.fields; len(fields) > 0 {
+	if fields := _u.fields; len(fields) > 0 {
 		_spec.Node.Columns = make([]string, 0, len(fields))
 		_spec.Node.Columns = append(_spec.Node.Columns, devicerequest.FieldID)
 		for _, f := range fields {
@@ -418,65 +412,43 @@ func (druo *DeviceRequestUpdateOne) sqlSave(ctx context.Context) (_node *DeviceR
 			}
 		}
 	}
-	if ps := druo.mutation.predicates; len(ps) > 0 {
+	if ps := _u.mutation.predicates; len(ps) > 0 {
 		_spec.Predicate = func(selector *sql.Selector) {
 			for i := range ps {
 				ps[i](selector)
 			}
 		}
 	}
-	if value, ok := druo.mutation.UserCode(); ok {
-		_spec.Fields.Set = append(_spec.Fields.Set, &sqlgraph.FieldSpec{
-			Type:   field.TypeString,
-			Value:  value,
-			Column: devicerequest.FieldUserCode,
-		})
+	if value, ok := _u.mutation.UserCode(); ok {
+		_spec.SetField(devicerequest.FieldUserCode, field.TypeString, value)
 	}
-	if value, ok := druo.mutation.DeviceCode(); ok {
-		_spec.Fields.Set = append(_spec.Fields.Set, &sqlgraph.FieldSpec{
-			Type:   field.TypeString,
-			Value:  value,
-			Column: devicerequest.FieldDeviceCode,
-		})
+	if value, ok := _u.mutation.DeviceCode(); ok {
+		_spec.SetField(devicerequest.FieldDeviceCode, field.TypeString, value)
 	}
-	if value, ok := druo.mutation.ClientID(); ok {
-		_spec.Fields.Set = append(_spec.Fields.Set, &sqlgraph.FieldSpec{
-			Type:   field.TypeString,
-			Value:  value,
-			Column: devicerequest.FieldClientID,
-		})
+	if value, ok := _u.mutation.ClientID(); ok {
+		_spec.SetField(devicerequest.FieldClientID, field.TypeString, value)
 	}
-	if value, ok := druo.mutation.ClientSecret(); ok {
-		_spec.Fields.Set = append(_spec.Fields.Set, &sqlgraph.FieldSpec{
-			Type:   field.TypeString,
-			Value:  value,
-			Column: devicerequest.FieldClientSecret,
-		})
+	if value, ok := _u.mutation.ClientSecret(); ok {
+		_spec.SetField(devicerequest.FieldClientSecret, field.TypeString, value)
 	}
-	if value, ok := druo.mutation.Scopes(); ok {
-		_spec.Fields.Set = append(_spec.Fields.Set, &sqlgraph.FieldSpec{
-			Type:   field.TypeJSON,
-			Value:  value,
-			Column: devicerequest.FieldScopes,
-		})
+	if value, ok := _u.mutation.Scopes(); ok {
+		_spec.SetField(devicerequest.FieldScopes, field.TypeJSON, value)
 	}
-	if druo.mutation.ScopesCleared() {
-		_spec.Fields.Clear = append(_spec.Fields.Clear, &sqlgraph.FieldSpec{
-			Type:   field.TypeJSON,
-			Column: devicerequest.FieldScopes,
+	if value, ok := _u.mutation.AppendedScopes(); ok {
+		_spec.AddModifier(func(u *sql.UpdateBuilder) {
+			sqljson.Append(u, devicerequest.FieldScopes, value)
 		})
 	}
-	if value, ok := druo.mutation.Expiry(); ok {
-		_spec.Fields.Set = append(_spec.Fields.Set, &sqlgraph.FieldSpec{
-			Type:   field.TypeTime,
-			Value:  value,
-			Column: devicerequest.FieldExpiry,
-		})
+	if _u.mutation.ScopesCleared() {
+		_spec.ClearField(devicerequest.FieldScopes, field.TypeJSON)
+	}
+	if value, ok := _u.mutation.Expiry(); ok {
+		_spec.SetField(devicerequest.FieldExpiry, field.TypeTime, value)
 	}
-	_node = &DeviceRequest{config: druo.config}
+	_node = &DeviceRequest{config: _u.config}
 	_spec.Assign = _node.assignValues
 	_spec.ScanValues = _node.scanValues
-	if err = sqlgraph.UpdateNode(ctx, druo.driver, _spec); err != nil {
+	if err = sqlgraph.UpdateNode(ctx, _u.driver, _spec); err != nil {
 		if _, ok := err.(*sqlgraph.NotFoundError); ok {
 			err = &NotFoundError{devicerequest.Label}
 		} else if sqlgraph.IsConstraintError(err) {
@@ -484,5 +456,6 @@ func (druo *DeviceRequestUpdateOne) sqlSave(ctx context.Context) (_node *DeviceR
 		}
 		return nil, err
 	}
+	_u.mutation.done = true
 	return _node, nil
 }
diff --git a/storage/ent/db/devicetoken.go b/storage/ent/db/devicetoken.go
index 0daa128064..30b69d0307 100644
--- a/storage/ent/db/devicetoken.go
+++ b/storage/ent/db/devicetoken.go
@@ -7,6 +7,7 @@ import (
 	"strings"
 	"time"
 
+	"entgo.io/ent"
 	"entgo.io/ent/dialect/sql"
 	"github.com/dexidp/dex/storage/ent/db/devicetoken"
 )
@@ -32,11 +33,12 @@ type DeviceToken struct {
 	CodeChallenge string `json:"code_challenge,omitempty"`
 	// CodeChallengeMethod holds the value of the "code_challenge_method" field.
 	CodeChallengeMethod string `json:"code_challenge_method,omitempty"`
+	selectValues        sql.SelectValues
 }
 
 // scanValues returns the types for scanning values from sql.Rows.
-func (*DeviceToken) scanValues(columns []string) ([]interface{}, error) {
-	values := make([]interface{}, len(columns))
+func (*DeviceToken) scanValues(columns []string) ([]any, error) {
+	values := make([]any, len(columns))
 	for i := range columns {
 		switch columns[i] {
 		case devicetoken.FieldToken:
@@ -48,7 +50,7 @@ func (*DeviceToken) scanValues(columns []string) ([]interface{}, error) {
 		case devicetoken.FieldExpiry, devicetoken.FieldLastRequest:
 			values[i] = new(sql.NullTime)
 		default:
-			return nil, fmt.Errorf("unexpected column %q for type DeviceToken", columns[i])
+			values[i] = new(sql.UnknownType)
 		}
 	}
 	return values, nil
@@ -56,7 +58,7 @@ func (*DeviceToken) scanValues(columns []string) ([]interface{}, error) {
 
 // assignValues assigns the values that were returned from sql.Rows (after scanning)
 // to the DeviceToken fields.
-func (dt *DeviceToken) assignValues(columns []string, values []interface{}) error {
+func (_m *DeviceToken) assignValues(columns []string, values []any) error {
 	if m, n := len(values), len(columns); m < n {
 		return fmt.Errorf("mismatch number of scan values: %d != %d", m, n)
 	}
@@ -67,117 +69,119 @@ func (dt *DeviceToken) assignValues(columns []string, values []interface{}) erro
 			if !ok {
 				return fmt.Errorf("unexpected type %T for field id", value)
 			}
-			dt.ID = int(value.Int64)
+			_m.ID = int(value.Int64)
 		case devicetoken.FieldDeviceCode:
 			if value, ok := values[i].(*sql.NullString); !ok {
 				return fmt.Errorf("unexpected type %T for field device_code", values[i])
 			} else if value.Valid {
-				dt.DeviceCode = value.String
+				_m.DeviceCode = value.String
 			}
 		case devicetoken.FieldStatus:
 			if value, ok := values[i].(*sql.NullString); !ok {
 				return fmt.Errorf("unexpected type %T for field status", values[i])
 			} else if value.Valid {
-				dt.Status = value.String
+				_m.Status = value.String
 			}
 		case devicetoken.FieldToken:
 			if value, ok := values[i].(*[]byte); !ok {
 				return fmt.Errorf("unexpected type %T for field token", values[i])
 			} else if value != nil {
-				dt.Token = value
+				_m.Token = value
 			}
 		case devicetoken.FieldExpiry:
 			if value, ok := values[i].(*sql.NullTime); !ok {
 				return fmt.Errorf("unexpected type %T for field expiry", values[i])
 			} else if value.Valid {
-				dt.Expiry = value.Time
+				_m.Expiry = value.Time
 			}
 		case devicetoken.FieldLastRequest:
 			if value, ok := values[i].(*sql.NullTime); !ok {
 				return fmt.Errorf("unexpected type %T for field last_request", values[i])
 			} else if value.Valid {
-				dt.LastRequest = value.Time
+				_m.LastRequest = value.Time
 			}
 		case devicetoken.FieldPollInterval:
 			if value, ok := values[i].(*sql.NullInt64); !ok {
 				return fmt.Errorf("unexpected type %T for field poll_interval", values[i])
 			} else if value.Valid {
-				dt.PollInterval = int(value.Int64)
+				_m.PollInterval = int(value.Int64)
 			}
 		case devicetoken.FieldCodeChallenge:
 			if value, ok := values[i].(*sql.NullString); !ok {
 				return fmt.Errorf("unexpected type %T for field code_challenge", values[i])
 			} else if value.Valid {
-				dt.CodeChallenge = value.String
+				_m.CodeChallenge = value.String
 			}
 		case devicetoken.FieldCodeChallengeMethod:
 			if value, ok := values[i].(*sql.NullString); !ok {
 				return fmt.Errorf("unexpected type %T for field code_challenge_method", values[i])
 			} else if value.Valid {
-				dt.CodeChallengeMethod = value.String
+				_m.CodeChallengeMethod = value.String
 			}
+		default:
+			_m.selectValues.Set(columns[i], values[i])
 		}
 	}
 	return nil
 }
 
+// Value returns the ent.Value that was dynamically selected and assigned to the DeviceToken.
+// This includes values selected through modifiers, order, etc.
+func (_m *DeviceToken) Value(name string) (ent.Value, error) {
+	return _m.selectValues.Get(name)
+}
+
 // Update returns a builder for updating this DeviceToken.
 // Note that you need to call DeviceToken.Unwrap() before calling this method if this DeviceToken
 // was returned from a transaction, and the transaction was committed or rolled back.
-func (dt *DeviceToken) Update() *DeviceTokenUpdateOne {
-	return (&DeviceTokenClient{config: dt.config}).UpdateOne(dt)
+func (_m *DeviceToken) Update() *DeviceTokenUpdateOne {
+	return NewDeviceTokenClient(_m.config).UpdateOne(_m)
 }
 
 // Unwrap unwraps the DeviceToken entity that was returned from a transaction after it was closed,
 // so that all future queries will be executed through the driver which created the transaction.
-func (dt *DeviceToken) Unwrap() *DeviceToken {
-	_tx, ok := dt.config.driver.(*txDriver)
+func (_m *DeviceToken) Unwrap() *DeviceToken {
+	_tx, ok := _m.config.driver.(*txDriver)
 	if !ok {
 		panic("db: DeviceToken is not a transactional entity")
 	}
-	dt.config.driver = _tx.drv
-	return dt
+	_m.config.driver = _tx.drv
+	return _m
 }
 
 // String implements the fmt.Stringer.
-func (dt *DeviceToken) String() string {
+func (_m *DeviceToken) String() string {
 	var builder strings.Builder
 	builder.WriteString("DeviceToken(")
-	builder.WriteString(fmt.Sprintf("id=%v, ", dt.ID))
+	builder.WriteString(fmt.Sprintf("id=%v, ", _m.ID))
 	builder.WriteString("device_code=")
-	builder.WriteString(dt.DeviceCode)
+	builder.WriteString(_m.DeviceCode)
 	builder.WriteString(", ")
 	builder.WriteString("status=")
-	builder.WriteString(dt.Status)
+	builder.WriteString(_m.Status)
 	builder.WriteString(", ")
-	if v := dt.Token; v != nil {
+	if v := _m.Token; v != nil {
 		builder.WriteString("token=")
 		builder.WriteString(fmt.Sprintf("%v", *v))
 	}
 	builder.WriteString(", ")
 	builder.WriteString("expiry=")
-	builder.WriteString(dt.Expiry.Format(time.ANSIC))
+	builder.WriteString(_m.Expiry.Format(time.ANSIC))
 	builder.WriteString(", ")
 	builder.WriteString("last_request=")
-	builder.WriteString(dt.LastRequest.Format(time.ANSIC))
+	builder.WriteString(_m.LastRequest.Format(time.ANSIC))
 	builder.WriteString(", ")
 	builder.WriteString("poll_interval=")
-	builder.WriteString(fmt.Sprintf("%v", dt.PollInterval))
+	builder.WriteString(fmt.Sprintf("%v", _m.PollInterval))
 	builder.WriteString(", ")
 	builder.WriteString("code_challenge=")
-	builder.WriteString(dt.CodeChallenge)
+	builder.WriteString(_m.CodeChallenge)
 	builder.WriteString(", ")
 	builder.WriteString("code_challenge_method=")
-	builder.WriteString(dt.CodeChallengeMethod)
+	builder.WriteString(_m.CodeChallengeMethod)
 	builder.WriteByte(')')
 	return builder.String()
 }
 
 // DeviceTokens is a parsable slice of DeviceToken.
 type DeviceTokens []*DeviceToken
-
-func (dt DeviceTokens) config(cfg config) {
-	for _i := range dt {
-		dt[_i].config = cfg
-	}
-}
diff --git a/storage/ent/db/devicetoken/devicetoken.go b/storage/ent/db/devicetoken/devicetoken.go
index f40b1b048a..7297244035 100644
--- a/storage/ent/db/devicetoken/devicetoken.go
+++ b/storage/ent/db/devicetoken/devicetoken.go
@@ -2,6 +2,10 @@
 
 package devicetoken
 
+import (
+	"entgo.io/ent/dialect/sql"
+)
+
 const (
 	// Label holds the string label denoting the devicetoken type in the database.
 	Label = "device_token"
@@ -60,3 +64,46 @@ var (
 	// DefaultCodeChallengeMethod holds the default value on creation for the "code_challenge_method" field.
 	DefaultCodeChallengeMethod string
 )
+
+// OrderOption defines the ordering options for the DeviceToken queries.
+type OrderOption func(*sql.Selector)
+
+// ByID orders the results by the id field.
+func ByID(opts ...sql.OrderTermOption) OrderOption {
+	return sql.OrderByField(FieldID, opts...).ToFunc()
+}
+
+// ByDeviceCode orders the results by the device_code field.
+func ByDeviceCode(opts ...sql.OrderTermOption) OrderOption {
+	return sql.OrderByField(FieldDeviceCode, opts...).ToFunc()
+}
+
+// ByStatus orders the results by the status field.
+func ByStatus(opts ...sql.OrderTermOption) OrderOption {
+	return sql.OrderByField(FieldStatus, opts...).ToFunc()
+}
+
+// ByExpiry orders the results by the expiry field.
+func ByExpiry(opts ...sql.OrderTermOption) OrderOption {
+	return sql.OrderByField(FieldExpiry, opts...).ToFunc()
+}
+
+// ByLastRequest orders the results by the last_request field.
+func ByLastRequest(opts ...sql.OrderTermOption) OrderOption {
+	return sql.OrderByField(FieldLastRequest, opts...).ToFunc()
+}
+
+// ByPollInterval orders the results by the poll_interval field.
+func ByPollInterval(opts ...sql.OrderTermOption) OrderOption {
+	return sql.OrderByField(FieldPollInterval, opts...).ToFunc()
+}
+
+// ByCodeChallenge orders the results by the code_challenge field.
+func ByCodeChallenge(opts ...sql.OrderTermOption) OrderOption {
+	return sql.OrderByField(FieldCodeChallenge, opts...).ToFunc()
+}
+
+// ByCodeChallengeMethod orders the results by the code_challenge_method field.
+func ByCodeChallengeMethod(opts ...sql.OrderTermOption) OrderOption {
+	return sql.OrderByField(FieldCodeChallengeMethod, opts...).ToFunc()
+}
diff --git a/storage/ent/db/devicetoken/where.go b/storage/ent/db/devicetoken/where.go
index a8e33f1e00..59fa65cb1e 100644
--- a/storage/ent/db/devicetoken/where.go
+++ b/storage/ent/db/devicetoken/where.go
@@ -11,825 +11,530 @@ import (
 
 // ID filters vertices based on their ID field.
 func ID(id int) predicate.DeviceToken {
-	return predicate.DeviceToken(func(s *sql.Selector) {
-		s.Where(sql.EQ(s.C(FieldID), id))
-	})
+	return predicate.DeviceToken(sql.FieldEQ(FieldID, id))
 }
 
 // IDEQ applies the EQ predicate on the ID field.
 func IDEQ(id int) predicate.DeviceToken {
-	return predicate.DeviceToken(func(s *sql.Selector) {
-		s.Where(sql.EQ(s.C(FieldID), id))
-	})
+	return predicate.DeviceToken(sql.FieldEQ(FieldID, id))
 }
 
 // IDNEQ applies the NEQ predicate on the ID field.
 func IDNEQ(id int) predicate.DeviceToken {
-	return predicate.DeviceToken(func(s *sql.Selector) {
-		s.Where(sql.NEQ(s.C(FieldID), id))
-	})
+	return predicate.DeviceToken(sql.FieldNEQ(FieldID, id))
 }
 
 // IDIn applies the In predicate on the ID field.
 func IDIn(ids ...int) predicate.DeviceToken {
-	return predicate.DeviceToken(func(s *sql.Selector) {
-		v := make([]interface{}, len(ids))
-		for i := range v {
-			v[i] = ids[i]
-		}
-		s.Where(sql.In(s.C(FieldID), v...))
-	})
+	return predicate.DeviceToken(sql.FieldIn(FieldID, ids...))
 }
 
 // IDNotIn applies the NotIn predicate on the ID field.
 func IDNotIn(ids ...int) predicate.DeviceToken {
-	return predicate.DeviceToken(func(s *sql.Selector) {
-		v := make([]interface{}, len(ids))
-		for i := range v {
-			v[i] = ids[i]
-		}
-		s.Where(sql.NotIn(s.C(FieldID), v...))
-	})
+	return predicate.DeviceToken(sql.FieldNotIn(FieldID, ids...))
 }
 
 // IDGT applies the GT predicate on the ID field.
 func IDGT(id int) predicate.DeviceToken {
-	return predicate.DeviceToken(func(s *sql.Selector) {
-		s.Where(sql.GT(s.C(FieldID), id))
-	})
+	return predicate.DeviceToken(sql.FieldGT(FieldID, id))
 }
 
 // IDGTE applies the GTE predicate on the ID field.
 func IDGTE(id int) predicate.DeviceToken {
-	return predicate.DeviceToken(func(s *sql.Selector) {
-		s.Where(sql.GTE(s.C(FieldID), id))
-	})
+	return predicate.DeviceToken(sql.FieldGTE(FieldID, id))
 }
 
 // IDLT applies the LT predicate on the ID field.
 func IDLT(id int) predicate.DeviceToken {
-	return predicate.DeviceToken(func(s *sql.Selector) {
-		s.Where(sql.LT(s.C(FieldID), id))
-	})
+	return predicate.DeviceToken(sql.FieldLT(FieldID, id))
 }
 
 // IDLTE applies the LTE predicate on the ID field.
 func IDLTE(id int) predicate.DeviceToken {
-	return predicate.DeviceToken(func(s *sql.Selector) {
-		s.Where(sql.LTE(s.C(FieldID), id))
-	})
+	return predicate.DeviceToken(sql.FieldLTE(FieldID, id))
 }
 
 // DeviceCode applies equality check predicate on the "device_code" field. It's identical to DeviceCodeEQ.
 func DeviceCode(v string) predicate.DeviceToken {
-	return predicate.DeviceToken(func(s *sql.Selector) {
-		s.Where(sql.EQ(s.C(FieldDeviceCode), v))
-	})
+	return predicate.DeviceToken(sql.FieldEQ(FieldDeviceCode, v))
 }
 
 // Status applies equality check predicate on the "status" field. It's identical to StatusEQ.
 func Status(v string) predicate.DeviceToken {
-	return predicate.DeviceToken(func(s *sql.Selector) {
-		s.Where(sql.EQ(s.C(FieldStatus), v))
-	})
+	return predicate.DeviceToken(sql.FieldEQ(FieldStatus, v))
 }
 
 // Token applies equality check predicate on the "token" field. It's identical to TokenEQ.
 func Token(v []byte) predicate.DeviceToken {
-	return predicate.DeviceToken(func(s *sql.Selector) {
-		s.Where(sql.EQ(s.C(FieldToken), v))
-	})
+	return predicate.DeviceToken(sql.FieldEQ(FieldToken, v))
 }
 
 // Expiry applies equality check predicate on the "expiry" field. It's identical to ExpiryEQ.
 func Expiry(v time.Time) predicate.DeviceToken {
-	return predicate.DeviceToken(func(s *sql.Selector) {
-		s.Where(sql.EQ(s.C(FieldExpiry), v))
-	})
+	return predicate.DeviceToken(sql.FieldEQ(FieldExpiry, v))
 }
 
 // LastRequest applies equality check predicate on the "last_request" field. It's identical to LastRequestEQ.
 func LastRequest(v time.Time) predicate.DeviceToken {
-	return predicate.DeviceToken(func(s *sql.Selector) {
-		s.Where(sql.EQ(s.C(FieldLastRequest), v))
-	})
+	return predicate.DeviceToken(sql.FieldEQ(FieldLastRequest, v))
 }
 
 // PollInterval applies equality check predicate on the "poll_interval" field. It's identical to PollIntervalEQ.
 func PollInterval(v int) predicate.DeviceToken {
-	return predicate.DeviceToken(func(s *sql.Selector) {
-		s.Where(sql.EQ(s.C(FieldPollInterval), v))
-	})
+	return predicate.DeviceToken(sql.FieldEQ(FieldPollInterval, v))
 }
 
 // CodeChallenge applies equality check predicate on the "code_challenge" field. It's identical to CodeChallengeEQ.
 func CodeChallenge(v string) predicate.DeviceToken {
-	return predicate.DeviceToken(func(s *sql.Selector) {
-		s.Where(sql.EQ(s.C(FieldCodeChallenge), v))
-	})
+	return predicate.DeviceToken(sql.FieldEQ(FieldCodeChallenge, v))
 }
 
 // CodeChallengeMethod applies equality check predicate on the "code_challenge_method" field. It's identical to CodeChallengeMethodEQ.
 func CodeChallengeMethod(v string) predicate.DeviceToken {
-	return predicate.DeviceToken(func(s *sql.Selector) {
-		s.Where(sql.EQ(s.C(FieldCodeChallengeMethod), v))
-	})
+	return predicate.DeviceToken(sql.FieldEQ(FieldCodeChallengeMethod, v))
 }
 
 // DeviceCodeEQ applies the EQ predicate on the "device_code" field.
 func DeviceCodeEQ(v string) predicate.DeviceToken {
-	return predicate.DeviceToken(func(s *sql.Selector) {
-		s.Where(sql.EQ(s.C(FieldDeviceCode), v))
-	})
+	return predicate.DeviceToken(sql.FieldEQ(FieldDeviceCode, v))
 }
 
 // DeviceCodeNEQ applies the NEQ predicate on the "device_code" field.
 func DeviceCodeNEQ(v string) predicate.DeviceToken {
-	return predicate.DeviceToken(func(s *sql.Selector) {
-		s.Where(sql.NEQ(s.C(FieldDeviceCode), v))
-	})
+	return predicate.DeviceToken(sql.FieldNEQ(FieldDeviceCode, v))
 }
 
 // DeviceCodeIn applies the In predicate on the "device_code" field.
 func DeviceCodeIn(vs ...string) predicate.DeviceToken {
-	v := make([]interface{}, len(vs))
-	for i := range v {
-		v[i] = vs[i]
-	}
-	return predicate.DeviceToken(func(s *sql.Selector) {
-		s.Where(sql.In(s.C(FieldDeviceCode), v...))
-	})
+	return predicate.DeviceToken(sql.FieldIn(FieldDeviceCode, vs...))
 }
 
 // DeviceCodeNotIn applies the NotIn predicate on the "device_code" field.
 func DeviceCodeNotIn(vs ...string) predicate.DeviceToken {
-	v := make([]interface{}, len(vs))
-	for i := range v {
-		v[i] = vs[i]
-	}
-	return predicate.DeviceToken(func(s *sql.Selector) {
-		s.Where(sql.NotIn(s.C(FieldDeviceCode), v...))
-	})
+	return predicate.DeviceToken(sql.FieldNotIn(FieldDeviceCode, vs...))
 }
 
 // DeviceCodeGT applies the GT predicate on the "device_code" field.
 func DeviceCodeGT(v string) predicate.DeviceToken {
-	return predicate.DeviceToken(func(s *sql.Selector) {
-		s.Where(sql.GT(s.C(FieldDeviceCode), v))
-	})
+	return predicate.DeviceToken(sql.FieldGT(FieldDeviceCode, v))
 }
 
 // DeviceCodeGTE applies the GTE predicate on the "device_code" field.
 func DeviceCodeGTE(v string) predicate.DeviceToken {
-	return predicate.DeviceToken(func(s *sql.Selector) {
-		s.Where(sql.GTE(s.C(FieldDeviceCode), v))
-	})
+	return predicate.DeviceToken(sql.FieldGTE(FieldDeviceCode, v))
 }
 
 // DeviceCodeLT applies the LT predicate on the "device_code" field.
 func DeviceCodeLT(v string) predicate.DeviceToken {
-	return predicate.DeviceToken(func(s *sql.Selector) {
-		s.Where(sql.LT(s.C(FieldDeviceCode), v))
-	})
+	return predicate.DeviceToken(sql.FieldLT(FieldDeviceCode, v))
 }
 
 // DeviceCodeLTE applies the LTE predicate on the "device_code" field.
 func DeviceCodeLTE(v string) predicate.DeviceToken {
-	return predicate.DeviceToken(func(s *sql.Selector) {
-		s.Where(sql.LTE(s.C(FieldDeviceCode), v))
-	})
+	return predicate.DeviceToken(sql.FieldLTE(FieldDeviceCode, v))
 }
 
 // DeviceCodeContains applies the Contains predicate on the "device_code" field.
 func DeviceCodeContains(v string) predicate.DeviceToken {
-	return predicate.DeviceToken(func(s *sql.Selector) {
-		s.Where(sql.Contains(s.C(FieldDeviceCode), v))
-	})
+	return predicate.DeviceToken(sql.FieldContains(FieldDeviceCode, v))
 }
 
 // DeviceCodeHasPrefix applies the HasPrefix predicate on the "device_code" field.
 func DeviceCodeHasPrefix(v string) predicate.DeviceToken {
-	return predicate.DeviceToken(func(s *sql.Selector) {
-		s.Where(sql.HasPrefix(s.C(FieldDeviceCode), v))
-	})
+	return predicate.DeviceToken(sql.FieldHasPrefix(FieldDeviceCode, v))
 }
 
 // DeviceCodeHasSuffix applies the HasSuffix predicate on the "device_code" field.
 func DeviceCodeHasSuffix(v string) predicate.DeviceToken {
-	return predicate.DeviceToken(func(s *sql.Selector) {
-		s.Where(sql.HasSuffix(s.C(FieldDeviceCode), v))
-	})
+	return predicate.DeviceToken(sql.FieldHasSuffix(FieldDeviceCode, v))
 }
 
 // DeviceCodeEqualFold applies the EqualFold predicate on the "device_code" field.
 func DeviceCodeEqualFold(v string) predicate.DeviceToken {
-	return predicate.DeviceToken(func(s *sql.Selector) {
-		s.Where(sql.EqualFold(s.C(FieldDeviceCode), v))
-	})
+	return predicate.DeviceToken(sql.FieldEqualFold(FieldDeviceCode, v))
 }
 
 // DeviceCodeContainsFold applies the ContainsFold predicate on the "device_code" field.
 func DeviceCodeContainsFold(v string) predicate.DeviceToken {
-	return predicate.DeviceToken(func(s *sql.Selector) {
-		s.Where(sql.ContainsFold(s.C(FieldDeviceCode), v))
-	})
+	return predicate.DeviceToken(sql.FieldContainsFold(FieldDeviceCode, v))
 }
 
 // StatusEQ applies the EQ predicate on the "status" field.
 func StatusEQ(v string) predicate.DeviceToken {
-	return predicate.DeviceToken(func(s *sql.Selector) {
-		s.Where(sql.EQ(s.C(FieldStatus), v))
-	})
+	return predicate.DeviceToken(sql.FieldEQ(FieldStatus, v))
 }
 
 // StatusNEQ applies the NEQ predicate on the "status" field.
 func StatusNEQ(v string) predicate.DeviceToken {
-	return predicate.DeviceToken(func(s *sql.Selector) {
-		s.Where(sql.NEQ(s.C(FieldStatus), v))
-	})
+	return predicate.DeviceToken(sql.FieldNEQ(FieldStatus, v))
 }
 
 // StatusIn applies the In predicate on the "status" field.
 func StatusIn(vs ...string) predicate.DeviceToken {
-	v := make([]interface{}, len(vs))
-	for i := range v {
-		v[i] = vs[i]
-	}
-	return predicate.DeviceToken(func(s *sql.Selector) {
-		s.Where(sql.In(s.C(FieldStatus), v...))
-	})
+	return predicate.DeviceToken(sql.FieldIn(FieldStatus, vs...))
 }
 
 // StatusNotIn applies the NotIn predicate on the "status" field.
 func StatusNotIn(vs ...string) predicate.DeviceToken {
-	v := make([]interface{}, len(vs))
-	for i := range v {
-		v[i] = vs[i]
-	}
-	return predicate.DeviceToken(func(s *sql.Selector) {
-		s.Where(sql.NotIn(s.C(FieldStatus), v...))
-	})
+	return predicate.DeviceToken(sql.FieldNotIn(FieldStatus, vs...))
 }
 
 // StatusGT applies the GT predicate on the "status" field.
 func StatusGT(v string) predicate.DeviceToken {
-	return predicate.DeviceToken(func(s *sql.Selector) {
-		s.Where(sql.GT(s.C(FieldStatus), v))
-	})
+	return predicate.DeviceToken(sql.FieldGT(FieldStatus, v))
 }
 
 // StatusGTE applies the GTE predicate on the "status" field.
 func StatusGTE(v string) predicate.DeviceToken {
-	return predicate.DeviceToken(func(s *sql.Selector) {
-		s.Where(sql.GTE(s.C(FieldStatus), v))
-	})
+	return predicate.DeviceToken(sql.FieldGTE(FieldStatus, v))
 }
 
 // StatusLT applies the LT predicate on the "status" field.
 func StatusLT(v string) predicate.DeviceToken {
-	return predicate.DeviceToken(func(s *sql.Selector) {
-		s.Where(sql.LT(s.C(FieldStatus), v))
-	})
+	return predicate.DeviceToken(sql.FieldLT(FieldStatus, v))
 }
 
 // StatusLTE applies the LTE predicate on the "status" field.
 func StatusLTE(v string) predicate.DeviceToken {
-	return predicate.DeviceToken(func(s *sql.Selector) {
-		s.Where(sql.LTE(s.C(FieldStatus), v))
-	})
+	return predicate.DeviceToken(sql.FieldLTE(FieldStatus, v))
 }
 
 // StatusContains applies the Contains predicate on the "status" field.
 func StatusContains(v string) predicate.DeviceToken {
-	return predicate.DeviceToken(func(s *sql.Selector) {
-		s.Where(sql.Contains(s.C(FieldStatus), v))
-	})
+	return predicate.DeviceToken(sql.FieldContains(FieldStatus, v))
 }
 
 // StatusHasPrefix applies the HasPrefix predicate on the "status" field.
 func StatusHasPrefix(v string) predicate.DeviceToken {
-	return predicate.DeviceToken(func(s *sql.Selector) {
-		s.Where(sql.HasPrefix(s.C(FieldStatus), v))
-	})
+	return predicate.DeviceToken(sql.FieldHasPrefix(FieldStatus, v))
 }
 
 // StatusHasSuffix applies the HasSuffix predicate on the "status" field.
 func StatusHasSuffix(v string) predicate.DeviceToken {
-	return predicate.DeviceToken(func(s *sql.Selector) {
-		s.Where(sql.HasSuffix(s.C(FieldStatus), v))
-	})
+	return predicate.DeviceToken(sql.FieldHasSuffix(FieldStatus, v))
 }
 
 // StatusEqualFold applies the EqualFold predicate on the "status" field.
 func StatusEqualFold(v string) predicate.DeviceToken {
-	return predicate.DeviceToken(func(s *sql.Selector) {
-		s.Where(sql.EqualFold(s.C(FieldStatus), v))
-	})
+	return predicate.DeviceToken(sql.FieldEqualFold(FieldStatus, v))
 }
 
 // StatusContainsFold applies the ContainsFold predicate on the "status" field.
 func StatusContainsFold(v string) predicate.DeviceToken {
-	return predicate.DeviceToken(func(s *sql.Selector) {
-		s.Where(sql.ContainsFold(s.C(FieldStatus), v))
-	})
+	return predicate.DeviceToken(sql.FieldContainsFold(FieldStatus, v))
 }
 
 // TokenEQ applies the EQ predicate on the "token" field.
 func TokenEQ(v []byte) predicate.DeviceToken {
-	return predicate.DeviceToken(func(s *sql.Selector) {
-		s.Where(sql.EQ(s.C(FieldToken), v))
-	})
+	return predicate.DeviceToken(sql.FieldEQ(FieldToken, v))
 }
 
 // TokenNEQ applies the NEQ predicate on the "token" field.
 func TokenNEQ(v []byte) predicate.DeviceToken {
-	return predicate.DeviceToken(func(s *sql.Selector) {
-		s.Where(sql.NEQ(s.C(FieldToken), v))
-	})
+	return predicate.DeviceToken(sql.FieldNEQ(FieldToken, v))
 }
 
 // TokenIn applies the In predicate on the "token" field.
 func TokenIn(vs ...[]byte) predicate.DeviceToken {
-	v := make([]interface{}, len(vs))
-	for i := range v {
-		v[i] = vs[i]
-	}
-	return predicate.DeviceToken(func(s *sql.Selector) {
-		s.Where(sql.In(s.C(FieldToken), v...))
-	})
+	return predicate.DeviceToken(sql.FieldIn(FieldToken, vs...))
 }
 
 // TokenNotIn applies the NotIn predicate on the "token" field.
 func TokenNotIn(vs ...[]byte) predicate.DeviceToken {
-	v := make([]interface{}, len(vs))
-	for i := range v {
-		v[i] = vs[i]
-	}
-	return predicate.DeviceToken(func(s *sql.Selector) {
-		s.Where(sql.NotIn(s.C(FieldToken), v...))
-	})
+	return predicate.DeviceToken(sql.FieldNotIn(FieldToken, vs...))
 }
 
 // TokenGT applies the GT predicate on the "token" field.
 func TokenGT(v []byte) predicate.DeviceToken {
-	return predicate.DeviceToken(func(s *sql.Selector) {
-		s.Where(sql.GT(s.C(FieldToken), v))
-	})
+	return predicate.DeviceToken(sql.FieldGT(FieldToken, v))
 }
 
 // TokenGTE applies the GTE predicate on the "token" field.
 func TokenGTE(v []byte) predicate.DeviceToken {
-	return predicate.DeviceToken(func(s *sql.Selector) {
-		s.Where(sql.GTE(s.C(FieldToken), v))
-	})
+	return predicate.DeviceToken(sql.FieldGTE(FieldToken, v))
 }
 
 // TokenLT applies the LT predicate on the "token" field.
 func TokenLT(v []byte) predicate.DeviceToken {
-	return predicate.DeviceToken(func(s *sql.Selector) {
-		s.Where(sql.LT(s.C(FieldToken), v))
-	})
+	return predicate.DeviceToken(sql.FieldLT(FieldToken, v))
 }
 
 // TokenLTE applies the LTE predicate on the "token" field.
 func TokenLTE(v []byte) predicate.DeviceToken {
-	return predicate.DeviceToken(func(s *sql.Selector) {
-		s.Where(sql.LTE(s.C(FieldToken), v))
-	})
+	return predicate.DeviceToken(sql.FieldLTE(FieldToken, v))
 }
 
 // TokenIsNil applies the IsNil predicate on the "token" field.
 func TokenIsNil() predicate.DeviceToken {
-	return predicate.DeviceToken(func(s *sql.Selector) {
-		s.Where(sql.IsNull(s.C(FieldToken)))
-	})
+	return predicate.DeviceToken(sql.FieldIsNull(FieldToken))
 }
 
 // TokenNotNil applies the NotNil predicate on the "token" field.
 func TokenNotNil() predicate.DeviceToken {
-	return predicate.DeviceToken(func(s *sql.Selector) {
-		s.Where(sql.NotNull(s.C(FieldToken)))
-	})
+	return predicate.DeviceToken(sql.FieldNotNull(FieldToken))
 }
 
 // ExpiryEQ applies the EQ predicate on the "expiry" field.
 func ExpiryEQ(v time.Time) predicate.DeviceToken {
-	return predicate.DeviceToken(func(s *sql.Selector) {
-		s.Where(sql.EQ(s.C(FieldExpiry), v))
-	})
+	return predicate.DeviceToken(sql.FieldEQ(FieldExpiry, v))
 }
 
 // ExpiryNEQ applies the NEQ predicate on the "expiry" field.
 func ExpiryNEQ(v time.Time) predicate.DeviceToken {
-	return predicate.DeviceToken(func(s *sql.Selector) {
-		s.Where(sql.NEQ(s.C(FieldExpiry), v))
-	})
+	return predicate.DeviceToken(sql.FieldNEQ(FieldExpiry, v))
 }
 
 // ExpiryIn applies the In predicate on the "expiry" field.
 func ExpiryIn(vs ...time.Time) predicate.DeviceToken {
-	v := make([]interface{}, len(vs))
-	for i := range v {
-		v[i] = vs[i]
-	}
-	return predicate.DeviceToken(func(s *sql.Selector) {
-		s.Where(sql.In(s.C(FieldExpiry), v...))
-	})
+	return predicate.DeviceToken(sql.FieldIn(FieldExpiry, vs...))
 }
 
 // ExpiryNotIn applies the NotIn predicate on the "expiry" field.
 func ExpiryNotIn(vs ...time.Time) predicate.DeviceToken {
-	v := make([]interface{}, len(vs))
-	for i := range v {
-		v[i] = vs[i]
-	}
-	return predicate.DeviceToken(func(s *sql.Selector) {
-		s.Where(sql.NotIn(s.C(FieldExpiry), v...))
-	})
+	return predicate.DeviceToken(sql.FieldNotIn(FieldExpiry, vs...))
 }
 
 // ExpiryGT applies the GT predicate on the "expiry" field.
 func ExpiryGT(v time.Time) predicate.DeviceToken {
-	return predicate.DeviceToken(func(s *sql.Selector) {
-		s.Where(sql.GT(s.C(FieldExpiry), v))
-	})
+	return predicate.DeviceToken(sql.FieldGT(FieldExpiry, v))
 }
 
 // ExpiryGTE applies the GTE predicate on the "expiry" field.
 func ExpiryGTE(v time.Time) predicate.DeviceToken {
-	return predicate.DeviceToken(func(s *sql.Selector) {
-		s.Where(sql.GTE(s.C(FieldExpiry), v))
-	})
+	return predicate.DeviceToken(sql.FieldGTE(FieldExpiry, v))
 }
 
 // ExpiryLT applies the LT predicate on the "expiry" field.
 func ExpiryLT(v time.Time) predicate.DeviceToken {
-	return predicate.DeviceToken(func(s *sql.Selector) {
-		s.Where(sql.LT(s.C(FieldExpiry), v))
-	})
+	return predicate.DeviceToken(sql.FieldLT(FieldExpiry, v))
 }
 
 // ExpiryLTE applies the LTE predicate on the "expiry" field.
 func ExpiryLTE(v time.Time) predicate.DeviceToken {
-	return predicate.DeviceToken(func(s *sql.Selector) {
-		s.Where(sql.LTE(s.C(FieldExpiry), v))
-	})
+	return predicate.DeviceToken(sql.FieldLTE(FieldExpiry, v))
 }
 
 // LastRequestEQ applies the EQ predicate on the "last_request" field.
 func LastRequestEQ(v time.Time) predicate.DeviceToken {
-	return predicate.DeviceToken(func(s *sql.Selector) {
-		s.Where(sql.EQ(s.C(FieldLastRequest), v))
-	})
+	return predicate.DeviceToken(sql.FieldEQ(FieldLastRequest, v))
 }
 
 // LastRequestNEQ applies the NEQ predicate on the "last_request" field.
 func LastRequestNEQ(v time.Time) predicate.DeviceToken {
-	return predicate.DeviceToken(func(s *sql.Selector) {
-		s.Where(sql.NEQ(s.C(FieldLastRequest), v))
-	})
+	return predicate.DeviceToken(sql.FieldNEQ(FieldLastRequest, v))
 }
 
 // LastRequestIn applies the In predicate on the "last_request" field.
 func LastRequestIn(vs ...time.Time) predicate.DeviceToken {
-	v := make([]interface{}, len(vs))
-	for i := range v {
-		v[i] = vs[i]
-	}
-	return predicate.DeviceToken(func(s *sql.Selector) {
-		s.Where(sql.In(s.C(FieldLastRequest), v...))
-	})
+	return predicate.DeviceToken(sql.FieldIn(FieldLastRequest, vs...))
 }
 
 // LastRequestNotIn applies the NotIn predicate on the "last_request" field.
 func LastRequestNotIn(vs ...time.Time) predicate.DeviceToken {
-	v := make([]interface{}, len(vs))
-	for i := range v {
-		v[i] = vs[i]
-	}
-	return predicate.DeviceToken(func(s *sql.Selector) {
-		s.Where(sql.NotIn(s.C(FieldLastRequest), v...))
-	})
+	return predicate.DeviceToken(sql.FieldNotIn(FieldLastRequest, vs...))
 }
 
 // LastRequestGT applies the GT predicate on the "last_request" field.
 func LastRequestGT(v time.Time) predicate.DeviceToken {
-	return predicate.DeviceToken(func(s *sql.Selector) {
-		s.Where(sql.GT(s.C(FieldLastRequest), v))
-	})
+	return predicate.DeviceToken(sql.FieldGT(FieldLastRequest, v))
 }
 
 // LastRequestGTE applies the GTE predicate on the "last_request" field.
 func LastRequestGTE(v time.Time) predicate.DeviceToken {
-	return predicate.DeviceToken(func(s *sql.Selector) {
-		s.Where(sql.GTE(s.C(FieldLastRequest), v))
-	})
+	return predicate.DeviceToken(sql.FieldGTE(FieldLastRequest, v))
 }
 
 // LastRequestLT applies the LT predicate on the "last_request" field.
 func LastRequestLT(v time.Time) predicate.DeviceToken {
-	return predicate.DeviceToken(func(s *sql.Selector) {
-		s.Where(sql.LT(s.C(FieldLastRequest), v))
-	})
+	return predicate.DeviceToken(sql.FieldLT(FieldLastRequest, v))
 }
 
 // LastRequestLTE applies the LTE predicate on the "last_request" field.
 func LastRequestLTE(v time.Time) predicate.DeviceToken {
-	return predicate.DeviceToken(func(s *sql.Selector) {
-		s.Where(sql.LTE(s.C(FieldLastRequest), v))
-	})
+	return predicate.DeviceToken(sql.FieldLTE(FieldLastRequest, v))
 }
 
 // PollIntervalEQ applies the EQ predicate on the "poll_interval" field.
 func PollIntervalEQ(v int) predicate.DeviceToken {
-	return predicate.DeviceToken(func(s *sql.Selector) {
-		s.Where(sql.EQ(s.C(FieldPollInterval), v))
-	})
+	return predicate.DeviceToken(sql.FieldEQ(FieldPollInterval, v))
 }
 
 // PollIntervalNEQ applies the NEQ predicate on the "poll_interval" field.
 func PollIntervalNEQ(v int) predicate.DeviceToken {
-	return predicate.DeviceToken(func(s *sql.Selector) {
-		s.Where(sql.NEQ(s.C(FieldPollInterval), v))
-	})
+	return predicate.DeviceToken(sql.FieldNEQ(FieldPollInterval, v))
 }
 
 // PollIntervalIn applies the In predicate on the "poll_interval" field.
 func PollIntervalIn(vs ...int) predicate.DeviceToken {
-	v := make([]interface{}, len(vs))
-	for i := range v {
-		v[i] = vs[i]
-	}
-	return predicate.DeviceToken(func(s *sql.Selector) {
-		s.Where(sql.In(s.C(FieldPollInterval), v...))
-	})
+	return predicate.DeviceToken(sql.FieldIn(FieldPollInterval, vs...))
 }
 
 // PollIntervalNotIn applies the NotIn predicate on the "poll_interval" field.
 func PollIntervalNotIn(vs ...int) predicate.DeviceToken {
-	v := make([]interface{}, len(vs))
-	for i := range v {
-		v[i] = vs[i]
-	}
-	return predicate.DeviceToken(func(s *sql.Selector) {
-		s.Where(sql.NotIn(s.C(FieldPollInterval), v...))
-	})
+	return predicate.DeviceToken(sql.FieldNotIn(FieldPollInterval, vs...))
 }
 
 // PollIntervalGT applies the GT predicate on the "poll_interval" field.
 func PollIntervalGT(v int) predicate.DeviceToken {
-	return predicate.DeviceToken(func(s *sql.Selector) {
-		s.Where(sql.GT(s.C(FieldPollInterval), v))
-	})
+	return predicate.DeviceToken(sql.FieldGT(FieldPollInterval, v))
 }
 
 // PollIntervalGTE applies the GTE predicate on the "poll_interval" field.
 func PollIntervalGTE(v int) predicate.DeviceToken {
-	return predicate.DeviceToken(func(s *sql.Selector) {
-		s.Where(sql.GTE(s.C(FieldPollInterval), v))
-	})
+	return predicate.DeviceToken(sql.FieldGTE(FieldPollInterval, v))
 }
 
 // PollIntervalLT applies the LT predicate on the "poll_interval" field.
 func PollIntervalLT(v int) predicate.DeviceToken {
-	return predicate.DeviceToken(func(s *sql.Selector) {
-		s.Where(sql.LT(s.C(FieldPollInterval), v))
-	})
+	return predicate.DeviceToken(sql.FieldLT(FieldPollInterval, v))
 }
 
 // PollIntervalLTE applies the LTE predicate on the "poll_interval" field.
 func PollIntervalLTE(v int) predicate.DeviceToken {
-	return predicate.DeviceToken(func(s *sql.Selector) {
-		s.Where(sql.LTE(s.C(FieldPollInterval), v))
-	})
+	return predicate.DeviceToken(sql.FieldLTE(FieldPollInterval, v))
 }
 
 // CodeChallengeEQ applies the EQ predicate on the "code_challenge" field.
 func CodeChallengeEQ(v string) predicate.DeviceToken {
-	return predicate.DeviceToken(func(s *sql.Selector) {
-		s.Where(sql.EQ(s.C(FieldCodeChallenge), v))
-	})
+	return predicate.DeviceToken(sql.FieldEQ(FieldCodeChallenge, v))
 }
 
 // CodeChallengeNEQ applies the NEQ predicate on the "code_challenge" field.
 func CodeChallengeNEQ(v string) predicate.DeviceToken {
-	return predicate.DeviceToken(func(s *sql.Selector) {
-		s.Where(sql.NEQ(s.C(FieldCodeChallenge), v))
-	})
+	return predicate.DeviceToken(sql.FieldNEQ(FieldCodeChallenge, v))
 }
 
 // CodeChallengeIn applies the In predicate on the "code_challenge" field.
 func CodeChallengeIn(vs ...string) predicate.DeviceToken {
-	v := make([]interface{}, len(vs))
-	for i := range v {
-		v[i] = vs[i]
-	}
-	return predicate.DeviceToken(func(s *sql.Selector) {
-		s.Where(sql.In(s.C(FieldCodeChallenge), v...))
-	})
+	return predicate.DeviceToken(sql.FieldIn(FieldCodeChallenge, vs...))
 }
 
 // CodeChallengeNotIn applies the NotIn predicate on the "code_challenge" field.
 func CodeChallengeNotIn(vs ...string) predicate.DeviceToken {
-	v := make([]interface{}, len(vs))
-	for i := range v {
-		v[i] = vs[i]
-	}
-	return predicate.DeviceToken(func(s *sql.Selector) {
-		s.Where(sql.NotIn(s.C(FieldCodeChallenge), v...))
-	})
+	return predicate.DeviceToken(sql.FieldNotIn(FieldCodeChallenge, vs...))
 }
 
 // CodeChallengeGT applies the GT predicate on the "code_challenge" field.
 func CodeChallengeGT(v string) predicate.DeviceToken {
-	return predicate.DeviceToken(func(s *sql.Selector) {
-		s.Where(sql.GT(s.C(FieldCodeChallenge), v))
-	})
+	return predicate.DeviceToken(sql.FieldGT(FieldCodeChallenge, v))
 }
 
 // CodeChallengeGTE applies the GTE predicate on the "code_challenge" field.
 func CodeChallengeGTE(v string) predicate.DeviceToken {
-	return predicate.DeviceToken(func(s *sql.Selector) {
-		s.Where(sql.GTE(s.C(FieldCodeChallenge), v))
-	})
+	return predicate.DeviceToken(sql.FieldGTE(FieldCodeChallenge, v))
 }
 
 // CodeChallengeLT applies the LT predicate on the "code_challenge" field.
 func CodeChallengeLT(v string) predicate.DeviceToken {
-	return predicate.DeviceToken(func(s *sql.Selector) {
-		s.Where(sql.LT(s.C(FieldCodeChallenge), v))
-	})
+	return predicate.DeviceToken(sql.FieldLT(FieldCodeChallenge, v))
 }
 
 // CodeChallengeLTE applies the LTE predicate on the "code_challenge" field.
 func CodeChallengeLTE(v string) predicate.DeviceToken {
-	return predicate.DeviceToken(func(s *sql.Selector) {
-		s.Where(sql.LTE(s.C(FieldCodeChallenge), v))
-	})
+	return predicate.DeviceToken(sql.FieldLTE(FieldCodeChallenge, v))
 }
 
 // CodeChallengeContains applies the Contains predicate on the "code_challenge" field.
 func CodeChallengeContains(v string) predicate.DeviceToken {
-	return predicate.DeviceToken(func(s *sql.Selector) {
-		s.Where(sql.Contains(s.C(FieldCodeChallenge), v))
-	})
+	return predicate.DeviceToken(sql.FieldContains(FieldCodeChallenge, v))
 }
 
 // CodeChallengeHasPrefix applies the HasPrefix predicate on the "code_challenge" field.
 func CodeChallengeHasPrefix(v string) predicate.DeviceToken {
-	return predicate.DeviceToken(func(s *sql.Selector) {
-		s.Where(sql.HasPrefix(s.C(FieldCodeChallenge), v))
-	})
+	return predicate.DeviceToken(sql.FieldHasPrefix(FieldCodeChallenge, v))
 }
 
 // CodeChallengeHasSuffix applies the HasSuffix predicate on the "code_challenge" field.
 func CodeChallengeHasSuffix(v string) predicate.DeviceToken {
-	return predicate.DeviceToken(func(s *sql.Selector) {
-		s.Where(sql.HasSuffix(s.C(FieldCodeChallenge), v))
-	})
+	return predicate.DeviceToken(sql.FieldHasSuffix(FieldCodeChallenge, v))
 }
 
 // CodeChallengeEqualFold applies the EqualFold predicate on the "code_challenge" field.
 func CodeChallengeEqualFold(v string) predicate.DeviceToken {
-	return predicate.DeviceToken(func(s *sql.Selector) {
-		s.Where(sql.EqualFold(s.C(FieldCodeChallenge), v))
-	})
+	return predicate.DeviceToken(sql.FieldEqualFold(FieldCodeChallenge, v))
 }
 
 // CodeChallengeContainsFold applies the ContainsFold predicate on the "code_challenge" field.
 func CodeChallengeContainsFold(v string) predicate.DeviceToken {
-	return predicate.DeviceToken(func(s *sql.Selector) {
-		s.Where(sql.ContainsFold(s.C(FieldCodeChallenge), v))
-	})
+	return predicate.DeviceToken(sql.FieldContainsFold(FieldCodeChallenge, v))
 }
 
 // CodeChallengeMethodEQ applies the EQ predicate on the "code_challenge_method" field.
 func CodeChallengeMethodEQ(v string) predicate.DeviceToken {
-	return predicate.DeviceToken(func(s *sql.Selector) {
-		s.Where(sql.EQ(s.C(FieldCodeChallengeMethod), v))
-	})
+	return predicate.DeviceToken(sql.FieldEQ(FieldCodeChallengeMethod, v))
 }
 
 // CodeChallengeMethodNEQ applies the NEQ predicate on the "code_challenge_method" field.
 func CodeChallengeMethodNEQ(v string) predicate.DeviceToken {
-	return predicate.DeviceToken(func(s *sql.Selector) {
-		s.Where(sql.NEQ(s.C(FieldCodeChallengeMethod), v))
-	})
+	return predicate.DeviceToken(sql.FieldNEQ(FieldCodeChallengeMethod, v))
 }
 
 // CodeChallengeMethodIn applies the In predicate on the "code_challenge_method" field.
 func CodeChallengeMethodIn(vs ...string) predicate.DeviceToken {
-	v := make([]interface{}, len(vs))
-	for i := range v {
-		v[i] = vs[i]
-	}
-	return predicate.DeviceToken(func(s *sql.Selector) {
-		s.Where(sql.In(s.C(FieldCodeChallengeMethod), v...))
-	})
+	return predicate.DeviceToken(sql.FieldIn(FieldCodeChallengeMethod, vs...))
 }
 
 // CodeChallengeMethodNotIn applies the NotIn predicate on the "code_challenge_method" field.
 func CodeChallengeMethodNotIn(vs ...string) predicate.DeviceToken {
-	v := make([]interface{}, len(vs))
-	for i := range v {
-		v[i] = vs[i]
-	}
-	return predicate.DeviceToken(func(s *sql.Selector) {
-		s.Where(sql.NotIn(s.C(FieldCodeChallengeMethod), v...))
-	})
+	return predicate.DeviceToken(sql.FieldNotIn(FieldCodeChallengeMethod, vs...))
 }
 
 // CodeChallengeMethodGT applies the GT predicate on the "code_challenge_method" field.
 func CodeChallengeMethodGT(v string) predicate.DeviceToken {
-	return predicate.DeviceToken(func(s *sql.Selector) {
-		s.Where(sql.GT(s.C(FieldCodeChallengeMethod), v))
-	})
+	return predicate.DeviceToken(sql.FieldGT(FieldCodeChallengeMethod, v))
 }
 
 // CodeChallengeMethodGTE applies the GTE predicate on the "code_challenge_method" field.
 func CodeChallengeMethodGTE(v string) predicate.DeviceToken {
-	return predicate.DeviceToken(func(s *sql.Selector) {
-		s.Where(sql.GTE(s.C(FieldCodeChallengeMethod), v))
-	})
+	return predicate.DeviceToken(sql.FieldGTE(FieldCodeChallengeMethod, v))
 }
 
 // CodeChallengeMethodLT applies the LT predicate on the "code_challenge_method" field.
 func CodeChallengeMethodLT(v string) predicate.DeviceToken {
-	return predicate.DeviceToken(func(s *sql.Selector) {
-		s.Where(sql.LT(s.C(FieldCodeChallengeMethod), v))
-	})
+	return predicate.DeviceToken(sql.FieldLT(FieldCodeChallengeMethod, v))
 }
 
 // CodeChallengeMethodLTE applies the LTE predicate on the "code_challenge_method" field.
 func CodeChallengeMethodLTE(v string) predicate.DeviceToken {
-	return predicate.DeviceToken(func(s *sql.Selector) {
-		s.Where(sql.LTE(s.C(FieldCodeChallengeMethod), v))
-	})
+	return predicate.DeviceToken(sql.FieldLTE(FieldCodeChallengeMethod, v))
 }
 
 // CodeChallengeMethodContains applies the Contains predicate on the "code_challenge_method" field.
 func CodeChallengeMethodContains(v string) predicate.DeviceToken {
-	return predicate.DeviceToken(func(s *sql.Selector) {
-		s.Where(sql.Contains(s.C(FieldCodeChallengeMethod), v))
-	})
+	return predicate.DeviceToken(sql.FieldContains(FieldCodeChallengeMethod, v))
 }
 
 // CodeChallengeMethodHasPrefix applies the HasPrefix predicate on the "code_challenge_method" field.
 func CodeChallengeMethodHasPrefix(v string) predicate.DeviceToken {
-	return predicate.DeviceToken(func(s *sql.Selector) {
-		s.Where(sql.HasPrefix(s.C(FieldCodeChallengeMethod), v))
-	})
+	return predicate.DeviceToken(sql.FieldHasPrefix(FieldCodeChallengeMethod, v))
 }
 
 // CodeChallengeMethodHasSuffix applies the HasSuffix predicate on the "code_challenge_method" field.
 func CodeChallengeMethodHasSuffix(v string) predicate.DeviceToken {
-	return predicate.DeviceToken(func(s *sql.Selector) {
-		s.Where(sql.HasSuffix(s.C(FieldCodeChallengeMethod), v))
-	})
+	return predicate.DeviceToken(sql.FieldHasSuffix(FieldCodeChallengeMethod, v))
 }
 
 // CodeChallengeMethodEqualFold applies the EqualFold predicate on the "code_challenge_method" field.
 func CodeChallengeMethodEqualFold(v string) predicate.DeviceToken {
-	return predicate.DeviceToken(func(s *sql.Selector) {
-		s.Where(sql.EqualFold(s.C(FieldCodeChallengeMethod), v))
-	})
+	return predicate.DeviceToken(sql.FieldEqualFold(FieldCodeChallengeMethod, v))
 }
 
 // CodeChallengeMethodContainsFold applies the ContainsFold predicate on the "code_challenge_method" field.
 func CodeChallengeMethodContainsFold(v string) predicate.DeviceToken {
-	return predicate.DeviceToken(func(s *sql.Selector) {
-		s.Where(sql.ContainsFold(s.C(FieldCodeChallengeMethod), v))
-	})
+	return predicate.DeviceToken(sql.FieldContainsFold(FieldCodeChallengeMethod, v))
 }
 
 // And groups predicates with the AND operator between them.
 func And(predicates ...predicate.DeviceToken) predicate.DeviceToken {
-	return predicate.DeviceToken(func(s *sql.Selector) {
-		s1 := s.Clone().SetP(nil)
-		for _, p := range predicates {
-			p(s1)
-		}
-		s.Where(s1.P())
-	})
+	return predicate.DeviceToken(sql.AndPredicates(predicates...))
 }
 
 // Or groups predicates with the OR operator between them.
 func Or(predicates ...predicate.DeviceToken) predicate.DeviceToken {
-	return predicate.DeviceToken(func(s *sql.Selector) {
-		s1 := s.Clone().SetP(nil)
-		for i, p := range predicates {
-			if i > 0 {
-				s1.Or()
-			}
-			p(s1)
-		}
-		s.Where(s1.P())
-	})
+	return predicate.DeviceToken(sql.OrPredicates(predicates...))
 }
 
 // Not applies the not operator on the given predicate.
 func Not(p predicate.DeviceToken) predicate.DeviceToken {
-	return predicate.DeviceToken(func(s *sql.Selector) {
-		p(s.Not())
-	})
+	return predicate.DeviceToken(sql.NotPredicates(p))
 }
diff --git a/storage/ent/db/devicetoken_create.go b/storage/ent/db/devicetoken_create.go
index bbf67e5a29..577d475103 100644
--- a/storage/ent/db/devicetoken_create.go
+++ b/storage/ent/db/devicetoken_create.go
@@ -21,125 +21,83 @@ type DeviceTokenCreate struct {
 }
 
 // SetDeviceCode sets the "device_code" field.
-func (dtc *DeviceTokenCreate) SetDeviceCode(s string) *DeviceTokenCreate {
-	dtc.mutation.SetDeviceCode(s)
-	return dtc
+func (_c *DeviceTokenCreate) SetDeviceCode(v string) *DeviceTokenCreate {
+	_c.mutation.SetDeviceCode(v)
+	return _c
 }
 
 // SetStatus sets the "status" field.
-func (dtc *DeviceTokenCreate) SetStatus(s string) *DeviceTokenCreate {
-	dtc.mutation.SetStatus(s)
-	return dtc
+func (_c *DeviceTokenCreate) SetStatus(v string) *DeviceTokenCreate {
+	_c.mutation.SetStatus(v)
+	return _c
 }
 
 // SetToken sets the "token" field.
-func (dtc *DeviceTokenCreate) SetToken(b []byte) *DeviceTokenCreate {
-	dtc.mutation.SetToken(b)
-	return dtc
+func (_c *DeviceTokenCreate) SetToken(v []byte) *DeviceTokenCreate {
+	_c.mutation.SetToken(v)
+	return _c
 }
 
 // SetExpiry sets the "expiry" field.
-func (dtc *DeviceTokenCreate) SetExpiry(t time.Time) *DeviceTokenCreate {
-	dtc.mutation.SetExpiry(t)
-	return dtc
+func (_c *DeviceTokenCreate) SetExpiry(v time.Time) *DeviceTokenCreate {
+	_c.mutation.SetExpiry(v)
+	return _c
 }
 
 // SetLastRequest sets the "last_request" field.
-func (dtc *DeviceTokenCreate) SetLastRequest(t time.Time) *DeviceTokenCreate {
-	dtc.mutation.SetLastRequest(t)
-	return dtc
+func (_c *DeviceTokenCreate) SetLastRequest(v time.Time) *DeviceTokenCreate {
+	_c.mutation.SetLastRequest(v)
+	return _c
 }
 
 // SetPollInterval sets the "poll_interval" field.
-func (dtc *DeviceTokenCreate) SetPollInterval(i int) *DeviceTokenCreate {
-	dtc.mutation.SetPollInterval(i)
-	return dtc
+func (_c *DeviceTokenCreate) SetPollInterval(v int) *DeviceTokenCreate {
+	_c.mutation.SetPollInterval(v)
+	return _c
 }
 
 // SetCodeChallenge sets the "code_challenge" field.
-func (dtc *DeviceTokenCreate) SetCodeChallenge(s string) *DeviceTokenCreate {
-	dtc.mutation.SetCodeChallenge(s)
-	return dtc
+func (_c *DeviceTokenCreate) SetCodeChallenge(v string) *DeviceTokenCreate {
+	_c.mutation.SetCodeChallenge(v)
+	return _c
 }
 
 // SetNillableCodeChallenge sets the "code_challenge" field if the given value is not nil.
-func (dtc *DeviceTokenCreate) SetNillableCodeChallenge(s *string) *DeviceTokenCreate {
-	if s != nil {
-		dtc.SetCodeChallenge(*s)
+func (_c *DeviceTokenCreate) SetNillableCodeChallenge(v *string) *DeviceTokenCreate {
+	if v != nil {
+		_c.SetCodeChallenge(*v)
 	}
-	return dtc
+	return _c
 }
 
 // SetCodeChallengeMethod sets the "code_challenge_method" field.
-func (dtc *DeviceTokenCreate) SetCodeChallengeMethod(s string) *DeviceTokenCreate {
-	dtc.mutation.SetCodeChallengeMethod(s)
-	return dtc
+func (_c *DeviceTokenCreate) SetCodeChallengeMethod(v string) *DeviceTokenCreate {
+	_c.mutation.SetCodeChallengeMethod(v)
+	return _c
 }
 
 // SetNillableCodeChallengeMethod sets the "code_challenge_method" field if the given value is not nil.
-func (dtc *DeviceTokenCreate) SetNillableCodeChallengeMethod(s *string) *DeviceTokenCreate {
-	if s != nil {
-		dtc.SetCodeChallengeMethod(*s)
+func (_c *DeviceTokenCreate) SetNillableCodeChallengeMethod(v *string) *DeviceTokenCreate {
+	if v != nil {
+		_c.SetCodeChallengeMethod(*v)
 	}
-	return dtc
+	return _c
 }
 
 // Mutation returns the DeviceTokenMutation object of the builder.
-func (dtc *DeviceTokenCreate) Mutation() *DeviceTokenMutation {
-	return dtc.mutation
+func (_c *DeviceTokenCreate) Mutation() *DeviceTokenMutation {
+	return _c.mutation
 }
 
 // Save creates the DeviceToken in the database.
-func (dtc *DeviceTokenCreate) Save(ctx context.Context) (*DeviceToken, error) {
-	var (
-		err  error
-		node *DeviceToken
-	)
-	dtc.defaults()
-	if len(dtc.hooks) == 0 {
-		if err = dtc.check(); err != nil {
-			return nil, err
-		}
-		node, err = dtc.sqlSave(ctx)
-	} else {
-		var mut Mutator = MutateFunc(func(ctx context.Context, m Mutation) (Value, error) {
-			mutation, ok := m.(*DeviceTokenMutation)
-			if !ok {
-				return nil, fmt.Errorf("unexpected mutation type %T", m)
-			}
-			if err = dtc.check(); err != nil {
-				return nil, err
-			}
-			dtc.mutation = mutation
-			if node, err = dtc.sqlSave(ctx); err != nil {
-				return nil, err
-			}
-			mutation.id = &node.ID
-			mutation.done = true
-			return node, err
-		})
-		for i := len(dtc.hooks) - 1; i >= 0; i-- {
-			if dtc.hooks[i] == nil {
-				return nil, fmt.Errorf("db: uninitialized hook (forgotten import db/runtime?)")
-			}
-			mut = dtc.hooks[i](mut)
-		}
-		v, err := mut.Mutate(ctx, dtc.mutation)
-		if err != nil {
-			return nil, err
-		}
-		nv, ok := v.(*DeviceToken)
-		if !ok {
-			return nil, fmt.Errorf("unexpected node type %T returned from DeviceTokenMutation", v)
-		}
-		node = nv
-	}
-	return node, err
+func (_c *DeviceTokenCreate) Save(ctx context.Context) (*DeviceToken, error) {
+	_c.defaults()
+	return withHooks(ctx, _c.sqlSave, _c.mutation, _c.hooks)
 }
 
 // SaveX calls Save and panics if Save returns an error.
-func (dtc *DeviceTokenCreate) SaveX(ctx context.Context) *DeviceToken {
-	v, err := dtc.Save(ctx)
+func (_c *DeviceTokenCreate) SaveX(ctx context.Context) *DeviceToken {
+	v, err := _c.Save(ctx)
 	if err != nil {
 		panic(err)
 	}
@@ -147,69 +105,72 @@ func (dtc *DeviceTokenCreate) SaveX(ctx context.Context) *DeviceToken {
 }
 
 // Exec executes the query.
-func (dtc *DeviceTokenCreate) Exec(ctx context.Context) error {
-	_, err := dtc.Save(ctx)
+func (_c *DeviceTokenCreate) Exec(ctx context.Context) error {
+	_, err := _c.Save(ctx)
 	return err
 }
 
 // ExecX is like Exec, but panics if an error occurs.
-func (dtc *DeviceTokenCreate) ExecX(ctx context.Context) {
-	if err := dtc.Exec(ctx); err != nil {
+func (_c *DeviceTokenCreate) ExecX(ctx context.Context) {
+	if err := _c.Exec(ctx); err != nil {
 		panic(err)
 	}
 }
 
 // defaults sets the default values of the builder before save.
-func (dtc *DeviceTokenCreate) defaults() {
-	if _, ok := dtc.mutation.CodeChallenge(); !ok {
+func (_c *DeviceTokenCreate) defaults() {
+	if _, ok := _c.mutation.CodeChallenge(); !ok {
 		v := devicetoken.DefaultCodeChallenge
-		dtc.mutation.SetCodeChallenge(v)
+		_c.mutation.SetCodeChallenge(v)
 	}
-	if _, ok := dtc.mutation.CodeChallengeMethod(); !ok {
+	if _, ok := _c.mutation.CodeChallengeMethod(); !ok {
 		v := devicetoken.DefaultCodeChallengeMethod
-		dtc.mutation.SetCodeChallengeMethod(v)
+		_c.mutation.SetCodeChallengeMethod(v)
 	}
 }
 
 // check runs all checks and user-defined validators on the builder.
-func (dtc *DeviceTokenCreate) check() error {
-	if _, ok := dtc.mutation.DeviceCode(); !ok {
+func (_c *DeviceTokenCreate) check() error {
+	if _, ok := _c.mutation.DeviceCode(); !ok {
 		return &ValidationError{Name: "device_code", err: errors.New(`db: missing required field "DeviceToken.device_code"`)}
 	}
-	if v, ok := dtc.mutation.DeviceCode(); ok {
+	if v, ok := _c.mutation.DeviceCode(); ok {
 		if err := devicetoken.DeviceCodeValidator(v); err != nil {
 			return &ValidationError{Name: "device_code", err: fmt.Errorf(`db: validator failed for field "DeviceToken.device_code": %w`, err)}
 		}
 	}
-	if _, ok := dtc.mutation.Status(); !ok {
+	if _, ok := _c.mutation.Status(); !ok {
 		return &ValidationError{Name: "status", err: errors.New(`db: missing required field "DeviceToken.status"`)}
 	}
-	if v, ok := dtc.mutation.Status(); ok {
+	if v, ok := _c.mutation.Status(); ok {
 		if err := devicetoken.StatusValidator(v); err != nil {
 			return &ValidationError{Name: "status", err: fmt.Errorf(`db: validator failed for field "DeviceToken.status": %w`, err)}
 		}
 	}
-	if _, ok := dtc.mutation.Expiry(); !ok {
+	if _, ok := _c.mutation.Expiry(); !ok {
 		return &ValidationError{Name: "expiry", err: errors.New(`db: missing required field "DeviceToken.expiry"`)}
 	}
-	if _, ok := dtc.mutation.LastRequest(); !ok {
+	if _, ok := _c.mutation.LastRequest(); !ok {
 		return &ValidationError{Name: "last_request", err: errors.New(`db: missing required field "DeviceToken.last_request"`)}
 	}
-	if _, ok := dtc.mutation.PollInterval(); !ok {
+	if _, ok := _c.mutation.PollInterval(); !ok {
 		return &ValidationError{Name: "poll_interval", err: errors.New(`db: missing required field "DeviceToken.poll_interval"`)}
 	}
-	if _, ok := dtc.mutation.CodeChallenge(); !ok {
+	if _, ok := _c.mutation.CodeChallenge(); !ok {
 		return &ValidationError{Name: "code_challenge", err: errors.New(`db: missing required field "DeviceToken.code_challenge"`)}
 	}
-	if _, ok := dtc.mutation.CodeChallengeMethod(); !ok {
+	if _, ok := _c.mutation.CodeChallengeMethod(); !ok {
 		return &ValidationError{Name: "code_challenge_method", err: errors.New(`db: missing required field "DeviceToken.code_challenge_method"`)}
 	}
 	return nil
 }
 
-func (dtc *DeviceTokenCreate) sqlSave(ctx context.Context) (*DeviceToken, error) {
-	_node, _spec := dtc.createSpec()
-	if err := sqlgraph.CreateNode(ctx, dtc.driver, _spec); err != nil {
+func (_c *DeviceTokenCreate) sqlSave(ctx context.Context) (*DeviceToken, error) {
+	if err := _c.check(); err != nil {
+		return nil, err
+	}
+	_node, _spec := _c.createSpec()
+	if err := sqlgraph.CreateNode(ctx, _c.driver, _spec); err != nil {
 		if sqlgraph.IsConstraintError(err) {
 			err = &ConstraintError{msg: err.Error(), wrap: err}
 		}
@@ -217,82 +178,46 @@ func (dtc *DeviceTokenCreate) sqlSave(ctx context.Context) (*DeviceToken, error)
 	}
 	id := _spec.ID.Value.(int64)
 	_node.ID = int(id)
+	_c.mutation.id = &_node.ID
+	_c.mutation.done = true
 	return _node, nil
 }
 
-func (dtc *DeviceTokenCreate) createSpec() (*DeviceToken, *sqlgraph.CreateSpec) {
+func (_c *DeviceTokenCreate) createSpec() (*DeviceToken, *sqlgraph.CreateSpec) {
 	var (
-		_node = &DeviceToken{config: dtc.config}
-		_spec = &sqlgraph.CreateSpec{
-			Table: devicetoken.Table,
-			ID: &sqlgraph.FieldSpec{
-				Type:   field.TypeInt,
-				Column: devicetoken.FieldID,
-			},
-		}
+		_node = &DeviceToken{config: _c.config}
+		_spec = sqlgraph.NewCreateSpec(devicetoken.Table, sqlgraph.NewFieldSpec(devicetoken.FieldID, field.TypeInt))
 	)
-	if value, ok := dtc.mutation.DeviceCode(); ok {
-		_spec.Fields = append(_spec.Fields, &sqlgraph.FieldSpec{
-			Type:   field.TypeString,
-			Value:  value,
-			Column: devicetoken.FieldDeviceCode,
-		})
+	if value, ok := _c.mutation.DeviceCode(); ok {
+		_spec.SetField(devicetoken.FieldDeviceCode, field.TypeString, value)
 		_node.DeviceCode = value
 	}
-	if value, ok := dtc.mutation.Status(); ok {
-		_spec.Fields = append(_spec.Fields, &sqlgraph.FieldSpec{
-			Type:   field.TypeString,
-			Value:  value,
-			Column: devicetoken.FieldStatus,
-		})
+	if value, ok := _c.mutation.Status(); ok {
+		_spec.SetField(devicetoken.FieldStatus, field.TypeString, value)
 		_node.Status = value
 	}
-	if value, ok := dtc.mutation.Token(); ok {
-		_spec.Fields = append(_spec.Fields, &sqlgraph.FieldSpec{
-			Type:   field.TypeBytes,
-			Value:  value,
-			Column: devicetoken.FieldToken,
-		})
+	if value, ok := _c.mutation.Token(); ok {
+		_spec.SetField(devicetoken.FieldToken, field.TypeBytes, value)
 		_node.Token = &value
 	}
-	if value, ok := dtc.mutation.Expiry(); ok {
-		_spec.Fields = append(_spec.Fields, &sqlgraph.FieldSpec{
-			Type:   field.TypeTime,
-			Value:  value,
-			Column: devicetoken.FieldExpiry,
-		})
+	if value, ok := _c.mutation.Expiry(); ok {
+		_spec.SetField(devicetoken.FieldExpiry, field.TypeTime, value)
 		_node.Expiry = value
 	}
-	if value, ok := dtc.mutation.LastRequest(); ok {
-		_spec.Fields = append(_spec.Fields, &sqlgraph.FieldSpec{
-			Type:   field.TypeTime,
-			Value:  value,
-			Column: devicetoken.FieldLastRequest,
-		})
+	if value, ok := _c.mutation.LastRequest(); ok {
+		_spec.SetField(devicetoken.FieldLastRequest, field.TypeTime, value)
 		_node.LastRequest = value
 	}
-	if value, ok := dtc.mutation.PollInterval(); ok {
-		_spec.Fields = append(_spec.Fields, &sqlgraph.FieldSpec{
-			Type:   field.TypeInt,
-			Value:  value,
-			Column: devicetoken.FieldPollInterval,
-		})
+	if value, ok := _c.mutation.PollInterval(); ok {
+		_spec.SetField(devicetoken.FieldPollInterval, field.TypeInt, value)
 		_node.PollInterval = value
 	}
-	if value, ok := dtc.mutation.CodeChallenge(); ok {
-		_spec.Fields = append(_spec.Fields, &sqlgraph.FieldSpec{
-			Type:   field.TypeString,
-			Value:  value,
-			Column: devicetoken.FieldCodeChallenge,
-		})
+	if value, ok := _c.mutation.CodeChallenge(); ok {
+		_spec.SetField(devicetoken.FieldCodeChallenge, field.TypeString, value)
 		_node.CodeChallenge = value
 	}
-	if value, ok := dtc.mutation.CodeChallengeMethod(); ok {
-		_spec.Fields = append(_spec.Fields, &sqlgraph.FieldSpec{
-			Type:   field.TypeString,
-			Value:  value,
-			Column: devicetoken.FieldCodeChallengeMethod,
-		})
+	if value, ok := _c.mutation.CodeChallengeMethod(); ok {
+		_spec.SetField(devicetoken.FieldCodeChallengeMethod, field.TypeString, value)
 		_node.CodeChallengeMethod = value
 	}
 	return _node, _spec
@@ -301,17 +226,21 @@ func (dtc *DeviceTokenCreate) createSpec() (*DeviceToken, *sqlgraph.CreateSpec)
 // DeviceTokenCreateBulk is the builder for creating many DeviceToken entities in bulk.
 type DeviceTokenCreateBulk struct {
 	config
+	err      error
 	builders []*DeviceTokenCreate
 }
 
 // Save creates the DeviceToken entities in the database.
-func (dtcb *DeviceTokenCreateBulk) Save(ctx context.Context) ([]*DeviceToken, error) {
-	specs := make([]*sqlgraph.CreateSpec, len(dtcb.builders))
-	nodes := make([]*DeviceToken, len(dtcb.builders))
-	mutators := make([]Mutator, len(dtcb.builders))
-	for i := range dtcb.builders {
+func (_c *DeviceTokenCreateBulk) Save(ctx context.Context) ([]*DeviceToken, error) {
+	if _c.err != nil {
+		return nil, _c.err
+	}
+	specs := make([]*sqlgraph.CreateSpec, len(_c.builders))
+	nodes := make([]*DeviceToken, len(_c.builders))
+	mutators := make([]Mutator, len(_c.builders))
+	for i := range _c.builders {
 		func(i int, root context.Context) {
-			builder := dtcb.builders[i]
+			builder := _c.builders[i]
 			builder.defaults()
 			var mut Mutator = MutateFunc(func(ctx context.Context, m Mutation) (Value, error) {
 				mutation, ok := m.(*DeviceTokenMutation)
@@ -322,14 +251,14 @@ func (dtcb *DeviceTokenCreateBulk) Save(ctx context.Context) ([]*DeviceToken, er
 					return nil, err
 				}
 				builder.mutation = mutation
-				nodes[i], specs[i] = builder.createSpec()
 				var err error
+				nodes[i], specs[i] = builder.createSpec()
 				if i < len(mutators)-1 {
-					_, err = mutators[i+1].Mutate(root, dtcb.builders[i+1].mutation)
+					_, err = mutators[i+1].Mutate(root, _c.builders[i+1].mutation)
 				} else {
 					spec := &sqlgraph.BatchCreateSpec{Nodes: specs}
 					// Invoke the actual operation on the latest mutation in the chain.
-					if err = sqlgraph.BatchCreate(ctx, dtcb.driver, spec); err != nil {
+					if err = sqlgraph.BatchCreate(ctx, _c.driver, spec); err != nil {
 						if sqlgraph.IsConstraintError(err) {
 							err = &ConstraintError{msg: err.Error(), wrap: err}
 						}
@@ -353,7 +282,7 @@ func (dtcb *DeviceTokenCreateBulk) Save(ctx context.Context) ([]*DeviceToken, er
 		}(i, ctx)
 	}
 	if len(mutators) > 0 {
-		if _, err := mutators[0].Mutate(ctx, dtcb.builders[0].mutation); err != nil {
+		if _, err := mutators[0].Mutate(ctx, _c.builders[0].mutation); err != nil {
 			return nil, err
 		}
 	}
@@ -361,8 +290,8 @@ func (dtcb *DeviceTokenCreateBulk) Save(ctx context.Context) ([]*DeviceToken, er
 }
 
 // SaveX is like Save, but panics if an error occurs.
-func (dtcb *DeviceTokenCreateBulk) SaveX(ctx context.Context) []*DeviceToken {
-	v, err := dtcb.Save(ctx)
+func (_c *DeviceTokenCreateBulk) SaveX(ctx context.Context) []*DeviceToken {
+	v, err := _c.Save(ctx)
 	if err != nil {
 		panic(err)
 	}
@@ -370,14 +299,14 @@ func (dtcb *DeviceTokenCreateBulk) SaveX(ctx context.Context) []*DeviceToken {
 }
 
 // Exec executes the query.
-func (dtcb *DeviceTokenCreateBulk) Exec(ctx context.Context) error {
-	_, err := dtcb.Save(ctx)
+func (_c *DeviceTokenCreateBulk) Exec(ctx context.Context) error {
+	_, err := _c.Save(ctx)
 	return err
 }
 
 // ExecX is like Exec, but panics if an error occurs.
-func (dtcb *DeviceTokenCreateBulk) ExecX(ctx context.Context) {
-	if err := dtcb.Exec(ctx); err != nil {
+func (_c *DeviceTokenCreateBulk) ExecX(ctx context.Context) {
+	if err := _c.Exec(ctx); err != nil {
 		panic(err)
 	}
 }
diff --git a/storage/ent/db/devicetoken_delete.go b/storage/ent/db/devicetoken_delete.go
index 3c196aac09..02acd31454 100644
--- a/storage/ent/db/devicetoken_delete.go
+++ b/storage/ent/db/devicetoken_delete.go
@@ -4,7 +4,6 @@ package db
 
 import (
 	"context"
-	"fmt"
 
 	"entgo.io/ent/dialect/sql"
 	"entgo.io/ent/dialect/sql/sqlgraph"
@@ -21,84 +20,56 @@ type DeviceTokenDelete struct {
 }
 
 // Where appends a list predicates to the DeviceTokenDelete builder.
-func (dtd *DeviceTokenDelete) Where(ps ...predicate.DeviceToken) *DeviceTokenDelete {
-	dtd.mutation.Where(ps...)
-	return dtd
+func (_d *DeviceTokenDelete) Where(ps ...predicate.DeviceToken) *DeviceTokenDelete {
+	_d.mutation.Where(ps...)
+	return _d
 }
 
 // Exec executes the deletion query and returns how many vertices were deleted.
-func (dtd *DeviceTokenDelete) Exec(ctx context.Context) (int, error) {
-	var (
-		err      error
-		affected int
-	)
-	if len(dtd.hooks) == 0 {
-		affected, err = dtd.sqlExec(ctx)
-	} else {
-		var mut Mutator = MutateFunc(func(ctx context.Context, m Mutation) (Value, error) {
-			mutation, ok := m.(*DeviceTokenMutation)
-			if !ok {
-				return nil, fmt.Errorf("unexpected mutation type %T", m)
-			}
-			dtd.mutation = mutation
-			affected, err = dtd.sqlExec(ctx)
-			mutation.done = true
-			return affected, err
-		})
-		for i := len(dtd.hooks) - 1; i >= 0; i-- {
-			if dtd.hooks[i] == nil {
-				return 0, fmt.Errorf("db: uninitialized hook (forgotten import db/runtime?)")
-			}
-			mut = dtd.hooks[i](mut)
-		}
-		if _, err := mut.Mutate(ctx, dtd.mutation); err != nil {
-			return 0, err
-		}
-	}
-	return affected, err
+func (_d *DeviceTokenDelete) Exec(ctx context.Context) (int, error) {
+	return withHooks(ctx, _d.sqlExec, _d.mutation, _d.hooks)
 }
 
 // ExecX is like Exec, but panics if an error occurs.
-func (dtd *DeviceTokenDelete) ExecX(ctx context.Context) int {
-	n, err := dtd.Exec(ctx)
+func (_d *DeviceTokenDelete) ExecX(ctx context.Context) int {
+	n, err := _d.Exec(ctx)
 	if err != nil {
 		panic(err)
 	}
 	return n
 }
 
-func (dtd *DeviceTokenDelete) sqlExec(ctx context.Context) (int, error) {
-	_spec := &sqlgraph.DeleteSpec{
-		Node: &sqlgraph.NodeSpec{
-			Table: devicetoken.Table,
-			ID: &sqlgraph.FieldSpec{
-				Type:   field.TypeInt,
-				Column: devicetoken.FieldID,
-			},
-		},
-	}
-	if ps := dtd.mutation.predicates; len(ps) > 0 {
+func (_d *DeviceTokenDelete) sqlExec(ctx context.Context) (int, error) {
+	_spec := sqlgraph.NewDeleteSpec(devicetoken.Table, sqlgraph.NewFieldSpec(devicetoken.FieldID, field.TypeInt))
+	if ps := _d.mutation.predicates; len(ps) > 0 {
 		_spec.Predicate = func(selector *sql.Selector) {
 			for i := range ps {
 				ps[i](selector)
 			}
 		}
 	}
-	affected, err := sqlgraph.DeleteNodes(ctx, dtd.driver, _spec)
+	affected, err := sqlgraph.DeleteNodes(ctx, _d.driver, _spec)
 	if err != nil && sqlgraph.IsConstraintError(err) {
 		err = &ConstraintError{msg: err.Error(), wrap: err}
 	}
+	_d.mutation.done = true
 	return affected, err
 }
 
 // DeviceTokenDeleteOne is the builder for deleting a single DeviceToken entity.
 type DeviceTokenDeleteOne struct {
-	dtd *DeviceTokenDelete
+	_d *DeviceTokenDelete
+}
+
+// Where appends a list predicates to the DeviceTokenDelete builder.
+func (_d *DeviceTokenDeleteOne) Where(ps ...predicate.DeviceToken) *DeviceTokenDeleteOne {
+	_d._d.mutation.Where(ps...)
+	return _d
 }
 
 // Exec executes the deletion query.
-func (dtdo *DeviceTokenDeleteOne) Exec(ctx context.Context) error {
-	n, err := dtdo.dtd.Exec(ctx)
+func (_d *DeviceTokenDeleteOne) Exec(ctx context.Context) error {
+	n, err := _d._d.Exec(ctx)
 	switch {
 	case err != nil:
 		return err
@@ -110,6 +81,8 @@ func (dtdo *DeviceTokenDeleteOne) Exec(ctx context.Context) error {
 }
 
 // ExecX is like Exec, but panics if an error occurs.
-func (dtdo *DeviceTokenDeleteOne) ExecX(ctx context.Context) {
-	dtdo.dtd.ExecX(ctx)
+func (_d *DeviceTokenDeleteOne) ExecX(ctx context.Context) {
+	if err := _d.Exec(ctx); err != nil {
+		panic(err)
+	}
 }
diff --git a/storage/ent/db/devicetoken_query.go b/storage/ent/db/devicetoken_query.go
index 1860a841ad..af910afdc6 100644
--- a/storage/ent/db/devicetoken_query.go
+++ b/storage/ent/db/devicetoken_query.go
@@ -7,6 +7,7 @@ import (
 	"fmt"
 	"math"
 
+	"entgo.io/ent"
 	"entgo.io/ent/dialect/sql"
 	"entgo.io/ent/dialect/sql/sqlgraph"
 	"entgo.io/ent/schema/field"
@@ -17,11 +18,9 @@ import (
 // DeviceTokenQuery is the builder for querying DeviceToken entities.
 type DeviceTokenQuery struct {
 	config
-	limit      *int
-	offset     *int
-	unique     *bool
-	order      []OrderFunc
-	fields     []string
+	ctx        *QueryContext
+	order      []devicetoken.OrderOption
+	inters     []Interceptor
 	predicates []predicate.DeviceToken
 	// intermediate query (i.e. traversal path).
 	sql  *sql.Selector
@@ -29,40 +28,40 @@ type DeviceTokenQuery struct {
 }
 
 // Where adds a new predicate for the DeviceTokenQuery builder.
-func (dtq *DeviceTokenQuery) Where(ps ...predicate.DeviceToken) *DeviceTokenQuery {
-	dtq.predicates = append(dtq.predicates, ps...)
-	return dtq
+func (_q *DeviceTokenQuery) Where(ps ...predicate.DeviceToken) *DeviceTokenQuery {
+	_q.predicates = append(_q.predicates, ps...)
+	return _q
 }
 
-// Limit adds a limit step to the query.
-func (dtq *DeviceTokenQuery) Limit(limit int) *DeviceTokenQuery {
-	dtq.limit = &limit
-	return dtq
+// Limit the number of records to be returned by this query.
+func (_q *DeviceTokenQuery) Limit(limit int) *DeviceTokenQuery {
+	_q.ctx.Limit = &limit
+	return _q
 }
 
-// Offset adds an offset step to the query.
-func (dtq *DeviceTokenQuery) Offset(offset int) *DeviceTokenQuery {
-	dtq.offset = &offset
-	return dtq
+// Offset to start from.
+func (_q *DeviceTokenQuery) Offset(offset int) *DeviceTokenQuery {
+	_q.ctx.Offset = &offset
+	return _q
 }
 
 // Unique configures the query builder to filter duplicate records on query.
 // By default, unique is set to true, and can be disabled using this method.
-func (dtq *DeviceTokenQuery) Unique(unique bool) *DeviceTokenQuery {
-	dtq.unique = &unique
-	return dtq
+func (_q *DeviceTokenQuery) Unique(unique bool) *DeviceTokenQuery {
+	_q.ctx.Unique = &unique
+	return _q
 }
 
-// Order adds an order step to the query.
-func (dtq *DeviceTokenQuery) Order(o ...OrderFunc) *DeviceTokenQuery {
-	dtq.order = append(dtq.order, o...)
-	return dtq
+// Order specifies how the records should be ordered.
+func (_q *DeviceTokenQuery) Order(o ...devicetoken.OrderOption) *DeviceTokenQuery {
+	_q.order = append(_q.order, o...)
+	return _q
 }
 
 // First returns the first DeviceToken entity from the query.
 // Returns a *NotFoundError when no DeviceToken was found.
-func (dtq *DeviceTokenQuery) First(ctx context.Context) (*DeviceToken, error) {
-	nodes, err := dtq.Limit(1).All(ctx)
+func (_q *DeviceTokenQuery) First(ctx context.Context) (*DeviceToken, error) {
+	nodes, err := _q.Limit(1).All(setContextOp(ctx, _q.ctx, ent.OpQueryFirst))
 	if err != nil {
 		return nil, err
 	}
@@ -73,8 +72,8 @@ func (dtq *DeviceTokenQuery) First(ctx context.Context) (*DeviceToken, error) {
 }
 
 // FirstX is like First, but panics if an error occurs.
-func (dtq *DeviceTokenQuery) FirstX(ctx context.Context) *DeviceToken {
-	node, err := dtq.First(ctx)
+func (_q *DeviceTokenQuery) FirstX(ctx context.Context) *DeviceToken {
+	node, err := _q.First(ctx)
 	if err != nil && !IsNotFound(err) {
 		panic(err)
 	}
@@ -83,9 +82,9 @@ func (dtq *DeviceTokenQuery) FirstX(ctx context.Context) *DeviceToken {
 
 // FirstID returns the first DeviceToken ID from the query.
 // Returns a *NotFoundError when no DeviceToken ID was found.
-func (dtq *DeviceTokenQuery) FirstID(ctx context.Context) (id int, err error) {
+func (_q *DeviceTokenQuery) FirstID(ctx context.Context) (id int, err error) {
 	var ids []int
-	if ids, err = dtq.Limit(1).IDs(ctx); err != nil {
+	if ids, err = _q.Limit(1).IDs(setContextOp(ctx, _q.ctx, ent.OpQueryFirstID)); err != nil {
 		return
 	}
 	if len(ids) == 0 {
@@ -96,8 +95,8 @@ func (dtq *DeviceTokenQuery) FirstID(ctx context.Context) (id int, err error) {
 }
 
 // FirstIDX is like FirstID, but panics if an error occurs.
-func (dtq *DeviceTokenQuery) FirstIDX(ctx context.Context) int {
-	id, err := dtq.FirstID(ctx)
+func (_q *DeviceTokenQuery) FirstIDX(ctx context.Context) int {
+	id, err := _q.FirstID(ctx)
 	if err != nil && !IsNotFound(err) {
 		panic(err)
 	}
@@ -107,8 +106,8 @@ func (dtq *DeviceTokenQuery) FirstIDX(ctx context.Context) int {
 // Only returns a single DeviceToken entity found by the query, ensuring it only returns one.
 // Returns a *NotSingularError when more than one DeviceToken entity is found.
 // Returns a *NotFoundError when no DeviceToken entities are found.
-func (dtq *DeviceTokenQuery) Only(ctx context.Context) (*DeviceToken, error) {
-	nodes, err := dtq.Limit(2).All(ctx)
+func (_q *DeviceTokenQuery) Only(ctx context.Context) (*DeviceToken, error) {
+	nodes, err := _q.Limit(2).All(setContextOp(ctx, _q.ctx, ent.OpQueryOnly))
 	if err != nil {
 		return nil, err
 	}
@@ -123,8 +122,8 @@ func (dtq *DeviceTokenQuery) Only(ctx context.Context) (*DeviceToken, error) {
 }
 
 // OnlyX is like Only, but panics if an error occurs.
-func (dtq *DeviceTokenQuery) OnlyX(ctx context.Context) *DeviceToken {
-	node, err := dtq.Only(ctx)
+func (_q *DeviceTokenQuery) OnlyX(ctx context.Context) *DeviceToken {
+	node, err := _q.Only(ctx)
 	if err != nil {
 		panic(err)
 	}
@@ -134,9 +133,9 @@ func (dtq *DeviceTokenQuery) OnlyX(ctx context.Context) *DeviceToken {
 // OnlyID is like Only, but returns the only DeviceToken ID in the query.
 // Returns a *NotSingularError when more than one DeviceToken ID is found.
 // Returns a *NotFoundError when no entities are found.
-func (dtq *DeviceTokenQuery) OnlyID(ctx context.Context) (id int, err error) {
+func (_q *DeviceTokenQuery) OnlyID(ctx context.Context) (id int, err error) {
 	var ids []int
-	if ids, err = dtq.Limit(2).IDs(ctx); err != nil {
+	if ids, err = _q.Limit(2).IDs(setContextOp(ctx, _q.ctx, ent.OpQueryOnlyID)); err != nil {
 		return
 	}
 	switch len(ids) {
@@ -151,8 +150,8 @@ func (dtq *DeviceTokenQuery) OnlyID(ctx context.Context) (id int, err error) {
 }
 
 // OnlyIDX is like OnlyID, but panics if an error occurs.
-func (dtq *DeviceTokenQuery) OnlyIDX(ctx context.Context) int {
-	id, err := dtq.OnlyID(ctx)
+func (_q *DeviceTokenQuery) OnlyIDX(ctx context.Context) int {
+	id, err := _q.OnlyID(ctx)
 	if err != nil {
 		panic(err)
 	}
@@ -160,16 +159,18 @@ func (dtq *DeviceTokenQuery) OnlyIDX(ctx context.Context) int {
 }
 
 // All executes the query and returns a list of DeviceTokens.
-func (dtq *DeviceTokenQuery) All(ctx context.Context) ([]*DeviceToken, error) {
-	if err := dtq.prepareQuery(ctx); err != nil {
+func (_q *DeviceTokenQuery) All(ctx context.Context) ([]*DeviceToken, error) {
+	ctx = setContextOp(ctx, _q.ctx, ent.OpQueryAll)
+	if err := _q.prepareQuery(ctx); err != nil {
 		return nil, err
 	}
-	return dtq.sqlAll(ctx)
+	qr := querierAll[[]*DeviceToken, *DeviceTokenQuery]()
+	return withInterceptors[[]*DeviceToken](ctx, _q, qr, _q.inters)
 }
 
 // AllX is like All, but panics if an error occurs.
-func (dtq *DeviceTokenQuery) AllX(ctx context.Context) []*DeviceToken {
-	nodes, err := dtq.All(ctx)
+func (_q *DeviceTokenQuery) AllX(ctx context.Context) []*DeviceToken {
+	nodes, err := _q.All(ctx)
 	if err != nil {
 		panic(err)
 	}
@@ -177,17 +178,20 @@ func (dtq *DeviceTokenQuery) AllX(ctx context.Context) []*DeviceToken {
 }
 
 // IDs executes the query and returns a list of DeviceToken IDs.
-func (dtq *DeviceTokenQuery) IDs(ctx context.Context) ([]int, error) {
-	var ids []int
-	if err := dtq.Select(devicetoken.FieldID).Scan(ctx, &ids); err != nil {
+func (_q *DeviceTokenQuery) IDs(ctx context.Context) (ids []int, err error) {
+	if _q.ctx.Unique == nil && _q.path != nil {
+		_q.Unique(true)
+	}
+	ctx = setContextOp(ctx, _q.ctx, ent.OpQueryIDs)
+	if err = _q.Select(devicetoken.FieldID).Scan(ctx, &ids); err != nil {
 		return nil, err
 	}
 	return ids, nil
 }
 
 // IDsX is like IDs, but panics if an error occurs.
-func (dtq *DeviceTokenQuery) IDsX(ctx context.Context) []int {
-	ids, err := dtq.IDs(ctx)
+func (_q *DeviceTokenQuery) IDsX(ctx context.Context) []int {
+	ids, err := _q.IDs(ctx)
 	if err != nil {
 		panic(err)
 	}
@@ -195,16 +199,17 @@ func (dtq *DeviceTokenQuery) IDsX(ctx context.Context) []int {
 }
 
 // Count returns the count of the given query.
-func (dtq *DeviceTokenQuery) Count(ctx context.Context) (int, error) {
-	if err := dtq.prepareQuery(ctx); err != nil {
+func (_q *DeviceTokenQuery) Count(ctx context.Context) (int, error) {
+	ctx = setContextOp(ctx, _q.ctx, ent.OpQueryCount)
+	if err := _q.prepareQuery(ctx); err != nil {
 		return 0, err
 	}
-	return dtq.sqlCount(ctx)
+	return withInterceptors[int](ctx, _q, querierCount[*DeviceTokenQuery](), _q.inters)
 }
 
 // CountX is like Count, but panics if an error occurs.
-func (dtq *DeviceTokenQuery) CountX(ctx context.Context) int {
-	count, err := dtq.Count(ctx)
+func (_q *DeviceTokenQuery) CountX(ctx context.Context) int {
+	count, err := _q.Count(ctx)
 	if err != nil {
 		panic(err)
 	}
@@ -212,16 +217,21 @@ func (dtq *DeviceTokenQuery) CountX(ctx context.Context) int {
 }
 
 // Exist returns true if the query has elements in the graph.
-func (dtq *DeviceTokenQuery) Exist(ctx context.Context) (bool, error) {
-	if err := dtq.prepareQuery(ctx); err != nil {
-		return false, err
+func (_q *DeviceTokenQuery) Exist(ctx context.Context) (bool, error) {
+	ctx = setContextOp(ctx, _q.ctx, ent.OpQueryExist)
+	switch _, err := _q.FirstID(ctx); {
+	case IsNotFound(err):
+		return false, nil
+	case err != nil:
+		return false, fmt.Errorf("db: check existence: %w", err)
+	default:
+		return true, nil
 	}
-	return dtq.sqlExist(ctx)
 }
 
 // ExistX is like Exist, but panics if an error occurs.
-func (dtq *DeviceTokenQuery) ExistX(ctx context.Context) bool {
-	exist, err := dtq.Exist(ctx)
+func (_q *DeviceTokenQuery) ExistX(ctx context.Context) bool {
+	exist, err := _q.Exist(ctx)
 	if err != nil {
 		panic(err)
 	}
@@ -230,20 +240,19 @@ func (dtq *DeviceTokenQuery) ExistX(ctx context.Context) bool {
 
 // Clone returns a duplicate of the DeviceTokenQuery builder, including all associated steps. It can be
 // used to prepare common query builders and use them differently after the clone is made.
-func (dtq *DeviceTokenQuery) Clone() *DeviceTokenQuery {
-	if dtq == nil {
+func (_q *DeviceTokenQuery) Clone() *DeviceTokenQuery {
+	if _q == nil {
 		return nil
 	}
 	return &DeviceTokenQuery{
-		config:     dtq.config,
-		limit:      dtq.limit,
-		offset:     dtq.offset,
-		order:      append([]OrderFunc{}, dtq.order...),
-		predicates: append([]predicate.DeviceToken{}, dtq.predicates...),
+		config:     _q.config,
+		ctx:        _q.ctx.Clone(),
+		order:      append([]devicetoken.OrderOption{}, _q.order...),
+		inters:     append([]Interceptor{}, _q.inters...),
+		predicates: append([]predicate.DeviceToken{}, _q.predicates...),
 		// clone intermediate query.
-		sql:    dtq.sql.Clone(),
-		path:   dtq.path,
-		unique: dtq.unique,
+		sql:  _q.sql.Clone(),
+		path: _q.path,
 	}
 }
 
@@ -261,18 +270,12 @@ func (dtq *DeviceTokenQuery) Clone() *DeviceTokenQuery {
 //		GroupBy(devicetoken.FieldDeviceCode).
 //		Aggregate(db.Count()).
 //		Scan(ctx, &v)
-//
-func (dtq *DeviceTokenQuery) GroupBy(field string, fields ...string) *DeviceTokenGroupBy {
-	grbuild := &DeviceTokenGroupBy{config: dtq.config}
-	grbuild.fields = append([]string{field}, fields...)
-	grbuild.path = func(ctx context.Context) (prev *sql.Selector, err error) {
-		if err := dtq.prepareQuery(ctx); err != nil {
-			return nil, err
-		}
-		return dtq.sqlQuery(ctx), nil
-	}
+func (_q *DeviceTokenQuery) GroupBy(field string, fields ...string) *DeviceTokenGroupBy {
+	_q.ctx.Fields = append([]string{field}, fields...)
+	grbuild := &DeviceTokenGroupBy{build: _q}
+	grbuild.flds = &_q.ctx.Fields
 	grbuild.label = devicetoken.Label
-	grbuild.flds, grbuild.scan = &grbuild.fields, grbuild.Scan
+	grbuild.scan = grbuild.Scan
 	return grbuild
 }
 
@@ -288,48 +291,62 @@ func (dtq *DeviceTokenQuery) GroupBy(field string, fields ...string) *DeviceToke
 //	client.DeviceToken.Query().
 //		Select(devicetoken.FieldDeviceCode).
 //		Scan(ctx, &v)
-//
-func (dtq *DeviceTokenQuery) Select(fields ...string) *DeviceTokenSelect {
-	dtq.fields = append(dtq.fields, fields...)
-	selbuild := &DeviceTokenSelect{DeviceTokenQuery: dtq}
-	selbuild.label = devicetoken.Label
-	selbuild.flds, selbuild.scan = &dtq.fields, selbuild.Scan
-	return selbuild
+func (_q *DeviceTokenQuery) Select(fields ...string) *DeviceTokenSelect {
+	_q.ctx.Fields = append(_q.ctx.Fields, fields...)
+	sbuild := &DeviceTokenSelect{DeviceTokenQuery: _q}
+	sbuild.label = devicetoken.Label
+	sbuild.flds, sbuild.scan = &_q.ctx.Fields, sbuild.Scan
+	return sbuild
+}
+
+// Aggregate returns a DeviceTokenSelect configured with the given aggregations.
+func (_q *DeviceTokenQuery) Aggregate(fns ...AggregateFunc) *DeviceTokenSelect {
+	return _q.Select().Aggregate(fns...)
 }
 
-func (dtq *DeviceTokenQuery) prepareQuery(ctx context.Context) error {
-	for _, f := range dtq.fields {
+func (_q *DeviceTokenQuery) prepareQuery(ctx context.Context) error {
+	for _, inter := range _q.inters {
+		if inter == nil {
+			return fmt.Errorf("db: uninitialized interceptor (forgotten import db/runtime?)")
+		}
+		if trv, ok := inter.(Traverser); ok {
+			if err := trv.Traverse(ctx, _q); err != nil {
+				return err
+			}
+		}
+	}
+	for _, f := range _q.ctx.Fields {
 		if !devicetoken.ValidColumn(f) {
 			return &ValidationError{Name: f, err: fmt.Errorf("db: invalid field %q for query", f)}
 		}
 	}
-	if dtq.path != nil {
-		prev, err := dtq.path(ctx)
+	if _q.path != nil {
+		prev, err := _q.path(ctx)
 		if err != nil {
 			return err
 		}
-		dtq.sql = prev
+		_q.sql = prev
 	}
 	return nil
 }
 
-func (dtq *DeviceTokenQuery) sqlAll(ctx context.Context, hooks ...queryHook) ([]*DeviceToken, error) {
+func (_q *DeviceTokenQuery) sqlAll(ctx context.Context, hooks ...queryHook) ([]*DeviceToken, error) {
 	var (
 		nodes = []*DeviceToken{}
-		_spec = dtq.querySpec()
+		_spec = _q.querySpec()
 	)
-	_spec.ScanValues = func(columns []string) ([]interface{}, error) {
+	_spec.ScanValues = func(columns []string) ([]any, error) {
 		return (*DeviceToken).scanValues(nil, columns)
 	}
-	_spec.Assign = func(columns []string, values []interface{}) error {
-		node := &DeviceToken{config: dtq.config}
+	_spec.Assign = func(columns []string, values []any) error {
+		node := &DeviceToken{config: _q.config}
 		nodes = append(nodes, node)
 		return node.assignValues(columns, values)
 	}
 	for i := range hooks {
 		hooks[i](ctx, _spec)
 	}
-	if err := sqlgraph.QueryNodes(ctx, dtq.driver, _spec); err != nil {
+	if err := sqlgraph.QueryNodes(ctx, _q.driver, _spec); err != nil {
 		return nil, err
 	}
 	if len(nodes) == 0 {
@@ -338,40 +355,24 @@ func (dtq *DeviceTokenQuery) sqlAll(ctx context.Context, hooks ...queryHook) ([]
 	return nodes, nil
 }
 
-func (dtq *DeviceTokenQuery) sqlCount(ctx context.Context) (int, error) {
-	_spec := dtq.querySpec()
-	_spec.Node.Columns = dtq.fields
-	if len(dtq.fields) > 0 {
-		_spec.Unique = dtq.unique != nil && *dtq.unique
-	}
-	return sqlgraph.CountNodes(ctx, dtq.driver, _spec)
-}
-
-func (dtq *DeviceTokenQuery) sqlExist(ctx context.Context) (bool, error) {
-	n, err := dtq.sqlCount(ctx)
-	if err != nil {
-		return false, fmt.Errorf("db: check existence: %w", err)
+func (_q *DeviceTokenQuery) sqlCount(ctx context.Context) (int, error) {
+	_spec := _q.querySpec()
+	_spec.Node.Columns = _q.ctx.Fields
+	if len(_q.ctx.Fields) > 0 {
+		_spec.Unique = _q.ctx.Unique != nil && *_q.ctx.Unique
 	}
-	return n > 0, nil
+	return sqlgraph.CountNodes(ctx, _q.driver, _spec)
 }
 
-func (dtq *DeviceTokenQuery) querySpec() *sqlgraph.QuerySpec {
-	_spec := &sqlgraph.QuerySpec{
-		Node: &sqlgraph.NodeSpec{
-			Table:   devicetoken.Table,
-			Columns: devicetoken.Columns,
-			ID: &sqlgraph.FieldSpec{
-				Type:   field.TypeInt,
-				Column: devicetoken.FieldID,
-			},
-		},
-		From:   dtq.sql,
-		Unique: true,
-	}
-	if unique := dtq.unique; unique != nil {
+func (_q *DeviceTokenQuery) querySpec() *sqlgraph.QuerySpec {
+	_spec := sqlgraph.NewQuerySpec(devicetoken.Table, devicetoken.Columns, sqlgraph.NewFieldSpec(devicetoken.FieldID, field.TypeInt))
+	_spec.From = _q.sql
+	if unique := _q.ctx.Unique; unique != nil {
 		_spec.Unique = *unique
+	} else if _q.path != nil {
+		_spec.Unique = true
 	}
-	if fields := dtq.fields; len(fields) > 0 {
+	if fields := _q.ctx.Fields; len(fields) > 0 {
 		_spec.Node.Columns = make([]string, 0, len(fields))
 		_spec.Node.Columns = append(_spec.Node.Columns, devicetoken.FieldID)
 		for i := range fields {
@@ -380,20 +381,20 @@ func (dtq *DeviceTokenQuery) querySpec() *sqlgraph.QuerySpec {
 			}
 		}
 	}
-	if ps := dtq.predicates; len(ps) > 0 {
+	if ps := _q.predicates; len(ps) > 0 {
 		_spec.Predicate = func(selector *sql.Selector) {
 			for i := range ps {
 				ps[i](selector)
 			}
 		}
 	}
-	if limit := dtq.limit; limit != nil {
+	if limit := _q.ctx.Limit; limit != nil {
 		_spec.Limit = *limit
 	}
-	if offset := dtq.offset; offset != nil {
+	if offset := _q.ctx.Offset; offset != nil {
 		_spec.Offset = *offset
 	}
-	if ps := dtq.order; len(ps) > 0 {
+	if ps := _q.order; len(ps) > 0 {
 		_spec.Order = func(selector *sql.Selector) {
 			for i := range ps {
 				ps[i](selector)
@@ -403,33 +404,33 @@ func (dtq *DeviceTokenQuery) querySpec() *sqlgraph.QuerySpec {
 	return _spec
 }
 
-func (dtq *DeviceTokenQuery) sqlQuery(ctx context.Context) *sql.Selector {
-	builder := sql.Dialect(dtq.driver.Dialect())
+func (_q *DeviceTokenQuery) sqlQuery(ctx context.Context) *sql.Selector {
+	builder := sql.Dialect(_q.driver.Dialect())
 	t1 := builder.Table(devicetoken.Table)
-	columns := dtq.fields
+	columns := _q.ctx.Fields
 	if len(columns) == 0 {
 		columns = devicetoken.Columns
 	}
 	selector := builder.Select(t1.Columns(columns...)...).From(t1)
-	if dtq.sql != nil {
-		selector = dtq.sql
+	if _q.sql != nil {
+		selector = _q.sql
 		selector.Select(selector.Columns(columns...)...)
 	}
-	if dtq.unique != nil && *dtq.unique {
+	if _q.ctx.Unique != nil && *_q.ctx.Unique {
 		selector.Distinct()
 	}
-	for _, p := range dtq.predicates {
+	for _, p := range _q.predicates {
 		p(selector)
 	}
-	for _, p := range dtq.order {
+	for _, p := range _q.order {
 		p(selector)
 	}
-	if offset := dtq.offset; offset != nil {
+	if offset := _q.ctx.Offset; offset != nil {
 		// limit is mandatory for offset clause. We start
 		// with default value, and override it below if needed.
 		selector.Offset(*offset).Limit(math.MaxInt32)
 	}
-	if limit := dtq.limit; limit != nil {
+	if limit := _q.ctx.Limit; limit != nil {
 		selector.Limit(*limit)
 	}
 	return selector
@@ -437,90 +438,88 @@ func (dtq *DeviceTokenQuery) sqlQuery(ctx context.Context) *sql.Selector {
 
 // DeviceTokenGroupBy is the group-by builder for DeviceToken entities.
 type DeviceTokenGroupBy struct {
-	config
 	selector
-	fields []string
-	fns    []AggregateFunc
-	// intermediate query (i.e. traversal path).
-	sql  *sql.Selector
-	path func(context.Context) (*sql.Selector, error)
+	build *DeviceTokenQuery
 }
 
 // Aggregate adds the given aggregation functions to the group-by query.
-func (dtgb *DeviceTokenGroupBy) Aggregate(fns ...AggregateFunc) *DeviceTokenGroupBy {
-	dtgb.fns = append(dtgb.fns, fns...)
-	return dtgb
+func (_g *DeviceTokenGroupBy) Aggregate(fns ...AggregateFunc) *DeviceTokenGroupBy {
+	_g.fns = append(_g.fns, fns...)
+	return _g
 }
 
-// Scan applies the group-by query and scans the result into the given value.
-func (dtgb *DeviceTokenGroupBy) Scan(ctx context.Context, v interface{}) error {
-	query, err := dtgb.path(ctx)
-	if err != nil {
+// Scan applies the selector query and scans the result into the given value.
+func (_g *DeviceTokenGroupBy) Scan(ctx context.Context, v any) error {
+	ctx = setContextOp(ctx, _g.build.ctx, ent.OpQueryGroupBy)
+	if err := _g.build.prepareQuery(ctx); err != nil {
 		return err
 	}
-	dtgb.sql = query
-	return dtgb.sqlScan(ctx, v)
+	return scanWithInterceptors[*DeviceTokenQuery, *DeviceTokenGroupBy](ctx, _g.build, _g, _g.build.inters, v)
 }
 
-func (dtgb *DeviceTokenGroupBy) sqlScan(ctx context.Context, v interface{}) error {
-	for _, f := range dtgb.fields {
-		if !devicetoken.ValidColumn(f) {
-			return &ValidationError{Name: f, err: fmt.Errorf("invalid field %q for group-by", f)}
+func (_g *DeviceTokenGroupBy) sqlScan(ctx context.Context, root *DeviceTokenQuery, v any) error {
+	selector := root.sqlQuery(ctx).Select()
+	aggregation := make([]string, 0, len(_g.fns))
+	for _, fn := range _g.fns {
+		aggregation = append(aggregation, fn(selector))
+	}
+	if len(selector.SelectedColumns()) == 0 {
+		columns := make([]string, 0, len(*_g.flds)+len(_g.fns))
+		for _, f := range *_g.flds {
+			columns = append(columns, selector.C(f))
 		}
+		columns = append(columns, aggregation...)
+		selector.Select(columns...)
 	}
-	selector := dtgb.sqlQuery()
+	selector.GroupBy(selector.Columns(*_g.flds...)...)
 	if err := selector.Err(); err != nil {
 		return err
 	}
 	rows := &sql.Rows{}
 	query, args := selector.Query()
-	if err := dtgb.driver.Query(ctx, query, args, rows); err != nil {
+	if err := _g.build.driver.Query(ctx, query, args, rows); err != nil {
 		return err
 	}
 	defer rows.Close()
 	return sql.ScanSlice(rows, v)
 }
 
-func (dtgb *DeviceTokenGroupBy) sqlQuery() *sql.Selector {
-	selector := dtgb.sql.Select()
-	aggregation := make([]string, 0, len(dtgb.fns))
-	for _, fn := range dtgb.fns {
-		aggregation = append(aggregation, fn(selector))
-	}
-	// If no columns were selected in a custom aggregation function, the default
-	// selection is the fields used for "group-by", and the aggregation functions.
-	if len(selector.SelectedColumns()) == 0 {
-		columns := make([]string, 0, len(dtgb.fields)+len(dtgb.fns))
-		for _, f := range dtgb.fields {
-			columns = append(columns, selector.C(f))
-		}
-		columns = append(columns, aggregation...)
-		selector.Select(columns...)
-	}
-	return selector.GroupBy(selector.Columns(dtgb.fields...)...)
-}
-
 // DeviceTokenSelect is the builder for selecting fields of DeviceToken entities.
 type DeviceTokenSelect struct {
 	*DeviceTokenQuery
 	selector
-	// intermediate query (i.e. traversal path).
-	sql *sql.Selector
+}
+
+// Aggregate adds the given aggregation functions to the selector query.
+func (_s *DeviceTokenSelect) Aggregate(fns ...AggregateFunc) *DeviceTokenSelect {
+	_s.fns = append(_s.fns, fns...)
+	return _s
 }
 
 // Scan applies the selector query and scans the result into the given value.
-func (dts *DeviceTokenSelect) Scan(ctx context.Context, v interface{}) error {
-	if err := dts.prepareQuery(ctx); err != nil {
+func (_s *DeviceTokenSelect) Scan(ctx context.Context, v any) error {
+	ctx = setContextOp(ctx, _s.ctx, ent.OpQuerySelect)
+	if err := _s.prepareQuery(ctx); err != nil {
 		return err
 	}
-	dts.sql = dts.DeviceTokenQuery.sqlQuery(ctx)
-	return dts.sqlScan(ctx, v)
+	return scanWithInterceptors[*DeviceTokenQuery, *DeviceTokenSelect](ctx, _s.DeviceTokenQuery, _s, _s.inters, v)
 }
 
-func (dts *DeviceTokenSelect) sqlScan(ctx context.Context, v interface{}) error {
+func (_s *DeviceTokenSelect) sqlScan(ctx context.Context, root *DeviceTokenQuery, v any) error {
+	selector := root.sqlQuery(ctx)
+	aggregation := make([]string, 0, len(_s.fns))
+	for _, fn := range _s.fns {
+		aggregation = append(aggregation, fn(selector))
+	}
+	switch n := len(*_s.selector.flds); {
+	case n == 0 && len(aggregation) > 0:
+		selector.Select(aggregation...)
+	case n != 0 && len(aggregation) > 0:
+		selector.AppendSelect(aggregation...)
+	}
 	rows := &sql.Rows{}
-	query, args := dts.sql.Query()
-	if err := dts.driver.Query(ctx, query, args, rows); err != nil {
+	query, args := selector.Query()
+	if err := _s.driver.Query(ctx, query, args, rows); err != nil {
 		return err
 	}
 	defer rows.Close()
diff --git a/storage/ent/db/devicetoken_update.go b/storage/ent/db/devicetoken_update.go
index cc0b92f5ba..024beb35d1 100644
--- a/storage/ent/db/devicetoken_update.go
+++ b/storage/ent/db/devicetoken_update.go
@@ -23,134 +23,141 @@ type DeviceTokenUpdate struct {
 }
 
 // Where appends a list predicates to the DeviceTokenUpdate builder.
-func (dtu *DeviceTokenUpdate) Where(ps ...predicate.DeviceToken) *DeviceTokenUpdate {
-	dtu.mutation.Where(ps...)
-	return dtu
+func (_u *DeviceTokenUpdate) Where(ps ...predicate.DeviceToken) *DeviceTokenUpdate {
+	_u.mutation.Where(ps...)
+	return _u
 }
 
 // SetDeviceCode sets the "device_code" field.
-func (dtu *DeviceTokenUpdate) SetDeviceCode(s string) *DeviceTokenUpdate {
-	dtu.mutation.SetDeviceCode(s)
-	return dtu
+func (_u *DeviceTokenUpdate) SetDeviceCode(v string) *DeviceTokenUpdate {
+	_u.mutation.SetDeviceCode(v)
+	return _u
+}
+
+// SetNillableDeviceCode sets the "device_code" field if the given value is not nil.
+func (_u *DeviceTokenUpdate) SetNillableDeviceCode(v *string) *DeviceTokenUpdate {
+	if v != nil {
+		_u.SetDeviceCode(*v)
+	}
+	return _u
 }
 
 // SetStatus sets the "status" field.
-func (dtu *DeviceTokenUpdate) SetStatus(s string) *DeviceTokenUpdate {
-	dtu.mutation.SetStatus(s)
-	return dtu
+func (_u *DeviceTokenUpdate) SetStatus(v string) *DeviceTokenUpdate {
+	_u.mutation.SetStatus(v)
+	return _u
+}
+
+// SetNillableStatus sets the "status" field if the given value is not nil.
+func (_u *DeviceTokenUpdate) SetNillableStatus(v *string) *DeviceTokenUpdate {
+	if v != nil {
+		_u.SetStatus(*v)
+	}
+	return _u
 }
 
 // SetToken sets the "token" field.
-func (dtu *DeviceTokenUpdate) SetToken(b []byte) *DeviceTokenUpdate {
-	dtu.mutation.SetToken(b)
-	return dtu
+func (_u *DeviceTokenUpdate) SetToken(v []byte) *DeviceTokenUpdate {
+	_u.mutation.SetToken(v)
+	return _u
 }
 
 // ClearToken clears the value of the "token" field.
-func (dtu *DeviceTokenUpdate) ClearToken() *DeviceTokenUpdate {
-	dtu.mutation.ClearToken()
-	return dtu
+func (_u *DeviceTokenUpdate) ClearToken() *DeviceTokenUpdate {
+	_u.mutation.ClearToken()
+	return _u
 }
 
 // SetExpiry sets the "expiry" field.
-func (dtu *DeviceTokenUpdate) SetExpiry(t time.Time) *DeviceTokenUpdate {
-	dtu.mutation.SetExpiry(t)
-	return dtu
+func (_u *DeviceTokenUpdate) SetExpiry(v time.Time) *DeviceTokenUpdate {
+	_u.mutation.SetExpiry(v)
+	return _u
+}
+
+// SetNillableExpiry sets the "expiry" field if the given value is not nil.
+func (_u *DeviceTokenUpdate) SetNillableExpiry(v *time.Time) *DeviceTokenUpdate {
+	if v != nil {
+		_u.SetExpiry(*v)
+	}
+	return _u
 }
 
 // SetLastRequest sets the "last_request" field.
-func (dtu *DeviceTokenUpdate) SetLastRequest(t time.Time) *DeviceTokenUpdate {
-	dtu.mutation.SetLastRequest(t)
-	return dtu
+func (_u *DeviceTokenUpdate) SetLastRequest(v time.Time) *DeviceTokenUpdate {
+	_u.mutation.SetLastRequest(v)
+	return _u
+}
+
+// SetNillableLastRequest sets the "last_request" field if the given value is not nil.
+func (_u *DeviceTokenUpdate) SetNillableLastRequest(v *time.Time) *DeviceTokenUpdate {
+	if v != nil {
+		_u.SetLastRequest(*v)
+	}
+	return _u
 }
 
 // SetPollInterval sets the "poll_interval" field.
-func (dtu *DeviceTokenUpdate) SetPollInterval(i int) *DeviceTokenUpdate {
-	dtu.mutation.ResetPollInterval()
-	dtu.mutation.SetPollInterval(i)
-	return dtu
+func (_u *DeviceTokenUpdate) SetPollInterval(v int) *DeviceTokenUpdate {
+	_u.mutation.ResetPollInterval()
+	_u.mutation.SetPollInterval(v)
+	return _u
 }
 
-// AddPollInterval adds i to the "poll_interval" field.
-func (dtu *DeviceTokenUpdate) AddPollInterval(i int) *DeviceTokenUpdate {
-	dtu.mutation.AddPollInterval(i)
-	return dtu
+// SetNillablePollInterval sets the "poll_interval" field if the given value is not nil.
+func (_u *DeviceTokenUpdate) SetNillablePollInterval(v *int) *DeviceTokenUpdate {
+	if v != nil {
+		_u.SetPollInterval(*v)
+	}
+	return _u
+}
+
+// AddPollInterval adds value to the "poll_interval" field.
+func (_u *DeviceTokenUpdate) AddPollInterval(v int) *DeviceTokenUpdate {
+	_u.mutation.AddPollInterval(v)
+	return _u
 }
 
 // SetCodeChallenge sets the "code_challenge" field.
-func (dtu *DeviceTokenUpdate) SetCodeChallenge(s string) *DeviceTokenUpdate {
-	dtu.mutation.SetCodeChallenge(s)
-	return dtu
+func (_u *DeviceTokenUpdate) SetCodeChallenge(v string) *DeviceTokenUpdate {
+	_u.mutation.SetCodeChallenge(v)
+	return _u
 }
 
 // SetNillableCodeChallenge sets the "code_challenge" field if the given value is not nil.
-func (dtu *DeviceTokenUpdate) SetNillableCodeChallenge(s *string) *DeviceTokenUpdate {
-	if s != nil {
-		dtu.SetCodeChallenge(*s)
+func (_u *DeviceTokenUpdate) SetNillableCodeChallenge(v *string) *DeviceTokenUpdate {
+	if v != nil {
+		_u.SetCodeChallenge(*v)
 	}
-	return dtu
+	return _u
 }
 
 // SetCodeChallengeMethod sets the "code_challenge_method" field.
-func (dtu *DeviceTokenUpdate) SetCodeChallengeMethod(s string) *DeviceTokenUpdate {
-	dtu.mutation.SetCodeChallengeMethod(s)
-	return dtu
+func (_u *DeviceTokenUpdate) SetCodeChallengeMethod(v string) *DeviceTokenUpdate {
+	_u.mutation.SetCodeChallengeMethod(v)
+	return _u
 }
 
 // SetNillableCodeChallengeMethod sets the "code_challenge_method" field if the given value is not nil.
-func (dtu *DeviceTokenUpdate) SetNillableCodeChallengeMethod(s *string) *DeviceTokenUpdate {
-	if s != nil {
-		dtu.SetCodeChallengeMethod(*s)
+func (_u *DeviceTokenUpdate) SetNillableCodeChallengeMethod(v *string) *DeviceTokenUpdate {
+	if v != nil {
+		_u.SetCodeChallengeMethod(*v)
 	}
-	return dtu
+	return _u
 }
 
 // Mutation returns the DeviceTokenMutation object of the builder.
-func (dtu *DeviceTokenUpdate) Mutation() *DeviceTokenMutation {
-	return dtu.mutation
+func (_u *DeviceTokenUpdate) Mutation() *DeviceTokenMutation {
+	return _u.mutation
 }
 
 // Save executes the query and returns the number of nodes affected by the update operation.
-func (dtu *DeviceTokenUpdate) Save(ctx context.Context) (int, error) {
-	var (
-		err      error
-		affected int
-	)
-	if len(dtu.hooks) == 0 {
-		if err = dtu.check(); err != nil {
-			return 0, err
-		}
-		affected, err = dtu.sqlSave(ctx)
-	} else {
-		var mut Mutator = MutateFunc(func(ctx context.Context, m Mutation) (Value, error) {
-			mutation, ok := m.(*DeviceTokenMutation)
-			if !ok {
-				return nil, fmt.Errorf("unexpected mutation type %T", m)
-			}
-			if err = dtu.check(); err != nil {
-				return 0, err
-			}
-			dtu.mutation = mutation
-			affected, err = dtu.sqlSave(ctx)
-			mutation.done = true
-			return affected, err
-		})
-		for i := len(dtu.hooks) - 1; i >= 0; i-- {
-			if dtu.hooks[i] == nil {
-				return 0, fmt.Errorf("db: uninitialized hook (forgotten import db/runtime?)")
-			}
-			mut = dtu.hooks[i](mut)
-		}
-		if _, err := mut.Mutate(ctx, dtu.mutation); err != nil {
-			return 0, err
-		}
-	}
-	return affected, err
+func (_u *DeviceTokenUpdate) Save(ctx context.Context) (int, error) {
+	return withHooks(ctx, _u.sqlSave, _u.mutation, _u.hooks)
 }
 
 // SaveX is like Save, but panics if an error occurs.
-func (dtu *DeviceTokenUpdate) SaveX(ctx context.Context) int {
-	affected, err := dtu.Save(ctx)
+func (_u *DeviceTokenUpdate) SaveX(ctx context.Context) int {
+	affected, err := _u.Save(ctx)
 	if err != nil {
 		panic(err)
 	}
@@ -158,26 +165,26 @@ func (dtu *DeviceTokenUpdate) SaveX(ctx context.Context) int {
 }
 
 // Exec executes the query.
-func (dtu *DeviceTokenUpdate) Exec(ctx context.Context) error {
-	_, err := dtu.Save(ctx)
+func (_u *DeviceTokenUpdate) Exec(ctx context.Context) error {
+	_, err := _u.Save(ctx)
 	return err
 }
 
 // ExecX is like Exec, but panics if an error occurs.
-func (dtu *DeviceTokenUpdate) ExecX(ctx context.Context) {
-	if err := dtu.Exec(ctx); err != nil {
+func (_u *DeviceTokenUpdate) ExecX(ctx context.Context) {
+	if err := _u.Exec(ctx); err != nil {
 		panic(err)
 	}
 }
 
 // check runs all checks and user-defined validators on the builder.
-func (dtu *DeviceTokenUpdate) check() error {
-	if v, ok := dtu.mutation.DeviceCode(); ok {
+func (_u *DeviceTokenUpdate) check() error {
+	if v, ok := _u.mutation.DeviceCode(); ok {
 		if err := devicetoken.DeviceCodeValidator(v); err != nil {
 			return &ValidationError{Name: "device_code", err: fmt.Errorf(`db: validator failed for field "DeviceToken.device_code": %w`, err)}
 		}
 	}
-	if v, ok := dtu.mutation.Status(); ok {
+	if v, ok := _u.mutation.Status(); ok {
 		if err := devicetoken.StatusValidator(v); err != nil {
 			return &ValidationError{Name: "status", err: fmt.Errorf(`db: validator failed for field "DeviceToken.status": %w`, err)}
 		}
@@ -185,94 +192,49 @@ func (dtu *DeviceTokenUpdate) check() error {
 	return nil
 }
 
-func (dtu *DeviceTokenUpdate) sqlSave(ctx context.Context) (n int, err error) {
-	_spec := &sqlgraph.UpdateSpec{
-		Node: &sqlgraph.NodeSpec{
-			Table:   devicetoken.Table,
-			Columns: devicetoken.Columns,
-			ID: &sqlgraph.FieldSpec{
-				Type:   field.TypeInt,
-				Column: devicetoken.FieldID,
-			},
-		},
+func (_u *DeviceTokenUpdate) sqlSave(ctx context.Context) (_node int, err error) {
+	if err := _u.check(); err != nil {
+		return _node, err
 	}
-	if ps := dtu.mutation.predicates; len(ps) > 0 {
+	_spec := sqlgraph.NewUpdateSpec(devicetoken.Table, devicetoken.Columns, sqlgraph.NewFieldSpec(devicetoken.FieldID, field.TypeInt))
+	if ps := _u.mutation.predicates; len(ps) > 0 {
 		_spec.Predicate = func(selector *sql.Selector) {
 			for i := range ps {
 				ps[i](selector)
 			}
 		}
 	}
-	if value, ok := dtu.mutation.DeviceCode(); ok {
-		_spec.Fields.Set = append(_spec.Fields.Set, &sqlgraph.FieldSpec{
-			Type:   field.TypeString,
-			Value:  value,
-			Column: devicetoken.FieldDeviceCode,
-		})
-	}
-	if value, ok := dtu.mutation.Status(); ok {
-		_spec.Fields.Set = append(_spec.Fields.Set, &sqlgraph.FieldSpec{
-			Type:   field.TypeString,
-			Value:  value,
-			Column: devicetoken.FieldStatus,
-		})
-	}
-	if value, ok := dtu.mutation.Token(); ok {
-		_spec.Fields.Set = append(_spec.Fields.Set, &sqlgraph.FieldSpec{
-			Type:   field.TypeBytes,
-			Value:  value,
-			Column: devicetoken.FieldToken,
-		})
-	}
-	if dtu.mutation.TokenCleared() {
-		_spec.Fields.Clear = append(_spec.Fields.Clear, &sqlgraph.FieldSpec{
-			Type:   field.TypeBytes,
-			Column: devicetoken.FieldToken,
-		})
-	}
-	if value, ok := dtu.mutation.Expiry(); ok {
-		_spec.Fields.Set = append(_spec.Fields.Set, &sqlgraph.FieldSpec{
-			Type:   field.TypeTime,
-			Value:  value,
-			Column: devicetoken.FieldExpiry,
-		})
-	}
-	if value, ok := dtu.mutation.LastRequest(); ok {
-		_spec.Fields.Set = append(_spec.Fields.Set, &sqlgraph.FieldSpec{
-			Type:   field.TypeTime,
-			Value:  value,
-			Column: devicetoken.FieldLastRequest,
-		})
-	}
-	if value, ok := dtu.mutation.PollInterval(); ok {
-		_spec.Fields.Set = append(_spec.Fields.Set, &sqlgraph.FieldSpec{
-			Type:   field.TypeInt,
-			Value:  value,
-			Column: devicetoken.FieldPollInterval,
-		})
-	}
-	if value, ok := dtu.mutation.AddedPollInterval(); ok {
-		_spec.Fields.Add = append(_spec.Fields.Add, &sqlgraph.FieldSpec{
-			Type:   field.TypeInt,
-			Value:  value,
-			Column: devicetoken.FieldPollInterval,
-		})
-	}
-	if value, ok := dtu.mutation.CodeChallenge(); ok {
-		_spec.Fields.Set = append(_spec.Fields.Set, &sqlgraph.FieldSpec{
-			Type:   field.TypeString,
-			Value:  value,
-			Column: devicetoken.FieldCodeChallenge,
-		})
-	}
-	if value, ok := dtu.mutation.CodeChallengeMethod(); ok {
-		_spec.Fields.Set = append(_spec.Fields.Set, &sqlgraph.FieldSpec{
-			Type:   field.TypeString,
-			Value:  value,
-			Column: devicetoken.FieldCodeChallengeMethod,
-		})
-	}
-	if n, err = sqlgraph.UpdateNodes(ctx, dtu.driver, _spec); err != nil {
+	if value, ok := _u.mutation.DeviceCode(); ok {
+		_spec.SetField(devicetoken.FieldDeviceCode, field.TypeString, value)
+	}
+	if value, ok := _u.mutation.Status(); ok {
+		_spec.SetField(devicetoken.FieldStatus, field.TypeString, value)
+	}
+	if value, ok := _u.mutation.Token(); ok {
+		_spec.SetField(devicetoken.FieldToken, field.TypeBytes, value)
+	}
+	if _u.mutation.TokenCleared() {
+		_spec.ClearField(devicetoken.FieldToken, field.TypeBytes)
+	}
+	if value, ok := _u.mutation.Expiry(); ok {
+		_spec.SetField(devicetoken.FieldExpiry, field.TypeTime, value)
+	}
+	if value, ok := _u.mutation.LastRequest(); ok {
+		_spec.SetField(devicetoken.FieldLastRequest, field.TypeTime, value)
+	}
+	if value, ok := _u.mutation.PollInterval(); ok {
+		_spec.SetField(devicetoken.FieldPollInterval, field.TypeInt, value)
+	}
+	if value, ok := _u.mutation.AddedPollInterval(); ok {
+		_spec.AddField(devicetoken.FieldPollInterval, field.TypeInt, value)
+	}
+	if value, ok := _u.mutation.CodeChallenge(); ok {
+		_spec.SetField(devicetoken.FieldCodeChallenge, field.TypeString, value)
+	}
+	if value, ok := _u.mutation.CodeChallengeMethod(); ok {
+		_spec.SetField(devicetoken.FieldCodeChallengeMethod, field.TypeString, value)
+	}
+	if _node, err = sqlgraph.UpdateNodes(ctx, _u.driver, _spec); err != nil {
 		if _, ok := err.(*sqlgraph.NotFoundError); ok {
 			err = &NotFoundError{devicetoken.Label}
 		} else if sqlgraph.IsConstraintError(err) {
@@ -280,7 +242,8 @@ func (dtu *DeviceTokenUpdate) sqlSave(ctx context.Context) (n int, err error) {
 		}
 		return 0, err
 	}
-	return n, nil
+	_u.mutation.done = true
+	return _node, nil
 }
 
 // DeviceTokenUpdateOne is the builder for updating a single DeviceToken entity.
@@ -292,141 +255,148 @@ type DeviceTokenUpdateOne struct {
 }
 
 // SetDeviceCode sets the "device_code" field.
-func (dtuo *DeviceTokenUpdateOne) SetDeviceCode(s string) *DeviceTokenUpdateOne {
-	dtuo.mutation.SetDeviceCode(s)
-	return dtuo
+func (_u *DeviceTokenUpdateOne) SetDeviceCode(v string) *DeviceTokenUpdateOne {
+	_u.mutation.SetDeviceCode(v)
+	return _u
+}
+
+// SetNillableDeviceCode sets the "device_code" field if the given value is not nil.
+func (_u *DeviceTokenUpdateOne) SetNillableDeviceCode(v *string) *DeviceTokenUpdateOne {
+	if v != nil {
+		_u.SetDeviceCode(*v)
+	}
+	return _u
 }
 
 // SetStatus sets the "status" field.
-func (dtuo *DeviceTokenUpdateOne) SetStatus(s string) *DeviceTokenUpdateOne {
-	dtuo.mutation.SetStatus(s)
-	return dtuo
+func (_u *DeviceTokenUpdateOne) SetStatus(v string) *DeviceTokenUpdateOne {
+	_u.mutation.SetStatus(v)
+	return _u
+}
+
+// SetNillableStatus sets the "status" field if the given value is not nil.
+func (_u *DeviceTokenUpdateOne) SetNillableStatus(v *string) *DeviceTokenUpdateOne {
+	if v != nil {
+		_u.SetStatus(*v)
+	}
+	return _u
 }
 
 // SetToken sets the "token" field.
-func (dtuo *DeviceTokenUpdateOne) SetToken(b []byte) *DeviceTokenUpdateOne {
-	dtuo.mutation.SetToken(b)
-	return dtuo
+func (_u *DeviceTokenUpdateOne) SetToken(v []byte) *DeviceTokenUpdateOne {
+	_u.mutation.SetToken(v)
+	return _u
 }
 
 // ClearToken clears the value of the "token" field.
-func (dtuo *DeviceTokenUpdateOne) ClearToken() *DeviceTokenUpdateOne {
-	dtuo.mutation.ClearToken()
-	return dtuo
+func (_u *DeviceTokenUpdateOne) ClearToken() *DeviceTokenUpdateOne {
+	_u.mutation.ClearToken()
+	return _u
 }
 
 // SetExpiry sets the "expiry" field.
-func (dtuo *DeviceTokenUpdateOne) SetExpiry(t time.Time) *DeviceTokenUpdateOne {
-	dtuo.mutation.SetExpiry(t)
-	return dtuo
+func (_u *DeviceTokenUpdateOne) SetExpiry(v time.Time) *DeviceTokenUpdateOne {
+	_u.mutation.SetExpiry(v)
+	return _u
+}
+
+// SetNillableExpiry sets the "expiry" field if the given value is not nil.
+func (_u *DeviceTokenUpdateOne) SetNillableExpiry(v *time.Time) *DeviceTokenUpdateOne {
+	if v != nil {
+		_u.SetExpiry(*v)
+	}
+	return _u
 }
 
 // SetLastRequest sets the "last_request" field.
-func (dtuo *DeviceTokenUpdateOne) SetLastRequest(t time.Time) *DeviceTokenUpdateOne {
-	dtuo.mutation.SetLastRequest(t)
-	return dtuo
+func (_u *DeviceTokenUpdateOne) SetLastRequest(v time.Time) *DeviceTokenUpdateOne {
+	_u.mutation.SetLastRequest(v)
+	return _u
+}
+
+// SetNillableLastRequest sets the "last_request" field if the given value is not nil.
+func (_u *DeviceTokenUpdateOne) SetNillableLastRequest(v *time.Time) *DeviceTokenUpdateOne {
+	if v != nil {
+		_u.SetLastRequest(*v)
+	}
+	return _u
 }
 
 // SetPollInterval sets the "poll_interval" field.
-func (dtuo *DeviceTokenUpdateOne) SetPollInterval(i int) *DeviceTokenUpdateOne {
-	dtuo.mutation.ResetPollInterval()
-	dtuo.mutation.SetPollInterval(i)
-	return dtuo
+func (_u *DeviceTokenUpdateOne) SetPollInterval(v int) *DeviceTokenUpdateOne {
+	_u.mutation.ResetPollInterval()
+	_u.mutation.SetPollInterval(v)
+	return _u
+}
+
+// SetNillablePollInterval sets the "poll_interval" field if the given value is not nil.
+func (_u *DeviceTokenUpdateOne) SetNillablePollInterval(v *int) *DeviceTokenUpdateOne {
+	if v != nil {
+		_u.SetPollInterval(*v)
+	}
+	return _u
 }
 
-// AddPollInterval adds i to the "poll_interval" field.
-func (dtuo *DeviceTokenUpdateOne) AddPollInterval(i int) *DeviceTokenUpdateOne {
-	dtuo.mutation.AddPollInterval(i)
-	return dtuo
+// AddPollInterval adds value to the "poll_interval" field.
+func (_u *DeviceTokenUpdateOne) AddPollInterval(v int) *DeviceTokenUpdateOne {
+	_u.mutation.AddPollInterval(v)
+	return _u
 }
 
 // SetCodeChallenge sets the "code_challenge" field.
-func (dtuo *DeviceTokenUpdateOne) SetCodeChallenge(s string) *DeviceTokenUpdateOne {
-	dtuo.mutation.SetCodeChallenge(s)
-	return dtuo
+func (_u *DeviceTokenUpdateOne) SetCodeChallenge(v string) *DeviceTokenUpdateOne {
+	_u.mutation.SetCodeChallenge(v)
+	return _u
 }
 
 // SetNillableCodeChallenge sets the "code_challenge" field if the given value is not nil.
-func (dtuo *DeviceTokenUpdateOne) SetNillableCodeChallenge(s *string) *DeviceTokenUpdateOne {
-	if s != nil {
-		dtuo.SetCodeChallenge(*s)
+func (_u *DeviceTokenUpdateOne) SetNillableCodeChallenge(v *string) *DeviceTokenUpdateOne {
+	if v != nil {
+		_u.SetCodeChallenge(*v)
 	}
-	return dtuo
+	return _u
 }
 
 // SetCodeChallengeMethod sets the "code_challenge_method" field.
-func (dtuo *DeviceTokenUpdateOne) SetCodeChallengeMethod(s string) *DeviceTokenUpdateOne {
-	dtuo.mutation.SetCodeChallengeMethod(s)
-	return dtuo
+func (_u *DeviceTokenUpdateOne) SetCodeChallengeMethod(v string) *DeviceTokenUpdateOne {
+	_u.mutation.SetCodeChallengeMethod(v)
+	return _u
 }
 
 // SetNillableCodeChallengeMethod sets the "code_challenge_method" field if the given value is not nil.
-func (dtuo *DeviceTokenUpdateOne) SetNillableCodeChallengeMethod(s *string) *DeviceTokenUpdateOne {
-	if s != nil {
-		dtuo.SetCodeChallengeMethod(*s)
+func (_u *DeviceTokenUpdateOne) SetNillableCodeChallengeMethod(v *string) *DeviceTokenUpdateOne {
+	if v != nil {
+		_u.SetCodeChallengeMethod(*v)
 	}
-	return dtuo
+	return _u
 }
 
 // Mutation returns the DeviceTokenMutation object of the builder.
-func (dtuo *DeviceTokenUpdateOne) Mutation() *DeviceTokenMutation {
-	return dtuo.mutation
+func (_u *DeviceTokenUpdateOne) Mutation() *DeviceTokenMutation {
+	return _u.mutation
+}
+
+// Where appends a list predicates to the DeviceTokenUpdate builder.
+func (_u *DeviceTokenUpdateOne) Where(ps ...predicate.DeviceToken) *DeviceTokenUpdateOne {
+	_u.mutation.Where(ps...)
+	return _u
 }
 
 // Select allows selecting one or more fields (columns) of the returned entity.
 // The default is selecting all fields defined in the entity schema.
-func (dtuo *DeviceTokenUpdateOne) Select(field string, fields ...string) *DeviceTokenUpdateOne {
-	dtuo.fields = append([]string{field}, fields...)
-	return dtuo
+func (_u *DeviceTokenUpdateOne) Select(field string, fields ...string) *DeviceTokenUpdateOne {
+	_u.fields = append([]string{field}, fields...)
+	return _u
 }
 
 // Save executes the query and returns the updated DeviceToken entity.
-func (dtuo *DeviceTokenUpdateOne) Save(ctx context.Context) (*DeviceToken, error) {
-	var (
-		err  error
-		node *DeviceToken
-	)
-	if len(dtuo.hooks) == 0 {
-		if err = dtuo.check(); err != nil {
-			return nil, err
-		}
-		node, err = dtuo.sqlSave(ctx)
-	} else {
-		var mut Mutator = MutateFunc(func(ctx context.Context, m Mutation) (Value, error) {
-			mutation, ok := m.(*DeviceTokenMutation)
-			if !ok {
-				return nil, fmt.Errorf("unexpected mutation type %T", m)
-			}
-			if err = dtuo.check(); err != nil {
-				return nil, err
-			}
-			dtuo.mutation = mutation
-			node, err = dtuo.sqlSave(ctx)
-			mutation.done = true
-			return node, err
-		})
-		for i := len(dtuo.hooks) - 1; i >= 0; i-- {
-			if dtuo.hooks[i] == nil {
-				return nil, fmt.Errorf("db: uninitialized hook (forgotten import db/runtime?)")
-			}
-			mut = dtuo.hooks[i](mut)
-		}
-		v, err := mut.Mutate(ctx, dtuo.mutation)
-		if err != nil {
-			return nil, err
-		}
-		nv, ok := v.(*DeviceToken)
-		if !ok {
-			return nil, fmt.Errorf("unexpected node type %T returned from DeviceTokenMutation", v)
-		}
-		node = nv
-	}
-	return node, err
+func (_u *DeviceTokenUpdateOne) Save(ctx context.Context) (*DeviceToken, error) {
+	return withHooks(ctx, _u.sqlSave, _u.mutation, _u.hooks)
 }
 
 // SaveX is like Save, but panics if an error occurs.
-func (dtuo *DeviceTokenUpdateOne) SaveX(ctx context.Context) *DeviceToken {
-	node, err := dtuo.Save(ctx)
+func (_u *DeviceTokenUpdateOne) SaveX(ctx context.Context) *DeviceToken {
+	node, err := _u.Save(ctx)
 	if err != nil {
 		panic(err)
 	}
@@ -434,26 +404,26 @@ func (dtuo *DeviceTokenUpdateOne) SaveX(ctx context.Context) *DeviceToken {
 }
 
 // Exec executes the query on the entity.
-func (dtuo *DeviceTokenUpdateOne) Exec(ctx context.Context) error {
-	_, err := dtuo.Save(ctx)
+func (_u *DeviceTokenUpdateOne) Exec(ctx context.Context) error {
+	_, err := _u.Save(ctx)
 	return err
 }
 
 // ExecX is like Exec, but panics if an error occurs.
-func (dtuo *DeviceTokenUpdateOne) ExecX(ctx context.Context) {
-	if err := dtuo.Exec(ctx); err != nil {
+func (_u *DeviceTokenUpdateOne) ExecX(ctx context.Context) {
+	if err := _u.Exec(ctx); err != nil {
 		panic(err)
 	}
 }
 
 // check runs all checks and user-defined validators on the builder.
-func (dtuo *DeviceTokenUpdateOne) check() error {
-	if v, ok := dtuo.mutation.DeviceCode(); ok {
+func (_u *DeviceTokenUpdateOne) check() error {
+	if v, ok := _u.mutation.DeviceCode(); ok {
 		if err := devicetoken.DeviceCodeValidator(v); err != nil {
 			return &ValidationError{Name: "device_code", err: fmt.Errorf(`db: validator failed for field "DeviceToken.device_code": %w`, err)}
 		}
 	}
-	if v, ok := dtuo.mutation.Status(); ok {
+	if v, ok := _u.mutation.Status(); ok {
 		if err := devicetoken.StatusValidator(v); err != nil {
 			return &ValidationError{Name: "status", err: fmt.Errorf(`db: validator failed for field "DeviceToken.status": %w`, err)}
 		}
@@ -461,23 +431,17 @@ func (dtuo *DeviceTokenUpdateOne) check() error {
 	return nil
 }
 
-func (dtuo *DeviceTokenUpdateOne) sqlSave(ctx context.Context) (_node *DeviceToken, err error) {
-	_spec := &sqlgraph.UpdateSpec{
-		Node: &sqlgraph.NodeSpec{
-			Table:   devicetoken.Table,
-			Columns: devicetoken.Columns,
-			ID: &sqlgraph.FieldSpec{
-				Type:   field.TypeInt,
-				Column: devicetoken.FieldID,
-			},
-		},
+func (_u *DeviceTokenUpdateOne) sqlSave(ctx context.Context) (_node *DeviceToken, err error) {
+	if err := _u.check(); err != nil {
+		return _node, err
 	}
-	id, ok := dtuo.mutation.ID()
+	_spec := sqlgraph.NewUpdateSpec(devicetoken.Table, devicetoken.Columns, sqlgraph.NewFieldSpec(devicetoken.FieldID, field.TypeInt))
+	id, ok := _u.mutation.ID()
 	if !ok {
 		return nil, &ValidationError{Name: "id", err: errors.New(`db: missing "DeviceToken.id" for update`)}
 	}
 	_spec.Node.ID.Value = id
-	if fields := dtuo.fields; len(fields) > 0 {
+	if fields := _u.fields; len(fields) > 0 {
 		_spec.Node.Columns = make([]string, 0, len(fields))
 		_spec.Node.Columns = append(_spec.Node.Columns, devicetoken.FieldID)
 		for _, f := range fields {
@@ -489,86 +453,47 @@ func (dtuo *DeviceTokenUpdateOne) sqlSave(ctx context.Context) (_node *DeviceTok
 			}
 		}
 	}
-	if ps := dtuo.mutation.predicates; len(ps) > 0 {
+	if ps := _u.mutation.predicates; len(ps) > 0 {
 		_spec.Predicate = func(selector *sql.Selector) {
 			for i := range ps {
 				ps[i](selector)
 			}
 		}
 	}
-	if value, ok := dtuo.mutation.DeviceCode(); ok {
-		_spec.Fields.Set = append(_spec.Fields.Set, &sqlgraph.FieldSpec{
-			Type:   field.TypeString,
-			Value:  value,
-			Column: devicetoken.FieldDeviceCode,
-		})
-	}
-	if value, ok := dtuo.mutation.Status(); ok {
-		_spec.Fields.Set = append(_spec.Fields.Set, &sqlgraph.FieldSpec{
-			Type:   field.TypeString,
-			Value:  value,
-			Column: devicetoken.FieldStatus,
-		})
-	}
-	if value, ok := dtuo.mutation.Token(); ok {
-		_spec.Fields.Set = append(_spec.Fields.Set, &sqlgraph.FieldSpec{
-			Type:   field.TypeBytes,
-			Value:  value,
-			Column: devicetoken.FieldToken,
-		})
-	}
-	if dtuo.mutation.TokenCleared() {
-		_spec.Fields.Clear = append(_spec.Fields.Clear, &sqlgraph.FieldSpec{
-			Type:   field.TypeBytes,
-			Column: devicetoken.FieldToken,
-		})
-	}
-	if value, ok := dtuo.mutation.Expiry(); ok {
-		_spec.Fields.Set = append(_spec.Fields.Set, &sqlgraph.FieldSpec{
-			Type:   field.TypeTime,
-			Value:  value,
-			Column: devicetoken.FieldExpiry,
-		})
-	}
-	if value, ok := dtuo.mutation.LastRequest(); ok {
-		_spec.Fields.Set = append(_spec.Fields.Set, &sqlgraph.FieldSpec{
-			Type:   field.TypeTime,
-			Value:  value,
-			Column: devicetoken.FieldLastRequest,
-		})
-	}
-	if value, ok := dtuo.mutation.PollInterval(); ok {
-		_spec.Fields.Set = append(_spec.Fields.Set, &sqlgraph.FieldSpec{
-			Type:   field.TypeInt,
-			Value:  value,
-			Column: devicetoken.FieldPollInterval,
-		})
-	}
-	if value, ok := dtuo.mutation.AddedPollInterval(); ok {
-		_spec.Fields.Add = append(_spec.Fields.Add, &sqlgraph.FieldSpec{
-			Type:   field.TypeInt,
-			Value:  value,
-			Column: devicetoken.FieldPollInterval,
-		})
-	}
-	if value, ok := dtuo.mutation.CodeChallenge(); ok {
-		_spec.Fields.Set = append(_spec.Fields.Set, &sqlgraph.FieldSpec{
-			Type:   field.TypeString,
-			Value:  value,
-			Column: devicetoken.FieldCodeChallenge,
-		})
-	}
-	if value, ok := dtuo.mutation.CodeChallengeMethod(); ok {
-		_spec.Fields.Set = append(_spec.Fields.Set, &sqlgraph.FieldSpec{
-			Type:   field.TypeString,
-			Value:  value,
-			Column: devicetoken.FieldCodeChallengeMethod,
-		})
-	}
-	_node = &DeviceToken{config: dtuo.config}
+	if value, ok := _u.mutation.DeviceCode(); ok {
+		_spec.SetField(devicetoken.FieldDeviceCode, field.TypeString, value)
+	}
+	if value, ok := _u.mutation.Status(); ok {
+		_spec.SetField(devicetoken.FieldStatus, field.TypeString, value)
+	}
+	if value, ok := _u.mutation.Token(); ok {
+		_spec.SetField(devicetoken.FieldToken, field.TypeBytes, value)
+	}
+	if _u.mutation.TokenCleared() {
+		_spec.ClearField(devicetoken.FieldToken, field.TypeBytes)
+	}
+	if value, ok := _u.mutation.Expiry(); ok {
+		_spec.SetField(devicetoken.FieldExpiry, field.TypeTime, value)
+	}
+	if value, ok := _u.mutation.LastRequest(); ok {
+		_spec.SetField(devicetoken.FieldLastRequest, field.TypeTime, value)
+	}
+	if value, ok := _u.mutation.PollInterval(); ok {
+		_spec.SetField(devicetoken.FieldPollInterval, field.TypeInt, value)
+	}
+	if value, ok := _u.mutation.AddedPollInterval(); ok {
+		_spec.AddField(devicetoken.FieldPollInterval, field.TypeInt, value)
+	}
+	if value, ok := _u.mutation.CodeChallenge(); ok {
+		_spec.SetField(devicetoken.FieldCodeChallenge, field.TypeString, value)
+	}
+	if value, ok := _u.mutation.CodeChallengeMethod(); ok {
+		_spec.SetField(devicetoken.FieldCodeChallengeMethod, field.TypeString, value)
+	}
+	_node = &DeviceToken{config: _u.config}
 	_spec.Assign = _node.assignValues
 	_spec.ScanValues = _node.scanValues
-	if err = sqlgraph.UpdateNode(ctx, dtuo.driver, _spec); err != nil {
+	if err = sqlgraph.UpdateNode(ctx, _u.driver, _spec); err != nil {
 		if _, ok := err.(*sqlgraph.NotFoundError); ok {
 			err = &NotFoundError{devicetoken.Label}
 		} else if sqlgraph.IsConstraintError(err) {
@@ -576,5 +501,6 @@ func (dtuo *DeviceTokenUpdateOne) sqlSave(ctx context.Context) (_node *DeviceTok
 		}
 		return nil, err
 	}
+	_u.mutation.done = true
 	return _node, nil
 }
diff --git a/storage/ent/db/ent.go b/storage/ent/db/ent.go
index ed76b32b51..f73e0090e1 100644
--- a/storage/ent/db/ent.go
+++ b/storage/ent/db/ent.go
@@ -6,12 +6,15 @@ import (
 	"context"
 	"errors"
 	"fmt"
+	"reflect"
+	"sync"
 
 	"entgo.io/ent"
 	"entgo.io/ent/dialect/sql"
 	"entgo.io/ent/dialect/sql/sqlgraph"
 	"github.com/dexidp/dex/storage/ent/db/authcode"
 	"github.com/dexidp/dex/storage/ent/db/authrequest"
+	"github.com/dexidp/dex/storage/ent/db/authsession"
 	"github.com/dexidp/dex/storage/ent/db/connector"
 	"github.com/dexidp/dex/storage/ent/db/devicerequest"
 	"github.com/dexidp/dex/storage/ent/db/devicetoken"
@@ -20,57 +23,89 @@ import (
 	"github.com/dexidp/dex/storage/ent/db/offlinesession"
 	"github.com/dexidp/dex/storage/ent/db/password"
 	"github.com/dexidp/dex/storage/ent/db/refreshtoken"
+	"github.com/dexidp/dex/storage/ent/db/useridentity"
 )
 
 // ent aliases to avoid import conflicts in user's code.
 type (
-	Op         = ent.Op
-	Hook       = ent.Hook
-	Value      = ent.Value
-	Query      = ent.Query
-	Policy     = ent.Policy
-	Mutator    = ent.Mutator
-	Mutation   = ent.Mutation
-	MutateFunc = ent.MutateFunc
+	Op            = ent.Op
+	Hook          = ent.Hook
+	Value         = ent.Value
+	Query         = ent.Query
+	QueryContext  = ent.QueryContext
+	Querier       = ent.Querier
+	QuerierFunc   = ent.QuerierFunc
+	Interceptor   = ent.Interceptor
+	InterceptFunc = ent.InterceptFunc
+	Traverser     = ent.Traverser
+	TraverseFunc  = ent.TraverseFunc
+	Policy        = ent.Policy
+	Mutator       = ent.Mutator
+	Mutation      = ent.Mutation
+	MutateFunc    = ent.MutateFunc
 )
 
+type clientCtxKey struct{}
+
+// FromContext returns a Client stored inside a context, or nil if there isn't one.
+func FromContext(ctx context.Context) *Client {
+	c, _ := ctx.Value(clientCtxKey{}).(*Client)
+	return c
+}
+
+// NewContext returns a new context with the given Client attached.
+func NewContext(parent context.Context, c *Client) context.Context {
+	return context.WithValue(parent, clientCtxKey{}, c)
+}
+
+type txCtxKey struct{}
+
+// TxFromContext returns a Tx stored inside a context, or nil if there isn't one.
+func TxFromContext(ctx context.Context) *Tx {
+	tx, _ := ctx.Value(txCtxKey{}).(*Tx)
+	return tx
+}
+
+// NewTxContext returns a new context with the given Tx attached.
+func NewTxContext(parent context.Context, tx *Tx) context.Context {
+	return context.WithValue(parent, txCtxKey{}, tx)
+}
+
 // OrderFunc applies an ordering on the sql selector.
+// Deprecated: Use Asc/Desc functions or the package builders instead.
 type OrderFunc func(*sql.Selector)
 
-// columnChecker returns a function indicates if the column exists in the given column.
-func columnChecker(table string) func(string) error {
-	checks := map[string]func(string) bool{
-		authcode.Table:       authcode.ValidColumn,
-		authrequest.Table:    authrequest.ValidColumn,
-		connector.Table:      connector.ValidColumn,
-		devicerequest.Table:  devicerequest.ValidColumn,
-		devicetoken.Table:    devicetoken.ValidColumn,
-		keys.Table:           keys.ValidColumn,
-		oauth2client.Table:   oauth2client.ValidColumn,
-		offlinesession.Table: offlinesession.ValidColumn,
-		password.Table:       password.ValidColumn,
-		refreshtoken.Table:   refreshtoken.ValidColumn,
-	}
-	check, ok := checks[table]
-	if !ok {
-		return func(string) error {
-			return fmt.Errorf("unknown table %q", table)
-		}
-	}
-	return func(column string) error {
-		if !check(column) {
-			return fmt.Errorf("unknown column %q for table %q", column, table)
-		}
-		return nil
-	}
+var (
+	initCheck   sync.Once
+	columnCheck sql.ColumnCheck
+)
+
+// checkColumn checks if the column exists in the given table.
+func checkColumn(t, c string) error {
+	initCheck.Do(func() {
+		columnCheck = sql.NewColumnCheck(map[string]func(string) bool{
+			authcode.Table:       authcode.ValidColumn,
+			authrequest.Table:    authrequest.ValidColumn,
+			authsession.Table:    authsession.ValidColumn,
+			connector.Table:      connector.ValidColumn,
+			devicerequest.Table:  devicerequest.ValidColumn,
+			devicetoken.Table:    devicetoken.ValidColumn,
+			keys.Table:           keys.ValidColumn,
+			oauth2client.Table:   oauth2client.ValidColumn,
+			offlinesession.Table: offlinesession.ValidColumn,
+			password.Table:       password.ValidColumn,
+			refreshtoken.Table:   refreshtoken.ValidColumn,
+			useridentity.Table:   useridentity.ValidColumn,
+		})
+	})
+	return columnCheck(t, c)
 }
 
 // Asc applies the given fields in ASC order.
-func Asc(fields ...string) OrderFunc {
+func Asc(fields ...string) func(*sql.Selector) {
 	return func(s *sql.Selector) {
-		check := columnChecker(s.TableName())
 		for _, f := range fields {
-			if err := check(f); err != nil {
+			if err := checkColumn(s.TableName(), f); err != nil {
 				s.AddError(&ValidationError{Name: f, err: fmt.Errorf("db: %w", err)})
 			}
 			s.OrderBy(sql.Asc(s.C(f)))
@@ -79,11 +114,10 @@ func Asc(fields ...string) OrderFunc {
 }
 
 // Desc applies the given fields in DESC order.
-func Desc(fields ...string) OrderFunc {
+func Desc(fields ...string) func(*sql.Selector) {
 	return func(s *sql.Selector) {
-		check := columnChecker(s.TableName())
 		for _, f := range fields {
-			if err := check(f); err != nil {
+			if err := checkColumn(s.TableName(), f); err != nil {
 				s.AddError(&ValidationError{Name: f, err: fmt.Errorf("db: %w", err)})
 			}
 			s.OrderBy(sql.Desc(s.C(f)))
@@ -99,7 +133,6 @@ type AggregateFunc func(*sql.Selector) string
 //	GroupBy(field1, field2).
 //	Aggregate(db.As(db.Sum(field1), "sum_field1"), (db.As(db.Sum(field2), "sum_field2")).
 //	Scan(ctx, &v)
-//
 func As(fn AggregateFunc, end string) AggregateFunc {
 	return func(s *sql.Selector) string {
 		return sql.As(fn(s), end)
@@ -116,8 +149,7 @@ func Count() AggregateFunc {
 // Max applies the "max" aggregation function on the given field of each group.
 func Max(field string) AggregateFunc {
 	return func(s *sql.Selector) string {
-		check := columnChecker(s.TableName())
-		if err := check(field); err != nil {
+		if err := checkColumn(s.TableName(), field); err != nil {
 			s.AddError(&ValidationError{Name: field, err: fmt.Errorf("db: %w", err)})
 			return ""
 		}
@@ -128,8 +160,7 @@ func Max(field string) AggregateFunc {
 // Mean applies the "mean" aggregation function on the given field of each group.
 func Mean(field string) AggregateFunc {
 	return func(s *sql.Selector) string {
-		check := columnChecker(s.TableName())
-		if err := check(field); err != nil {
+		if err := checkColumn(s.TableName(), field); err != nil {
 			s.AddError(&ValidationError{Name: field, err: fmt.Errorf("db: %w", err)})
 			return ""
 		}
@@ -140,8 +171,7 @@ func Mean(field string) AggregateFunc {
 // Min applies the "min" aggregation function on the given field of each group.
 func Min(field string) AggregateFunc {
 	return func(s *sql.Selector) string {
-		check := columnChecker(s.TableName())
-		if err := check(field); err != nil {
+		if err := checkColumn(s.TableName(), field); err != nil {
 			s.AddError(&ValidationError{Name: field, err: fmt.Errorf("db: %w", err)})
 			return ""
 		}
@@ -152,8 +182,7 @@ func Min(field string) AggregateFunc {
 // Sum applies the "sum" aggregation function on the given field of each group.
 func Sum(field string) AggregateFunc {
 	return func(s *sql.Selector) string {
-		check := columnChecker(s.TableName())
-		if err := check(field); err != nil {
+		if err := checkColumn(s.TableName(), field); err != nil {
 			s.AddError(&ValidationError{Name: field, err: fmt.Errorf("db: %w", err)})
 			return ""
 		}
@@ -282,11 +311,12 @@ func IsConstraintError(err error) bool {
 type selector struct {
 	label string
 	flds  *[]string
-	scan  func(context.Context, interface{}) error
+	fns   []AggregateFunc
+	scan  func(context.Context, any) error
 }
 
 // ScanX is like Scan, but panics if an error occurs.
-func (s *selector) ScanX(ctx context.Context, v interface{}) {
+func (s *selector) ScanX(ctx context.Context, v any) {
 	if err := s.scan(ctx, v); err != nil {
 		panic(err)
 	}
@@ -480,5 +510,121 @@ func (s *selector) BoolX(ctx context.Context) bool {
 	return v
 }
 
+// withHooks invokes the builder operation with the given hooks, if any.
+func withHooks[V Value, M any, PM interface {
+	*M
+	Mutation
+}](ctx context.Context, exec func(context.Context) (V, error), mutation PM, hooks []Hook) (value V, err error) {
+	if len(hooks) == 0 {
+		return exec(ctx)
+	}
+	var mut Mutator = MutateFunc(func(ctx context.Context, m Mutation) (Value, error) {
+		mutationT, ok := any(m).(PM)
+		if !ok {
+			return nil, fmt.Errorf("unexpected mutation type %T", m)
+		}
+		// Set the mutation to the builder.
+		*mutation = *mutationT
+		return exec(ctx)
+	})
+	for i := len(hooks) - 1; i >= 0; i-- {
+		if hooks[i] == nil {
+			return value, fmt.Errorf("ent: uninitialized hook (forgotten import ent/runtime?)")
+		}
+		mut = hooks[i](mut)
+	}
+	v, err := mut.Mutate(ctx, mutation)
+	if err != nil {
+		return value, err
+	}
+	nv, ok := v.(V)
+	if !ok {
+		return value, fmt.Errorf("unexpected node type %T returned from %T", v, mutation)
+	}
+	return nv, nil
+}
+
+// setContextOp returns a new context with the given QueryContext attached (including its op) in case it does not exist.
+func setContextOp(ctx context.Context, qc *QueryContext, op string) context.Context {
+	if ent.QueryFromContext(ctx) == nil {
+		qc.Op = op
+		ctx = ent.NewQueryContext(ctx, qc)
+	}
+	return ctx
+}
+
+func querierAll[V Value, Q interface {
+	sqlAll(context.Context, ...queryHook) (V, error)
+}]() Querier {
+	return QuerierFunc(func(ctx context.Context, q Query) (Value, error) {
+		query, ok := q.(Q)
+		if !ok {
+			return nil, fmt.Errorf("unexpected query type %T", q)
+		}
+		return query.sqlAll(ctx)
+	})
+}
+
+func querierCount[Q interface {
+	sqlCount(context.Context) (int, error)
+}]() Querier {
+	return QuerierFunc(func(ctx context.Context, q Query) (Value, error) {
+		query, ok := q.(Q)
+		if !ok {
+			return nil, fmt.Errorf("unexpected query type %T", q)
+		}
+		return query.sqlCount(ctx)
+	})
+}
+
+func withInterceptors[V Value](ctx context.Context, q Query, qr Querier, inters []Interceptor) (v V, err error) {
+	for i := len(inters) - 1; i >= 0; i-- {
+		qr = inters[i].Intercept(qr)
+	}
+	rv, err := qr.Query(ctx, q)
+	if err != nil {
+		return v, err
+	}
+	vt, ok := rv.(V)
+	if !ok {
+		return v, fmt.Errorf("unexpected type %T returned from %T. expected type: %T", vt, q, v)
+	}
+	return vt, nil
+}
+
+func scanWithInterceptors[Q1 ent.Query, Q2 interface {
+	sqlScan(context.Context, Q1, any) error
+}](ctx context.Context, rootQuery Q1, selectOrGroup Q2, inters []Interceptor, v any) error {
+	rv := reflect.ValueOf(v)
+	var qr Querier = QuerierFunc(func(ctx context.Context, q Query) (Value, error) {
+		query, ok := q.(Q1)
+		if !ok {
+			return nil, fmt.Errorf("unexpected query type %T", q)
+		}
+		if err := selectOrGroup.sqlScan(ctx, query, v); err != nil {
+			return nil, err
+		}
+		if k := rv.Kind(); k == reflect.Pointer && rv.Elem().CanInterface() {
+			return rv.Elem().Interface(), nil
+		}
+		return v, nil
+	})
+	for i := len(inters) - 1; i >= 0; i-- {
+		qr = inters[i].Intercept(qr)
+	}
+	vv, err := qr.Query(ctx, rootQuery)
+	if err != nil {
+		return err
+	}
+	switch rv2 := reflect.ValueOf(vv); {
+	case rv.IsNil(), rv2.IsNil(), rv.Kind() != reflect.Pointer:
+	case rv.Type() == rv2.Type():
+		rv.Elem().Set(rv2.Elem())
+	case rv.Elem().Type() == rv2.Type():
+		rv.Elem().Set(rv2)
+	}
+	return nil
+}
+
 // queryHook describes an internal hook for the different sqlAll methods.
 type queryHook func(context.Context, *sqlgraph.QuerySpec)
diff --git a/storage/ent/db/enttest/enttest.go b/storage/ent/db/enttest/enttest.go
index ecbb02d930..65702d99c9 100644
--- a/storage/ent/db/enttest/enttest.go
+++ b/storage/ent/db/enttest/enttest.go
@@ -18,7 +18,7 @@ type (
 	// testing.T and testing.B and used by enttest.
 	TestingT interface {
 		FailNow()
-		Error(...interface{})
+		Error(...any)
 	}
 
 	// Option configures client creation.
diff --git a/storage/ent/db/hook/hook.go b/storage/ent/db/hook/hook.go
index 856e5e5949..1c8780d70c 100644
--- a/storage/ent/db/hook/hook.go
+++ b/storage/ent/db/hook/hook.go
@@ -15,11 +15,10 @@ type AuthCodeFunc func(context.Context, *db.AuthCodeMutation) (db.Value, error)
 
 // Mutate calls f(ctx, m).
 func (f AuthCodeFunc) Mutate(ctx context.Context, m db.Mutation) (db.Value, error) {
-	mv, ok := m.(*db.AuthCodeMutation)
-	if !ok {
-		return nil, fmt.Errorf("unexpected mutation type %T. expect *db.AuthCodeMutation", m)
+	if mv, ok := m.(*db.AuthCodeMutation); ok {
+		return f(ctx, mv)
 	}
-	return f(ctx, mv)
+	return nil, fmt.Errorf("unexpected mutation type %T. expect *db.AuthCodeMutation", m)
 }
 
 // The AuthRequestFunc type is an adapter to allow the use of ordinary
@@ -28,11 +27,22 @@ type AuthRequestFunc func(context.Context, *db.AuthRequestMutation) (db.Value, e
 
 // Mutate calls f(ctx, m).
 func (f AuthRequestFunc) Mutate(ctx context.Context, m db.Mutation) (db.Value, error) {
-	mv, ok := m.(*db.AuthRequestMutation)
-	if !ok {
-		return nil, fmt.Errorf("unexpected mutation type %T. expect *db.AuthRequestMutation", m)
+	if mv, ok := m.(*db.AuthRequestMutation); ok {
+		return f(ctx, mv)
 	}
-	return f(ctx, mv)
+	return nil, fmt.Errorf("unexpected mutation type %T. expect *db.AuthRequestMutation", m)
+}
+
+// The AuthSessionFunc type is an adapter to allow the use of ordinary
+// function as AuthSession mutator.
+type AuthSessionFunc func(context.Context, *db.AuthSessionMutation) (db.Value, error)
+
+// Mutate calls f(ctx, m).
+func (f AuthSessionFunc) Mutate(ctx context.Context, m db.Mutation) (db.Value, error) {
+	if mv, ok := m.(*db.AuthSessionMutation); ok {
+		return f(ctx, mv)
+	}
+	return nil, fmt.Errorf("unexpected mutation type %T. expect *db.AuthSessionMutation", m)
 }
 
 // The ConnectorFunc type is an adapter to allow the use of ordinary
@@ -41,11 +51,10 @@ type ConnectorFunc func(context.Context, *db.ConnectorMutation) (db.Value, error
 
 // Mutate calls f(ctx, m).
 func (f ConnectorFunc) Mutate(ctx context.Context, m db.Mutation) (db.Value, error) {
-	mv, ok := m.(*db.ConnectorMutation)
-	if !ok {
-		return nil, fmt.Errorf("unexpected mutation type %T. expect *db.ConnectorMutation", m)
+	if mv, ok := m.(*db.ConnectorMutation); ok {
+		return f(ctx, mv)
 	}
-	return f(ctx, mv)
+	return nil, fmt.Errorf("unexpected mutation type %T. expect *db.ConnectorMutation", m)
 }
 
 // The DeviceRequestFunc type is an adapter to allow the use of ordinary
@@ -54,11 +63,10 @@ type DeviceRequestFunc func(context.Context, *db.DeviceRequestMutation) (db.Valu
 
 // Mutate calls f(ctx, m).
 func (f DeviceRequestFunc) Mutate(ctx context.Context, m db.Mutation) (db.Value, error) {
-	mv, ok := m.(*db.DeviceRequestMutation)
-	if !ok {
-		return nil, fmt.Errorf("unexpected mutation type %T. expect *db.DeviceRequestMutation", m)
+	if mv, ok := m.(*db.DeviceRequestMutation); ok {
+		return f(ctx, mv)
 	}
-	return f(ctx, mv)
+	return nil, fmt.Errorf("unexpected mutation type %T. expect *db.DeviceRequestMutation", m)
 }
 
 // The DeviceTokenFunc type is an adapter to allow the use of ordinary
@@ -67,11 +75,10 @@ type DeviceTokenFunc func(context.Context, *db.DeviceTokenMutation) (db.Value, e
 
 // Mutate calls f(ctx, m).
 func (f DeviceTokenFunc) Mutate(ctx context.Context, m db.Mutation) (db.Value, error) {
-	mv, ok := m.(*db.DeviceTokenMutation)
-	if !ok {
-		return nil, fmt.Errorf("unexpected mutation type %T. expect *db.DeviceTokenMutation", m)
+	if mv, ok := m.(*db.DeviceTokenMutation); ok {
+		return f(ctx, mv)
 	}
-	return f(ctx, mv)
+	return nil, fmt.Errorf("unexpected mutation type %T. expect *db.DeviceTokenMutation", m)
 }
 
 // The KeysFunc type is an adapter to allow the use of ordinary
@@ -80,11 +87,10 @@ type KeysFunc func(context.Context, *db.KeysMutation) (db.Value, error)
 
 // Mutate calls f(ctx, m).
 func (f KeysFunc) Mutate(ctx context.Context, m db.Mutation) (db.Value, error) {
-	mv, ok := m.(*db.KeysMutation)
-	if !ok {
-		return nil, fmt.Errorf("unexpected mutation type %T. expect *db.KeysMutation", m)
+	if mv, ok := m.(*db.KeysMutation); ok {
+		return f(ctx, mv)
 	}
-	return f(ctx, mv)
+	return nil, fmt.Errorf("unexpected mutation type %T. expect *db.KeysMutation", m)
 }
 
 // The OAuth2ClientFunc type is an adapter to allow the use of ordinary
@@ -93,11 +99,10 @@ type OAuth2ClientFunc func(context.Context, *db.OAuth2ClientMutation) (db.Value,
 
 // Mutate calls f(ctx, m).
 func (f OAuth2ClientFunc) Mutate(ctx context.Context, m db.Mutation) (db.Value, error) {
-	mv, ok := m.(*db.OAuth2ClientMutation)
-	if !ok {
-		return nil, fmt.Errorf("unexpected mutation type %T. expect *db.OAuth2ClientMutation", m)
+	if mv, ok := m.(*db.OAuth2ClientMutation); ok {
+		return f(ctx, mv)
 	}
-	return f(ctx, mv)
+	return nil, fmt.Errorf("unexpected mutation type %T. expect *db.OAuth2ClientMutation", m)
 }
 
 // The OfflineSessionFunc type is an adapter to allow the use of ordinary
@@ -106,11 +111,10 @@ type OfflineSessionFunc func(context.Context, *db.OfflineSessionMutation) (db.Va
 
 // Mutate calls f(ctx, m).
 func (f OfflineSessionFunc) Mutate(ctx context.Context, m db.Mutation) (db.Value, error) {
-	mv, ok := m.(*db.OfflineSessionMutation)
-	if !ok {
-		return nil, fmt.Errorf("unexpected mutation type %T. expect *db.OfflineSessionMutation", m)
+	if mv, ok := m.(*db.OfflineSessionMutation); ok {
+		return f(ctx, mv)
 	}
-	return f(ctx, mv)
+	return nil, fmt.Errorf("unexpected mutation type %T. expect *db.OfflineSessionMutation", m)
 }
 
 // The PasswordFunc type is an adapter to allow the use of ordinary
@@ -119,11 +123,10 @@ type PasswordFunc func(context.Context, *db.PasswordMutation) (db.Value, error)
 
 // Mutate calls f(ctx, m).
 func (f PasswordFunc) Mutate(ctx context.Context, m db.Mutation) (db.Value, error) {
-	mv, ok := m.(*db.PasswordMutation)
-	if !ok {
-		return nil, fmt.Errorf("unexpected mutation type %T. expect *db.PasswordMutation", m)
+	if mv, ok := m.(*db.PasswordMutation); ok {
+		return f(ctx, mv)
 	}
-	return f(ctx, mv)
+	return nil, fmt.Errorf("unexpected mutation type %T. expect *db.PasswordMutation", m)
 }
 
 // The RefreshTokenFunc type is an adapter to allow the use of ordinary
@@ -132,11 +135,22 @@ type RefreshTokenFunc func(context.Context, *db.RefreshTokenMutation) (db.Value,
 
 // Mutate calls f(ctx, m).
 func (f RefreshTokenFunc) Mutate(ctx context.Context, m db.Mutation) (db.Value, error) {
-	mv, ok := m.(*db.RefreshTokenMutation)
-	if !ok {
-		return nil, fmt.Errorf("unexpected mutation type %T. expect *db.RefreshTokenMutation", m)
+	if mv, ok := m.(*db.RefreshTokenMutation); ok {
+		return f(ctx, mv)
+	}
+	return nil, fmt.Errorf("unexpected mutation type %T. expect *db.RefreshTokenMutation", m)
+}
+
+// The UserIdentityFunc type is an adapter to allow the use of ordinary
+// function as UserIdentity mutator.
+type UserIdentityFunc func(context.Context, *db.UserIdentityMutation) (db.Value, error)
+
+// Mutate calls f(ctx, m).
+func (f UserIdentityFunc) Mutate(ctx context.Context, m db.Mutation) (db.Value, error) {
+	if mv, ok := m.(*db.UserIdentityMutation); ok {
+		return f(ctx, mv)
 	}
-	return f(ctx, mv)
+	return nil, fmt.Errorf("unexpected mutation type %T. expect *db.UserIdentityMutation", m)
 }
 
 // Condition is a hook condition function.
@@ -234,7 +248,6 @@ func HasFields(field string, fields ...string) Condition {
 // If executes the given hook under condition.
 //
 //	hook.If(ComputeAverage, And(HasFields(...), HasAddedFields(...)))
-//
 func If(hk db.Hook, cond Condition) db.Hook {
 	return func(next db.Mutator) db.Mutator {
 		return db.MutateFunc(func(ctx context.Context, m db.Mutation) (db.Value, error) {
@@ -249,7 +262,6 @@ func If(hk db.Hook, cond Condition) db.Hook {
 // On executes the given hook only for the given operation.
 //
 //	hook.On(Log, db.Delete|db.Create)
-//
 func On(hk db.Hook, op db.Op) db.Hook {
 	return If(hk, HasOp(op))
 }
@@ -257,7 +269,6 @@ func On(hk db.Hook, op db.Op) db.Hook {
 // Unless skips the given hook only for the given operation.
 //
 //	hook.Unless(Log, db.Update|db.UpdateOne)
-//
 func Unless(hk db.Hook, op db.Op) db.Hook {
 	return If(hk, Not(HasOp(op)))
 }
@@ -278,7 +289,6 @@ func FixedError(err error) db.Hook {
 //			Reject(db.Delete|db.Update),
 //		}
 //	}
-//
 func Reject(op db.Op) db.Hook {
 	hk := FixedError(fmt.Errorf("%s operation is not allowed", op))
 	return On(hk, op)
diff --git a/storage/ent/db/keys.go b/storage/ent/db/keys.go
index d307ad8ed2..bd3c02bcac 100644
--- a/storage/ent/db/keys.go
+++ b/storage/ent/db/keys.go
@@ -8,10 +8,11 @@ import (
 	"strings"
 	"time"
 
+	"entgo.io/ent"
 	"entgo.io/ent/dialect/sql"
 	"github.com/dexidp/dex/storage"
 	"github.com/dexidp/dex/storage/ent/db/keys"
-	jose "gopkg.in/square/go-jose.v2"
+	jose "github.com/go-jose/go-jose/v4"
 )
 
 // Keys is the model entity for the Keys schema.
@@ -27,11 +28,12 @@ type Keys struct {
 	SigningKeyPub jose.JSONWebKey `json:"signing_key_pub,omitempty"`
 	// NextRotation holds the value of the "next_rotation" field.
 	NextRotation time.Time `json:"next_rotation,omitempty"`
+	selectValues sql.SelectValues
 }
 
 // scanValues returns the types for scanning values from sql.Rows.
-func (*Keys) scanValues(columns []string) ([]interface{}, error) {
-	values := make([]interface{}, len(columns))
+func (*Keys) scanValues(columns []string) ([]any, error) {
+	values := make([]any, len(columns))
 	for i := range columns {
 		switch columns[i] {
 		case keys.FieldVerificationKeys, keys.FieldSigningKey, keys.FieldSigningKeyPub:
@@ -41,7 +43,7 @@ func (*Keys) scanValues(columns []string) ([]interface{}, error) {
 		case keys.FieldNextRotation:
 			values[i] = new(sql.NullTime)
 		default:
-			return nil, fmt.Errorf("unexpected column %q for type Keys", columns[i])
+			values[i] = new(sql.UnknownType)
 		}
 	}
 	return values, nil
@@ -49,7 +51,7 @@ func (*Keys) scanValues(columns []string) ([]interface{}, error) {
 
 // assignValues assigns the values that were returned from sql.Rows (after scanning)
 // to the Keys fields.
-func (k *Keys) assignValues(columns []string, values []interface{}) error {
+func (_m *Keys) assignValues(columns []string, values []any) error {
 	if m, n := len(values), len(columns); m < n {
 		return fmt.Errorf("mismatch number of scan values: %d != %d", m, n)
 	}
@@ -59,13 +61,13 @@ func (k *Keys) assignValues(columns []string, values []interface{}) error {
 			if value, ok := values[i].(*sql.NullString); !ok {
 				return fmt.Errorf("unexpected type %T for field id", values[i])
 			} else if value.Valid {
-				k.ID = value.String
+				_m.ID = value.String
 			}
 		case keys.FieldVerificationKeys:
 			if value, ok := values[i].(*[]byte); !ok {
 				return fmt.Errorf("unexpected type %T for field verification_keys", values[i])
 			} else if value != nil && len(*value) > 0 {
-				if err := json.Unmarshal(*value, &k.VerificationKeys); err != nil {
+				if err := json.Unmarshal(*value, &_m.VerificationKeys); err != nil {
 					return fmt.Errorf("unmarshal field verification_keys: %w", err)
 				}
 			}
@@ -73,7 +75,7 @@ func (k *Keys) assignValues(columns []string, values []interface{}) error {
 			if value, ok := values[i].(*[]byte); !ok {
 				return fmt.Errorf("unexpected type %T for field signing_key", values[i])
 			} else if value != nil && len(*value) > 0 {
-				if err := json.Unmarshal(*value, &k.SigningKey); err != nil {
+				if err := json.Unmarshal(*value, &_m.SigningKey); err != nil {
 					return fmt.Errorf("unmarshal field signing_key: %w", err)
 				}
 			}
@@ -81,7 +83,7 @@ func (k *Keys) assignValues(columns []string, values []interface{}) error {
 			if value, ok := values[i].(*[]byte); !ok {
 				return fmt.Errorf("unexpected type %T for field signing_key_pub", values[i])
 			} else if value != nil && len(*value) > 0 {
-				if err := json.Unmarshal(*value, &k.SigningKeyPub); err != nil {
+				if err := json.Unmarshal(*value, &_m.SigningKeyPub); err != nil {
 					return fmt.Errorf("unmarshal field signing_key_pub: %w", err)
 				}
 			}
@@ -89,56 +91,58 @@ func (k *Keys) assignValues(columns []string, values []interface{}) error {
 			if value, ok := values[i].(*sql.NullTime); !ok {
 				return fmt.Errorf("unexpected type %T for field next_rotation", values[i])
 			} else if value.Valid {
-				k.NextRotation = value.Time
+				_m.NextRotation = value.Time
 			}
+		default:
+			_m.selectValues.Set(columns[i], values[i])
 		}
 	}
 	return nil
 }
 
+// Value returns the ent.Value that was dynamically selected and assigned to the Keys.
+// This includes values selected through modifiers, order, etc.
+func (_m *Keys) Value(name string) (ent.Value, error) {
+	return _m.selectValues.Get(name)
+}
+
 // Update returns a builder for updating this Keys.
 // Note that you need to call Keys.Unwrap() before calling this method if this Keys
 // was returned from a transaction, and the transaction was committed or rolled back.
-func (k *Keys) Update() *KeysUpdateOne {
-	return (&KeysClient{config: k.config}).UpdateOne(k)
+func (_m *Keys) Update() *KeysUpdateOne {
+	return NewKeysClient(_m.config).UpdateOne(_m)
 }
 
 // Unwrap unwraps the Keys entity that was returned from a transaction after it was closed,
 // so that all future queries will be executed through the driver which created the transaction.
-func (k *Keys) Unwrap() *Keys {
-	_tx, ok := k.config.driver.(*txDriver)
+func (_m *Keys) Unwrap() *Keys {
+	_tx, ok := _m.config.driver.(*txDriver)
 	if !ok {
 		panic("db: Keys is not a transactional entity")
 	}
-	k.config.driver = _tx.drv
-	return k
+	_m.config.driver = _tx.drv
+	return _m
 }
 
 // String implements the fmt.Stringer.
-func (k *Keys) String() string {
+func (_m *Keys) String() string {
 	var builder strings.Builder
 	builder.WriteString("Keys(")
-	builder.WriteString(fmt.Sprintf("id=%v, ", k.ID))
+	builder.WriteString(fmt.Sprintf("id=%v, ", _m.ID))
 	builder.WriteString("verification_keys=")
-	builder.WriteString(fmt.Sprintf("%v", k.VerificationKeys))
+	builder.WriteString(fmt.Sprintf("%v", _m.VerificationKeys))
 	builder.WriteString(", ")
 	builder.WriteString("signing_key=")
-	builder.WriteString(fmt.Sprintf("%v", k.SigningKey))
+	builder.WriteString(fmt.Sprintf("%v", _m.SigningKey))
 	builder.WriteString(", ")
 	builder.WriteString("signing_key_pub=")
-	builder.WriteString(fmt.Sprintf("%v", k.SigningKeyPub))
+	builder.WriteString(fmt.Sprintf("%v", _m.SigningKeyPub))
 	builder.WriteString(", ")
 	builder.WriteString("next_rotation=")
-	builder.WriteString(k.NextRotation.Format(time.ANSIC))
+	builder.WriteString(_m.NextRotation.Format(time.ANSIC))
 	builder.WriteByte(')')
 	return builder.String()
 }
 
 // KeysSlice is a parsable slice of Keys.
 type KeysSlice []*Keys
-
-func (k KeysSlice) config(cfg config) {
-	for _i := range k {
-		k[_i].config = cfg
-	}
-}
diff --git a/storage/ent/db/keys/keys.go b/storage/ent/db/keys/keys.go
index eb96d92a11..a00f39b1fd 100644
--- a/storage/ent/db/keys/keys.go
+++ b/storage/ent/db/keys/keys.go
@@ -2,6 +2,10 @@
 
 package keys
 
+import (
+	"entgo.io/ent/dialect/sql"
+)
+
 const (
 	// Label holds the string label denoting the keys type in the database.
 	Label = "keys"
@@ -42,3 +46,16 @@ var (
 	// IDValidator is a validator for the "id" field. It is called by the builders before save.
 	IDValidator func(string) error
 )
+
+// OrderOption defines the ordering options for the Keys queries.
+type OrderOption func(*sql.Selector)
+
+// ByID orders the results by the id field.
+func ByID(opts ...sql.OrderTermOption) OrderOption {
+	return sql.OrderByField(FieldID, opts...).ToFunc()
+}
+
+// ByNextRotation orders the results by the next_rotation field.
+func ByNextRotation(opts ...sql.OrderTermOption) OrderOption {
+	return sql.OrderByField(FieldNextRotation, opts...).ToFunc()
+}
diff --git a/storage/ent/db/keys/where.go b/storage/ent/db/keys/where.go
index f918579da8..04bec3baec 100644
--- a/storage/ent/db/keys/where.go
+++ b/storage/ent/db/keys/where.go
@@ -11,174 +11,115 @@ import (
 
 // ID filters vertices based on their ID field.
 func ID(id string) predicate.Keys {
-	return predicate.Keys(func(s *sql.Selector) {
-		s.Where(sql.EQ(s.C(FieldID), id))
-	})
+	return predicate.Keys(sql.FieldEQ(FieldID, id))
 }
 
 // IDEQ applies the EQ predicate on the ID field.
 func IDEQ(id string) predicate.Keys {
-	return predicate.Keys(func(s *sql.Selector) {
-		s.Where(sql.EQ(s.C(FieldID), id))
-	})
+	return predicate.Keys(sql.FieldEQ(FieldID, id))
 }
 
 // IDNEQ applies the NEQ predicate on the ID field.
 func IDNEQ(id string) predicate.Keys {
-	return predicate.Keys(func(s *sql.Selector) {
-		s.Where(sql.NEQ(s.C(FieldID), id))
-	})
+	return predicate.Keys(sql.FieldNEQ(FieldID, id))
 }
 
 // IDIn applies the In predicate on the ID field.
 func IDIn(ids ...string) predicate.Keys {
-	return predicate.Keys(func(s *sql.Selector) {
-		v := make([]interface{}, len(ids))
-		for i := range v {
-			v[i] = ids[i]
-		}
-		s.Where(sql.In(s.C(FieldID), v...))
-	})
+	return predicate.Keys(sql.FieldIn(FieldID, ids...))
 }
 
 // IDNotIn applies the NotIn predicate on the ID field.
 func IDNotIn(ids ...string) predicate.Keys {
-	return predicate.Keys(func(s *sql.Selector) {
-		v := make([]interface{}, len(ids))
-		for i := range v {
-			v[i] = ids[i]
-		}
-		s.Where(sql.NotIn(s.C(FieldID), v...))
-	})
+	return predicate.Keys(sql.FieldNotIn(FieldID, ids...))
 }
 
 // IDGT applies the GT predicate on the ID field.
 func IDGT(id string) predicate.Keys {
-	return predicate.Keys(func(s *sql.Selector) {
-		s.Where(sql.GT(s.C(FieldID), id))
-	})
+	return predicate.Keys(sql.FieldGT(FieldID, id))
 }
 
 // IDGTE applies the GTE predicate on the ID field.
 func IDGTE(id string) predicate.Keys {
-	return predicate.Keys(func(s *sql.Selector) {
-		s.Where(sql.GTE(s.C(FieldID), id))
-	})
+	return predicate.Keys(sql.FieldGTE(FieldID, id))
 }
 
 // IDLT applies the LT predicate on the ID field.
 func IDLT(id string) predicate.Keys {
-	return predicate.Keys(func(s *sql.Selector) {
-		s.Where(sql.LT(s.C(FieldID), id))
-	})
+	return predicate.Keys(sql.FieldLT(FieldID, id))
 }
 
 // IDLTE applies the LTE predicate on the ID field.
 func IDLTE(id string) predicate.Keys {
-	return predicate.Keys(func(s *sql.Selector) {
-		s.Where(sql.LTE(s.C(FieldID), id))
-	})
+	return predicate.Keys(sql.FieldLTE(FieldID, id))
+}
+
+// IDEqualFold applies the EqualFold predicate on the ID field.
+func IDEqualFold(id string) predicate.Keys {
+	return predicate.Keys(sql.FieldEqualFold(FieldID, id))
+}
+
+// IDContainsFold applies the ContainsFold predicate on the ID field.
+func IDContainsFold(id string) predicate.Keys {
+	return predicate.Keys(sql.FieldContainsFold(FieldID, id))
 }
 
 // NextRotation applies equality check predicate on the "next_rotation" field. It's identical to NextRotationEQ.
 func NextRotation(v time.Time) predicate.Keys {
-	return predicate.Keys(func(s *sql.Selector) {
-		s.Where(sql.EQ(s.C(FieldNextRotation), v))
-	})
+	return predicate.Keys(sql.FieldEQ(FieldNextRotation, v))
 }
 
 // NextRotationEQ applies the EQ predicate on the "next_rotation" field.
 func NextRotationEQ(v time.Time) predicate.Keys {
-	return predicate.Keys(func(s *sql.Selector) {
-		s.Where(sql.EQ(s.C(FieldNextRotation), v))
-	})
+	return predicate.Keys(sql.FieldEQ(FieldNextRotation, v))
 }
 
 // NextRotationNEQ applies the NEQ predicate on the "next_rotation" field.
 func NextRotationNEQ(v time.Time) predicate.Keys {
-	return predicate.Keys(func(s *sql.Selector) {
-		s.Where(sql.NEQ(s.C(FieldNextRotation), v))
-	})
+	return predicate.Keys(sql.FieldNEQ(FieldNextRotation, v))
 }
 
 // NextRotationIn applies the In predicate on the "next_rotation" field.
 func NextRotationIn(vs ...time.Time) predicate.Keys {
-	v := make([]interface{}, len(vs))
-	for i := range v {
-		v[i] = vs[i]
-	}
-	return predicate.Keys(func(s *sql.Selector) {
-		s.Where(sql.In(s.C(FieldNextRotation), v...))
-	})
+	return predicate.Keys(sql.FieldIn(FieldNextRotation, vs...))
 }
 
 // NextRotationNotIn applies the NotIn predicate on the "next_rotation" field.
 func NextRotationNotIn(vs ...time.Time) predicate.Keys {
-	v := make([]interface{}, len(vs))
-	for i := range v {
-		v[i] = vs[i]
-	}
-	return predicate.Keys(func(s *sql.Selector) {
-		s.Where(sql.NotIn(s.C(FieldNextRotation), v...))
-	})
+	return predicate.Keys(sql.FieldNotIn(FieldNextRotation, vs...))
 }
 
 // NextRotationGT applies the GT predicate on the "next_rotation" field.
 func NextRotationGT(v time.Time) predicate.Keys {
-	return predicate.Keys(func(s *sql.Selector) {
-		s.Where(sql.GT(s.C(FieldNextRotation), v))
-	})
+	return predicate.Keys(sql.FieldGT(FieldNextRotation, v))
 }
 
 // NextRotationGTE applies the GTE predicate on the "next_rotation" field.
 func NextRotationGTE(v time.Time) predicate.Keys {
-	return predicate.Keys(func(s *sql.Selector) {
-		s.Where(sql.GTE(s.C(FieldNextRotation), v))
-	})
+	return predicate.Keys(sql.FieldGTE(FieldNextRotation, v))
 }
 
 // NextRotationLT applies the LT predicate on the "next_rotation" field.
 func NextRotationLT(v time.Time) predicate.Keys {
-	return predicate.Keys(func(s *sql.Selector) {
-		s.Where(sql.LT(s.C(FieldNextRotation), v))
-	})
+	return predicate.Keys(sql.FieldLT(FieldNextRotation, v))
 }
 
 // NextRotationLTE applies the LTE predicate on the "next_rotation" field.
 func NextRotationLTE(v time.Time) predicate.Keys {
-	return predicate.Keys(func(s *sql.Selector) {
-		s.Where(sql.LTE(s.C(FieldNextRotation), v))
-	})
+	return predicate.Keys(sql.FieldLTE(FieldNextRotation, v))
 }
 
 // And groups predicates with the AND operator between them.
 func And(predicates ...predicate.Keys) predicate.Keys {
-	return predicate.Keys(func(s *sql.Selector) {
-		s1 := s.Clone().SetP(nil)
-		for _, p := range predicates {
-			p(s1)
-		}
-		s.Where(s1.P())
-	})
+	return predicate.Keys(sql.AndPredicates(predicates...))
 }
 
 // Or groups predicates with the OR operator between them.
 func Or(predicates ...predicate.Keys) predicate.Keys {
-	return predicate.Keys(func(s *sql.Selector) {
-		s1 := s.Clone().SetP(nil)
-		for i, p := range predicates {
-			if i > 0 {
-				s1.Or()
-			}
-			p(s1)
-		}
-		s.Where(s1.P())
-	})
+	return predicate.Keys(sql.OrPredicates(predicates...))
 }
 
 // Not applies the not operator on the given predicate.
 func Not(p predicate.Keys) predicate.Keys {
-	return predicate.Keys(func(s *sql.Selector) {
-		p(s.Not())
-	})
+	return predicate.Keys(sql.NotPredicates(p))
 }
diff --git a/storage/ent/db/keys_create.go b/storage/ent/db/keys_create.go
index 818ca27891..9cafd80a16 100644
--- a/storage/ent/db/keys_create.go
+++ b/storage/ent/db/keys_create.go
@@ -12,7 +12,7 @@ import (
 	"entgo.io/ent/schema/field"
 	"github.com/dexidp/dex/storage"
 	"github.com/dexidp/dex/storage/ent/db/keys"
-	jose "gopkg.in/square/go-jose.v2"
+	jose "github.com/go-jose/go-jose/v4"
 )
 
 // KeysCreate is the builder for creating a Keys entity.
@@ -23,90 +23,48 @@ type KeysCreate struct {
 }
 
 // SetVerificationKeys sets the "verification_keys" field.
-func (kc *KeysCreate) SetVerificationKeys(sk []storage.VerificationKey) *KeysCreate {
-	kc.mutation.SetVerificationKeys(sk)
-	return kc
+func (_c *KeysCreate) SetVerificationKeys(v []storage.VerificationKey) *KeysCreate {
+	_c.mutation.SetVerificationKeys(v)
+	return _c
 }
 
 // SetSigningKey sets the "signing_key" field.
-func (kc *KeysCreate) SetSigningKey(jwk jose.JSONWebKey) *KeysCreate {
-	kc.mutation.SetSigningKey(jwk)
-	return kc
+func (_c *KeysCreate) SetSigningKey(v jose.JSONWebKey) *KeysCreate {
+	_c.mutation.SetSigningKey(v)
+	return _c
 }
 
 // SetSigningKeyPub sets the "signing_key_pub" field.
-func (kc *KeysCreate) SetSigningKeyPub(jwk jose.JSONWebKey) *KeysCreate {
-	kc.mutation.SetSigningKeyPub(jwk)
-	return kc
+func (_c *KeysCreate) SetSigningKeyPub(v jose.JSONWebKey) *KeysCreate {
+	_c.mutation.SetSigningKeyPub(v)
+	return _c
 }
 
 // SetNextRotation sets the "next_rotation" field.
-func (kc *KeysCreate) SetNextRotation(t time.Time) *KeysCreate {
-	kc.mutation.SetNextRotation(t)
-	return kc
+func (_c *KeysCreate) SetNextRotation(v time.Time) *KeysCreate {
+	_c.mutation.SetNextRotation(v)
+	return _c
 }
 
 // SetID sets the "id" field.
-func (kc *KeysCreate) SetID(s string) *KeysCreate {
-	kc.mutation.SetID(s)
-	return kc
+func (_c *KeysCreate) SetID(v string) *KeysCreate {
+	_c.mutation.SetID(v)
+	return _c
 }
 
 // Mutation returns the KeysMutation object of the builder.
-func (kc *KeysCreate) Mutation() *KeysMutation {
-	return kc.mutation
+func (_c *KeysCreate) Mutation() *KeysMutation {
+	return _c.mutation
 }
 
 // Save creates the Keys in the database.
-func (kc *KeysCreate) Save(ctx context.Context) (*Keys, error) {
-	var (
-		err  error
-		node *Keys
-	)
-	if len(kc.hooks) == 0 {
-		if err = kc.check(); err != nil {
-			return nil, err
-		}
-		node, err = kc.sqlSave(ctx)
-	} else {
-		var mut Mutator = MutateFunc(func(ctx context.Context, m Mutation) (Value, error) {
-			mutation, ok := m.(*KeysMutation)
-			if !ok {
-				return nil, fmt.Errorf("unexpected mutation type %T", m)
-			}
-			if err = kc.check(); err != nil {
-				return nil, err
-			}
-			kc.mutation = mutation
-			if node, err = kc.sqlSave(ctx); err != nil {
-				return nil, err
-			}
-			mutation.id = &node.ID
-			mutation.done = true
-			return node, err
-		})
-		for i := len(kc.hooks) - 1; i >= 0; i-- {
-			if kc.hooks[i] == nil {
-				return nil, fmt.Errorf("db: uninitialized hook (forgotten import db/runtime?)")
-			}
-			mut = kc.hooks[i](mut)
-		}
-		v, err := mut.Mutate(ctx, kc.mutation)
-		if err != nil {
-			return nil, err
-		}
-		nv, ok := v.(*Keys)
-		if !ok {
-			return nil, fmt.Errorf("unexpected node type %T returned from KeysMutation", v)
-		}
-		node = nv
-	}
-	return node, err
+func (_c *KeysCreate) Save(ctx context.Context) (*Keys, error) {
+	return withHooks(ctx, _c.sqlSave, _c.mutation, _c.hooks)
 }
 
 // SaveX calls Save and panics if Save returns an error.
-func (kc *KeysCreate) SaveX(ctx context.Context) *Keys {
-	v, err := kc.Save(ctx)
+func (_c *KeysCreate) SaveX(ctx context.Context) *Keys {
+	v, err := _c.Save(ctx)
 	if err != nil {
 		panic(err)
 	}
@@ -114,33 +72,33 @@ func (kc *KeysCreate) SaveX(ctx context.Context) *Keys {
 }
 
 // Exec executes the query.
-func (kc *KeysCreate) Exec(ctx context.Context) error {
-	_, err := kc.Save(ctx)
+func (_c *KeysCreate) Exec(ctx context.Context) error {
+	_, err := _c.Save(ctx)
 	return err
 }
 
 // ExecX is like Exec, but panics if an error occurs.
-func (kc *KeysCreate) ExecX(ctx context.Context) {
-	if err := kc.Exec(ctx); err != nil {
+func (_c *KeysCreate) ExecX(ctx context.Context) {
+	if err := _c.Exec(ctx); err != nil {
 		panic(err)
 	}
 }
 
 // check runs all checks and user-defined validators on the builder.
-func (kc *KeysCreate) check() error {
-	if _, ok := kc.mutation.VerificationKeys(); !ok {
+func (_c *KeysCreate) check() error {
+	if _, ok := _c.mutation.VerificationKeys(); !ok {
 		return &ValidationError{Name: "verification_keys", err: errors.New(`db: missing required field "Keys.verification_keys"`)}
 	}
-	if _, ok := kc.mutation.SigningKey(); !ok {
+	if _, ok := _c.mutation.SigningKey(); !ok {
 		return &ValidationError{Name: "signing_key", err: errors.New(`db: missing required field "Keys.signing_key"`)}
 	}
-	if _, ok := kc.mutation.SigningKeyPub(); !ok {
+	if _, ok := _c.mutation.SigningKeyPub(); !ok {
 		return &ValidationError{Name: "signing_key_pub", err: errors.New(`db: missing required field "Keys.signing_key_pub"`)}
 	}
-	if _, ok := kc.mutation.NextRotation(); !ok {
+	if _, ok := _c.mutation.NextRotation(); !ok {
 		return &ValidationError{Name: "next_rotation", err: errors.New(`db: missing required field "Keys.next_rotation"`)}
 	}
-	if v, ok := kc.mutation.ID(); ok {
+	if v, ok := _c.mutation.ID(); ok {
 		if err := keys.IDValidator(v); err != nil {
 			return &ValidationError{Name: "id", err: fmt.Errorf(`db: validator failed for field "Keys.id": %w`, err)}
 		}
@@ -148,9 +106,12 @@ func (kc *KeysCreate) check() error {
 	return nil
 }
 
-func (kc *KeysCreate) sqlSave(ctx context.Context) (*Keys, error) {
-	_node, _spec := kc.createSpec()
-	if err := sqlgraph.CreateNode(ctx, kc.driver, _spec); err != nil {
+func (_c *KeysCreate) sqlSave(ctx context.Context) (*Keys, error) {
+	if err := _c.check(); err != nil {
+		return nil, err
+	}
+	_node, _spec := _c.createSpec()
+	if err := sqlgraph.CreateNode(ctx, _c.driver, _spec); err != nil {
 		if sqlgraph.IsConstraintError(err) {
 			err = &ConstraintError{msg: err.Error(), wrap: err}
 		}
@@ -163,54 +124,34 @@ func (kc *KeysCreate) sqlSave(ctx context.Context) (*Keys, error) {
 			return nil, fmt.Errorf("unexpected Keys.ID type: %T", _spec.ID.Value)
 		}
 	}
+	_c.mutation.id = &_node.ID
+	_c.mutation.done = true
 	return _node, nil
 }
 
-func (kc *KeysCreate) createSpec() (*Keys, *sqlgraph.CreateSpec) {
+func (_c *KeysCreate) createSpec() (*Keys, *sqlgraph.CreateSpec) {
 	var (
-		_node = &Keys{config: kc.config}
-		_spec = &sqlgraph.CreateSpec{
-			Table: keys.Table,
-			ID: &sqlgraph.FieldSpec{
-				Type:   field.TypeString,
-				Column: keys.FieldID,
-			},
-		}
+		_node = &Keys{config: _c.config}
+		_spec = sqlgraph.NewCreateSpec(keys.Table, sqlgraph.NewFieldSpec(keys.FieldID, field.TypeString))
 	)
-	if id, ok := kc.mutation.ID(); ok {
+	if id, ok := _c.mutation.ID(); ok {
 		_node.ID = id
 		_spec.ID.Value = id
 	}
-	if value, ok := kc.mutation.VerificationKeys(); ok {
-		_spec.Fields = append(_spec.Fields, &sqlgraph.FieldSpec{
-			Type:   field.TypeJSON,
-			Value:  value,
-			Column: keys.FieldVerificationKeys,
-		})
+	if value, ok := _c.mutation.VerificationKeys(); ok {
+		_spec.SetField(keys.FieldVerificationKeys, field.TypeJSON, value)
 		_node.VerificationKeys = value
 	}
-	if value, ok := kc.mutation.SigningKey(); ok {
-		_spec.Fields = append(_spec.Fields, &sqlgraph.FieldSpec{
-			Type:   field.TypeJSON,
-			Value:  value,
-			Column: keys.FieldSigningKey,
-		})
+	if value, ok := _c.mutation.SigningKey(); ok {
+		_spec.SetField(keys.FieldSigningKey, field.TypeJSON, value)
 		_node.SigningKey = value
 	}
-	if value, ok := kc.mutation.SigningKeyPub(); ok {
-		_spec.Fields = append(_spec.Fields, &sqlgraph.FieldSpec{
-			Type:   field.TypeJSON,
-			Value:  value,
-			Column: keys.FieldSigningKeyPub,
-		})
+	if value, ok := _c.mutation.SigningKeyPub(); ok {
+		_spec.SetField(keys.FieldSigningKeyPub, field.TypeJSON, value)
 		_node.SigningKeyPub = value
 	}
-	if value, ok := kc.mutation.NextRotation(); ok {
-		_spec.Fields = append(_spec.Fields, &sqlgraph.FieldSpec{
-			Type:   field.TypeTime,
-			Value:  value,
-			Column: keys.FieldNextRotation,
-		})
+	if value, ok := _c.mutation.NextRotation(); ok {
+		_spec.SetField(keys.FieldNextRotation, field.TypeTime, value)
 		_node.NextRotation = value
 	}
 	return _node, _spec
@@ -219,17 +160,21 @@ func (kc *KeysCreate) createSpec() (*Keys, *sqlgraph.CreateSpec) {
 // KeysCreateBulk is the builder for creating many Keys entities in bulk.
 type KeysCreateBulk struct {
 	config
+	err      error
 	builders []*KeysCreate
 }
 
 // Save creates the Keys entities in the database.
-func (kcb *KeysCreateBulk) Save(ctx context.Context) ([]*Keys, error) {
-	specs := make([]*sqlgraph.CreateSpec, len(kcb.builders))
-	nodes := make([]*Keys, len(kcb.builders))
-	mutators := make([]Mutator, len(kcb.builders))
-	for i := range kcb.builders {
+func (_c *KeysCreateBulk) Save(ctx context.Context) ([]*Keys, error) {
+	if _c.err != nil {
+		return nil, _c.err
+	}
+	specs := make([]*sqlgraph.CreateSpec, len(_c.builders))
+	nodes := make([]*Keys, len(_c.builders))
+	mutators := make([]Mutator, len(_c.builders))
+	for i := range _c.builders {
 		func(i int, root context.Context) {
-			builder := kcb.builders[i]
+			builder := _c.builders[i]
 			var mut Mutator = MutateFunc(func(ctx context.Context, m Mutation) (Value, error) {
 				mutation, ok := m.(*KeysMutation)
 				if !ok {
@@ -239,14 +184,14 @@ func (kcb *KeysCreateBulk) Save(ctx context.Context) ([]*Keys, error) {
 					return nil, err
 				}
 				builder.mutation = mutation
-				nodes[i], specs[i] = builder.createSpec()
 				var err error
+				nodes[i], specs[i] = builder.createSpec()
 				if i < len(mutators)-1 {
-					_, err = mutators[i+1].Mutate(root, kcb.builders[i+1].mutation)
+					_, err = mutators[i+1].Mutate(root, _c.builders[i+1].mutation)
 				} else {
 					spec := &sqlgraph.BatchCreateSpec{Nodes: specs}
 					// Invoke the actual operation on the latest mutation in the chain.
-					if err = sqlgraph.BatchCreate(ctx, kcb.driver, spec); err != nil {
+					if err = sqlgraph.BatchCreate(ctx, _c.driver, spec); err != nil {
 						if sqlgraph.IsConstraintError(err) {
 							err = &ConstraintError{msg: err.Error(), wrap: err}
 						}
@@ -266,7 +211,7 @@ func (kcb *KeysCreateBulk) Save(ctx context.Context) ([]*Keys, error) {
 		}(i, ctx)
 	}
 	if len(mutators) > 0 {
-		if _, err := mutators[0].Mutate(ctx, kcb.builders[0].mutation); err != nil {
+		if _, err := mutators[0].Mutate(ctx, _c.builders[0].mutation); err != nil {
 			return nil, err
 		}
 	}
@@ -274,8 +219,8 @@ func (kcb *KeysCreateBulk) Save(ctx context.Context) ([]*Keys, error) {
 }
 
 // SaveX is like Save, but panics if an error occurs.
-func (kcb *KeysCreateBulk) SaveX(ctx context.Context) []*Keys {
-	v, err := kcb.Save(ctx)
+func (_c *KeysCreateBulk) SaveX(ctx context.Context) []*Keys {
+	v, err := _c.Save(ctx)
 	if err != nil {
 		panic(err)
 	}
@@ -283,14 +228,14 @@ func (kcb *KeysCreateBulk) SaveX(ctx context.Context) []*Keys {
 }
 
 // Exec executes the query.
-func (kcb *KeysCreateBulk) Exec(ctx context.Context) error {
-	_, err := kcb.Save(ctx)
+func (_c *KeysCreateBulk) Exec(ctx context.Context) error {
+	_, err := _c.Save(ctx)
 	return err
 }
 
 // ExecX is like Exec, but panics if an error occurs.
-func (kcb *KeysCreateBulk) ExecX(ctx context.Context) {
-	if err := kcb.Exec(ctx); err != nil {
+func (_c *KeysCreateBulk) ExecX(ctx context.Context) {
+	if err := _c.Exec(ctx); err != nil {
 		panic(err)
 	}
 }
diff --git a/storage/ent/db/keys_delete.go b/storage/ent/db/keys_delete.go
index 5bcf970f58..b4e838eb62 100644
--- a/storage/ent/db/keys_delete.go
+++ b/storage/ent/db/keys_delete.go
@@ -4,7 +4,6 @@ package db
 
 import (
 	"context"
-	"fmt"
 
 	"entgo.io/ent/dialect/sql"
 	"entgo.io/ent/dialect/sql/sqlgraph"
@@ -21,84 +20,56 @@ type KeysDelete struct {
 }
 
 // Where appends a list predicates to the KeysDelete builder.
-func (kd *KeysDelete) Where(ps ...predicate.Keys) *KeysDelete {
-	kd.mutation.Where(ps...)
-	return kd
+func (_d *KeysDelete) Where(ps ...predicate.Keys) *KeysDelete {
+	_d.mutation.Where(ps...)
+	return _d
 }
 
 // Exec executes the deletion query and returns how many vertices were deleted.
-func (kd *KeysDelete) Exec(ctx context.Context) (int, error) {
-	var (
-		err      error
-		affected int
-	)
-	if len(kd.hooks) == 0 {
-		affected, err = kd.sqlExec(ctx)
-	} else {
-		var mut Mutator = MutateFunc(func(ctx context.Context, m Mutation) (Value, error) {
-			mutation, ok := m.(*KeysMutation)
-			if !ok {
-				return nil, fmt.Errorf("unexpected mutation type %T", m)
-			}
-			kd.mutation = mutation
-			affected, err = kd.sqlExec(ctx)
-			mutation.done = true
-			return affected, err
-		})
-		for i := len(kd.hooks) - 1; i >= 0; i-- {
-			if kd.hooks[i] == nil {
-				return 0, fmt.Errorf("db: uninitialized hook (forgotten import db/runtime?)")
-			}
-			mut = kd.hooks[i](mut)
-		}
-		if _, err := mut.Mutate(ctx, kd.mutation); err != nil {
-			return 0, err
-		}
-	}
-	return affected, err
+func (_d *KeysDelete) Exec(ctx context.Context) (int, error) {
+	return withHooks(ctx, _d.sqlExec, _d.mutation, _d.hooks)
 }
 
 // ExecX is like Exec, but panics if an error occurs.
-func (kd *KeysDelete) ExecX(ctx context.Context) int {
-	n, err := kd.Exec(ctx)
+func (_d *KeysDelete) ExecX(ctx context.Context) int {
+	n, err := _d.Exec(ctx)
 	if err != nil {
 		panic(err)
 	}
 	return n
 }
 
-func (kd *KeysDelete) sqlExec(ctx context.Context) (int, error) {
-	_spec := &sqlgraph.DeleteSpec{
-		Node: &sqlgraph.NodeSpec{
-			Table: keys.Table,
-			ID: &sqlgraph.FieldSpec{
-				Type:   field.TypeString,
-				Column: keys.FieldID,
-			},
-		},
-	}
-	if ps := kd.mutation.predicates; len(ps) > 0 {
+func (_d *KeysDelete) sqlExec(ctx context.Context) (int, error) {
+	_spec := sqlgraph.NewDeleteSpec(keys.Table, sqlgraph.NewFieldSpec(keys.FieldID, field.TypeString))
+	if ps := _d.mutation.predicates; len(ps) > 0 {
 		_spec.Predicate = func(selector *sql.Selector) {
 			for i := range ps {
 				ps[i](selector)
 			}
 		}
 	}
-	affected, err := sqlgraph.DeleteNodes(ctx, kd.driver, _spec)
+	affected, err := sqlgraph.DeleteNodes(ctx, _d.driver, _spec)
 	if err != nil && sqlgraph.IsConstraintError(err) {
 		err = &ConstraintError{msg: err.Error(), wrap: err}
 	}
+	_d.mutation.done = true
 	return affected, err
 }
 
 // KeysDeleteOne is the builder for deleting a single Keys entity.
 type KeysDeleteOne struct {
-	kd *KeysDelete
+	_d *KeysDelete
+}
+
+// Where appends a list predicates to the KeysDelete builder.
+func (_d *KeysDeleteOne) Where(ps ...predicate.Keys) *KeysDeleteOne {
+	_d._d.mutation.Where(ps...)
+	return _d
 }
 
 // Exec executes the deletion query.
-func (kdo *KeysDeleteOne) Exec(ctx context.Context) error {
-	n, err := kdo.kd.Exec(ctx)
+func (_d *KeysDeleteOne) Exec(ctx context.Context) error {
+	n, err := _d._d.Exec(ctx)
 	switch {
 	case err != nil:
 		return err
@@ -110,6 +81,8 @@ func (kdo *KeysDeleteOne) Exec(ctx context.Context) error {
 }
 
 // ExecX is like Exec, but panics if an error occurs.
-func (kdo *KeysDeleteOne) ExecX(ctx context.Context) {
-	kdo.kd.ExecX(ctx)
+func (_d *KeysDeleteOne) ExecX(ctx context.Context) {
+	if err := _d.Exec(ctx); err != nil {
+		panic(err)
+	}
 }
diff --git a/storage/ent/db/keys_query.go b/storage/ent/db/keys_query.go
index 7d9ea9082d..1c86b797a4 100644
--- a/storage/ent/db/keys_query.go
+++ b/storage/ent/db/keys_query.go
@@ -7,6 +7,7 @@ import (
 	"fmt"
 	"math"
 
+	"entgo.io/ent"
 	"entgo.io/ent/dialect/sql"
 	"entgo.io/ent/dialect/sql/sqlgraph"
 	"entgo.io/ent/schema/field"
@@ -17,11 +18,9 @@ import (
 // KeysQuery is the builder for querying Keys entities.
 type KeysQuery struct {
 	config
-	limit      *int
-	offset     *int
-	unique     *bool
-	order      []OrderFunc
-	fields     []string
+	ctx        *QueryContext
+	order      []keys.OrderOption
+	inters     []Interceptor
 	predicates []predicate.Keys
 	// intermediate query (i.e. traversal path).
 	sql  *sql.Selector
@@ -29,40 +28,40 @@ type KeysQuery struct {
 }
 
 // Where adds a new predicate for the KeysQuery builder.
-func (kq *KeysQuery) Where(ps ...predicate.Keys) *KeysQuery {
-	kq.predicates = append(kq.predicates, ps...)
-	return kq
+func (_q *KeysQuery) Where(ps ...predicate.Keys) *KeysQuery {
+	_q.predicates = append(_q.predicates, ps...)
+	return _q
 }
 
-// Limit adds a limit step to the query.
-func (kq *KeysQuery) Limit(limit int) *KeysQuery {
-	kq.limit = &limit
-	return kq
+// Limit the number of records to be returned by this query.
+func (_q *KeysQuery) Limit(limit int) *KeysQuery {
+	_q.ctx.Limit = &limit
+	return _q
 }
 
-// Offset adds an offset step to the query.
-func (kq *KeysQuery) Offset(offset int) *KeysQuery {
-	kq.offset = &offset
-	return kq
+// Offset to start from.
+func (_q *KeysQuery) Offset(offset int) *KeysQuery {
+	_q.ctx.Offset = &offset
+	return _q
 }
 
 // Unique configures the query builder to filter duplicate records on query.
 // By default, unique is set to true, and can be disabled using this method.
-func (kq *KeysQuery) Unique(unique bool) *KeysQuery {
-	kq.unique = &unique
-	return kq
+func (_q *KeysQuery) Unique(unique bool) *KeysQuery {
+	_q.ctx.Unique = &unique
+	return _q
 }
 
-// Order adds an order step to the query.
-func (kq *KeysQuery) Order(o ...OrderFunc) *KeysQuery {
-	kq.order = append(kq.order, o...)
-	return kq
+// Order specifies how the records should be ordered.
+func (_q *KeysQuery) Order(o ...keys.OrderOption) *KeysQuery {
+	_q.order = append(_q.order, o...)
+	return _q
 }
 
 // First returns the first Keys entity from the query.
 // Returns a *NotFoundError when no Keys was found.
-func (kq *KeysQuery) First(ctx context.Context) (*Keys, error) {
-	nodes, err := kq.Limit(1).All(ctx)
+func (_q *KeysQuery) First(ctx context.Context) (*Keys, error) {
+	nodes, err := _q.Limit(1).All(setContextOp(ctx, _q.ctx, ent.OpQueryFirst))
 	if err != nil {
 		return nil, err
 	}
@@ -73,8 +72,8 @@ func (kq *KeysQuery) First(ctx context.Context) (*Keys, error) {
 }
 
 // FirstX is like First, but panics if an error occurs.
-func (kq *KeysQuery) FirstX(ctx context.Context) *Keys {
-	node, err := kq.First(ctx)
+func (_q *KeysQuery) FirstX(ctx context.Context) *Keys {
+	node, err := _q.First(ctx)
 	if err != nil && !IsNotFound(err) {
 		panic(err)
 	}
@@ -83,9 +82,9 @@ func (kq *KeysQuery) FirstX(ctx context.Context) *Keys {
 
 // FirstID returns the first Keys ID from the query.
 // Returns a *NotFoundError when no Keys ID was found.
-func (kq *KeysQuery) FirstID(ctx context.Context) (id string, err error) {
+func (_q *KeysQuery) FirstID(ctx context.Context) (id string, err error) {
 	var ids []string
-	if ids, err = kq.Limit(1).IDs(ctx); err != nil {
+	if ids, err = _q.Limit(1).IDs(setContextOp(ctx, _q.ctx, ent.OpQueryFirstID)); err != nil {
 		return
 	}
 	if len(ids) == 0 {
@@ -96,8 +95,8 @@ func (kq *KeysQuery) FirstID(ctx context.Context) (id string, err error) {
 }
 
 // FirstIDX is like FirstID, but panics if an error occurs.
-func (kq *KeysQuery) FirstIDX(ctx context.Context) string {
-	id, err := kq.FirstID(ctx)
+func (_q *KeysQuery) FirstIDX(ctx context.Context) string {
+	id, err := _q.FirstID(ctx)
 	if err != nil && !IsNotFound(err) {
 		panic(err)
 	}
@@ -107,8 +106,8 @@ func (kq *KeysQuery) FirstIDX(ctx context.Context) string {
 // Only returns a single Keys entity found by the query, ensuring it only returns one.
 // Returns a *NotSingularError when more than one Keys entity is found.
 // Returns a *NotFoundError when no Keys entities are found.
-func (kq *KeysQuery) Only(ctx context.Context) (*Keys, error) {
-	nodes, err := kq.Limit(2).All(ctx)
+func (_q *KeysQuery) Only(ctx context.Context) (*Keys, error) {
+	nodes, err := _q.Limit(2).All(setContextOp(ctx, _q.ctx, ent.OpQueryOnly))
 	if err != nil {
 		return nil, err
 	}
@@ -123,8 +122,8 @@ func (kq *KeysQuery) Only(ctx context.Context) (*Keys, error) {
 }
 
 // OnlyX is like Only, but panics if an error occurs.
-func (kq *KeysQuery) OnlyX(ctx context.Context) *Keys {
-	node, err := kq.Only(ctx)
+func (_q *KeysQuery) OnlyX(ctx context.Context) *Keys {
+	node, err := _q.Only(ctx)
 	if err != nil {
 		panic(err)
 	}
@@ -134,9 +133,9 @@ func (kq *KeysQuery) OnlyX(ctx context.Context) *Keys {
 // OnlyID is like Only, but returns the only Keys ID in the query.
 // Returns a *NotSingularError when more than one Keys ID is found.
 // Returns a *NotFoundError when no entities are found.
-func (kq *KeysQuery) OnlyID(ctx context.Context) (id string, err error) {
+func (_q *KeysQuery) OnlyID(ctx context.Context) (id string, err error) {
 	var ids []string
-	if ids, err = kq.Limit(2).IDs(ctx); err != nil {
+	if ids, err = _q.Limit(2).IDs(setContextOp(ctx, _q.ctx, ent.OpQueryOnlyID)); err != nil {
 		return
 	}
 	switch len(ids) {
@@ -151,8 +150,8 @@ func (kq *KeysQuery) OnlyID(ctx context.Context) (id string, err error) {
 }
 
 // OnlyIDX is like OnlyID, but panics if an error occurs.
-func (kq *KeysQuery) OnlyIDX(ctx context.Context) string {
-	id, err := kq.OnlyID(ctx)
+func (_q *KeysQuery) OnlyIDX(ctx context.Context) string {
+	id, err := _q.OnlyID(ctx)
 	if err != nil {
 		panic(err)
 	}
@@ -160,16 +159,18 @@ func (kq *KeysQuery) OnlyIDX(ctx context.Context) string {
 }
 
 // All executes the query and returns a list of KeysSlice.
-func (kq *KeysQuery) All(ctx context.Context) ([]*Keys, error) {
-	if err := kq.prepareQuery(ctx); err != nil {
+func (_q *KeysQuery) All(ctx context.Context) ([]*Keys, error) {
+	ctx = setContextOp(ctx, _q.ctx, ent.OpQueryAll)
+	if err := _q.prepareQuery(ctx); err != nil {
 		return nil, err
 	}
-	return kq.sqlAll(ctx)
+	qr := querierAll[[]*Keys, *KeysQuery]()
+	return withInterceptors[[]*Keys](ctx, _q, qr, _q.inters)
 }
 
 // AllX is like All, but panics if an error occurs.
-func (kq *KeysQuery) AllX(ctx context.Context) []*Keys {
-	nodes, err := kq.All(ctx)
+func (_q *KeysQuery) AllX(ctx context.Context) []*Keys {
+	nodes, err := _q.All(ctx)
 	if err != nil {
 		panic(err)
 	}
@@ -177,17 +178,20 @@ func (kq *KeysQuery) AllX(ctx context.Context) []*Keys {
 }
 
 // IDs executes the query and returns a list of Keys IDs.
-func (kq *KeysQuery) IDs(ctx context.Context) ([]string, error) {
-	var ids []string
-	if err := kq.Select(keys.FieldID).Scan(ctx, &ids); err != nil {
+func (_q *KeysQuery) IDs(ctx context.Context) (ids []string, err error) {
+	if _q.ctx.Unique == nil && _q.path != nil {
+		_q.Unique(true)
+	}
+	ctx = setContextOp(ctx, _q.ctx, ent.OpQueryIDs)
+	if err = _q.Select(keys.FieldID).Scan(ctx, &ids); err != nil {
 		return nil, err
 	}
 	return ids, nil
 }
 
 // IDsX is like IDs, but panics if an error occurs.
-func (kq *KeysQuery) IDsX(ctx context.Context) []string {
-	ids, err := kq.IDs(ctx)
+func (_q *KeysQuery) IDsX(ctx context.Context) []string {
+	ids, err := _q.IDs(ctx)
 	if err != nil {
 		panic(err)
 	}
@@ -195,16 +199,17 @@ func (kq *KeysQuery) IDsX(ctx context.Context) []string {
 }
 
 // Count returns the count of the given query.
-func (kq *KeysQuery) Count(ctx context.Context) (int, error) {
-	if err := kq.prepareQuery(ctx); err != nil {
+func (_q *KeysQuery) Count(ctx context.Context) (int, error) {
+	ctx = setContextOp(ctx, _q.ctx, ent.OpQueryCount)
+	if err := _q.prepareQuery(ctx); err != nil {
 		return 0, err
 	}
-	return kq.sqlCount(ctx)
+	return withInterceptors[int](ctx, _q, querierCount[*KeysQuery](), _q.inters)
 }
 
 // CountX is like Count, but panics if an error occurs.
-func (kq *KeysQuery) CountX(ctx context.Context) int {
-	count, err := kq.Count(ctx)
+func (_q *KeysQuery) CountX(ctx context.Context) int {
+	count, err := _q.Count(ctx)
 	if err != nil {
 		panic(err)
 	}
@@ -212,16 +217,21 @@ func (kq *KeysQuery) CountX(ctx context.Context) int {
 }
 
 // Exist returns true if the query has elements in the graph.
-func (kq *KeysQuery) Exist(ctx context.Context) (bool, error) {
-	if err := kq.prepareQuery(ctx); err != nil {
-		return false, err
+func (_q *KeysQuery) Exist(ctx context.Context) (bool, error) {
+	ctx = setContextOp(ctx, _q.ctx, ent.OpQueryExist)
+	switch _, err := _q.FirstID(ctx); {
+	case IsNotFound(err):
+		return false, nil
+	case err != nil:
+		return false, fmt.Errorf("db: check existence: %w", err)
+	default:
+		return true, nil
 	}
-	return kq.sqlExist(ctx)
 }
 
 // ExistX is like Exist, but panics if an error occurs.
-func (kq *KeysQuery) ExistX(ctx context.Context) bool {
-	exist, err := kq.Exist(ctx)
+func (_q *KeysQuery) ExistX(ctx context.Context) bool {
+	exist, err := _q.Exist(ctx)
 	if err != nil {
 		panic(err)
 	}
@@ -230,20 +240,19 @@ func (kq *KeysQuery) ExistX(ctx context.Context) bool {
 
 // Clone returns a duplicate of the KeysQuery builder, including all associated steps. It can be
 // used to prepare common query builders and use them differently after the clone is made.
-func (kq *KeysQuery) Clone() *KeysQuery {
-	if kq == nil {
+func (_q *KeysQuery) Clone() *KeysQuery {
+	if _q == nil {
 		return nil
 	}
 	return &KeysQuery{
-		config:     kq.config,
-		limit:      kq.limit,
-		offset:     kq.offset,
-		order:      append([]OrderFunc{}, kq.order...),
-		predicates: append([]predicate.Keys{}, kq.predicates...),
+		config:     _q.config,
+		ctx:        _q.ctx.Clone(),
+		order:      append([]keys.OrderOption{}, _q.order...),
+		inters:     append([]Interceptor{}, _q.inters...),
+		predicates: append([]predicate.Keys{}, _q.predicates...),
 		// clone intermediate query.
-		sql:    kq.sql.Clone(),
-		path:   kq.path,
-		unique: kq.unique,
+		sql:  _q.sql.Clone(),
+		path: _q.path,
 	}
 }
 
@@ -261,18 +270,12 @@ func (kq *KeysQuery) Clone() *KeysQuery {
 //		GroupBy(keys.FieldVerificationKeys).
 //		Aggregate(db.Count()).
 //		Scan(ctx, &v)
-//
-func (kq *KeysQuery) GroupBy(field string, fields ...string) *KeysGroupBy {
-	grbuild := &KeysGroupBy{config: kq.config}
-	grbuild.fields = append([]string{field}, fields...)
-	grbuild.path = func(ctx context.Context) (prev *sql.Selector, err error) {
-		if err := kq.prepareQuery(ctx); err != nil {
-			return nil, err
-		}
-		return kq.sqlQuery(ctx), nil
-	}
+func (_q *KeysQuery) GroupBy(field string, fields ...string) *KeysGroupBy {
+	_q.ctx.Fields = append([]string{field}, fields...)
+	grbuild := &KeysGroupBy{build: _q}
+	grbuild.flds = &_q.ctx.Fields
 	grbuild.label = keys.Label
-	grbuild.flds, grbuild.scan = &grbuild.fields, grbuild.Scan
+	grbuild.scan = grbuild.Scan
 	return grbuild
 }
 
@@ -288,48 +291,62 @@ func (kq *KeysQuery) GroupBy(field string, fields ...string) *KeysGroupBy {
 //	client.Keys.Query().
 //		Select(keys.FieldVerificationKeys).
 //		Scan(ctx, &v)
-//
-func (kq *KeysQuery) Select(fields ...string) *KeysSelect {
-	kq.fields = append(kq.fields, fields...)
-	selbuild := &KeysSelect{KeysQuery: kq}
-	selbuild.label = keys.Label
-	selbuild.flds, selbuild.scan = &kq.fields, selbuild.Scan
-	return selbuild
+func (_q *KeysQuery) Select(fields ...string) *KeysSelect {
+	_q.ctx.Fields = append(_q.ctx.Fields, fields...)
+	sbuild := &KeysSelect{KeysQuery: _q}
+	sbuild.label = keys.Label
+	sbuild.flds, sbuild.scan = &_q.ctx.Fields, sbuild.Scan
+	return sbuild
+}
+
+// Aggregate returns a KeysSelect configured with the given aggregations.
+func (_q *KeysQuery) Aggregate(fns ...AggregateFunc) *KeysSelect {
+	return _q.Select().Aggregate(fns...)
 }
 
-func (kq *KeysQuery) prepareQuery(ctx context.Context) error {
-	for _, f := range kq.fields {
+func (_q *KeysQuery) prepareQuery(ctx context.Context) error {
+	for _, inter := range _q.inters {
+		if inter == nil {
+			return fmt.Errorf("db: uninitialized interceptor (forgotten import db/runtime?)")
+		}
+		if trv, ok := inter.(Traverser); ok {
+			if err := trv.Traverse(ctx, _q); err != nil {
+				return err
+			}
+		}
+	}
+	for _, f := range _q.ctx.Fields {
 		if !keys.ValidColumn(f) {
 			return &ValidationError{Name: f, err: fmt.Errorf("db: invalid field %q for query", f)}
 		}
 	}
-	if kq.path != nil {
-		prev, err := kq.path(ctx)
+	if _q.path != nil {
+		prev, err := _q.path(ctx)
 		if err != nil {
 			return err
 		}
-		kq.sql = prev
+		_q.sql = prev
 	}
 	return nil
 }
 
-func (kq *KeysQuery) sqlAll(ctx context.Context, hooks ...queryHook) ([]*Keys, error) {
+func (_q *KeysQuery) sqlAll(ctx context.Context, hooks ...queryHook) ([]*Keys, error) {
 	var (
 		nodes = []*Keys{}
-		_spec = kq.querySpec()
+		_spec = _q.querySpec()
 	)
-	_spec.ScanValues = func(columns []string) ([]interface{}, error) {
+	_spec.ScanValues = func(columns []string) ([]any, error) {
 		return (*Keys).scanValues(nil, columns)
 	}
-	_spec.Assign = func(columns []string, values []interface{}) error {
-		node := &Keys{config: kq.config}
+	_spec.Assign = func(columns []string, values []any) error {
+		node := &Keys{config: _q.config}
 		nodes = append(nodes, node)
 		return node.assignValues(columns, values)
 	}
 	for i := range hooks {
 		hooks[i](ctx, _spec)
 	}
-	if err := sqlgraph.QueryNodes(ctx, kq.driver, _spec); err != nil {
+	if err := sqlgraph.QueryNodes(ctx, _q.driver, _spec); err != nil {
 		return nil, err
 	}
 	if len(nodes) == 0 {
@@ -338,40 +355,24 @@ func (kq *KeysQuery) sqlAll(ctx context.Context, hooks ...queryHook) ([]*Keys, e
 	return nodes, nil
 }
 
-func (kq *KeysQuery) sqlCount(ctx context.Context) (int, error) {
-	_spec := kq.querySpec()
-	_spec.Node.Columns = kq.fields
-	if len(kq.fields) > 0 {
-		_spec.Unique = kq.unique != nil && *kq.unique
-	}
-	return sqlgraph.CountNodes(ctx, kq.driver, _spec)
-}
-
-func (kq *KeysQuery) sqlExist(ctx context.Context) (bool, error) {
-	n, err := kq.sqlCount(ctx)
-	if err != nil {
-		return false, fmt.Errorf("db: check existence: %w", err)
+func (_q *KeysQuery) sqlCount(ctx context.Context) (int, error) {
+	_spec := _q.querySpec()
+	_spec.Node.Columns = _q.ctx.Fields
+	if len(_q.ctx.Fields) > 0 {
+		_spec.Unique = _q.ctx.Unique != nil && *_q.ctx.Unique
 	}
-	return n > 0, nil
+	return sqlgraph.CountNodes(ctx, _q.driver, _spec)
 }
 
-func (kq *KeysQuery) querySpec() *sqlgraph.QuerySpec {
-	_spec := &sqlgraph.QuerySpec{
-		Node: &sqlgraph.NodeSpec{
-			Table:   keys.Table,
-			Columns: keys.Columns,
-			ID: &sqlgraph.FieldSpec{
-				Type:   field.TypeString,
-				Column: keys.FieldID,
-			},
-		},
-		From:   kq.sql,
-		Unique: true,
-	}
-	if unique := kq.unique; unique != nil {
+func (_q *KeysQuery) querySpec() *sqlgraph.QuerySpec {
+	_spec := sqlgraph.NewQuerySpec(keys.Table, keys.Columns, sqlgraph.NewFieldSpec(keys.FieldID, field.TypeString))
+	_spec.From = _q.sql
+	if unique := _q.ctx.Unique; unique != nil {
 		_spec.Unique = *unique
+	} else if _q.path != nil {
+		_spec.Unique = true
 	}
-	if fields := kq.fields; len(fields) > 0 {
+	if fields := _q.ctx.Fields; len(fields) > 0 {
 		_spec.Node.Columns = make([]string, 0, len(fields))
 		_spec.Node.Columns = append(_spec.Node.Columns, keys.FieldID)
 		for i := range fields {
@@ -380,20 +381,20 @@ func (kq *KeysQuery) querySpec() *sqlgraph.QuerySpec {
 			}
 		}
 	}
-	if ps := kq.predicates; len(ps) > 0 {
+	if ps := _q.predicates; len(ps) > 0 {
 		_spec.Predicate = func(selector *sql.Selector) {
 			for i := range ps {
 				ps[i](selector)
 			}
 		}
 	}
-	if limit := kq.limit; limit != nil {
+	if limit := _q.ctx.Limit; limit != nil {
 		_spec.Limit = *limit
 	}
-	if offset := kq.offset; offset != nil {
+	if offset := _q.ctx.Offset; offset != nil {
 		_spec.Offset = *offset
 	}
-	if ps := kq.order; len(ps) > 0 {
+	if ps := _q.order; len(ps) > 0 {
 		_spec.Order = func(selector *sql.Selector) {
 			for i := range ps {
 				ps[i](selector)
@@ -403,33 +404,33 @@ func (kq *KeysQuery) querySpec() *sqlgraph.QuerySpec {
 	return _spec
 }
 
-func (kq *KeysQuery) sqlQuery(ctx context.Context) *sql.Selector {
-	builder := sql.Dialect(kq.driver.Dialect())
+func (_q *KeysQuery) sqlQuery(ctx context.Context) *sql.Selector {
+	builder := sql.Dialect(_q.driver.Dialect())
 	t1 := builder.Table(keys.Table)
-	columns := kq.fields
+	columns := _q.ctx.Fields
 	if len(columns) == 0 {
 		columns = keys.Columns
 	}
 	selector := builder.Select(t1.Columns(columns...)...).From(t1)
-	if kq.sql != nil {
-		selector = kq.sql
+	if _q.sql != nil {
+		selector = _q.sql
 		selector.Select(selector.Columns(columns...)...)
 	}
-	if kq.unique != nil && *kq.unique {
+	if _q.ctx.Unique != nil && *_q.ctx.Unique {
 		selector.Distinct()
 	}
-	for _, p := range kq.predicates {
+	for _, p := range _q.predicates {
 		p(selector)
 	}
-	for _, p := range kq.order {
+	for _, p := range _q.order {
 		p(selector)
 	}
-	if offset := kq.offset; offset != nil {
+	if offset := _q.ctx.Offset; offset != nil {
 		// limit is mandatory for offset clause. We start
 		// with default value, and override it below if needed.
 		selector.Offset(*offset).Limit(math.MaxInt32)
 	}
-	if limit := kq.limit; limit != nil {
+	if limit := _q.ctx.Limit; limit != nil {
 		selector.Limit(*limit)
 	}
 	return selector
@@ -437,90 +438,88 @@ func (kq *KeysQuery) sqlQuery(ctx context.Context) *sql.Selector {
 
 // KeysGroupBy is the group-by builder for Keys entities.
 type KeysGroupBy struct {
-	config
 	selector
-	fields []string
-	fns    []AggregateFunc
-	// intermediate query (i.e. traversal path).
-	sql  *sql.Selector
-	path func(context.Context) (*sql.Selector, error)
+	build *KeysQuery
 }
 
 // Aggregate adds the given aggregation functions to the group-by query.
-func (kgb *KeysGroupBy) Aggregate(fns ...AggregateFunc) *KeysGroupBy {
-	kgb.fns = append(kgb.fns, fns...)
-	return kgb
+func (_g *KeysGroupBy) Aggregate(fns ...AggregateFunc) *KeysGroupBy {
+	_g.fns = append(_g.fns, fns...)
+	return _g
 }
 
-// Scan applies the group-by query and scans the result into the given value.
-func (kgb *KeysGroupBy) Scan(ctx context.Context, v interface{}) error {
-	query, err := kgb.path(ctx)
-	if err != nil {
+// Scan applies the selector query and scans the result into the given value.
+func (_g *KeysGroupBy) Scan(ctx context.Context, v any) error {
+	ctx = setContextOp(ctx, _g.build.ctx, ent.OpQueryGroupBy)
+	if err := _g.build.prepareQuery(ctx); err != nil {
 		return err
 	}
-	kgb.sql = query
-	return kgb.sqlScan(ctx, v)
+	return scanWithInterceptors[*KeysQuery, *KeysGroupBy](ctx, _g.build, _g, _g.build.inters, v)
 }
 
-func (kgb *KeysGroupBy) sqlScan(ctx context.Context, v interface{}) error {
-	for _, f := range kgb.fields {
-		if !keys.ValidColumn(f) {
-			return &ValidationError{Name: f, err: fmt.Errorf("invalid field %q for group-by", f)}
+func (_g *KeysGroupBy) sqlScan(ctx context.Context, root *KeysQuery, v any) error {
+	selector := root.sqlQuery(ctx).Select()
+	aggregation := make([]string, 0, len(_g.fns))
+	for _, fn := range _g.fns {
+		aggregation = append(aggregation, fn(selector))
+	}
+	if len(selector.SelectedColumns()) == 0 {
+		columns := make([]string, 0, len(*_g.flds)+len(_g.fns))
+		for _, f := range *_g.flds {
+			columns = append(columns, selector.C(f))
 		}
+		columns = append(columns, aggregation...)
+		selector.Select(columns...)
 	}
-	selector := kgb.sqlQuery()
+	selector.GroupBy(selector.Columns(*_g.flds...)...)
 	if err := selector.Err(); err != nil {
 		return err
 	}
 	rows := &sql.Rows{}
 	query, args := selector.Query()
-	if err := kgb.driver.Query(ctx, query, args, rows); err != nil {
+	if err := _g.build.driver.Query(ctx, query, args, rows); err != nil {
 		return err
 	}
 	defer rows.Close()
 	return sql.ScanSlice(rows, v)
 }
 
-func (kgb *KeysGroupBy) sqlQuery() *sql.Selector {
-	selector := kgb.sql.Select()
-	aggregation := make([]string, 0, len(kgb.fns))
-	for _, fn := range kgb.fns {
-		aggregation = append(aggregation, fn(selector))
-	}
-	// If no columns were selected in a custom aggregation function, the default
-	// selection is the fields used for "group-by", and the aggregation functions.
-	if len(selector.SelectedColumns()) == 0 {
-		columns := make([]string, 0, len(kgb.fields)+len(kgb.fns))
-		for _, f := range kgb.fields {
-			columns = append(columns, selector.C(f))
-		}
-		columns = append(columns, aggregation...)
-		selector.Select(columns...)
-	}
-	return selector.GroupBy(selector.Columns(kgb.fields...)...)
-}
-
 // KeysSelect is the builder for selecting fields of Keys entities.
 type KeysSelect struct {
 	*KeysQuery
 	selector
-	// intermediate query (i.e. traversal path).
-	sql *sql.Selector
+}
+
+// Aggregate adds the given aggregation functions to the selector query.
+func (_s *KeysSelect) Aggregate(fns ...AggregateFunc) *KeysSelect {
+	_s.fns = append(_s.fns, fns...)
+	return _s
 }
 
 // Scan applies the selector query and scans the result into the given value.
-func (ks *KeysSelect) Scan(ctx context.Context, v interface{}) error {
-	if err := ks.prepareQuery(ctx); err != nil {
+func (_s *KeysSelect) Scan(ctx context.Context, v any) error {
+	ctx = setContextOp(ctx, _s.ctx, ent.OpQuerySelect)
+	if err := _s.prepareQuery(ctx); err != nil {
 		return err
 	}
-	ks.sql = ks.KeysQuery.sqlQuery(ctx)
-	return ks.sqlScan(ctx, v)
+	return scanWithInterceptors[*KeysQuery, *KeysSelect](ctx, _s.KeysQuery, _s, _s.inters, v)
 }
 
-func (ks *KeysSelect) sqlScan(ctx context.Context, v interface{}) error {
+func (_s *KeysSelect) sqlScan(ctx context.Context, root *KeysQuery, v any) error {
+	selector := root.sqlQuery(ctx)
+	aggregation := make([]string, 0, len(_s.fns))
+	for _, fn := range _s.fns {
+		aggregation = append(aggregation, fn(selector))
+	}
+	switch n := len(*_s.selector.flds); {
+	case n == 0 && len(aggregation) > 0:
+		selector.Select(aggregation...)
+	case n != 0 && len(aggregation) > 0:
+		selector.AppendSelect(aggregation...)
+	}
 	rows := &sql.Rows{}
-	query, args := ks.sql.Query()
-	if err := ks.driver.Query(ctx, query, args, rows); err != nil {
+	query, args := selector.Query()
+	if err := _s.driver.Query(ctx, query, args, rows); err != nil {
 		return err
 	}
 	defer rows.Close()
diff --git a/storage/ent/db/keys_update.go b/storage/ent/db/keys_update.go
index b5fbefff67..f45446f079 100644
--- a/storage/ent/db/keys_update.go
+++ b/storage/ent/db/keys_update.go
@@ -10,11 +10,12 @@ import (
 
 	"entgo.io/ent/dialect/sql"
 	"entgo.io/ent/dialect/sql/sqlgraph"
+	"entgo.io/ent/dialect/sql/sqljson"
 	"entgo.io/ent/schema/field"
 	"github.com/dexidp/dex/storage"
 	"github.com/dexidp/dex/storage/ent/db/keys"
 	"github.com/dexidp/dex/storage/ent/db/predicate"
-	jose "gopkg.in/square/go-jose.v2"
+	jose "github.com/go-jose/go-jose/v4"
 )
 
 // KeysUpdate is the builder for updating Keys entities.
@@ -25,75 +26,78 @@ type KeysUpdate struct {
 }
 
 // Where appends a list predicates to the KeysUpdate builder.
-func (ku *KeysUpdate) Where(ps ...predicate.Keys) *KeysUpdate {
-	ku.mutation.Where(ps...)
-	return ku
+func (_u *KeysUpdate) Where(ps ...predicate.Keys) *KeysUpdate {
+	_u.mutation.Where(ps...)
+	return _u
 }
 
 // SetVerificationKeys sets the "verification_keys" field.
-func (ku *KeysUpdate) SetVerificationKeys(sk []storage.VerificationKey) *KeysUpdate {
-	ku.mutation.SetVerificationKeys(sk)
-	return ku
+func (_u *KeysUpdate) SetVerificationKeys(v []storage.VerificationKey) *KeysUpdate {
+	_u.mutation.SetVerificationKeys(v)
+	return _u
+}
+
+// AppendVerificationKeys appends value to the "verification_keys" field.
+func (_u *KeysUpdate) AppendVerificationKeys(v []storage.VerificationKey) *KeysUpdate {
+	_u.mutation.AppendVerificationKeys(v)
+	return _u
 }
 
 // SetSigningKey sets the "signing_key" field.
-func (ku *KeysUpdate) SetSigningKey(jwk jose.JSONWebKey) *KeysUpdate {
-	ku.mutation.SetSigningKey(jwk)
-	return ku
+func (_u *KeysUpdate) SetSigningKey(v jose.JSONWebKey) *KeysUpdate {
+	_u.mutation.SetSigningKey(v)
+	return _u
+}
+
+// SetNillableSigningKey sets the "signing_key" field if the given value is not nil.
+func (_u *KeysUpdate) SetNillableSigningKey(v *jose.JSONWebKey) *KeysUpdate {
+	if v != nil {
+		_u.SetSigningKey(*v)
+	}
+	return _u
 }
 
 // SetSigningKeyPub sets the "signing_key_pub" field.
-func (ku *KeysUpdate) SetSigningKeyPub(jwk jose.JSONWebKey) *KeysUpdate {
-	ku.mutation.SetSigningKeyPub(jwk)
-	return ku
+func (_u *KeysUpdate) SetSigningKeyPub(v jose.JSONWebKey) *KeysUpdate {
+	_u.mutation.SetSigningKeyPub(v)
+	return _u
+}
+
+// SetNillableSigningKeyPub sets the "signing_key_pub" field if the given value is not nil.
+func (_u *KeysUpdate) SetNillableSigningKeyPub(v *jose.JSONWebKey) *KeysUpdate {
+	if v != nil {
+		_u.SetSigningKeyPub(*v)
+	}
+	return _u
 }
 
 // SetNextRotation sets the "next_rotation" field.
-func (ku *KeysUpdate) SetNextRotation(t time.Time) *KeysUpdate {
-	ku.mutation.SetNextRotation(t)
-	return ku
+func (_u *KeysUpdate) SetNextRotation(v time.Time) *KeysUpdate {
+	_u.mutation.SetNextRotation(v)
+	return _u
+}
+
+// SetNillableNextRotation sets the "next_rotation" field if the given value is not nil.
+func (_u *KeysUpdate) SetNillableNextRotation(v *time.Time) *KeysUpdate {
+	if v != nil {
+		_u.SetNextRotation(*v)
+	}
+	return _u
 }
 
 // Mutation returns the KeysMutation object of the builder.
-func (ku *KeysUpdate) Mutation() *KeysMutation {
-	return ku.mutation
+func (_u *KeysUpdate) Mutation() *KeysMutation {
+	return _u.mutation
 }
 
 // Save executes the query and returns the number of nodes affected by the update operation.
-func (ku *KeysUpdate) Save(ctx context.Context) (int, error) {
-	var (
-		err      error
-		affected int
-	)
-	if len(ku.hooks) == 0 {
-		affected, err = ku.sqlSave(ctx)
-	} else {
-		var mut Mutator = MutateFunc(func(ctx context.Context, m Mutation) (Value, error) {
-			mutation, ok := m.(*KeysMutation)
-			if !ok {
-				return nil, fmt.Errorf("unexpected mutation type %T", m)
-			}
-			ku.mutation = mutation
-			affected, err = ku.sqlSave(ctx)
-			mutation.done = true
-			return affected, err
-		})
-		for i := len(ku.hooks) - 1; i >= 0; i-- {
-			if ku.hooks[i] == nil {
-				return 0, fmt.Errorf("db: uninitialized hook (forgotten import db/runtime?)")
-			}
-			mut = ku.hooks[i](mut)
-		}
-		if _, err := mut.Mutate(ctx, ku.mutation); err != nil {
-			return 0, err
-		}
-	}
-	return affected, err
+func (_u *KeysUpdate) Save(ctx context.Context) (int, error) {
+	return withHooks(ctx, _u.sqlSave, _u.mutation, _u.hooks)
 }
 
 // SaveX is like Save, but panics if an error occurs.
-func (ku *KeysUpdate) SaveX(ctx context.Context) int {
-	affected, err := ku.Save(ctx)
+func (_u *KeysUpdate) SaveX(ctx context.Context) int {
+	affected, err := _u.Save(ctx)
 	if err != nil {
 		panic(err)
 	}
@@ -101,65 +105,45 @@ func (ku *KeysUpdate) SaveX(ctx context.Context) int {
 }
 
 // Exec executes the query.
-func (ku *KeysUpdate) Exec(ctx context.Context) error {
-	_, err := ku.Save(ctx)
+func (_u *KeysUpdate) Exec(ctx context.Context) error {
+	_, err := _u.Save(ctx)
 	return err
 }
 
 // ExecX is like Exec, but panics if an error occurs.
-func (ku *KeysUpdate) ExecX(ctx context.Context) {
-	if err := ku.Exec(ctx); err != nil {
+func (_u *KeysUpdate) ExecX(ctx context.Context) {
+	if err := _u.Exec(ctx); err != nil {
 		panic(err)
 	}
 }
 
-func (ku *KeysUpdate) sqlSave(ctx context.Context) (n int, err error) {
-	_spec := &sqlgraph.UpdateSpec{
-		Node: &sqlgraph.NodeSpec{
-			Table:   keys.Table,
-			Columns: keys.Columns,
-			ID: &sqlgraph.FieldSpec{
-				Type:   field.TypeString,
-				Column: keys.FieldID,
-			},
-		},
-	}
-	if ps := ku.mutation.predicates; len(ps) > 0 {
+func (_u *KeysUpdate) sqlSave(ctx context.Context) (_node int, err error) {
+	_spec := sqlgraph.NewUpdateSpec(keys.Table, keys.Columns, sqlgraph.NewFieldSpec(keys.FieldID, field.TypeString))
+	if ps := _u.mutation.predicates; len(ps) > 0 {
 		_spec.Predicate = func(selector *sql.Selector) {
 			for i := range ps {
 				ps[i](selector)
 			}
 		}
 	}
-	if value, ok := ku.mutation.VerificationKeys(); ok {
-		_spec.Fields.Set = append(_spec.Fields.Set, &sqlgraph.FieldSpec{
-			Type:   field.TypeJSON,
-			Value:  value,
-			Column: keys.FieldVerificationKeys,
-		})
+	if value, ok := _u.mutation.VerificationKeys(); ok {
+		_spec.SetField(keys.FieldVerificationKeys, field.TypeJSON, value)
 	}
-	if value, ok := ku.mutation.SigningKey(); ok {
-		_spec.Fields.Set = append(_spec.Fields.Set, &sqlgraph.FieldSpec{
-			Type:   field.TypeJSON,
-			Value:  value,
-			Column: keys.FieldSigningKey,
+	if value, ok := _u.mutation.AppendedVerificationKeys(); ok {
+		_spec.AddModifier(func(u *sql.UpdateBuilder) {
+			sqljson.Append(u, keys.FieldVerificationKeys, value)
 		})
 	}
-	if value, ok := ku.mutation.SigningKeyPub(); ok {
-		_spec.Fields.Set = append(_spec.Fields.Set, &sqlgraph.FieldSpec{
-			Type:   field.TypeJSON,
-			Value:  value,
-			Column: keys.FieldSigningKeyPub,
-		})
+	if value, ok := _u.mutation.SigningKey(); ok {
+		_spec.SetField(keys.FieldSigningKey, field.TypeJSON, value)
 	}
-	if value, ok := ku.mutation.NextRotation(); ok {
-		_spec.Fields.Set = append(_spec.Fields.Set, &sqlgraph.FieldSpec{
-			Type:   field.TypeTime,
-			Value:  value,
-			Column: keys.FieldNextRotation,
-		})
+	if value, ok := _u.mutation.SigningKeyPub(); ok {
+		_spec.SetField(keys.FieldSigningKeyPub, field.TypeJSON, value)
+	}
+	if value, ok := _u.mutation.NextRotation(); ok {
+		_spec.SetField(keys.FieldNextRotation, field.TypeTime, value)
 	}
-	if n, err = sqlgraph.UpdateNodes(ctx, ku.driver, _spec); err != nil {
+	if _node, err = sqlgraph.UpdateNodes(ctx, _u.driver, _spec); err != nil {
 		if _, ok := err.(*sqlgraph.NotFoundError); ok {
 			err = &NotFoundError{keys.Label}
 		} else if sqlgraph.IsConstraintError(err) {
@@ -167,7 +151,8 @@ func (ku *KeysUpdate) sqlSave(ctx context.Context) (n int, err error) {
 		}
 		return 0, err
 	}
-	return n, nil
+	_u.mutation.done = true
+	return _node, nil
 }
 
 // KeysUpdateOne is the builder for updating a single Keys entity.
@@ -179,82 +164,85 @@ type KeysUpdateOne struct {
 }
 
 // SetVerificationKeys sets the "verification_keys" field.
-func (kuo *KeysUpdateOne) SetVerificationKeys(sk []storage.VerificationKey) *KeysUpdateOne {
-	kuo.mutation.SetVerificationKeys(sk)
-	return kuo
+func (_u *KeysUpdateOne) SetVerificationKeys(v []storage.VerificationKey) *KeysUpdateOne {
+	_u.mutation.SetVerificationKeys(v)
+	return _u
+}
+
+// AppendVerificationKeys appends value to the "verification_keys" field.
+func (_u *KeysUpdateOne) AppendVerificationKeys(v []storage.VerificationKey) *KeysUpdateOne {
+	_u.mutation.AppendVerificationKeys(v)
+	return _u
 }
 
 // SetSigningKey sets the "signing_key" field.
-func (kuo *KeysUpdateOne) SetSigningKey(jwk jose.JSONWebKey) *KeysUpdateOne {
-	kuo.mutation.SetSigningKey(jwk)
-	return kuo
+func (_u *KeysUpdateOne) SetSigningKey(v jose.JSONWebKey) *KeysUpdateOne {
+	_u.mutation.SetSigningKey(v)
+	return _u
+}
+
+// SetNillableSigningKey sets the "signing_key" field if the given value is not nil.
+func (_u *KeysUpdateOne) SetNillableSigningKey(v *jose.JSONWebKey) *KeysUpdateOne {
+	if v != nil {
+		_u.SetSigningKey(*v)
+	}
+	return _u
 }
 
 // SetSigningKeyPub sets the "signing_key_pub" field.
-func (kuo *KeysUpdateOne) SetSigningKeyPub(jwk jose.JSONWebKey) *KeysUpdateOne {
-	kuo.mutation.SetSigningKeyPub(jwk)
-	return kuo
+func (_u *KeysUpdateOne) SetSigningKeyPub(v jose.JSONWebKey) *KeysUpdateOne {
+	_u.mutation.SetSigningKeyPub(v)
+	return _u
+}
+
+// SetNillableSigningKeyPub sets the "signing_key_pub" field if the given value is not nil.
+func (_u *KeysUpdateOne) SetNillableSigningKeyPub(v *jose.JSONWebKey) *KeysUpdateOne {
+	if v != nil {
+		_u.SetSigningKeyPub(*v)
+	}
+	return _u
 }
 
 // SetNextRotation sets the "next_rotation" field.
-func (kuo *KeysUpdateOne) SetNextRotation(t time.Time) *KeysUpdateOne {
-	kuo.mutation.SetNextRotation(t)
-	return kuo
+func (_u *KeysUpdateOne) SetNextRotation(v time.Time) *KeysUpdateOne {
+	_u.mutation.SetNextRotation(v)
+	return _u
+}
+
+// SetNillableNextRotation sets the "next_rotation" field if the given value is not nil.
+func (_u *KeysUpdateOne) SetNillableNextRotation(v *time.Time) *KeysUpdateOne {
+	if v != nil {
+		_u.SetNextRotation(*v)
+	}
+	return _u
 }
 
 // Mutation returns the KeysMutation object of the builder.
-func (kuo *KeysUpdateOne) Mutation() *KeysMutation {
-	return kuo.mutation
+func (_u *KeysUpdateOne) Mutation() *KeysMutation {
+	return _u.mutation
+}
+
+// Where appends a list predicates to the KeysUpdate builder.
+func (_u *KeysUpdateOne) Where(ps ...predicate.Keys) *KeysUpdateOne {
+	_u.mutation.Where(ps...)
+	return _u
 }
 
 // Select allows selecting one or more fields (columns) of the returned entity.
 // The default is selecting all fields defined in the entity schema.
-func (kuo *KeysUpdateOne) Select(field string, fields ...string) *KeysUpdateOne {
-	kuo.fields = append([]string{field}, fields...)
-	return kuo
+func (_u *KeysUpdateOne) Select(field string, fields ...string) *KeysUpdateOne {
+	_u.fields = append([]string{field}, fields...)
+	return _u
 }
 
 // Save executes the query and returns the updated Keys entity.
-func (kuo *KeysUpdateOne) Save(ctx context.Context) (*Keys, error) {
-	var (
-		err  error
-		node *Keys
-	)
-	if len(kuo.hooks) == 0 {
-		node, err = kuo.sqlSave(ctx)
-	} else {
-		var mut Mutator = MutateFunc(func(ctx context.Context, m Mutation) (Value, error) {
-			mutation, ok := m.(*KeysMutation)
-			if !ok {
-				return nil, fmt.Errorf("unexpected mutation type %T", m)
-			}
-			kuo.mutation = mutation
-			node, err = kuo.sqlSave(ctx)
-			mutation.done = true
-			return node, err
-		})
-		for i := len(kuo.hooks) - 1; i >= 0; i-- {
-			if kuo.hooks[i] == nil {
-				return nil, fmt.Errorf("db: uninitialized hook (forgotten import db/runtime?)")
-			}
-			mut = kuo.hooks[i](mut)
-		}
-		v, err := mut.Mutate(ctx, kuo.mutation)
-		if err != nil {
-			return nil, err
-		}
-		nv, ok := v.(*Keys)
-		if !ok {
-			return nil, fmt.Errorf("unexpected node type %T returned from KeysMutation", v)
-		}
-		node = nv
-	}
-	return node, err
+func (_u *KeysUpdateOne) Save(ctx context.Context) (*Keys, error) {
+	return withHooks(ctx, _u.sqlSave, _u.mutation, _u.hooks)
 }
 
 // SaveX is like Save, but panics if an error occurs.
-func (kuo *KeysUpdateOne) SaveX(ctx context.Context) *Keys {
-	node, err := kuo.Save(ctx)
+func (_u *KeysUpdateOne) SaveX(ctx context.Context) *Keys {
+	node, err := _u.Save(ctx)
 	if err != nil {
 		panic(err)
 	}
@@ -262,35 +250,26 @@ func (kuo *KeysUpdateOne) SaveX(ctx context.Context) *Keys {
 }
 
 // Exec executes the query on the entity.
-func (kuo *KeysUpdateOne) Exec(ctx context.Context) error {
-	_, err := kuo.Save(ctx)
+func (_u *KeysUpdateOne) Exec(ctx context.Context) error {
+	_, err := _u.Save(ctx)
 	return err
 }
 
 // ExecX is like Exec, but panics if an error occurs.
-func (kuo *KeysUpdateOne) ExecX(ctx context.Context) {
-	if err := kuo.Exec(ctx); err != nil {
+func (_u *KeysUpdateOne) ExecX(ctx context.Context) {
+	if err := _u.Exec(ctx); err != nil {
 		panic(err)
 	}
 }
 
-func (kuo *KeysUpdateOne) sqlSave(ctx context.Context) (_node *Keys, err error) {
-	_spec := &sqlgraph.UpdateSpec{
-		Node: &sqlgraph.NodeSpec{
-			Table:   keys.Table,
-			Columns: keys.Columns,
-			ID: &sqlgraph.FieldSpec{
-				Type:   field.TypeString,
-				Column: keys.FieldID,
-			},
-		},
-	}
-	id, ok := kuo.mutation.ID()
+func (_u *KeysUpdateOne) sqlSave(ctx context.Context) (_node *Keys, err error) {
+	_spec := sqlgraph.NewUpdateSpec(keys.Table, keys.Columns, sqlgraph.NewFieldSpec(keys.FieldID, field.TypeString))
+	id, ok := _u.mutation.ID()
 	if !ok {
 		return nil, &ValidationError{Name: "id", err: errors.New(`db: missing "Keys.id" for update`)}
 	}
 	_spec.Node.ID.Value = id
-	if fields := kuo.fields; len(fields) > 0 {
+	if fields := _u.fields; len(fields) > 0 {
 		_spec.Node.Columns = make([]string, 0, len(fields))
 		_spec.Node.Columns = append(_spec.Node.Columns, keys.FieldID)
 		for _, f := range fields {
@@ -302,45 +281,34 @@ func (kuo *KeysUpdateOne) sqlSave(ctx context.Context) (_node *Keys, err error)
 			}
 		}
 	}
-	if ps := kuo.mutation.predicates; len(ps) > 0 {
+	if ps := _u.mutation.predicates; len(ps) > 0 {
 		_spec.Predicate = func(selector *sql.Selector) {
 			for i := range ps {
 				ps[i](selector)
 			}
 		}
 	}
-	if value, ok := kuo.mutation.VerificationKeys(); ok {
-		_spec.Fields.Set = append(_spec.Fields.Set, &sqlgraph.FieldSpec{
-			Type:   field.TypeJSON,
-			Value:  value,
-			Column: keys.FieldVerificationKeys,
-		})
+	if value, ok := _u.mutation.VerificationKeys(); ok {
+		_spec.SetField(keys.FieldVerificationKeys, field.TypeJSON, value)
 	}
-	if value, ok := kuo.mutation.SigningKey(); ok {
-		_spec.Fields.Set = append(_spec.Fields.Set, &sqlgraph.FieldSpec{
-			Type:   field.TypeJSON,
-			Value:  value,
-			Column: keys.FieldSigningKey,
+	if value, ok := _u.mutation.AppendedVerificationKeys(); ok {
+		_spec.AddModifier(func(u *sql.UpdateBuilder) {
+			sqljson.Append(u, keys.FieldVerificationKeys, value)
 		})
 	}
-	if value, ok := kuo.mutation.SigningKeyPub(); ok {
-		_spec.Fields.Set = append(_spec.Fields.Set, &sqlgraph.FieldSpec{
-			Type:   field.TypeJSON,
-			Value:  value,
-			Column: keys.FieldSigningKeyPub,
-		})
+	if value, ok := _u.mutation.SigningKey(); ok {
+		_spec.SetField(keys.FieldSigningKey, field.TypeJSON, value)
 	}
-	if value, ok := kuo.mutation.NextRotation(); ok {
-		_spec.Fields.Set = append(_spec.Fields.Set, &sqlgraph.FieldSpec{
-			Type:   field.TypeTime,
-			Value:  value,
-			Column: keys.FieldNextRotation,
-		})
+	if value, ok := _u.mutation.SigningKeyPub(); ok {
+		_spec.SetField(keys.FieldSigningKeyPub, field.TypeJSON, value)
+	}
+	if value, ok := _u.mutation.NextRotation(); ok {
+		_spec.SetField(keys.FieldNextRotation, field.TypeTime, value)
 	}
-	_node = &Keys{config: kuo.config}
+	_node = &Keys{config: _u.config}
 	_spec.Assign = _node.assignValues
 	_spec.ScanValues = _node.scanValues
-	if err = sqlgraph.UpdateNode(ctx, kuo.driver, _spec); err != nil {
+	if err = sqlgraph.UpdateNode(ctx, _u.driver, _spec); err != nil {
 		if _, ok := err.(*sqlgraph.NotFoundError); ok {
 			err = &NotFoundError{keys.Label}
 		} else if sqlgraph.IsConstraintError(err) {
@@ -348,5 +316,6 @@ func (kuo *KeysUpdateOne) sqlSave(ctx context.Context) (_node *Keys, err error)
 		}
 		return nil, err
 	}
+	_u.mutation.done = true
 	return _node, nil
 }
diff --git a/storage/ent/db/migrate/migrate.go b/storage/ent/db/migrate/migrate.go
index 6bccf3918a..1956a6bf64 100644
--- a/storage/ent/db/migrate/migrate.go
+++ b/storage/ent/db/migrate/migrate.go
@@ -56,10 +56,9 @@ func Create(ctx context.Context, s *Schema, tables []*schema.Table, opts ...sche
 
 // WriteTo writes the schema changes to w instead of running them against the database.
 //
-// 	if err := client.Schema.WriteTo(context.Background(), os.Stdout); err != nil {
+//	if err := client.Schema.WriteTo(context.Background(), os.Stdout); err != nil {
 //		log.Fatal(err)
-// 	}
-//
+//	}
 func (s *Schema) WriteTo(ctx context.Context, w io.Writer, opts ...schema.MigrateOption) error {
 	return Create(ctx, &Schema{drv: &schema.WriteDriver{Writer: w, Driver: s.drv}}, Tables, opts...)
 }
diff --git a/storage/ent/db/migrate/schema.go b/storage/ent/db/migrate/schema.go
index ced57b32d9..3a76ba2dbb 100644
--- a/storage/ent/db/migrate/schema.go
+++ b/storage/ent/db/migrate/schema.go
@@ -26,6 +26,8 @@ var (
 		{Name: "expiry", Type: field.TypeTime, SchemaType: map[string]string{"mysql": "datetime(3)", "postgres": "timestamptz", "sqlite3": "timestamp"}},
 		{Name: "code_challenge", Type: field.TypeString, Size: 2147483647, Default: "", SchemaType: map[string]string{"mysql": "varchar(384)", "postgres": "text", "sqlite3": "text"}},
 		{Name: "code_challenge_method", Type: field.TypeString, Size: 2147483647, Default: "", SchemaType: map[string]string{"mysql": "varchar(384)", "postgres": "text", "sqlite3": "text"}},
+		{Name: "auth_time", Type: field.TypeTime, Nullable: true, SchemaType: map[string]string{"mysql": "datetime(3)", "postgres": "timestamptz", "sqlite3": "timestamp"}},
+		{Name: "session_id", Type: field.TypeString, Nullable: true, Size: 2147483647, Default: "", SchemaType: map[string]string{"mysql": "varchar(384)", "postgres": "text", "sqlite3": "text"}},
 	}
 	// AuthCodesTable holds the schema information for the "auth_codes" table.
 	AuthCodesTable = &schema.Table{
@@ -55,6 +57,12 @@ var (
 		{Name: "expiry", Type: field.TypeTime, SchemaType: map[string]string{"mysql": "datetime(3)", "postgres": "timestamptz", "sqlite3": "timestamp"}},
 		{Name: "code_challenge", Type: field.TypeString, Size: 2147483647, Default: "", SchemaType: map[string]string{"mysql": "varchar(384)", "postgres": "text", "sqlite3": "text"}},
 		{Name: "code_challenge_method", Type: field.TypeString, Size: 2147483647, Default: "", SchemaType: map[string]string{"mysql": "varchar(384)", "postgres": "text", "sqlite3": "text"}},
+		{Name: "hmac_key", Type: field.TypeBytes},
+		{Name: "mfa_validated", Type: field.TypeBool, Default: false},
+		{Name: "webauthn_session_data", Type: field.TypeBytes, Nullable: true},
+		{Name: "prompt", Type: field.TypeString, Size: 2147483647, Default: "", SchemaType: map[string]string{"mysql": "varchar(384)", "postgres": "text", "sqlite3": "text"}},
+		{Name: "max_age", Type: field.TypeInt, Default: -1},
+		{Name: "auth_time", Type: field.TypeTime, Nullable: true, SchemaType: map[string]string{"mysql": "datetime(3)", "postgres": "timestamptz", "sqlite3": "timestamp"}},
 	}
 	// AuthRequestsTable holds the schema information for the "auth_requests" table.
 	AuthRequestsTable = &schema.Table{
@@ -62,6 +70,27 @@ var (
 		Columns:    AuthRequestsColumns,
 		PrimaryKey: []*schema.Column{AuthRequestsColumns[0]},
 	}
+	// AuthSessionsColumns holds the columns for the "auth_sessions" table.
+	AuthSessionsColumns = []*schema.Column{
+		{Name: "id", Type: field.TypeString, Unique: true, Size: 2147483647, SchemaType: map[string]string{"mysql": "varchar(384)", "postgres": "text", "sqlite3": "text"}},
+		{Name: "user_id", Type: field.TypeString, Size: 2147483647, SchemaType: map[string]string{"mysql": "varchar(384)", "postgres": "text", "sqlite3": "text"}},
+		{Name: "connector_id", Type: field.TypeString, Size: 2147483647, SchemaType: map[string]string{"mysql": "varchar(384)", "postgres": "text", "sqlite3": "text"}},
+		{Name: "secret", Type: field.TypeString, Size: 2147483647, SchemaType: map[string]string{"mysql": "varchar(384)", "postgres": "text", "sqlite3": "text"}},
+		{Name: "client_states", Type: field.TypeBytes},
+		{Name: "created_at", Type: field.TypeTime, SchemaType: map[string]string{"mysql": "datetime(3)", "postgres": "timestamptz", "sqlite3": "timestamp"}},
+		{Name: "last_activity", Type: field.TypeTime, SchemaType: map[string]string{"mysql": "datetime(3)", "postgres": "timestamptz", "sqlite3": "timestamp"}},
+		{Name: "ip_address", Type: field.TypeString, Size: 2147483647, Default: "", SchemaType: map[string]string{"mysql": "varchar(384)", "postgres": "text", "sqlite3": "text"}},
+		{Name: "user_agent", Type: field.TypeString, Size: 2147483647, Default: "", SchemaType: map[string]string{"mysql": "varchar(384)", "postgres": "text", "sqlite3": "text"}},
+		{Name: "absolute_expiry", Type: field.TypeTime, SchemaType: map[string]string{"mysql": "datetime(3)", "postgres": "timestamptz", "sqlite3": "timestamp"}},
+		{Name: "idle_expiry", Type: field.TypeTime, SchemaType: map[string]string{"mysql": "datetime(3)", "postgres": "timestamptz", "sqlite3": "timestamp"}},
+		{Name: "logout_state", Type: field.TypeBytes, Nullable: true},
+	}
+	// AuthSessionsTable holds the schema information for the "auth_sessions" table.
+	AuthSessionsTable = &schema.Table{
+		Name:       "auth_sessions",
+		Columns:    AuthSessionsColumns,
+		PrimaryKey: []*schema.Column{AuthSessionsColumns[0]},
+	}
 	// ConnectorsColumns holds the columns for the "connectors" table.
 	ConnectorsColumns = []*schema.Column{
 		{Name: "id", Type: field.TypeString, Unique: true, Size: 100, SchemaType: map[string]string{"mysql": "varchar(384)", "postgres": "text", "sqlite3": "text"}},
@@ -69,6 +98,7 @@ var (
 		{Name: "name", Type: field.TypeString, Size: 2147483647, SchemaType: map[string]string{"mysql": "varchar(384)", "postgres": "text", "sqlite3": "text"}},
 		{Name: "resource_version", Type: field.TypeString, Size: 2147483647, SchemaType: map[string]string{"mysql": "varchar(384)", "postgres": "text", "sqlite3": "text"}},
 		{Name: "config", Type: field.TypeBytes},
+		{Name: "grant_types", Type: field.TypeJSON, Nullable: true},
 	}
 	// ConnectorsTable holds the schema information for the "connectors" table.
 	ConnectorsTable = &schema.Table{
@@ -133,6 +163,13 @@ var (
 		{Name: "public", Type: field.TypeBool},
 		{Name: "name", Type: field.TypeString, Size: 2147483647, SchemaType: map[string]string{"mysql": "varchar(384)", "postgres": "text", "sqlite3": "text"}},
 		{Name: "logo_url", Type: field.TypeString, Size: 2147483647, SchemaType: map[string]string{"mysql": "varchar(384)", "postgres": "text", "sqlite3": "text"}},
+		{Name: "allowed_connectors", Type: field.TypeJSON, Nullable: true},
+		{Name: "mfa_chain", Type: field.TypeJSON, Nullable: true},
+		{Name: "post_logout_redirect_uris", Type: field.TypeJSON, Nullable: true},
+		{Name: "sso_shared_with", Type: field.TypeJSON, Nullable: true},
+		{Name: "backchannel_logout_uri", Type: field.TypeString, Nullable: true, Size: 2147483647, Default: "", SchemaType: map[string]string{"mysql": "varchar(384)", "postgres": "text", "sqlite3": "text"}},
+		{Name: "refresh_token_lifetime", Type: field.TypeString, Nullable: true, Size: 2147483647, Default: "", SchemaType: map[string]string{"mysql": "varchar(384)", "postgres": "text", "sqlite3": "text"}},
+		{Name: "client_credentials_claims", Type: field.TypeJSON, Nullable: true},
 	}
 	// Oauth2clientsTable holds the schema information for the "oauth2clients" table.
 	Oauth2clientsTable = &schema.Table{
@@ -160,7 +197,11 @@ var (
 		{Name: "email", Type: field.TypeString, Unique: true, Size: 2147483647, SchemaType: map[string]string{"mysql": "varchar(384)", "postgres": "text", "sqlite3": "text"}},
 		{Name: "hash", Type: field.TypeBytes},
 		{Name: "username", Type: field.TypeString, Size: 2147483647, SchemaType: map[string]string{"mysql": "varchar(384)", "postgres": "text", "sqlite3": "text"}},
+		{Name: "name", Type: field.TypeString, Size: 2147483647, Default: "", SchemaType: map[string]string{"mysql": "varchar(384)", "postgres": "text", "sqlite3": "text"}},
+		{Name: "preferred_username", Type: field.TypeString, Size: 2147483647, Default: "", SchemaType: map[string]string{"mysql": "varchar(384)", "postgres": "text", "sqlite3": "text"}},
+		{Name: "email_verified", Type: field.TypeBool, Nullable: true},
 		{Name: "user_id", Type: field.TypeString, Size: 2147483647, SchemaType: map[string]string{"mysql": "varchar(384)", "postgres": "text", "sqlite3": "text"}},
+		{Name: "groups", Type: field.TypeJSON, Nullable: true},
 	}
 	// PasswordsTable holds the schema information for the "passwords" table.
 	PasswordsTable = &schema.Table{
@@ -193,10 +234,35 @@ var (
 		Columns:    RefreshTokensColumns,
 		PrimaryKey: []*schema.Column{RefreshTokensColumns[0]},
 	}
+	// UserIdentitiesColumns holds the columns for the "user_identities" table.
+	UserIdentitiesColumns = []*schema.Column{
+		{Name: "id", Type: field.TypeString, Unique: true, Size: 2147483647, SchemaType: map[string]string{"mysql": "varchar(384)", "postgres": "text", "sqlite3": "text"}},
+		{Name: "user_id", Type: field.TypeString, Size: 2147483647, SchemaType: map[string]string{"mysql": "varchar(384)", "postgres": "text", "sqlite3": "text"}},
+		{Name: "connector_id", Type: field.TypeString, Size: 2147483647, SchemaType: map[string]string{"mysql": "varchar(384)", "postgres": "text", "sqlite3": "text"}},
+		{Name: "claims_user_id", Type: field.TypeString, Size: 2147483647, Default: "", SchemaType: map[string]string{"mysql": "varchar(384)", "postgres": "text", "sqlite3": "text"}},
+		{Name: "claims_username", Type: field.TypeString, Size: 2147483647, Default: "", SchemaType: map[string]string{"mysql": "varchar(384)", "postgres": "text", "sqlite3": "text"}},
+		{Name: "claims_preferred_username", Type: field.TypeString, Size: 2147483647, Default: "", SchemaType: map[string]string{"mysql": "varchar(384)", "postgres": "text", "sqlite3": "text"}},
+		{Name: "claims_email", Type: field.TypeString, Size: 2147483647, Default: "", SchemaType: map[string]string{"mysql": "varchar(384)", "postgres": "text", "sqlite3": "text"}},
+		{Name: "claims_email_verified", Type: field.TypeBool, Default: false},
+		{Name: "claims_groups", Type: field.TypeJSON, Nullable: true},
+		{Name: "consents", Type: field.TypeBytes},
+		{Name: "mfa_secrets", Type: field.TypeBytes, Nullable: true},
+		{Name: "webauthn_credentials", Type: field.TypeBytes, Nullable: true},
+		{Name: "created_at", Type: field.TypeTime, SchemaType: map[string]string{"mysql": "datetime(3)", "postgres": "timestamptz", "sqlite3": "timestamp"}},
+		{Name: "last_login", Type: field.TypeTime, SchemaType: map[string]string{"mysql": "datetime(3)", "postgres": "timestamptz", "sqlite3": "timestamp"}},
+		{Name: "blocked_until", Type: field.TypeTime, SchemaType: map[string]string{"mysql": "datetime(3)", "postgres": "timestamptz", "sqlite3": "timestamp"}},
+	}
+	// UserIdentitiesTable holds the schema information for the "user_identities" table.
+	UserIdentitiesTable = &schema.Table{
+		Name:       "user_identities",
+		Columns:    UserIdentitiesColumns,
+		PrimaryKey: []*schema.Column{UserIdentitiesColumns[0]},
+	}
 	// Tables holds all the tables in the schema.
 	Tables = []*schema.Table{
 		AuthCodesTable,
 		AuthRequestsTable,
+		AuthSessionsTable,
 		ConnectorsTable,
 		DeviceRequestsTable,
 		DeviceTokensTable,
@@ -205,6 +271,7 @@ var (
 		OfflineSessionsTable,
 		PasswordsTable,
 		RefreshTokensTable,
+		UserIdentitiesTable,
 	}
 )
 
diff --git a/storage/ent/db/mutation.go b/storage/ent/db/mutation.go
index af12a242bc..e4edf2fb11 100644
--- a/storage/ent/db/mutation.go
+++ b/storage/ent/db/mutation.go
@@ -9,9 +9,12 @@ import (
 	"sync"
 	"time"
 
+	"entgo.io/ent"
+	"entgo.io/ent/dialect/sql"
 	"github.com/dexidp/dex/storage"
 	"github.com/dexidp/dex/storage/ent/db/authcode"
 	"github.com/dexidp/dex/storage/ent/db/authrequest"
+	"github.com/dexidp/dex/storage/ent/db/authsession"
 	"github.com/dexidp/dex/storage/ent/db/connector"
 	"github.com/dexidp/dex/storage/ent/db/devicerequest"
 	"github.com/dexidp/dex/storage/ent/db/devicetoken"
@@ -21,9 +24,8 @@ import (
 	"github.com/dexidp/dex/storage/ent/db/password"
 	"github.com/dexidp/dex/storage/ent/db/predicate"
 	"github.com/dexidp/dex/storage/ent/db/refreshtoken"
-	jose "gopkg.in/square/go-jose.v2"
-
-	"entgo.io/ent"
+	"github.com/dexidp/dex/storage/ent/db/useridentity"
+	jose "github.com/go-jose/go-jose/v4"
 )
 
 const (
@@ -37,6 +39,7 @@ const (
 	// Node types.
 	TypeAuthCode       = "AuthCode"
 	TypeAuthRequest    = "AuthRequest"
+	TypeAuthSession    = "AuthSession"
 	TypeConnector      = "Connector"
 	TypeDeviceRequest  = "DeviceRequest"
 	TypeDeviceToken    = "DeviceToken"
@@ -45,6 +48,7 @@ const (
 	TypeOfflineSession = "OfflineSession"
 	TypePassword       = "Password"
 	TypeRefreshToken   = "RefreshToken"
+	TypeUserIdentity   = "UserIdentity"
 )
 
 // AuthCodeMutation represents an operation that mutates the AuthCode nodes in the graph.
@@ -55,6 +59,7 @@ type AuthCodeMutation struct {
 	id                        *string
 	client_id                 *string
 	scopes                    *[]string
+	appendscopes              []string
 	nonce                     *string
 	redirect_uri              *string
 	claims_user_id            *string
@@ -62,12 +67,15 @@ type AuthCodeMutation struct {
 	claims_email              *string
 	claims_email_verified     *bool
 	claims_groups             *[]string
+	appendclaims_groups       []string
 	claims_preferred_username *string
 	connector_id              *string
 	connector_data            *[]byte
 	expiry                    *time.Time
 	code_challenge            *string
 	code_challenge_method     *string
+	auth_time                 *time.Time
+	session_id                *string
 	clearedFields             map[string]struct{}
 	done                      bool
 	oldValue                  func(context.Context) (*AuthCode, error)
@@ -217,6 +225,7 @@ func (m *AuthCodeMutation) ResetClientID() {
 // SetScopes sets the "scopes" field.
 func (m *AuthCodeMutation) SetScopes(s []string) {
 	m.scopes = &s
+	m.appendscopes = nil
 }
 
 // Scopes returns the value of the "scopes" field in the mutation.
@@ -245,9 +254,23 @@ func (m *AuthCodeMutation) OldScopes(ctx context.Context) (v []string, err error
 	return oldValue.Scopes, nil
 }
 
+// AppendScopes adds s to the "scopes" field.
+func (m *AuthCodeMutation) AppendScopes(s []string) {
+	m.appendscopes = append(m.appendscopes, s...)
+}
+
+// AppendedScopes returns the list of values that were appended to the "scopes" field in this mutation.
+func (m *AuthCodeMutation) AppendedScopes() ([]string, bool) {
+	if len(m.appendscopes) == 0 {
+		return nil, false
+	}
+	return m.appendscopes, true
+}
+
 // ClearScopes clears the value of the "scopes" field.
 func (m *AuthCodeMutation) ClearScopes() {
 	m.scopes = nil
+	m.appendscopes = nil
 	m.clearedFields[authcode.FieldScopes] = struct{}{}
 }
 
@@ -260,6 +283,7 @@ func (m *AuthCodeMutation) ScopesCleared() bool {
 // ResetScopes resets all changes to the "scopes" field.
 func (m *AuthCodeMutation) ResetScopes() {
 	m.scopes = nil
+	m.appendscopes = nil
 	delete(m.clearedFields, authcode.FieldScopes)
 }
 
@@ -482,6 +506,7 @@ func (m *AuthCodeMutation) ResetClaimsEmailVerified() {
 // SetClaimsGroups sets the "claims_groups" field.
 func (m *AuthCodeMutation) SetClaimsGroups(s []string) {
 	m.claims_groups = &s
+	m.appendclaims_groups = nil
 }
 
 // ClaimsGroups returns the value of the "claims_groups" field in the mutation.
@@ -510,9 +535,23 @@ func (m *AuthCodeMutation) OldClaimsGroups(ctx context.Context) (v []string, err
 	return oldValue.ClaimsGroups, nil
 }
 
+// AppendClaimsGroups adds s to the "claims_groups" field.
+func (m *AuthCodeMutation) AppendClaimsGroups(s []string) {
+	m.appendclaims_groups = append(m.appendclaims_groups, s...)
+}
+
+// AppendedClaimsGroups returns the list of values that were appended to the "claims_groups" field in this mutation.
+func (m *AuthCodeMutation) AppendedClaimsGroups() ([]string, bool) {
+	if len(m.appendclaims_groups) == 0 {
+		return nil, false
+	}
+	return m.appendclaims_groups, true
+}
+
 // ClearClaimsGroups clears the value of the "claims_groups" field.
 func (m *AuthCodeMutation) ClearClaimsGroups() {
 	m.claims_groups = nil
+	m.appendclaims_groups = nil
 	m.clearedFields[authcode.FieldClaimsGroups] = struct{}{}
 }
 
@@ -525,6 +564,7 @@ func (m *AuthCodeMutation) ClaimsGroupsCleared() bool {
 // ResetClaimsGroups resets all changes to the "claims_groups" field.
 func (m *AuthCodeMutation) ResetClaimsGroups() {
 	m.claims_groups = nil
+	m.appendclaims_groups = nil
 	delete(m.clearedFields, authcode.FieldClaimsGroups)
 }
 
@@ -757,16 +797,129 @@ func (m *AuthCodeMutation) ResetCodeChallengeMethod() {
 	m.code_challenge_method = nil
 }
 
+// SetAuthTime sets the "auth_time" field.
+func (m *AuthCodeMutation) SetAuthTime(t time.Time) {
+	m.auth_time = &t
+}
+
+// AuthTime returns the value of the "auth_time" field in the mutation.
+func (m *AuthCodeMutation) AuthTime() (r time.Time, exists bool) {
+	v := m.auth_time
+	if v == nil {
+		return
+	}
+	return *v, true
+}
+
+// OldAuthTime returns the old "auth_time" field's value of the AuthCode entity.
+// If the AuthCode object wasn't provided to the builder, the object is fetched from the database.
+// An error is returned if the mutation operation is not UpdateOne, or the database query fails.
+func (m *AuthCodeMutation) OldAuthTime(ctx context.Context) (v time.Time, err error) {
+	if !m.op.Is(OpUpdateOne) {
+		return v, errors.New("OldAuthTime is only allowed on UpdateOne operations")
+	}
+	if m.id == nil || m.oldValue == nil {
+		return v, errors.New("OldAuthTime requires an ID field in the mutation")
+	}
+	oldValue, err := m.oldValue(ctx)
+	if err != nil {
+		return v, fmt.Errorf("querying old value for OldAuthTime: %w", err)
+	}
+	return oldValue.AuthTime, nil
+}
+
+// ClearAuthTime clears the value of the "auth_time" field.
+func (m *AuthCodeMutation) ClearAuthTime() {
+	m.auth_time = nil
+	m.clearedFields[authcode.FieldAuthTime] = struct{}{}
+}
+
+// AuthTimeCleared returns if the "auth_time" field was cleared in this mutation.
+func (m *AuthCodeMutation) AuthTimeCleared() bool {
+	_, ok := m.clearedFields[authcode.FieldAuthTime]
+	return ok
+}
+
+// ResetAuthTime resets all changes to the "auth_time" field.
+func (m *AuthCodeMutation) ResetAuthTime() {
+	m.auth_time = nil
+	delete(m.clearedFields, authcode.FieldAuthTime)
+}
+
+// SetSessionID sets the "session_id" field.
+func (m *AuthCodeMutation) SetSessionID(s string) {
+	m.session_id = &s
+}
+
+// SessionID returns the value of the "session_id" field in the mutation.
+func (m *AuthCodeMutation) SessionID() (r string, exists bool) {
+	v := m.session_id
+	if v == nil {
+		return
+	}
+	return *v, true
+}
+
+// OldSessionID returns the old "session_id" field's value of the AuthCode entity.
+// If the AuthCode object wasn't provided to the builder, the object is fetched from the database.
+// An error is returned if the mutation operation is not UpdateOne, or the database query fails.
+func (m *AuthCodeMutation) OldSessionID(ctx context.Context) (v string, err error) {
+	if !m.op.Is(OpUpdateOne) {
+		return v, errors.New("OldSessionID is only allowed on UpdateOne operations")
+	}
+	if m.id == nil || m.oldValue == nil {
+		return v, errors.New("OldSessionID requires an ID field in the mutation")
+	}
+	oldValue, err := m.oldValue(ctx)
+	if err != nil {
+		return v, fmt.Errorf("querying old value for OldSessionID: %w", err)
+	}
+	return oldValue.SessionID, nil
+}
+
+// ClearSessionID clears the value of the "session_id" field.
+func (m *AuthCodeMutation) ClearSessionID() {
+	m.session_id = nil
+	m.clearedFields[authcode.FieldSessionID] = struct{}{}
+}
+
+// SessionIDCleared returns if the "session_id" field was cleared in this mutation.
+func (m *AuthCodeMutation) SessionIDCleared() bool {
+	_, ok := m.clearedFields[authcode.FieldSessionID]
+	return ok
+}
+
+// ResetSessionID resets all changes to the "session_id" field.
+func (m *AuthCodeMutation) ResetSessionID() {
+	m.session_id = nil
+	delete(m.clearedFields, authcode.FieldSessionID)
+}
+
 // Where appends a list predicates to the AuthCodeMutation builder.
 func (m *AuthCodeMutation) Where(ps ...predicate.AuthCode) {
 	m.predicates = append(m.predicates, ps...)
 }
 
+// WhereP appends storage-level predicates to the AuthCodeMutation builder. Using this method,
+// users can use type-assertion to append predicates that do not depend on any generated package.
+func (m *AuthCodeMutation) WhereP(ps ...func(*sql.Selector)) {
+	p := make([]predicate.AuthCode, len(ps))
+	for i := range ps {
+		p[i] = ps[i]
+	}
+	m.Where(p...)
+}
+
 // Op returns the operation name.
 func (m *AuthCodeMutation) Op() Op {
 	return m.op
 }
 
+// SetOp allows setting the mutation operation.
+func (m *AuthCodeMutation) SetOp(op Op) {
+	m.op = op
+}
+
 // Type returns the node type of this mutation (AuthCode).
 func (m *AuthCodeMutation) Type() string {
 	return m.typ
@@ -776,7 +929,7 @@ func (m *AuthCodeMutation) Type() string {
 // order to get all numeric fields that were incremented/decremented, call
 // AddedFields().
 func (m *AuthCodeMutation) Fields() []string {
-	fields := make([]string, 0, 15)
+	fields := make([]string, 0, 17)
 	if m.client_id != nil {
 		fields = append(fields, authcode.FieldClientID)
 	}
@@ -822,6 +975,12 @@ func (m *AuthCodeMutation) Fields() []string {
 	if m.code_challenge_method != nil {
 		fields = append(fields, authcode.FieldCodeChallengeMethod)
 	}
+	if m.auth_time != nil {
+		fields = append(fields, authcode.FieldAuthTime)
+	}
+	if m.session_id != nil {
+		fields = append(fields, authcode.FieldSessionID)
+	}
 	return fields
 }
 
@@ -860,6 +1019,10 @@ func (m *AuthCodeMutation) Field(name string) (ent.Value, bool) {
 		return m.CodeChallenge()
 	case authcode.FieldCodeChallengeMethod:
 		return m.CodeChallengeMethod()
+	case authcode.FieldAuthTime:
+		return m.AuthTime()
+	case authcode.FieldSessionID:
+		return m.SessionID()
 	}
 	return nil, false
 }
@@ -899,6 +1062,10 @@ func (m *AuthCodeMutation) OldField(ctx context.Context, name string) (ent.Value
 		return m.OldCodeChallenge(ctx)
 	case authcode.FieldCodeChallengeMethod:
 		return m.OldCodeChallengeMethod(ctx)
+	case authcode.FieldAuthTime:
+		return m.OldAuthTime(ctx)
+	case authcode.FieldSessionID:
+		return m.OldSessionID(ctx)
 	}
 	return nil, fmt.Errorf("unknown AuthCode field %s", name)
 }
@@ -1013,6 +1180,20 @@ func (m *AuthCodeMutation) SetField(name string, value ent.Value) error {
 		}
 		m.SetCodeChallengeMethod(v)
 		return nil
+	case authcode.FieldAuthTime:
+		v, ok := value.(time.Time)
+		if !ok {
+			return fmt.Errorf("unexpected type %T for field %s", value, name)
+		}
+		m.SetAuthTime(v)
+		return nil
+	case authcode.FieldSessionID:
+		v, ok := value.(string)
+		if !ok {
+			return fmt.Errorf("unexpected type %T for field %s", value, name)
+		}
+		m.SetSessionID(v)
+		return nil
 	}
 	return fmt.Errorf("unknown AuthCode field %s", name)
 }
@@ -1052,6 +1233,12 @@ func (m *AuthCodeMutation) ClearedFields() []string {
 	if m.FieldCleared(authcode.FieldConnectorData) {
 		fields = append(fields, authcode.FieldConnectorData)
 	}
+	if m.FieldCleared(authcode.FieldAuthTime) {
+		fields = append(fields, authcode.FieldAuthTime)
+	}
+	if m.FieldCleared(authcode.FieldSessionID) {
+		fields = append(fields, authcode.FieldSessionID)
+	}
 	return fields
 }
 
@@ -1075,6 +1262,12 @@ func (m *AuthCodeMutation) ClearField(name string) error {
 	case authcode.FieldConnectorData:
 		m.ClearConnectorData()
 		return nil
+	case authcode.FieldAuthTime:
+		m.ClearAuthTime()
+		return nil
+	case authcode.FieldSessionID:
+		m.ClearSessionID()
+		return nil
 	}
 	return fmt.Errorf("unknown AuthCode nullable field %s", name)
 }
@@ -1128,6 +1321,12 @@ func (m *AuthCodeMutation) ResetField(name string) error {
 	case authcode.FieldCodeChallengeMethod:
 		m.ResetCodeChallengeMethod()
 		return nil
+	case authcode.FieldAuthTime:
+		m.ResetAuthTime()
+		return nil
+	case authcode.FieldSessionID:
+		m.ResetSessionID()
+		return nil
 	}
 	return fmt.Errorf("unknown AuthCode field %s", name)
 }
@@ -1188,7 +1387,9 @@ type AuthRequestMutation struct {
 	id                        *string
 	client_id                 *string
 	scopes                    *[]string
+	appendscopes              []string
 	response_types            *[]string
+	appendresponse_types      []string
 	redirect_uri              *string
 	nonce                     *string
 	state                     *string
@@ -1199,12 +1400,20 @@ type AuthRequestMutation struct {
 	claims_email              *string
 	claims_email_verified     *bool
 	claims_groups             *[]string
+	appendclaims_groups       []string
 	claims_preferred_username *string
 	connector_id              *string
 	connector_data            *[]byte
 	expiry                    *time.Time
 	code_challenge            *string
 	code_challenge_method     *string
+	hmac_key                  *[]byte
+	mfa_validated             *bool
+	webauthn_session_data     *[]byte
+	prompt                    *string
+	max_age                   *int
+	addmax_age                *int
+	auth_time                 *time.Time
 	clearedFields             map[string]struct{}
 	done                      bool
 	oldValue                  func(context.Context) (*AuthRequest, error)
@@ -1354,6 +1563,7 @@ func (m *AuthRequestMutation) ResetClientID() {
 // SetScopes sets the "scopes" field.
 func (m *AuthRequestMutation) SetScopes(s []string) {
 	m.scopes = &s
+	m.appendscopes = nil
 }
 
 // Scopes returns the value of the "scopes" field in the mutation.
@@ -1382,9 +1592,23 @@ func (m *AuthRequestMutation) OldScopes(ctx context.Context) (v []string, err er
 	return oldValue.Scopes, nil
 }
 
+// AppendScopes adds s to the "scopes" field.
+func (m *AuthRequestMutation) AppendScopes(s []string) {
+	m.appendscopes = append(m.appendscopes, s...)
+}
+
+// AppendedScopes returns the list of values that were appended to the "scopes" field in this mutation.
+func (m *AuthRequestMutation) AppendedScopes() ([]string, bool) {
+	if len(m.appendscopes) == 0 {
+		return nil, false
+	}
+	return m.appendscopes, true
+}
+
 // ClearScopes clears the value of the "scopes" field.
 func (m *AuthRequestMutation) ClearScopes() {
 	m.scopes = nil
+	m.appendscopes = nil
 	m.clearedFields[authrequest.FieldScopes] = struct{}{}
 }
 
@@ -1397,12 +1621,14 @@ func (m *AuthRequestMutation) ScopesCleared() bool {
 // ResetScopes resets all changes to the "scopes" field.
 func (m *AuthRequestMutation) ResetScopes() {
 	m.scopes = nil
+	m.appendscopes = nil
 	delete(m.clearedFields, authrequest.FieldScopes)
 }
 
 // SetResponseTypes sets the "response_types" field.
 func (m *AuthRequestMutation) SetResponseTypes(s []string) {
 	m.response_types = &s
+	m.appendresponse_types = nil
 }
 
 // ResponseTypes returns the value of the "response_types" field in the mutation.
@@ -1431,9 +1657,23 @@ func (m *AuthRequestMutation) OldResponseTypes(ctx context.Context) (v []string,
 	return oldValue.ResponseTypes, nil
 }
 
+// AppendResponseTypes adds s to the "response_types" field.
+func (m *AuthRequestMutation) AppendResponseTypes(s []string) {
+	m.appendresponse_types = append(m.appendresponse_types, s...)
+}
+
+// AppendedResponseTypes returns the list of values that were appended to the "response_types" field in this mutation.
+func (m *AuthRequestMutation) AppendedResponseTypes() ([]string, bool) {
+	if len(m.appendresponse_types) == 0 {
+		return nil, false
+	}
+	return m.appendresponse_types, true
+}
+
 // ClearResponseTypes clears the value of the "response_types" field.
 func (m *AuthRequestMutation) ClearResponseTypes() {
 	m.response_types = nil
+	m.appendresponse_types = nil
 	m.clearedFields[authrequest.FieldResponseTypes] = struct{}{}
 }
 
@@ -1446,6 +1686,7 @@ func (m *AuthRequestMutation) ResponseTypesCleared() bool {
 // ResetResponseTypes resets all changes to the "response_types" field.
 func (m *AuthRequestMutation) ResetResponseTypes() {
 	m.response_types = nil
+	m.appendresponse_types = nil
 	delete(m.clearedFields, authrequest.FieldResponseTypes)
 }
 
@@ -1776,6 +2017,7 @@ func (m *AuthRequestMutation) ResetClaimsEmailVerified() {
 // SetClaimsGroups sets the "claims_groups" field.
 func (m *AuthRequestMutation) SetClaimsGroups(s []string) {
 	m.claims_groups = &s
+	m.appendclaims_groups = nil
 }
 
 // ClaimsGroups returns the value of the "claims_groups" field in the mutation.
@@ -1804,9 +2046,23 @@ func (m *AuthRequestMutation) OldClaimsGroups(ctx context.Context) (v []string,
 	return oldValue.ClaimsGroups, nil
 }
 
+// AppendClaimsGroups adds s to the "claims_groups" field.
+func (m *AuthRequestMutation) AppendClaimsGroups(s []string) {
+	m.appendclaims_groups = append(m.appendclaims_groups, s...)
+}
+
+// AppendedClaimsGroups returns the list of values that were appended to the "claims_groups" field in this mutation.
+func (m *AuthRequestMutation) AppendedClaimsGroups() ([]string, bool) {
+	if len(m.appendclaims_groups) == 0 {
+		return nil, false
+	}
+	return m.appendclaims_groups, true
+}
+
 // ClearClaimsGroups clears the value of the "claims_groups" field.
 func (m *AuthRequestMutation) ClearClaimsGroups() {
 	m.claims_groups = nil
+	m.appendclaims_groups = nil
 	m.clearedFields[authrequest.FieldClaimsGroups] = struct{}{}
 }
 
@@ -1819,6 +2075,7 @@ func (m *AuthRequestMutation) ClaimsGroupsCleared() bool {
 // ResetClaimsGroups resets all changes to the "claims_groups" field.
 func (m *AuthRequestMutation) ResetClaimsGroups() {
 	m.claims_groups = nil
+	m.appendclaims_groups = nil
 	delete(m.clearedFields, authrequest.FieldClaimsGroups)
 }
 
@@ -2051,16 +2308,293 @@ func (m *AuthRequestMutation) ResetCodeChallengeMethod() {
 	m.code_challenge_method = nil
 }
 
+// SetHmacKey sets the "hmac_key" field.
+func (m *AuthRequestMutation) SetHmacKey(b []byte) {
+	m.hmac_key = &b
+}
+
+// HmacKey returns the value of the "hmac_key" field in the mutation.
+func (m *AuthRequestMutation) HmacKey() (r []byte, exists bool) {
+	v := m.hmac_key
+	if v == nil {
+		return
+	}
+	return *v, true
+}
+
+// OldHmacKey returns the old "hmac_key" field's value of the AuthRequest entity.
+// If the AuthRequest object wasn't provided to the builder, the object is fetched from the database.
+// An error is returned if the mutation operation is not UpdateOne, or the database query fails.
+func (m *AuthRequestMutation) OldHmacKey(ctx context.Context) (v []byte, err error) {
+	if !m.op.Is(OpUpdateOne) {
+		return v, errors.New("OldHmacKey is only allowed on UpdateOne operations")
+	}
+	if m.id == nil || m.oldValue == nil {
+		return v, errors.New("OldHmacKey requires an ID field in the mutation")
+	}
+	oldValue, err := m.oldValue(ctx)
+	if err != nil {
+		return v, fmt.Errorf("querying old value for OldHmacKey: %w", err)
+	}
+	return oldValue.HmacKey, nil
+}
+
+// ResetHmacKey resets all changes to the "hmac_key" field.
+func (m *AuthRequestMutation) ResetHmacKey() {
+	m.hmac_key = nil
+}
+
+// SetMfaValidated sets the "mfa_validated" field.
+func (m *AuthRequestMutation) SetMfaValidated(b bool) {
+	m.mfa_validated = &b
+}
+
+// MfaValidated returns the value of the "mfa_validated" field in the mutation.
+func (m *AuthRequestMutation) MfaValidated() (r bool, exists bool) {
+	v := m.mfa_validated
+	if v == nil {
+		return
+	}
+	return *v, true
+}
+
+// OldMfaValidated returns the old "mfa_validated" field's value of the AuthRequest entity.
+// If the AuthRequest object wasn't provided to the builder, the object is fetched from the database.
+// An error is returned if the mutation operation is not UpdateOne, or the database query fails.
+func (m *AuthRequestMutation) OldMfaValidated(ctx context.Context) (v bool, err error) {
+	if !m.op.Is(OpUpdateOne) {
+		return v, errors.New("OldMfaValidated is only allowed on UpdateOne operations")
+	}
+	if m.id == nil || m.oldValue == nil {
+		return v, errors.New("OldMfaValidated requires an ID field in the mutation")
+	}
+	oldValue, err := m.oldValue(ctx)
+	if err != nil {
+		return v, fmt.Errorf("querying old value for OldMfaValidated: %w", err)
+	}
+	return oldValue.MfaValidated, nil
+}
+
+// ResetMfaValidated resets all changes to the "mfa_validated" field.
+func (m *AuthRequestMutation) ResetMfaValidated() {
+	m.mfa_validated = nil
+}
+
+// SetWebauthnSessionData sets the "webauthn_session_data" field.
+func (m *AuthRequestMutation) SetWebauthnSessionData(b []byte) {
+	m.webauthn_session_data = &b
+}
+
+// WebauthnSessionData returns the value of the "webauthn_session_data" field in the mutation.
+func (m *AuthRequestMutation) WebauthnSessionData() (r []byte, exists bool) {
+	v := m.webauthn_session_data
+	if v == nil {
+		return
+	}
+	return *v, true
+}
+
+// OldWebauthnSessionData returns the old "webauthn_session_data" field's value of the AuthRequest entity.
+// If the AuthRequest object wasn't provided to the builder, the object is fetched from the database.
+// An error is returned if the mutation operation is not UpdateOne, or the database query fails.
+func (m *AuthRequestMutation) OldWebauthnSessionData(ctx context.Context) (v *[]byte, err error) {
+	if !m.op.Is(OpUpdateOne) {
+		return v, errors.New("OldWebauthnSessionData is only allowed on UpdateOne operations")
+	}
+	if m.id == nil || m.oldValue == nil {
+		return v, errors.New("OldWebauthnSessionData requires an ID field in the mutation")
+	}
+	oldValue, err := m.oldValue(ctx)
+	if err != nil {
+		return v, fmt.Errorf("querying old value for OldWebauthnSessionData: %w", err)
+	}
+	return oldValue.WebauthnSessionData, nil
+}
+
+// ClearWebauthnSessionData clears the value of the "webauthn_session_data" field.
+func (m *AuthRequestMutation) ClearWebauthnSessionData() {
+	m.webauthn_session_data = nil
+	m.clearedFields[authrequest.FieldWebauthnSessionData] = struct{}{}
+}
+
+// WebauthnSessionDataCleared returns if the "webauthn_session_data" field was cleared in this mutation.
+func (m *AuthRequestMutation) WebauthnSessionDataCleared() bool {
+	_, ok := m.clearedFields[authrequest.FieldWebauthnSessionData]
+	return ok
+}
+
+// ResetWebauthnSessionData resets all changes to the "webauthn_session_data" field.
+func (m *AuthRequestMutation) ResetWebauthnSessionData() {
+	m.webauthn_session_data = nil
+	delete(m.clearedFields, authrequest.FieldWebauthnSessionData)
+}
+
+// SetPrompt sets the "prompt" field.
+func (m *AuthRequestMutation) SetPrompt(s string) {
+	m.prompt = &s
+}
+
+// Prompt returns the value of the "prompt" field in the mutation.
+func (m *AuthRequestMutation) Prompt() (r string, exists bool) {
+	v := m.prompt
+	if v == nil {
+		return
+	}
+	return *v, true
+}
+
+// OldPrompt returns the old "prompt" field's value of the AuthRequest entity.
+// If the AuthRequest object wasn't provided to the builder, the object is fetched from the database.
+// An error is returned if the mutation operation is not UpdateOne, or the database query fails.
+func (m *AuthRequestMutation) OldPrompt(ctx context.Context) (v string, err error) {
+	if !m.op.Is(OpUpdateOne) {
+		return v, errors.New("OldPrompt is only allowed on UpdateOne operations")
+	}
+	if m.id == nil || m.oldValue == nil {
+		return v, errors.New("OldPrompt requires an ID field in the mutation")
+	}
+	oldValue, err := m.oldValue(ctx)
+	if err != nil {
+		return v, fmt.Errorf("querying old value for OldPrompt: %w", err)
+	}
+	return oldValue.Prompt, nil
+}
+
+// ResetPrompt resets all changes to the "prompt" field.
+func (m *AuthRequestMutation) ResetPrompt() {
+	m.prompt = nil
+}
+
+// SetMaxAge sets the "max_age" field.
+func (m *AuthRequestMutation) SetMaxAge(i int) {
+	m.max_age = &i
+	m.addmax_age = nil
+}
+
+// MaxAge returns the value of the "max_age" field in the mutation.
+func (m *AuthRequestMutation) MaxAge() (r int, exists bool) {
+	v := m.max_age
+	if v == nil {
+		return
+	}
+	return *v, true
+}
+
+// OldMaxAge returns the old "max_age" field's value of the AuthRequest entity.
+// If the AuthRequest object wasn't provided to the builder, the object is fetched from the database.
+// An error is returned if the mutation operation is not UpdateOne, or the database query fails.
+func (m *AuthRequestMutation) OldMaxAge(ctx context.Context) (v int, err error) {
+	if !m.op.Is(OpUpdateOne) {
+		return v, errors.New("OldMaxAge is only allowed on UpdateOne operations")
+	}
+	if m.id == nil || m.oldValue == nil {
+		return v, errors.New("OldMaxAge requires an ID field in the mutation")
+	}
+	oldValue, err := m.oldValue(ctx)
+	if err != nil {
+		return v, fmt.Errorf("querying old value for OldMaxAge: %w", err)
+	}
+	return oldValue.MaxAge, nil
+}
+
+// AddMaxAge adds i to the "max_age" field.
+func (m *AuthRequestMutation) AddMaxAge(i int) {
+	if m.addmax_age != nil {
+		*m.addmax_age += i
+	} else {
+		m.addmax_age = &i
+	}
+}
+
+// AddedMaxAge returns the value that was added to the "max_age" field in this mutation.
+func (m *AuthRequestMutation) AddedMaxAge() (r int, exists bool) {
+	v := m.addmax_age
+	if v == nil {
+		return
+	}
+	return *v, true
+}
+
+// ResetMaxAge resets all changes to the "max_age" field.
+func (m *AuthRequestMutation) ResetMaxAge() {
+	m.max_age = nil
+	m.addmax_age = nil
+}
+
+// SetAuthTime sets the "auth_time" field.
+func (m *AuthRequestMutation) SetAuthTime(t time.Time) {
+	m.auth_time = &t
+}
+
+// AuthTime returns the value of the "auth_time" field in the mutation.
+func (m *AuthRequestMutation) AuthTime() (r time.Time, exists bool) {
+	v := m.auth_time
+	if v == nil {
+		return
+	}
+	return *v, true
+}
+
+// OldAuthTime returns the old "auth_time" field's value of the AuthRequest entity.
+// If the AuthRequest object wasn't provided to the builder, the object is fetched from the database.
+// An error is returned if the mutation operation is not UpdateOne, or the database query fails.
+func (m *AuthRequestMutation) OldAuthTime(ctx context.Context) (v time.Time, err error) {
+	if !m.op.Is(OpUpdateOne) {
+		return v, errors.New("OldAuthTime is only allowed on UpdateOne operations")
+	}
+	if m.id == nil || m.oldValue == nil {
+		return v, errors.New("OldAuthTime requires an ID field in the mutation")
+	}
+	oldValue, err := m.oldValue(ctx)
+	if err != nil {
+		return v, fmt.Errorf("querying old value for OldAuthTime: %w", err)
+	}
+	return oldValue.AuthTime, nil
+}
+
+// ClearAuthTime clears the value of the "auth_time" field.
+func (m *AuthRequestMutation) ClearAuthTime() {
+	m.auth_time = nil
+	m.clearedFields[authrequest.FieldAuthTime] = struct{}{}
+}
+
+// AuthTimeCleared returns if the "auth_time" field was cleared in this mutation.
+func (m *AuthRequestMutation) AuthTimeCleared() bool {
+	_, ok := m.clearedFields[authrequest.FieldAuthTime]
+	return ok
+}
+
+// ResetAuthTime resets all changes to the "auth_time" field.
+func (m *AuthRequestMutation) ResetAuthTime() {
+	m.auth_time = nil
+	delete(m.clearedFields, authrequest.FieldAuthTime)
+}
+
 // Where appends a list predicates to the AuthRequestMutation builder.
 func (m *AuthRequestMutation) Where(ps ...predicate.AuthRequest) {
 	m.predicates = append(m.predicates, ps...)
 }
 
+// WhereP appends storage-level predicates to the AuthRequestMutation builder. Using this method,
+// users can use type-assertion to append predicates that do not depend on any generated package.
+func (m *AuthRequestMutation) WhereP(ps ...func(*sql.Selector)) {
+	p := make([]predicate.AuthRequest, len(ps))
+	for i := range ps {
+		p[i] = ps[i]
+	}
+	m.Where(p...)
+}
+
 // Op returns the operation name.
 func (m *AuthRequestMutation) Op() Op {
 	return m.op
 }
 
+// SetOp allows setting the mutation operation.
+func (m *AuthRequestMutation) SetOp(op Op) {
+	m.op = op
+}
+
 // Type returns the node type of this mutation (AuthRequest).
 func (m *AuthRequestMutation) Type() string {
 	return m.typ
@@ -2070,7 +2604,7 @@ func (m *AuthRequestMutation) Type() string {
 // order to get all numeric fields that were incremented/decremented, call
 // AddedFields().
 func (m *AuthRequestMutation) Fields() []string {
-	fields := make([]string, 0, 19)
+	fields := make([]string, 0, 25)
 	if m.client_id != nil {
 		fields = append(fields, authrequest.FieldClientID)
 	}
@@ -2128,7 +2662,25 @@ func (m *AuthRequestMutation) Fields() []string {
 	if m.code_challenge_method != nil {
 		fields = append(fields, authrequest.FieldCodeChallengeMethod)
 	}
-	return fields
+	if m.hmac_key != nil {
+		fields = append(fields, authrequest.FieldHmacKey)
+	}
+	if m.mfa_validated != nil {
+		fields = append(fields, authrequest.FieldMfaValidated)
+	}
+	if m.webauthn_session_data != nil {
+		fields = append(fields, authrequest.FieldWebauthnSessionData)
+	}
+	if m.prompt != nil {
+		fields = append(fields, authrequest.FieldPrompt)
+	}
+	if m.max_age != nil {
+		fields = append(fields, authrequest.FieldMaxAge)
+	}
+	if m.auth_time != nil {
+		fields = append(fields, authrequest.FieldAuthTime)
+	}
+	return fields
 }
 
 // Field returns the value of a field with the given name. The second boolean
@@ -2174,6 +2726,18 @@ func (m *AuthRequestMutation) Field(name string) (ent.Value, bool) {
 		return m.CodeChallenge()
 	case authrequest.FieldCodeChallengeMethod:
 		return m.CodeChallengeMethod()
+	case authrequest.FieldHmacKey:
+		return m.HmacKey()
+	case authrequest.FieldMfaValidated:
+		return m.MfaValidated()
+	case authrequest.FieldWebauthnSessionData:
+		return m.WebauthnSessionData()
+	case authrequest.FieldPrompt:
+		return m.Prompt()
+	case authrequest.FieldMaxAge:
+		return m.MaxAge()
+	case authrequest.FieldAuthTime:
+		return m.AuthTime()
 	}
 	return nil, false
 }
@@ -2221,6 +2785,18 @@ func (m *AuthRequestMutation) OldField(ctx context.Context, name string) (ent.Va
 		return m.OldCodeChallenge(ctx)
 	case authrequest.FieldCodeChallengeMethod:
 		return m.OldCodeChallengeMethod(ctx)
+	case authrequest.FieldHmacKey:
+		return m.OldHmacKey(ctx)
+	case authrequest.FieldMfaValidated:
+		return m.OldMfaValidated(ctx)
+	case authrequest.FieldWebauthnSessionData:
+		return m.OldWebauthnSessionData(ctx)
+	case authrequest.FieldPrompt:
+		return m.OldPrompt(ctx)
+	case authrequest.FieldMaxAge:
+		return m.OldMaxAge(ctx)
+	case authrequest.FieldAuthTime:
+		return m.OldAuthTime(ctx)
 	}
 	return nil, fmt.Errorf("unknown AuthRequest field %s", name)
 }
@@ -2363,6 +2939,48 @@ func (m *AuthRequestMutation) SetField(name string, value ent.Value) error {
 		}
 		m.SetCodeChallengeMethod(v)
 		return nil
+	case authrequest.FieldHmacKey:
+		v, ok := value.([]byte)
+		if !ok {
+			return fmt.Errorf("unexpected type %T for field %s", value, name)
+		}
+		m.SetHmacKey(v)
+		return nil
+	case authrequest.FieldMfaValidated:
+		v, ok := value.(bool)
+		if !ok {
+			return fmt.Errorf("unexpected type %T for field %s", value, name)
+		}
+		m.SetMfaValidated(v)
+		return nil
+	case authrequest.FieldWebauthnSessionData:
+		v, ok := value.([]byte)
+		if !ok {
+			return fmt.Errorf("unexpected type %T for field %s", value, name)
+		}
+		m.SetWebauthnSessionData(v)
+		return nil
+	case authrequest.FieldPrompt:
+		v, ok := value.(string)
+		if !ok {
+			return fmt.Errorf("unexpected type %T for field %s", value, name)
+		}
+		m.SetPrompt(v)
+		return nil
+	case authrequest.FieldMaxAge:
+		v, ok := value.(int)
+		if !ok {
+			return fmt.Errorf("unexpected type %T for field %s", value, name)
+		}
+		m.SetMaxAge(v)
+		return nil
+	case authrequest.FieldAuthTime:
+		v, ok := value.(time.Time)
+		if !ok {
+			return fmt.Errorf("unexpected type %T for field %s", value, name)
+		}
+		m.SetAuthTime(v)
+		return nil
 	}
 	return fmt.Errorf("unknown AuthRequest field %s", name)
 }
@@ -2370,13 +2988,21 @@ func (m *AuthRequestMutation) SetField(name string, value ent.Value) error {
 // AddedFields returns all numeric fields that were incremented/decremented during
 // this mutation.
 func (m *AuthRequestMutation) AddedFields() []string {
-	return nil
+	var fields []string
+	if m.addmax_age != nil {
+		fields = append(fields, authrequest.FieldMaxAge)
+	}
+	return fields
 }
 
 // AddedField returns the numeric value that was incremented/decremented on a field
 // with the given name. The second boolean return value indicates that this field
 // was not set, or was not defined in the schema.
 func (m *AuthRequestMutation) AddedField(name string) (ent.Value, bool) {
+	switch name {
+	case authrequest.FieldMaxAge:
+		return m.AddedMaxAge()
+	}
 	return nil, false
 }
 
@@ -2385,6 +3011,13 @@ func (m *AuthRequestMutation) AddedField(name string) (ent.Value, bool) {
 // type.
 func (m *AuthRequestMutation) AddField(name string, value ent.Value) error {
 	switch name {
+	case authrequest.FieldMaxAge:
+		v, ok := value.(int)
+		if !ok {
+			return fmt.Errorf("unexpected type %T for field %s", value, name)
+		}
+		m.AddMaxAge(v)
+		return nil
 	}
 	return fmt.Errorf("unknown AuthRequest numeric field %s", name)
 }
@@ -2405,6 +3038,12 @@ func (m *AuthRequestMutation) ClearedFields() []string {
 	if m.FieldCleared(authrequest.FieldConnectorData) {
 		fields = append(fields, authrequest.FieldConnectorData)
 	}
+	if m.FieldCleared(authrequest.FieldWebauthnSessionData) {
+		fields = append(fields, authrequest.FieldWebauthnSessionData)
+	}
+	if m.FieldCleared(authrequest.FieldAuthTime) {
+		fields = append(fields, authrequest.FieldAuthTime)
+	}
 	return fields
 }
 
@@ -2431,6 +3070,12 @@ func (m *AuthRequestMutation) ClearField(name string) error {
 	case authrequest.FieldConnectorData:
 		m.ClearConnectorData()
 		return nil
+	case authrequest.FieldWebauthnSessionData:
+		m.ClearWebauthnSessionData()
+		return nil
+	case authrequest.FieldAuthTime:
+		m.ClearAuthTime()
+		return nil
 	}
 	return fmt.Errorf("unknown AuthRequest nullable field %s", name)
 }
@@ -2496,6 +3141,24 @@ func (m *AuthRequestMutation) ResetField(name string) error {
 	case authrequest.FieldCodeChallengeMethod:
 		m.ResetCodeChallengeMethod()
 		return nil
+	case authrequest.FieldHmacKey:
+		m.ResetHmacKey()
+		return nil
+	case authrequest.FieldMfaValidated:
+		m.ResetMfaValidated()
+		return nil
+	case authrequest.FieldWebauthnSessionData:
+		m.ResetWebauthnSessionData()
+		return nil
+	case authrequest.FieldPrompt:
+		m.ResetPrompt()
+		return nil
+	case authrequest.FieldMaxAge:
+		m.ResetMaxAge()
+		return nil
+	case authrequest.FieldAuthTime:
+		m.ResetAuthTime()
+		return nil
 	}
 	return fmt.Errorf("unknown AuthRequest field %s", name)
 }
@@ -2548,33 +3211,40 @@ func (m *AuthRequestMutation) ResetEdge(name string) error {
 	return fmt.Errorf("unknown AuthRequest edge %s", name)
 }
 
-// ConnectorMutation represents an operation that mutates the Connector nodes in the graph.
-type ConnectorMutation struct {
+// AuthSessionMutation represents an operation that mutates the AuthSession nodes in the graph.
+type AuthSessionMutation struct {
 	config
-	op               Op
-	typ              string
-	id               *string
-	_type            *string
-	name             *string
-	resource_version *string
-	_config          *[]byte
-	clearedFields    map[string]struct{}
-	done             bool
-	oldValue         func(context.Context) (*Connector, error)
-	predicates       []predicate.Connector
-}
-
-var _ ent.Mutation = (*ConnectorMutation)(nil)
-
-// connectorOption allows management of the mutation configuration using functional options.
-type connectorOption func(*ConnectorMutation)
-
-// newConnectorMutation creates new mutation for the Connector entity.
-func newConnectorMutation(c config, op Op, opts ...connectorOption) *ConnectorMutation {
-	m := &ConnectorMutation{
+	op              Op
+	typ             string
+	id              *string
+	user_id         *string
+	connector_id    *string
+	secret          *string
+	client_states   *[]byte
+	created_at      *time.Time
+	last_activity   *time.Time
+	ip_address      *string
+	user_agent      *string
+	absolute_expiry *time.Time
+	idle_expiry     *time.Time
+	logout_state    *[]byte
+	clearedFields   map[string]struct{}
+	done            bool
+	oldValue        func(context.Context) (*AuthSession, error)
+	predicates      []predicate.AuthSession
+}
+
+var _ ent.Mutation = (*AuthSessionMutation)(nil)
+
+// authsessionOption allows management of the mutation configuration using functional options.
+type authsessionOption func(*AuthSessionMutation)
+
+// newAuthSessionMutation creates new mutation for the AuthSession entity.
+func newAuthSessionMutation(c config, op Op, opts ...authsessionOption) *AuthSessionMutation {
+	m := &AuthSessionMutation{
 		config:        c,
 		op:            op,
-		typ:           TypeConnector,
+		typ:           TypeAuthSession,
 		clearedFields: make(map[string]struct{}),
 	}
 	for _, opt := range opts {
@@ -2583,20 +3253,20 @@ func newConnectorMutation(c config, op Op, opts ...connectorOption) *ConnectorMu
 	return m
 }
 
-// withConnectorID sets the ID field of the mutation.
-func withConnectorID(id string) connectorOption {
-	return func(m *ConnectorMutation) {
+// withAuthSessionID sets the ID field of the mutation.
+func withAuthSessionID(id string) authsessionOption {
+	return func(m *AuthSessionMutation) {
 		var (
 			err   error
 			once  sync.Once
-			value *Connector
+			value *AuthSession
 		)
-		m.oldValue = func(ctx context.Context) (*Connector, error) {
+		m.oldValue = func(ctx context.Context) (*AuthSession, error) {
 			once.Do(func() {
 				if m.done {
 					err = errors.New("querying old values post mutation is not allowed")
 				} else {
-					value, err = m.Client().Connector.Get(ctx, id)
+					value, err = m.Client().AuthSession.Get(ctx, id)
 				}
 			})
 			return value, err
@@ -2605,10 +3275,10 @@ func withConnectorID(id string) connectorOption {
 	}
 }
 
-// withConnector sets the old Connector of the mutation.
-func withConnector(node *Connector) connectorOption {
-	return func(m *ConnectorMutation) {
-		m.oldValue = func(context.Context) (*Connector, error) {
+// withAuthSession sets the old AuthSession of the mutation.
+func withAuthSession(node *AuthSession) authsessionOption {
+	return func(m *AuthSessionMutation) {
+		m.oldValue = func(context.Context) (*AuthSession, error) {
 			return node, nil
 		}
 		m.id = &node.ID
@@ -2617,7 +3287,7 @@ func withConnector(node *Connector) connectorOption {
 
 // Client returns a new `ent.Client` from the mutation. If the mutation was
 // executed in a transaction (ent.Tx), a transactional client is returned.
-func (m ConnectorMutation) Client() *Client {
+func (m AuthSessionMutation) Client() *Client {
 	client := &Client{config: m.config}
 	client.init()
 	return client
@@ -2625,7 +3295,7 @@ func (m ConnectorMutation) Client() *Client {
 
 // Tx returns an `ent.Tx` for mutations that were executed in transactions;
 // it returns an error otherwise.
-func (m ConnectorMutation) Tx() (*Tx, error) {
+func (m AuthSessionMutation) Tx() (*Tx, error) {
 	if _, ok := m.driver.(*txDriver); !ok {
 		return nil, errors.New("db: mutation is not running in a transaction")
 	}
@@ -2635,14 +3305,14 @@ func (m ConnectorMutation) Tx() (*Tx, error) {
 }
 
 // SetID sets the value of the id field. Note that this
-// operation is only accepted on creation of Connector entities.
-func (m *ConnectorMutation) SetID(id string) {
+// operation is only accepted on creation of AuthSession entities.
+func (m *AuthSessionMutation) SetID(id string) {
 	m.id = &id
 }
 
 // ID returns the ID value in the mutation. Note that the ID is only available
 // if it was provided to the builder or after it was returned from the database.
-func (m *ConnectorMutation) ID() (id string, exists bool) {
+func (m *AuthSessionMutation) ID() (id string, exists bool) {
 	if m.id == nil {
 		return
 	}
@@ -2653,7 +3323,7 @@ func (m *ConnectorMutation) ID() (id string, exists bool) {
 // That means, if the mutation is applied within a transaction with an isolation level such
 // as sql.LevelSerializable, the returned ids match the ids of the rows that will be updated
 // or updated by the mutation.
-func (m *ConnectorMutation) IDs(ctx context.Context) ([]string, error) {
+func (m *AuthSessionMutation) IDs(ctx context.Context) ([]string, error) {
 	switch {
 	case m.op.Is(OpUpdateOne | OpDeleteOne):
 		id, exists := m.ID()
@@ -2662,400 +3332,808 @@ func (m *ConnectorMutation) IDs(ctx context.Context) ([]string, error) {
 		}
 		fallthrough
 	case m.op.Is(OpUpdate | OpDelete):
-		return m.Client().Connector.Query().Where(m.predicates...).IDs(ctx)
+		return m.Client().AuthSession.Query().Where(m.predicates...).IDs(ctx)
 	default:
 		return nil, fmt.Errorf("IDs is not allowed on %s operations", m.op)
 	}
 }
 
-// SetType sets the "type" field.
-func (m *ConnectorMutation) SetType(s string) {
-	m._type = &s
+// SetUserID sets the "user_id" field.
+func (m *AuthSessionMutation) SetUserID(s string) {
+	m.user_id = &s
 }
 
-// GetType returns the value of the "type" field in the mutation.
-func (m *ConnectorMutation) GetType() (r string, exists bool) {
-	v := m._type
+// UserID returns the value of the "user_id" field in the mutation.
+func (m *AuthSessionMutation) UserID() (r string, exists bool) {
+	v := m.user_id
 	if v == nil {
 		return
 	}
 	return *v, true
 }
 
-// OldType returns the old "type" field's value of the Connector entity.
-// If the Connector object wasn't provided to the builder, the object is fetched from the database.
+// OldUserID returns the old "user_id" field's value of the AuthSession entity.
+// If the AuthSession object wasn't provided to the builder, the object is fetched from the database.
 // An error is returned if the mutation operation is not UpdateOne, or the database query fails.
-func (m *ConnectorMutation) OldType(ctx context.Context) (v string, err error) {
+func (m *AuthSessionMutation) OldUserID(ctx context.Context) (v string, err error) {
 	if !m.op.Is(OpUpdateOne) {
-		return v, errors.New("OldType is only allowed on UpdateOne operations")
+		return v, errors.New("OldUserID is only allowed on UpdateOne operations")
 	}
 	if m.id == nil || m.oldValue == nil {
-		return v, errors.New("OldType requires an ID field in the mutation")
+		return v, errors.New("OldUserID requires an ID field in the mutation")
 	}
 	oldValue, err := m.oldValue(ctx)
 	if err != nil {
-		return v, fmt.Errorf("querying old value for OldType: %w", err)
+		return v, fmt.Errorf("querying old value for OldUserID: %w", err)
 	}
-	return oldValue.Type, nil
+	return oldValue.UserID, nil
 }
 
-// ResetType resets all changes to the "type" field.
-func (m *ConnectorMutation) ResetType() {
-	m._type = nil
+// ResetUserID resets all changes to the "user_id" field.
+func (m *AuthSessionMutation) ResetUserID() {
+	m.user_id = nil
 }
 
-// SetName sets the "name" field.
-func (m *ConnectorMutation) SetName(s string) {
-	m.name = &s
+// SetConnectorID sets the "connector_id" field.
+func (m *AuthSessionMutation) SetConnectorID(s string) {
+	m.connector_id = &s
 }
 
-// Name returns the value of the "name" field in the mutation.
-func (m *ConnectorMutation) Name() (r string, exists bool) {
-	v := m.name
+// ConnectorID returns the value of the "connector_id" field in the mutation.
+func (m *AuthSessionMutation) ConnectorID() (r string, exists bool) {
+	v := m.connector_id
 	if v == nil {
 		return
 	}
 	return *v, true
 }
 
-// OldName returns the old "name" field's value of the Connector entity.
-// If the Connector object wasn't provided to the builder, the object is fetched from the database.
+// OldConnectorID returns the old "connector_id" field's value of the AuthSession entity.
+// If the AuthSession object wasn't provided to the builder, the object is fetched from the database.
 // An error is returned if the mutation operation is not UpdateOne, or the database query fails.
-func (m *ConnectorMutation) OldName(ctx context.Context) (v string, err error) {
+func (m *AuthSessionMutation) OldConnectorID(ctx context.Context) (v string, err error) {
 	if !m.op.Is(OpUpdateOne) {
-		return v, errors.New("OldName is only allowed on UpdateOne operations")
+		return v, errors.New("OldConnectorID is only allowed on UpdateOne operations")
 	}
 	if m.id == nil || m.oldValue == nil {
-		return v, errors.New("OldName requires an ID field in the mutation")
+		return v, errors.New("OldConnectorID requires an ID field in the mutation")
 	}
 	oldValue, err := m.oldValue(ctx)
 	if err != nil {
-		return v, fmt.Errorf("querying old value for OldName: %w", err)
+		return v, fmt.Errorf("querying old value for OldConnectorID: %w", err)
 	}
-	return oldValue.Name, nil
+	return oldValue.ConnectorID, nil
 }
 
-// ResetName resets all changes to the "name" field.
-func (m *ConnectorMutation) ResetName() {
-	m.name = nil
+// ResetConnectorID resets all changes to the "connector_id" field.
+func (m *AuthSessionMutation) ResetConnectorID() {
+	m.connector_id = nil
 }
 
-// SetResourceVersion sets the "resource_version" field.
-func (m *ConnectorMutation) SetResourceVersion(s string) {
-	m.resource_version = &s
+// SetSecret sets the "secret" field.
+func (m *AuthSessionMutation) SetSecret(s string) {
+	m.secret = &s
 }
 
-// ResourceVersion returns the value of the "resource_version" field in the mutation.
-func (m *ConnectorMutation) ResourceVersion() (r string, exists bool) {
-	v := m.resource_version
+// Secret returns the value of the "secret" field in the mutation.
+func (m *AuthSessionMutation) Secret() (r string, exists bool) {
+	v := m.secret
 	if v == nil {
 		return
 	}
 	return *v, true
 }
 
-// OldResourceVersion returns the old "resource_version" field's value of the Connector entity.
-// If the Connector object wasn't provided to the builder, the object is fetched from the database.
+// OldSecret returns the old "secret" field's value of the AuthSession entity.
+// If the AuthSession object wasn't provided to the builder, the object is fetched from the database.
 // An error is returned if the mutation operation is not UpdateOne, or the database query fails.
-func (m *ConnectorMutation) OldResourceVersion(ctx context.Context) (v string, err error) {
+func (m *AuthSessionMutation) OldSecret(ctx context.Context) (v string, err error) {
 	if !m.op.Is(OpUpdateOne) {
-		return v, errors.New("OldResourceVersion is only allowed on UpdateOne operations")
+		return v, errors.New("OldSecret is only allowed on UpdateOne operations")
 	}
 	if m.id == nil || m.oldValue == nil {
-		return v, errors.New("OldResourceVersion requires an ID field in the mutation")
+		return v, errors.New("OldSecret requires an ID field in the mutation")
 	}
 	oldValue, err := m.oldValue(ctx)
 	if err != nil {
-		return v, fmt.Errorf("querying old value for OldResourceVersion: %w", err)
+		return v, fmt.Errorf("querying old value for OldSecret: %w", err)
 	}
-	return oldValue.ResourceVersion, nil
+	return oldValue.Secret, nil
 }
 
-// ResetResourceVersion resets all changes to the "resource_version" field.
-func (m *ConnectorMutation) ResetResourceVersion() {
-	m.resource_version = nil
+// ResetSecret resets all changes to the "secret" field.
+func (m *AuthSessionMutation) ResetSecret() {
+	m.secret = nil
 }
 
-// SetConfig sets the "config" field.
-func (m *ConnectorMutation) SetConfig(b []byte) {
-	m._config = &b
+// SetClientStates sets the "client_states" field.
+func (m *AuthSessionMutation) SetClientStates(b []byte) {
+	m.client_states = &b
 }
 
-// Config returns the value of the "config" field in the mutation.
-func (m *ConnectorMutation) Config() (r []byte, exists bool) {
-	v := m._config
+// ClientStates returns the value of the "client_states" field in the mutation.
+func (m *AuthSessionMutation) ClientStates() (r []byte, exists bool) {
+	v := m.client_states
 	if v == nil {
 		return
 	}
 	return *v, true
 }
 
-// OldConfig returns the old "config" field's value of the Connector entity.
-// If the Connector object wasn't provided to the builder, the object is fetched from the database.
+// OldClientStates returns the old "client_states" field's value of the AuthSession entity.
+// If the AuthSession object wasn't provided to the builder, the object is fetched from the database.
 // An error is returned if the mutation operation is not UpdateOne, or the database query fails.
-func (m *ConnectorMutation) OldConfig(ctx context.Context) (v []byte, err error) {
+func (m *AuthSessionMutation) OldClientStates(ctx context.Context) (v []byte, err error) {
 	if !m.op.Is(OpUpdateOne) {
-		return v, errors.New("OldConfig is only allowed on UpdateOne operations")
+		return v, errors.New("OldClientStates is only allowed on UpdateOne operations")
 	}
 	if m.id == nil || m.oldValue == nil {
-		return v, errors.New("OldConfig requires an ID field in the mutation")
+		return v, errors.New("OldClientStates requires an ID field in the mutation")
 	}
 	oldValue, err := m.oldValue(ctx)
 	if err != nil {
-		return v, fmt.Errorf("querying old value for OldConfig: %w", err)
+		return v, fmt.Errorf("querying old value for OldClientStates: %w", err)
 	}
-	return oldValue.Config, nil
+	return oldValue.ClientStates, nil
 }
 
-// ResetConfig resets all changes to the "config" field.
-func (m *ConnectorMutation) ResetConfig() {
-	m._config = nil
+// ResetClientStates resets all changes to the "client_states" field.
+func (m *AuthSessionMutation) ResetClientStates() {
+	m.client_states = nil
 }
 
-// Where appends a list predicates to the ConnectorMutation builder.
-func (m *ConnectorMutation) Where(ps ...predicate.Connector) {
-	m.predicates = append(m.predicates, ps...)
+// SetCreatedAt sets the "created_at" field.
+func (m *AuthSessionMutation) SetCreatedAt(t time.Time) {
+	m.created_at = &t
 }
 
-// Op returns the operation name.
-func (m *ConnectorMutation) Op() Op {
-	return m.op
+// CreatedAt returns the value of the "created_at" field in the mutation.
+func (m *AuthSessionMutation) CreatedAt() (r time.Time, exists bool) {
+	v := m.created_at
+	if v == nil {
+		return
+	}
+	return *v, true
 }
 
-// Type returns the node type of this mutation (Connector).
-func (m *ConnectorMutation) Type() string {
-	return m.typ
+// OldCreatedAt returns the old "created_at" field's value of the AuthSession entity.
+// If the AuthSession object wasn't provided to the builder, the object is fetched from the database.
+// An error is returned if the mutation operation is not UpdateOne, or the database query fails.
+func (m *AuthSessionMutation) OldCreatedAt(ctx context.Context) (v time.Time, err error) {
+	if !m.op.Is(OpUpdateOne) {
+		return v, errors.New("OldCreatedAt is only allowed on UpdateOne operations")
+	}
+	if m.id == nil || m.oldValue == nil {
+		return v, errors.New("OldCreatedAt requires an ID field in the mutation")
+	}
+	oldValue, err := m.oldValue(ctx)
+	if err != nil {
+		return v, fmt.Errorf("querying old value for OldCreatedAt: %w", err)
+	}
+	return oldValue.CreatedAt, nil
 }
 
-// Fields returns all fields that were changed during this mutation. Note that in
-// order to get all numeric fields that were incremented/decremented, call
-// AddedFields().
-func (m *ConnectorMutation) Fields() []string {
-	fields := make([]string, 0, 4)
-	if m._type != nil {
-		fields = append(fields, connector.FieldType)
+// ResetCreatedAt resets all changes to the "created_at" field.
+func (m *AuthSessionMutation) ResetCreatedAt() {
+	m.created_at = nil
+}
+
+// SetLastActivity sets the "last_activity" field.
+func (m *AuthSessionMutation) SetLastActivity(t time.Time) {
+	m.last_activity = &t
+}
+
+// LastActivity returns the value of the "last_activity" field in the mutation.
+func (m *AuthSessionMutation) LastActivity() (r time.Time, exists bool) {
+	v := m.last_activity
+	if v == nil {
+		return
 	}
-	if m.name != nil {
-		fields = append(fields, connector.FieldName)
+	return *v, true
+}
+
+// OldLastActivity returns the old "last_activity" field's value of the AuthSession entity.
+// If the AuthSession object wasn't provided to the builder, the object is fetched from the database.
+// An error is returned if the mutation operation is not UpdateOne, or the database query fails.
+func (m *AuthSessionMutation) OldLastActivity(ctx context.Context) (v time.Time, err error) {
+	if !m.op.Is(OpUpdateOne) {
+		return v, errors.New("OldLastActivity is only allowed on UpdateOne operations")
 	}
-	if m.resource_version != nil {
-		fields = append(fields, connector.FieldResourceVersion)
+	if m.id == nil || m.oldValue == nil {
+		return v, errors.New("OldLastActivity requires an ID field in the mutation")
 	}
-	if m._config != nil {
-		fields = append(fields, connector.FieldConfig)
+	oldValue, err := m.oldValue(ctx)
+	if err != nil {
+		return v, fmt.Errorf("querying old value for OldLastActivity: %w", err)
 	}
-	return fields
+	return oldValue.LastActivity, nil
 }
 
-// Field returns the value of a field with the given name. The second boolean
-// return value indicates that this field was not set, or was not defined in the
-// schema.
-func (m *ConnectorMutation) Field(name string) (ent.Value, bool) {
-	switch name {
-	case connector.FieldType:
-		return m.GetType()
-	case connector.FieldName:
-		return m.Name()
-	case connector.FieldResourceVersion:
-		return m.ResourceVersion()
-	case connector.FieldConfig:
-		return m.Config()
-	}
-	return nil, false
+// ResetLastActivity resets all changes to the "last_activity" field.
+func (m *AuthSessionMutation) ResetLastActivity() {
+	m.last_activity = nil
+}
+
+// SetIPAddress sets the "ip_address" field.
+func (m *AuthSessionMutation) SetIPAddress(s string) {
+	m.ip_address = &s
+}
+
+// IPAddress returns the value of the "ip_address" field in the mutation.
+func (m *AuthSessionMutation) IPAddress() (r string, exists bool) {
+	v := m.ip_address
+	if v == nil {
+		return
+	}
+	return *v, true
+}
+
+// OldIPAddress returns the old "ip_address" field's value of the AuthSession entity.
+// If the AuthSession object wasn't provided to the builder, the object is fetched from the database.
+// An error is returned if the mutation operation is not UpdateOne, or the database query fails.
+func (m *AuthSessionMutation) OldIPAddress(ctx context.Context) (v string, err error) {
+	if !m.op.Is(OpUpdateOne) {
+		return v, errors.New("OldIPAddress is only allowed on UpdateOne operations")
+	}
+	if m.id == nil || m.oldValue == nil {
+		return v, errors.New("OldIPAddress requires an ID field in the mutation")
+	}
+	oldValue, err := m.oldValue(ctx)
+	if err != nil {
+		return v, fmt.Errorf("querying old value for OldIPAddress: %w", err)
+	}
+	return oldValue.IPAddress, nil
+}
+
+// ResetIPAddress resets all changes to the "ip_address" field.
+func (m *AuthSessionMutation) ResetIPAddress() {
+	m.ip_address = nil
+}
+
+// SetUserAgent sets the "user_agent" field.
+func (m *AuthSessionMutation) SetUserAgent(s string) {
+	m.user_agent = &s
+}
+
+// UserAgent returns the value of the "user_agent" field in the mutation.
+func (m *AuthSessionMutation) UserAgent() (r string, exists bool) {
+	v := m.user_agent
+	if v == nil {
+		return
+	}
+	return *v, true
+}
+
+// OldUserAgent returns the old "user_agent" field's value of the AuthSession entity.
+// If the AuthSession object wasn't provided to the builder, the object is fetched from the database.
+// An error is returned if the mutation operation is not UpdateOne, or the database query fails.
+func (m *AuthSessionMutation) OldUserAgent(ctx context.Context) (v string, err error) {
+	if !m.op.Is(OpUpdateOne) {
+		return v, errors.New("OldUserAgent is only allowed on UpdateOne operations")
+	}
+	if m.id == nil || m.oldValue == nil {
+		return v, errors.New("OldUserAgent requires an ID field in the mutation")
+	}
+	oldValue, err := m.oldValue(ctx)
+	if err != nil {
+		return v, fmt.Errorf("querying old value for OldUserAgent: %w", err)
+	}
+	return oldValue.UserAgent, nil
+}
+
+// ResetUserAgent resets all changes to the "user_agent" field.
+func (m *AuthSessionMutation) ResetUserAgent() {
+	m.user_agent = nil
+}
+
+// SetAbsoluteExpiry sets the "absolute_expiry" field.
+func (m *AuthSessionMutation) SetAbsoluteExpiry(t time.Time) {
+	m.absolute_expiry = &t
+}
+
+// AbsoluteExpiry returns the value of the "absolute_expiry" field in the mutation.
+func (m *AuthSessionMutation) AbsoluteExpiry() (r time.Time, exists bool) {
+	v := m.absolute_expiry
+	if v == nil {
+		return
+	}
+	return *v, true
+}
+
+// OldAbsoluteExpiry returns the old "absolute_expiry" field's value of the AuthSession entity.
+// If the AuthSession object wasn't provided to the builder, the object is fetched from the database.
+// An error is returned if the mutation operation is not UpdateOne, or the database query fails.
+func (m *AuthSessionMutation) OldAbsoluteExpiry(ctx context.Context) (v time.Time, err error) {
+	if !m.op.Is(OpUpdateOne) {
+		return v, errors.New("OldAbsoluteExpiry is only allowed on UpdateOne operations")
+	}
+	if m.id == nil || m.oldValue == nil {
+		return v, errors.New("OldAbsoluteExpiry requires an ID field in the mutation")
+	}
+	oldValue, err := m.oldValue(ctx)
+	if err != nil {
+		return v, fmt.Errorf("querying old value for OldAbsoluteExpiry: %w", err)
+	}
+	return oldValue.AbsoluteExpiry, nil
+}
+
+// ResetAbsoluteExpiry resets all changes to the "absolute_expiry" field.
+func (m *AuthSessionMutation) ResetAbsoluteExpiry() {
+	m.absolute_expiry = nil
+}
+
+// SetIdleExpiry sets the "idle_expiry" field.
+func (m *AuthSessionMutation) SetIdleExpiry(t time.Time) {
+	m.idle_expiry = &t
+}
+
+// IdleExpiry returns the value of the "idle_expiry" field in the mutation.
+func (m *AuthSessionMutation) IdleExpiry() (r time.Time, exists bool) {
+	v := m.idle_expiry
+	if v == nil {
+		return
+	}
+	return *v, true
+}
+
+// OldIdleExpiry returns the old "idle_expiry" field's value of the AuthSession entity.
+// If the AuthSession object wasn't provided to the builder, the object is fetched from the database.
+// An error is returned if the mutation operation is not UpdateOne, or the database query fails.
+func (m *AuthSessionMutation) OldIdleExpiry(ctx context.Context) (v time.Time, err error) {
+	if !m.op.Is(OpUpdateOne) {
+		return v, errors.New("OldIdleExpiry is only allowed on UpdateOne operations")
+	}
+	if m.id == nil || m.oldValue == nil {
+		return v, errors.New("OldIdleExpiry requires an ID field in the mutation")
+	}
+	oldValue, err := m.oldValue(ctx)
+	if err != nil {
+		return v, fmt.Errorf("querying old value for OldIdleExpiry: %w", err)
+	}
+	return oldValue.IdleExpiry, nil
+}
+
+// ResetIdleExpiry resets all changes to the "idle_expiry" field.
+func (m *AuthSessionMutation) ResetIdleExpiry() {
+	m.idle_expiry = nil
+}
+
+// SetLogoutState sets the "logout_state" field.
+func (m *AuthSessionMutation) SetLogoutState(b []byte) {
+	m.logout_state = &b
+}
+
+// LogoutState returns the value of the "logout_state" field in the mutation.
+func (m *AuthSessionMutation) LogoutState() (r []byte, exists bool) {
+	v := m.logout_state
+	if v == nil {
+		return
+	}
+	return *v, true
+}
+
+// OldLogoutState returns the old "logout_state" field's value of the AuthSession entity.
+// If the AuthSession object wasn't provided to the builder, the object is fetched from the database.
+// An error is returned if the mutation operation is not UpdateOne, or the database query fails.
+func (m *AuthSessionMutation) OldLogoutState(ctx context.Context) (v []byte, err error) {
+	if !m.op.Is(OpUpdateOne) {
+		return v, errors.New("OldLogoutState is only allowed on UpdateOne operations")
+	}
+	if m.id == nil || m.oldValue == nil {
+		return v, errors.New("OldLogoutState requires an ID field in the mutation")
+	}
+	oldValue, err := m.oldValue(ctx)
+	if err != nil {
+		return v, fmt.Errorf("querying old value for OldLogoutState: %w", err)
+	}
+	return oldValue.LogoutState, nil
+}
+
+// ClearLogoutState clears the value of the "logout_state" field.
+func (m *AuthSessionMutation) ClearLogoutState() {
+	m.logout_state = nil
+	m.clearedFields[authsession.FieldLogoutState] = struct{}{}
+}
+
+// LogoutStateCleared returns if the "logout_state" field was cleared in this mutation.
+func (m *AuthSessionMutation) LogoutStateCleared() bool {
+	_, ok := m.clearedFields[authsession.FieldLogoutState]
+	return ok
+}
+
+// ResetLogoutState resets all changes to the "logout_state" field.
+func (m *AuthSessionMutation) ResetLogoutState() {
+	m.logout_state = nil
+	delete(m.clearedFields, authsession.FieldLogoutState)
+}
+
+// Where appends a list predicates to the AuthSessionMutation builder.
+func (m *AuthSessionMutation) Where(ps ...predicate.AuthSession) {
+	m.predicates = append(m.predicates, ps...)
+}
+
+// WhereP appends storage-level predicates to the AuthSessionMutation builder. Using this method,
+// users can use type-assertion to append predicates that do not depend on any generated package.
+func (m *AuthSessionMutation) WhereP(ps ...func(*sql.Selector)) {
+	p := make([]predicate.AuthSession, len(ps))
+	for i := range ps {
+		p[i] = ps[i]
+	}
+	m.Where(p...)
+}
+
+// Op returns the operation name.
+func (m *AuthSessionMutation) Op() Op {
+	return m.op
+}
+
+// SetOp allows setting the mutation operation.
+func (m *AuthSessionMutation) SetOp(op Op) {
+	m.op = op
+}
+
+// Type returns the node type of this mutation (AuthSession).
+func (m *AuthSessionMutation) Type() string {
+	return m.typ
+}
+
+// Fields returns all fields that were changed during this mutation. Note that in
+// order to get all numeric fields that were incremented/decremented, call
+// AddedFields().
+func (m *AuthSessionMutation) Fields() []string {
+	fields := make([]string, 0, 11)
+	if m.user_id != nil {
+		fields = append(fields, authsession.FieldUserID)
+	}
+	if m.connector_id != nil {
+		fields = append(fields, authsession.FieldConnectorID)
+	}
+	if m.secret != nil {
+		fields = append(fields, authsession.FieldSecret)
+	}
+	if m.client_states != nil {
+		fields = append(fields, authsession.FieldClientStates)
+	}
+	if m.created_at != nil {
+		fields = append(fields, authsession.FieldCreatedAt)
+	}
+	if m.last_activity != nil {
+		fields = append(fields, authsession.FieldLastActivity)
+	}
+	if m.ip_address != nil {
+		fields = append(fields, authsession.FieldIPAddress)
+	}
+	if m.user_agent != nil {
+		fields = append(fields, authsession.FieldUserAgent)
+	}
+	if m.absolute_expiry != nil {
+		fields = append(fields, authsession.FieldAbsoluteExpiry)
+	}
+	if m.idle_expiry != nil {
+		fields = append(fields, authsession.FieldIdleExpiry)
+	}
+	if m.logout_state != nil {
+		fields = append(fields, authsession.FieldLogoutState)
+	}
+	return fields
+}
+
+// Field returns the value of a field with the given name. The second boolean
+// return value indicates that this field was not set, or was not defined in the
+// schema.
+func (m *AuthSessionMutation) Field(name string) (ent.Value, bool) {
+	switch name {
+	case authsession.FieldUserID:
+		return m.UserID()
+	case authsession.FieldConnectorID:
+		return m.ConnectorID()
+	case authsession.FieldSecret:
+		return m.Secret()
+	case authsession.FieldClientStates:
+		return m.ClientStates()
+	case authsession.FieldCreatedAt:
+		return m.CreatedAt()
+	case authsession.FieldLastActivity:
+		return m.LastActivity()
+	case authsession.FieldIPAddress:
+		return m.IPAddress()
+	case authsession.FieldUserAgent:
+		return m.UserAgent()
+	case authsession.FieldAbsoluteExpiry:
+		return m.AbsoluteExpiry()
+	case authsession.FieldIdleExpiry:
+		return m.IdleExpiry()
+	case authsession.FieldLogoutState:
+		return m.LogoutState()
+	}
+	return nil, false
 }
 
 // OldField returns the old value of the field from the database. An error is
 // returned if the mutation operation is not UpdateOne, or the query to the
 // database failed.
-func (m *ConnectorMutation) OldField(ctx context.Context, name string) (ent.Value, error) {
+func (m *AuthSessionMutation) OldField(ctx context.Context, name string) (ent.Value, error) {
 	switch name {
-	case connector.FieldType:
-		return m.OldType(ctx)
-	case connector.FieldName:
-		return m.OldName(ctx)
-	case connector.FieldResourceVersion:
-		return m.OldResourceVersion(ctx)
-	case connector.FieldConfig:
-		return m.OldConfig(ctx)
-	}
-	return nil, fmt.Errorf("unknown Connector field %s", name)
+	case authsession.FieldUserID:
+		return m.OldUserID(ctx)
+	case authsession.FieldConnectorID:
+		return m.OldConnectorID(ctx)
+	case authsession.FieldSecret:
+		return m.OldSecret(ctx)
+	case authsession.FieldClientStates:
+		return m.OldClientStates(ctx)
+	case authsession.FieldCreatedAt:
+		return m.OldCreatedAt(ctx)
+	case authsession.FieldLastActivity:
+		return m.OldLastActivity(ctx)
+	case authsession.FieldIPAddress:
+		return m.OldIPAddress(ctx)
+	case authsession.FieldUserAgent:
+		return m.OldUserAgent(ctx)
+	case authsession.FieldAbsoluteExpiry:
+		return m.OldAbsoluteExpiry(ctx)
+	case authsession.FieldIdleExpiry:
+		return m.OldIdleExpiry(ctx)
+	case authsession.FieldLogoutState:
+		return m.OldLogoutState(ctx)
+	}
+	return nil, fmt.Errorf("unknown AuthSession field %s", name)
 }
 
 // SetField sets the value of a field with the given name. It returns an error if
 // the field is not defined in the schema, or if the type mismatched the field
 // type.
-func (m *ConnectorMutation) SetField(name string, value ent.Value) error {
+func (m *AuthSessionMutation) SetField(name string, value ent.Value) error {
 	switch name {
-	case connector.FieldType:
+	case authsession.FieldUserID:
 		v, ok := value.(string)
 		if !ok {
 			return fmt.Errorf("unexpected type %T for field %s", value, name)
 		}
-		m.SetType(v)
+		m.SetUserID(v)
 		return nil
-	case connector.FieldName:
+	case authsession.FieldConnectorID:
 		v, ok := value.(string)
 		if !ok {
 			return fmt.Errorf("unexpected type %T for field %s", value, name)
 		}
-		m.SetName(v)
+		m.SetConnectorID(v)
 		return nil
-	case connector.FieldResourceVersion:
+	case authsession.FieldSecret:
 		v, ok := value.(string)
 		if !ok {
 			return fmt.Errorf("unexpected type %T for field %s", value, name)
 		}
-		m.SetResourceVersion(v)
+		m.SetSecret(v)
 		return nil
-	case connector.FieldConfig:
+	case authsession.FieldClientStates:
 		v, ok := value.([]byte)
 		if !ok {
 			return fmt.Errorf("unexpected type %T for field %s", value, name)
 		}
-		m.SetConfig(v)
+		m.SetClientStates(v)
+		return nil
+	case authsession.FieldCreatedAt:
+		v, ok := value.(time.Time)
+		if !ok {
+			return fmt.Errorf("unexpected type %T for field %s", value, name)
+		}
+		m.SetCreatedAt(v)
+		return nil
+	case authsession.FieldLastActivity:
+		v, ok := value.(time.Time)
+		if !ok {
+			return fmt.Errorf("unexpected type %T for field %s", value, name)
+		}
+		m.SetLastActivity(v)
+		return nil
+	case authsession.FieldIPAddress:
+		v, ok := value.(string)
+		if !ok {
+			return fmt.Errorf("unexpected type %T for field %s", value, name)
+		}
+		m.SetIPAddress(v)
+		return nil
+	case authsession.FieldUserAgent:
+		v, ok := value.(string)
+		if !ok {
+			return fmt.Errorf("unexpected type %T for field %s", value, name)
+		}
+		m.SetUserAgent(v)
+		return nil
+	case authsession.FieldAbsoluteExpiry:
+		v, ok := value.(time.Time)
+		if !ok {
+			return fmt.Errorf("unexpected type %T for field %s", value, name)
+		}
+		m.SetAbsoluteExpiry(v)
+		return nil
+	case authsession.FieldIdleExpiry:
+		v, ok := value.(time.Time)
+		if !ok {
+			return fmt.Errorf("unexpected type %T for field %s", value, name)
+		}
+		m.SetIdleExpiry(v)
+		return nil
+	case authsession.FieldLogoutState:
+		v, ok := value.([]byte)
+		if !ok {
+			return fmt.Errorf("unexpected type %T for field %s", value, name)
+		}
+		m.SetLogoutState(v)
 		return nil
 	}
-	return fmt.Errorf("unknown Connector field %s", name)
+	return fmt.Errorf("unknown AuthSession field %s", name)
 }
 
 // AddedFields returns all numeric fields that were incremented/decremented during
 // this mutation.
-func (m *ConnectorMutation) AddedFields() []string {
+func (m *AuthSessionMutation) AddedFields() []string {
 	return nil
 }
 
 // AddedField returns the numeric value that was incremented/decremented on a field
 // with the given name. The second boolean return value indicates that this field
 // was not set, or was not defined in the schema.
-func (m *ConnectorMutation) AddedField(name string) (ent.Value, bool) {
+func (m *AuthSessionMutation) AddedField(name string) (ent.Value, bool) {
 	return nil, false
 }
 
 // AddField adds the value to the field with the given name. It returns an error if
 // the field is not defined in the schema, or if the type mismatched the field
 // type.
-func (m *ConnectorMutation) AddField(name string, value ent.Value) error {
+func (m *AuthSessionMutation) AddField(name string, value ent.Value) error {
 	switch name {
 	}
-	return fmt.Errorf("unknown Connector numeric field %s", name)
+	return fmt.Errorf("unknown AuthSession numeric field %s", name)
 }
 
 // ClearedFields returns all nullable fields that were cleared during this
 // mutation.
-func (m *ConnectorMutation) ClearedFields() []string {
-	return nil
+func (m *AuthSessionMutation) ClearedFields() []string {
+	var fields []string
+	if m.FieldCleared(authsession.FieldLogoutState) {
+		fields = append(fields, authsession.FieldLogoutState)
+	}
+	return fields
 }
 
 // FieldCleared returns a boolean indicating if a field with the given name was
 // cleared in this mutation.
-func (m *ConnectorMutation) FieldCleared(name string) bool {
+func (m *AuthSessionMutation) FieldCleared(name string) bool {
 	_, ok := m.clearedFields[name]
 	return ok
 }
 
 // ClearField clears the value of the field with the given name. It returns an
 // error if the field is not defined in the schema.
-func (m *ConnectorMutation) ClearField(name string) error {
-	return fmt.Errorf("unknown Connector nullable field %s", name)
+func (m *AuthSessionMutation) ClearField(name string) error {
+	switch name {
+	case authsession.FieldLogoutState:
+		m.ClearLogoutState()
+		return nil
+	}
+	return fmt.Errorf("unknown AuthSession nullable field %s", name)
 }
 
 // ResetField resets all changes in the mutation for the field with the given name.
 // It returns an error if the field is not defined in the schema.
-func (m *ConnectorMutation) ResetField(name string) error {
+func (m *AuthSessionMutation) ResetField(name string) error {
 	switch name {
-	case connector.FieldType:
-		m.ResetType()
+	case authsession.FieldUserID:
+		m.ResetUserID()
 		return nil
-	case connector.FieldName:
-		m.ResetName()
+	case authsession.FieldConnectorID:
+		m.ResetConnectorID()
 		return nil
-	case connector.FieldResourceVersion:
-		m.ResetResourceVersion()
+	case authsession.FieldSecret:
+		m.ResetSecret()
 		return nil
-	case connector.FieldConfig:
-		m.ResetConfig()
+	case authsession.FieldClientStates:
+		m.ResetClientStates()
+		return nil
+	case authsession.FieldCreatedAt:
+		m.ResetCreatedAt()
+		return nil
+	case authsession.FieldLastActivity:
+		m.ResetLastActivity()
+		return nil
+	case authsession.FieldIPAddress:
+		m.ResetIPAddress()
+		return nil
+	case authsession.FieldUserAgent:
+		m.ResetUserAgent()
+		return nil
+	case authsession.FieldAbsoluteExpiry:
+		m.ResetAbsoluteExpiry()
+		return nil
+	case authsession.FieldIdleExpiry:
+		m.ResetIdleExpiry()
+		return nil
+	case authsession.FieldLogoutState:
+		m.ResetLogoutState()
 		return nil
 	}
-	return fmt.Errorf("unknown Connector field %s", name)
+	return fmt.Errorf("unknown AuthSession field %s", name)
 }
 
 // AddedEdges returns all edge names that were set/added in this mutation.
-func (m *ConnectorMutation) AddedEdges() []string {
+func (m *AuthSessionMutation) AddedEdges() []string {
 	edges := make([]string, 0, 0)
 	return edges
 }
 
 // AddedIDs returns all IDs (to other nodes) that were added for the given edge
 // name in this mutation.
-func (m *ConnectorMutation) AddedIDs(name string) []ent.Value {
+func (m *AuthSessionMutation) AddedIDs(name string) []ent.Value {
 	return nil
 }
 
 // RemovedEdges returns all edge names that were removed in this mutation.
-func (m *ConnectorMutation) RemovedEdges() []string {
+func (m *AuthSessionMutation) RemovedEdges() []string {
 	edges := make([]string, 0, 0)
 	return edges
 }
 
 // RemovedIDs returns all IDs (to other nodes) that were removed for the edge with
 // the given name in this mutation.
-func (m *ConnectorMutation) RemovedIDs(name string) []ent.Value {
+func (m *AuthSessionMutation) RemovedIDs(name string) []ent.Value {
 	return nil
 }
 
 // ClearedEdges returns all edge names that were cleared in this mutation.
-func (m *ConnectorMutation) ClearedEdges() []string {
+func (m *AuthSessionMutation) ClearedEdges() []string {
 	edges := make([]string, 0, 0)
 	return edges
 }
 
 // EdgeCleared returns a boolean which indicates if the edge with the given name
 // was cleared in this mutation.
-func (m *ConnectorMutation) EdgeCleared(name string) bool {
+func (m *AuthSessionMutation) EdgeCleared(name string) bool {
 	return false
 }
 
 // ClearEdge clears the value of the edge with the given name. It returns an error
 // if that edge is not defined in the schema.
-func (m *ConnectorMutation) ClearEdge(name string) error {
-	return fmt.Errorf("unknown Connector unique edge %s", name)
+func (m *AuthSessionMutation) ClearEdge(name string) error {
+	return fmt.Errorf("unknown AuthSession unique edge %s", name)
 }
 
 // ResetEdge resets all changes to the edge with the given name in this mutation.
 // It returns an error if the edge is not defined in the schema.
-func (m *ConnectorMutation) ResetEdge(name string) error {
-	return fmt.Errorf("unknown Connector edge %s", name)
+func (m *AuthSessionMutation) ResetEdge(name string) error {
+	return fmt.Errorf("unknown AuthSession edge %s", name)
 }
 
-// DeviceRequestMutation represents an operation that mutates the DeviceRequest nodes in the graph.
-type DeviceRequestMutation struct {
+// ConnectorMutation represents an operation that mutates the Connector nodes in the graph.
+type ConnectorMutation struct {
 	config
-	op            Op
-	typ           string
-	id            *int
-	user_code     *string
-	device_code   *string
-	client_id     *string
-	client_secret *string
-	scopes        *[]string
-	expiry        *time.Time
-	clearedFields map[string]struct{}
-	done          bool
-	oldValue      func(context.Context) (*DeviceRequest, error)
-	predicates    []predicate.DeviceRequest
+	op                Op
+	typ               string
+	id                *string
+	_type             *string
+	name              *string
+	resource_version  *string
+	_config           *[]byte
+	grant_types       *[]string
+	appendgrant_types []string
+	clearedFields     map[string]struct{}
+	done              bool
+	oldValue          func(context.Context) (*Connector, error)
+	predicates        []predicate.Connector
 }
 
-var _ ent.Mutation = (*DeviceRequestMutation)(nil)
+var _ ent.Mutation = (*ConnectorMutation)(nil)
 
-// devicerequestOption allows management of the mutation configuration using functional options.
-type devicerequestOption func(*DeviceRequestMutation)
+// connectorOption allows management of the mutation configuration using functional options.
+type connectorOption func(*ConnectorMutation)
 
-// newDeviceRequestMutation creates new mutation for the DeviceRequest entity.
-func newDeviceRequestMutation(c config, op Op, opts ...devicerequestOption) *DeviceRequestMutation {
-	m := &DeviceRequestMutation{
+// newConnectorMutation creates new mutation for the Connector entity.
+func newConnectorMutation(c config, op Op, opts ...connectorOption) *ConnectorMutation {
+	m := &ConnectorMutation{
 		config:        c,
 		op:            op,
-		typ:           TypeDeviceRequest,
+		typ:           TypeConnector,
 		clearedFields: make(map[string]struct{}),
 	}
 	for _, opt := range opts {
@@ -3064,20 +4142,20 @@ func newDeviceRequestMutation(c config, op Op, opts ...devicerequestOption) *Dev
 	return m
 }
 
-// withDeviceRequestID sets the ID field of the mutation.
-func withDeviceRequestID(id int) devicerequestOption {
-	return func(m *DeviceRequestMutation) {
+// withConnectorID sets the ID field of the mutation.
+func withConnectorID(id string) connectorOption {
+	return func(m *ConnectorMutation) {
 		var (
 			err   error
 			once  sync.Once
-			value *DeviceRequest
+			value *Connector
 		)
-		m.oldValue = func(ctx context.Context) (*DeviceRequest, error) {
+		m.oldValue = func(ctx context.Context) (*Connector, error) {
 			once.Do(func() {
 				if m.done {
 					err = errors.New("querying old values post mutation is not allowed")
 				} else {
-					value, err = m.Client().DeviceRequest.Get(ctx, id)
+					value, err = m.Client().Connector.Get(ctx, id)
 				}
 			})
 			return value, err
@@ -3086,10 +4164,10 @@ func withDeviceRequestID(id int) devicerequestOption {
 	}
 }
 
-// withDeviceRequest sets the old DeviceRequest of the mutation.
-func withDeviceRequest(node *DeviceRequest) devicerequestOption {
-	return func(m *DeviceRequestMutation) {
-		m.oldValue = func(context.Context) (*DeviceRequest, error) {
+// withConnector sets the old Connector of the mutation.
+func withConnector(node *Connector) connectorOption {
+	return func(m *ConnectorMutation) {
+		m.oldValue = func(context.Context) (*Connector, error) {
 			return node, nil
 		}
 		m.id = &node.ID
@@ -3098,7 +4176,7 @@ func withDeviceRequest(node *DeviceRequest) devicerequestOption {
 
 // Client returns a new `ent.Client` from the mutation. If the mutation was
 // executed in a transaction (ent.Tx), a transactional client is returned.
-func (m DeviceRequestMutation) Client() *Client {
+func (m ConnectorMutation) Client() *Client {
 	client := &Client{config: m.config}
 	client.init()
 	return client
@@ -3106,7 +4184,7 @@ func (m DeviceRequestMutation) Client() *Client {
 
 // Tx returns an `ent.Tx` for mutations that were executed in transactions;
 // it returns an error otherwise.
-func (m DeviceRequestMutation) Tx() (*Tx, error) {
+func (m ConnectorMutation) Tx() (*Tx, error) {
 	if _, ok := m.driver.(*txDriver); !ok {
 		return nil, errors.New("db: mutation is not running in a transaction")
 	}
@@ -3115,9 +4193,15 @@ func (m DeviceRequestMutation) Tx() (*Tx, error) {
 	return tx, nil
 }
 
+// SetID sets the value of the id field. Note that this
+// operation is only accepted on creation of Connector entities.
+func (m *ConnectorMutation) SetID(id string) {
+	m.id = &id
+}
+
 // ID returns the ID value in the mutation. Note that the ID is only available
 // if it was provided to the builder or after it was returned from the database.
-func (m *DeviceRequestMutation) ID() (id int, exists bool) {
+func (m *ConnectorMutation) ID() (id string, exists bool) {
 	if m.id == nil {
 		return
 	}
@@ -3128,287 +4212,279 @@ func (m *DeviceRequestMutation) ID() (id int, exists bool) {
 // That means, if the mutation is applied within a transaction with an isolation level such
 // as sql.LevelSerializable, the returned ids match the ids of the rows that will be updated
 // or updated by the mutation.
-func (m *DeviceRequestMutation) IDs(ctx context.Context) ([]int, error) {
+func (m *ConnectorMutation) IDs(ctx context.Context) ([]string, error) {
 	switch {
 	case m.op.Is(OpUpdateOne | OpDeleteOne):
 		id, exists := m.ID()
 		if exists {
-			return []int{id}, nil
+			return []string{id}, nil
 		}
 		fallthrough
 	case m.op.Is(OpUpdate | OpDelete):
-		return m.Client().DeviceRequest.Query().Where(m.predicates...).IDs(ctx)
+		return m.Client().Connector.Query().Where(m.predicates...).IDs(ctx)
 	default:
 		return nil, fmt.Errorf("IDs is not allowed on %s operations", m.op)
 	}
 }
 
-// SetUserCode sets the "user_code" field.
-func (m *DeviceRequestMutation) SetUserCode(s string) {
-	m.user_code = &s
+// SetType sets the "type" field.
+func (m *ConnectorMutation) SetType(s string) {
+	m._type = &s
 }
 
-// UserCode returns the value of the "user_code" field in the mutation.
-func (m *DeviceRequestMutation) UserCode() (r string, exists bool) {
-	v := m.user_code
+// GetType returns the value of the "type" field in the mutation.
+func (m *ConnectorMutation) GetType() (r string, exists bool) {
+	v := m._type
 	if v == nil {
 		return
 	}
 	return *v, true
 }
 
-// OldUserCode returns the old "user_code" field's value of the DeviceRequest entity.
-// If the DeviceRequest object wasn't provided to the builder, the object is fetched from the database.
+// OldType returns the old "type" field's value of the Connector entity.
+// If the Connector object wasn't provided to the builder, the object is fetched from the database.
 // An error is returned if the mutation operation is not UpdateOne, or the database query fails.
-func (m *DeviceRequestMutation) OldUserCode(ctx context.Context) (v string, err error) {
+func (m *ConnectorMutation) OldType(ctx context.Context) (v string, err error) {
 	if !m.op.Is(OpUpdateOne) {
-		return v, errors.New("OldUserCode is only allowed on UpdateOne operations")
+		return v, errors.New("OldType is only allowed on UpdateOne operations")
 	}
 	if m.id == nil || m.oldValue == nil {
-		return v, errors.New("OldUserCode requires an ID field in the mutation")
+		return v, errors.New("OldType requires an ID field in the mutation")
 	}
 	oldValue, err := m.oldValue(ctx)
 	if err != nil {
-		return v, fmt.Errorf("querying old value for OldUserCode: %w", err)
+		return v, fmt.Errorf("querying old value for OldType: %w", err)
 	}
-	return oldValue.UserCode, nil
+	return oldValue.Type, nil
 }
 
-// ResetUserCode resets all changes to the "user_code" field.
-func (m *DeviceRequestMutation) ResetUserCode() {
-	m.user_code = nil
+// ResetType resets all changes to the "type" field.
+func (m *ConnectorMutation) ResetType() {
+	m._type = nil
 }
 
-// SetDeviceCode sets the "device_code" field.
-func (m *DeviceRequestMutation) SetDeviceCode(s string) {
-	m.device_code = &s
+// SetName sets the "name" field.
+func (m *ConnectorMutation) SetName(s string) {
+	m.name = &s
 }
 
-// DeviceCode returns the value of the "device_code" field in the mutation.
-func (m *DeviceRequestMutation) DeviceCode() (r string, exists bool) {
-	v := m.device_code
+// Name returns the value of the "name" field in the mutation.
+func (m *ConnectorMutation) Name() (r string, exists bool) {
+	v := m.name
 	if v == nil {
 		return
 	}
 	return *v, true
 }
 
-// OldDeviceCode returns the old "device_code" field's value of the DeviceRequest entity.
-// If the DeviceRequest object wasn't provided to the builder, the object is fetched from the database.
+// OldName returns the old "name" field's value of the Connector entity.
+// If the Connector object wasn't provided to the builder, the object is fetched from the database.
 // An error is returned if the mutation operation is not UpdateOne, or the database query fails.
-func (m *DeviceRequestMutation) OldDeviceCode(ctx context.Context) (v string, err error) {
+func (m *ConnectorMutation) OldName(ctx context.Context) (v string, err error) {
 	if !m.op.Is(OpUpdateOne) {
-		return v, errors.New("OldDeviceCode is only allowed on UpdateOne operations")
+		return v, errors.New("OldName is only allowed on UpdateOne operations")
 	}
 	if m.id == nil || m.oldValue == nil {
-		return v, errors.New("OldDeviceCode requires an ID field in the mutation")
+		return v, errors.New("OldName requires an ID field in the mutation")
 	}
 	oldValue, err := m.oldValue(ctx)
 	if err != nil {
-		return v, fmt.Errorf("querying old value for OldDeviceCode: %w", err)
+		return v, fmt.Errorf("querying old value for OldName: %w", err)
 	}
-	return oldValue.DeviceCode, nil
+	return oldValue.Name, nil
 }
 
-// ResetDeviceCode resets all changes to the "device_code" field.
-func (m *DeviceRequestMutation) ResetDeviceCode() {
-	m.device_code = nil
+// ResetName resets all changes to the "name" field.
+func (m *ConnectorMutation) ResetName() {
+	m.name = nil
 }
 
-// SetClientID sets the "client_id" field.
-func (m *DeviceRequestMutation) SetClientID(s string) {
-	m.client_id = &s
+// SetResourceVersion sets the "resource_version" field.
+func (m *ConnectorMutation) SetResourceVersion(s string) {
+	m.resource_version = &s
 }
 
-// ClientID returns the value of the "client_id" field in the mutation.
-func (m *DeviceRequestMutation) ClientID() (r string, exists bool) {
-	v := m.client_id
+// ResourceVersion returns the value of the "resource_version" field in the mutation.
+func (m *ConnectorMutation) ResourceVersion() (r string, exists bool) {
+	v := m.resource_version
 	if v == nil {
 		return
 	}
 	return *v, true
 }
 
-// OldClientID returns the old "client_id" field's value of the DeviceRequest entity.
-// If the DeviceRequest object wasn't provided to the builder, the object is fetched from the database.
+// OldResourceVersion returns the old "resource_version" field's value of the Connector entity.
+// If the Connector object wasn't provided to the builder, the object is fetched from the database.
 // An error is returned if the mutation operation is not UpdateOne, or the database query fails.
-func (m *DeviceRequestMutation) OldClientID(ctx context.Context) (v string, err error) {
+func (m *ConnectorMutation) OldResourceVersion(ctx context.Context) (v string, err error) {
 	if !m.op.Is(OpUpdateOne) {
-		return v, errors.New("OldClientID is only allowed on UpdateOne operations")
+		return v, errors.New("OldResourceVersion is only allowed on UpdateOne operations")
 	}
 	if m.id == nil || m.oldValue == nil {
-		return v, errors.New("OldClientID requires an ID field in the mutation")
+		return v, errors.New("OldResourceVersion requires an ID field in the mutation")
 	}
 	oldValue, err := m.oldValue(ctx)
 	if err != nil {
-		return v, fmt.Errorf("querying old value for OldClientID: %w", err)
+		return v, fmt.Errorf("querying old value for OldResourceVersion: %w", err)
 	}
-	return oldValue.ClientID, nil
+	return oldValue.ResourceVersion, nil
 }
 
-// ResetClientID resets all changes to the "client_id" field.
-func (m *DeviceRequestMutation) ResetClientID() {
-	m.client_id = nil
+// ResetResourceVersion resets all changes to the "resource_version" field.
+func (m *ConnectorMutation) ResetResourceVersion() {
+	m.resource_version = nil
 }
 
-// SetClientSecret sets the "client_secret" field.
-func (m *DeviceRequestMutation) SetClientSecret(s string) {
-	m.client_secret = &s
+// SetConfig sets the "config" field.
+func (m *ConnectorMutation) SetConfig(b []byte) {
+	m._config = &b
 }
 
-// ClientSecret returns the value of the "client_secret" field in the mutation.
-func (m *DeviceRequestMutation) ClientSecret() (r string, exists bool) {
-	v := m.client_secret
+// Config returns the value of the "config" field in the mutation.
+func (m *ConnectorMutation) Config() (r []byte, exists bool) {
+	v := m._config
 	if v == nil {
 		return
 	}
 	return *v, true
 }
 
-// OldClientSecret returns the old "client_secret" field's value of the DeviceRequest entity.
-// If the DeviceRequest object wasn't provided to the builder, the object is fetched from the database.
+// OldConfig returns the old "config" field's value of the Connector entity.
+// If the Connector object wasn't provided to the builder, the object is fetched from the database.
 // An error is returned if the mutation operation is not UpdateOne, or the database query fails.
-func (m *DeviceRequestMutation) OldClientSecret(ctx context.Context) (v string, err error) {
+func (m *ConnectorMutation) OldConfig(ctx context.Context) (v []byte, err error) {
 	if !m.op.Is(OpUpdateOne) {
-		return v, errors.New("OldClientSecret is only allowed on UpdateOne operations")
+		return v, errors.New("OldConfig is only allowed on UpdateOne operations")
 	}
 	if m.id == nil || m.oldValue == nil {
-		return v, errors.New("OldClientSecret requires an ID field in the mutation")
+		return v, errors.New("OldConfig requires an ID field in the mutation")
 	}
 	oldValue, err := m.oldValue(ctx)
 	if err != nil {
-		return v, fmt.Errorf("querying old value for OldClientSecret: %w", err)
+		return v, fmt.Errorf("querying old value for OldConfig: %w", err)
 	}
-	return oldValue.ClientSecret, nil
+	return oldValue.Config, nil
 }
 
-// ResetClientSecret resets all changes to the "client_secret" field.
-func (m *DeviceRequestMutation) ResetClientSecret() {
-	m.client_secret = nil
+// ResetConfig resets all changes to the "config" field.
+func (m *ConnectorMutation) ResetConfig() {
+	m._config = nil
 }
 
-// SetScopes sets the "scopes" field.
-func (m *DeviceRequestMutation) SetScopes(s []string) {
-	m.scopes = &s
+// SetGrantTypes sets the "grant_types" field.
+func (m *ConnectorMutation) SetGrantTypes(s []string) {
+	m.grant_types = &s
+	m.appendgrant_types = nil
 }
 
-// Scopes returns the value of the "scopes" field in the mutation.
-func (m *DeviceRequestMutation) Scopes() (r []string, exists bool) {
-	v := m.scopes
+// GrantTypes returns the value of the "grant_types" field in the mutation.
+func (m *ConnectorMutation) GrantTypes() (r []string, exists bool) {
+	v := m.grant_types
 	if v == nil {
 		return
 	}
 	return *v, true
 }
 
-// OldScopes returns the old "scopes" field's value of the DeviceRequest entity.
-// If the DeviceRequest object wasn't provided to the builder, the object is fetched from the database.
+// OldGrantTypes returns the old "grant_types" field's value of the Connector entity.
+// If the Connector object wasn't provided to the builder, the object is fetched from the database.
 // An error is returned if the mutation operation is not UpdateOne, or the database query fails.
-func (m *DeviceRequestMutation) OldScopes(ctx context.Context) (v []string, err error) {
+func (m *ConnectorMutation) OldGrantTypes(ctx context.Context) (v []string, err error) {
 	if !m.op.Is(OpUpdateOne) {
-		return v, errors.New("OldScopes is only allowed on UpdateOne operations")
+		return v, errors.New("OldGrantTypes is only allowed on UpdateOne operations")
 	}
 	if m.id == nil || m.oldValue == nil {
-		return v, errors.New("OldScopes requires an ID field in the mutation")
+		return v, errors.New("OldGrantTypes requires an ID field in the mutation")
 	}
 	oldValue, err := m.oldValue(ctx)
 	if err != nil {
-		return v, fmt.Errorf("querying old value for OldScopes: %w", err)
+		return v, fmt.Errorf("querying old value for OldGrantTypes: %w", err)
 	}
-	return oldValue.Scopes, nil
+	return oldValue.GrantTypes, nil
 }
 
-// ClearScopes clears the value of the "scopes" field.
-func (m *DeviceRequestMutation) ClearScopes() {
-	m.scopes = nil
-	m.clearedFields[devicerequest.FieldScopes] = struct{}{}
+// AppendGrantTypes adds s to the "grant_types" field.
+func (m *ConnectorMutation) AppendGrantTypes(s []string) {
+	m.appendgrant_types = append(m.appendgrant_types, s...)
 }
 
-// ScopesCleared returns if the "scopes" field was cleared in this mutation.
-func (m *DeviceRequestMutation) ScopesCleared() bool {
-	_, ok := m.clearedFields[devicerequest.FieldScopes]
+// AppendedGrantTypes returns the list of values that were appended to the "grant_types" field in this mutation.
+func (m *ConnectorMutation) AppendedGrantTypes() ([]string, bool) {
+	if len(m.appendgrant_types) == 0 {
+		return nil, false
+	}
+	return m.appendgrant_types, true
+}
+
+// ClearGrantTypes clears the value of the "grant_types" field.
+func (m *ConnectorMutation) ClearGrantTypes() {
+	m.grant_types = nil
+	m.appendgrant_types = nil
+	m.clearedFields[connector.FieldGrantTypes] = struct{}{}
+}
+
+// GrantTypesCleared returns if the "grant_types" field was cleared in this mutation.
+func (m *ConnectorMutation) GrantTypesCleared() bool {
+	_, ok := m.clearedFields[connector.FieldGrantTypes]
 	return ok
 }
 
-// ResetScopes resets all changes to the "scopes" field.
-func (m *DeviceRequestMutation) ResetScopes() {
-	m.scopes = nil
-	delete(m.clearedFields, devicerequest.FieldScopes)
+// ResetGrantTypes resets all changes to the "grant_types" field.
+func (m *ConnectorMutation) ResetGrantTypes() {
+	m.grant_types = nil
+	m.appendgrant_types = nil
+	delete(m.clearedFields, connector.FieldGrantTypes)
 }
 
-// SetExpiry sets the "expiry" field.
-func (m *DeviceRequestMutation) SetExpiry(t time.Time) {
-	m.expiry = &t
+// Where appends a list predicates to the ConnectorMutation builder.
+func (m *ConnectorMutation) Where(ps ...predicate.Connector) {
+	m.predicates = append(m.predicates, ps...)
 }
 
-// Expiry returns the value of the "expiry" field in the mutation.
-func (m *DeviceRequestMutation) Expiry() (r time.Time, exists bool) {
-	v := m.expiry
-	if v == nil {
-		return
+// WhereP appends storage-level predicates to the ConnectorMutation builder. Using this method,
+// users can use type-assertion to append predicates that do not depend on any generated package.
+func (m *ConnectorMutation) WhereP(ps ...func(*sql.Selector)) {
+	p := make([]predicate.Connector, len(ps))
+	for i := range ps {
+		p[i] = ps[i]
 	}
-	return *v, true
-}
-
-// OldExpiry returns the old "expiry" field's value of the DeviceRequest entity.
-// If the DeviceRequest object wasn't provided to the builder, the object is fetched from the database.
-// An error is returned if the mutation operation is not UpdateOne, or the database query fails.
-func (m *DeviceRequestMutation) OldExpiry(ctx context.Context) (v time.Time, err error) {
-	if !m.op.Is(OpUpdateOne) {
-		return v, errors.New("OldExpiry is only allowed on UpdateOne operations")
-	}
-	if m.id == nil || m.oldValue == nil {
-		return v, errors.New("OldExpiry requires an ID field in the mutation")
-	}
-	oldValue, err := m.oldValue(ctx)
-	if err != nil {
-		return v, fmt.Errorf("querying old value for OldExpiry: %w", err)
-	}
-	return oldValue.Expiry, nil
-}
-
-// ResetExpiry resets all changes to the "expiry" field.
-func (m *DeviceRequestMutation) ResetExpiry() {
-	m.expiry = nil
-}
-
-// Where appends a list predicates to the DeviceRequestMutation builder.
-func (m *DeviceRequestMutation) Where(ps ...predicate.DeviceRequest) {
-	m.predicates = append(m.predicates, ps...)
+	m.Where(p...)
 }
 
 // Op returns the operation name.
-func (m *DeviceRequestMutation) Op() Op {
+func (m *ConnectorMutation) Op() Op {
 	return m.op
 }
 
-// Type returns the node type of this mutation (DeviceRequest).
-func (m *DeviceRequestMutation) Type() string {
+// SetOp allows setting the mutation operation.
+func (m *ConnectorMutation) SetOp(op Op) {
+	m.op = op
+}
+
+// Type returns the node type of this mutation (Connector).
+func (m *ConnectorMutation) Type() string {
 	return m.typ
 }
 
 // Fields returns all fields that were changed during this mutation. Note that in
 // order to get all numeric fields that were incremented/decremented, call
 // AddedFields().
-func (m *DeviceRequestMutation) Fields() []string {
-	fields := make([]string, 0, 6)
-	if m.user_code != nil {
-		fields = append(fields, devicerequest.FieldUserCode)
-	}
-	if m.device_code != nil {
-		fields = append(fields, devicerequest.FieldDeviceCode)
+func (m *ConnectorMutation) Fields() []string {
+	fields := make([]string, 0, 5)
+	if m._type != nil {
+		fields = append(fields, connector.FieldType)
 	}
-	if m.client_id != nil {
-		fields = append(fields, devicerequest.FieldClientID)
+	if m.name != nil {
+		fields = append(fields, connector.FieldName)
 	}
-	if m.client_secret != nil {
-		fields = append(fields, devicerequest.FieldClientSecret)
+	if m.resource_version != nil {
+		fields = append(fields, connector.FieldResourceVersion)
 	}
-	if m.scopes != nil {
-		fields = append(fields, devicerequest.FieldScopes)
+	if m._config != nil {
+		fields = append(fields, connector.FieldConfig)
 	}
-	if m.expiry != nil {
-		fields = append(fields, devicerequest.FieldExpiry)
+	if m.grant_types != nil {
+		fields = append(fields, connector.FieldGrantTypes)
 	}
 	return fields
 }
@@ -3416,20 +4492,18 @@ func (m *DeviceRequestMutation) Fields() []string {
 // Field returns the value of a field with the given name. The second boolean
 // return value indicates that this field was not set, or was not defined in the
 // schema.
-func (m *DeviceRequestMutation) Field(name string) (ent.Value, bool) {
+func (m *ConnectorMutation) Field(name string) (ent.Value, bool) {
 	switch name {
-	case devicerequest.FieldUserCode:
-		return m.UserCode()
-	case devicerequest.FieldDeviceCode:
-		return m.DeviceCode()
-	case devicerequest.FieldClientID:
-		return m.ClientID()
-	case devicerequest.FieldClientSecret:
-		return m.ClientSecret()
-	case devicerequest.FieldScopes:
-		return m.Scopes()
-	case devicerequest.FieldExpiry:
-		return m.Expiry()
+	case connector.FieldType:
+		return m.GetType()
+	case connector.FieldName:
+		return m.Name()
+	case connector.FieldResourceVersion:
+		return m.ResourceVersion()
+	case connector.FieldConfig:
+		return m.Config()
+	case connector.FieldGrantTypes:
+		return m.GrantTypes()
 	}
 	return nil, false
 }
@@ -3437,231 +4511,217 @@ func (m *DeviceRequestMutation) Field(name string) (ent.Value, bool) {
 // OldField returns the old value of the field from the database. An error is
 // returned if the mutation operation is not UpdateOne, or the query to the
 // database failed.
-func (m *DeviceRequestMutation) OldField(ctx context.Context, name string) (ent.Value, error) {
+func (m *ConnectorMutation) OldField(ctx context.Context, name string) (ent.Value, error) {
 	switch name {
-	case devicerequest.FieldUserCode:
-		return m.OldUserCode(ctx)
-	case devicerequest.FieldDeviceCode:
-		return m.OldDeviceCode(ctx)
-	case devicerequest.FieldClientID:
-		return m.OldClientID(ctx)
-	case devicerequest.FieldClientSecret:
-		return m.OldClientSecret(ctx)
-	case devicerequest.FieldScopes:
-		return m.OldScopes(ctx)
-	case devicerequest.FieldExpiry:
-		return m.OldExpiry(ctx)
+	case connector.FieldType:
+		return m.OldType(ctx)
+	case connector.FieldName:
+		return m.OldName(ctx)
+	case connector.FieldResourceVersion:
+		return m.OldResourceVersion(ctx)
+	case connector.FieldConfig:
+		return m.OldConfig(ctx)
+	case connector.FieldGrantTypes:
+		return m.OldGrantTypes(ctx)
 	}
-	return nil, fmt.Errorf("unknown DeviceRequest field %s", name)
+	return nil, fmt.Errorf("unknown Connector field %s", name)
 }
 
 // SetField sets the value of a field with the given name. It returns an error if
 // the field is not defined in the schema, or if the type mismatched the field
 // type.
-func (m *DeviceRequestMutation) SetField(name string, value ent.Value) error {
+func (m *ConnectorMutation) SetField(name string, value ent.Value) error {
 	switch name {
-	case devicerequest.FieldUserCode:
+	case connector.FieldType:
 		v, ok := value.(string)
 		if !ok {
 			return fmt.Errorf("unexpected type %T for field %s", value, name)
 		}
-		m.SetUserCode(v)
+		m.SetType(v)
 		return nil
-	case devicerequest.FieldDeviceCode:
+	case connector.FieldName:
 		v, ok := value.(string)
 		if !ok {
 			return fmt.Errorf("unexpected type %T for field %s", value, name)
 		}
-		m.SetDeviceCode(v)
+		m.SetName(v)
 		return nil
-	case devicerequest.FieldClientID:
+	case connector.FieldResourceVersion:
 		v, ok := value.(string)
 		if !ok {
 			return fmt.Errorf("unexpected type %T for field %s", value, name)
 		}
-		m.SetClientID(v)
+		m.SetResourceVersion(v)
 		return nil
-	case devicerequest.FieldClientSecret:
-		v, ok := value.(string)
+	case connector.FieldConfig:
+		v, ok := value.([]byte)
 		if !ok {
 			return fmt.Errorf("unexpected type %T for field %s", value, name)
 		}
-		m.SetClientSecret(v)
+		m.SetConfig(v)
 		return nil
-	case devicerequest.FieldScopes:
+	case connector.FieldGrantTypes:
 		v, ok := value.([]string)
 		if !ok {
 			return fmt.Errorf("unexpected type %T for field %s", value, name)
 		}
-		m.SetScopes(v)
-		return nil
-	case devicerequest.FieldExpiry:
-		v, ok := value.(time.Time)
-		if !ok {
-			return fmt.Errorf("unexpected type %T for field %s", value, name)
-		}
-		m.SetExpiry(v)
+		m.SetGrantTypes(v)
 		return nil
 	}
-	return fmt.Errorf("unknown DeviceRequest field %s", name)
+	return fmt.Errorf("unknown Connector field %s", name)
 }
 
 // AddedFields returns all numeric fields that were incremented/decremented during
 // this mutation.
-func (m *DeviceRequestMutation) AddedFields() []string {
+func (m *ConnectorMutation) AddedFields() []string {
 	return nil
 }
 
 // AddedField returns the numeric value that was incremented/decremented on a field
 // with the given name. The second boolean return value indicates that this field
 // was not set, or was not defined in the schema.
-func (m *DeviceRequestMutation) AddedField(name string) (ent.Value, bool) {
+func (m *ConnectorMutation) AddedField(name string) (ent.Value, bool) {
 	return nil, false
 }
 
 // AddField adds the value to the field with the given name. It returns an error if
 // the field is not defined in the schema, or if the type mismatched the field
 // type.
-func (m *DeviceRequestMutation) AddField(name string, value ent.Value) error {
+func (m *ConnectorMutation) AddField(name string, value ent.Value) error {
 	switch name {
 	}
-	return fmt.Errorf("unknown DeviceRequest numeric field %s", name)
+	return fmt.Errorf("unknown Connector numeric field %s", name)
 }
 
 // ClearedFields returns all nullable fields that were cleared during this
 // mutation.
-func (m *DeviceRequestMutation) ClearedFields() []string {
+func (m *ConnectorMutation) ClearedFields() []string {
 	var fields []string
-	if m.FieldCleared(devicerequest.FieldScopes) {
-		fields = append(fields, devicerequest.FieldScopes)
+	if m.FieldCleared(connector.FieldGrantTypes) {
+		fields = append(fields, connector.FieldGrantTypes)
 	}
 	return fields
 }
 
 // FieldCleared returns a boolean indicating if a field with the given name was
 // cleared in this mutation.
-func (m *DeviceRequestMutation) FieldCleared(name string) bool {
+func (m *ConnectorMutation) FieldCleared(name string) bool {
 	_, ok := m.clearedFields[name]
 	return ok
 }
 
 // ClearField clears the value of the field with the given name. It returns an
 // error if the field is not defined in the schema.
-func (m *DeviceRequestMutation) ClearField(name string) error {
+func (m *ConnectorMutation) ClearField(name string) error {
 	switch name {
-	case devicerequest.FieldScopes:
-		m.ClearScopes()
+	case connector.FieldGrantTypes:
+		m.ClearGrantTypes()
 		return nil
 	}
-	return fmt.Errorf("unknown DeviceRequest nullable field %s", name)
+	return fmt.Errorf("unknown Connector nullable field %s", name)
 }
 
 // ResetField resets all changes in the mutation for the field with the given name.
 // It returns an error if the field is not defined in the schema.
-func (m *DeviceRequestMutation) ResetField(name string) error {
+func (m *ConnectorMutation) ResetField(name string) error {
 	switch name {
-	case devicerequest.FieldUserCode:
-		m.ResetUserCode()
-		return nil
-	case devicerequest.FieldDeviceCode:
-		m.ResetDeviceCode()
+	case connector.FieldType:
+		m.ResetType()
 		return nil
-	case devicerequest.FieldClientID:
-		m.ResetClientID()
+	case connector.FieldName:
+		m.ResetName()
 		return nil
-	case devicerequest.FieldClientSecret:
-		m.ResetClientSecret()
+	case connector.FieldResourceVersion:
+		m.ResetResourceVersion()
 		return nil
-	case devicerequest.FieldScopes:
-		m.ResetScopes()
+	case connector.FieldConfig:
+		m.ResetConfig()
 		return nil
-	case devicerequest.FieldExpiry:
-		m.ResetExpiry()
+	case connector.FieldGrantTypes:
+		m.ResetGrantTypes()
 		return nil
 	}
-	return fmt.Errorf("unknown DeviceRequest field %s", name)
+	return fmt.Errorf("unknown Connector field %s", name)
 }
 
 // AddedEdges returns all edge names that were set/added in this mutation.
-func (m *DeviceRequestMutation) AddedEdges() []string {
+func (m *ConnectorMutation) AddedEdges() []string {
 	edges := make([]string, 0, 0)
 	return edges
 }
 
 // AddedIDs returns all IDs (to other nodes) that were added for the given edge
 // name in this mutation.
-func (m *DeviceRequestMutation) AddedIDs(name string) []ent.Value {
+func (m *ConnectorMutation) AddedIDs(name string) []ent.Value {
 	return nil
 }
 
 // RemovedEdges returns all edge names that were removed in this mutation.
-func (m *DeviceRequestMutation) RemovedEdges() []string {
+func (m *ConnectorMutation) RemovedEdges() []string {
 	edges := make([]string, 0, 0)
 	return edges
 }
 
 // RemovedIDs returns all IDs (to other nodes) that were removed for the edge with
 // the given name in this mutation.
-func (m *DeviceRequestMutation) RemovedIDs(name string) []ent.Value {
+func (m *ConnectorMutation) RemovedIDs(name string) []ent.Value {
 	return nil
 }
 
 // ClearedEdges returns all edge names that were cleared in this mutation.
-func (m *DeviceRequestMutation) ClearedEdges() []string {
+func (m *ConnectorMutation) ClearedEdges() []string {
 	edges := make([]string, 0, 0)
 	return edges
 }
 
 // EdgeCleared returns a boolean which indicates if the edge with the given name
 // was cleared in this mutation.
-func (m *DeviceRequestMutation) EdgeCleared(name string) bool {
+func (m *ConnectorMutation) EdgeCleared(name string) bool {
 	return false
 }
 
 // ClearEdge clears the value of the edge with the given name. It returns an error
 // if that edge is not defined in the schema.
-func (m *DeviceRequestMutation) ClearEdge(name string) error {
-	return fmt.Errorf("unknown DeviceRequest unique edge %s", name)
+func (m *ConnectorMutation) ClearEdge(name string) error {
+	return fmt.Errorf("unknown Connector unique edge %s", name)
 }
 
 // ResetEdge resets all changes to the edge with the given name in this mutation.
 // It returns an error if the edge is not defined in the schema.
-func (m *DeviceRequestMutation) ResetEdge(name string) error {
-	return fmt.Errorf("unknown DeviceRequest edge %s", name)
+func (m *ConnectorMutation) ResetEdge(name string) error {
+	return fmt.Errorf("unknown Connector edge %s", name)
 }
 
-// DeviceTokenMutation represents an operation that mutates the DeviceToken nodes in the graph.
-type DeviceTokenMutation struct {
+// DeviceRequestMutation represents an operation that mutates the DeviceRequest nodes in the graph.
+type DeviceRequestMutation struct {
 	config
-	op                    Op
-	typ                   string
-	id                    *int
-	device_code           *string
-	status                *string
-	token                 *[]byte
-	expiry                *time.Time
-	last_request          *time.Time
-	poll_interval         *int
-	addpoll_interval      *int
-	code_challenge        *string
-	code_challenge_method *string
-	clearedFields         map[string]struct{}
-	done                  bool
-	oldValue              func(context.Context) (*DeviceToken, error)
-	predicates            []predicate.DeviceToken
+	op            Op
+	typ           string
+	id            *int
+	user_code     *string
+	device_code   *string
+	client_id     *string
+	client_secret *string
+	scopes        *[]string
+	appendscopes  []string
+	expiry        *time.Time
+	clearedFields map[string]struct{}
+	done          bool
+	oldValue      func(context.Context) (*DeviceRequest, error)
+	predicates    []predicate.DeviceRequest
 }
 
-var _ ent.Mutation = (*DeviceTokenMutation)(nil)
+var _ ent.Mutation = (*DeviceRequestMutation)(nil)
 
-// devicetokenOption allows management of the mutation configuration using functional options.
-type devicetokenOption func(*DeviceTokenMutation)
+// devicerequestOption allows management of the mutation configuration using functional options.
+type devicerequestOption func(*DeviceRequestMutation)
 
-// newDeviceTokenMutation creates new mutation for the DeviceToken entity.
-func newDeviceTokenMutation(c config, op Op, opts ...devicetokenOption) *DeviceTokenMutation {
-	m := &DeviceTokenMutation{
+// newDeviceRequestMutation creates new mutation for the DeviceRequest entity.
+func newDeviceRequestMutation(c config, op Op, opts ...devicerequestOption) *DeviceRequestMutation {
+	m := &DeviceRequestMutation{
 		config:        c,
 		op:            op,
-		typ:           TypeDeviceToken,
+		typ:           TypeDeviceRequest,
 		clearedFields: make(map[string]struct{}),
 	}
 	for _, opt := range opts {
@@ -3670,20 +4730,20 @@ func newDeviceTokenMutation(c config, op Op, opts ...devicetokenOption) *DeviceT
 	return m
 }
 
-// withDeviceTokenID sets the ID field of the mutation.
-func withDeviceTokenID(id int) devicetokenOption {
-	return func(m *DeviceTokenMutation) {
+// withDeviceRequestID sets the ID field of the mutation.
+func withDeviceRequestID(id int) devicerequestOption {
+	return func(m *DeviceRequestMutation) {
 		var (
 			err   error
 			once  sync.Once
-			value *DeviceToken
+			value *DeviceRequest
 		)
-		m.oldValue = func(ctx context.Context) (*DeviceToken, error) {
+		m.oldValue = func(ctx context.Context) (*DeviceRequest, error) {
 			once.Do(func() {
 				if m.done {
 					err = errors.New("querying old values post mutation is not allowed")
 				} else {
-					value, err = m.Client().DeviceToken.Get(ctx, id)
+					value, err = m.Client().DeviceRequest.Get(ctx, id)
 				}
 			})
 			return value, err
@@ -3692,10 +4752,10 @@ func withDeviceTokenID(id int) devicetokenOption {
 	}
 }
 
-// withDeviceToken sets the old DeviceToken of the mutation.
-func withDeviceToken(node *DeviceToken) devicetokenOption {
-	return func(m *DeviceTokenMutation) {
-		m.oldValue = func(context.Context) (*DeviceToken, error) {
+// withDeviceRequest sets the old DeviceRequest of the mutation.
+func withDeviceRequest(node *DeviceRequest) devicerequestOption {
+	return func(m *DeviceRequestMutation) {
+		m.oldValue = func(context.Context) (*DeviceRequest, error) {
 			return node, nil
 		}
 		m.id = &node.ID
@@ -3704,7 +4764,7 @@ func withDeviceToken(node *DeviceToken) devicetokenOption {
 
 // Client returns a new `ent.Client` from the mutation. If the mutation was
 // executed in a transaction (ent.Tx), a transactional client is returned.
-func (m DeviceTokenMutation) Client() *Client {
+func (m DeviceRequestMutation) Client() *Client {
 	client := &Client{config: m.config}
 	client.init()
 	return client
@@ -3712,7 +4772,7 @@ func (m DeviceTokenMutation) Client() *Client {
 
 // Tx returns an `ent.Tx` for mutations that were executed in transactions;
 // it returns an error otherwise.
-func (m DeviceTokenMutation) Tx() (*Tx, error) {
+func (m DeviceRequestMutation) Tx() (*Tx, error) {
 	if _, ok := m.driver.(*txDriver); !ok {
 		return nil, errors.New("db: mutation is not running in a transaction")
 	}
@@ -3723,7 +4783,7 @@ func (m DeviceTokenMutation) Tx() (*Tx, error) {
 
 // ID returns the ID value in the mutation. Note that the ID is only available
 // if it was provided to the builder or after it was returned from the database.
-func (m *DeviceTokenMutation) ID() (id int, exists bool) {
+func (m *DeviceRequestMutation) ID() (id int, exists bool) {
 	if m.id == nil {
 		return
 	}
@@ -3734,7 +4794,7 @@ func (m *DeviceTokenMutation) ID() (id int, exists bool) {
 // That means, if the mutation is applied within a transaction with an isolation level such
 // as sql.LevelSerializable, the returned ids match the ids of the rows that will be updated
 // or updated by the mutation.
-func (m *DeviceTokenMutation) IDs(ctx context.Context) ([]int, error) {
+func (m *DeviceRequestMutation) IDs(ctx context.Context) ([]int, error) {
 	switch {
 	case m.op.Is(OpUpdateOne | OpDeleteOne):
 		id, exists := m.ID()
@@ -3743,376 +4803,309 @@ func (m *DeviceTokenMutation) IDs(ctx context.Context) ([]int, error) {
 		}
 		fallthrough
 	case m.op.Is(OpUpdate | OpDelete):
-		return m.Client().DeviceToken.Query().Where(m.predicates...).IDs(ctx)
+		return m.Client().DeviceRequest.Query().Where(m.predicates...).IDs(ctx)
 	default:
 		return nil, fmt.Errorf("IDs is not allowed on %s operations", m.op)
 	}
 }
 
-// SetDeviceCode sets the "device_code" field.
-func (m *DeviceTokenMutation) SetDeviceCode(s string) {
-	m.device_code = &s
+// SetUserCode sets the "user_code" field.
+func (m *DeviceRequestMutation) SetUserCode(s string) {
+	m.user_code = &s
 }
 
-// DeviceCode returns the value of the "device_code" field in the mutation.
-func (m *DeviceTokenMutation) DeviceCode() (r string, exists bool) {
-	v := m.device_code
+// UserCode returns the value of the "user_code" field in the mutation.
+func (m *DeviceRequestMutation) UserCode() (r string, exists bool) {
+	v := m.user_code
 	if v == nil {
 		return
 	}
 	return *v, true
 }
 
-// OldDeviceCode returns the old "device_code" field's value of the DeviceToken entity.
-// If the DeviceToken object wasn't provided to the builder, the object is fetched from the database.
+// OldUserCode returns the old "user_code" field's value of the DeviceRequest entity.
+// If the DeviceRequest object wasn't provided to the builder, the object is fetched from the database.
 // An error is returned if the mutation operation is not UpdateOne, or the database query fails.
-func (m *DeviceTokenMutation) OldDeviceCode(ctx context.Context) (v string, err error) {
+func (m *DeviceRequestMutation) OldUserCode(ctx context.Context) (v string, err error) {
 	if !m.op.Is(OpUpdateOne) {
-		return v, errors.New("OldDeviceCode is only allowed on UpdateOne operations")
+		return v, errors.New("OldUserCode is only allowed on UpdateOne operations")
 	}
 	if m.id == nil || m.oldValue == nil {
-		return v, errors.New("OldDeviceCode requires an ID field in the mutation")
+		return v, errors.New("OldUserCode requires an ID field in the mutation")
 	}
 	oldValue, err := m.oldValue(ctx)
 	if err != nil {
-		return v, fmt.Errorf("querying old value for OldDeviceCode: %w", err)
+		return v, fmt.Errorf("querying old value for OldUserCode: %w", err)
 	}
-	return oldValue.DeviceCode, nil
+	return oldValue.UserCode, nil
 }
 
-// ResetDeviceCode resets all changes to the "device_code" field.
-func (m *DeviceTokenMutation) ResetDeviceCode() {
-	m.device_code = nil
+// ResetUserCode resets all changes to the "user_code" field.
+func (m *DeviceRequestMutation) ResetUserCode() {
+	m.user_code = nil
 }
 
-// SetStatus sets the "status" field.
-func (m *DeviceTokenMutation) SetStatus(s string) {
-	m.status = &s
+// SetDeviceCode sets the "device_code" field.
+func (m *DeviceRequestMutation) SetDeviceCode(s string) {
+	m.device_code = &s
 }
 
-// Status returns the value of the "status" field in the mutation.
-func (m *DeviceTokenMutation) Status() (r string, exists bool) {
-	v := m.status
+// DeviceCode returns the value of the "device_code" field in the mutation.
+func (m *DeviceRequestMutation) DeviceCode() (r string, exists bool) {
+	v := m.device_code
 	if v == nil {
 		return
 	}
 	return *v, true
 }
 
-// OldStatus returns the old "status" field's value of the DeviceToken entity.
-// If the DeviceToken object wasn't provided to the builder, the object is fetched from the database.
+// OldDeviceCode returns the old "device_code" field's value of the DeviceRequest entity.
+// If the DeviceRequest object wasn't provided to the builder, the object is fetched from the database.
 // An error is returned if the mutation operation is not UpdateOne, or the database query fails.
-func (m *DeviceTokenMutation) OldStatus(ctx context.Context) (v string, err error) {
+func (m *DeviceRequestMutation) OldDeviceCode(ctx context.Context) (v string, err error) {
 	if !m.op.Is(OpUpdateOne) {
-		return v, errors.New("OldStatus is only allowed on UpdateOne operations")
+		return v, errors.New("OldDeviceCode is only allowed on UpdateOne operations")
 	}
 	if m.id == nil || m.oldValue == nil {
-		return v, errors.New("OldStatus requires an ID field in the mutation")
+		return v, errors.New("OldDeviceCode requires an ID field in the mutation")
 	}
 	oldValue, err := m.oldValue(ctx)
 	if err != nil {
-		return v, fmt.Errorf("querying old value for OldStatus: %w", err)
+		return v, fmt.Errorf("querying old value for OldDeviceCode: %w", err)
 	}
-	return oldValue.Status, nil
+	return oldValue.DeviceCode, nil
 }
 
-// ResetStatus resets all changes to the "status" field.
-func (m *DeviceTokenMutation) ResetStatus() {
-	m.status = nil
+// ResetDeviceCode resets all changes to the "device_code" field.
+func (m *DeviceRequestMutation) ResetDeviceCode() {
+	m.device_code = nil
 }
 
-// SetToken sets the "token" field.
-func (m *DeviceTokenMutation) SetToken(b []byte) {
-	m.token = &b
+// SetClientID sets the "client_id" field.
+func (m *DeviceRequestMutation) SetClientID(s string) {
+	m.client_id = &s
 }
 
-// Token returns the value of the "token" field in the mutation.
-func (m *DeviceTokenMutation) Token() (r []byte, exists bool) {
-	v := m.token
+// ClientID returns the value of the "client_id" field in the mutation.
+func (m *DeviceRequestMutation) ClientID() (r string, exists bool) {
+	v := m.client_id
 	if v == nil {
 		return
 	}
 	return *v, true
 }
 
-// OldToken returns the old "token" field's value of the DeviceToken entity.
-// If the DeviceToken object wasn't provided to the builder, the object is fetched from the database.
+// OldClientID returns the old "client_id" field's value of the DeviceRequest entity.
+// If the DeviceRequest object wasn't provided to the builder, the object is fetched from the database.
 // An error is returned if the mutation operation is not UpdateOne, or the database query fails.
-func (m *DeviceTokenMutation) OldToken(ctx context.Context) (v *[]byte, err error) {
+func (m *DeviceRequestMutation) OldClientID(ctx context.Context) (v string, err error) {
 	if !m.op.Is(OpUpdateOne) {
-		return v, errors.New("OldToken is only allowed on UpdateOne operations")
+		return v, errors.New("OldClientID is only allowed on UpdateOne operations")
 	}
 	if m.id == nil || m.oldValue == nil {
-		return v, errors.New("OldToken requires an ID field in the mutation")
+		return v, errors.New("OldClientID requires an ID field in the mutation")
 	}
 	oldValue, err := m.oldValue(ctx)
 	if err != nil {
-		return v, fmt.Errorf("querying old value for OldToken: %w", err)
+		return v, fmt.Errorf("querying old value for OldClientID: %w", err)
 	}
-	return oldValue.Token, nil
-}
-
-// ClearToken clears the value of the "token" field.
-func (m *DeviceTokenMutation) ClearToken() {
-	m.token = nil
-	m.clearedFields[devicetoken.FieldToken] = struct{}{}
-}
-
-// TokenCleared returns if the "token" field was cleared in this mutation.
-func (m *DeviceTokenMutation) TokenCleared() bool {
-	_, ok := m.clearedFields[devicetoken.FieldToken]
-	return ok
+	return oldValue.ClientID, nil
 }
 
-// ResetToken resets all changes to the "token" field.
-func (m *DeviceTokenMutation) ResetToken() {
-	m.token = nil
-	delete(m.clearedFields, devicetoken.FieldToken)
+// ResetClientID resets all changes to the "client_id" field.
+func (m *DeviceRequestMutation) ResetClientID() {
+	m.client_id = nil
 }
 
-// SetExpiry sets the "expiry" field.
-func (m *DeviceTokenMutation) SetExpiry(t time.Time) {
-	m.expiry = &t
+// SetClientSecret sets the "client_secret" field.
+func (m *DeviceRequestMutation) SetClientSecret(s string) {
+	m.client_secret = &s
 }
 
-// Expiry returns the value of the "expiry" field in the mutation.
-func (m *DeviceTokenMutation) Expiry() (r time.Time, exists bool) {
-	v := m.expiry
+// ClientSecret returns the value of the "client_secret" field in the mutation.
+func (m *DeviceRequestMutation) ClientSecret() (r string, exists bool) {
+	v := m.client_secret
 	if v == nil {
 		return
 	}
 	return *v, true
 }
 
-// OldExpiry returns the old "expiry" field's value of the DeviceToken entity.
-// If the DeviceToken object wasn't provided to the builder, the object is fetched from the database.
+// OldClientSecret returns the old "client_secret" field's value of the DeviceRequest entity.
+// If the DeviceRequest object wasn't provided to the builder, the object is fetched from the database.
 // An error is returned if the mutation operation is not UpdateOne, or the database query fails.
-func (m *DeviceTokenMutation) OldExpiry(ctx context.Context) (v time.Time, err error) {
+func (m *DeviceRequestMutation) OldClientSecret(ctx context.Context) (v string, err error) {
 	if !m.op.Is(OpUpdateOne) {
-		return v, errors.New("OldExpiry is only allowed on UpdateOne operations")
+		return v, errors.New("OldClientSecret is only allowed on UpdateOne operations")
 	}
 	if m.id == nil || m.oldValue == nil {
-		return v, errors.New("OldExpiry requires an ID field in the mutation")
+		return v, errors.New("OldClientSecret requires an ID field in the mutation")
 	}
 	oldValue, err := m.oldValue(ctx)
 	if err != nil {
-		return v, fmt.Errorf("querying old value for OldExpiry: %w", err)
+		return v, fmt.Errorf("querying old value for OldClientSecret: %w", err)
 	}
-	return oldValue.Expiry, nil
+	return oldValue.ClientSecret, nil
 }
 
-// ResetExpiry resets all changes to the "expiry" field.
-func (m *DeviceTokenMutation) ResetExpiry() {
-	m.expiry = nil
+// ResetClientSecret resets all changes to the "client_secret" field.
+func (m *DeviceRequestMutation) ResetClientSecret() {
+	m.client_secret = nil
 }
 
-// SetLastRequest sets the "last_request" field.
-func (m *DeviceTokenMutation) SetLastRequest(t time.Time) {
-	m.last_request = &t
+// SetScopes sets the "scopes" field.
+func (m *DeviceRequestMutation) SetScopes(s []string) {
+	m.scopes = &s
+	m.appendscopes = nil
 }
 
-// LastRequest returns the value of the "last_request" field in the mutation.
-func (m *DeviceTokenMutation) LastRequest() (r time.Time, exists bool) {
-	v := m.last_request
+// Scopes returns the value of the "scopes" field in the mutation.
+func (m *DeviceRequestMutation) Scopes() (r []string, exists bool) {
+	v := m.scopes
 	if v == nil {
 		return
 	}
 	return *v, true
 }
 
-// OldLastRequest returns the old "last_request" field's value of the DeviceToken entity.
-// If the DeviceToken object wasn't provided to the builder, the object is fetched from the database.
+// OldScopes returns the old "scopes" field's value of the DeviceRequest entity.
+// If the DeviceRequest object wasn't provided to the builder, the object is fetched from the database.
 // An error is returned if the mutation operation is not UpdateOne, or the database query fails.
-func (m *DeviceTokenMutation) OldLastRequest(ctx context.Context) (v time.Time, err error) {
+func (m *DeviceRequestMutation) OldScopes(ctx context.Context) (v []string, err error) {
 	if !m.op.Is(OpUpdateOne) {
-		return v, errors.New("OldLastRequest is only allowed on UpdateOne operations")
+		return v, errors.New("OldScopes is only allowed on UpdateOne operations")
 	}
 	if m.id == nil || m.oldValue == nil {
-		return v, errors.New("OldLastRequest requires an ID field in the mutation")
+		return v, errors.New("OldScopes requires an ID field in the mutation")
 	}
 	oldValue, err := m.oldValue(ctx)
 	if err != nil {
-		return v, fmt.Errorf("querying old value for OldLastRequest: %w", err)
+		return v, fmt.Errorf("querying old value for OldScopes: %w", err)
 	}
-	return oldValue.LastRequest, nil
+	return oldValue.Scopes, nil
 }
 
-// ResetLastRequest resets all changes to the "last_request" field.
-func (m *DeviceTokenMutation) ResetLastRequest() {
-	m.last_request = nil
+// AppendScopes adds s to the "scopes" field.
+func (m *DeviceRequestMutation) AppendScopes(s []string) {
+	m.appendscopes = append(m.appendscopes, s...)
 }
 
-// SetPollInterval sets the "poll_interval" field.
-func (m *DeviceTokenMutation) SetPollInterval(i int) {
-	m.poll_interval = &i
-	m.addpoll_interval = nil
+// AppendedScopes returns the list of values that were appended to the "scopes" field in this mutation.
+func (m *DeviceRequestMutation) AppendedScopes() ([]string, bool) {
+	if len(m.appendscopes) == 0 {
+		return nil, false
+	}
+	return m.appendscopes, true
 }
 
-// PollInterval returns the value of the "poll_interval" field in the mutation.
-func (m *DeviceTokenMutation) PollInterval() (r int, exists bool) {
-	v := m.poll_interval
+// ClearScopes clears the value of the "scopes" field.
+func (m *DeviceRequestMutation) ClearScopes() {
+	m.scopes = nil
+	m.appendscopes = nil
+	m.clearedFields[devicerequest.FieldScopes] = struct{}{}
+}
+
+// ScopesCleared returns if the "scopes" field was cleared in this mutation.
+func (m *DeviceRequestMutation) ScopesCleared() bool {
+	_, ok := m.clearedFields[devicerequest.FieldScopes]
+	return ok
+}
+
+// ResetScopes resets all changes to the "scopes" field.
+func (m *DeviceRequestMutation) ResetScopes() {
+	m.scopes = nil
+	m.appendscopes = nil
+	delete(m.clearedFields, devicerequest.FieldScopes)
+}
+
+// SetExpiry sets the "expiry" field.
+func (m *DeviceRequestMutation) SetExpiry(t time.Time) {
+	m.expiry = &t
+}
+
+// Expiry returns the value of the "expiry" field in the mutation.
+func (m *DeviceRequestMutation) Expiry() (r time.Time, exists bool) {
+	v := m.expiry
 	if v == nil {
 		return
 	}
 	return *v, true
 }
 
-// OldPollInterval returns the old "poll_interval" field's value of the DeviceToken entity.
-// If the DeviceToken object wasn't provided to the builder, the object is fetched from the database.
+// OldExpiry returns the old "expiry" field's value of the DeviceRequest entity.
+// If the DeviceRequest object wasn't provided to the builder, the object is fetched from the database.
 // An error is returned if the mutation operation is not UpdateOne, or the database query fails.
-func (m *DeviceTokenMutation) OldPollInterval(ctx context.Context) (v int, err error) {
+func (m *DeviceRequestMutation) OldExpiry(ctx context.Context) (v time.Time, err error) {
 	if !m.op.Is(OpUpdateOne) {
-		return v, errors.New("OldPollInterval is only allowed on UpdateOne operations")
+		return v, errors.New("OldExpiry is only allowed on UpdateOne operations")
 	}
 	if m.id == nil || m.oldValue == nil {
-		return v, errors.New("OldPollInterval requires an ID field in the mutation")
+		return v, errors.New("OldExpiry requires an ID field in the mutation")
 	}
 	oldValue, err := m.oldValue(ctx)
 	if err != nil {
-		return v, fmt.Errorf("querying old value for OldPollInterval: %w", err)
+		return v, fmt.Errorf("querying old value for OldExpiry: %w", err)
 	}
-	return oldValue.PollInterval, nil
+	return oldValue.Expiry, nil
 }
 
-// AddPollInterval adds i to the "poll_interval" field.
-func (m *DeviceTokenMutation) AddPollInterval(i int) {
-	if m.addpoll_interval != nil {
-		*m.addpoll_interval += i
-	} else {
-		m.addpoll_interval = &i
-	}
+// ResetExpiry resets all changes to the "expiry" field.
+func (m *DeviceRequestMutation) ResetExpiry() {
+	m.expiry = nil
 }
 
-// AddedPollInterval returns the value that was added to the "poll_interval" field in this mutation.
-func (m *DeviceTokenMutation) AddedPollInterval() (r int, exists bool) {
-	v := m.addpoll_interval
-	if v == nil {
-		return
+// Where appends a list predicates to the DeviceRequestMutation builder.
+func (m *DeviceRequestMutation) Where(ps ...predicate.DeviceRequest) {
+	m.predicates = append(m.predicates, ps...)
+}
+
+// WhereP appends storage-level predicates to the DeviceRequestMutation builder. Using this method,
+// users can use type-assertion to append predicates that do not depend on any generated package.
+func (m *DeviceRequestMutation) WhereP(ps ...func(*sql.Selector)) {
+	p := make([]predicate.DeviceRequest, len(ps))
+	for i := range ps {
+		p[i] = ps[i]
 	}
-	return *v, true
-}
-
-// ResetPollInterval resets all changes to the "poll_interval" field.
-func (m *DeviceTokenMutation) ResetPollInterval() {
-	m.poll_interval = nil
-	m.addpoll_interval = nil
-}
-
-// SetCodeChallenge sets the "code_challenge" field.
-func (m *DeviceTokenMutation) SetCodeChallenge(s string) {
-	m.code_challenge = &s
-}
-
-// CodeChallenge returns the value of the "code_challenge" field in the mutation.
-func (m *DeviceTokenMutation) CodeChallenge() (r string, exists bool) {
-	v := m.code_challenge
-	if v == nil {
-		return
-	}
-	return *v, true
-}
-
-// OldCodeChallenge returns the old "code_challenge" field's value of the DeviceToken entity.
-// If the DeviceToken object wasn't provided to the builder, the object is fetched from the database.
-// An error is returned if the mutation operation is not UpdateOne, or the database query fails.
-func (m *DeviceTokenMutation) OldCodeChallenge(ctx context.Context) (v string, err error) {
-	if !m.op.Is(OpUpdateOne) {
-		return v, errors.New("OldCodeChallenge is only allowed on UpdateOne operations")
-	}
-	if m.id == nil || m.oldValue == nil {
-		return v, errors.New("OldCodeChallenge requires an ID field in the mutation")
-	}
-	oldValue, err := m.oldValue(ctx)
-	if err != nil {
-		return v, fmt.Errorf("querying old value for OldCodeChallenge: %w", err)
-	}
-	return oldValue.CodeChallenge, nil
-}
-
-// ResetCodeChallenge resets all changes to the "code_challenge" field.
-func (m *DeviceTokenMutation) ResetCodeChallenge() {
-	m.code_challenge = nil
-}
-
-// SetCodeChallengeMethod sets the "code_challenge_method" field.
-func (m *DeviceTokenMutation) SetCodeChallengeMethod(s string) {
-	m.code_challenge_method = &s
-}
-
-// CodeChallengeMethod returns the value of the "code_challenge_method" field in the mutation.
-func (m *DeviceTokenMutation) CodeChallengeMethod() (r string, exists bool) {
-	v := m.code_challenge_method
-	if v == nil {
-		return
-	}
-	return *v, true
-}
-
-// OldCodeChallengeMethod returns the old "code_challenge_method" field's value of the DeviceToken entity.
-// If the DeviceToken object wasn't provided to the builder, the object is fetched from the database.
-// An error is returned if the mutation operation is not UpdateOne, or the database query fails.
-func (m *DeviceTokenMutation) OldCodeChallengeMethod(ctx context.Context) (v string, err error) {
-	if !m.op.Is(OpUpdateOne) {
-		return v, errors.New("OldCodeChallengeMethod is only allowed on UpdateOne operations")
-	}
-	if m.id == nil || m.oldValue == nil {
-		return v, errors.New("OldCodeChallengeMethod requires an ID field in the mutation")
-	}
-	oldValue, err := m.oldValue(ctx)
-	if err != nil {
-		return v, fmt.Errorf("querying old value for OldCodeChallengeMethod: %w", err)
-	}
-	return oldValue.CodeChallengeMethod, nil
-}
-
-// ResetCodeChallengeMethod resets all changes to the "code_challenge_method" field.
-func (m *DeviceTokenMutation) ResetCodeChallengeMethod() {
-	m.code_challenge_method = nil
-}
-
-// Where appends a list predicates to the DeviceTokenMutation builder.
-func (m *DeviceTokenMutation) Where(ps ...predicate.DeviceToken) {
-	m.predicates = append(m.predicates, ps...)
+	m.Where(p...)
 }
 
 // Op returns the operation name.
-func (m *DeviceTokenMutation) Op() Op {
+func (m *DeviceRequestMutation) Op() Op {
 	return m.op
 }
 
-// Type returns the node type of this mutation (DeviceToken).
-func (m *DeviceTokenMutation) Type() string {
+// SetOp allows setting the mutation operation.
+func (m *DeviceRequestMutation) SetOp(op Op) {
+	m.op = op
+}
+
+// Type returns the node type of this mutation (DeviceRequest).
+func (m *DeviceRequestMutation) Type() string {
 	return m.typ
 }
 
 // Fields returns all fields that were changed during this mutation. Note that in
 // order to get all numeric fields that were incremented/decremented, call
 // AddedFields().
-func (m *DeviceTokenMutation) Fields() []string {
-	fields := make([]string, 0, 8)
-	if m.device_code != nil {
-		fields = append(fields, devicetoken.FieldDeviceCode)
-	}
-	if m.status != nil {
-		fields = append(fields, devicetoken.FieldStatus)
-	}
-	if m.token != nil {
-		fields = append(fields, devicetoken.FieldToken)
+func (m *DeviceRequestMutation) Fields() []string {
+	fields := make([]string, 0, 6)
+	if m.user_code != nil {
+		fields = append(fields, devicerequest.FieldUserCode)
 	}
-	if m.expiry != nil {
-		fields = append(fields, devicetoken.FieldExpiry)
+	if m.device_code != nil {
+		fields = append(fields, devicerequest.FieldDeviceCode)
 	}
-	if m.last_request != nil {
-		fields = append(fields, devicetoken.FieldLastRequest)
+	if m.client_id != nil {
+		fields = append(fields, devicerequest.FieldClientID)
 	}
-	if m.poll_interval != nil {
-		fields = append(fields, devicetoken.FieldPollInterval)
+	if m.client_secret != nil {
+		fields = append(fields, devicerequest.FieldClientSecret)
 	}
-	if m.code_challenge != nil {
-		fields = append(fields, devicetoken.FieldCodeChallenge)
+	if m.scopes != nil {
+		fields = append(fields, devicerequest.FieldScopes)
 	}
-	if m.code_challenge_method != nil {
-		fields = append(fields, devicetoken.FieldCodeChallengeMethod)
+	if m.expiry != nil {
+		fields = append(fields, devicerequest.FieldExpiry)
 	}
 	return fields
 }
@@ -4120,24 +5113,20 @@ func (m *DeviceTokenMutation) Fields() []string {
 // Field returns the value of a field with the given name. The second boolean
 // return value indicates that this field was not set, or was not defined in the
 // schema.
-func (m *DeviceTokenMutation) Field(name string) (ent.Value, bool) {
+func (m *DeviceRequestMutation) Field(name string) (ent.Value, bool) {
 	switch name {
-	case devicetoken.FieldDeviceCode:
+	case devicerequest.FieldUserCode:
+		return m.UserCode()
+	case devicerequest.FieldDeviceCode:
 		return m.DeviceCode()
-	case devicetoken.FieldStatus:
-		return m.Status()
-	case devicetoken.FieldToken:
-		return m.Token()
-	case devicetoken.FieldExpiry:
+	case devicerequest.FieldClientID:
+		return m.ClientID()
+	case devicerequest.FieldClientSecret:
+		return m.ClientSecret()
+	case devicerequest.FieldScopes:
+		return m.Scopes()
+	case devicerequest.FieldExpiry:
 		return m.Expiry()
-	case devicetoken.FieldLastRequest:
-		return m.LastRequest()
-	case devicetoken.FieldPollInterval:
-		return m.PollInterval()
-	case devicetoken.FieldCodeChallenge:
-		return m.CodeChallenge()
-	case devicetoken.FieldCodeChallengeMethod:
-		return m.CodeChallengeMethod()
 	}
 	return nil, false
 }
@@ -4145,265 +5134,231 @@ func (m *DeviceTokenMutation) Field(name string) (ent.Value, bool) {
 // OldField returns the old value of the field from the database. An error is
 // returned if the mutation operation is not UpdateOne, or the query to the
 // database failed.
-func (m *DeviceTokenMutation) OldField(ctx context.Context, name string) (ent.Value, error) {
+func (m *DeviceRequestMutation) OldField(ctx context.Context, name string) (ent.Value, error) {
 	switch name {
-	case devicetoken.FieldDeviceCode:
+	case devicerequest.FieldUserCode:
+		return m.OldUserCode(ctx)
+	case devicerequest.FieldDeviceCode:
 		return m.OldDeviceCode(ctx)
-	case devicetoken.FieldStatus:
-		return m.OldStatus(ctx)
-	case devicetoken.FieldToken:
-		return m.OldToken(ctx)
-	case devicetoken.FieldExpiry:
+	case devicerequest.FieldClientID:
+		return m.OldClientID(ctx)
+	case devicerequest.FieldClientSecret:
+		return m.OldClientSecret(ctx)
+	case devicerequest.FieldScopes:
+		return m.OldScopes(ctx)
+	case devicerequest.FieldExpiry:
 		return m.OldExpiry(ctx)
-	case devicetoken.FieldLastRequest:
-		return m.OldLastRequest(ctx)
-	case devicetoken.FieldPollInterval:
-		return m.OldPollInterval(ctx)
-	case devicetoken.FieldCodeChallenge:
-		return m.OldCodeChallenge(ctx)
-	case devicetoken.FieldCodeChallengeMethod:
-		return m.OldCodeChallengeMethod(ctx)
 	}
-	return nil, fmt.Errorf("unknown DeviceToken field %s", name)
+	return nil, fmt.Errorf("unknown DeviceRequest field %s", name)
 }
 
 // SetField sets the value of a field with the given name. It returns an error if
 // the field is not defined in the schema, or if the type mismatched the field
 // type.
-func (m *DeviceTokenMutation) SetField(name string, value ent.Value) error {
+func (m *DeviceRequestMutation) SetField(name string, value ent.Value) error {
 	switch name {
-	case devicetoken.FieldDeviceCode:
+	case devicerequest.FieldUserCode:
 		v, ok := value.(string)
 		if !ok {
 			return fmt.Errorf("unexpected type %T for field %s", value, name)
 		}
-		m.SetDeviceCode(v)
+		m.SetUserCode(v)
 		return nil
-	case devicetoken.FieldStatus:
+	case devicerequest.FieldDeviceCode:
 		v, ok := value.(string)
 		if !ok {
 			return fmt.Errorf("unexpected type %T for field %s", value, name)
 		}
-		m.SetStatus(v)
-		return nil
-	case devicetoken.FieldToken:
-		v, ok := value.([]byte)
-		if !ok {
-			return fmt.Errorf("unexpected type %T for field %s", value, name)
-		}
-		m.SetToken(v)
-		return nil
-	case devicetoken.FieldExpiry:
-		v, ok := value.(time.Time)
-		if !ok {
-			return fmt.Errorf("unexpected type %T for field %s", value, name)
-		}
-		m.SetExpiry(v)
+		m.SetDeviceCode(v)
 		return nil
-	case devicetoken.FieldLastRequest:
-		v, ok := value.(time.Time)
+	case devicerequest.FieldClientID:
+		v, ok := value.(string)
 		if !ok {
 			return fmt.Errorf("unexpected type %T for field %s", value, name)
 		}
-		m.SetLastRequest(v)
+		m.SetClientID(v)
 		return nil
-	case devicetoken.FieldPollInterval:
-		v, ok := value.(int)
+	case devicerequest.FieldClientSecret:
+		v, ok := value.(string)
 		if !ok {
 			return fmt.Errorf("unexpected type %T for field %s", value, name)
 		}
-		m.SetPollInterval(v)
+		m.SetClientSecret(v)
 		return nil
-	case devicetoken.FieldCodeChallenge:
-		v, ok := value.(string)
+	case devicerequest.FieldScopes:
+		v, ok := value.([]string)
 		if !ok {
 			return fmt.Errorf("unexpected type %T for field %s", value, name)
 		}
-		m.SetCodeChallenge(v)
+		m.SetScopes(v)
 		return nil
-	case devicetoken.FieldCodeChallengeMethod:
-		v, ok := value.(string)
+	case devicerequest.FieldExpiry:
+		v, ok := value.(time.Time)
 		if !ok {
 			return fmt.Errorf("unexpected type %T for field %s", value, name)
 		}
-		m.SetCodeChallengeMethod(v)
+		m.SetExpiry(v)
 		return nil
 	}
-	return fmt.Errorf("unknown DeviceToken field %s", name)
+	return fmt.Errorf("unknown DeviceRequest field %s", name)
 }
 
 // AddedFields returns all numeric fields that were incremented/decremented during
 // this mutation.
-func (m *DeviceTokenMutation) AddedFields() []string {
-	var fields []string
-	if m.addpoll_interval != nil {
-		fields = append(fields, devicetoken.FieldPollInterval)
-	}
-	return fields
+func (m *DeviceRequestMutation) AddedFields() []string {
+	return nil
 }
 
 // AddedField returns the numeric value that was incremented/decremented on a field
 // with the given name. The second boolean return value indicates that this field
 // was not set, or was not defined in the schema.
-func (m *DeviceTokenMutation) AddedField(name string) (ent.Value, bool) {
-	switch name {
-	case devicetoken.FieldPollInterval:
-		return m.AddedPollInterval()
-	}
+func (m *DeviceRequestMutation) AddedField(name string) (ent.Value, bool) {
 	return nil, false
 }
 
 // AddField adds the value to the field with the given name. It returns an error if
 // the field is not defined in the schema, or if the type mismatched the field
 // type.
-func (m *DeviceTokenMutation) AddField(name string, value ent.Value) error {
+func (m *DeviceRequestMutation) AddField(name string, value ent.Value) error {
 	switch name {
-	case devicetoken.FieldPollInterval:
-		v, ok := value.(int)
-		if !ok {
-			return fmt.Errorf("unexpected type %T for field %s", value, name)
-		}
-		m.AddPollInterval(v)
-		return nil
 	}
-	return fmt.Errorf("unknown DeviceToken numeric field %s", name)
+	return fmt.Errorf("unknown DeviceRequest numeric field %s", name)
 }
 
 // ClearedFields returns all nullable fields that were cleared during this
 // mutation.
-func (m *DeviceTokenMutation) ClearedFields() []string {
+func (m *DeviceRequestMutation) ClearedFields() []string {
 	var fields []string
-	if m.FieldCleared(devicetoken.FieldToken) {
-		fields = append(fields, devicetoken.FieldToken)
+	if m.FieldCleared(devicerequest.FieldScopes) {
+		fields = append(fields, devicerequest.FieldScopes)
 	}
 	return fields
 }
 
 // FieldCleared returns a boolean indicating if a field with the given name was
 // cleared in this mutation.
-func (m *DeviceTokenMutation) FieldCleared(name string) bool {
+func (m *DeviceRequestMutation) FieldCleared(name string) bool {
 	_, ok := m.clearedFields[name]
 	return ok
 }
 
 // ClearField clears the value of the field with the given name. It returns an
 // error if the field is not defined in the schema.
-func (m *DeviceTokenMutation) ClearField(name string) error {
+func (m *DeviceRequestMutation) ClearField(name string) error {
 	switch name {
-	case devicetoken.FieldToken:
-		m.ClearToken()
+	case devicerequest.FieldScopes:
+		m.ClearScopes()
 		return nil
 	}
-	return fmt.Errorf("unknown DeviceToken nullable field %s", name)
+	return fmt.Errorf("unknown DeviceRequest nullable field %s", name)
 }
 
 // ResetField resets all changes in the mutation for the field with the given name.
 // It returns an error if the field is not defined in the schema.
-func (m *DeviceTokenMutation) ResetField(name string) error {
+func (m *DeviceRequestMutation) ResetField(name string) error {
 	switch name {
-	case devicetoken.FieldDeviceCode:
-		m.ResetDeviceCode()
-		return nil
-	case devicetoken.FieldStatus:
-		m.ResetStatus()
-		return nil
-	case devicetoken.FieldToken:
-		m.ResetToken()
+	case devicerequest.FieldUserCode:
+		m.ResetUserCode()
 		return nil
-	case devicetoken.FieldExpiry:
-		m.ResetExpiry()
+	case devicerequest.FieldDeviceCode:
+		m.ResetDeviceCode()
 		return nil
-	case devicetoken.FieldLastRequest:
-		m.ResetLastRequest()
+	case devicerequest.FieldClientID:
+		m.ResetClientID()
 		return nil
-	case devicetoken.FieldPollInterval:
-		m.ResetPollInterval()
+	case devicerequest.FieldClientSecret:
+		m.ResetClientSecret()
 		return nil
-	case devicetoken.FieldCodeChallenge:
-		m.ResetCodeChallenge()
+	case devicerequest.FieldScopes:
+		m.ResetScopes()
 		return nil
-	case devicetoken.FieldCodeChallengeMethod:
-		m.ResetCodeChallengeMethod()
+	case devicerequest.FieldExpiry:
+		m.ResetExpiry()
 		return nil
 	}
-	return fmt.Errorf("unknown DeviceToken field %s", name)
+	return fmt.Errorf("unknown DeviceRequest field %s", name)
 }
 
 // AddedEdges returns all edge names that were set/added in this mutation.
-func (m *DeviceTokenMutation) AddedEdges() []string {
+func (m *DeviceRequestMutation) AddedEdges() []string {
 	edges := make([]string, 0, 0)
 	return edges
 }
 
 // AddedIDs returns all IDs (to other nodes) that were added for the given edge
 // name in this mutation.
-func (m *DeviceTokenMutation) AddedIDs(name string) []ent.Value {
+func (m *DeviceRequestMutation) AddedIDs(name string) []ent.Value {
 	return nil
 }
 
 // RemovedEdges returns all edge names that were removed in this mutation.
-func (m *DeviceTokenMutation) RemovedEdges() []string {
+func (m *DeviceRequestMutation) RemovedEdges() []string {
 	edges := make([]string, 0, 0)
 	return edges
 }
 
 // RemovedIDs returns all IDs (to other nodes) that were removed for the edge with
 // the given name in this mutation.
-func (m *DeviceTokenMutation) RemovedIDs(name string) []ent.Value {
+func (m *DeviceRequestMutation) RemovedIDs(name string) []ent.Value {
 	return nil
 }
 
 // ClearedEdges returns all edge names that were cleared in this mutation.
-func (m *DeviceTokenMutation) ClearedEdges() []string {
+func (m *DeviceRequestMutation) ClearedEdges() []string {
 	edges := make([]string, 0, 0)
 	return edges
 }
 
 // EdgeCleared returns a boolean which indicates if the edge with the given name
 // was cleared in this mutation.
-func (m *DeviceTokenMutation) EdgeCleared(name string) bool {
+func (m *DeviceRequestMutation) EdgeCleared(name string) bool {
 	return false
 }
 
 // ClearEdge clears the value of the edge with the given name. It returns an error
 // if that edge is not defined in the schema.
-func (m *DeviceTokenMutation) ClearEdge(name string) error {
-	return fmt.Errorf("unknown DeviceToken unique edge %s", name)
+func (m *DeviceRequestMutation) ClearEdge(name string) error {
+	return fmt.Errorf("unknown DeviceRequest unique edge %s", name)
 }
 
 // ResetEdge resets all changes to the edge with the given name in this mutation.
 // It returns an error if the edge is not defined in the schema.
-func (m *DeviceTokenMutation) ResetEdge(name string) error {
-	return fmt.Errorf("unknown DeviceToken edge %s", name)
+func (m *DeviceRequestMutation) ResetEdge(name string) error {
+	return fmt.Errorf("unknown DeviceRequest edge %s", name)
 }
 
-// KeysMutation represents an operation that mutates the Keys nodes in the graph.
-type KeysMutation struct {
+// DeviceTokenMutation represents an operation that mutates the DeviceToken nodes in the graph.
+type DeviceTokenMutation struct {
 	config
-	op                Op
-	typ               string
-	id                *string
-	verification_keys *[]storage.VerificationKey
-	signing_key       *jose.JSONWebKey
-	signing_key_pub   *jose.JSONWebKey
-	next_rotation     *time.Time
-	clearedFields     map[string]struct{}
-	done              bool
-	oldValue          func(context.Context) (*Keys, error)
-	predicates        []predicate.Keys
+	op                    Op
+	typ                   string
+	id                    *int
+	device_code           *string
+	status                *string
+	token                 *[]byte
+	expiry                *time.Time
+	last_request          *time.Time
+	poll_interval         *int
+	addpoll_interval      *int
+	code_challenge        *string
+	code_challenge_method *string
+	clearedFields         map[string]struct{}
+	done                  bool
+	oldValue              func(context.Context) (*DeviceToken, error)
+	predicates            []predicate.DeviceToken
 }
 
-var _ ent.Mutation = (*KeysMutation)(nil)
+var _ ent.Mutation = (*DeviceTokenMutation)(nil)
 
-// keysOption allows management of the mutation configuration using functional options.
-type keysOption func(*KeysMutation)
+// devicetokenOption allows management of the mutation configuration using functional options.
+type devicetokenOption func(*DeviceTokenMutation)
 
-// newKeysMutation creates new mutation for the Keys entity.
-func newKeysMutation(c config, op Op, opts ...keysOption) *KeysMutation {
-	m := &KeysMutation{
+// newDeviceTokenMutation creates new mutation for the DeviceToken entity.
+func newDeviceTokenMutation(c config, op Op, opts ...devicetokenOption) *DeviceTokenMutation {
+	m := &DeviceTokenMutation{
 		config:        c,
 		op:            op,
-		typ:           TypeKeys,
+		typ:           TypeDeviceToken,
 		clearedFields: make(map[string]struct{}),
 	}
 	for _, opt := range opts {
@@ -4412,20 +5367,20 @@ func newKeysMutation(c config, op Op, opts ...keysOption) *KeysMutation {
 	return m
 }
 
-// withKeysID sets the ID field of the mutation.
-func withKeysID(id string) keysOption {
-	return func(m *KeysMutation) {
+// withDeviceTokenID sets the ID field of the mutation.
+func withDeviceTokenID(id int) devicetokenOption {
+	return func(m *DeviceTokenMutation) {
 		var (
 			err   error
 			once  sync.Once
-			value *Keys
+			value *DeviceToken
 		)
-		m.oldValue = func(ctx context.Context) (*Keys, error) {
+		m.oldValue = func(ctx context.Context) (*DeviceToken, error) {
 			once.Do(func() {
 				if m.done {
 					err = errors.New("querying old values post mutation is not allowed")
 				} else {
-					value, err = m.Client().Keys.Get(ctx, id)
+					value, err = m.Client().DeviceToken.Get(ctx, id)
 				}
 			})
 			return value, err
@@ -4434,10 +5389,10 @@ func withKeysID(id string) keysOption {
 	}
 }
 
-// withKeys sets the old Keys of the mutation.
-func withKeys(node *Keys) keysOption {
-	return func(m *KeysMutation) {
-		m.oldValue = func(context.Context) (*Keys, error) {
+// withDeviceToken sets the old DeviceToken of the mutation.
+func withDeviceToken(node *DeviceToken) devicetokenOption {
+	return func(m *DeviceTokenMutation) {
+		m.oldValue = func(context.Context) (*DeviceToken, error) {
 			return node, nil
 		}
 		m.id = &node.ID
@@ -4446,7 +5401,7 @@ func withKeys(node *Keys) keysOption {
 
 // Client returns a new `ent.Client` from the mutation. If the mutation was
 // executed in a transaction (ent.Tx), a transactional client is returned.
-func (m KeysMutation) Client() *Client {
+func (m DeviceTokenMutation) Client() *Client {
 	client := &Client{config: m.config}
 	client.init()
 	return client
@@ -4454,7 +5409,7 @@ func (m KeysMutation) Client() *Client {
 
 // Tx returns an `ent.Tx` for mutations that were executed in transactions;
 // it returns an error otherwise.
-func (m KeysMutation) Tx() (*Tx, error) {
+func (m DeviceTokenMutation) Tx() (*Tx, error) {
 	if _, ok := m.driver.(*txDriver); !ok {
 		return nil, errors.New("db: mutation is not running in a transaction")
 	}
@@ -4463,15 +5418,9 @@ func (m KeysMutation) Tx() (*Tx, error) {
 	return tx, nil
 }
 
-// SetID sets the value of the id field. Note that this
-// operation is only accepted on creation of Keys entities.
-func (m *KeysMutation) SetID(id string) {
-	m.id = &id
-}
-
 // ID returns the ID value in the mutation. Note that the ID is only available
 // if it was provided to the builder or after it was returned from the database.
-func (m *KeysMutation) ID() (id string, exists bool) {
+func (m *DeviceTokenMutation) ID() (id int, exists bool) {
 	if m.id == nil {
 		return
 	}
@@ -4482,409 +5431,2978 @@ func (m *KeysMutation) ID() (id string, exists bool) {
 // That means, if the mutation is applied within a transaction with an isolation level such
 // as sql.LevelSerializable, the returned ids match the ids of the rows that will be updated
 // or updated by the mutation.
-func (m *KeysMutation) IDs(ctx context.Context) ([]string, error) {
+func (m *DeviceTokenMutation) IDs(ctx context.Context) ([]int, error) {
 	switch {
 	case m.op.Is(OpUpdateOne | OpDeleteOne):
 		id, exists := m.ID()
 		if exists {
-			return []string{id}, nil
+			return []int{id}, nil
 		}
 		fallthrough
 	case m.op.Is(OpUpdate | OpDelete):
-		return m.Client().Keys.Query().Where(m.predicates...).IDs(ctx)
+		return m.Client().DeviceToken.Query().Where(m.predicates...).IDs(ctx)
 	default:
 		return nil, fmt.Errorf("IDs is not allowed on %s operations", m.op)
 	}
 }
 
-// SetVerificationKeys sets the "verification_keys" field.
-func (m *KeysMutation) SetVerificationKeys(sk []storage.VerificationKey) {
-	m.verification_keys = &sk
+// SetDeviceCode sets the "device_code" field.
+func (m *DeviceTokenMutation) SetDeviceCode(s string) {
+	m.device_code = &s
 }
 
-// VerificationKeys returns the value of the "verification_keys" field in the mutation.
-func (m *KeysMutation) VerificationKeys() (r []storage.VerificationKey, exists bool) {
-	v := m.verification_keys
+// DeviceCode returns the value of the "device_code" field in the mutation.
+func (m *DeviceTokenMutation) DeviceCode() (r string, exists bool) {
+	v := m.device_code
 	if v == nil {
 		return
 	}
 	return *v, true
 }
 
-// OldVerificationKeys returns the old "verification_keys" field's value of the Keys entity.
-// If the Keys object wasn't provided to the builder, the object is fetched from the database.
+// OldDeviceCode returns the old "device_code" field's value of the DeviceToken entity.
+// If the DeviceToken object wasn't provided to the builder, the object is fetched from the database.
 // An error is returned if the mutation operation is not UpdateOne, or the database query fails.
-func (m *KeysMutation) OldVerificationKeys(ctx context.Context) (v []storage.VerificationKey, err error) {
+func (m *DeviceTokenMutation) OldDeviceCode(ctx context.Context) (v string, err error) {
 	if !m.op.Is(OpUpdateOne) {
-		return v, errors.New("OldVerificationKeys is only allowed on UpdateOne operations")
+		return v, errors.New("OldDeviceCode is only allowed on UpdateOne operations")
 	}
 	if m.id == nil || m.oldValue == nil {
-		return v, errors.New("OldVerificationKeys requires an ID field in the mutation")
+		return v, errors.New("OldDeviceCode requires an ID field in the mutation")
 	}
 	oldValue, err := m.oldValue(ctx)
 	if err != nil {
-		return v, fmt.Errorf("querying old value for OldVerificationKeys: %w", err)
+		return v, fmt.Errorf("querying old value for OldDeviceCode: %w", err)
 	}
-	return oldValue.VerificationKeys, nil
+	return oldValue.DeviceCode, nil
 }
 
-// ResetVerificationKeys resets all changes to the "verification_keys" field.
-func (m *KeysMutation) ResetVerificationKeys() {
-	m.verification_keys = nil
+// ResetDeviceCode resets all changes to the "device_code" field.
+func (m *DeviceTokenMutation) ResetDeviceCode() {
+	m.device_code = nil
 }
 
-// SetSigningKey sets the "signing_key" field.
-func (m *KeysMutation) SetSigningKey(jwk jose.JSONWebKey) {
-	m.signing_key = &jwk
+// SetStatus sets the "status" field.
+func (m *DeviceTokenMutation) SetStatus(s string) {
+	m.status = &s
 }
 
-// SigningKey returns the value of the "signing_key" field in the mutation.
-func (m *KeysMutation) SigningKey() (r jose.JSONWebKey, exists bool) {
-	v := m.signing_key
+// Status returns the value of the "status" field in the mutation.
+func (m *DeviceTokenMutation) Status() (r string, exists bool) {
+	v := m.status
 	if v == nil {
 		return
 	}
 	return *v, true
 }
 
-// OldSigningKey returns the old "signing_key" field's value of the Keys entity.
-// If the Keys object wasn't provided to the builder, the object is fetched from the database.
+// OldStatus returns the old "status" field's value of the DeviceToken entity.
+// If the DeviceToken object wasn't provided to the builder, the object is fetched from the database.
 // An error is returned if the mutation operation is not UpdateOne, or the database query fails.
-func (m *KeysMutation) OldSigningKey(ctx context.Context) (v jose.JSONWebKey, err error) {
+func (m *DeviceTokenMutation) OldStatus(ctx context.Context) (v string, err error) {
 	if !m.op.Is(OpUpdateOne) {
-		return v, errors.New("OldSigningKey is only allowed on UpdateOne operations")
+		return v, errors.New("OldStatus is only allowed on UpdateOne operations")
 	}
 	if m.id == nil || m.oldValue == nil {
-		return v, errors.New("OldSigningKey requires an ID field in the mutation")
+		return v, errors.New("OldStatus requires an ID field in the mutation")
 	}
 	oldValue, err := m.oldValue(ctx)
 	if err != nil {
-		return v, fmt.Errorf("querying old value for OldSigningKey: %w", err)
+		return v, fmt.Errorf("querying old value for OldStatus: %w", err)
 	}
-	return oldValue.SigningKey, nil
+	return oldValue.Status, nil
 }
 
-// ResetSigningKey resets all changes to the "signing_key" field.
-func (m *KeysMutation) ResetSigningKey() {
-	m.signing_key = nil
+// ResetStatus resets all changes to the "status" field.
+func (m *DeviceTokenMutation) ResetStatus() {
+	m.status = nil
 }
 
-// SetSigningKeyPub sets the "signing_key_pub" field.
-func (m *KeysMutation) SetSigningKeyPub(jwk jose.JSONWebKey) {
-	m.signing_key_pub = &jwk
+// SetToken sets the "token" field.
+func (m *DeviceTokenMutation) SetToken(b []byte) {
+	m.token = &b
 }
 
-// SigningKeyPub returns the value of the "signing_key_pub" field in the mutation.
-func (m *KeysMutation) SigningKeyPub() (r jose.JSONWebKey, exists bool) {
-	v := m.signing_key_pub
+// Token returns the value of the "token" field in the mutation.
+func (m *DeviceTokenMutation) Token() (r []byte, exists bool) {
+	v := m.token
 	if v == nil {
 		return
 	}
 	return *v, true
 }
 
-// OldSigningKeyPub returns the old "signing_key_pub" field's value of the Keys entity.
-// If the Keys object wasn't provided to the builder, the object is fetched from the database.
+// OldToken returns the old "token" field's value of the DeviceToken entity.
+// If the DeviceToken object wasn't provided to the builder, the object is fetched from the database.
 // An error is returned if the mutation operation is not UpdateOne, or the database query fails.
-func (m *KeysMutation) OldSigningKeyPub(ctx context.Context) (v jose.JSONWebKey, err error) {
+func (m *DeviceTokenMutation) OldToken(ctx context.Context) (v *[]byte, err error) {
 	if !m.op.Is(OpUpdateOne) {
-		return v, errors.New("OldSigningKeyPub is only allowed on UpdateOne operations")
+		return v, errors.New("OldToken is only allowed on UpdateOne operations")
 	}
 	if m.id == nil || m.oldValue == nil {
-		return v, errors.New("OldSigningKeyPub requires an ID field in the mutation")
+		return v, errors.New("OldToken requires an ID field in the mutation")
 	}
 	oldValue, err := m.oldValue(ctx)
 	if err != nil {
-		return v, fmt.Errorf("querying old value for OldSigningKeyPub: %w", err)
+		return v, fmt.Errorf("querying old value for OldToken: %w", err)
 	}
-	return oldValue.SigningKeyPub, nil
+	return oldValue.Token, nil
 }
 
-// ResetSigningKeyPub resets all changes to the "signing_key_pub" field.
-func (m *KeysMutation) ResetSigningKeyPub() {
-	m.signing_key_pub = nil
+// ClearToken clears the value of the "token" field.
+func (m *DeviceTokenMutation) ClearToken() {
+	m.token = nil
+	m.clearedFields[devicetoken.FieldToken] = struct{}{}
 }
 
-// SetNextRotation sets the "next_rotation" field.
-func (m *KeysMutation) SetNextRotation(t time.Time) {
-	m.next_rotation = &t
+// TokenCleared returns if the "token" field was cleared in this mutation.
+func (m *DeviceTokenMutation) TokenCleared() bool {
+	_, ok := m.clearedFields[devicetoken.FieldToken]
+	return ok
 }
 
-// NextRotation returns the value of the "next_rotation" field in the mutation.
-func (m *KeysMutation) NextRotation() (r time.Time, exists bool) {
-	v := m.next_rotation
-	if v == nil {
-		return
-	}
-	return *v, true
+// ResetToken resets all changes to the "token" field.
+func (m *DeviceTokenMutation) ResetToken() {
+	m.token = nil
+	delete(m.clearedFields, devicetoken.FieldToken)
 }
 
-// OldNextRotation returns the old "next_rotation" field's value of the Keys entity.
-// If the Keys object wasn't provided to the builder, the object is fetched from the database.
+// SetExpiry sets the "expiry" field.
+func (m *DeviceTokenMutation) SetExpiry(t time.Time) {
+	m.expiry = &t
+}
+
+// Expiry returns the value of the "expiry" field in the mutation.
+func (m *DeviceTokenMutation) Expiry() (r time.Time, exists bool) {
+	v := m.expiry
+	if v == nil {
+		return
+	}
+	return *v, true
+}
+
+// OldExpiry returns the old "expiry" field's value of the DeviceToken entity.
+// If the DeviceToken object wasn't provided to the builder, the object is fetched from the database.
 // An error is returned if the mutation operation is not UpdateOne, or the database query fails.
-func (m *KeysMutation) OldNextRotation(ctx context.Context) (v time.Time, err error) {
+func (m *DeviceTokenMutation) OldExpiry(ctx context.Context) (v time.Time, err error) {
 	if !m.op.Is(OpUpdateOne) {
-		return v, errors.New("OldNextRotation is only allowed on UpdateOne operations")
+		return v, errors.New("OldExpiry is only allowed on UpdateOne operations")
 	}
 	if m.id == nil || m.oldValue == nil {
-		return v, errors.New("OldNextRotation requires an ID field in the mutation")
+		return v, errors.New("OldExpiry requires an ID field in the mutation")
 	}
 	oldValue, err := m.oldValue(ctx)
 	if err != nil {
-		return v, fmt.Errorf("querying old value for OldNextRotation: %w", err)
+		return v, fmt.Errorf("querying old value for OldExpiry: %w", err)
 	}
-	return oldValue.NextRotation, nil
-}
-
-// ResetNextRotation resets all changes to the "next_rotation" field.
-func (m *KeysMutation) ResetNextRotation() {
-	m.next_rotation = nil
+	return oldValue.Expiry, nil
 }
 
-// Where appends a list predicates to the KeysMutation builder.
-func (m *KeysMutation) Where(ps ...predicate.Keys) {
-	m.predicates = append(m.predicates, ps...)
+// ResetExpiry resets all changes to the "expiry" field.
+func (m *DeviceTokenMutation) ResetExpiry() {
+	m.expiry = nil
 }
 
-// Op returns the operation name.
-func (m *KeysMutation) Op() Op {
-	return m.op
+// SetLastRequest sets the "last_request" field.
+func (m *DeviceTokenMutation) SetLastRequest(t time.Time) {
+	m.last_request = &t
 }
 
-// Type returns the node type of this mutation (Keys).
-func (m *KeysMutation) Type() string {
-	return m.typ
+// LastRequest returns the value of the "last_request" field in the mutation.
+func (m *DeviceTokenMutation) LastRequest() (r time.Time, exists bool) {
+	v := m.last_request
+	if v == nil {
+		return
+	}
+	return *v, true
 }
 
-// Fields returns all fields that were changed during this mutation. Note that in
-// order to get all numeric fields that were incremented/decremented, call
-// AddedFields().
-func (m *KeysMutation) Fields() []string {
-	fields := make([]string, 0, 4)
-	if m.verification_keys != nil {
-		fields = append(fields, keys.FieldVerificationKeys)
+// OldLastRequest returns the old "last_request" field's value of the DeviceToken entity.
+// If the DeviceToken object wasn't provided to the builder, the object is fetched from the database.
+// An error is returned if the mutation operation is not UpdateOne, or the database query fails.
+func (m *DeviceTokenMutation) OldLastRequest(ctx context.Context) (v time.Time, err error) {
+	if !m.op.Is(OpUpdateOne) {
+		return v, errors.New("OldLastRequest is only allowed on UpdateOne operations")
 	}
-	if m.signing_key != nil {
-		fields = append(fields, keys.FieldSigningKey)
+	if m.id == nil || m.oldValue == nil {
+		return v, errors.New("OldLastRequest requires an ID field in the mutation")
 	}
-	if m.signing_key_pub != nil {
-		fields = append(fields, keys.FieldSigningKeyPub)
+	oldValue, err := m.oldValue(ctx)
+	if err != nil {
+		return v, fmt.Errorf("querying old value for OldLastRequest: %w", err)
 	}
-	if m.next_rotation != nil {
-		fields = append(fields, keys.FieldNextRotation)
+	return oldValue.LastRequest, nil
+}
+
+// ResetLastRequest resets all changes to the "last_request" field.
+func (m *DeviceTokenMutation) ResetLastRequest() {
+	m.last_request = nil
+}
+
+// SetPollInterval sets the "poll_interval" field.
+func (m *DeviceTokenMutation) SetPollInterval(i int) {
+	m.poll_interval = &i
+	m.addpoll_interval = nil
+}
+
+// PollInterval returns the value of the "poll_interval" field in the mutation.
+func (m *DeviceTokenMutation) PollInterval() (r int, exists bool) {
+	v := m.poll_interval
+	if v == nil {
+		return
 	}
-	return fields
+	return *v, true
 }
 
-// Field returns the value of a field with the given name. The second boolean
-// return value indicates that this field was not set, or was not defined in the
-// schema.
-func (m *KeysMutation) Field(name string) (ent.Value, bool) {
-	switch name {
-	case keys.FieldVerificationKeys:
-		return m.VerificationKeys()
-	case keys.FieldSigningKey:
-		return m.SigningKey()
-	case keys.FieldSigningKeyPub:
-		return m.SigningKeyPub()
-	case keys.FieldNextRotation:
-		return m.NextRotation()
+// OldPollInterval returns the old "poll_interval" field's value of the DeviceToken entity.
+// If the DeviceToken object wasn't provided to the builder, the object is fetched from the database.
+// An error is returned if the mutation operation is not UpdateOne, or the database query fails.
+func (m *DeviceTokenMutation) OldPollInterval(ctx context.Context) (v int, err error) {
+	if !m.op.Is(OpUpdateOne) {
+		return v, errors.New("OldPollInterval is only allowed on UpdateOne operations")
 	}
-	return nil, false
+	if m.id == nil || m.oldValue == nil {
+		return v, errors.New("OldPollInterval requires an ID field in the mutation")
+	}
+	oldValue, err := m.oldValue(ctx)
+	if err != nil {
+		return v, fmt.Errorf("querying old value for OldPollInterval: %w", err)
+	}
+	return oldValue.PollInterval, nil
 }
 
-// OldField returns the old value of the field from the database. An error is
-// returned if the mutation operation is not UpdateOne, or the query to the
-// database failed.
-func (m *KeysMutation) OldField(ctx context.Context, name string) (ent.Value, error) {
-	switch name {
-	case keys.FieldVerificationKeys:
-		return m.OldVerificationKeys(ctx)
-	case keys.FieldSigningKey:
-		return m.OldSigningKey(ctx)
-	case keys.FieldSigningKeyPub:
-		return m.OldSigningKeyPub(ctx)
-	case keys.FieldNextRotation:
-		return m.OldNextRotation(ctx)
+// AddPollInterval adds i to the "poll_interval" field.
+func (m *DeviceTokenMutation) AddPollInterval(i int) {
+	if m.addpoll_interval != nil {
+		*m.addpoll_interval += i
+	} else {
+		m.addpoll_interval = &i
 	}
-	return nil, fmt.Errorf("unknown Keys field %s", name)
 }
 
-// SetField sets the value of a field with the given name. It returns an error if
-// the field is not defined in the schema, or if the type mismatched the field
-// type.
-func (m *KeysMutation) SetField(name string, value ent.Value) error {
-	switch name {
-	case keys.FieldVerificationKeys:
-		v, ok := value.([]storage.VerificationKey)
-		if !ok {
-			return fmt.Errorf("unexpected type %T for field %s", value, name)
-		}
-		m.SetVerificationKeys(v)
-		return nil
-	case keys.FieldSigningKey:
-		v, ok := value.(jose.JSONWebKey)
-		if !ok {
-			return fmt.Errorf("unexpected type %T for field %s", value, name)
-		}
-		m.SetSigningKey(v)
-		return nil
-	case keys.FieldSigningKeyPub:
-		v, ok := value.(jose.JSONWebKey)
-		if !ok {
-			return fmt.Errorf("unexpected type %T for field %s", value, name)
-		}
-		m.SetSigningKeyPub(v)
-		return nil
-	case keys.FieldNextRotation:
-		v, ok := value.(time.Time)
-		if !ok {
-			return fmt.Errorf("unexpected type %T for field %s", value, name)
-		}
-		m.SetNextRotation(v)
-		return nil
+// AddedPollInterval returns the value that was added to the "poll_interval" field in this mutation.
+func (m *DeviceTokenMutation) AddedPollInterval() (r int, exists bool) {
+	v := m.addpoll_interval
+	if v == nil {
+		return
 	}
-	return fmt.Errorf("unknown Keys field %s", name)
+	return *v, true
 }
 
-// AddedFields returns all numeric fields that were incremented/decremented during
-// this mutation.
-func (m *KeysMutation) AddedFields() []string {
-	return nil
+// ResetPollInterval resets all changes to the "poll_interval" field.
+func (m *DeviceTokenMutation) ResetPollInterval() {
+	m.poll_interval = nil
+	m.addpoll_interval = nil
 }
 
-// AddedField returns the numeric value that was incremented/decremented on a field
-// with the given name. The second boolean return value indicates that this field
-// was not set, or was not defined in the schema.
-func (m *KeysMutation) AddedField(name string) (ent.Value, bool) {
-	return nil, false
+// SetCodeChallenge sets the "code_challenge" field.
+func (m *DeviceTokenMutation) SetCodeChallenge(s string) {
+	m.code_challenge = &s
 }
 
-// AddField adds the value to the field with the given name. It returns an error if
-// the field is not defined in the schema, or if the type mismatched the field
-// type.
-func (m *KeysMutation) AddField(name string, value ent.Value) error {
-	switch name {
+// CodeChallenge returns the value of the "code_challenge" field in the mutation.
+func (m *DeviceTokenMutation) CodeChallenge() (r string, exists bool) {
+	v := m.code_challenge
+	if v == nil {
+		return
 	}
-	return fmt.Errorf("unknown Keys numeric field %s", name)
+	return *v, true
 }
 
-// ClearedFields returns all nullable fields that were cleared during this
-// mutation.
-func (m *KeysMutation) ClearedFields() []string {
-	return nil
+// OldCodeChallenge returns the old "code_challenge" field's value of the DeviceToken entity.
+// If the DeviceToken object wasn't provided to the builder, the object is fetched from the database.
+// An error is returned if the mutation operation is not UpdateOne, or the database query fails.
+func (m *DeviceTokenMutation) OldCodeChallenge(ctx context.Context) (v string, err error) {
+	if !m.op.Is(OpUpdateOne) {
+		return v, errors.New("OldCodeChallenge is only allowed on UpdateOne operations")
+	}
+	if m.id == nil || m.oldValue == nil {
+		return v, errors.New("OldCodeChallenge requires an ID field in the mutation")
+	}
+	oldValue, err := m.oldValue(ctx)
+	if err != nil {
+		return v, fmt.Errorf("querying old value for OldCodeChallenge: %w", err)
+	}
+	return oldValue.CodeChallenge, nil
 }
 
-// FieldCleared returns a boolean indicating if a field with the given name was
-// cleared in this mutation.
-func (m *KeysMutation) FieldCleared(name string) bool {
-	_, ok := m.clearedFields[name]
-	return ok
+// ResetCodeChallenge resets all changes to the "code_challenge" field.
+func (m *DeviceTokenMutation) ResetCodeChallenge() {
+	m.code_challenge = nil
 }
 
-// ClearField clears the value of the field with the given name. It returns an
-// error if the field is not defined in the schema.
-func (m *KeysMutation) ClearField(name string) error {
-	return fmt.Errorf("unknown Keys nullable field %s", name)
+// SetCodeChallengeMethod sets the "code_challenge_method" field.
+func (m *DeviceTokenMutation) SetCodeChallengeMethod(s string) {
+	m.code_challenge_method = &s
 }
 
-// ResetField resets all changes in the mutation for the field with the given name.
-// It returns an error if the field is not defined in the schema.
+// CodeChallengeMethod returns the value of the "code_challenge_method" field in the mutation.
+func (m *DeviceTokenMutation) CodeChallengeMethod() (r string, exists bool) {
+	v := m.code_challenge_method
+	if v == nil {
+		return
+	}
+	return *v, true
+}
+
+// OldCodeChallengeMethod returns the old "code_challenge_method" field's value of the DeviceToken entity.
+// If the DeviceToken object wasn't provided to the builder, the object is fetched from the database.
+// An error is returned if the mutation operation is not UpdateOne, or the database query fails.
+func (m *DeviceTokenMutation) OldCodeChallengeMethod(ctx context.Context) (v string, err error) {
+	if !m.op.Is(OpUpdateOne) {
+		return v, errors.New("OldCodeChallengeMethod is only allowed on UpdateOne operations")
+	}
+	if m.id == nil || m.oldValue == nil {
+		return v, errors.New("OldCodeChallengeMethod requires an ID field in the mutation")
+	}
+	oldValue, err := m.oldValue(ctx)
+	if err != nil {
+		return v, fmt.Errorf("querying old value for OldCodeChallengeMethod: %w", err)
+	}
+	return oldValue.CodeChallengeMethod, nil
+}
+
+// ResetCodeChallengeMethod resets all changes to the "code_challenge_method" field.
+func (m *DeviceTokenMutation) ResetCodeChallengeMethod() {
+	m.code_challenge_method = nil
+}
+
+// Where appends a list predicates to the DeviceTokenMutation builder.
+func (m *DeviceTokenMutation) Where(ps ...predicate.DeviceToken) {
+	m.predicates = append(m.predicates, ps...)
+}
+
+// WhereP appends storage-level predicates to the DeviceTokenMutation builder. Using this method,
+// users can use type-assertion to append predicates that do not depend on any generated package.
+func (m *DeviceTokenMutation) WhereP(ps ...func(*sql.Selector)) {
+	p := make([]predicate.DeviceToken, len(ps))
+	for i := range ps {
+		p[i] = ps[i]
+	}
+	m.Where(p...)
+}
+
+// Op returns the operation name.
+func (m *DeviceTokenMutation) Op() Op {
+	return m.op
+}
+
+// SetOp allows setting the mutation operation.
+func (m *DeviceTokenMutation) SetOp(op Op) {
+	m.op = op
+}
+
+// Type returns the node type of this mutation (DeviceToken).
+func (m *DeviceTokenMutation) Type() string {
+	return m.typ
+}
+
+// Fields returns all fields that were changed during this mutation. Note that in
+// order to get all numeric fields that were incremented/decremented, call
+// AddedFields().
+func (m *DeviceTokenMutation) Fields() []string {
+	fields := make([]string, 0, 8)
+	if m.device_code != nil {
+		fields = append(fields, devicetoken.FieldDeviceCode)
+	}
+	if m.status != nil {
+		fields = append(fields, devicetoken.FieldStatus)
+	}
+	if m.token != nil {
+		fields = append(fields, devicetoken.FieldToken)
+	}
+	if m.expiry != nil {
+		fields = append(fields, devicetoken.FieldExpiry)
+	}
+	if m.last_request != nil {
+		fields = append(fields, devicetoken.FieldLastRequest)
+	}
+	if m.poll_interval != nil {
+		fields = append(fields, devicetoken.FieldPollInterval)
+	}
+	if m.code_challenge != nil {
+		fields = append(fields, devicetoken.FieldCodeChallenge)
+	}
+	if m.code_challenge_method != nil {
+		fields = append(fields, devicetoken.FieldCodeChallengeMethod)
+	}
+	return fields
+}
+
+// Field returns the value of a field with the given name. The second boolean
+// return value indicates that this field was not set, or was not defined in the
+// schema.
+func (m *DeviceTokenMutation) Field(name string) (ent.Value, bool) {
+	switch name {
+	case devicetoken.FieldDeviceCode:
+		return m.DeviceCode()
+	case devicetoken.FieldStatus:
+		return m.Status()
+	case devicetoken.FieldToken:
+		return m.Token()
+	case devicetoken.FieldExpiry:
+		return m.Expiry()
+	case devicetoken.FieldLastRequest:
+		return m.LastRequest()
+	case devicetoken.FieldPollInterval:
+		return m.PollInterval()
+	case devicetoken.FieldCodeChallenge:
+		return m.CodeChallenge()
+	case devicetoken.FieldCodeChallengeMethod:
+		return m.CodeChallengeMethod()
+	}
+	return nil, false
+}
+
+// OldField returns the old value of the field from the database. An error is
+// returned if the mutation operation is not UpdateOne, or the query to the
+// database failed.
+func (m *DeviceTokenMutation) OldField(ctx context.Context, name string) (ent.Value, error) {
+	switch name {
+	case devicetoken.FieldDeviceCode:
+		return m.OldDeviceCode(ctx)
+	case devicetoken.FieldStatus:
+		return m.OldStatus(ctx)
+	case devicetoken.FieldToken:
+		return m.OldToken(ctx)
+	case devicetoken.FieldExpiry:
+		return m.OldExpiry(ctx)
+	case devicetoken.FieldLastRequest:
+		return m.OldLastRequest(ctx)
+	case devicetoken.FieldPollInterval:
+		return m.OldPollInterval(ctx)
+	case devicetoken.FieldCodeChallenge:
+		return m.OldCodeChallenge(ctx)
+	case devicetoken.FieldCodeChallengeMethod:
+		return m.OldCodeChallengeMethod(ctx)
+	}
+	return nil, fmt.Errorf("unknown DeviceToken field %s", name)
+}
+
+// SetField sets the value of a field with the given name. It returns an error if
+// the field is not defined in the schema, or if the type mismatched the field
+// type.
+func (m *DeviceTokenMutation) SetField(name string, value ent.Value) error {
+	switch name {
+	case devicetoken.FieldDeviceCode:
+		v, ok := value.(string)
+		if !ok {
+			return fmt.Errorf("unexpected type %T for field %s", value, name)
+		}
+		m.SetDeviceCode(v)
+		return nil
+	case devicetoken.FieldStatus:
+		v, ok := value.(string)
+		if !ok {
+			return fmt.Errorf("unexpected type %T for field %s", value, name)
+		}
+		m.SetStatus(v)
+		return nil
+	case devicetoken.FieldToken:
+		v, ok := value.([]byte)
+		if !ok {
+			return fmt.Errorf("unexpected type %T for field %s", value, name)
+		}
+		m.SetToken(v)
+		return nil
+	case devicetoken.FieldExpiry:
+		v, ok := value.(time.Time)
+		if !ok {
+			return fmt.Errorf("unexpected type %T for field %s", value, name)
+		}
+		m.SetExpiry(v)
+		return nil
+	case devicetoken.FieldLastRequest:
+		v, ok := value.(time.Time)
+		if !ok {
+			return fmt.Errorf("unexpected type %T for field %s", value, name)
+		}
+		m.SetLastRequest(v)
+		return nil
+	case devicetoken.FieldPollInterval:
+		v, ok := value.(int)
+		if !ok {
+			return fmt.Errorf("unexpected type %T for field %s", value, name)
+		}
+		m.SetPollInterval(v)
+		return nil
+	case devicetoken.FieldCodeChallenge:
+		v, ok := value.(string)
+		if !ok {
+			return fmt.Errorf("unexpected type %T for field %s", value, name)
+		}
+		m.SetCodeChallenge(v)
+		return nil
+	case devicetoken.FieldCodeChallengeMethod:
+		v, ok := value.(string)
+		if !ok {
+			return fmt.Errorf("unexpected type %T for field %s", value, name)
+		}
+		m.SetCodeChallengeMethod(v)
+		return nil
+	}
+	return fmt.Errorf("unknown DeviceToken field %s", name)
+}
+
+// AddedFields returns all numeric fields that were incremented/decremented during
+// this mutation.
+func (m *DeviceTokenMutation) AddedFields() []string {
+	var fields []string
+	if m.addpoll_interval != nil {
+		fields = append(fields, devicetoken.FieldPollInterval)
+	}
+	return fields
+}
+
+// AddedField returns the numeric value that was incremented/decremented on a field
+// with the given name. The second boolean return value indicates that this field
+// was not set, or was not defined in the schema.
+func (m *DeviceTokenMutation) AddedField(name string) (ent.Value, bool) {
+	switch name {
+	case devicetoken.FieldPollInterval:
+		return m.AddedPollInterval()
+	}
+	return nil, false
+}
+
+// AddField adds the value to the field with the given name. It returns an error if
+// the field is not defined in the schema, or if the type mismatched the field
+// type.
+func (m *DeviceTokenMutation) AddField(name string, value ent.Value) error {
+	switch name {
+	case devicetoken.FieldPollInterval:
+		v, ok := value.(int)
+		if !ok {
+			return fmt.Errorf("unexpected type %T for field %s", value, name)
+		}
+		m.AddPollInterval(v)
+		return nil
+	}
+	return fmt.Errorf("unknown DeviceToken numeric field %s", name)
+}
+
+// ClearedFields returns all nullable fields that were cleared during this
+// mutation.
+func (m *DeviceTokenMutation) ClearedFields() []string {
+	var fields []string
+	if m.FieldCleared(devicetoken.FieldToken) {
+		fields = append(fields, devicetoken.FieldToken)
+	}
+	return fields
+}
+
+// FieldCleared returns a boolean indicating if a field with the given name was
+// cleared in this mutation.
+func (m *DeviceTokenMutation) FieldCleared(name string) bool {
+	_, ok := m.clearedFields[name]
+	return ok
+}
+
+// ClearField clears the value of the field with the given name. It returns an
+// error if the field is not defined in the schema.
+func (m *DeviceTokenMutation) ClearField(name string) error {
+	switch name {
+	case devicetoken.FieldToken:
+		m.ClearToken()
+		return nil
+	}
+	return fmt.Errorf("unknown DeviceToken nullable field %s", name)
+}
+
+// ResetField resets all changes in the mutation for the field with the given name.
+// It returns an error if the field is not defined in the schema.
+func (m *DeviceTokenMutation) ResetField(name string) error {
+	switch name {
+	case devicetoken.FieldDeviceCode:
+		m.ResetDeviceCode()
+		return nil
+	case devicetoken.FieldStatus:
+		m.ResetStatus()
+		return nil
+	case devicetoken.FieldToken:
+		m.ResetToken()
+		return nil
+	case devicetoken.FieldExpiry:
+		m.ResetExpiry()
+		return nil
+	case devicetoken.FieldLastRequest:
+		m.ResetLastRequest()
+		return nil
+	case devicetoken.FieldPollInterval:
+		m.ResetPollInterval()
+		return nil
+	case devicetoken.FieldCodeChallenge:
+		m.ResetCodeChallenge()
+		return nil
+	case devicetoken.FieldCodeChallengeMethod:
+		m.ResetCodeChallengeMethod()
+		return nil
+	}
+	return fmt.Errorf("unknown DeviceToken field %s", name)
+}
+
+// AddedEdges returns all edge names that were set/added in this mutation.
+func (m *DeviceTokenMutation) AddedEdges() []string {
+	edges := make([]string, 0, 0)
+	return edges
+}
+
+// AddedIDs returns all IDs (to other nodes) that were added for the given edge
+// name in this mutation.
+func (m *DeviceTokenMutation) AddedIDs(name string) []ent.Value {
+	return nil
+}
+
+// RemovedEdges returns all edge names that were removed in this mutation.
+func (m *DeviceTokenMutation) RemovedEdges() []string {
+	edges := make([]string, 0, 0)
+	return edges
+}
+
+// RemovedIDs returns all IDs (to other nodes) that were removed for the edge with
+// the given name in this mutation.
+func (m *DeviceTokenMutation) RemovedIDs(name string) []ent.Value {
+	return nil
+}
+
+// ClearedEdges returns all edge names that were cleared in this mutation.
+func (m *DeviceTokenMutation) ClearedEdges() []string {
+	edges := make([]string, 0, 0)
+	return edges
+}
+
+// EdgeCleared returns a boolean which indicates if the edge with the given name
+// was cleared in this mutation.
+func (m *DeviceTokenMutation) EdgeCleared(name string) bool {
+	return false
+}
+
+// ClearEdge clears the value of the edge with the given name. It returns an error
+// if that edge is not defined in the schema.
+func (m *DeviceTokenMutation) ClearEdge(name string) error {
+	return fmt.Errorf("unknown DeviceToken unique edge %s", name)
+}
+
+// ResetEdge resets all changes to the edge with the given name in this mutation.
+// It returns an error if the edge is not defined in the schema.
+func (m *DeviceTokenMutation) ResetEdge(name string) error {
+	return fmt.Errorf("unknown DeviceToken edge %s", name)
+}
+
+// KeysMutation represents an operation that mutates the Keys nodes in the graph.
+type KeysMutation struct {
+	config
+	op                      Op
+	typ                     string
+	id                      *string
+	verification_keys       *[]storage.VerificationKey
+	appendverification_keys []storage.VerificationKey
+	signing_key             *jose.JSONWebKey
+	signing_key_pub         *jose.JSONWebKey
+	next_rotation           *time.Time
+	clearedFields           map[string]struct{}
+	done                    bool
+	oldValue                func(context.Context) (*Keys, error)
+	predicates              []predicate.Keys
+}
+
+var _ ent.Mutation = (*KeysMutation)(nil)
+
+// keysOption allows management of the mutation configuration using functional options.
+type keysOption func(*KeysMutation)
+
+// newKeysMutation creates new mutation for the Keys entity.
+func newKeysMutation(c config, op Op, opts ...keysOption) *KeysMutation {
+	m := &KeysMutation{
+		config:        c,
+		op:            op,
+		typ:           TypeKeys,
+		clearedFields: make(map[string]struct{}),
+	}
+	for _, opt := range opts {
+		opt(m)
+	}
+	return m
+}
+
+// withKeysID sets the ID field of the mutation.
+func withKeysID(id string) keysOption {
+	return func(m *KeysMutation) {
+		var (
+			err   error
+			once  sync.Once
+			value *Keys
+		)
+		m.oldValue = func(ctx context.Context) (*Keys, error) {
+			once.Do(func() {
+				if m.done {
+					err = errors.New("querying old values post mutation is not allowed")
+				} else {
+					value, err = m.Client().Keys.Get(ctx, id)
+				}
+			})
+			return value, err
+		}
+		m.id = &id
+	}
+}
+
+// withKeys sets the old Keys of the mutation.
+func withKeys(node *Keys) keysOption {
+	return func(m *KeysMutation) {
+		m.oldValue = func(context.Context) (*Keys, error) {
+			return node, nil
+		}
+		m.id = &node.ID
+	}
+}
+
+// Client returns a new `ent.Client` from the mutation. If the mutation was
+// executed in a transaction (ent.Tx), a transactional client is returned.
+func (m KeysMutation) Client() *Client {
+	client := &Client{config: m.config}
+	client.init()
+	return client
+}
+
+// Tx returns an `ent.Tx` for mutations that were executed in transactions;
+// it returns an error otherwise.
+func (m KeysMutation) Tx() (*Tx, error) {
+	if _, ok := m.driver.(*txDriver); !ok {
+		return nil, errors.New("db: mutation is not running in a transaction")
+	}
+	tx := &Tx{config: m.config}
+	tx.init()
+	return tx, nil
+}
+
+// SetID sets the value of the id field. Note that this
+// operation is only accepted on creation of Keys entities.
+func (m *KeysMutation) SetID(id string) {
+	m.id = &id
+}
+
+// ID returns the ID value in the mutation. Note that the ID is only available
+// if it was provided to the builder or after it was returned from the database.
+func (m *KeysMutation) ID() (id string, exists bool) {
+	if m.id == nil {
+		return
+	}
+	return *m.id, true
+}
+
+// IDs queries the database and returns the entity ids that match the mutation's predicate.
+// That means, if the mutation is applied within a transaction with an isolation level such
+// as sql.LevelSerializable, the returned ids match the ids of the rows that will be updated
+// or updated by the mutation.
+func (m *KeysMutation) IDs(ctx context.Context) ([]string, error) {
+	switch {
+	case m.op.Is(OpUpdateOne | OpDeleteOne):
+		id, exists := m.ID()
+		if exists {
+			return []string{id}, nil
+		}
+		fallthrough
+	case m.op.Is(OpUpdate | OpDelete):
+		return m.Client().Keys.Query().Where(m.predicates...).IDs(ctx)
+	default:
+		return nil, fmt.Errorf("IDs is not allowed on %s operations", m.op)
+	}
+}
+
+// SetVerificationKeys sets the "verification_keys" field.
+func (m *KeysMutation) SetVerificationKeys(sk []storage.VerificationKey) {
+	m.verification_keys = &sk
+	m.appendverification_keys = nil
+}
+
+// VerificationKeys returns the value of the "verification_keys" field in the mutation.
+func (m *KeysMutation) VerificationKeys() (r []storage.VerificationKey, exists bool) {
+	v := m.verification_keys
+	if v == nil {
+		return
+	}
+	return *v, true
+}
+
+// OldVerificationKeys returns the old "verification_keys" field's value of the Keys entity.
+// If the Keys object wasn't provided to the builder, the object is fetched from the database.
+// An error is returned if the mutation operation is not UpdateOne, or the database query fails.
+func (m *KeysMutation) OldVerificationKeys(ctx context.Context) (v []storage.VerificationKey, err error) {
+	if !m.op.Is(OpUpdateOne) {
+		return v, errors.New("OldVerificationKeys is only allowed on UpdateOne operations")
+	}
+	if m.id == nil || m.oldValue == nil {
+		return v, errors.New("OldVerificationKeys requires an ID field in the mutation")
+	}
+	oldValue, err := m.oldValue(ctx)
+	if err != nil {
+		return v, fmt.Errorf("querying old value for OldVerificationKeys: %w", err)
+	}
+	return oldValue.VerificationKeys, nil
+}
+
+// AppendVerificationKeys adds sk to the "verification_keys" field.
+func (m *KeysMutation) AppendVerificationKeys(sk []storage.VerificationKey) {
+	m.appendverification_keys = append(m.appendverification_keys, sk...)
+}
+
+// AppendedVerificationKeys returns the list of values that were appended to the "verification_keys" field in this mutation.
+func (m *KeysMutation) AppendedVerificationKeys() ([]storage.VerificationKey, bool) {
+	if len(m.appendverification_keys) == 0 {
+		return nil, false
+	}
+	return m.appendverification_keys, true
+}
+
+// ResetVerificationKeys resets all changes to the "verification_keys" field.
+func (m *KeysMutation) ResetVerificationKeys() {
+	m.verification_keys = nil
+	m.appendverification_keys = nil
+}
+
+// SetSigningKey sets the "signing_key" field.
+func (m *KeysMutation) SetSigningKey(jwk jose.JSONWebKey) {
+	m.signing_key = &jwk
+}
+
+// SigningKey returns the value of the "signing_key" field in the mutation.
+func (m *KeysMutation) SigningKey() (r jose.JSONWebKey, exists bool) {
+	v := m.signing_key
+	if v == nil {
+		return
+	}
+	return *v, true
+}
+
+// OldSigningKey returns the old "signing_key" field's value of the Keys entity.
+// If the Keys object wasn't provided to the builder, the object is fetched from the database.
+// An error is returned if the mutation operation is not UpdateOne, or the database query fails.
+func (m *KeysMutation) OldSigningKey(ctx context.Context) (v jose.JSONWebKey, err error) {
+	if !m.op.Is(OpUpdateOne) {
+		return v, errors.New("OldSigningKey is only allowed on UpdateOne operations")
+	}
+	if m.id == nil || m.oldValue == nil {
+		return v, errors.New("OldSigningKey requires an ID field in the mutation")
+	}
+	oldValue, err := m.oldValue(ctx)
+	if err != nil {
+		return v, fmt.Errorf("querying old value for OldSigningKey: %w", err)
+	}
+	return oldValue.SigningKey, nil
+}
+
+// ResetSigningKey resets all changes to the "signing_key" field.
+func (m *KeysMutation) ResetSigningKey() {
+	m.signing_key = nil
+}
+
+// SetSigningKeyPub sets the "signing_key_pub" field.
+func (m *KeysMutation) SetSigningKeyPub(jwk jose.JSONWebKey) {
+	m.signing_key_pub = &jwk
+}
+
+// SigningKeyPub returns the value of the "signing_key_pub" field in the mutation.
+func (m *KeysMutation) SigningKeyPub() (r jose.JSONWebKey, exists bool) {
+	v := m.signing_key_pub
+	if v == nil {
+		return
+	}
+	return *v, true
+}
+
+// OldSigningKeyPub returns the old "signing_key_pub" field's value of the Keys entity.
+// If the Keys object wasn't provided to the builder, the object is fetched from the database.
+// An error is returned if the mutation operation is not UpdateOne, or the database query fails.
+func (m *KeysMutation) OldSigningKeyPub(ctx context.Context) (v jose.JSONWebKey, err error) {
+	if !m.op.Is(OpUpdateOne) {
+		return v, errors.New("OldSigningKeyPub is only allowed on UpdateOne operations")
+	}
+	if m.id == nil || m.oldValue == nil {
+		return v, errors.New("OldSigningKeyPub requires an ID field in the mutation")
+	}
+	oldValue, err := m.oldValue(ctx)
+	if err != nil {
+		return v, fmt.Errorf("querying old value for OldSigningKeyPub: %w", err)
+	}
+	return oldValue.SigningKeyPub, nil
+}
+
+// ResetSigningKeyPub resets all changes to the "signing_key_pub" field.
+func (m *KeysMutation) ResetSigningKeyPub() {
+	m.signing_key_pub = nil
+}
+
+// SetNextRotation sets the "next_rotation" field.
+func (m *KeysMutation) SetNextRotation(t time.Time) {
+	m.next_rotation = &t
+}
+
+// NextRotation returns the value of the "next_rotation" field in the mutation.
+func (m *KeysMutation) NextRotation() (r time.Time, exists bool) {
+	v := m.next_rotation
+	if v == nil {
+		return
+	}
+	return *v, true
+}
+
+// OldNextRotation returns the old "next_rotation" field's value of the Keys entity.
+// If the Keys object wasn't provided to the builder, the object is fetched from the database.
+// An error is returned if the mutation operation is not UpdateOne, or the database query fails.
+func (m *KeysMutation) OldNextRotation(ctx context.Context) (v time.Time, err error) {
+	if !m.op.Is(OpUpdateOne) {
+		return v, errors.New("OldNextRotation is only allowed on UpdateOne operations")
+	}
+	if m.id == nil || m.oldValue == nil {
+		return v, errors.New("OldNextRotation requires an ID field in the mutation")
+	}
+	oldValue, err := m.oldValue(ctx)
+	if err != nil {
+		return v, fmt.Errorf("querying old value for OldNextRotation: %w", err)
+	}
+	return oldValue.NextRotation, nil
+}
+
+// ResetNextRotation resets all changes to the "next_rotation" field.
+func (m *KeysMutation) ResetNextRotation() {
+	m.next_rotation = nil
+}
+
+// Where appends a list predicates to the KeysMutation builder.
+func (m *KeysMutation) Where(ps ...predicate.Keys) {
+	m.predicates = append(m.predicates, ps...)
+}
+
+// WhereP appends storage-level predicates to the KeysMutation builder. Using this method,
+// users can use type-assertion to append predicates that do not depend on any generated package.
+func (m *KeysMutation) WhereP(ps ...func(*sql.Selector)) {
+	p := make([]predicate.Keys, len(ps))
+	for i := range ps {
+		p[i] = ps[i]
+	}
+	m.Where(p...)
+}
+
+// Op returns the operation name.
+func (m *KeysMutation) Op() Op {
+	return m.op
+}
+
+// SetOp allows setting the mutation operation.
+func (m *KeysMutation) SetOp(op Op) {
+	m.op = op
+}
+
+// Type returns the node type of this mutation (Keys).
+func (m *KeysMutation) Type() string {
+	return m.typ
+}
+
+// Fields returns all fields that were changed during this mutation. Note that in
+// order to get all numeric fields that were incremented/decremented, call
+// AddedFields().
+func (m *KeysMutation) Fields() []string {
+	fields := make([]string, 0, 4)
+	if m.verification_keys != nil {
+		fields = append(fields, keys.FieldVerificationKeys)
+	}
+	if m.signing_key != nil {
+		fields = append(fields, keys.FieldSigningKey)
+	}
+	if m.signing_key_pub != nil {
+		fields = append(fields, keys.FieldSigningKeyPub)
+	}
+	if m.next_rotation != nil {
+		fields = append(fields, keys.FieldNextRotation)
+	}
+	return fields
+}
+
+// Field returns the value of a field with the given name. The second boolean
+// return value indicates that this field was not set, or was not defined in the
+// schema.
+func (m *KeysMutation) Field(name string) (ent.Value, bool) {
+	switch name {
+	case keys.FieldVerificationKeys:
+		return m.VerificationKeys()
+	case keys.FieldSigningKey:
+		return m.SigningKey()
+	case keys.FieldSigningKeyPub:
+		return m.SigningKeyPub()
+	case keys.FieldNextRotation:
+		return m.NextRotation()
+	}
+	return nil, false
+}
+
+// OldField returns the old value of the field from the database. An error is
+// returned if the mutation operation is not UpdateOne, or the query to the
+// database failed.
+func (m *KeysMutation) OldField(ctx context.Context, name string) (ent.Value, error) {
+	switch name {
+	case keys.FieldVerificationKeys:
+		return m.OldVerificationKeys(ctx)
+	case keys.FieldSigningKey:
+		return m.OldSigningKey(ctx)
+	case keys.FieldSigningKeyPub:
+		return m.OldSigningKeyPub(ctx)
+	case keys.FieldNextRotation:
+		return m.OldNextRotation(ctx)
+	}
+	return nil, fmt.Errorf("unknown Keys field %s", name)
+}
+
+// SetField sets the value of a field with the given name. It returns an error if
+// the field is not defined in the schema, or if the type mismatched the field
+// type.
+func (m *KeysMutation) SetField(name string, value ent.Value) error {
+	switch name {
+	case keys.FieldVerificationKeys:
+		v, ok := value.([]storage.VerificationKey)
+		if !ok {
+			return fmt.Errorf("unexpected type %T for field %s", value, name)
+		}
+		m.SetVerificationKeys(v)
+		return nil
+	case keys.FieldSigningKey:
+		v, ok := value.(jose.JSONWebKey)
+		if !ok {
+			return fmt.Errorf("unexpected type %T for field %s", value, name)
+		}
+		m.SetSigningKey(v)
+		return nil
+	case keys.FieldSigningKeyPub:
+		v, ok := value.(jose.JSONWebKey)
+		if !ok {
+			return fmt.Errorf("unexpected type %T for field %s", value, name)
+		}
+		m.SetSigningKeyPub(v)
+		return nil
+	case keys.FieldNextRotation:
+		v, ok := value.(time.Time)
+		if !ok {
+			return fmt.Errorf("unexpected type %T for field %s", value, name)
+		}
+		m.SetNextRotation(v)
+		return nil
+	}
+	return fmt.Errorf("unknown Keys field %s", name)
+}
+
+// AddedFields returns all numeric fields that were incremented/decremented during
+// this mutation.
+func (m *KeysMutation) AddedFields() []string {
+	return nil
+}
+
+// AddedField returns the numeric value that was incremented/decremented on a field
+// with the given name. The second boolean return value indicates that this field
+// was not set, or was not defined in the schema.
+func (m *KeysMutation) AddedField(name string) (ent.Value, bool) {
+	return nil, false
+}
+
+// AddField adds the value to the field with the given name. It returns an error if
+// the field is not defined in the schema, or if the type mismatched the field
+// type.
+func (m *KeysMutation) AddField(name string, value ent.Value) error {
+	switch name {
+	}
+	return fmt.Errorf("unknown Keys numeric field %s", name)
+}
+
+// ClearedFields returns all nullable fields that were cleared during this
+// mutation.
+func (m *KeysMutation) ClearedFields() []string {
+	return nil
+}
+
+// FieldCleared returns a boolean indicating if a field with the given name was
+// cleared in this mutation.
+func (m *KeysMutation) FieldCleared(name string) bool {
+	_, ok := m.clearedFields[name]
+	return ok
+}
+
+// ClearField clears the value of the field with the given name. It returns an
+// error if the field is not defined in the schema.
+func (m *KeysMutation) ClearField(name string) error {
+	return fmt.Errorf("unknown Keys nullable field %s", name)
+}
+
+// ResetField resets all changes in the mutation for the field with the given name.
+// It returns an error if the field is not defined in the schema.
 func (m *KeysMutation) ResetField(name string) error {
 	switch name {
-	case keys.FieldVerificationKeys:
-		m.ResetVerificationKeys()
+	case keys.FieldVerificationKeys:
+		m.ResetVerificationKeys()
+		return nil
+	case keys.FieldSigningKey:
+		m.ResetSigningKey()
+		return nil
+	case keys.FieldSigningKeyPub:
+		m.ResetSigningKeyPub()
+		return nil
+	case keys.FieldNextRotation:
+		m.ResetNextRotation()
+		return nil
+	}
+	return fmt.Errorf("unknown Keys field %s", name)
+}
+
+// AddedEdges returns all edge names that were set/added in this mutation.
+func (m *KeysMutation) AddedEdges() []string {
+	edges := make([]string, 0, 0)
+	return edges
+}
+
+// AddedIDs returns all IDs (to other nodes) that were added for the given edge
+// name in this mutation.
+func (m *KeysMutation) AddedIDs(name string) []ent.Value {
+	return nil
+}
+
+// RemovedEdges returns all edge names that were removed in this mutation.
+func (m *KeysMutation) RemovedEdges() []string {
+	edges := make([]string, 0, 0)
+	return edges
+}
+
+// RemovedIDs returns all IDs (to other nodes) that were removed for the edge with
+// the given name in this mutation.
+func (m *KeysMutation) RemovedIDs(name string) []ent.Value {
+	return nil
+}
+
+// ClearedEdges returns all edge names that were cleared in this mutation.
+func (m *KeysMutation) ClearedEdges() []string {
+	edges := make([]string, 0, 0)
+	return edges
+}
+
+// EdgeCleared returns a boolean which indicates if the edge with the given name
+// was cleared in this mutation.
+func (m *KeysMutation) EdgeCleared(name string) bool {
+	return false
+}
+
+// ClearEdge clears the value of the edge with the given name. It returns an error
+// if that edge is not defined in the schema.
+func (m *KeysMutation) ClearEdge(name string) error {
+	return fmt.Errorf("unknown Keys unique edge %s", name)
+}
+
+// ResetEdge resets all changes to the edge with the given name in this mutation.
+// It returns an error if the edge is not defined in the schema.
+func (m *KeysMutation) ResetEdge(name string) error {
+	return fmt.Errorf("unknown Keys edge %s", name)
+}
+
+// OAuth2ClientMutation represents an operation that mutates the OAuth2Client nodes in the graph.
+type OAuth2ClientMutation struct {
+	config
+	op                              Op
+	typ                             string
+	id                              *string
+	secret                          *string
+	redirect_uris                   *[]string
+	appendredirect_uris             []string
+	trusted_peers                   *[]string
+	appendtrusted_peers             []string
+	public                          *bool
+	name                            *string
+	logo_url                        *string
+	allowed_connectors              *[]string
+	appendallowed_connectors        []string
+	mfa_chain                       *[]string
+	appendmfa_chain                 []string
+	post_logout_redirect_uris       *[]string
+	appendpost_logout_redirect_uris []string
+	sso_shared_with                 *[]string
+	appendsso_shared_with           []string
+	backchannel_logout_uri          *string
+	refresh_token_lifetime          *string
+	client_credentials_claims       **storage.ClientCredentialsClaims
+	clearedFields                   map[string]struct{}
+	done                            bool
+	oldValue                        func(context.Context) (*OAuth2Client, error)
+	predicates                      []predicate.OAuth2Client
+}
+
+var _ ent.Mutation = (*OAuth2ClientMutation)(nil)
+
+// oauth2clientOption allows management of the mutation configuration using functional options.
+type oauth2clientOption func(*OAuth2ClientMutation)
+
+// newOAuth2ClientMutation creates new mutation for the OAuth2Client entity.
+func newOAuth2ClientMutation(c config, op Op, opts ...oauth2clientOption) *OAuth2ClientMutation {
+	m := &OAuth2ClientMutation{
+		config:        c,
+		op:            op,
+		typ:           TypeOAuth2Client,
+		clearedFields: make(map[string]struct{}),
+	}
+	for _, opt := range opts {
+		opt(m)
+	}
+	return m
+}
+
+// withOAuth2ClientID sets the ID field of the mutation.
+func withOAuth2ClientID(id string) oauth2clientOption {
+	return func(m *OAuth2ClientMutation) {
+		var (
+			err   error
+			once  sync.Once
+			value *OAuth2Client
+		)
+		m.oldValue = func(ctx context.Context) (*OAuth2Client, error) {
+			once.Do(func() {
+				if m.done {
+					err = errors.New("querying old values post mutation is not allowed")
+				} else {
+					value, err = m.Client().OAuth2Client.Get(ctx, id)
+				}
+			})
+			return value, err
+		}
+		m.id = &id
+	}
+}
+
+// withOAuth2Client sets the old OAuth2Client of the mutation.
+func withOAuth2Client(node *OAuth2Client) oauth2clientOption {
+	return func(m *OAuth2ClientMutation) {
+		m.oldValue = func(context.Context) (*OAuth2Client, error) {
+			return node, nil
+		}
+		m.id = &node.ID
+	}
+}
+
+// Client returns a new `ent.Client` from the mutation. If the mutation was
+// executed in a transaction (ent.Tx), a transactional client is returned.
+func (m OAuth2ClientMutation) Client() *Client {
+	client := &Client{config: m.config}
+	client.init()
+	return client
+}
+
+// Tx returns an `ent.Tx` for mutations that were executed in transactions;
+// it returns an error otherwise.
+func (m OAuth2ClientMutation) Tx() (*Tx, error) {
+	if _, ok := m.driver.(*txDriver); !ok {
+		return nil, errors.New("db: mutation is not running in a transaction")
+	}
+	tx := &Tx{config: m.config}
+	tx.init()
+	return tx, nil
+}
+
+// SetID sets the value of the id field. Note that this
+// operation is only accepted on creation of OAuth2Client entities.
+func (m *OAuth2ClientMutation) SetID(id string) {
+	m.id = &id
+}
+
+// ID returns the ID value in the mutation. Note that the ID is only available
+// if it was provided to the builder or after it was returned from the database.
+func (m *OAuth2ClientMutation) ID() (id string, exists bool) {
+	if m.id == nil {
+		return
+	}
+	return *m.id, true
+}
+
+// IDs queries the database and returns the entity ids that match the mutation's predicate.
+// That means, if the mutation is applied within a transaction with an isolation level such
+// as sql.LevelSerializable, the returned ids match the ids of the rows that will be updated
+// or updated by the mutation.
+func (m *OAuth2ClientMutation) IDs(ctx context.Context) ([]string, error) {
+	switch {
+	case m.op.Is(OpUpdateOne | OpDeleteOne):
+		id, exists := m.ID()
+		if exists {
+			return []string{id}, nil
+		}
+		fallthrough
+	case m.op.Is(OpUpdate | OpDelete):
+		return m.Client().OAuth2Client.Query().Where(m.predicates...).IDs(ctx)
+	default:
+		return nil, fmt.Errorf("IDs is not allowed on %s operations", m.op)
+	}
+}
+
+// SetSecret sets the "secret" field.
+func (m *OAuth2ClientMutation) SetSecret(s string) {
+	m.secret = &s
+}
+
+// Secret returns the value of the "secret" field in the mutation.
+func (m *OAuth2ClientMutation) Secret() (r string, exists bool) {
+	v := m.secret
+	if v == nil {
+		return
+	}
+	return *v, true
+}
+
+// OldSecret returns the old "secret" field's value of the OAuth2Client entity.
+// If the OAuth2Client object wasn't provided to the builder, the object is fetched from the database.
+// An error is returned if the mutation operation is not UpdateOne, or the database query fails.
+func (m *OAuth2ClientMutation) OldSecret(ctx context.Context) (v string, err error) {
+	if !m.op.Is(OpUpdateOne) {
+		return v, errors.New("OldSecret is only allowed on UpdateOne operations")
+	}
+	if m.id == nil || m.oldValue == nil {
+		return v, errors.New("OldSecret requires an ID field in the mutation")
+	}
+	oldValue, err := m.oldValue(ctx)
+	if err != nil {
+		return v, fmt.Errorf("querying old value for OldSecret: %w", err)
+	}
+	return oldValue.Secret, nil
+}
+
+// ResetSecret resets all changes to the "secret" field.
+func (m *OAuth2ClientMutation) ResetSecret() {
+	m.secret = nil
+}
+
+// SetRedirectUris sets the "redirect_uris" field.
+func (m *OAuth2ClientMutation) SetRedirectUris(s []string) {
+	m.redirect_uris = &s
+	m.appendredirect_uris = nil
+}
+
+// RedirectUris returns the value of the "redirect_uris" field in the mutation.
+func (m *OAuth2ClientMutation) RedirectUris() (r []string, exists bool) {
+	v := m.redirect_uris
+	if v == nil {
+		return
+	}
+	return *v, true
+}
+
+// OldRedirectUris returns the old "redirect_uris" field's value of the OAuth2Client entity.
+// If the OAuth2Client object wasn't provided to the builder, the object is fetched from the database.
+// An error is returned if the mutation operation is not UpdateOne, or the database query fails.
+func (m *OAuth2ClientMutation) OldRedirectUris(ctx context.Context) (v []string, err error) {
+	if !m.op.Is(OpUpdateOne) {
+		return v, errors.New("OldRedirectUris is only allowed on UpdateOne operations")
+	}
+	if m.id == nil || m.oldValue == nil {
+		return v, errors.New("OldRedirectUris requires an ID field in the mutation")
+	}
+	oldValue, err := m.oldValue(ctx)
+	if err != nil {
+		return v, fmt.Errorf("querying old value for OldRedirectUris: %w", err)
+	}
+	return oldValue.RedirectUris, nil
+}
+
+// AppendRedirectUris adds s to the "redirect_uris" field.
+func (m *OAuth2ClientMutation) AppendRedirectUris(s []string) {
+	m.appendredirect_uris = append(m.appendredirect_uris, s...)
+}
+
+// AppendedRedirectUris returns the list of values that were appended to the "redirect_uris" field in this mutation.
+func (m *OAuth2ClientMutation) AppendedRedirectUris() ([]string, bool) {
+	if len(m.appendredirect_uris) == 0 {
+		return nil, false
+	}
+	return m.appendredirect_uris, true
+}
+
+// ClearRedirectUris clears the value of the "redirect_uris" field.
+func (m *OAuth2ClientMutation) ClearRedirectUris() {
+	m.redirect_uris = nil
+	m.appendredirect_uris = nil
+	m.clearedFields[oauth2client.FieldRedirectUris] = struct{}{}
+}
+
+// RedirectUrisCleared returns if the "redirect_uris" field was cleared in this mutation.
+func (m *OAuth2ClientMutation) RedirectUrisCleared() bool {
+	_, ok := m.clearedFields[oauth2client.FieldRedirectUris]
+	return ok
+}
+
+// ResetRedirectUris resets all changes to the "redirect_uris" field.
+func (m *OAuth2ClientMutation) ResetRedirectUris() {
+	m.redirect_uris = nil
+	m.appendredirect_uris = nil
+	delete(m.clearedFields, oauth2client.FieldRedirectUris)
+}
+
+// SetTrustedPeers sets the "trusted_peers" field.
+func (m *OAuth2ClientMutation) SetTrustedPeers(s []string) {
+	m.trusted_peers = &s
+	m.appendtrusted_peers = nil
+}
+
+// TrustedPeers returns the value of the "trusted_peers" field in the mutation.
+func (m *OAuth2ClientMutation) TrustedPeers() (r []string, exists bool) {
+	v := m.trusted_peers
+	if v == nil {
+		return
+	}
+	return *v, true
+}
+
+// OldTrustedPeers returns the old "trusted_peers" field's value of the OAuth2Client entity.
+// If the OAuth2Client object wasn't provided to the builder, the object is fetched from the database.
+// An error is returned if the mutation operation is not UpdateOne, or the database query fails.
+func (m *OAuth2ClientMutation) OldTrustedPeers(ctx context.Context) (v []string, err error) {
+	if !m.op.Is(OpUpdateOne) {
+		return v, errors.New("OldTrustedPeers is only allowed on UpdateOne operations")
+	}
+	if m.id == nil || m.oldValue == nil {
+		return v, errors.New("OldTrustedPeers requires an ID field in the mutation")
+	}
+	oldValue, err := m.oldValue(ctx)
+	if err != nil {
+		return v, fmt.Errorf("querying old value for OldTrustedPeers: %w", err)
+	}
+	return oldValue.TrustedPeers, nil
+}
+
+// AppendTrustedPeers adds s to the "trusted_peers" field.
+func (m *OAuth2ClientMutation) AppendTrustedPeers(s []string) {
+	m.appendtrusted_peers = append(m.appendtrusted_peers, s...)
+}
+
+// AppendedTrustedPeers returns the list of values that were appended to the "trusted_peers" field in this mutation.
+func (m *OAuth2ClientMutation) AppendedTrustedPeers() ([]string, bool) {
+	if len(m.appendtrusted_peers) == 0 {
+		return nil, false
+	}
+	return m.appendtrusted_peers, true
+}
+
+// ClearTrustedPeers clears the value of the "trusted_peers" field.
+func (m *OAuth2ClientMutation) ClearTrustedPeers() {
+	m.trusted_peers = nil
+	m.appendtrusted_peers = nil
+	m.clearedFields[oauth2client.FieldTrustedPeers] = struct{}{}
+}
+
+// TrustedPeersCleared returns if the "trusted_peers" field was cleared in this mutation.
+func (m *OAuth2ClientMutation) TrustedPeersCleared() bool {
+	_, ok := m.clearedFields[oauth2client.FieldTrustedPeers]
+	return ok
+}
+
+// ResetTrustedPeers resets all changes to the "trusted_peers" field.
+func (m *OAuth2ClientMutation) ResetTrustedPeers() {
+	m.trusted_peers = nil
+	m.appendtrusted_peers = nil
+	delete(m.clearedFields, oauth2client.FieldTrustedPeers)
+}
+
+// SetPublic sets the "public" field.
+func (m *OAuth2ClientMutation) SetPublic(b bool) {
+	m.public = &b
+}
+
+// Public returns the value of the "public" field in the mutation.
+func (m *OAuth2ClientMutation) Public() (r bool, exists bool) {
+	v := m.public
+	if v == nil {
+		return
+	}
+	return *v, true
+}
+
+// OldPublic returns the old "public" field's value of the OAuth2Client entity.
+// If the OAuth2Client object wasn't provided to the builder, the object is fetched from the database.
+// An error is returned if the mutation operation is not UpdateOne, or the database query fails.
+func (m *OAuth2ClientMutation) OldPublic(ctx context.Context) (v bool, err error) {
+	if !m.op.Is(OpUpdateOne) {
+		return v, errors.New("OldPublic is only allowed on UpdateOne operations")
+	}
+	if m.id == nil || m.oldValue == nil {
+		return v, errors.New("OldPublic requires an ID field in the mutation")
+	}
+	oldValue, err := m.oldValue(ctx)
+	if err != nil {
+		return v, fmt.Errorf("querying old value for OldPublic: %w", err)
+	}
+	return oldValue.Public, nil
+}
+
+// ResetPublic resets all changes to the "public" field.
+func (m *OAuth2ClientMutation) ResetPublic() {
+	m.public = nil
+}
+
+// SetName sets the "name" field.
+func (m *OAuth2ClientMutation) SetName(s string) {
+	m.name = &s
+}
+
+// Name returns the value of the "name" field in the mutation.
+func (m *OAuth2ClientMutation) Name() (r string, exists bool) {
+	v := m.name
+	if v == nil {
+		return
+	}
+	return *v, true
+}
+
+// OldName returns the old "name" field's value of the OAuth2Client entity.
+// If the OAuth2Client object wasn't provided to the builder, the object is fetched from the database.
+// An error is returned if the mutation operation is not UpdateOne, or the database query fails.
+func (m *OAuth2ClientMutation) OldName(ctx context.Context) (v string, err error) {
+	if !m.op.Is(OpUpdateOne) {
+		return v, errors.New("OldName is only allowed on UpdateOne operations")
+	}
+	if m.id == nil || m.oldValue == nil {
+		return v, errors.New("OldName requires an ID field in the mutation")
+	}
+	oldValue, err := m.oldValue(ctx)
+	if err != nil {
+		return v, fmt.Errorf("querying old value for OldName: %w", err)
+	}
+	return oldValue.Name, nil
+}
+
+// ResetName resets all changes to the "name" field.
+func (m *OAuth2ClientMutation) ResetName() {
+	m.name = nil
+}
+
+// SetLogoURL sets the "logo_url" field.
+func (m *OAuth2ClientMutation) SetLogoURL(s string) {
+	m.logo_url = &s
+}
+
+// LogoURL returns the value of the "logo_url" field in the mutation.
+func (m *OAuth2ClientMutation) LogoURL() (r string, exists bool) {
+	v := m.logo_url
+	if v == nil {
+		return
+	}
+	return *v, true
+}
+
+// OldLogoURL returns the old "logo_url" field's value of the OAuth2Client entity.
+// If the OAuth2Client object wasn't provided to the builder, the object is fetched from the database.
+// An error is returned if the mutation operation is not UpdateOne, or the database query fails.
+func (m *OAuth2ClientMutation) OldLogoURL(ctx context.Context) (v string, err error) {
+	if !m.op.Is(OpUpdateOne) {
+		return v, errors.New("OldLogoURL is only allowed on UpdateOne operations")
+	}
+	if m.id == nil || m.oldValue == nil {
+		return v, errors.New("OldLogoURL requires an ID field in the mutation")
+	}
+	oldValue, err := m.oldValue(ctx)
+	if err != nil {
+		return v, fmt.Errorf("querying old value for OldLogoURL: %w", err)
+	}
+	return oldValue.LogoURL, nil
+}
+
+// ResetLogoURL resets all changes to the "logo_url" field.
+func (m *OAuth2ClientMutation) ResetLogoURL() {
+	m.logo_url = nil
+}
+
+// SetAllowedConnectors sets the "allowed_connectors" field.
+func (m *OAuth2ClientMutation) SetAllowedConnectors(s []string) {
+	m.allowed_connectors = &s
+	m.appendallowed_connectors = nil
+}
+
+// AllowedConnectors returns the value of the "allowed_connectors" field in the mutation.
+func (m *OAuth2ClientMutation) AllowedConnectors() (r []string, exists bool) {
+	v := m.allowed_connectors
+	if v == nil {
+		return
+	}
+	return *v, true
+}
+
+// OldAllowedConnectors returns the old "allowed_connectors" field's value of the OAuth2Client entity.
+// If the OAuth2Client object wasn't provided to the builder, the object is fetched from the database.
+// An error is returned if the mutation operation is not UpdateOne, or the database query fails.
+func (m *OAuth2ClientMutation) OldAllowedConnectors(ctx context.Context) (v []string, err error) {
+	if !m.op.Is(OpUpdateOne) {
+		return v, errors.New("OldAllowedConnectors is only allowed on UpdateOne operations")
+	}
+	if m.id == nil || m.oldValue == nil {
+		return v, errors.New("OldAllowedConnectors requires an ID field in the mutation")
+	}
+	oldValue, err := m.oldValue(ctx)
+	if err != nil {
+		return v, fmt.Errorf("querying old value for OldAllowedConnectors: %w", err)
+	}
+	return oldValue.AllowedConnectors, nil
+}
+
+// AppendAllowedConnectors adds s to the "allowed_connectors" field.
+func (m *OAuth2ClientMutation) AppendAllowedConnectors(s []string) {
+	m.appendallowed_connectors = append(m.appendallowed_connectors, s...)
+}
+
+// AppendedAllowedConnectors returns the list of values that were appended to the "allowed_connectors" field in this mutation.
+func (m *OAuth2ClientMutation) AppendedAllowedConnectors() ([]string, bool) {
+	if len(m.appendallowed_connectors) == 0 {
+		return nil, false
+	}
+	return m.appendallowed_connectors, true
+}
+
+// ClearAllowedConnectors clears the value of the "allowed_connectors" field.
+func (m *OAuth2ClientMutation) ClearAllowedConnectors() {
+	m.allowed_connectors = nil
+	m.appendallowed_connectors = nil
+	m.clearedFields[oauth2client.FieldAllowedConnectors] = struct{}{}
+}
+
+// AllowedConnectorsCleared returns if the "allowed_connectors" field was cleared in this mutation.
+func (m *OAuth2ClientMutation) AllowedConnectorsCleared() bool {
+	_, ok := m.clearedFields[oauth2client.FieldAllowedConnectors]
+	return ok
+}
+
+// ResetAllowedConnectors resets all changes to the "allowed_connectors" field.
+func (m *OAuth2ClientMutation) ResetAllowedConnectors() {
+	m.allowed_connectors = nil
+	m.appendallowed_connectors = nil
+	delete(m.clearedFields, oauth2client.FieldAllowedConnectors)
+}
+
+// SetMfaChain sets the "mfa_chain" field.
+func (m *OAuth2ClientMutation) SetMfaChain(s []string) {
+	m.mfa_chain = &s
+	m.appendmfa_chain = nil
+}
+
+// MfaChain returns the value of the "mfa_chain" field in the mutation.
+func (m *OAuth2ClientMutation) MfaChain() (r []string, exists bool) {
+	v := m.mfa_chain
+	if v == nil {
+		return
+	}
+	return *v, true
+}
+
+// OldMfaChain returns the old "mfa_chain" field's value of the OAuth2Client entity.
+// If the OAuth2Client object wasn't provided to the builder, the object is fetched from the database.
+// An error is returned if the mutation operation is not UpdateOne, or the database query fails.
+func (m *OAuth2ClientMutation) OldMfaChain(ctx context.Context) (v []string, err error) {
+	if !m.op.Is(OpUpdateOne) {
+		return v, errors.New("OldMfaChain is only allowed on UpdateOne operations")
+	}
+	if m.id == nil || m.oldValue == nil {
+		return v, errors.New("OldMfaChain requires an ID field in the mutation")
+	}
+	oldValue, err := m.oldValue(ctx)
+	if err != nil {
+		return v, fmt.Errorf("querying old value for OldMfaChain: %w", err)
+	}
+	return oldValue.MfaChain, nil
+}
+
+// AppendMfaChain adds s to the "mfa_chain" field.
+func (m *OAuth2ClientMutation) AppendMfaChain(s []string) {
+	m.appendmfa_chain = append(m.appendmfa_chain, s...)
+}
+
+// AppendedMfaChain returns the list of values that were appended to the "mfa_chain" field in this mutation.
+func (m *OAuth2ClientMutation) AppendedMfaChain() ([]string, bool) {
+	if len(m.appendmfa_chain) == 0 {
+		return nil, false
+	}
+	return m.appendmfa_chain, true
+}
+
+// ClearMfaChain clears the value of the "mfa_chain" field.
+func (m *OAuth2ClientMutation) ClearMfaChain() {
+	m.mfa_chain = nil
+	m.appendmfa_chain = nil
+	m.clearedFields[oauth2client.FieldMfaChain] = struct{}{}
+}
+
+// MfaChainCleared returns if the "mfa_chain" field was cleared in this mutation.
+func (m *OAuth2ClientMutation) MfaChainCleared() bool {
+	_, ok := m.clearedFields[oauth2client.FieldMfaChain]
+	return ok
+}
+
+// ResetMfaChain resets all changes to the "mfa_chain" field.
+func (m *OAuth2ClientMutation) ResetMfaChain() {
+	m.mfa_chain = nil
+	m.appendmfa_chain = nil
+	delete(m.clearedFields, oauth2client.FieldMfaChain)
+}
+
+// SetPostLogoutRedirectUris sets the "post_logout_redirect_uris" field.
+func (m *OAuth2ClientMutation) SetPostLogoutRedirectUris(s []string) {
+	m.post_logout_redirect_uris = &s
+	m.appendpost_logout_redirect_uris = nil
+}
+
+// PostLogoutRedirectUris returns the value of the "post_logout_redirect_uris" field in the mutation.
+func (m *OAuth2ClientMutation) PostLogoutRedirectUris() (r []string, exists bool) {
+	v := m.post_logout_redirect_uris
+	if v == nil {
+		return
+	}
+	return *v, true
+}
+
+// OldPostLogoutRedirectUris returns the old "post_logout_redirect_uris" field's value of the OAuth2Client entity.
+// If the OAuth2Client object wasn't provided to the builder, the object is fetched from the database.
+// An error is returned if the mutation operation is not UpdateOne, or the database query fails.
+func (m *OAuth2ClientMutation) OldPostLogoutRedirectUris(ctx context.Context) (v []string, err error) {
+	if !m.op.Is(OpUpdateOne) {
+		return v, errors.New("OldPostLogoutRedirectUris is only allowed on UpdateOne operations")
+	}
+	if m.id == nil || m.oldValue == nil {
+		return v, errors.New("OldPostLogoutRedirectUris requires an ID field in the mutation")
+	}
+	oldValue, err := m.oldValue(ctx)
+	if err != nil {
+		return v, fmt.Errorf("querying old value for OldPostLogoutRedirectUris: %w", err)
+	}
+	return oldValue.PostLogoutRedirectUris, nil
+}
+
+// AppendPostLogoutRedirectUris adds s to the "post_logout_redirect_uris" field.
+func (m *OAuth2ClientMutation) AppendPostLogoutRedirectUris(s []string) {
+	m.appendpost_logout_redirect_uris = append(m.appendpost_logout_redirect_uris, s...)
+}
+
+// AppendedPostLogoutRedirectUris returns the list of values that were appended to the "post_logout_redirect_uris" field in this mutation.
+func (m *OAuth2ClientMutation) AppendedPostLogoutRedirectUris() ([]string, bool) {
+	if len(m.appendpost_logout_redirect_uris) == 0 {
+		return nil, false
+	}
+	return m.appendpost_logout_redirect_uris, true
+}
+
+// ClearPostLogoutRedirectUris clears the value of the "post_logout_redirect_uris" field.
+func (m *OAuth2ClientMutation) ClearPostLogoutRedirectUris() {
+	m.post_logout_redirect_uris = nil
+	m.appendpost_logout_redirect_uris = nil
+	m.clearedFields[oauth2client.FieldPostLogoutRedirectUris] = struct{}{}
+}
+
+// PostLogoutRedirectUrisCleared returns if the "post_logout_redirect_uris" field was cleared in this mutation.
+func (m *OAuth2ClientMutation) PostLogoutRedirectUrisCleared() bool {
+	_, ok := m.clearedFields[oauth2client.FieldPostLogoutRedirectUris]
+	return ok
+}
+
+// ResetPostLogoutRedirectUris resets all changes to the "post_logout_redirect_uris" field.
+func (m *OAuth2ClientMutation) ResetPostLogoutRedirectUris() {
+	m.post_logout_redirect_uris = nil
+	m.appendpost_logout_redirect_uris = nil
+	delete(m.clearedFields, oauth2client.FieldPostLogoutRedirectUris)
+}
+
+// SetSSOSharedWith sets the "sso_shared_with" field.
+func (m *OAuth2ClientMutation) SetSSOSharedWith(s []string) {
+	m.sso_shared_with = &s
+	m.appendsso_shared_with = nil
+}
+
+// SSOSharedWith returns the value of the "sso_shared_with" field in the mutation.
+func (m *OAuth2ClientMutation) SSOSharedWith() (r []string, exists bool) {
+	v := m.sso_shared_with
+	if v == nil {
+		return
+	}
+	return *v, true
+}
+
+// OldSSOSharedWith returns the old "sso_shared_with" field's value of the OAuth2Client entity.
+// If the OAuth2Client object wasn't provided to the builder, the object is fetched from the database.
+// An error is returned if the mutation operation is not UpdateOne, or the database query fails.
+func (m *OAuth2ClientMutation) OldSSOSharedWith(ctx context.Context) (v []string, err error) {
+	if !m.op.Is(OpUpdateOne) {
+		return v, errors.New("OldSSOSharedWith is only allowed on UpdateOne operations")
+	}
+	if m.id == nil || m.oldValue == nil {
+		return v, errors.New("OldSSOSharedWith requires an ID field in the mutation")
+	}
+	oldValue, err := m.oldValue(ctx)
+	if err != nil {
+		return v, fmt.Errorf("querying old value for OldSSOSharedWith: %w", err)
+	}
+	return oldValue.SSOSharedWith, nil
+}
+
+// AppendSSOSharedWith adds s to the "sso_shared_with" field.
+func (m *OAuth2ClientMutation) AppendSSOSharedWith(s []string) {
+	m.appendsso_shared_with = append(m.appendsso_shared_with, s...)
+}
+
+// AppendedSSOSharedWith returns the list of values that were appended to the "sso_shared_with" field in this mutation.
+func (m *OAuth2ClientMutation) AppendedSSOSharedWith() ([]string, bool) {
+	if len(m.appendsso_shared_with) == 0 {
+		return nil, false
+	}
+	return m.appendsso_shared_with, true
+}
+
+// ClearSSOSharedWith clears the value of the "sso_shared_with" field.
+func (m *OAuth2ClientMutation) ClearSSOSharedWith() {
+	m.sso_shared_with = nil
+	m.appendsso_shared_with = nil
+	m.clearedFields[oauth2client.FieldSSOSharedWith] = struct{}{}
+}
+
+// SSOSharedWithCleared returns if the "sso_shared_with" field was cleared in this mutation.
+func (m *OAuth2ClientMutation) SSOSharedWithCleared() bool {
+	_, ok := m.clearedFields[oauth2client.FieldSSOSharedWith]
+	return ok
+}
+
+// ResetSSOSharedWith resets all changes to the "sso_shared_with" field.
+func (m *OAuth2ClientMutation) ResetSSOSharedWith() {
+	m.sso_shared_with = nil
+	m.appendsso_shared_with = nil
+	delete(m.clearedFields, oauth2client.FieldSSOSharedWith)
+}
+
+// SetBackchannelLogoutURI sets the "backchannel_logout_uri" field.
+func (m *OAuth2ClientMutation) SetBackchannelLogoutURI(s string) {
+	m.backchannel_logout_uri = &s
+}
+
+// BackchannelLogoutURI returns the value of the "backchannel_logout_uri" field in the mutation.
+func (m *OAuth2ClientMutation) BackchannelLogoutURI() (r string, exists bool) {
+	v := m.backchannel_logout_uri
+	if v == nil {
+		return
+	}
+	return *v, true
+}
+
+// OldBackchannelLogoutURI returns the old "backchannel_logout_uri" field's value of the OAuth2Client entity.
+// If the OAuth2Client object wasn't provided to the builder, the object is fetched from the database.
+// An error is returned if the mutation operation is not UpdateOne, or the database query fails.
+func (m *OAuth2ClientMutation) OldBackchannelLogoutURI(ctx context.Context) (v string, err error) {
+	if !m.op.Is(OpUpdateOne) {
+		return v, errors.New("OldBackchannelLogoutURI is only allowed on UpdateOne operations")
+	}
+	if m.id == nil || m.oldValue == nil {
+		return v, errors.New("OldBackchannelLogoutURI requires an ID field in the mutation")
+	}
+	oldValue, err := m.oldValue(ctx)
+	if err != nil {
+		return v, fmt.Errorf("querying old value for OldBackchannelLogoutURI: %w", err)
+	}
+	return oldValue.BackchannelLogoutURI, nil
+}
+
+// ClearBackchannelLogoutURI clears the value of the "backchannel_logout_uri" field.
+func (m *OAuth2ClientMutation) ClearBackchannelLogoutURI() {
+	m.backchannel_logout_uri = nil
+	m.clearedFields[oauth2client.FieldBackchannelLogoutURI] = struct{}{}
+}
+
+// BackchannelLogoutURICleared returns if the "backchannel_logout_uri" field was cleared in this mutation.
+func (m *OAuth2ClientMutation) BackchannelLogoutURICleared() bool {
+	_, ok := m.clearedFields[oauth2client.FieldBackchannelLogoutURI]
+	return ok
+}
+
+// ResetBackchannelLogoutURI resets all changes to the "backchannel_logout_uri" field.
+func (m *OAuth2ClientMutation) ResetBackchannelLogoutURI() {
+	m.backchannel_logout_uri = nil
+	delete(m.clearedFields, oauth2client.FieldBackchannelLogoutURI)
+}
+
+// SetRefreshTokenLifetime sets the "refresh_token_lifetime" field.
+func (m *OAuth2ClientMutation) SetRefreshTokenLifetime(s string) {
+	m.refresh_token_lifetime = &s
+}
+
+// RefreshTokenLifetime returns the value of the "refresh_token_lifetime" field in the mutation.
+func (m *OAuth2ClientMutation) RefreshTokenLifetime() (r string, exists bool) {
+	v := m.refresh_token_lifetime
+	if v == nil {
+		return
+	}
+	return *v, true
+}
+
+// OldRefreshTokenLifetime returns the old "refresh_token_lifetime" field's value of the OAuth2Client entity.
+// If the OAuth2Client object wasn't provided to the builder, the object is fetched from the database.
+// An error is returned if the mutation operation is not UpdateOne, or the database query fails.
+func (m *OAuth2ClientMutation) OldRefreshTokenLifetime(ctx context.Context) (v string, err error) {
+	if !m.op.Is(OpUpdateOne) {
+		return v, errors.New("OldRefreshTokenLifetime is only allowed on UpdateOne operations")
+	}
+	if m.id == nil || m.oldValue == nil {
+		return v, errors.New("OldRefreshTokenLifetime requires an ID field in the mutation")
+	}
+	oldValue, err := m.oldValue(ctx)
+	if err != nil {
+		return v, fmt.Errorf("querying old value for OldRefreshTokenLifetime: %w", err)
+	}
+	return oldValue.RefreshTokenLifetime, nil
+}
+
+// ClearRefreshTokenLifetime clears the value of the "refresh_token_lifetime" field.
+func (m *OAuth2ClientMutation) ClearRefreshTokenLifetime() {
+	m.refresh_token_lifetime = nil
+	m.clearedFields[oauth2client.FieldRefreshTokenLifetime] = struct{}{}
+}
+
+// RefreshTokenLifetimeCleared returns if the "refresh_token_lifetime" field was cleared in this mutation.
+func (m *OAuth2ClientMutation) RefreshTokenLifetimeCleared() bool {
+	_, ok := m.clearedFields[oauth2client.FieldRefreshTokenLifetime]
+	return ok
+}
+
+// ResetRefreshTokenLifetime resets all changes to the "refresh_token_lifetime" field.
+func (m *OAuth2ClientMutation) ResetRefreshTokenLifetime() {
+	m.refresh_token_lifetime = nil
+	delete(m.clearedFields, oauth2client.FieldRefreshTokenLifetime)
+}
+
+// SetClientCredentialsClaims sets the "client_credentials_claims" field.
+func (m *OAuth2ClientMutation) SetClientCredentialsClaims(scc *storage.ClientCredentialsClaims) {
+	m.client_credentials_claims = &scc
+}
+
+// ClientCredentialsClaims returns the value of the "client_credentials_claims" field in the mutation.
+func (m *OAuth2ClientMutation) ClientCredentialsClaims() (r *storage.ClientCredentialsClaims, exists bool) {
+	v := m.client_credentials_claims
+	if v == nil {
+		return
+	}
+	return *v, true
+}
+
+// OldClientCredentialsClaims returns the old "client_credentials_claims" field's value of the OAuth2Client entity.
+// If the OAuth2Client object wasn't provided to the builder, the object is fetched from the database.
+// An error is returned if the mutation operation is not UpdateOne, or the database query fails.
+func (m *OAuth2ClientMutation) OldClientCredentialsClaims(ctx context.Context) (v *storage.ClientCredentialsClaims, err error) {
+	if !m.op.Is(OpUpdateOne) {
+		return v, errors.New("OldClientCredentialsClaims is only allowed on UpdateOne operations")
+	}
+	if m.id == nil || m.oldValue == nil {
+		return v, errors.New("OldClientCredentialsClaims requires an ID field in the mutation")
+	}
+	oldValue, err := m.oldValue(ctx)
+	if err != nil {
+		return v, fmt.Errorf("querying old value for OldClientCredentialsClaims: %w", err)
+	}
+	return oldValue.ClientCredentialsClaims, nil
+}
+
+// ClearClientCredentialsClaims clears the value of the "client_credentials_claims" field.
+func (m *OAuth2ClientMutation) ClearClientCredentialsClaims() {
+	m.client_credentials_claims = nil
+	m.clearedFields[oauth2client.FieldClientCredentialsClaims] = struct{}{}
+}
+
+// ClientCredentialsClaimsCleared returns if the "client_credentials_claims" field was cleared in this mutation.
+func (m *OAuth2ClientMutation) ClientCredentialsClaimsCleared() bool {
+	_, ok := m.clearedFields[oauth2client.FieldClientCredentialsClaims]
+	return ok
+}
+
+// ResetClientCredentialsClaims resets all changes to the "client_credentials_claims" field.
+func (m *OAuth2ClientMutation) ResetClientCredentialsClaims() {
+	m.client_credentials_claims = nil
+	delete(m.clearedFields, oauth2client.FieldClientCredentialsClaims)
+}
+
+// Where appends a list predicates to the OAuth2ClientMutation builder.
+func (m *OAuth2ClientMutation) Where(ps ...predicate.OAuth2Client) {
+	m.predicates = append(m.predicates, ps...)
+}
+
+// WhereP appends storage-level predicates to the OAuth2ClientMutation builder. Using this method,
+// users can use type-assertion to append predicates that do not depend on any generated package.
+func (m *OAuth2ClientMutation) WhereP(ps ...func(*sql.Selector)) {
+	p := make([]predicate.OAuth2Client, len(ps))
+	for i := range ps {
+		p[i] = ps[i]
+	}
+	m.Where(p...)
+}
+
+// Op returns the operation name.
+func (m *OAuth2ClientMutation) Op() Op {
+	return m.op
+}
+
+// SetOp allows setting the mutation operation.
+func (m *OAuth2ClientMutation) SetOp(op Op) {
+	m.op = op
+}
+
+// Type returns the node type of this mutation (OAuth2Client).
+func (m *OAuth2ClientMutation) Type() string {
+	return m.typ
+}
+
+// Fields returns all fields that were changed during this mutation. Note that in
+// order to get all numeric fields that were incremented/decremented, call
+// AddedFields().
+func (m *OAuth2ClientMutation) Fields() []string {
+	fields := make([]string, 0, 13)
+	if m.secret != nil {
+		fields = append(fields, oauth2client.FieldSecret)
+	}
+	if m.redirect_uris != nil {
+		fields = append(fields, oauth2client.FieldRedirectUris)
+	}
+	if m.trusted_peers != nil {
+		fields = append(fields, oauth2client.FieldTrustedPeers)
+	}
+	if m.public != nil {
+		fields = append(fields, oauth2client.FieldPublic)
+	}
+	if m.name != nil {
+		fields = append(fields, oauth2client.FieldName)
+	}
+	if m.logo_url != nil {
+		fields = append(fields, oauth2client.FieldLogoURL)
+	}
+	if m.allowed_connectors != nil {
+		fields = append(fields, oauth2client.FieldAllowedConnectors)
+	}
+	if m.mfa_chain != nil {
+		fields = append(fields, oauth2client.FieldMfaChain)
+	}
+	if m.post_logout_redirect_uris != nil {
+		fields = append(fields, oauth2client.FieldPostLogoutRedirectUris)
+	}
+	if m.sso_shared_with != nil {
+		fields = append(fields, oauth2client.FieldSSOSharedWith)
+	}
+	if m.backchannel_logout_uri != nil {
+		fields = append(fields, oauth2client.FieldBackchannelLogoutURI)
+	}
+	if m.refresh_token_lifetime != nil {
+		fields = append(fields, oauth2client.FieldRefreshTokenLifetime)
+	}
+	if m.client_credentials_claims != nil {
+		fields = append(fields, oauth2client.FieldClientCredentialsClaims)
+	}
+	return fields
+}
+
+// Field returns the value of a field with the given name. The second boolean
+// return value indicates that this field was not set, or was not defined in the
+// schema.
+func (m *OAuth2ClientMutation) Field(name string) (ent.Value, bool) {
+	switch name {
+	case oauth2client.FieldSecret:
+		return m.Secret()
+	case oauth2client.FieldRedirectUris:
+		return m.RedirectUris()
+	case oauth2client.FieldTrustedPeers:
+		return m.TrustedPeers()
+	case oauth2client.FieldPublic:
+		return m.Public()
+	case oauth2client.FieldName:
+		return m.Name()
+	case oauth2client.FieldLogoURL:
+		return m.LogoURL()
+	case oauth2client.FieldAllowedConnectors:
+		return m.AllowedConnectors()
+	case oauth2client.FieldMfaChain:
+		return m.MfaChain()
+	case oauth2client.FieldPostLogoutRedirectUris:
+		return m.PostLogoutRedirectUris()
+	case oauth2client.FieldSSOSharedWith:
+		return m.SSOSharedWith()
+	case oauth2client.FieldBackchannelLogoutURI:
+		return m.BackchannelLogoutURI()
+	case oauth2client.FieldRefreshTokenLifetime:
+		return m.RefreshTokenLifetime()
+	case oauth2client.FieldClientCredentialsClaims:
+		return m.ClientCredentialsClaims()
+	}
+	return nil, false
+}
+
+// OldField returns the old value of the field from the database. An error is
+// returned if the mutation operation is not UpdateOne, or the query to the
+// database failed.
+func (m *OAuth2ClientMutation) OldField(ctx context.Context, name string) (ent.Value, error) {
+	switch name {
+	case oauth2client.FieldSecret:
+		return m.OldSecret(ctx)
+	case oauth2client.FieldRedirectUris:
+		return m.OldRedirectUris(ctx)
+	case oauth2client.FieldTrustedPeers:
+		return m.OldTrustedPeers(ctx)
+	case oauth2client.FieldPublic:
+		return m.OldPublic(ctx)
+	case oauth2client.FieldName:
+		return m.OldName(ctx)
+	case oauth2client.FieldLogoURL:
+		return m.OldLogoURL(ctx)
+	case oauth2client.FieldAllowedConnectors:
+		return m.OldAllowedConnectors(ctx)
+	case oauth2client.FieldMfaChain:
+		return m.OldMfaChain(ctx)
+	case oauth2client.FieldPostLogoutRedirectUris:
+		return m.OldPostLogoutRedirectUris(ctx)
+	case oauth2client.FieldSSOSharedWith:
+		return m.OldSSOSharedWith(ctx)
+	case oauth2client.FieldBackchannelLogoutURI:
+		return m.OldBackchannelLogoutURI(ctx)
+	case oauth2client.FieldRefreshTokenLifetime:
+		return m.OldRefreshTokenLifetime(ctx)
+	case oauth2client.FieldClientCredentialsClaims:
+		return m.OldClientCredentialsClaims(ctx)
+	}
+	return nil, fmt.Errorf("unknown OAuth2Client field %s", name)
+}
+
+// SetField sets the value of a field with the given name. It returns an error if
+// the field is not defined in the schema, or if the type mismatched the field
+// type.
+func (m *OAuth2ClientMutation) SetField(name string, value ent.Value) error {
+	switch name {
+	case oauth2client.FieldSecret:
+		v, ok := value.(string)
+		if !ok {
+			return fmt.Errorf("unexpected type %T for field %s", value, name)
+		}
+		m.SetSecret(v)
+		return nil
+	case oauth2client.FieldRedirectUris:
+		v, ok := value.([]string)
+		if !ok {
+			return fmt.Errorf("unexpected type %T for field %s", value, name)
+		}
+		m.SetRedirectUris(v)
+		return nil
+	case oauth2client.FieldTrustedPeers:
+		v, ok := value.([]string)
+		if !ok {
+			return fmt.Errorf("unexpected type %T for field %s", value, name)
+		}
+		m.SetTrustedPeers(v)
+		return nil
+	case oauth2client.FieldPublic:
+		v, ok := value.(bool)
+		if !ok {
+			return fmt.Errorf("unexpected type %T for field %s", value, name)
+		}
+		m.SetPublic(v)
+		return nil
+	case oauth2client.FieldName:
+		v, ok := value.(string)
+		if !ok {
+			return fmt.Errorf("unexpected type %T for field %s", value, name)
+		}
+		m.SetName(v)
+		return nil
+	case oauth2client.FieldLogoURL:
+		v, ok := value.(string)
+		if !ok {
+			return fmt.Errorf("unexpected type %T for field %s", value, name)
+		}
+		m.SetLogoURL(v)
+		return nil
+	case oauth2client.FieldAllowedConnectors:
+		v, ok := value.([]string)
+		if !ok {
+			return fmt.Errorf("unexpected type %T for field %s", value, name)
+		}
+		m.SetAllowedConnectors(v)
+		return nil
+	case oauth2client.FieldMfaChain:
+		v, ok := value.([]string)
+		if !ok {
+			return fmt.Errorf("unexpected type %T for field %s", value, name)
+		}
+		m.SetMfaChain(v)
+		return nil
+	case oauth2client.FieldPostLogoutRedirectUris:
+		v, ok := value.([]string)
+		if !ok {
+			return fmt.Errorf("unexpected type %T for field %s", value, name)
+		}
+		m.SetPostLogoutRedirectUris(v)
+		return nil
+	case oauth2client.FieldSSOSharedWith:
+		v, ok := value.([]string)
+		if !ok {
+			return fmt.Errorf("unexpected type %T for field %s", value, name)
+		}
+		m.SetSSOSharedWith(v)
+		return nil
+	case oauth2client.FieldBackchannelLogoutURI:
+		v, ok := value.(string)
+		if !ok {
+			return fmt.Errorf("unexpected type %T for field %s", value, name)
+		}
+		m.SetBackchannelLogoutURI(v)
+		return nil
+	case oauth2client.FieldRefreshTokenLifetime:
+		v, ok := value.(string)
+		if !ok {
+			return fmt.Errorf("unexpected type %T for field %s", value, name)
+		}
+		m.SetRefreshTokenLifetime(v)
+		return nil
+	case oauth2client.FieldClientCredentialsClaims:
+		v, ok := value.(*storage.ClientCredentialsClaims)
+		if !ok {
+			return fmt.Errorf("unexpected type %T for field %s", value, name)
+		}
+		m.SetClientCredentialsClaims(v)
+		return nil
+	}
+	return fmt.Errorf("unknown OAuth2Client field %s", name)
+}
+
+// AddedFields returns all numeric fields that were incremented/decremented during
+// this mutation.
+func (m *OAuth2ClientMutation) AddedFields() []string {
+	return nil
+}
+
+// AddedField returns the numeric value that was incremented/decremented on a field
+// with the given name. The second boolean return value indicates that this field
+// was not set, or was not defined in the schema.
+func (m *OAuth2ClientMutation) AddedField(name string) (ent.Value, bool) {
+	return nil, false
+}
+
+// AddField adds the value to the field with the given name. It returns an error if
+// the field is not defined in the schema, or if the type mismatched the field
+// type.
+func (m *OAuth2ClientMutation) AddField(name string, value ent.Value) error {
+	switch name {
+	}
+	return fmt.Errorf("unknown OAuth2Client numeric field %s", name)
+}
+
+// ClearedFields returns all nullable fields that were cleared during this
+// mutation.
+func (m *OAuth2ClientMutation) ClearedFields() []string {
+	var fields []string
+	if m.FieldCleared(oauth2client.FieldRedirectUris) {
+		fields = append(fields, oauth2client.FieldRedirectUris)
+	}
+	if m.FieldCleared(oauth2client.FieldTrustedPeers) {
+		fields = append(fields, oauth2client.FieldTrustedPeers)
+	}
+	if m.FieldCleared(oauth2client.FieldAllowedConnectors) {
+		fields = append(fields, oauth2client.FieldAllowedConnectors)
+	}
+	if m.FieldCleared(oauth2client.FieldMfaChain) {
+		fields = append(fields, oauth2client.FieldMfaChain)
+	}
+	if m.FieldCleared(oauth2client.FieldPostLogoutRedirectUris) {
+		fields = append(fields, oauth2client.FieldPostLogoutRedirectUris)
+	}
+	if m.FieldCleared(oauth2client.FieldSSOSharedWith) {
+		fields = append(fields, oauth2client.FieldSSOSharedWith)
+	}
+	if m.FieldCleared(oauth2client.FieldBackchannelLogoutURI) {
+		fields = append(fields, oauth2client.FieldBackchannelLogoutURI)
+	}
+	if m.FieldCleared(oauth2client.FieldRefreshTokenLifetime) {
+		fields = append(fields, oauth2client.FieldRefreshTokenLifetime)
+	}
+	if m.FieldCleared(oauth2client.FieldClientCredentialsClaims) {
+		fields = append(fields, oauth2client.FieldClientCredentialsClaims)
+	}
+	return fields
+}
+
+// FieldCleared returns a boolean indicating if a field with the given name was
+// cleared in this mutation.
+func (m *OAuth2ClientMutation) FieldCleared(name string) bool {
+	_, ok := m.clearedFields[name]
+	return ok
+}
+
+// ClearField clears the value of the field with the given name. It returns an
+// error if the field is not defined in the schema.
+func (m *OAuth2ClientMutation) ClearField(name string) error {
+	switch name {
+	case oauth2client.FieldRedirectUris:
+		m.ClearRedirectUris()
+		return nil
+	case oauth2client.FieldTrustedPeers:
+		m.ClearTrustedPeers()
+		return nil
+	case oauth2client.FieldAllowedConnectors:
+		m.ClearAllowedConnectors()
+		return nil
+	case oauth2client.FieldMfaChain:
+		m.ClearMfaChain()
+		return nil
+	case oauth2client.FieldPostLogoutRedirectUris:
+		m.ClearPostLogoutRedirectUris()
+		return nil
+	case oauth2client.FieldSSOSharedWith:
+		m.ClearSSOSharedWith()
+		return nil
+	case oauth2client.FieldBackchannelLogoutURI:
+		m.ClearBackchannelLogoutURI()
+		return nil
+	case oauth2client.FieldRefreshTokenLifetime:
+		m.ClearRefreshTokenLifetime()
+		return nil
+	case oauth2client.FieldClientCredentialsClaims:
+		m.ClearClientCredentialsClaims()
+		return nil
+	}
+	return fmt.Errorf("unknown OAuth2Client nullable field %s", name)
+}
+
+// ResetField resets all changes in the mutation for the field with the given name.
+// It returns an error if the field is not defined in the schema.
+func (m *OAuth2ClientMutation) ResetField(name string) error {
+	switch name {
+	case oauth2client.FieldSecret:
+		m.ResetSecret()
+		return nil
+	case oauth2client.FieldRedirectUris:
+		m.ResetRedirectUris()
+		return nil
+	case oauth2client.FieldTrustedPeers:
+		m.ResetTrustedPeers()
+		return nil
+	case oauth2client.FieldPublic:
+		m.ResetPublic()
+		return nil
+	case oauth2client.FieldName:
+		m.ResetName()
+		return nil
+	case oauth2client.FieldLogoURL:
+		m.ResetLogoURL()
+		return nil
+	case oauth2client.FieldAllowedConnectors:
+		m.ResetAllowedConnectors()
+		return nil
+	case oauth2client.FieldMfaChain:
+		m.ResetMfaChain()
+		return nil
+	case oauth2client.FieldPostLogoutRedirectUris:
+		m.ResetPostLogoutRedirectUris()
+		return nil
+	case oauth2client.FieldSSOSharedWith:
+		m.ResetSSOSharedWith()
+		return nil
+	case oauth2client.FieldBackchannelLogoutURI:
+		m.ResetBackchannelLogoutURI()
+		return nil
+	case oauth2client.FieldRefreshTokenLifetime:
+		m.ResetRefreshTokenLifetime()
+		return nil
+	case oauth2client.FieldClientCredentialsClaims:
+		m.ResetClientCredentialsClaims()
+		return nil
+	}
+	return fmt.Errorf("unknown OAuth2Client field %s", name)
+}
+
+// AddedEdges returns all edge names that were set/added in this mutation.
+func (m *OAuth2ClientMutation) AddedEdges() []string {
+	edges := make([]string, 0, 0)
+	return edges
+}
+
+// AddedIDs returns all IDs (to other nodes) that were added for the given edge
+// name in this mutation.
+func (m *OAuth2ClientMutation) AddedIDs(name string) []ent.Value {
+	return nil
+}
+
+// RemovedEdges returns all edge names that were removed in this mutation.
+func (m *OAuth2ClientMutation) RemovedEdges() []string {
+	edges := make([]string, 0, 0)
+	return edges
+}
+
+// RemovedIDs returns all IDs (to other nodes) that were removed for the edge with
+// the given name in this mutation.
+func (m *OAuth2ClientMutation) RemovedIDs(name string) []ent.Value {
+	return nil
+}
+
+// ClearedEdges returns all edge names that were cleared in this mutation.
+func (m *OAuth2ClientMutation) ClearedEdges() []string {
+	edges := make([]string, 0, 0)
+	return edges
+}
+
+// EdgeCleared returns a boolean which indicates if the edge with the given name
+// was cleared in this mutation.
+func (m *OAuth2ClientMutation) EdgeCleared(name string) bool {
+	return false
+}
+
+// ClearEdge clears the value of the edge with the given name. It returns an error
+// if that edge is not defined in the schema.
+func (m *OAuth2ClientMutation) ClearEdge(name string) error {
+	return fmt.Errorf("unknown OAuth2Client unique edge %s", name)
+}
+
+// ResetEdge resets all changes to the edge with the given name in this mutation.
+// It returns an error if the edge is not defined in the schema.
+func (m *OAuth2ClientMutation) ResetEdge(name string) error {
+	return fmt.Errorf("unknown OAuth2Client edge %s", name)
+}
+
+// OfflineSessionMutation represents an operation that mutates the OfflineSession nodes in the graph.
+type OfflineSessionMutation struct {
+	config
+	op             Op
+	typ            string
+	id             *string
+	user_id        *string
+	conn_id        *string
+	refresh        *[]byte
+	connector_data *[]byte
+	clearedFields  map[string]struct{}
+	done           bool
+	oldValue       func(context.Context) (*OfflineSession, error)
+	predicates     []predicate.OfflineSession
+}
+
+var _ ent.Mutation = (*OfflineSessionMutation)(nil)
+
+// offlinesessionOption allows management of the mutation configuration using functional options.
+type offlinesessionOption func(*OfflineSessionMutation)
+
+// newOfflineSessionMutation creates new mutation for the OfflineSession entity.
+func newOfflineSessionMutation(c config, op Op, opts ...offlinesessionOption) *OfflineSessionMutation {
+	m := &OfflineSessionMutation{
+		config:        c,
+		op:            op,
+		typ:           TypeOfflineSession,
+		clearedFields: make(map[string]struct{}),
+	}
+	for _, opt := range opts {
+		opt(m)
+	}
+	return m
+}
+
+// withOfflineSessionID sets the ID field of the mutation.
+func withOfflineSessionID(id string) offlinesessionOption {
+	return func(m *OfflineSessionMutation) {
+		var (
+			err   error
+			once  sync.Once
+			value *OfflineSession
+		)
+		m.oldValue = func(ctx context.Context) (*OfflineSession, error) {
+			once.Do(func() {
+				if m.done {
+					err = errors.New("querying old values post mutation is not allowed")
+				} else {
+					value, err = m.Client().OfflineSession.Get(ctx, id)
+				}
+			})
+			return value, err
+		}
+		m.id = &id
+	}
+}
+
+// withOfflineSession sets the old OfflineSession of the mutation.
+func withOfflineSession(node *OfflineSession) offlinesessionOption {
+	return func(m *OfflineSessionMutation) {
+		m.oldValue = func(context.Context) (*OfflineSession, error) {
+			return node, nil
+		}
+		m.id = &node.ID
+	}
+}
+
+// Client returns a new `ent.Client` from the mutation. If the mutation was
+// executed in a transaction (ent.Tx), a transactional client is returned.
+func (m OfflineSessionMutation) Client() *Client {
+	client := &Client{config: m.config}
+	client.init()
+	return client
+}
+
+// Tx returns an `ent.Tx` for mutations that were executed in transactions;
+// it returns an error otherwise.
+func (m OfflineSessionMutation) Tx() (*Tx, error) {
+	if _, ok := m.driver.(*txDriver); !ok {
+		return nil, errors.New("db: mutation is not running in a transaction")
+	}
+	tx := &Tx{config: m.config}
+	tx.init()
+	return tx, nil
+}
+
+// SetID sets the value of the id field. Note that this
+// operation is only accepted on creation of OfflineSession entities.
+func (m *OfflineSessionMutation) SetID(id string) {
+	m.id = &id
+}
+
+// ID returns the ID value in the mutation. Note that the ID is only available
+// if it was provided to the builder or after it was returned from the database.
+func (m *OfflineSessionMutation) ID() (id string, exists bool) {
+	if m.id == nil {
+		return
+	}
+	return *m.id, true
+}
+
+// IDs queries the database and returns the entity ids that match the mutation's predicate.
+// That means, if the mutation is applied within a transaction with an isolation level such
+// as sql.LevelSerializable, the returned ids match the ids of the rows that will be updated
+// or updated by the mutation.
+func (m *OfflineSessionMutation) IDs(ctx context.Context) ([]string, error) {
+	switch {
+	case m.op.Is(OpUpdateOne | OpDeleteOne):
+		id, exists := m.ID()
+		if exists {
+			return []string{id}, nil
+		}
+		fallthrough
+	case m.op.Is(OpUpdate | OpDelete):
+		return m.Client().OfflineSession.Query().Where(m.predicates...).IDs(ctx)
+	default:
+		return nil, fmt.Errorf("IDs is not allowed on %s operations", m.op)
+	}
+}
+
+// SetUserID sets the "user_id" field.
+func (m *OfflineSessionMutation) SetUserID(s string) {
+	m.user_id = &s
+}
+
+// UserID returns the value of the "user_id" field in the mutation.
+func (m *OfflineSessionMutation) UserID() (r string, exists bool) {
+	v := m.user_id
+	if v == nil {
+		return
+	}
+	return *v, true
+}
+
+// OldUserID returns the old "user_id" field's value of the OfflineSession entity.
+// If the OfflineSession object wasn't provided to the builder, the object is fetched from the database.
+// An error is returned if the mutation operation is not UpdateOne, or the database query fails.
+func (m *OfflineSessionMutation) OldUserID(ctx context.Context) (v string, err error) {
+	if !m.op.Is(OpUpdateOne) {
+		return v, errors.New("OldUserID is only allowed on UpdateOne operations")
+	}
+	if m.id == nil || m.oldValue == nil {
+		return v, errors.New("OldUserID requires an ID field in the mutation")
+	}
+	oldValue, err := m.oldValue(ctx)
+	if err != nil {
+		return v, fmt.Errorf("querying old value for OldUserID: %w", err)
+	}
+	return oldValue.UserID, nil
+}
+
+// ResetUserID resets all changes to the "user_id" field.
+func (m *OfflineSessionMutation) ResetUserID() {
+	m.user_id = nil
+}
+
+// SetConnID sets the "conn_id" field.
+func (m *OfflineSessionMutation) SetConnID(s string) {
+	m.conn_id = &s
+}
+
+// ConnID returns the value of the "conn_id" field in the mutation.
+func (m *OfflineSessionMutation) ConnID() (r string, exists bool) {
+	v := m.conn_id
+	if v == nil {
+		return
+	}
+	return *v, true
+}
+
+// OldConnID returns the old "conn_id" field's value of the OfflineSession entity.
+// If the OfflineSession object wasn't provided to the builder, the object is fetched from the database.
+// An error is returned if the mutation operation is not UpdateOne, or the database query fails.
+func (m *OfflineSessionMutation) OldConnID(ctx context.Context) (v string, err error) {
+	if !m.op.Is(OpUpdateOne) {
+		return v, errors.New("OldConnID is only allowed on UpdateOne operations")
+	}
+	if m.id == nil || m.oldValue == nil {
+		return v, errors.New("OldConnID requires an ID field in the mutation")
+	}
+	oldValue, err := m.oldValue(ctx)
+	if err != nil {
+		return v, fmt.Errorf("querying old value for OldConnID: %w", err)
+	}
+	return oldValue.ConnID, nil
+}
+
+// ResetConnID resets all changes to the "conn_id" field.
+func (m *OfflineSessionMutation) ResetConnID() {
+	m.conn_id = nil
+}
+
+// SetRefresh sets the "refresh" field.
+func (m *OfflineSessionMutation) SetRefresh(b []byte) {
+	m.refresh = &b
+}
+
+// Refresh returns the value of the "refresh" field in the mutation.
+func (m *OfflineSessionMutation) Refresh() (r []byte, exists bool) {
+	v := m.refresh
+	if v == nil {
+		return
+	}
+	return *v, true
+}
+
+// OldRefresh returns the old "refresh" field's value of the OfflineSession entity.
+// If the OfflineSession object wasn't provided to the builder, the object is fetched from the database.
+// An error is returned if the mutation operation is not UpdateOne, or the database query fails.
+func (m *OfflineSessionMutation) OldRefresh(ctx context.Context) (v []byte, err error) {
+	if !m.op.Is(OpUpdateOne) {
+		return v, errors.New("OldRefresh is only allowed on UpdateOne operations")
+	}
+	if m.id == nil || m.oldValue == nil {
+		return v, errors.New("OldRefresh requires an ID field in the mutation")
+	}
+	oldValue, err := m.oldValue(ctx)
+	if err != nil {
+		return v, fmt.Errorf("querying old value for OldRefresh: %w", err)
+	}
+	return oldValue.Refresh, nil
+}
+
+// ResetRefresh resets all changes to the "refresh" field.
+func (m *OfflineSessionMutation) ResetRefresh() {
+	m.refresh = nil
+}
+
+// SetConnectorData sets the "connector_data" field.
+func (m *OfflineSessionMutation) SetConnectorData(b []byte) {
+	m.connector_data = &b
+}
+
+// ConnectorData returns the value of the "connector_data" field in the mutation.
+func (m *OfflineSessionMutation) ConnectorData() (r []byte, exists bool) {
+	v := m.connector_data
+	if v == nil {
+		return
+	}
+	return *v, true
+}
+
+// OldConnectorData returns the old "connector_data" field's value of the OfflineSession entity.
+// If the OfflineSession object wasn't provided to the builder, the object is fetched from the database.
+// An error is returned if the mutation operation is not UpdateOne, or the database query fails.
+func (m *OfflineSessionMutation) OldConnectorData(ctx context.Context) (v *[]byte, err error) {
+	if !m.op.Is(OpUpdateOne) {
+		return v, errors.New("OldConnectorData is only allowed on UpdateOne operations")
+	}
+	if m.id == nil || m.oldValue == nil {
+		return v, errors.New("OldConnectorData requires an ID field in the mutation")
+	}
+	oldValue, err := m.oldValue(ctx)
+	if err != nil {
+		return v, fmt.Errorf("querying old value for OldConnectorData: %w", err)
+	}
+	return oldValue.ConnectorData, nil
+}
+
+// ClearConnectorData clears the value of the "connector_data" field.
+func (m *OfflineSessionMutation) ClearConnectorData() {
+	m.connector_data = nil
+	m.clearedFields[offlinesession.FieldConnectorData] = struct{}{}
+}
+
+// ConnectorDataCleared returns if the "connector_data" field was cleared in this mutation.
+func (m *OfflineSessionMutation) ConnectorDataCleared() bool {
+	_, ok := m.clearedFields[offlinesession.FieldConnectorData]
+	return ok
+}
+
+// ResetConnectorData resets all changes to the "connector_data" field.
+func (m *OfflineSessionMutation) ResetConnectorData() {
+	m.connector_data = nil
+	delete(m.clearedFields, offlinesession.FieldConnectorData)
+}
+
+// Where appends a list predicates to the OfflineSessionMutation builder.
+func (m *OfflineSessionMutation) Where(ps ...predicate.OfflineSession) {
+	m.predicates = append(m.predicates, ps...)
+}
+
+// WhereP appends storage-level predicates to the OfflineSessionMutation builder. Using this method,
+// users can use type-assertion to append predicates that do not depend on any generated package.
+func (m *OfflineSessionMutation) WhereP(ps ...func(*sql.Selector)) {
+	p := make([]predicate.OfflineSession, len(ps))
+	for i := range ps {
+		p[i] = ps[i]
+	}
+	m.Where(p...)
+}
+
+// Op returns the operation name.
+func (m *OfflineSessionMutation) Op() Op {
+	return m.op
+}
+
+// SetOp allows setting the mutation operation.
+func (m *OfflineSessionMutation) SetOp(op Op) {
+	m.op = op
+}
+
+// Type returns the node type of this mutation (OfflineSession).
+func (m *OfflineSessionMutation) Type() string {
+	return m.typ
+}
+
+// Fields returns all fields that were changed during this mutation. Note that in
+// order to get all numeric fields that were incremented/decremented, call
+// AddedFields().
+func (m *OfflineSessionMutation) Fields() []string {
+	fields := make([]string, 0, 4)
+	if m.user_id != nil {
+		fields = append(fields, offlinesession.FieldUserID)
+	}
+	if m.conn_id != nil {
+		fields = append(fields, offlinesession.FieldConnID)
+	}
+	if m.refresh != nil {
+		fields = append(fields, offlinesession.FieldRefresh)
+	}
+	if m.connector_data != nil {
+		fields = append(fields, offlinesession.FieldConnectorData)
+	}
+	return fields
+}
+
+// Field returns the value of a field with the given name. The second boolean
+// return value indicates that this field was not set, or was not defined in the
+// schema.
+func (m *OfflineSessionMutation) Field(name string) (ent.Value, bool) {
+	switch name {
+	case offlinesession.FieldUserID:
+		return m.UserID()
+	case offlinesession.FieldConnID:
+		return m.ConnID()
+	case offlinesession.FieldRefresh:
+		return m.Refresh()
+	case offlinesession.FieldConnectorData:
+		return m.ConnectorData()
+	}
+	return nil, false
+}
+
+// OldField returns the old value of the field from the database. An error is
+// returned if the mutation operation is not UpdateOne, or the query to the
+// database failed.
+func (m *OfflineSessionMutation) OldField(ctx context.Context, name string) (ent.Value, error) {
+	switch name {
+	case offlinesession.FieldUserID:
+		return m.OldUserID(ctx)
+	case offlinesession.FieldConnID:
+		return m.OldConnID(ctx)
+	case offlinesession.FieldRefresh:
+		return m.OldRefresh(ctx)
+	case offlinesession.FieldConnectorData:
+		return m.OldConnectorData(ctx)
+	}
+	return nil, fmt.Errorf("unknown OfflineSession field %s", name)
+}
+
+// SetField sets the value of a field with the given name. It returns an error if
+// the field is not defined in the schema, or if the type mismatched the field
+// type.
+func (m *OfflineSessionMutation) SetField(name string, value ent.Value) error {
+	switch name {
+	case offlinesession.FieldUserID:
+		v, ok := value.(string)
+		if !ok {
+			return fmt.Errorf("unexpected type %T for field %s", value, name)
+		}
+		m.SetUserID(v)
 		return nil
-	case keys.FieldSigningKey:
-		m.ResetSigningKey()
+	case offlinesession.FieldConnID:
+		v, ok := value.(string)
+		if !ok {
+			return fmt.Errorf("unexpected type %T for field %s", value, name)
+		}
+		m.SetConnID(v)
 		return nil
-	case keys.FieldSigningKeyPub:
-		m.ResetSigningKeyPub()
+	case offlinesession.FieldRefresh:
+		v, ok := value.([]byte)
+		if !ok {
+			return fmt.Errorf("unexpected type %T for field %s", value, name)
+		}
+		m.SetRefresh(v)
 		return nil
-	case keys.FieldNextRotation:
-		m.ResetNextRotation()
+	case offlinesession.FieldConnectorData:
+		v, ok := value.([]byte)
+		if !ok {
+			return fmt.Errorf("unexpected type %T for field %s", value, name)
+		}
+		m.SetConnectorData(v)
 		return nil
 	}
-	return fmt.Errorf("unknown Keys field %s", name)
+	return fmt.Errorf("unknown OfflineSession field %s", name)
+}
+
+// AddedFields returns all numeric fields that were incremented/decremented during
+// this mutation.
+func (m *OfflineSessionMutation) AddedFields() []string {
+	return nil
+}
+
+// AddedField returns the numeric value that was incremented/decremented on a field
+// with the given name. The second boolean return value indicates that this field
+// was not set, or was not defined in the schema.
+func (m *OfflineSessionMutation) AddedField(name string) (ent.Value, bool) {
+	return nil, false
+}
+
+// AddField adds the value to the field with the given name. It returns an error if
+// the field is not defined in the schema, or if the type mismatched the field
+// type.
+func (m *OfflineSessionMutation) AddField(name string, value ent.Value) error {
+	switch name {
+	}
+	return fmt.Errorf("unknown OfflineSession numeric field %s", name)
+}
+
+// ClearedFields returns all nullable fields that were cleared during this
+// mutation.
+func (m *OfflineSessionMutation) ClearedFields() []string {
+	var fields []string
+	if m.FieldCleared(offlinesession.FieldConnectorData) {
+		fields = append(fields, offlinesession.FieldConnectorData)
+	}
+	return fields
+}
+
+// FieldCleared returns a boolean indicating if a field with the given name was
+// cleared in this mutation.
+func (m *OfflineSessionMutation) FieldCleared(name string) bool {
+	_, ok := m.clearedFields[name]
+	return ok
+}
+
+// ClearField clears the value of the field with the given name. It returns an
+// error if the field is not defined in the schema.
+func (m *OfflineSessionMutation) ClearField(name string) error {
+	switch name {
+	case offlinesession.FieldConnectorData:
+		m.ClearConnectorData()
+		return nil
+	}
+	return fmt.Errorf("unknown OfflineSession nullable field %s", name)
+}
+
+// ResetField resets all changes in the mutation for the field with the given name.
+// It returns an error if the field is not defined in the schema.
+func (m *OfflineSessionMutation) ResetField(name string) error {
+	switch name {
+	case offlinesession.FieldUserID:
+		m.ResetUserID()
+		return nil
+	case offlinesession.FieldConnID:
+		m.ResetConnID()
+		return nil
+	case offlinesession.FieldRefresh:
+		m.ResetRefresh()
+		return nil
+	case offlinesession.FieldConnectorData:
+		m.ResetConnectorData()
+		return nil
+	}
+	return fmt.Errorf("unknown OfflineSession field %s", name)
 }
 
 // AddedEdges returns all edge names that were set/added in this mutation.
-func (m *KeysMutation) AddedEdges() []string {
+func (m *OfflineSessionMutation) AddedEdges() []string {
 	edges := make([]string, 0, 0)
 	return edges
 }
 
 // AddedIDs returns all IDs (to other nodes) that were added for the given edge
 // name in this mutation.
-func (m *KeysMutation) AddedIDs(name string) []ent.Value {
+func (m *OfflineSessionMutation) AddedIDs(name string) []ent.Value {
 	return nil
 }
 
 // RemovedEdges returns all edge names that were removed in this mutation.
-func (m *KeysMutation) RemovedEdges() []string {
+func (m *OfflineSessionMutation) RemovedEdges() []string {
 	edges := make([]string, 0, 0)
 	return edges
 }
 
 // RemovedIDs returns all IDs (to other nodes) that were removed for the edge with
 // the given name in this mutation.
-func (m *KeysMutation) RemovedIDs(name string) []ent.Value {
+func (m *OfflineSessionMutation) RemovedIDs(name string) []ent.Value {
 	return nil
 }
 
 // ClearedEdges returns all edge names that were cleared in this mutation.
-func (m *KeysMutation) ClearedEdges() []string {
+func (m *OfflineSessionMutation) ClearedEdges() []string {
 	edges := make([]string, 0, 0)
 	return edges
 }
 
 // EdgeCleared returns a boolean which indicates if the edge with the given name
 // was cleared in this mutation.
-func (m *KeysMutation) EdgeCleared(name string) bool {
+func (m *OfflineSessionMutation) EdgeCleared(name string) bool {
 	return false
 }
 
 // ClearEdge clears the value of the edge with the given name. It returns an error
 // if that edge is not defined in the schema.
-func (m *KeysMutation) ClearEdge(name string) error {
-	return fmt.Errorf("unknown Keys unique edge %s", name)
+func (m *OfflineSessionMutation) ClearEdge(name string) error {
+	return fmt.Errorf("unknown OfflineSession unique edge %s", name)
 }
 
 // ResetEdge resets all changes to the edge with the given name in this mutation.
 // It returns an error if the edge is not defined in the schema.
-func (m *KeysMutation) ResetEdge(name string) error {
-	return fmt.Errorf("unknown Keys edge %s", name)
+func (m *OfflineSessionMutation) ResetEdge(name string) error {
+	return fmt.Errorf("unknown OfflineSession edge %s", name)
 }
 
-// OAuth2ClientMutation represents an operation that mutates the OAuth2Client nodes in the graph.
-type OAuth2ClientMutation struct {
+// PasswordMutation represents an operation that mutates the Password nodes in the graph.
+type PasswordMutation struct {
 	config
-	op            Op
-	typ           string
-	id            *string
-	secret        *string
-	redirect_uris *[]string
-	trusted_peers *[]string
-	public        *bool
-	name          *string
-	logo_url      *string
-	clearedFields map[string]struct{}
-	done          bool
-	oldValue      func(context.Context) (*OAuth2Client, error)
-	predicates    []predicate.OAuth2Client
+	op                 Op
+	typ                string
+	id                 *int
+	email              *string
+	hash               *[]byte
+	username           *string
+	name               *string
+	preferred_username *string
+	email_verified     *bool
+	user_id            *string
+	groups             *[]string
+	appendgroups       []string
+	clearedFields      map[string]struct{}
+	done               bool
+	oldValue           func(context.Context) (*Password, error)
+	predicates         []predicate.Password
 }
 
-var _ ent.Mutation = (*OAuth2ClientMutation)(nil)
+var _ ent.Mutation = (*PasswordMutation)(nil)
 
-// oauth2clientOption allows management of the mutation configuration using functional options.
-type oauth2clientOption func(*OAuth2ClientMutation)
+// passwordOption allows management of the mutation configuration using functional options.
+type passwordOption func(*PasswordMutation)
 
-// newOAuth2ClientMutation creates new mutation for the OAuth2Client entity.
-func newOAuth2ClientMutation(c config, op Op, opts ...oauth2clientOption) *OAuth2ClientMutation {
-	m := &OAuth2ClientMutation{
+// newPasswordMutation creates new mutation for the Password entity.
+func newPasswordMutation(c config, op Op, opts ...passwordOption) *PasswordMutation {
+	m := &PasswordMutation{
 		config:        c,
 		op:            op,
-		typ:           TypeOAuth2Client,
+		typ:           TypePassword,
 		clearedFields: make(map[string]struct{}),
 	}
 	for _, opt := range opts {
@@ -4893,20 +8411,20 @@ func newOAuth2ClientMutation(c config, op Op, opts ...oauth2clientOption) *OAuth
 	return m
 }
 
-// withOAuth2ClientID sets the ID field of the mutation.
-func withOAuth2ClientID(id string) oauth2clientOption {
-	return func(m *OAuth2ClientMutation) {
+// withPasswordID sets the ID field of the mutation.
+func withPasswordID(id int) passwordOption {
+	return func(m *PasswordMutation) {
 		var (
 			err   error
 			once  sync.Once
-			value *OAuth2Client
+			value *Password
 		)
-		m.oldValue = func(ctx context.Context) (*OAuth2Client, error) {
+		m.oldValue = func(ctx context.Context) (*Password, error) {
 			once.Do(func() {
 				if m.done {
 					err = errors.New("querying old values post mutation is not allowed")
 				} else {
-					value, err = m.Client().OAuth2Client.Get(ctx, id)
+					value, err = m.Client().Password.Get(ctx, id)
 				}
 			})
 			return value, err
@@ -4915,10 +8433,10 @@ func withOAuth2ClientID(id string) oauth2clientOption {
 	}
 }
 
-// withOAuth2Client sets the old OAuth2Client of the mutation.
-func withOAuth2Client(node *OAuth2Client) oauth2clientOption {
-	return func(m *OAuth2ClientMutation) {
-		m.oldValue = func(context.Context) (*OAuth2Client, error) {
+// withPassword sets the old Password of the mutation.
+func withPassword(node *Password) passwordOption {
+	return func(m *PasswordMutation) {
+		m.oldValue = func(context.Context) (*Password, error) {
 			return node, nil
 		}
 		m.id = &node.ID
@@ -4927,7 +8445,7 @@ func withOAuth2Client(node *OAuth2Client) oauth2clientOption {
 
 // Client returns a new `ent.Client` from the mutation. If the mutation was
 // executed in a transaction (ent.Tx), a transactional client is returned.
-func (m OAuth2ClientMutation) Client() *Client {
+func (m PasswordMutation) Client() *Client {
 	client := &Client{config: m.config}
 	client.init()
 	return client
@@ -4935,7 +8453,7 @@ func (m OAuth2ClientMutation) Client() *Client {
 
 // Tx returns an `ent.Tx` for mutations that were executed in transactions;
 // it returns an error otherwise.
-func (m OAuth2ClientMutation) Tx() (*Tx, error) {
+func (m PasswordMutation) Tx() (*Tx, error) {
 	if _, ok := m.driver.(*txDriver); !ok {
 		return nil, errors.New("db: mutation is not running in a transaction")
 	}
@@ -4944,15 +8462,9 @@ func (m OAuth2ClientMutation) Tx() (*Tx, error) {
 	return tx, nil
 }
 
-// SetID sets the value of the id field. Note that this
-// operation is only accepted on creation of OAuth2Client entities.
-func (m *OAuth2ClientMutation) SetID(id string) {
-	m.id = &id
-}
-
 // ID returns the ID value in the mutation. Note that the ID is only available
 // if it was provided to the builder or after it was returned from the database.
-func (m *OAuth2ClientMutation) ID() (id string, exists bool) {
+func (m *PasswordMutation) ID() (id int, exists bool) {
 	if m.id == nil {
 		return
 	}
@@ -4963,300 +8475,409 @@ func (m *OAuth2ClientMutation) ID() (id string, exists bool) {
 // That means, if the mutation is applied within a transaction with an isolation level such
 // as sql.LevelSerializable, the returned ids match the ids of the rows that will be updated
 // or updated by the mutation.
-func (m *OAuth2ClientMutation) IDs(ctx context.Context) ([]string, error) {
+func (m *PasswordMutation) IDs(ctx context.Context) ([]int, error) {
 	switch {
 	case m.op.Is(OpUpdateOne | OpDeleteOne):
 		id, exists := m.ID()
 		if exists {
-			return []string{id}, nil
+			return []int{id}, nil
 		}
 		fallthrough
 	case m.op.Is(OpUpdate | OpDelete):
-		return m.Client().OAuth2Client.Query().Where(m.predicates...).IDs(ctx)
+		return m.Client().Password.Query().Where(m.predicates...).IDs(ctx)
 	default:
 		return nil, fmt.Errorf("IDs is not allowed on %s operations", m.op)
 	}
 }
 
-// SetSecret sets the "secret" field.
-func (m *OAuth2ClientMutation) SetSecret(s string) {
-	m.secret = &s
+// SetEmail sets the "email" field.
+func (m *PasswordMutation) SetEmail(s string) {
+	m.email = &s
 }
 
-// Secret returns the value of the "secret" field in the mutation.
-func (m *OAuth2ClientMutation) Secret() (r string, exists bool) {
-	v := m.secret
+// Email returns the value of the "email" field in the mutation.
+func (m *PasswordMutation) Email() (r string, exists bool) {
+	v := m.email
 	if v == nil {
 		return
 	}
 	return *v, true
 }
 
-// OldSecret returns the old "secret" field's value of the OAuth2Client entity.
-// If the OAuth2Client object wasn't provided to the builder, the object is fetched from the database.
+// OldEmail returns the old "email" field's value of the Password entity.
+// If the Password object wasn't provided to the builder, the object is fetched from the database.
 // An error is returned if the mutation operation is not UpdateOne, or the database query fails.
-func (m *OAuth2ClientMutation) OldSecret(ctx context.Context) (v string, err error) {
+func (m *PasswordMutation) OldEmail(ctx context.Context) (v string, err error) {
 	if !m.op.Is(OpUpdateOne) {
-		return v, errors.New("OldSecret is only allowed on UpdateOne operations")
+		return v, errors.New("OldEmail is only allowed on UpdateOne operations")
 	}
 	if m.id == nil || m.oldValue == nil {
-		return v, errors.New("OldSecret requires an ID field in the mutation")
+		return v, errors.New("OldEmail requires an ID field in the mutation")
 	}
 	oldValue, err := m.oldValue(ctx)
 	if err != nil {
-		return v, fmt.Errorf("querying old value for OldSecret: %w", err)
+		return v, fmt.Errorf("querying old value for OldEmail: %w", err)
 	}
-	return oldValue.Secret, nil
+	return oldValue.Email, nil
 }
 
-// ResetSecret resets all changes to the "secret" field.
-func (m *OAuth2ClientMutation) ResetSecret() {
-	m.secret = nil
+// ResetEmail resets all changes to the "email" field.
+func (m *PasswordMutation) ResetEmail() {
+	m.email = nil
 }
 
-// SetRedirectUris sets the "redirect_uris" field.
-func (m *OAuth2ClientMutation) SetRedirectUris(s []string) {
-	m.redirect_uris = &s
+// SetHash sets the "hash" field.
+func (m *PasswordMutation) SetHash(b []byte) {
+	m.hash = &b
 }
 
-// RedirectUris returns the value of the "redirect_uris" field in the mutation.
-func (m *OAuth2ClientMutation) RedirectUris() (r []string, exists bool) {
-	v := m.redirect_uris
+// Hash returns the value of the "hash" field in the mutation.
+func (m *PasswordMutation) Hash() (r []byte, exists bool) {
+	v := m.hash
 	if v == nil {
 		return
 	}
 	return *v, true
 }
 
-// OldRedirectUris returns the old "redirect_uris" field's value of the OAuth2Client entity.
-// If the OAuth2Client object wasn't provided to the builder, the object is fetched from the database.
+// OldHash returns the old "hash" field's value of the Password entity.
+// If the Password object wasn't provided to the builder, the object is fetched from the database.
 // An error is returned if the mutation operation is not UpdateOne, or the database query fails.
-func (m *OAuth2ClientMutation) OldRedirectUris(ctx context.Context) (v []string, err error) {
+func (m *PasswordMutation) OldHash(ctx context.Context) (v []byte, err error) {
 	if !m.op.Is(OpUpdateOne) {
-		return v, errors.New("OldRedirectUris is only allowed on UpdateOne operations")
+		return v, errors.New("OldHash is only allowed on UpdateOne operations")
 	}
 	if m.id == nil || m.oldValue == nil {
-		return v, errors.New("OldRedirectUris requires an ID field in the mutation")
+		return v, errors.New("OldHash requires an ID field in the mutation")
 	}
 	oldValue, err := m.oldValue(ctx)
 	if err != nil {
-		return v, fmt.Errorf("querying old value for OldRedirectUris: %w", err)
+		return v, fmt.Errorf("querying old value for OldHash: %w", err)
 	}
-	return oldValue.RedirectUris, nil
+	return oldValue.Hash, nil
 }
 
-// ClearRedirectUris clears the value of the "redirect_uris" field.
-func (m *OAuth2ClientMutation) ClearRedirectUris() {
-	m.redirect_uris = nil
-	m.clearedFields[oauth2client.FieldRedirectUris] = struct{}{}
+// ResetHash resets all changes to the "hash" field.
+func (m *PasswordMutation) ResetHash() {
+	m.hash = nil
 }
 
-// RedirectUrisCleared returns if the "redirect_uris" field was cleared in this mutation.
-func (m *OAuth2ClientMutation) RedirectUrisCleared() bool {
-	_, ok := m.clearedFields[oauth2client.FieldRedirectUris]
-	return ok
+// SetUsername sets the "username" field.
+func (m *PasswordMutation) SetUsername(s string) {
+	m.username = &s
 }
 
-// ResetRedirectUris resets all changes to the "redirect_uris" field.
-func (m *OAuth2ClientMutation) ResetRedirectUris() {
-	m.redirect_uris = nil
-	delete(m.clearedFields, oauth2client.FieldRedirectUris)
+// Username returns the value of the "username" field in the mutation.
+func (m *PasswordMutation) Username() (r string, exists bool) {
+	v := m.username
+	if v == nil {
+		return
+	}
+	return *v, true
 }
 
-// SetTrustedPeers sets the "trusted_peers" field.
-func (m *OAuth2ClientMutation) SetTrustedPeers(s []string) {
-	m.trusted_peers = &s
+// OldUsername returns the old "username" field's value of the Password entity.
+// If the Password object wasn't provided to the builder, the object is fetched from the database.
+// An error is returned if the mutation operation is not UpdateOne, or the database query fails.
+func (m *PasswordMutation) OldUsername(ctx context.Context) (v string, err error) {
+	if !m.op.Is(OpUpdateOne) {
+		return v, errors.New("OldUsername is only allowed on UpdateOne operations")
+	}
+	if m.id == nil || m.oldValue == nil {
+		return v, errors.New("OldUsername requires an ID field in the mutation")
+	}
+	oldValue, err := m.oldValue(ctx)
+	if err != nil {
+		return v, fmt.Errorf("querying old value for OldUsername: %w", err)
+	}
+	return oldValue.Username, nil
 }
 
-// TrustedPeers returns the value of the "trusted_peers" field in the mutation.
-func (m *OAuth2ClientMutation) TrustedPeers() (r []string, exists bool) {
-	v := m.trusted_peers
+// ResetUsername resets all changes to the "username" field.
+func (m *PasswordMutation) ResetUsername() {
+	m.username = nil
+}
+
+// SetName sets the "name" field.
+func (m *PasswordMutation) SetName(s string) {
+	m.name = &s
+}
+
+// Name returns the value of the "name" field in the mutation.
+func (m *PasswordMutation) Name() (r string, exists bool) {
+	v := m.name
 	if v == nil {
 		return
 	}
 	return *v, true
 }
 
-// OldTrustedPeers returns the old "trusted_peers" field's value of the OAuth2Client entity.
-// If the OAuth2Client object wasn't provided to the builder, the object is fetched from the database.
+// OldName returns the old "name" field's value of the Password entity.
+// If the Password object wasn't provided to the builder, the object is fetched from the database.
 // An error is returned if the mutation operation is not UpdateOne, or the database query fails.
-func (m *OAuth2ClientMutation) OldTrustedPeers(ctx context.Context) (v []string, err error) {
+func (m *PasswordMutation) OldName(ctx context.Context) (v string, err error) {
 	if !m.op.Is(OpUpdateOne) {
-		return v, errors.New("OldTrustedPeers is only allowed on UpdateOne operations")
+		return v, errors.New("OldName is only allowed on UpdateOne operations")
 	}
 	if m.id == nil || m.oldValue == nil {
-		return v, errors.New("OldTrustedPeers requires an ID field in the mutation")
+		return v, errors.New("OldName requires an ID field in the mutation")
 	}
 	oldValue, err := m.oldValue(ctx)
 	if err != nil {
-		return v, fmt.Errorf("querying old value for OldTrustedPeers: %w", err)
+		return v, fmt.Errorf("querying old value for OldName: %w", err)
 	}
-	return oldValue.TrustedPeers, nil
+	return oldValue.Name, nil
 }
 
-// ClearTrustedPeers clears the value of the "trusted_peers" field.
-func (m *OAuth2ClientMutation) ClearTrustedPeers() {
-	m.trusted_peers = nil
-	m.clearedFields[oauth2client.FieldTrustedPeers] = struct{}{}
+// ResetName resets all changes to the "name" field.
+func (m *PasswordMutation) ResetName() {
+	m.name = nil
 }
 
-// TrustedPeersCleared returns if the "trusted_peers" field was cleared in this mutation.
-func (m *OAuth2ClientMutation) TrustedPeersCleared() bool {
-	_, ok := m.clearedFields[oauth2client.FieldTrustedPeers]
-	return ok
+// SetPreferredUsername sets the "preferred_username" field.
+func (m *PasswordMutation) SetPreferredUsername(s string) {
+	m.preferred_username = &s
 }
 
-// ResetTrustedPeers resets all changes to the "trusted_peers" field.
-func (m *OAuth2ClientMutation) ResetTrustedPeers() {
-	m.trusted_peers = nil
-	delete(m.clearedFields, oauth2client.FieldTrustedPeers)
+// PreferredUsername returns the value of the "preferred_username" field in the mutation.
+func (m *PasswordMutation) PreferredUsername() (r string, exists bool) {
+	v := m.preferred_username
+	if v == nil {
+		return
+	}
+	return *v, true
 }
 
-// SetPublic sets the "public" field.
-func (m *OAuth2ClientMutation) SetPublic(b bool) {
-	m.public = &b
+// OldPreferredUsername returns the old "preferred_username" field's value of the Password entity.
+// If the Password object wasn't provided to the builder, the object is fetched from the database.
+// An error is returned if the mutation operation is not UpdateOne, or the database query fails.
+func (m *PasswordMutation) OldPreferredUsername(ctx context.Context) (v string, err error) {
+	if !m.op.Is(OpUpdateOne) {
+		return v, errors.New("OldPreferredUsername is only allowed on UpdateOne operations")
+	}
+	if m.id == nil || m.oldValue == nil {
+		return v, errors.New("OldPreferredUsername requires an ID field in the mutation")
+	}
+	oldValue, err := m.oldValue(ctx)
+	if err != nil {
+		return v, fmt.Errorf("querying old value for OldPreferredUsername: %w", err)
+	}
+	return oldValue.PreferredUsername, nil
 }
 
-// Public returns the value of the "public" field in the mutation.
-func (m *OAuth2ClientMutation) Public() (r bool, exists bool) {
-	v := m.public
+// ResetPreferredUsername resets all changes to the "preferred_username" field.
+func (m *PasswordMutation) ResetPreferredUsername() {
+	m.preferred_username = nil
+}
+
+// SetEmailVerified sets the "email_verified" field.
+func (m *PasswordMutation) SetEmailVerified(b bool) {
+	m.email_verified = &b
+}
+
+// EmailVerified returns the value of the "email_verified" field in the mutation.
+func (m *PasswordMutation) EmailVerified() (r bool, exists bool) {
+	v := m.email_verified
 	if v == nil {
 		return
 	}
 	return *v, true
 }
 
-// OldPublic returns the old "public" field's value of the OAuth2Client entity.
-// If the OAuth2Client object wasn't provided to the builder, the object is fetched from the database.
+// OldEmailVerified returns the old "email_verified" field's value of the Password entity.
+// If the Password object wasn't provided to the builder, the object is fetched from the database.
 // An error is returned if the mutation operation is not UpdateOne, or the database query fails.
-func (m *OAuth2ClientMutation) OldPublic(ctx context.Context) (v bool, err error) {
+func (m *PasswordMutation) OldEmailVerified(ctx context.Context) (v *bool, err error) {
 	if !m.op.Is(OpUpdateOne) {
-		return v, errors.New("OldPublic is only allowed on UpdateOne operations")
+		return v, errors.New("OldEmailVerified is only allowed on UpdateOne operations")
 	}
 	if m.id == nil || m.oldValue == nil {
-		return v, errors.New("OldPublic requires an ID field in the mutation")
+		return v, errors.New("OldEmailVerified requires an ID field in the mutation")
 	}
 	oldValue, err := m.oldValue(ctx)
 	if err != nil {
-		return v, fmt.Errorf("querying old value for OldPublic: %w", err)
+		return v, fmt.Errorf("querying old value for OldEmailVerified: %w", err)
 	}
-	return oldValue.Public, nil
+	return oldValue.EmailVerified, nil
 }
 
-// ResetPublic resets all changes to the "public" field.
-func (m *OAuth2ClientMutation) ResetPublic() {
-	m.public = nil
+// ClearEmailVerified clears the value of the "email_verified" field.
+func (m *PasswordMutation) ClearEmailVerified() {
+	m.email_verified = nil
+	m.clearedFields[password.FieldEmailVerified] = struct{}{}
 }
 
-// SetName sets the "name" field.
-func (m *OAuth2ClientMutation) SetName(s string) {
-	m.name = &s
+// EmailVerifiedCleared returns if the "email_verified" field was cleared in this mutation.
+func (m *PasswordMutation) EmailVerifiedCleared() bool {
+	_, ok := m.clearedFields[password.FieldEmailVerified]
+	return ok
 }
 
-// Name returns the value of the "name" field in the mutation.
-func (m *OAuth2ClientMutation) Name() (r string, exists bool) {
-	v := m.name
+// ResetEmailVerified resets all changes to the "email_verified" field.
+func (m *PasswordMutation) ResetEmailVerified() {
+	m.email_verified = nil
+	delete(m.clearedFields, password.FieldEmailVerified)
+}
+
+// SetUserID sets the "user_id" field.
+func (m *PasswordMutation) SetUserID(s string) {
+	m.user_id = &s
+}
+
+// UserID returns the value of the "user_id" field in the mutation.
+func (m *PasswordMutation) UserID() (r string, exists bool) {
+	v := m.user_id
 	if v == nil {
 		return
 	}
 	return *v, true
 }
 
-// OldName returns the old "name" field's value of the OAuth2Client entity.
-// If the OAuth2Client object wasn't provided to the builder, the object is fetched from the database.
+// OldUserID returns the old "user_id" field's value of the Password entity.
+// If the Password object wasn't provided to the builder, the object is fetched from the database.
 // An error is returned if the mutation operation is not UpdateOne, or the database query fails.
-func (m *OAuth2ClientMutation) OldName(ctx context.Context) (v string, err error) {
+func (m *PasswordMutation) OldUserID(ctx context.Context) (v string, err error) {
 	if !m.op.Is(OpUpdateOne) {
-		return v, errors.New("OldName is only allowed on UpdateOne operations")
+		return v, errors.New("OldUserID is only allowed on UpdateOne operations")
 	}
 	if m.id == nil || m.oldValue == nil {
-		return v, errors.New("OldName requires an ID field in the mutation")
+		return v, errors.New("OldUserID requires an ID field in the mutation")
 	}
 	oldValue, err := m.oldValue(ctx)
 	if err != nil {
-		return v, fmt.Errorf("querying old value for OldName: %w", err)
+		return v, fmt.Errorf("querying old value for OldUserID: %w", err)
 	}
-	return oldValue.Name, nil
+	return oldValue.UserID, nil
 }
 
-// ResetName resets all changes to the "name" field.
-func (m *OAuth2ClientMutation) ResetName() {
-	m.name = nil
+// ResetUserID resets all changes to the "user_id" field.
+func (m *PasswordMutation) ResetUserID() {
+	m.user_id = nil
 }
 
-// SetLogoURL sets the "logo_url" field.
-func (m *OAuth2ClientMutation) SetLogoURL(s string) {
-	m.logo_url = &s
+// SetGroups sets the "groups" field.
+func (m *PasswordMutation) SetGroups(s []string) {
+	m.groups = &s
+	m.appendgroups = nil
 }
 
-// LogoURL returns the value of the "logo_url" field in the mutation.
-func (m *OAuth2ClientMutation) LogoURL() (r string, exists bool) {
-	v := m.logo_url
+// Groups returns the value of the "groups" field in the mutation.
+func (m *PasswordMutation) Groups() (r []string, exists bool) {
+	v := m.groups
 	if v == nil {
 		return
 	}
 	return *v, true
 }
 
-// OldLogoURL returns the old "logo_url" field's value of the OAuth2Client entity.
-// If the OAuth2Client object wasn't provided to the builder, the object is fetched from the database.
+// OldGroups returns the old "groups" field's value of the Password entity.
+// If the Password object wasn't provided to the builder, the object is fetched from the database.
 // An error is returned if the mutation operation is not UpdateOne, or the database query fails.
-func (m *OAuth2ClientMutation) OldLogoURL(ctx context.Context) (v string, err error) {
+func (m *PasswordMutation) OldGroups(ctx context.Context) (v []string, err error) {
 	if !m.op.Is(OpUpdateOne) {
-		return v, errors.New("OldLogoURL is only allowed on UpdateOne operations")
+		return v, errors.New("OldGroups is only allowed on UpdateOne operations")
 	}
 	if m.id == nil || m.oldValue == nil {
-		return v, errors.New("OldLogoURL requires an ID field in the mutation")
+		return v, errors.New("OldGroups requires an ID field in the mutation")
 	}
 	oldValue, err := m.oldValue(ctx)
 	if err != nil {
-		return v, fmt.Errorf("querying old value for OldLogoURL: %w", err)
+		return v, fmt.Errorf("querying old value for OldGroups: %w", err)
 	}
-	return oldValue.LogoURL, nil
+	return oldValue.Groups, nil
 }
 
-// ResetLogoURL resets all changes to the "logo_url" field.
-func (m *OAuth2ClientMutation) ResetLogoURL() {
-	m.logo_url = nil
+// AppendGroups adds s to the "groups" field.
+func (m *PasswordMutation) AppendGroups(s []string) {
+	m.appendgroups = append(m.appendgroups, s...)
 }
 
-// Where appends a list predicates to the OAuth2ClientMutation builder.
-func (m *OAuth2ClientMutation) Where(ps ...predicate.OAuth2Client) {
+// AppendedGroups returns the list of values that were appended to the "groups" field in this mutation.
+func (m *PasswordMutation) AppendedGroups() ([]string, bool) {
+	if len(m.appendgroups) == 0 {
+		return nil, false
+	}
+	return m.appendgroups, true
+}
+
+// ClearGroups clears the value of the "groups" field.
+func (m *PasswordMutation) ClearGroups() {
+	m.groups = nil
+	m.appendgroups = nil
+	m.clearedFields[password.FieldGroups] = struct{}{}
+}
+
+// GroupsCleared returns if the "groups" field was cleared in this mutation.
+func (m *PasswordMutation) GroupsCleared() bool {
+	_, ok := m.clearedFields[password.FieldGroups]
+	return ok
+}
+
+// ResetGroups resets all changes to the "groups" field.
+func (m *PasswordMutation) ResetGroups() {
+	m.groups = nil
+	m.appendgroups = nil
+	delete(m.clearedFields, password.FieldGroups)
+}
+
+// Where appends a list predicates to the PasswordMutation builder.
+func (m *PasswordMutation) Where(ps ...predicate.Password) {
 	m.predicates = append(m.predicates, ps...)
 }
 
+// WhereP appends storage-level predicates to the PasswordMutation builder. Using this method,
+// users can use type-assertion to append predicates that do not depend on any generated package.
+func (m *PasswordMutation) WhereP(ps ...func(*sql.Selector)) {
+	p := make([]predicate.Password, len(ps))
+	for i := range ps {
+		p[i] = ps[i]
+	}
+	m.Where(p...)
+}
+
 // Op returns the operation name.
-func (m *OAuth2ClientMutation) Op() Op {
+func (m *PasswordMutation) Op() Op {
 	return m.op
 }
 
-// Type returns the node type of this mutation (OAuth2Client).
-func (m *OAuth2ClientMutation) Type() string {
+// SetOp allows setting the mutation operation.
+func (m *PasswordMutation) SetOp(op Op) {
+	m.op = op
+}
+
+// Type returns the node type of this mutation (Password).
+func (m *PasswordMutation) Type() string {
 	return m.typ
 }
 
 // Fields returns all fields that were changed during this mutation. Note that in
 // order to get all numeric fields that were incremented/decremented, call
 // AddedFields().
-func (m *OAuth2ClientMutation) Fields() []string {
-	fields := make([]string, 0, 6)
-	if m.secret != nil {
-		fields = append(fields, oauth2client.FieldSecret)
-	}
-	if m.redirect_uris != nil {
-		fields = append(fields, oauth2client.FieldRedirectUris)
+func (m *PasswordMutation) Fields() []string {
+	fields := make([]string, 0, 8)
+	if m.email != nil {
+		fields = append(fields, password.FieldEmail)
 	}
-	if m.trusted_peers != nil {
-		fields = append(fields, oauth2client.FieldTrustedPeers)
+	if m.hash != nil {
+		fields = append(fields, password.FieldHash)
 	}
-	if m.public != nil {
-		fields = append(fields, oauth2client.FieldPublic)
+	if m.username != nil {
+		fields = append(fields, password.FieldUsername)
 	}
 	if m.name != nil {
-		fields = append(fields, oauth2client.FieldName)
+		fields = append(fields, password.FieldName)
 	}
-	if m.logo_url != nil {
-		fields = append(fields, oauth2client.FieldLogoURL)
+	if m.preferred_username != nil {
+		fields = append(fields, password.FieldPreferredUsername)
+	}
+	if m.email_verified != nil {
+		fields = append(fields, password.FieldEmailVerified)
+	}
+	if m.user_id != nil {
+		fields = append(fields, password.FieldUserID)
+	}
+	if m.groups != nil {
+		fields = append(fields, password.FieldGroups)
 	}
 	return fields
 }
@@ -5264,20 +8885,24 @@ func (m *OAuth2ClientMutation) Fields() []string {
 // Field returns the value of a field with the given name. The second boolean
 // return value indicates that this field was not set, or was not defined in the
 // schema.
-func (m *OAuth2ClientMutation) Field(name string) (ent.Value, bool) {
+func (m *PasswordMutation) Field(name string) (ent.Value, bool) {
 	switch name {
-	case oauth2client.FieldSecret:
-		return m.Secret()
-	case oauth2client.FieldRedirectUris:
-		return m.RedirectUris()
-	case oauth2client.FieldTrustedPeers:
-		return m.TrustedPeers()
-	case oauth2client.FieldPublic:
-		return m.Public()
-	case oauth2client.FieldName:
+	case password.FieldEmail:
+		return m.Email()
+	case password.FieldHash:
+		return m.Hash()
+	case password.FieldUsername:
+		return m.Username()
+	case password.FieldName:
 		return m.Name()
-	case oauth2client.FieldLogoURL:
-		return m.LogoURL()
+	case password.FieldPreferredUsername:
+		return m.PreferredUsername()
+	case password.FieldEmailVerified:
+		return m.EmailVerified()
+	case password.FieldUserID:
+		return m.UserID()
+	case password.FieldGroups:
+		return m.Groups()
 	}
 	return nil, false
 }
@@ -5285,232 +8910,269 @@ func (m *OAuth2ClientMutation) Field(name string) (ent.Value, bool) {
 // OldField returns the old value of the field from the database. An error is
 // returned if the mutation operation is not UpdateOne, or the query to the
 // database failed.
-func (m *OAuth2ClientMutation) OldField(ctx context.Context, name string) (ent.Value, error) {
+func (m *PasswordMutation) OldField(ctx context.Context, name string) (ent.Value, error) {
 	switch name {
-	case oauth2client.FieldSecret:
-		return m.OldSecret(ctx)
-	case oauth2client.FieldRedirectUris:
-		return m.OldRedirectUris(ctx)
-	case oauth2client.FieldTrustedPeers:
-		return m.OldTrustedPeers(ctx)
-	case oauth2client.FieldPublic:
-		return m.OldPublic(ctx)
-	case oauth2client.FieldName:
+	case password.FieldEmail:
+		return m.OldEmail(ctx)
+	case password.FieldHash:
+		return m.OldHash(ctx)
+	case password.FieldUsername:
+		return m.OldUsername(ctx)
+	case password.FieldName:
 		return m.OldName(ctx)
-	case oauth2client.FieldLogoURL:
-		return m.OldLogoURL(ctx)
+	case password.FieldPreferredUsername:
+		return m.OldPreferredUsername(ctx)
+	case password.FieldEmailVerified:
+		return m.OldEmailVerified(ctx)
+	case password.FieldUserID:
+		return m.OldUserID(ctx)
+	case password.FieldGroups:
+		return m.OldGroups(ctx)
 	}
-	return nil, fmt.Errorf("unknown OAuth2Client field %s", name)
+	return nil, fmt.Errorf("unknown Password field %s", name)
 }
 
 // SetField sets the value of a field with the given name. It returns an error if
 // the field is not defined in the schema, or if the type mismatched the field
 // type.
-func (m *OAuth2ClientMutation) SetField(name string, value ent.Value) error {
+func (m *PasswordMutation) SetField(name string, value ent.Value) error {
 	switch name {
-	case oauth2client.FieldSecret:
+	case password.FieldEmail:
 		v, ok := value.(string)
 		if !ok {
 			return fmt.Errorf("unexpected type %T for field %s", value, name)
 		}
-		m.SetSecret(v)
+		m.SetEmail(v)
 		return nil
-	case oauth2client.FieldRedirectUris:
-		v, ok := value.([]string)
+	case password.FieldHash:
+		v, ok := value.([]byte)
 		if !ok {
 			return fmt.Errorf("unexpected type %T for field %s", value, name)
 		}
-		m.SetRedirectUris(v)
+		m.SetHash(v)
 		return nil
-	case oauth2client.FieldTrustedPeers:
-		v, ok := value.([]string)
+	case password.FieldUsername:
+		v, ok := value.(string)
 		if !ok {
 			return fmt.Errorf("unexpected type %T for field %s", value, name)
 		}
-		m.SetTrustedPeers(v)
+		m.SetUsername(v)
 		return nil
-	case oauth2client.FieldPublic:
-		v, ok := value.(bool)
+	case password.FieldName:
+		v, ok := value.(string)
 		if !ok {
 			return fmt.Errorf("unexpected type %T for field %s", value, name)
 		}
-		m.SetPublic(v)
+		m.SetName(v)
 		return nil
-	case oauth2client.FieldName:
+	case password.FieldPreferredUsername:
 		v, ok := value.(string)
 		if !ok {
 			return fmt.Errorf("unexpected type %T for field %s", value, name)
 		}
-		m.SetName(v)
+		m.SetPreferredUsername(v)
 		return nil
-	case oauth2client.FieldLogoURL:
+	case password.FieldEmailVerified:
+		v, ok := value.(bool)
+		if !ok {
+			return fmt.Errorf("unexpected type %T for field %s", value, name)
+		}
+		m.SetEmailVerified(v)
+		return nil
+	case password.FieldUserID:
 		v, ok := value.(string)
 		if !ok {
 			return fmt.Errorf("unexpected type %T for field %s", value, name)
 		}
-		m.SetLogoURL(v)
+		m.SetUserID(v)
+		return nil
+	case password.FieldGroups:
+		v, ok := value.([]string)
+		if !ok {
+			return fmt.Errorf("unexpected type %T for field %s", value, name)
+		}
+		m.SetGroups(v)
 		return nil
 	}
-	return fmt.Errorf("unknown OAuth2Client field %s", name)
+	return fmt.Errorf("unknown Password field %s", name)
 }
 
 // AddedFields returns all numeric fields that were incremented/decremented during
 // this mutation.
-func (m *OAuth2ClientMutation) AddedFields() []string {
+func (m *PasswordMutation) AddedFields() []string {
 	return nil
 }
 
 // AddedField returns the numeric value that was incremented/decremented on a field
 // with the given name. The second boolean return value indicates that this field
 // was not set, or was not defined in the schema.
-func (m *OAuth2ClientMutation) AddedField(name string) (ent.Value, bool) {
+func (m *PasswordMutation) AddedField(name string) (ent.Value, bool) {
 	return nil, false
 }
 
 // AddField adds the value to the field with the given name. It returns an error if
 // the field is not defined in the schema, or if the type mismatched the field
 // type.
-func (m *OAuth2ClientMutation) AddField(name string, value ent.Value) error {
+func (m *PasswordMutation) AddField(name string, value ent.Value) error {
 	switch name {
 	}
-	return fmt.Errorf("unknown OAuth2Client numeric field %s", name)
+	return fmt.Errorf("unknown Password numeric field %s", name)
 }
 
 // ClearedFields returns all nullable fields that were cleared during this
 // mutation.
-func (m *OAuth2ClientMutation) ClearedFields() []string {
+func (m *PasswordMutation) ClearedFields() []string {
 	var fields []string
-	if m.FieldCleared(oauth2client.FieldRedirectUris) {
-		fields = append(fields, oauth2client.FieldRedirectUris)
+	if m.FieldCleared(password.FieldEmailVerified) {
+		fields = append(fields, password.FieldEmailVerified)
 	}
-	if m.FieldCleared(oauth2client.FieldTrustedPeers) {
-		fields = append(fields, oauth2client.FieldTrustedPeers)
+	if m.FieldCleared(password.FieldGroups) {
+		fields = append(fields, password.FieldGroups)
 	}
 	return fields
 }
 
 // FieldCleared returns a boolean indicating if a field with the given name was
 // cleared in this mutation.
-func (m *OAuth2ClientMutation) FieldCleared(name string) bool {
+func (m *PasswordMutation) FieldCleared(name string) bool {
 	_, ok := m.clearedFields[name]
 	return ok
 }
 
 // ClearField clears the value of the field with the given name. It returns an
 // error if the field is not defined in the schema.
-func (m *OAuth2ClientMutation) ClearField(name string) error {
+func (m *PasswordMutation) ClearField(name string) error {
 	switch name {
-	case oauth2client.FieldRedirectUris:
-		m.ClearRedirectUris()
+	case password.FieldEmailVerified:
+		m.ClearEmailVerified()
 		return nil
-	case oauth2client.FieldTrustedPeers:
-		m.ClearTrustedPeers()
+	case password.FieldGroups:
+		m.ClearGroups()
 		return nil
 	}
-	return fmt.Errorf("unknown OAuth2Client nullable field %s", name)
+	return fmt.Errorf("unknown Password nullable field %s", name)
 }
 
 // ResetField resets all changes in the mutation for the field with the given name.
 // It returns an error if the field is not defined in the schema.
-func (m *OAuth2ClientMutation) ResetField(name string) error {
+func (m *PasswordMutation) ResetField(name string) error {
 	switch name {
-	case oauth2client.FieldSecret:
-		m.ResetSecret()
-		return nil
-	case oauth2client.FieldRedirectUris:
-		m.ResetRedirectUris()
+	case password.FieldEmail:
+		m.ResetEmail()
 		return nil
-	case oauth2client.FieldTrustedPeers:
-		m.ResetTrustedPeers()
+	case password.FieldHash:
+		m.ResetHash()
 		return nil
-	case oauth2client.FieldPublic:
-		m.ResetPublic()
+	case password.FieldUsername:
+		m.ResetUsername()
 		return nil
-	case oauth2client.FieldName:
+	case password.FieldName:
 		m.ResetName()
 		return nil
-	case oauth2client.FieldLogoURL:
-		m.ResetLogoURL()
+	case password.FieldPreferredUsername:
+		m.ResetPreferredUsername()
+		return nil
+	case password.FieldEmailVerified:
+		m.ResetEmailVerified()
+		return nil
+	case password.FieldUserID:
+		m.ResetUserID()
+		return nil
+	case password.FieldGroups:
+		m.ResetGroups()
 		return nil
 	}
-	return fmt.Errorf("unknown OAuth2Client field %s", name)
+	return fmt.Errorf("unknown Password field %s", name)
 }
 
 // AddedEdges returns all edge names that were set/added in this mutation.
-func (m *OAuth2ClientMutation) AddedEdges() []string {
+func (m *PasswordMutation) AddedEdges() []string {
 	edges := make([]string, 0, 0)
 	return edges
 }
 
 // AddedIDs returns all IDs (to other nodes) that were added for the given edge
 // name in this mutation.
-func (m *OAuth2ClientMutation) AddedIDs(name string) []ent.Value {
+func (m *PasswordMutation) AddedIDs(name string) []ent.Value {
 	return nil
 }
 
 // RemovedEdges returns all edge names that were removed in this mutation.
-func (m *OAuth2ClientMutation) RemovedEdges() []string {
+func (m *PasswordMutation) RemovedEdges() []string {
 	edges := make([]string, 0, 0)
 	return edges
 }
 
 // RemovedIDs returns all IDs (to other nodes) that were removed for the edge with
 // the given name in this mutation.
-func (m *OAuth2ClientMutation) RemovedIDs(name string) []ent.Value {
+func (m *PasswordMutation) RemovedIDs(name string) []ent.Value {
 	return nil
 }
 
 // ClearedEdges returns all edge names that were cleared in this mutation.
-func (m *OAuth2ClientMutation) ClearedEdges() []string {
+func (m *PasswordMutation) ClearedEdges() []string {
 	edges := make([]string, 0, 0)
 	return edges
 }
 
 // EdgeCleared returns a boolean which indicates if the edge with the given name
 // was cleared in this mutation.
-func (m *OAuth2ClientMutation) EdgeCleared(name string) bool {
+func (m *PasswordMutation) EdgeCleared(name string) bool {
 	return false
 }
 
 // ClearEdge clears the value of the edge with the given name. It returns an error
 // if that edge is not defined in the schema.
-func (m *OAuth2ClientMutation) ClearEdge(name string) error {
-	return fmt.Errorf("unknown OAuth2Client unique edge %s", name)
+func (m *PasswordMutation) ClearEdge(name string) error {
+	return fmt.Errorf("unknown Password unique edge %s", name)
 }
 
 // ResetEdge resets all changes to the edge with the given name in this mutation.
 // It returns an error if the edge is not defined in the schema.
-func (m *OAuth2ClientMutation) ResetEdge(name string) error {
-	return fmt.Errorf("unknown OAuth2Client edge %s", name)
+func (m *PasswordMutation) ResetEdge(name string) error {
+	return fmt.Errorf("unknown Password edge %s", name)
 }
 
-// OfflineSessionMutation represents an operation that mutates the OfflineSession nodes in the graph.
-type OfflineSessionMutation struct {
+// RefreshTokenMutation represents an operation that mutates the RefreshToken nodes in the graph.
+type RefreshTokenMutation struct {
 	config
-	op             Op
-	typ            string
-	id             *string
-	user_id        *string
-	conn_id        *string
-	refresh        *[]byte
-	connector_data *[]byte
-	clearedFields  map[string]struct{}
-	done           bool
-	oldValue       func(context.Context) (*OfflineSession, error)
-	predicates     []predicate.OfflineSession
+	op                        Op
+	typ                       string
+	id                        *string
+	client_id                 *string
+	scopes                    *[]string
+	appendscopes              []string
+	nonce                     *string
+	claims_user_id            *string
+	claims_username           *string
+	claims_email              *string
+	claims_email_verified     *bool
+	claims_groups             *[]string
+	appendclaims_groups       []string
+	claims_preferred_username *string
+	connector_id              *string
+	connector_data            *[]byte
+	token                     *string
+	obsolete_token            *string
+	created_at                *time.Time
+	last_used                 *time.Time
+	clearedFields             map[string]struct{}
+	done                      bool
+	oldValue                  func(context.Context) (*RefreshToken, error)
+	predicates                []predicate.RefreshToken
 }
 
-var _ ent.Mutation = (*OfflineSessionMutation)(nil)
+var _ ent.Mutation = (*RefreshTokenMutation)(nil)
 
-// offlinesessionOption allows management of the mutation configuration using functional options.
-type offlinesessionOption func(*OfflineSessionMutation)
+// refreshtokenOption allows management of the mutation configuration using functional options.
+type refreshtokenOption func(*RefreshTokenMutation)
 
-// newOfflineSessionMutation creates new mutation for the OfflineSession entity.
-func newOfflineSessionMutation(c config, op Op, opts ...offlinesessionOption) *OfflineSessionMutation {
-	m := &OfflineSessionMutation{
+// newRefreshTokenMutation creates new mutation for the RefreshToken entity.
+func newRefreshTokenMutation(c config, op Op, opts ...refreshtokenOption) *RefreshTokenMutation {
+	m := &RefreshTokenMutation{
 		config:        c,
 		op:            op,
-		typ:           TypeOfflineSession,
+		typ:           TypeRefreshToken,
 		clearedFields: make(map[string]struct{}),
 	}
 	for _, opt := range opts {
@@ -5519,20 +9181,20 @@ func newOfflineSessionMutation(c config, op Op, opts ...offlinesessionOption) *O
 	return m
 }
 
-// withOfflineSessionID sets the ID field of the mutation.
-func withOfflineSessionID(id string) offlinesessionOption {
-	return func(m *OfflineSessionMutation) {
+// withRefreshTokenID sets the ID field of the mutation.
+func withRefreshTokenID(id string) refreshtokenOption {
+	return func(m *RefreshTokenMutation) {
 		var (
 			err   error
 			once  sync.Once
-			value *OfflineSession
+			value *RefreshToken
 		)
-		m.oldValue = func(ctx context.Context) (*OfflineSession, error) {
+		m.oldValue = func(ctx context.Context) (*RefreshToken, error) {
 			once.Do(func() {
 				if m.done {
 					err = errors.New("querying old values post mutation is not allowed")
 				} else {
-					value, err = m.Client().OfflineSession.Get(ctx, id)
+					value, err = m.Client().RefreshToken.Get(ctx, id)
 				}
 			})
 			return value, err
@@ -5541,10 +9203,10 @@ func withOfflineSessionID(id string) offlinesessionOption {
 	}
 }
 
-// withOfflineSession sets the old OfflineSession of the mutation.
-func withOfflineSession(node *OfflineSession) offlinesessionOption {
-	return func(m *OfflineSessionMutation) {
-		m.oldValue = func(context.Context) (*OfflineSession, error) {
+// withRefreshToken sets the old RefreshToken of the mutation.
+func withRefreshToken(node *RefreshToken) refreshtokenOption {
+	return func(m *RefreshTokenMutation) {
+		m.oldValue = func(context.Context) (*RefreshToken, error) {
 			return node, nil
 		}
 		m.id = &node.ID
@@ -5553,7 +9215,7 @@ func withOfflineSession(node *OfflineSession) offlinesessionOption {
 
 // Client returns a new `ent.Client` from the mutation. If the mutation was
 // executed in a transaction (ent.Tx), a transactional client is returned.
-func (m OfflineSessionMutation) Client() *Client {
+func (m RefreshTokenMutation) Client() *Client {
 	client := &Client{config: m.config}
 	client.init()
 	return client
@@ -5561,7 +9223,7 @@ func (m OfflineSessionMutation) Client() *Client {
 
 // Tx returns an `ent.Tx` for mutations that were executed in transactions;
 // it returns an error otherwise.
-func (m OfflineSessionMutation) Tx() (*Tx, error) {
+func (m RefreshTokenMutation) Tx() (*Tx, error) {
 	if _, ok := m.driver.(*txDriver); !ok {
 		return nil, errors.New("db: mutation is not running in a transaction")
 	}
@@ -5571,14 +9233,14 @@ func (m OfflineSessionMutation) Tx() (*Tx, error) {
 }
 
 // SetID sets the value of the id field. Note that this
-// operation is only accepted on creation of OfflineSession entities.
-func (m *OfflineSessionMutation) SetID(id string) {
+// operation is only accepted on creation of RefreshToken entities.
+func (m *RefreshTokenMutation) SetID(id string) {
 	m.id = &id
 }
 
 // ID returns the ID value in the mutation. Note that the ID is only available
 // if it was provided to the builder or after it was returned from the database.
-func (m *OfflineSessionMutation) ID() (id string, exists bool) {
+func (m *RefreshTokenMutation) ID() (id string, exists bool) {
 	if m.id == nil {
 		return
 	}
@@ -5589,7 +9251,7 @@ func (m *OfflineSessionMutation) ID() (id string, exists bool) {
 // That means, if the mutation is applied within a transaction with an isolation level such
 // as sql.LevelSerializable, the returned ids match the ids of the rows that will be updated
 // or updated by the mutation.
-func (m *OfflineSessionMutation) IDs(ctx context.Context) ([]string, error) {
+func (m *RefreshTokenMutation) IDs(ctx context.Context) ([]string, error) {
 	switch {
 	case m.op.Is(OpUpdateOne | OpDeleteOne):
 		id, exists := m.ID()
@@ -5598,682 +9260,702 @@ func (m *OfflineSessionMutation) IDs(ctx context.Context) ([]string, error) {
 		}
 		fallthrough
 	case m.op.Is(OpUpdate | OpDelete):
-		return m.Client().OfflineSession.Query().Where(m.predicates...).IDs(ctx)
+		return m.Client().RefreshToken.Query().Where(m.predicates...).IDs(ctx)
 	default:
 		return nil, fmt.Errorf("IDs is not allowed on %s operations", m.op)
 	}
 }
 
-// SetUserID sets the "user_id" field.
-func (m *OfflineSessionMutation) SetUserID(s string) {
-	m.user_id = &s
+// SetClientID sets the "client_id" field.
+func (m *RefreshTokenMutation) SetClientID(s string) {
+	m.client_id = &s
 }
 
-// UserID returns the value of the "user_id" field in the mutation.
-func (m *OfflineSessionMutation) UserID() (r string, exists bool) {
-	v := m.user_id
+// ClientID returns the value of the "client_id" field in the mutation.
+func (m *RefreshTokenMutation) ClientID() (r string, exists bool) {
+	v := m.client_id
 	if v == nil {
 		return
 	}
 	return *v, true
 }
 
-// OldUserID returns the old "user_id" field's value of the OfflineSession entity.
-// If the OfflineSession object wasn't provided to the builder, the object is fetched from the database.
+// OldClientID returns the old "client_id" field's value of the RefreshToken entity.
+// If the RefreshToken object wasn't provided to the builder, the object is fetched from the database.
 // An error is returned if the mutation operation is not UpdateOne, or the database query fails.
-func (m *OfflineSessionMutation) OldUserID(ctx context.Context) (v string, err error) {
+func (m *RefreshTokenMutation) OldClientID(ctx context.Context) (v string, err error) {
 	if !m.op.Is(OpUpdateOne) {
-		return v, errors.New("OldUserID is only allowed on UpdateOne operations")
+		return v, errors.New("OldClientID is only allowed on UpdateOne operations")
 	}
 	if m.id == nil || m.oldValue == nil {
-		return v, errors.New("OldUserID requires an ID field in the mutation")
+		return v, errors.New("OldClientID requires an ID field in the mutation")
 	}
 	oldValue, err := m.oldValue(ctx)
 	if err != nil {
-		return v, fmt.Errorf("querying old value for OldUserID: %w", err)
+		return v, fmt.Errorf("querying old value for OldClientID: %w", err)
 	}
-	return oldValue.UserID, nil
+	return oldValue.ClientID, nil
 }
 
-// ResetUserID resets all changes to the "user_id" field.
-func (m *OfflineSessionMutation) ResetUserID() {
-	m.user_id = nil
+// ResetClientID resets all changes to the "client_id" field.
+func (m *RefreshTokenMutation) ResetClientID() {
+	m.client_id = nil
 }
 
-// SetConnID sets the "conn_id" field.
-func (m *OfflineSessionMutation) SetConnID(s string) {
-	m.conn_id = &s
+// SetScopes sets the "scopes" field.
+func (m *RefreshTokenMutation) SetScopes(s []string) {
+	m.scopes = &s
+	m.appendscopes = nil
 }
 
-// ConnID returns the value of the "conn_id" field in the mutation.
-func (m *OfflineSessionMutation) ConnID() (r string, exists bool) {
-	v := m.conn_id
+// Scopes returns the value of the "scopes" field in the mutation.
+func (m *RefreshTokenMutation) Scopes() (r []string, exists bool) {
+	v := m.scopes
 	if v == nil {
 		return
 	}
 	return *v, true
 }
 
-// OldConnID returns the old "conn_id" field's value of the OfflineSession entity.
-// If the OfflineSession object wasn't provided to the builder, the object is fetched from the database.
+// OldScopes returns the old "scopes" field's value of the RefreshToken entity.
+// If the RefreshToken object wasn't provided to the builder, the object is fetched from the database.
 // An error is returned if the mutation operation is not UpdateOne, or the database query fails.
-func (m *OfflineSessionMutation) OldConnID(ctx context.Context) (v string, err error) {
+func (m *RefreshTokenMutation) OldScopes(ctx context.Context) (v []string, err error) {
 	if !m.op.Is(OpUpdateOne) {
-		return v, errors.New("OldConnID is only allowed on UpdateOne operations")
+		return v, errors.New("OldScopes is only allowed on UpdateOne operations")
 	}
 	if m.id == nil || m.oldValue == nil {
-		return v, errors.New("OldConnID requires an ID field in the mutation")
+		return v, errors.New("OldScopes requires an ID field in the mutation")
 	}
 	oldValue, err := m.oldValue(ctx)
 	if err != nil {
-		return v, fmt.Errorf("querying old value for OldConnID: %w", err)
+		return v, fmt.Errorf("querying old value for OldScopes: %w", err)
 	}
-	return oldValue.ConnID, nil
+	return oldValue.Scopes, nil
 }
 
-// ResetConnID resets all changes to the "conn_id" field.
-func (m *OfflineSessionMutation) ResetConnID() {
-	m.conn_id = nil
+// AppendScopes adds s to the "scopes" field.
+func (m *RefreshTokenMutation) AppendScopes(s []string) {
+	m.appendscopes = append(m.appendscopes, s...)
 }
 
-// SetRefresh sets the "refresh" field.
-func (m *OfflineSessionMutation) SetRefresh(b []byte) {
-	m.refresh = &b
+// AppendedScopes returns the list of values that were appended to the "scopes" field in this mutation.
+func (m *RefreshTokenMutation) AppendedScopes() ([]string, bool) {
+	if len(m.appendscopes) == 0 {
+		return nil, false
+	}
+	return m.appendscopes, true
 }
 
-// Refresh returns the value of the "refresh" field in the mutation.
-func (m *OfflineSessionMutation) Refresh() (r []byte, exists bool) {
-	v := m.refresh
-	if v == nil {
-		return
-	}
-	return *v, true
+// ClearScopes clears the value of the "scopes" field.
+func (m *RefreshTokenMutation) ClearScopes() {
+	m.scopes = nil
+	m.appendscopes = nil
+	m.clearedFields[refreshtoken.FieldScopes] = struct{}{}
 }
 
-// OldRefresh returns the old "refresh" field's value of the OfflineSession entity.
-// If the OfflineSession object wasn't provided to the builder, the object is fetched from the database.
-// An error is returned if the mutation operation is not UpdateOne, or the database query fails.
-func (m *OfflineSessionMutation) OldRefresh(ctx context.Context) (v []byte, err error) {
-	if !m.op.Is(OpUpdateOne) {
-		return v, errors.New("OldRefresh is only allowed on UpdateOne operations")
-	}
-	if m.id == nil || m.oldValue == nil {
-		return v, errors.New("OldRefresh requires an ID field in the mutation")
-	}
-	oldValue, err := m.oldValue(ctx)
-	if err != nil {
-		return v, fmt.Errorf("querying old value for OldRefresh: %w", err)
-	}
-	return oldValue.Refresh, nil
+// ScopesCleared returns if the "scopes" field was cleared in this mutation.
+func (m *RefreshTokenMutation) ScopesCleared() bool {
+	_, ok := m.clearedFields[refreshtoken.FieldScopes]
+	return ok
 }
 
-// ResetRefresh resets all changes to the "refresh" field.
-func (m *OfflineSessionMutation) ResetRefresh() {
-	m.refresh = nil
+// ResetScopes resets all changes to the "scopes" field.
+func (m *RefreshTokenMutation) ResetScopes() {
+	m.scopes = nil
+	m.appendscopes = nil
+	delete(m.clearedFields, refreshtoken.FieldScopes)
 }
 
-// SetConnectorData sets the "connector_data" field.
-func (m *OfflineSessionMutation) SetConnectorData(b []byte) {
-	m.connector_data = &b
+// SetNonce sets the "nonce" field.
+func (m *RefreshTokenMutation) SetNonce(s string) {
+	m.nonce = &s
 }
 
-// ConnectorData returns the value of the "connector_data" field in the mutation.
-func (m *OfflineSessionMutation) ConnectorData() (r []byte, exists bool) {
-	v := m.connector_data
+// Nonce returns the value of the "nonce" field in the mutation.
+func (m *RefreshTokenMutation) Nonce() (r string, exists bool) {
+	v := m.nonce
 	if v == nil {
 		return
 	}
 	return *v, true
 }
 
-// OldConnectorData returns the old "connector_data" field's value of the OfflineSession entity.
-// If the OfflineSession object wasn't provided to the builder, the object is fetched from the database.
+// OldNonce returns the old "nonce" field's value of the RefreshToken entity.
+// If the RefreshToken object wasn't provided to the builder, the object is fetched from the database.
 // An error is returned if the mutation operation is not UpdateOne, or the database query fails.
-func (m *OfflineSessionMutation) OldConnectorData(ctx context.Context) (v *[]byte, err error) {
+func (m *RefreshTokenMutation) OldNonce(ctx context.Context) (v string, err error) {
 	if !m.op.Is(OpUpdateOne) {
-		return v, errors.New("OldConnectorData is only allowed on UpdateOne operations")
+		return v, errors.New("OldNonce is only allowed on UpdateOne operations")
 	}
 	if m.id == nil || m.oldValue == nil {
-		return v, errors.New("OldConnectorData requires an ID field in the mutation")
+		return v, errors.New("OldNonce requires an ID field in the mutation")
 	}
 	oldValue, err := m.oldValue(ctx)
 	if err != nil {
-		return v, fmt.Errorf("querying old value for OldConnectorData: %w", err)
+		return v, fmt.Errorf("querying old value for OldNonce: %w", err)
 	}
-	return oldValue.ConnectorData, nil
-}
-
-// ClearConnectorData clears the value of the "connector_data" field.
-func (m *OfflineSessionMutation) ClearConnectorData() {
-	m.connector_data = nil
-	m.clearedFields[offlinesession.FieldConnectorData] = struct{}{}
-}
-
-// ConnectorDataCleared returns if the "connector_data" field was cleared in this mutation.
-func (m *OfflineSessionMutation) ConnectorDataCleared() bool {
-	_, ok := m.clearedFields[offlinesession.FieldConnectorData]
-	return ok
-}
-
-// ResetConnectorData resets all changes to the "connector_data" field.
-func (m *OfflineSessionMutation) ResetConnectorData() {
-	m.connector_data = nil
-	delete(m.clearedFields, offlinesession.FieldConnectorData)
+	return oldValue.Nonce, nil
 }
 
-// Where appends a list predicates to the OfflineSessionMutation builder.
-func (m *OfflineSessionMutation) Where(ps ...predicate.OfflineSession) {
-	m.predicates = append(m.predicates, ps...)
+// ResetNonce resets all changes to the "nonce" field.
+func (m *RefreshTokenMutation) ResetNonce() {
+	m.nonce = nil
 }
 
-// Op returns the operation name.
-func (m *OfflineSessionMutation) Op() Op {
-	return m.op
+// SetClaimsUserID sets the "claims_user_id" field.
+func (m *RefreshTokenMutation) SetClaimsUserID(s string) {
+	m.claims_user_id = &s
 }
 
-// Type returns the node type of this mutation (OfflineSession).
-func (m *OfflineSessionMutation) Type() string {
-	return m.typ
+// ClaimsUserID returns the value of the "claims_user_id" field in the mutation.
+func (m *RefreshTokenMutation) ClaimsUserID() (r string, exists bool) {
+	v := m.claims_user_id
+	if v == nil {
+		return
+	}
+	return *v, true
 }
 
-// Fields returns all fields that were changed during this mutation. Note that in
-// order to get all numeric fields that were incremented/decremented, call
-// AddedFields().
-func (m *OfflineSessionMutation) Fields() []string {
-	fields := make([]string, 0, 4)
-	if m.user_id != nil {
-		fields = append(fields, offlinesession.FieldUserID)
-	}
-	if m.conn_id != nil {
-		fields = append(fields, offlinesession.FieldConnID)
+// OldClaimsUserID returns the old "claims_user_id" field's value of the RefreshToken entity.
+// If the RefreshToken object wasn't provided to the builder, the object is fetched from the database.
+// An error is returned if the mutation operation is not UpdateOne, or the database query fails.
+func (m *RefreshTokenMutation) OldClaimsUserID(ctx context.Context) (v string, err error) {
+	if !m.op.Is(OpUpdateOne) {
+		return v, errors.New("OldClaimsUserID is only allowed on UpdateOne operations")
 	}
-	if m.refresh != nil {
-		fields = append(fields, offlinesession.FieldRefresh)
+	if m.id == nil || m.oldValue == nil {
+		return v, errors.New("OldClaimsUserID requires an ID field in the mutation")
 	}
-	if m.connector_data != nil {
-		fields = append(fields, offlinesession.FieldConnectorData)
+	oldValue, err := m.oldValue(ctx)
+	if err != nil {
+		return v, fmt.Errorf("querying old value for OldClaimsUserID: %w", err)
 	}
-	return fields
+	return oldValue.ClaimsUserID, nil
 }
 
-// Field returns the value of a field with the given name. The second boolean
-// return value indicates that this field was not set, or was not defined in the
-// schema.
-func (m *OfflineSessionMutation) Field(name string) (ent.Value, bool) {
-	switch name {
-	case offlinesession.FieldUserID:
-		return m.UserID()
-	case offlinesession.FieldConnID:
-		return m.ConnID()
-	case offlinesession.FieldRefresh:
-		return m.Refresh()
-	case offlinesession.FieldConnectorData:
-		return m.ConnectorData()
-	}
-	return nil, false
+// ResetClaimsUserID resets all changes to the "claims_user_id" field.
+func (m *RefreshTokenMutation) ResetClaimsUserID() {
+	m.claims_user_id = nil
 }
 
-// OldField returns the old value of the field from the database. An error is
-// returned if the mutation operation is not UpdateOne, or the query to the
-// database failed.
-func (m *OfflineSessionMutation) OldField(ctx context.Context, name string) (ent.Value, error) {
-	switch name {
-	case offlinesession.FieldUserID:
-		return m.OldUserID(ctx)
-	case offlinesession.FieldConnID:
-		return m.OldConnID(ctx)
-	case offlinesession.FieldRefresh:
-		return m.OldRefresh(ctx)
-	case offlinesession.FieldConnectorData:
-		return m.OldConnectorData(ctx)
+// SetClaimsUsername sets the "claims_username" field.
+func (m *RefreshTokenMutation) SetClaimsUsername(s string) {
+	m.claims_username = &s
+}
+
+// ClaimsUsername returns the value of the "claims_username" field in the mutation.
+func (m *RefreshTokenMutation) ClaimsUsername() (r string, exists bool) {
+	v := m.claims_username
+	if v == nil {
+		return
 	}
-	return nil, fmt.Errorf("unknown OfflineSession field %s", name)
+	return *v, true
 }
 
-// SetField sets the value of a field with the given name. It returns an error if
-// the field is not defined in the schema, or if the type mismatched the field
-// type.
-func (m *OfflineSessionMutation) SetField(name string, value ent.Value) error {
-	switch name {
-	case offlinesession.FieldUserID:
-		v, ok := value.(string)
-		if !ok {
-			return fmt.Errorf("unexpected type %T for field %s", value, name)
-		}
-		m.SetUserID(v)
-		return nil
-	case offlinesession.FieldConnID:
-		v, ok := value.(string)
-		if !ok {
-			return fmt.Errorf("unexpected type %T for field %s", value, name)
-		}
-		m.SetConnID(v)
-		return nil
-	case offlinesession.FieldRefresh:
-		v, ok := value.([]byte)
-		if !ok {
-			return fmt.Errorf("unexpected type %T for field %s", value, name)
-		}
-		m.SetRefresh(v)
-		return nil
-	case offlinesession.FieldConnectorData:
-		v, ok := value.([]byte)
-		if !ok {
-			return fmt.Errorf("unexpected type %T for field %s", value, name)
-		}
-		m.SetConnectorData(v)
-		return nil
+// OldClaimsUsername returns the old "claims_username" field's value of the RefreshToken entity.
+// If the RefreshToken object wasn't provided to the builder, the object is fetched from the database.
+// An error is returned if the mutation operation is not UpdateOne, or the database query fails.
+func (m *RefreshTokenMutation) OldClaimsUsername(ctx context.Context) (v string, err error) {
+	if !m.op.Is(OpUpdateOne) {
+		return v, errors.New("OldClaimsUsername is only allowed on UpdateOne operations")
 	}
-	return fmt.Errorf("unknown OfflineSession field %s", name)
+	if m.id == nil || m.oldValue == nil {
+		return v, errors.New("OldClaimsUsername requires an ID field in the mutation")
+	}
+	oldValue, err := m.oldValue(ctx)
+	if err != nil {
+		return v, fmt.Errorf("querying old value for OldClaimsUsername: %w", err)
+	}
+	return oldValue.ClaimsUsername, nil
 }
 
-// AddedFields returns all numeric fields that were incremented/decremented during
-// this mutation.
-func (m *OfflineSessionMutation) AddedFields() []string {
-	return nil
+// ResetClaimsUsername resets all changes to the "claims_username" field.
+func (m *RefreshTokenMutation) ResetClaimsUsername() {
+	m.claims_username = nil
 }
 
-// AddedField returns the numeric value that was incremented/decremented on a field
-// with the given name. The second boolean return value indicates that this field
-// was not set, or was not defined in the schema.
-func (m *OfflineSessionMutation) AddedField(name string) (ent.Value, bool) {
-	return nil, false
+// SetClaimsEmail sets the "claims_email" field.
+func (m *RefreshTokenMutation) SetClaimsEmail(s string) {
+	m.claims_email = &s
 }
 
-// AddField adds the value to the field with the given name. It returns an error if
-// the field is not defined in the schema, or if the type mismatched the field
-// type.
-func (m *OfflineSessionMutation) AddField(name string, value ent.Value) error {
-	switch name {
+// ClaimsEmail returns the value of the "claims_email" field in the mutation.
+func (m *RefreshTokenMutation) ClaimsEmail() (r string, exists bool) {
+	v := m.claims_email
+	if v == nil {
+		return
 	}
-	return fmt.Errorf("unknown OfflineSession numeric field %s", name)
+	return *v, true
 }
 
-// ClearedFields returns all nullable fields that were cleared during this
-// mutation.
-func (m *OfflineSessionMutation) ClearedFields() []string {
-	var fields []string
-	if m.FieldCleared(offlinesession.FieldConnectorData) {
-		fields = append(fields, offlinesession.FieldConnectorData)
+// OldClaimsEmail returns the old "claims_email" field's value of the RefreshToken entity.
+// If the RefreshToken object wasn't provided to the builder, the object is fetched from the database.
+// An error is returned if the mutation operation is not UpdateOne, or the database query fails.
+func (m *RefreshTokenMutation) OldClaimsEmail(ctx context.Context) (v string, err error) {
+	if !m.op.Is(OpUpdateOne) {
+		return v, errors.New("OldClaimsEmail is only allowed on UpdateOne operations")
 	}
-	return fields
+	if m.id == nil || m.oldValue == nil {
+		return v, errors.New("OldClaimsEmail requires an ID field in the mutation")
+	}
+	oldValue, err := m.oldValue(ctx)
+	if err != nil {
+		return v, fmt.Errorf("querying old value for OldClaimsEmail: %w", err)
+	}
+	return oldValue.ClaimsEmail, nil
 }
 
-// FieldCleared returns a boolean indicating if a field with the given name was
-// cleared in this mutation.
-func (m *OfflineSessionMutation) FieldCleared(name string) bool {
-	_, ok := m.clearedFields[name]
-	return ok
+// ResetClaimsEmail resets all changes to the "claims_email" field.
+func (m *RefreshTokenMutation) ResetClaimsEmail() {
+	m.claims_email = nil
 }
 
-// ClearField clears the value of the field with the given name. It returns an
-// error if the field is not defined in the schema.
-func (m *OfflineSessionMutation) ClearField(name string) error {
-	switch name {
-	case offlinesession.FieldConnectorData:
-		m.ClearConnectorData()
-		return nil
+// SetClaimsEmailVerified sets the "claims_email_verified" field.
+func (m *RefreshTokenMutation) SetClaimsEmailVerified(b bool) {
+	m.claims_email_verified = &b
+}
+
+// ClaimsEmailVerified returns the value of the "claims_email_verified" field in the mutation.
+func (m *RefreshTokenMutation) ClaimsEmailVerified() (r bool, exists bool) {
+	v := m.claims_email_verified
+	if v == nil {
+		return
 	}
-	return fmt.Errorf("unknown OfflineSession nullable field %s", name)
+	return *v, true
 }
 
-// ResetField resets all changes in the mutation for the field with the given name.
-// It returns an error if the field is not defined in the schema.
-func (m *OfflineSessionMutation) ResetField(name string) error {
-	switch name {
-	case offlinesession.FieldUserID:
-		m.ResetUserID()
-		return nil
-	case offlinesession.FieldConnID:
-		m.ResetConnID()
-		return nil
-	case offlinesession.FieldRefresh:
-		m.ResetRefresh()
-		return nil
-	case offlinesession.FieldConnectorData:
-		m.ResetConnectorData()
-		return nil
+// OldClaimsEmailVerified returns the old "claims_email_verified" field's value of the RefreshToken entity.
+// If the RefreshToken object wasn't provided to the builder, the object is fetched from the database.
+// An error is returned if the mutation operation is not UpdateOne, or the database query fails.
+func (m *RefreshTokenMutation) OldClaimsEmailVerified(ctx context.Context) (v bool, err error) {
+	if !m.op.Is(OpUpdateOne) {
+		return v, errors.New("OldClaimsEmailVerified is only allowed on UpdateOne operations")
 	}
-	return fmt.Errorf("unknown OfflineSession field %s", name)
+	if m.id == nil || m.oldValue == nil {
+		return v, errors.New("OldClaimsEmailVerified requires an ID field in the mutation")
+	}
+	oldValue, err := m.oldValue(ctx)
+	if err != nil {
+		return v, fmt.Errorf("querying old value for OldClaimsEmailVerified: %w", err)
+	}
+	return oldValue.ClaimsEmailVerified, nil
 }
 
-// AddedEdges returns all edge names that were set/added in this mutation.
-func (m *OfflineSessionMutation) AddedEdges() []string {
-	edges := make([]string, 0, 0)
-	return edges
+// ResetClaimsEmailVerified resets all changes to the "claims_email_verified" field.
+func (m *RefreshTokenMutation) ResetClaimsEmailVerified() {
+	m.claims_email_verified = nil
 }
 
-// AddedIDs returns all IDs (to other nodes) that were added for the given edge
-// name in this mutation.
-func (m *OfflineSessionMutation) AddedIDs(name string) []ent.Value {
-	return nil
+// SetClaimsGroups sets the "claims_groups" field.
+func (m *RefreshTokenMutation) SetClaimsGroups(s []string) {
+	m.claims_groups = &s
+	m.appendclaims_groups = nil
 }
 
-// RemovedEdges returns all edge names that were removed in this mutation.
-func (m *OfflineSessionMutation) RemovedEdges() []string {
-	edges := make([]string, 0, 0)
-	return edges
+// ClaimsGroups returns the value of the "claims_groups" field in the mutation.
+func (m *RefreshTokenMutation) ClaimsGroups() (r []string, exists bool) {
+	v := m.claims_groups
+	if v == nil {
+		return
+	}
+	return *v, true
 }
 
-// RemovedIDs returns all IDs (to other nodes) that were removed for the edge with
-// the given name in this mutation.
-func (m *OfflineSessionMutation) RemovedIDs(name string) []ent.Value {
-	return nil
+// OldClaimsGroups returns the old "claims_groups" field's value of the RefreshToken entity.
+// If the RefreshToken object wasn't provided to the builder, the object is fetched from the database.
+// An error is returned if the mutation operation is not UpdateOne, or the database query fails.
+func (m *RefreshTokenMutation) OldClaimsGroups(ctx context.Context) (v []string, err error) {
+	if !m.op.Is(OpUpdateOne) {
+		return v, errors.New("OldClaimsGroups is only allowed on UpdateOne operations")
+	}
+	if m.id == nil || m.oldValue == nil {
+		return v, errors.New("OldClaimsGroups requires an ID field in the mutation")
+	}
+	oldValue, err := m.oldValue(ctx)
+	if err != nil {
+		return v, fmt.Errorf("querying old value for OldClaimsGroups: %w", err)
+	}
+	return oldValue.ClaimsGroups, nil
 }
 
-// ClearedEdges returns all edge names that were cleared in this mutation.
-func (m *OfflineSessionMutation) ClearedEdges() []string {
-	edges := make([]string, 0, 0)
-	return edges
+// AppendClaimsGroups adds s to the "claims_groups" field.
+func (m *RefreshTokenMutation) AppendClaimsGroups(s []string) {
+	m.appendclaims_groups = append(m.appendclaims_groups, s...)
 }
 
-// EdgeCleared returns a boolean which indicates if the edge with the given name
-// was cleared in this mutation.
-func (m *OfflineSessionMutation) EdgeCleared(name string) bool {
-	return false
+// AppendedClaimsGroups returns the list of values that were appended to the "claims_groups" field in this mutation.
+func (m *RefreshTokenMutation) AppendedClaimsGroups() ([]string, bool) {
+	if len(m.appendclaims_groups) == 0 {
+		return nil, false
+	}
+	return m.appendclaims_groups, true
 }
 
-// ClearEdge clears the value of the edge with the given name. It returns an error
-// if that edge is not defined in the schema.
-func (m *OfflineSessionMutation) ClearEdge(name string) error {
-	return fmt.Errorf("unknown OfflineSession unique edge %s", name)
+// ClearClaimsGroups clears the value of the "claims_groups" field.
+func (m *RefreshTokenMutation) ClearClaimsGroups() {
+	m.claims_groups = nil
+	m.appendclaims_groups = nil
+	m.clearedFields[refreshtoken.FieldClaimsGroups] = struct{}{}
 }
 
-// ResetEdge resets all changes to the edge with the given name in this mutation.
-// It returns an error if the edge is not defined in the schema.
-func (m *OfflineSessionMutation) ResetEdge(name string) error {
-	return fmt.Errorf("unknown OfflineSession edge %s", name)
+// ClaimsGroupsCleared returns if the "claims_groups" field was cleared in this mutation.
+func (m *RefreshTokenMutation) ClaimsGroupsCleared() bool {
+	_, ok := m.clearedFields[refreshtoken.FieldClaimsGroups]
+	return ok
 }
 
-// PasswordMutation represents an operation that mutates the Password nodes in the graph.
-type PasswordMutation struct {
-	config
-	op            Op
-	typ           string
-	id            *int
-	email         *string
-	hash          *[]byte
-	username      *string
-	user_id       *string
-	clearedFields map[string]struct{}
-	done          bool
-	oldValue      func(context.Context) (*Password, error)
-	predicates    []predicate.Password
+// ResetClaimsGroups resets all changes to the "claims_groups" field.
+func (m *RefreshTokenMutation) ResetClaimsGroups() {
+	m.claims_groups = nil
+	m.appendclaims_groups = nil
+	delete(m.clearedFields, refreshtoken.FieldClaimsGroups)
 }
 
-var _ ent.Mutation = (*PasswordMutation)(nil)
+// SetClaimsPreferredUsername sets the "claims_preferred_username" field.
+func (m *RefreshTokenMutation) SetClaimsPreferredUsername(s string) {
+	m.claims_preferred_username = &s
+}
 
-// passwordOption allows management of the mutation configuration using functional options.
-type passwordOption func(*PasswordMutation)
+// ClaimsPreferredUsername returns the value of the "claims_preferred_username" field in the mutation.
+func (m *RefreshTokenMutation) ClaimsPreferredUsername() (r string, exists bool) {
+	v := m.claims_preferred_username
+	if v == nil {
+		return
+	}
+	return *v, true
+}
 
-// newPasswordMutation creates new mutation for the Password entity.
-func newPasswordMutation(c config, op Op, opts ...passwordOption) *PasswordMutation {
-	m := &PasswordMutation{
-		config:        c,
-		op:            op,
-		typ:           TypePassword,
-		clearedFields: make(map[string]struct{}),
+// OldClaimsPreferredUsername returns the old "claims_preferred_username" field's value of the RefreshToken entity.
+// If the RefreshToken object wasn't provided to the builder, the object is fetched from the database.
+// An error is returned if the mutation operation is not UpdateOne, or the database query fails.
+func (m *RefreshTokenMutation) OldClaimsPreferredUsername(ctx context.Context) (v string, err error) {
+	if !m.op.Is(OpUpdateOne) {
+		return v, errors.New("OldClaimsPreferredUsername is only allowed on UpdateOne operations")
 	}
-	for _, opt := range opts {
-		opt(m)
+	if m.id == nil || m.oldValue == nil {
+		return v, errors.New("OldClaimsPreferredUsername requires an ID field in the mutation")
 	}
-	return m
+	oldValue, err := m.oldValue(ctx)
+	if err != nil {
+		return v, fmt.Errorf("querying old value for OldClaimsPreferredUsername: %w", err)
+	}
+	return oldValue.ClaimsPreferredUsername, nil
 }
 
-// withPasswordID sets the ID field of the mutation.
-func withPasswordID(id int) passwordOption {
-	return func(m *PasswordMutation) {
-		var (
-			err   error
-			once  sync.Once
-			value *Password
-		)
-		m.oldValue = func(ctx context.Context) (*Password, error) {
-			once.Do(func() {
-				if m.done {
-					err = errors.New("querying old values post mutation is not allowed")
-				} else {
-					value, err = m.Client().Password.Get(ctx, id)
-				}
-			})
-			return value, err
-		}
-		m.id = &id
+// ResetClaimsPreferredUsername resets all changes to the "claims_preferred_username" field.
+func (m *RefreshTokenMutation) ResetClaimsPreferredUsername() {
+	m.claims_preferred_username = nil
+}
+
+// SetConnectorID sets the "connector_id" field.
+func (m *RefreshTokenMutation) SetConnectorID(s string) {
+	m.connector_id = &s
+}
+
+// ConnectorID returns the value of the "connector_id" field in the mutation.
+func (m *RefreshTokenMutation) ConnectorID() (r string, exists bool) {
+	v := m.connector_id
+	if v == nil {
+		return
 	}
+	return *v, true
 }
 
-// withPassword sets the old Password of the mutation.
-func withPassword(node *Password) passwordOption {
-	return func(m *PasswordMutation) {
-		m.oldValue = func(context.Context) (*Password, error) {
-			return node, nil
-		}
-		m.id = &node.ID
+// OldConnectorID returns the old "connector_id" field's value of the RefreshToken entity.
+// If the RefreshToken object wasn't provided to the builder, the object is fetched from the database.
+// An error is returned if the mutation operation is not UpdateOne, or the database query fails.
+func (m *RefreshTokenMutation) OldConnectorID(ctx context.Context) (v string, err error) {
+	if !m.op.Is(OpUpdateOne) {
+		return v, errors.New("OldConnectorID is only allowed on UpdateOne operations")
+	}
+	if m.id == nil || m.oldValue == nil {
+		return v, errors.New("OldConnectorID requires an ID field in the mutation")
+	}
+	oldValue, err := m.oldValue(ctx)
+	if err != nil {
+		return v, fmt.Errorf("querying old value for OldConnectorID: %w", err)
 	}
+	return oldValue.ConnectorID, nil
 }
 
-// Client returns a new `ent.Client` from the mutation. If the mutation was
-// executed in a transaction (ent.Tx), a transactional client is returned.
-func (m PasswordMutation) Client() *Client {
-	client := &Client{config: m.config}
-	client.init()
-	return client
+// ResetConnectorID resets all changes to the "connector_id" field.
+func (m *RefreshTokenMutation) ResetConnectorID() {
+	m.connector_id = nil
 }
 
-// Tx returns an `ent.Tx` for mutations that were executed in transactions;
-// it returns an error otherwise.
-func (m PasswordMutation) Tx() (*Tx, error) {
-	if _, ok := m.driver.(*txDriver); !ok {
-		return nil, errors.New("db: mutation is not running in a transaction")
-	}
-	tx := &Tx{config: m.config}
-	tx.init()
-	return tx, nil
+// SetConnectorData sets the "connector_data" field.
+func (m *RefreshTokenMutation) SetConnectorData(b []byte) {
+	m.connector_data = &b
 }
 
-// ID returns the ID value in the mutation. Note that the ID is only available
-// if it was provided to the builder or after it was returned from the database.
-func (m *PasswordMutation) ID() (id int, exists bool) {
-	if m.id == nil {
+// ConnectorData returns the value of the "connector_data" field in the mutation.
+func (m *RefreshTokenMutation) ConnectorData() (r []byte, exists bool) {
+	v := m.connector_data
+	if v == nil {
 		return
 	}
-	return *m.id, true
+	return *v, true
 }
 
-// IDs queries the database and returns the entity ids that match the mutation's predicate.
-// That means, if the mutation is applied within a transaction with an isolation level such
-// as sql.LevelSerializable, the returned ids match the ids of the rows that will be updated
-// or updated by the mutation.
-func (m *PasswordMutation) IDs(ctx context.Context) ([]int, error) {
-	switch {
-	case m.op.Is(OpUpdateOne | OpDeleteOne):
-		id, exists := m.ID()
-		if exists {
-			return []int{id}, nil
-		}
-		fallthrough
-	case m.op.Is(OpUpdate | OpDelete):
-		return m.Client().Password.Query().Where(m.predicates...).IDs(ctx)
-	default:
-		return nil, fmt.Errorf("IDs is not allowed on %s operations", m.op)
+// OldConnectorData returns the old "connector_data" field's value of the RefreshToken entity.
+// If the RefreshToken object wasn't provided to the builder, the object is fetched from the database.
+// An error is returned if the mutation operation is not UpdateOne, or the database query fails.
+func (m *RefreshTokenMutation) OldConnectorData(ctx context.Context) (v *[]byte, err error) {
+	if !m.op.Is(OpUpdateOne) {
+		return v, errors.New("OldConnectorData is only allowed on UpdateOne operations")
 	}
+	if m.id == nil || m.oldValue == nil {
+		return v, errors.New("OldConnectorData requires an ID field in the mutation")
+	}
+	oldValue, err := m.oldValue(ctx)
+	if err != nil {
+		return v, fmt.Errorf("querying old value for OldConnectorData: %w", err)
+	}
+	return oldValue.ConnectorData, nil
 }
 
-// SetEmail sets the "email" field.
-func (m *PasswordMutation) SetEmail(s string) {
-	m.email = &s
+// ClearConnectorData clears the value of the "connector_data" field.
+func (m *RefreshTokenMutation) ClearConnectorData() {
+	m.connector_data = nil
+	m.clearedFields[refreshtoken.FieldConnectorData] = struct{}{}
 }
 
-// Email returns the value of the "email" field in the mutation.
-func (m *PasswordMutation) Email() (r string, exists bool) {
-	v := m.email
+// ConnectorDataCleared returns if the "connector_data" field was cleared in this mutation.
+func (m *RefreshTokenMutation) ConnectorDataCleared() bool {
+	_, ok := m.clearedFields[refreshtoken.FieldConnectorData]
+	return ok
+}
+
+// ResetConnectorData resets all changes to the "connector_data" field.
+func (m *RefreshTokenMutation) ResetConnectorData() {
+	m.connector_data = nil
+	delete(m.clearedFields, refreshtoken.FieldConnectorData)
+}
+
+// SetToken sets the "token" field.
+func (m *RefreshTokenMutation) SetToken(s string) {
+	m.token = &s
+}
+
+// Token returns the value of the "token" field in the mutation.
+func (m *RefreshTokenMutation) Token() (r string, exists bool) {
+	v := m.token
 	if v == nil {
 		return
 	}
 	return *v, true
 }
 
-// OldEmail returns the old "email" field's value of the Password entity.
-// If the Password object wasn't provided to the builder, the object is fetched from the database.
+// OldToken returns the old "token" field's value of the RefreshToken entity.
+// If the RefreshToken object wasn't provided to the builder, the object is fetched from the database.
 // An error is returned if the mutation operation is not UpdateOne, or the database query fails.
-func (m *PasswordMutation) OldEmail(ctx context.Context) (v string, err error) {
+func (m *RefreshTokenMutation) OldToken(ctx context.Context) (v string, err error) {
 	if !m.op.Is(OpUpdateOne) {
-		return v, errors.New("OldEmail is only allowed on UpdateOne operations")
+		return v, errors.New("OldToken is only allowed on UpdateOne operations")
 	}
 	if m.id == nil || m.oldValue == nil {
-		return v, errors.New("OldEmail requires an ID field in the mutation")
+		return v, errors.New("OldToken requires an ID field in the mutation")
 	}
 	oldValue, err := m.oldValue(ctx)
 	if err != nil {
-		return v, fmt.Errorf("querying old value for OldEmail: %w", err)
+		return v, fmt.Errorf("querying old value for OldToken: %w", err)
 	}
-	return oldValue.Email, nil
+	return oldValue.Token, nil
 }
 
-// ResetEmail resets all changes to the "email" field.
-func (m *PasswordMutation) ResetEmail() {
-	m.email = nil
+// ResetToken resets all changes to the "token" field.
+func (m *RefreshTokenMutation) ResetToken() {
+	m.token = nil
 }
 
-// SetHash sets the "hash" field.
-func (m *PasswordMutation) SetHash(b []byte) {
-	m.hash = &b
+// SetObsoleteToken sets the "obsolete_token" field.
+func (m *RefreshTokenMutation) SetObsoleteToken(s string) {
+	m.obsolete_token = &s
 }
 
-// Hash returns the value of the "hash" field in the mutation.
-func (m *PasswordMutation) Hash() (r []byte, exists bool) {
-	v := m.hash
+// ObsoleteToken returns the value of the "obsolete_token" field in the mutation.
+func (m *RefreshTokenMutation) ObsoleteToken() (r string, exists bool) {
+	v := m.obsolete_token
 	if v == nil {
 		return
 	}
 	return *v, true
 }
 
-// OldHash returns the old "hash" field's value of the Password entity.
-// If the Password object wasn't provided to the builder, the object is fetched from the database.
+// OldObsoleteToken returns the old "obsolete_token" field's value of the RefreshToken entity.
+// If the RefreshToken object wasn't provided to the builder, the object is fetched from the database.
 // An error is returned if the mutation operation is not UpdateOne, or the database query fails.
-func (m *PasswordMutation) OldHash(ctx context.Context) (v []byte, err error) {
+func (m *RefreshTokenMutation) OldObsoleteToken(ctx context.Context) (v string, err error) {
 	if !m.op.Is(OpUpdateOne) {
-		return v, errors.New("OldHash is only allowed on UpdateOne operations")
+		return v, errors.New("OldObsoleteToken is only allowed on UpdateOne operations")
 	}
 	if m.id == nil || m.oldValue == nil {
-		return v, errors.New("OldHash requires an ID field in the mutation")
+		return v, errors.New("OldObsoleteToken requires an ID field in the mutation")
 	}
 	oldValue, err := m.oldValue(ctx)
 	if err != nil {
-		return v, fmt.Errorf("querying old value for OldHash: %w", err)
+		return v, fmt.Errorf("querying old value for OldObsoleteToken: %w", err)
 	}
-	return oldValue.Hash, nil
+	return oldValue.ObsoleteToken, nil
 }
 
-// ResetHash resets all changes to the "hash" field.
-func (m *PasswordMutation) ResetHash() {
-	m.hash = nil
+// ResetObsoleteToken resets all changes to the "obsolete_token" field.
+func (m *RefreshTokenMutation) ResetObsoleteToken() {
+	m.obsolete_token = nil
 }
 
-// SetUsername sets the "username" field.
-func (m *PasswordMutation) SetUsername(s string) {
-	m.username = &s
+// SetCreatedAt sets the "created_at" field.
+func (m *RefreshTokenMutation) SetCreatedAt(t time.Time) {
+	m.created_at = &t
 }
 
-// Username returns the value of the "username" field in the mutation.
-func (m *PasswordMutation) Username() (r string, exists bool) {
-	v := m.username
+// CreatedAt returns the value of the "created_at" field in the mutation.
+func (m *RefreshTokenMutation) CreatedAt() (r time.Time, exists bool) {
+	v := m.created_at
 	if v == nil {
 		return
 	}
 	return *v, true
 }
 
-// OldUsername returns the old "username" field's value of the Password entity.
-// If the Password object wasn't provided to the builder, the object is fetched from the database.
+// OldCreatedAt returns the old "created_at" field's value of the RefreshToken entity.
+// If the RefreshToken object wasn't provided to the builder, the object is fetched from the database.
 // An error is returned if the mutation operation is not UpdateOne, or the database query fails.
-func (m *PasswordMutation) OldUsername(ctx context.Context) (v string, err error) {
+func (m *RefreshTokenMutation) OldCreatedAt(ctx context.Context) (v time.Time, err error) {
 	if !m.op.Is(OpUpdateOne) {
-		return v, errors.New("OldUsername is only allowed on UpdateOne operations")
+		return v, errors.New("OldCreatedAt is only allowed on UpdateOne operations")
 	}
 	if m.id == nil || m.oldValue == nil {
-		return v, errors.New("OldUsername requires an ID field in the mutation")
+		return v, errors.New("OldCreatedAt requires an ID field in the mutation")
 	}
 	oldValue, err := m.oldValue(ctx)
 	if err != nil {
-		return v, fmt.Errorf("querying old value for OldUsername: %w", err)
+		return v, fmt.Errorf("querying old value for OldCreatedAt: %w", err)
 	}
-	return oldValue.Username, nil
+	return oldValue.CreatedAt, nil
 }
 
-// ResetUsername resets all changes to the "username" field.
-func (m *PasswordMutation) ResetUsername() {
-	m.username = nil
+// ResetCreatedAt resets all changes to the "created_at" field.
+func (m *RefreshTokenMutation) ResetCreatedAt() {
+	m.created_at = nil
 }
 
-// SetUserID sets the "user_id" field.
-func (m *PasswordMutation) SetUserID(s string) {
-	m.user_id = &s
+// SetLastUsed sets the "last_used" field.
+func (m *RefreshTokenMutation) SetLastUsed(t time.Time) {
+	m.last_used = &t
 }
 
-// UserID returns the value of the "user_id" field in the mutation.
-func (m *PasswordMutation) UserID() (r string, exists bool) {
-	v := m.user_id
+// LastUsed returns the value of the "last_used" field in the mutation.
+func (m *RefreshTokenMutation) LastUsed() (r time.Time, exists bool) {
+	v := m.last_used
 	if v == nil {
 		return
 	}
 	return *v, true
 }
 
-// OldUserID returns the old "user_id" field's value of the Password entity.
-// If the Password object wasn't provided to the builder, the object is fetched from the database.
+// OldLastUsed returns the old "last_used" field's value of the RefreshToken entity.
+// If the RefreshToken object wasn't provided to the builder, the object is fetched from the database.
 // An error is returned if the mutation operation is not UpdateOne, or the database query fails.
-func (m *PasswordMutation) OldUserID(ctx context.Context) (v string, err error) {
+func (m *RefreshTokenMutation) OldLastUsed(ctx context.Context) (v time.Time, err error) {
 	if !m.op.Is(OpUpdateOne) {
-		return v, errors.New("OldUserID is only allowed on UpdateOne operations")
+		return v, errors.New("OldLastUsed is only allowed on UpdateOne operations")
 	}
 	if m.id == nil || m.oldValue == nil {
-		return v, errors.New("OldUserID requires an ID field in the mutation")
+		return v, errors.New("OldLastUsed requires an ID field in the mutation")
 	}
 	oldValue, err := m.oldValue(ctx)
 	if err != nil {
-		return v, fmt.Errorf("querying old value for OldUserID: %w", err)
+		return v, fmt.Errorf("querying old value for OldLastUsed: %w", err)
 	}
-	return oldValue.UserID, nil
+	return oldValue.LastUsed, nil
 }
 
-// ResetUserID resets all changes to the "user_id" field.
-func (m *PasswordMutation) ResetUserID() {
-	m.user_id = nil
+// ResetLastUsed resets all changes to the "last_used" field.
+func (m *RefreshTokenMutation) ResetLastUsed() {
+	m.last_used = nil
 }
 
-// Where appends a list predicates to the PasswordMutation builder.
-func (m *PasswordMutation) Where(ps ...predicate.Password) {
+// Where appends a list predicates to the RefreshTokenMutation builder.
+func (m *RefreshTokenMutation) Where(ps ...predicate.RefreshToken) {
 	m.predicates = append(m.predicates, ps...)
 }
 
+// WhereP appends storage-level predicates to the RefreshTokenMutation builder. Using this method,
+// users can use type-assertion to append predicates that do not depend on any generated package.
+func (m *RefreshTokenMutation) WhereP(ps ...func(*sql.Selector)) {
+	p := make([]predicate.RefreshToken, len(ps))
+	for i := range ps {
+		p[i] = ps[i]
+	}
+	m.Where(p...)
+}
+
 // Op returns the operation name.
-func (m *PasswordMutation) Op() Op {
+func (m *RefreshTokenMutation) Op() Op {
 	return m.op
 }
 
-// Type returns the node type of this mutation (Password).
-func (m *PasswordMutation) Type() string {
+// SetOp allows setting the mutation operation.
+func (m *RefreshTokenMutation) SetOp(op Op) {
+	m.op = op
+}
+
+// Type returns the node type of this mutation (RefreshToken).
+func (m *RefreshTokenMutation) Type() string {
 	return m.typ
 }
 
 // Fields returns all fields that were changed during this mutation. Note that in
 // order to get all numeric fields that were incremented/decremented, call
 // AddedFields().
-func (m *PasswordMutation) Fields() []string {
-	fields := make([]string, 0, 4)
-	if m.email != nil {
-		fields = append(fields, password.FieldEmail)
+func (m *RefreshTokenMutation) Fields() []string {
+	fields := make([]string, 0, 15)
+	if m.client_id != nil {
+		fields = append(fields, refreshtoken.FieldClientID)
 	}
-	if m.hash != nil {
-		fields = append(fields, password.FieldHash)
+	if m.scopes != nil {
+		fields = append(fields, refreshtoken.FieldScopes)
 	}
-	if m.username != nil {
-		fields = append(fields, password.FieldUsername)
+	if m.nonce != nil {
+		fields = append(fields, refreshtoken.FieldNonce)
 	}
-	if m.user_id != nil {
-		fields = append(fields, password.FieldUserID)
+	if m.claims_user_id != nil {
+		fields = append(fields, refreshtoken.FieldClaimsUserID)
+	}
+	if m.claims_username != nil {
+		fields = append(fields, refreshtoken.FieldClaimsUsername)
+	}
+	if m.claims_email != nil {
+		fields = append(fields, refreshtoken.FieldClaimsEmail)
+	}
+	if m.claims_email_verified != nil {
+		fields = append(fields, refreshtoken.FieldClaimsEmailVerified)
+	}
+	if m.claims_groups != nil {
+		fields = append(fields, refreshtoken.FieldClaimsGroups)
+	}
+	if m.claims_preferred_username != nil {
+		fields = append(fields, refreshtoken.FieldClaimsPreferredUsername)
+	}
+	if m.connector_id != nil {
+		fields = append(fields, refreshtoken.FieldConnectorID)
+	}
+	if m.connector_data != nil {
+		fields = append(fields, refreshtoken.FieldConnectorData)
+	}
+	if m.token != nil {
+		fields = append(fields, refreshtoken.FieldToken)
+	}
+	if m.obsolete_token != nil {
+		fields = append(fields, refreshtoken.FieldObsoleteToken)
+	}
+	if m.created_at != nil {
+		fields = append(fields, refreshtoken.FieldCreatedAt)
+	}
+	if m.last_used != nil {
+		fields = append(fields, refreshtoken.FieldLastUsed)
 	}
 	return fields
 }
@@ -6281,16 +9963,38 @@ func (m *PasswordMutation) Fields() []string {
 // Field returns the value of a field with the given name. The second boolean
 // return value indicates that this field was not set, or was not defined in the
 // schema.
-func (m *PasswordMutation) Field(name string) (ent.Value, bool) {
+func (m *RefreshTokenMutation) Field(name string) (ent.Value, bool) {
 	switch name {
-	case password.FieldEmail:
-		return m.Email()
-	case password.FieldHash:
-		return m.Hash()
-	case password.FieldUsername:
-		return m.Username()
-	case password.FieldUserID:
-		return m.UserID()
+	case refreshtoken.FieldClientID:
+		return m.ClientID()
+	case refreshtoken.FieldScopes:
+		return m.Scopes()
+	case refreshtoken.FieldNonce:
+		return m.Nonce()
+	case refreshtoken.FieldClaimsUserID:
+		return m.ClaimsUserID()
+	case refreshtoken.FieldClaimsUsername:
+		return m.ClaimsUsername()
+	case refreshtoken.FieldClaimsEmail:
+		return m.ClaimsEmail()
+	case refreshtoken.FieldClaimsEmailVerified:
+		return m.ClaimsEmailVerified()
+	case refreshtoken.FieldClaimsGroups:
+		return m.ClaimsGroups()
+	case refreshtoken.FieldClaimsPreferredUsername:
+		return m.ClaimsPreferredUsername()
+	case refreshtoken.FieldConnectorID:
+		return m.ConnectorID()
+	case refreshtoken.FieldConnectorData:
+		return m.ConnectorData()
+	case refreshtoken.FieldToken:
+		return m.Token()
+	case refreshtoken.FieldObsoleteToken:
+		return m.ObsoleteToken()
+	case refreshtoken.FieldCreatedAt:
+		return m.CreatedAt()
+	case refreshtoken.FieldLastUsed:
+		return m.LastUsed()
 	}
 	return nil, false
 }
@@ -6298,204 +10002,357 @@ func (m *PasswordMutation) Field(name string) (ent.Value, bool) {
 // OldField returns the old value of the field from the database. An error is
 // returned if the mutation operation is not UpdateOne, or the query to the
 // database failed.
-func (m *PasswordMutation) OldField(ctx context.Context, name string) (ent.Value, error) {
+func (m *RefreshTokenMutation) OldField(ctx context.Context, name string) (ent.Value, error) {
 	switch name {
-	case password.FieldEmail:
-		return m.OldEmail(ctx)
-	case password.FieldHash:
-		return m.OldHash(ctx)
-	case password.FieldUsername:
-		return m.OldUsername(ctx)
-	case password.FieldUserID:
-		return m.OldUserID(ctx)
+	case refreshtoken.FieldClientID:
+		return m.OldClientID(ctx)
+	case refreshtoken.FieldScopes:
+		return m.OldScopes(ctx)
+	case refreshtoken.FieldNonce:
+		return m.OldNonce(ctx)
+	case refreshtoken.FieldClaimsUserID:
+		return m.OldClaimsUserID(ctx)
+	case refreshtoken.FieldClaimsUsername:
+		return m.OldClaimsUsername(ctx)
+	case refreshtoken.FieldClaimsEmail:
+		return m.OldClaimsEmail(ctx)
+	case refreshtoken.FieldClaimsEmailVerified:
+		return m.OldClaimsEmailVerified(ctx)
+	case refreshtoken.FieldClaimsGroups:
+		return m.OldClaimsGroups(ctx)
+	case refreshtoken.FieldClaimsPreferredUsername:
+		return m.OldClaimsPreferredUsername(ctx)
+	case refreshtoken.FieldConnectorID:
+		return m.OldConnectorID(ctx)
+	case refreshtoken.FieldConnectorData:
+		return m.OldConnectorData(ctx)
+	case refreshtoken.FieldToken:
+		return m.OldToken(ctx)
+	case refreshtoken.FieldObsoleteToken:
+		return m.OldObsoleteToken(ctx)
+	case refreshtoken.FieldCreatedAt:
+		return m.OldCreatedAt(ctx)
+	case refreshtoken.FieldLastUsed:
+		return m.OldLastUsed(ctx)
 	}
-	return nil, fmt.Errorf("unknown Password field %s", name)
+	return nil, fmt.Errorf("unknown RefreshToken field %s", name)
 }
 
 // SetField sets the value of a field with the given name. It returns an error if
 // the field is not defined in the schema, or if the type mismatched the field
 // type.
-func (m *PasswordMutation) SetField(name string, value ent.Value) error {
+func (m *RefreshTokenMutation) SetField(name string, value ent.Value) error {
 	switch name {
-	case password.FieldEmail:
+	case refreshtoken.FieldClientID:
+		v, ok := value.(string)
+		if !ok {
+			return fmt.Errorf("unexpected type %T for field %s", value, name)
+		}
+		m.SetClientID(v)
+		return nil
+	case refreshtoken.FieldScopes:
+		v, ok := value.([]string)
+		if !ok {
+			return fmt.Errorf("unexpected type %T for field %s", value, name)
+		}
+		m.SetScopes(v)
+		return nil
+	case refreshtoken.FieldNonce:
+		v, ok := value.(string)
+		if !ok {
+			return fmt.Errorf("unexpected type %T for field %s", value, name)
+		}
+		m.SetNonce(v)
+		return nil
+	case refreshtoken.FieldClaimsUserID:
+		v, ok := value.(string)
+		if !ok {
+			return fmt.Errorf("unexpected type %T for field %s", value, name)
+		}
+		m.SetClaimsUserID(v)
+		return nil
+	case refreshtoken.FieldClaimsUsername:
 		v, ok := value.(string)
 		if !ok {
 			return fmt.Errorf("unexpected type %T for field %s", value, name)
 		}
-		m.SetEmail(v)
+		m.SetClaimsUsername(v)
 		return nil
-	case password.FieldHash:
+	case refreshtoken.FieldClaimsEmail:
+		v, ok := value.(string)
+		if !ok {
+			return fmt.Errorf("unexpected type %T for field %s", value, name)
+		}
+		m.SetClaimsEmail(v)
+		return nil
+	case refreshtoken.FieldClaimsEmailVerified:
+		v, ok := value.(bool)
+		if !ok {
+			return fmt.Errorf("unexpected type %T for field %s", value, name)
+		}
+		m.SetClaimsEmailVerified(v)
+		return nil
+	case refreshtoken.FieldClaimsGroups:
+		v, ok := value.([]string)
+		if !ok {
+			return fmt.Errorf("unexpected type %T for field %s", value, name)
+		}
+		m.SetClaimsGroups(v)
+		return nil
+	case refreshtoken.FieldClaimsPreferredUsername:
+		v, ok := value.(string)
+		if !ok {
+			return fmt.Errorf("unexpected type %T for field %s", value, name)
+		}
+		m.SetClaimsPreferredUsername(v)
+		return nil
+	case refreshtoken.FieldConnectorID:
+		v, ok := value.(string)
+		if !ok {
+			return fmt.Errorf("unexpected type %T for field %s", value, name)
+		}
+		m.SetConnectorID(v)
+		return nil
+	case refreshtoken.FieldConnectorData:
 		v, ok := value.([]byte)
 		if !ok {
 			return fmt.Errorf("unexpected type %T for field %s", value, name)
 		}
-		m.SetHash(v)
+		m.SetConnectorData(v)
 		return nil
-	case password.FieldUsername:
+	case refreshtoken.FieldToken:
 		v, ok := value.(string)
 		if !ok {
 			return fmt.Errorf("unexpected type %T for field %s", value, name)
 		}
-		m.SetUsername(v)
+		m.SetToken(v)
 		return nil
-	case password.FieldUserID:
+	case refreshtoken.FieldObsoleteToken:
 		v, ok := value.(string)
 		if !ok {
 			return fmt.Errorf("unexpected type %T for field %s", value, name)
 		}
-		m.SetUserID(v)
+		m.SetObsoleteToken(v)
+		return nil
+	case refreshtoken.FieldCreatedAt:
+		v, ok := value.(time.Time)
+		if !ok {
+			return fmt.Errorf("unexpected type %T for field %s", value, name)
+		}
+		m.SetCreatedAt(v)
+		return nil
+	case refreshtoken.FieldLastUsed:
+		v, ok := value.(time.Time)
+		if !ok {
+			return fmt.Errorf("unexpected type %T for field %s", value, name)
+		}
+		m.SetLastUsed(v)
 		return nil
 	}
-	return fmt.Errorf("unknown Password field %s", name)
+	return fmt.Errorf("unknown RefreshToken field %s", name)
 }
 
 // AddedFields returns all numeric fields that were incremented/decremented during
 // this mutation.
-func (m *PasswordMutation) AddedFields() []string {
+func (m *RefreshTokenMutation) AddedFields() []string {
 	return nil
 }
 
 // AddedField returns the numeric value that was incremented/decremented on a field
 // with the given name. The second boolean return value indicates that this field
 // was not set, or was not defined in the schema.
-func (m *PasswordMutation) AddedField(name string) (ent.Value, bool) {
+func (m *RefreshTokenMutation) AddedField(name string) (ent.Value, bool) {
 	return nil, false
 }
 
 // AddField adds the value to the field with the given name. It returns an error if
 // the field is not defined in the schema, or if the type mismatched the field
 // type.
-func (m *PasswordMutation) AddField(name string, value ent.Value) error {
+func (m *RefreshTokenMutation) AddField(name string, value ent.Value) error {
 	switch name {
 	}
-	return fmt.Errorf("unknown Password numeric field %s", name)
+	return fmt.Errorf("unknown RefreshToken numeric field %s", name)
 }
 
 // ClearedFields returns all nullable fields that were cleared during this
 // mutation.
-func (m *PasswordMutation) ClearedFields() []string {
-	return nil
+func (m *RefreshTokenMutation) ClearedFields() []string {
+	var fields []string
+	if m.FieldCleared(refreshtoken.FieldScopes) {
+		fields = append(fields, refreshtoken.FieldScopes)
+	}
+	if m.FieldCleared(refreshtoken.FieldClaimsGroups) {
+		fields = append(fields, refreshtoken.FieldClaimsGroups)
+	}
+	if m.FieldCleared(refreshtoken.FieldConnectorData) {
+		fields = append(fields, refreshtoken.FieldConnectorData)
+	}
+	return fields
 }
 
 // FieldCleared returns a boolean indicating if a field with the given name was
 // cleared in this mutation.
-func (m *PasswordMutation) FieldCleared(name string) bool {
+func (m *RefreshTokenMutation) FieldCleared(name string) bool {
 	_, ok := m.clearedFields[name]
 	return ok
 }
 
 // ClearField clears the value of the field with the given name. It returns an
 // error if the field is not defined in the schema.
-func (m *PasswordMutation) ClearField(name string) error {
-	return fmt.Errorf("unknown Password nullable field %s", name)
+func (m *RefreshTokenMutation) ClearField(name string) error {
+	switch name {
+	case refreshtoken.FieldScopes:
+		m.ClearScopes()
+		return nil
+	case refreshtoken.FieldClaimsGroups:
+		m.ClearClaimsGroups()
+		return nil
+	case refreshtoken.FieldConnectorData:
+		m.ClearConnectorData()
+		return nil
+	}
+	return fmt.Errorf("unknown RefreshToken nullable field %s", name)
 }
 
 // ResetField resets all changes in the mutation for the field with the given name.
 // It returns an error if the field is not defined in the schema.
-func (m *PasswordMutation) ResetField(name string) error {
+func (m *RefreshTokenMutation) ResetField(name string) error {
 	switch name {
-	case password.FieldEmail:
-		m.ResetEmail()
+	case refreshtoken.FieldClientID:
+		m.ResetClientID()
 		return nil
-	case password.FieldHash:
-		m.ResetHash()
+	case refreshtoken.FieldScopes:
+		m.ResetScopes()
 		return nil
-	case password.FieldUsername:
-		m.ResetUsername()
+	case refreshtoken.FieldNonce:
+		m.ResetNonce()
 		return nil
-	case password.FieldUserID:
-		m.ResetUserID()
+	case refreshtoken.FieldClaimsUserID:
+		m.ResetClaimsUserID()
+		return nil
+	case refreshtoken.FieldClaimsUsername:
+		m.ResetClaimsUsername()
+		return nil
+	case refreshtoken.FieldClaimsEmail:
+		m.ResetClaimsEmail()
+		return nil
+	case refreshtoken.FieldClaimsEmailVerified:
+		m.ResetClaimsEmailVerified()
+		return nil
+	case refreshtoken.FieldClaimsGroups:
+		m.ResetClaimsGroups()
+		return nil
+	case refreshtoken.FieldClaimsPreferredUsername:
+		m.ResetClaimsPreferredUsername()
+		return nil
+	case refreshtoken.FieldConnectorID:
+		m.ResetConnectorID()
+		return nil
+	case refreshtoken.FieldConnectorData:
+		m.ResetConnectorData()
+		return nil
+	case refreshtoken.FieldToken:
+		m.ResetToken()
+		return nil
+	case refreshtoken.FieldObsoleteToken:
+		m.ResetObsoleteToken()
+		return nil
+	case refreshtoken.FieldCreatedAt:
+		m.ResetCreatedAt()
+		return nil
+	case refreshtoken.FieldLastUsed:
+		m.ResetLastUsed()
 		return nil
 	}
-	return fmt.Errorf("unknown Password field %s", name)
+	return fmt.Errorf("unknown RefreshToken field %s", name)
 }
 
 // AddedEdges returns all edge names that were set/added in this mutation.
-func (m *PasswordMutation) AddedEdges() []string {
+func (m *RefreshTokenMutation) AddedEdges() []string {
 	edges := make([]string, 0, 0)
 	return edges
 }
 
 // AddedIDs returns all IDs (to other nodes) that were added for the given edge
 // name in this mutation.
-func (m *PasswordMutation) AddedIDs(name string) []ent.Value {
+func (m *RefreshTokenMutation) AddedIDs(name string) []ent.Value {
 	return nil
 }
 
 // RemovedEdges returns all edge names that were removed in this mutation.
-func (m *PasswordMutation) RemovedEdges() []string {
+func (m *RefreshTokenMutation) RemovedEdges() []string {
 	edges := make([]string, 0, 0)
 	return edges
 }
 
 // RemovedIDs returns all IDs (to other nodes) that were removed for the edge with
 // the given name in this mutation.
-func (m *PasswordMutation) RemovedIDs(name string) []ent.Value {
+func (m *RefreshTokenMutation) RemovedIDs(name string) []ent.Value {
 	return nil
 }
 
 // ClearedEdges returns all edge names that were cleared in this mutation.
-func (m *PasswordMutation) ClearedEdges() []string {
+func (m *RefreshTokenMutation) ClearedEdges() []string {
 	edges := make([]string, 0, 0)
 	return edges
 }
 
 // EdgeCleared returns a boolean which indicates if the edge with the given name
 // was cleared in this mutation.
-func (m *PasswordMutation) EdgeCleared(name string) bool {
+func (m *RefreshTokenMutation) EdgeCleared(name string) bool {
 	return false
 }
 
 // ClearEdge clears the value of the edge with the given name. It returns an error
 // if that edge is not defined in the schema.
-func (m *PasswordMutation) ClearEdge(name string) error {
-	return fmt.Errorf("unknown Password unique edge %s", name)
+func (m *RefreshTokenMutation) ClearEdge(name string) error {
+	return fmt.Errorf("unknown RefreshToken unique edge %s", name)
 }
 
 // ResetEdge resets all changes to the edge with the given name in this mutation.
 // It returns an error if the edge is not defined in the schema.
-func (m *PasswordMutation) ResetEdge(name string) error {
-	return fmt.Errorf("unknown Password edge %s", name)
+func (m *RefreshTokenMutation) ResetEdge(name string) error {
+	return fmt.Errorf("unknown RefreshToken edge %s", name)
 }
 
-// RefreshTokenMutation represents an operation that mutates the RefreshToken nodes in the graph.
-type RefreshTokenMutation struct {
+// UserIdentityMutation represents an operation that mutates the UserIdentity nodes in the graph.
+type UserIdentityMutation struct {
 	config
 	op                        Op
 	typ                       string
 	id                        *string
-	client_id                 *string
-	scopes                    *[]string
-	nonce                     *string
+	user_id                   *string
+	connector_id              *string
 	claims_user_id            *string
 	claims_username           *string
+	claims_preferred_username *string
 	claims_email              *string
 	claims_email_verified     *bool
 	claims_groups             *[]string
-	claims_preferred_username *string
-	connector_id              *string
-	connector_data            *[]byte
-	token                     *string
-	obsolete_token            *string
+	appendclaims_groups       []string
+	consents                  *[]byte
+	mfa_secrets               *[]byte
+	webauthn_credentials      *[]byte
 	created_at                *time.Time
-	last_used                 *time.Time
+	last_login                *time.Time
+	blocked_until             *time.Time
 	clearedFields             map[string]struct{}
 	done                      bool
-	oldValue                  func(context.Context) (*RefreshToken, error)
-	predicates                []predicate.RefreshToken
+	oldValue                  func(context.Context) (*UserIdentity, error)
+	predicates                []predicate.UserIdentity
 }
 
-var _ ent.Mutation = (*RefreshTokenMutation)(nil)
+var _ ent.Mutation = (*UserIdentityMutation)(nil)
 
-// refreshtokenOption allows management of the mutation configuration using functional options.
-type refreshtokenOption func(*RefreshTokenMutation)
+// useridentityOption allows management of the mutation configuration using functional options.
+type useridentityOption func(*UserIdentityMutation)
 
-// newRefreshTokenMutation creates new mutation for the RefreshToken entity.
-func newRefreshTokenMutation(c config, op Op, opts ...refreshtokenOption) *RefreshTokenMutation {
-	m := &RefreshTokenMutation{
+// newUserIdentityMutation creates new mutation for the UserIdentity entity.
+func newUserIdentityMutation(c config, op Op, opts ...useridentityOption) *UserIdentityMutation {
+	m := &UserIdentityMutation{
 		config:        c,
 		op:            op,
-		typ:           TypeRefreshToken,
+		typ:           TypeUserIdentity,
 		clearedFields: make(map[string]struct{}),
 	}
 	for _, opt := range opts {
@@ -6504,20 +10361,20 @@ func newRefreshTokenMutation(c config, op Op, opts ...refreshtokenOption) *Refre
 	return m
 }
 
-// withRefreshTokenID sets the ID field of the mutation.
-func withRefreshTokenID(id string) refreshtokenOption {
-	return func(m *RefreshTokenMutation) {
+// withUserIdentityID sets the ID field of the mutation.
+func withUserIdentityID(id string) useridentityOption {
+	return func(m *UserIdentityMutation) {
 		var (
 			err   error
 			once  sync.Once
-			value *RefreshToken
+			value *UserIdentity
 		)
-		m.oldValue = func(ctx context.Context) (*RefreshToken, error) {
+		m.oldValue = func(ctx context.Context) (*UserIdentity, error) {
 			once.Do(func() {
 				if m.done {
 					err = errors.New("querying old values post mutation is not allowed")
 				} else {
-					value, err = m.Client().RefreshToken.Get(ctx, id)
+					value, err = m.Client().UserIdentity.Get(ctx, id)
 				}
 			})
 			return value, err
@@ -6526,10 +10383,10 @@ func withRefreshTokenID(id string) refreshtokenOption {
 	}
 }
 
-// withRefreshToken sets the old RefreshToken of the mutation.
-func withRefreshToken(node *RefreshToken) refreshtokenOption {
-	return func(m *RefreshTokenMutation) {
-		m.oldValue = func(context.Context) (*RefreshToken, error) {
+// withUserIdentity sets the old UserIdentity of the mutation.
+func withUserIdentity(node *UserIdentity) useridentityOption {
+	return func(m *UserIdentityMutation) {
+		m.oldValue = func(context.Context) (*UserIdentity, error) {
 			return node, nil
 		}
 		m.id = &node.ID
@@ -6538,7 +10395,7 @@ func withRefreshToken(node *RefreshToken) refreshtokenOption {
 
 // Client returns a new `ent.Client` from the mutation. If the mutation was
 // executed in a transaction (ent.Tx), a transactional client is returned.
-func (m RefreshTokenMutation) Client() *Client {
+func (m UserIdentityMutation) Client() *Client {
 	client := &Client{config: m.config}
 	client.init()
 	return client
@@ -6546,7 +10403,7 @@ func (m RefreshTokenMutation) Client() *Client {
 
 // Tx returns an `ent.Tx` for mutations that were executed in transactions;
 // it returns an error otherwise.
-func (m RefreshTokenMutation) Tx() (*Tx, error) {
+func (m UserIdentityMutation) Tx() (*Tx, error) {
 	if _, ok := m.driver.(*txDriver); !ok {
 		return nil, errors.New("db: mutation is not running in a transaction")
 	}
@@ -6556,14 +10413,14 @@ func (m RefreshTokenMutation) Tx() (*Tx, error) {
 }
 
 // SetID sets the value of the id field. Note that this
-// operation is only accepted on creation of RefreshToken entities.
-func (m *RefreshTokenMutation) SetID(id string) {
+// operation is only accepted on creation of UserIdentity entities.
+func (m *UserIdentityMutation) SetID(id string) {
 	m.id = &id
 }
 
 // ID returns the ID value in the mutation. Note that the ID is only available
 // if it was provided to the builder or after it was returned from the database.
-func (m *RefreshTokenMutation) ID() (id string, exists bool) {
+func (m *UserIdentityMutation) ID() (id string, exists bool) {
 	if m.id == nil {
 		return
 	}
@@ -6574,7 +10431,7 @@ func (m *RefreshTokenMutation) ID() (id string, exists bool) {
 // That means, if the mutation is applied within a transaction with an isolation level such
 // as sql.LevelSerializable, the returned ids match the ids of the rows that will be updated
 // or updated by the mutation.
-func (m *RefreshTokenMutation) IDs(ctx context.Context) ([]string, error) {
+func (m *UserIdentityMutation) IDs(ctx context.Context) ([]string, error) {
 	switch {
 	case m.op.Is(OpUpdateOne | OpDeleteOne):
 		id, exists := m.ID()
@@ -6583,140 +10440,91 @@ func (m *RefreshTokenMutation) IDs(ctx context.Context) ([]string, error) {
 		}
 		fallthrough
 	case m.op.Is(OpUpdate | OpDelete):
-		return m.Client().RefreshToken.Query().Where(m.predicates...).IDs(ctx)
+		return m.Client().UserIdentity.Query().Where(m.predicates...).IDs(ctx)
 	default:
 		return nil, fmt.Errorf("IDs is not allowed on %s operations", m.op)
 	}
 }
 
-// SetClientID sets the "client_id" field.
-func (m *RefreshTokenMutation) SetClientID(s string) {
-	m.client_id = &s
-}
-
-// ClientID returns the value of the "client_id" field in the mutation.
-func (m *RefreshTokenMutation) ClientID() (r string, exists bool) {
-	v := m.client_id
-	if v == nil {
-		return
-	}
-	return *v, true
-}
-
-// OldClientID returns the old "client_id" field's value of the RefreshToken entity.
-// If the RefreshToken object wasn't provided to the builder, the object is fetched from the database.
-// An error is returned if the mutation operation is not UpdateOne, or the database query fails.
-func (m *RefreshTokenMutation) OldClientID(ctx context.Context) (v string, err error) {
-	if !m.op.Is(OpUpdateOne) {
-		return v, errors.New("OldClientID is only allowed on UpdateOne operations")
-	}
-	if m.id == nil || m.oldValue == nil {
-		return v, errors.New("OldClientID requires an ID field in the mutation")
-	}
-	oldValue, err := m.oldValue(ctx)
-	if err != nil {
-		return v, fmt.Errorf("querying old value for OldClientID: %w", err)
-	}
-	return oldValue.ClientID, nil
-}
-
-// ResetClientID resets all changes to the "client_id" field.
-func (m *RefreshTokenMutation) ResetClientID() {
-	m.client_id = nil
-}
-
-// SetScopes sets the "scopes" field.
-func (m *RefreshTokenMutation) SetScopes(s []string) {
-	m.scopes = &s
+// SetUserID sets the "user_id" field.
+func (m *UserIdentityMutation) SetUserID(s string) {
+	m.user_id = &s
 }
 
-// Scopes returns the value of the "scopes" field in the mutation.
-func (m *RefreshTokenMutation) Scopes() (r []string, exists bool) {
-	v := m.scopes
+// UserID returns the value of the "user_id" field in the mutation.
+func (m *UserIdentityMutation) UserID() (r string, exists bool) {
+	v := m.user_id
 	if v == nil {
 		return
 	}
 	return *v, true
 }
 
-// OldScopes returns the old "scopes" field's value of the RefreshToken entity.
-// If the RefreshToken object wasn't provided to the builder, the object is fetched from the database.
+// OldUserID returns the old "user_id" field's value of the UserIdentity entity.
+// If the UserIdentity object wasn't provided to the builder, the object is fetched from the database.
 // An error is returned if the mutation operation is not UpdateOne, or the database query fails.
-func (m *RefreshTokenMutation) OldScopes(ctx context.Context) (v []string, err error) {
+func (m *UserIdentityMutation) OldUserID(ctx context.Context) (v string, err error) {
 	if !m.op.Is(OpUpdateOne) {
-		return v, errors.New("OldScopes is only allowed on UpdateOne operations")
+		return v, errors.New("OldUserID is only allowed on UpdateOne operations")
 	}
 	if m.id == nil || m.oldValue == nil {
-		return v, errors.New("OldScopes requires an ID field in the mutation")
+		return v, errors.New("OldUserID requires an ID field in the mutation")
 	}
 	oldValue, err := m.oldValue(ctx)
 	if err != nil {
-		return v, fmt.Errorf("querying old value for OldScopes: %w", err)
+		return v, fmt.Errorf("querying old value for OldUserID: %w", err)
 	}
-	return oldValue.Scopes, nil
-}
-
-// ClearScopes clears the value of the "scopes" field.
-func (m *RefreshTokenMutation) ClearScopes() {
-	m.scopes = nil
-	m.clearedFields[refreshtoken.FieldScopes] = struct{}{}
-}
-
-// ScopesCleared returns if the "scopes" field was cleared in this mutation.
-func (m *RefreshTokenMutation) ScopesCleared() bool {
-	_, ok := m.clearedFields[refreshtoken.FieldScopes]
-	return ok
+	return oldValue.UserID, nil
 }
 
-// ResetScopes resets all changes to the "scopes" field.
-func (m *RefreshTokenMutation) ResetScopes() {
-	m.scopes = nil
-	delete(m.clearedFields, refreshtoken.FieldScopes)
+// ResetUserID resets all changes to the "user_id" field.
+func (m *UserIdentityMutation) ResetUserID() {
+	m.user_id = nil
 }
 
-// SetNonce sets the "nonce" field.
-func (m *RefreshTokenMutation) SetNonce(s string) {
-	m.nonce = &s
+// SetConnectorID sets the "connector_id" field.
+func (m *UserIdentityMutation) SetConnectorID(s string) {
+	m.connector_id = &s
 }
 
-// Nonce returns the value of the "nonce" field in the mutation.
-func (m *RefreshTokenMutation) Nonce() (r string, exists bool) {
-	v := m.nonce
+// ConnectorID returns the value of the "connector_id" field in the mutation.
+func (m *UserIdentityMutation) ConnectorID() (r string, exists bool) {
+	v := m.connector_id
 	if v == nil {
 		return
 	}
 	return *v, true
 }
 
-// OldNonce returns the old "nonce" field's value of the RefreshToken entity.
-// If the RefreshToken object wasn't provided to the builder, the object is fetched from the database.
+// OldConnectorID returns the old "connector_id" field's value of the UserIdentity entity.
+// If the UserIdentity object wasn't provided to the builder, the object is fetched from the database.
 // An error is returned if the mutation operation is not UpdateOne, or the database query fails.
-func (m *RefreshTokenMutation) OldNonce(ctx context.Context) (v string, err error) {
+func (m *UserIdentityMutation) OldConnectorID(ctx context.Context) (v string, err error) {
 	if !m.op.Is(OpUpdateOne) {
-		return v, errors.New("OldNonce is only allowed on UpdateOne operations")
+		return v, errors.New("OldConnectorID is only allowed on UpdateOne operations")
 	}
 	if m.id == nil || m.oldValue == nil {
-		return v, errors.New("OldNonce requires an ID field in the mutation")
+		return v, errors.New("OldConnectorID requires an ID field in the mutation")
 	}
 	oldValue, err := m.oldValue(ctx)
 	if err != nil {
-		return v, fmt.Errorf("querying old value for OldNonce: %w", err)
+		return v, fmt.Errorf("querying old value for OldConnectorID: %w", err)
 	}
-	return oldValue.Nonce, nil
+	return oldValue.ConnectorID, nil
 }
 
-// ResetNonce resets all changes to the "nonce" field.
-func (m *RefreshTokenMutation) ResetNonce() {
-	m.nonce = nil
+// ResetConnectorID resets all changes to the "connector_id" field.
+func (m *UserIdentityMutation) ResetConnectorID() {
+	m.connector_id = nil
 }
 
 // SetClaimsUserID sets the "claims_user_id" field.
-func (m *RefreshTokenMutation) SetClaimsUserID(s string) {
+func (m *UserIdentityMutation) SetClaimsUserID(s string) {
 	m.claims_user_id = &s
 }
 
 // ClaimsUserID returns the value of the "claims_user_id" field in the mutation.
-func (m *RefreshTokenMutation) ClaimsUserID() (r string, exists bool) {
+func (m *UserIdentityMutation) ClaimsUserID() (r string, exists bool) {
 	v := m.claims_user_id
 	if v == nil {
 		return
@@ -6724,10 +10532,10 @@ func (m *RefreshTokenMutation) ClaimsUserID() (r string, exists bool) {
 	return *v, true
 }
 
-// OldClaimsUserID returns the old "claims_user_id" field's value of the RefreshToken entity.
-// If the RefreshToken object wasn't provided to the builder, the object is fetched from the database.
+// OldClaimsUserID returns the old "claims_user_id" field's value of the UserIdentity entity.
+// If the UserIdentity object wasn't provided to the builder, the object is fetched from the database.
 // An error is returned if the mutation operation is not UpdateOne, or the database query fails.
-func (m *RefreshTokenMutation) OldClaimsUserID(ctx context.Context) (v string, err error) {
+func (m *UserIdentityMutation) OldClaimsUserID(ctx context.Context) (v string, err error) {
 	if !m.op.Is(OpUpdateOne) {
 		return v, errors.New("OldClaimsUserID is only allowed on UpdateOne operations")
 	}
@@ -6742,17 +10550,17 @@ func (m *RefreshTokenMutation) OldClaimsUserID(ctx context.Context) (v string, e
 }
 
 // ResetClaimsUserID resets all changes to the "claims_user_id" field.
-func (m *RefreshTokenMutation) ResetClaimsUserID() {
+func (m *UserIdentityMutation) ResetClaimsUserID() {
 	m.claims_user_id = nil
 }
 
 // SetClaimsUsername sets the "claims_username" field.
-func (m *RefreshTokenMutation) SetClaimsUsername(s string) {
+func (m *UserIdentityMutation) SetClaimsUsername(s string) {
 	m.claims_username = &s
 }
 
 // ClaimsUsername returns the value of the "claims_username" field in the mutation.
-func (m *RefreshTokenMutation) ClaimsUsername() (r string, exists bool) {
+func (m *UserIdentityMutation) ClaimsUsername() (r string, exists bool) {
 	v := m.claims_username
 	if v == nil {
 		return
@@ -6760,10 +10568,10 @@ func (m *RefreshTokenMutation) ClaimsUsername() (r string, exists bool) {
 	return *v, true
 }
 
-// OldClaimsUsername returns the old "claims_username" field's value of the RefreshToken entity.
-// If the RefreshToken object wasn't provided to the builder, the object is fetched from the database.
+// OldClaimsUsername returns the old "claims_username" field's value of the UserIdentity entity.
+// If the UserIdentity object wasn't provided to the builder, the object is fetched from the database.
 // An error is returned if the mutation operation is not UpdateOne, or the database query fails.
-func (m *RefreshTokenMutation) OldClaimsUsername(ctx context.Context) (v string, err error) {
+func (m *UserIdentityMutation) OldClaimsUsername(ctx context.Context) (v string, err error) {
 	if !m.op.Is(OpUpdateOne) {
 		return v, errors.New("OldClaimsUsername is only allowed on UpdateOne operations")
 	}
@@ -6778,17 +10586,53 @@ func (m *RefreshTokenMutation) OldClaimsUsername(ctx context.Context) (v string,
 }
 
 // ResetClaimsUsername resets all changes to the "claims_username" field.
-func (m *RefreshTokenMutation) ResetClaimsUsername() {
+func (m *UserIdentityMutation) ResetClaimsUsername() {
 	m.claims_username = nil
 }
 
+// SetClaimsPreferredUsername sets the "claims_preferred_username" field.
+func (m *UserIdentityMutation) SetClaimsPreferredUsername(s string) {
+	m.claims_preferred_username = &s
+}
+
+// ClaimsPreferredUsername returns the value of the "claims_preferred_username" field in the mutation.
+func (m *UserIdentityMutation) ClaimsPreferredUsername() (r string, exists bool) {
+	v := m.claims_preferred_username
+	if v == nil {
+		return
+	}
+	return *v, true
+}
+
+// OldClaimsPreferredUsername returns the old "claims_preferred_username" field's value of the UserIdentity entity.
+// If the UserIdentity object wasn't provided to the builder, the object is fetched from the database.
+// An error is returned if the mutation operation is not UpdateOne, or the database query fails.
+func (m *UserIdentityMutation) OldClaimsPreferredUsername(ctx context.Context) (v string, err error) {
+	if !m.op.Is(OpUpdateOne) {
+		return v, errors.New("OldClaimsPreferredUsername is only allowed on UpdateOne operations")
+	}
+	if m.id == nil || m.oldValue == nil {
+		return v, errors.New("OldClaimsPreferredUsername requires an ID field in the mutation")
+	}
+	oldValue, err := m.oldValue(ctx)
+	if err != nil {
+		return v, fmt.Errorf("querying old value for OldClaimsPreferredUsername: %w", err)
+	}
+	return oldValue.ClaimsPreferredUsername, nil
+}
+
+// ResetClaimsPreferredUsername resets all changes to the "claims_preferred_username" field.
+func (m *UserIdentityMutation) ResetClaimsPreferredUsername() {
+	m.claims_preferred_username = nil
+}
+
 // SetClaimsEmail sets the "claims_email" field.
-func (m *RefreshTokenMutation) SetClaimsEmail(s string) {
+func (m *UserIdentityMutation) SetClaimsEmail(s string) {
 	m.claims_email = &s
 }
 
 // ClaimsEmail returns the value of the "claims_email" field in the mutation.
-func (m *RefreshTokenMutation) ClaimsEmail() (r string, exists bool) {
+func (m *UserIdentityMutation) ClaimsEmail() (r string, exists bool) {
 	v := m.claims_email
 	if v == nil {
 		return
@@ -6796,10 +10640,10 @@ func (m *RefreshTokenMutation) ClaimsEmail() (r string, exists bool) {
 	return *v, true
 }
 
-// OldClaimsEmail returns the old "claims_email" field's value of the RefreshToken entity.
-// If the RefreshToken object wasn't provided to the builder, the object is fetched from the database.
+// OldClaimsEmail returns the old "claims_email" field's value of the UserIdentity entity.
+// If the UserIdentity object wasn't provided to the builder, the object is fetched from the database.
 // An error is returned if the mutation operation is not UpdateOne, or the database query fails.
-func (m *RefreshTokenMutation) OldClaimsEmail(ctx context.Context) (v string, err error) {
+func (m *UserIdentityMutation) OldClaimsEmail(ctx context.Context) (v string, err error) {
 	if !m.op.Is(OpUpdateOne) {
 		return v, errors.New("OldClaimsEmail is only allowed on UpdateOne operations")
 	}
@@ -6814,17 +10658,17 @@ func (m *RefreshTokenMutation) OldClaimsEmail(ctx context.Context) (v string, er
 }
 
 // ResetClaimsEmail resets all changes to the "claims_email" field.
-func (m *RefreshTokenMutation) ResetClaimsEmail() {
+func (m *UserIdentityMutation) ResetClaimsEmail() {
 	m.claims_email = nil
 }
 
 // SetClaimsEmailVerified sets the "claims_email_verified" field.
-func (m *RefreshTokenMutation) SetClaimsEmailVerified(b bool) {
+func (m *UserIdentityMutation) SetClaimsEmailVerified(b bool) {
 	m.claims_email_verified = &b
 }
 
 // ClaimsEmailVerified returns the value of the "claims_email_verified" field in the mutation.
-func (m *RefreshTokenMutation) ClaimsEmailVerified() (r bool, exists bool) {
+func (m *UserIdentityMutation) ClaimsEmailVerified() (r bool, exists bool) {
 	v := m.claims_email_verified
 	if v == nil {
 		return
@@ -6832,10 +10676,10 @@ func (m *RefreshTokenMutation) ClaimsEmailVerified() (r bool, exists bool) {
 	return *v, true
 }
 
-// OldClaimsEmailVerified returns the old "claims_email_verified" field's value of the RefreshToken entity.
-// If the RefreshToken object wasn't provided to the builder, the object is fetched from the database.
+// OldClaimsEmailVerified returns the old "claims_email_verified" field's value of the UserIdentity entity.
+// If the UserIdentity object wasn't provided to the builder, the object is fetched from the database.
 // An error is returned if the mutation operation is not UpdateOne, or the database query fails.
-func (m *RefreshTokenMutation) OldClaimsEmailVerified(ctx context.Context) (v bool, err error) {
+func (m *UserIdentityMutation) OldClaimsEmailVerified(ctx context.Context) (v bool, err error) {
 	if !m.op.Is(OpUpdateOne) {
 		return v, errors.New("OldClaimsEmailVerified is only allowed on UpdateOne operations")
 	}
@@ -6850,17 +10694,18 @@ func (m *RefreshTokenMutation) OldClaimsEmailVerified(ctx context.Context) (v bo
 }
 
 // ResetClaimsEmailVerified resets all changes to the "claims_email_verified" field.
-func (m *RefreshTokenMutation) ResetClaimsEmailVerified() {
+func (m *UserIdentityMutation) ResetClaimsEmailVerified() {
 	m.claims_email_verified = nil
 }
 
 // SetClaimsGroups sets the "claims_groups" field.
-func (m *RefreshTokenMutation) SetClaimsGroups(s []string) {
+func (m *UserIdentityMutation) SetClaimsGroups(s []string) {
 	m.claims_groups = &s
+	m.appendclaims_groups = nil
 }
 
 // ClaimsGroups returns the value of the "claims_groups" field in the mutation.
-func (m *RefreshTokenMutation) ClaimsGroups() (r []string, exists bool) {
+func (m *UserIdentityMutation) ClaimsGroups() (r []string, exists bool) {
 	v := m.claims_groups
 	if v == nil {
 		return
@@ -6868,10 +10713,10 @@ func (m *RefreshTokenMutation) ClaimsGroups() (r []string, exists bool) {
 	return *v, true
 }
 
-// OldClaimsGroups returns the old "claims_groups" field's value of the RefreshToken entity.
-// If the RefreshToken object wasn't provided to the builder, the object is fetched from the database.
+// OldClaimsGroups returns the old "claims_groups" field's value of the UserIdentity entity.
+// If the UserIdentity object wasn't provided to the builder, the object is fetched from the database.
 // An error is returned if the mutation operation is not UpdateOne, or the database query fails.
-func (m *RefreshTokenMutation) OldClaimsGroups(ctx context.Context) (v []string, err error) {
+func (m *UserIdentityMutation) OldClaimsGroups(ctx context.Context) (v []string, err error) {
 	if !m.op.Is(OpUpdateOne) {
 		return v, errors.New("OldClaimsGroups is only allowed on UpdateOne operations")
 	}
@@ -6885,224 +10730,180 @@ func (m *RefreshTokenMutation) OldClaimsGroups(ctx context.Context) (v []string,
 	return oldValue.ClaimsGroups, nil
 }
 
+// AppendClaimsGroups adds s to the "claims_groups" field.
+func (m *UserIdentityMutation) AppendClaimsGroups(s []string) {
+	m.appendclaims_groups = append(m.appendclaims_groups, s...)
+}
+
+// AppendedClaimsGroups returns the list of values that were appended to the "claims_groups" field in this mutation.
+func (m *UserIdentityMutation) AppendedClaimsGroups() ([]string, bool) {
+	if len(m.appendclaims_groups) == 0 {
+		return nil, false
+	}
+	return m.appendclaims_groups, true
+}
+
 // ClearClaimsGroups clears the value of the "claims_groups" field.
-func (m *RefreshTokenMutation) ClearClaimsGroups() {
+func (m *UserIdentityMutation) ClearClaimsGroups() {
 	m.claims_groups = nil
-	m.clearedFields[refreshtoken.FieldClaimsGroups] = struct{}{}
+	m.appendclaims_groups = nil
+	m.clearedFields[useridentity.FieldClaimsGroups] = struct{}{}
 }
 
 // ClaimsGroupsCleared returns if the "claims_groups" field was cleared in this mutation.
-func (m *RefreshTokenMutation) ClaimsGroupsCleared() bool {
-	_, ok := m.clearedFields[refreshtoken.FieldClaimsGroups]
+func (m *UserIdentityMutation) ClaimsGroupsCleared() bool {
+	_, ok := m.clearedFields[useridentity.FieldClaimsGroups]
 	return ok
 }
 
 // ResetClaimsGroups resets all changes to the "claims_groups" field.
-func (m *RefreshTokenMutation) ResetClaimsGroups() {
+func (m *UserIdentityMutation) ResetClaimsGroups() {
 	m.claims_groups = nil
-	delete(m.clearedFields, refreshtoken.FieldClaimsGroups)
-}
-
-// SetClaimsPreferredUsername sets the "claims_preferred_username" field.
-func (m *RefreshTokenMutation) SetClaimsPreferredUsername(s string) {
-	m.claims_preferred_username = &s
-}
-
-// ClaimsPreferredUsername returns the value of the "claims_preferred_username" field in the mutation.
-func (m *RefreshTokenMutation) ClaimsPreferredUsername() (r string, exists bool) {
-	v := m.claims_preferred_username
-	if v == nil {
-		return
-	}
-	return *v, true
-}
-
-// OldClaimsPreferredUsername returns the old "claims_preferred_username" field's value of the RefreshToken entity.
-// If the RefreshToken object wasn't provided to the builder, the object is fetched from the database.
-// An error is returned if the mutation operation is not UpdateOne, or the database query fails.
-func (m *RefreshTokenMutation) OldClaimsPreferredUsername(ctx context.Context) (v string, err error) {
-	if !m.op.Is(OpUpdateOne) {
-		return v, errors.New("OldClaimsPreferredUsername is only allowed on UpdateOne operations")
-	}
-	if m.id == nil || m.oldValue == nil {
-		return v, errors.New("OldClaimsPreferredUsername requires an ID field in the mutation")
-	}
-	oldValue, err := m.oldValue(ctx)
-	if err != nil {
-		return v, fmt.Errorf("querying old value for OldClaimsPreferredUsername: %w", err)
-	}
-	return oldValue.ClaimsPreferredUsername, nil
-}
-
-// ResetClaimsPreferredUsername resets all changes to the "claims_preferred_username" field.
-func (m *RefreshTokenMutation) ResetClaimsPreferredUsername() {
-	m.claims_preferred_username = nil
+	m.appendclaims_groups = nil
+	delete(m.clearedFields, useridentity.FieldClaimsGroups)
 }
 
-// SetConnectorID sets the "connector_id" field.
-func (m *RefreshTokenMutation) SetConnectorID(s string) {
-	m.connector_id = &s
+// SetConsents sets the "consents" field.
+func (m *UserIdentityMutation) SetConsents(b []byte) {
+	m.consents = &b
 }
 
-// ConnectorID returns the value of the "connector_id" field in the mutation.
-func (m *RefreshTokenMutation) ConnectorID() (r string, exists bool) {
-	v := m.connector_id
+// Consents returns the value of the "consents" field in the mutation.
+func (m *UserIdentityMutation) Consents() (r []byte, exists bool) {
+	v := m.consents
 	if v == nil {
 		return
 	}
 	return *v, true
 }
 
-// OldConnectorID returns the old "connector_id" field's value of the RefreshToken entity.
-// If the RefreshToken object wasn't provided to the builder, the object is fetched from the database.
+// OldConsents returns the old "consents" field's value of the UserIdentity entity.
+// If the UserIdentity object wasn't provided to the builder, the object is fetched from the database.
 // An error is returned if the mutation operation is not UpdateOne, or the database query fails.
-func (m *RefreshTokenMutation) OldConnectorID(ctx context.Context) (v string, err error) {
+func (m *UserIdentityMutation) OldConsents(ctx context.Context) (v []byte, err error) {
 	if !m.op.Is(OpUpdateOne) {
-		return v, errors.New("OldConnectorID is only allowed on UpdateOne operations")
+		return v, errors.New("OldConsents is only allowed on UpdateOne operations")
 	}
 	if m.id == nil || m.oldValue == nil {
-		return v, errors.New("OldConnectorID requires an ID field in the mutation")
+		return v, errors.New("OldConsents requires an ID field in the mutation")
 	}
 	oldValue, err := m.oldValue(ctx)
 	if err != nil {
-		return v, fmt.Errorf("querying old value for OldConnectorID: %w", err)
+		return v, fmt.Errorf("querying old value for OldConsents: %w", err)
 	}
-	return oldValue.ConnectorID, nil
+	return oldValue.Consents, nil
 }
 
-// ResetConnectorID resets all changes to the "connector_id" field.
-func (m *RefreshTokenMutation) ResetConnectorID() {
-	m.connector_id = nil
+// ResetConsents resets all changes to the "consents" field.
+func (m *UserIdentityMutation) ResetConsents() {
+	m.consents = nil
 }
 
-// SetConnectorData sets the "connector_data" field.
-func (m *RefreshTokenMutation) SetConnectorData(b []byte) {
-	m.connector_data = &b
+// SetMfaSecrets sets the "mfa_secrets" field.
+func (m *UserIdentityMutation) SetMfaSecrets(b []byte) {
+	m.mfa_secrets = &b
 }
 
-// ConnectorData returns the value of the "connector_data" field in the mutation.
-func (m *RefreshTokenMutation) ConnectorData() (r []byte, exists bool) {
-	v := m.connector_data
+// MfaSecrets returns the value of the "mfa_secrets" field in the mutation.
+func (m *UserIdentityMutation) MfaSecrets() (r []byte, exists bool) {
+	v := m.mfa_secrets
 	if v == nil {
 		return
 	}
 	return *v, true
 }
 
-// OldConnectorData returns the old "connector_data" field's value of the RefreshToken entity.
-// If the RefreshToken object wasn't provided to the builder, the object is fetched from the database.
+// OldMfaSecrets returns the old "mfa_secrets" field's value of the UserIdentity entity.
+// If the UserIdentity object wasn't provided to the builder, the object is fetched from the database.
 // An error is returned if the mutation operation is not UpdateOne, or the database query fails.
-func (m *RefreshTokenMutation) OldConnectorData(ctx context.Context) (v *[]byte, err error) {
+func (m *UserIdentityMutation) OldMfaSecrets(ctx context.Context) (v *[]byte, err error) {
 	if !m.op.Is(OpUpdateOne) {
-		return v, errors.New("OldConnectorData is only allowed on UpdateOne operations")
+		return v, errors.New("OldMfaSecrets is only allowed on UpdateOne operations")
 	}
 	if m.id == nil || m.oldValue == nil {
-		return v, errors.New("OldConnectorData requires an ID field in the mutation")
+		return v, errors.New("OldMfaSecrets requires an ID field in the mutation")
 	}
 	oldValue, err := m.oldValue(ctx)
 	if err != nil {
-		return v, fmt.Errorf("querying old value for OldConnectorData: %w", err)
+		return v, fmt.Errorf("querying old value for OldMfaSecrets: %w", err)
 	}
-	return oldValue.ConnectorData, nil
+	return oldValue.MfaSecrets, nil
 }
 
-// ClearConnectorData clears the value of the "connector_data" field.
-func (m *RefreshTokenMutation) ClearConnectorData() {
-	m.connector_data = nil
-	m.clearedFields[refreshtoken.FieldConnectorData] = struct{}{}
+// ClearMfaSecrets clears the value of the "mfa_secrets" field.
+func (m *UserIdentityMutation) ClearMfaSecrets() {
+	m.mfa_secrets = nil
+	m.clearedFields[useridentity.FieldMfaSecrets] = struct{}{}
 }
 
-// ConnectorDataCleared returns if the "connector_data" field was cleared in this mutation.
-func (m *RefreshTokenMutation) ConnectorDataCleared() bool {
-	_, ok := m.clearedFields[refreshtoken.FieldConnectorData]
+// MfaSecretsCleared returns if the "mfa_secrets" field was cleared in this mutation.
+func (m *UserIdentityMutation) MfaSecretsCleared() bool {
+	_, ok := m.clearedFields[useridentity.FieldMfaSecrets]
 	return ok
 }
 
-// ResetConnectorData resets all changes to the "connector_data" field.
-func (m *RefreshTokenMutation) ResetConnectorData() {
-	m.connector_data = nil
-	delete(m.clearedFields, refreshtoken.FieldConnectorData)
+// ResetMfaSecrets resets all changes to the "mfa_secrets" field.
+func (m *UserIdentityMutation) ResetMfaSecrets() {
+	m.mfa_secrets = nil
+	delete(m.clearedFields, useridentity.FieldMfaSecrets)
 }
 
-// SetToken sets the "token" field.
-func (m *RefreshTokenMutation) SetToken(s string) {
-	m.token = &s
+// SetWebauthnCredentials sets the "webauthn_credentials" field.
+func (m *UserIdentityMutation) SetWebauthnCredentials(b []byte) {
+	m.webauthn_credentials = &b
 }
 
-// Token returns the value of the "token" field in the mutation.
-func (m *RefreshTokenMutation) Token() (r string, exists bool) {
-	v := m.token
+// WebauthnCredentials returns the value of the "webauthn_credentials" field in the mutation.
+func (m *UserIdentityMutation) WebauthnCredentials() (r []byte, exists bool) {
+	v := m.webauthn_credentials
 	if v == nil {
 		return
 	}
 	return *v, true
 }
 
-// OldToken returns the old "token" field's value of the RefreshToken entity.
-// If the RefreshToken object wasn't provided to the builder, the object is fetched from the database.
+// OldWebauthnCredentials returns the old "webauthn_credentials" field's value of the UserIdentity entity.
+// If the UserIdentity object wasn't provided to the builder, the object is fetched from the database.
 // An error is returned if the mutation operation is not UpdateOne, or the database query fails.
-func (m *RefreshTokenMutation) OldToken(ctx context.Context) (v string, err error) {
+func (m *UserIdentityMutation) OldWebauthnCredentials(ctx context.Context) (v *[]byte, err error) {
 	if !m.op.Is(OpUpdateOne) {
-		return v, errors.New("OldToken is only allowed on UpdateOne operations")
+		return v, errors.New("OldWebauthnCredentials is only allowed on UpdateOne operations")
 	}
 	if m.id == nil || m.oldValue == nil {
-		return v, errors.New("OldToken requires an ID field in the mutation")
+		return v, errors.New("OldWebauthnCredentials requires an ID field in the mutation")
 	}
 	oldValue, err := m.oldValue(ctx)
 	if err != nil {
-		return v, fmt.Errorf("querying old value for OldToken: %w", err)
+		return v, fmt.Errorf("querying old value for OldWebauthnCredentials: %w", err)
 	}
-	return oldValue.Token, nil
-}
-
-// ResetToken resets all changes to the "token" field.
-func (m *RefreshTokenMutation) ResetToken() {
-	m.token = nil
-}
-
-// SetObsoleteToken sets the "obsolete_token" field.
-func (m *RefreshTokenMutation) SetObsoleteToken(s string) {
-	m.obsolete_token = &s
+	return oldValue.WebauthnCredentials, nil
 }
 
-// ObsoleteToken returns the value of the "obsolete_token" field in the mutation.
-func (m *RefreshTokenMutation) ObsoleteToken() (r string, exists bool) {
-	v := m.obsolete_token
-	if v == nil {
-		return
-	}
-	return *v, true
+// ClearWebauthnCredentials clears the value of the "webauthn_credentials" field.
+func (m *UserIdentityMutation) ClearWebauthnCredentials() {
+	m.webauthn_credentials = nil
+	m.clearedFields[useridentity.FieldWebauthnCredentials] = struct{}{}
 }
 
-// OldObsoleteToken returns the old "obsolete_token" field's value of the RefreshToken entity.
-// If the RefreshToken object wasn't provided to the builder, the object is fetched from the database.
-// An error is returned if the mutation operation is not UpdateOne, or the database query fails.
-func (m *RefreshTokenMutation) OldObsoleteToken(ctx context.Context) (v string, err error) {
-	if !m.op.Is(OpUpdateOne) {
-		return v, errors.New("OldObsoleteToken is only allowed on UpdateOne operations")
-	}
-	if m.id == nil || m.oldValue == nil {
-		return v, errors.New("OldObsoleteToken requires an ID field in the mutation")
-	}
-	oldValue, err := m.oldValue(ctx)
-	if err != nil {
-		return v, fmt.Errorf("querying old value for OldObsoleteToken: %w", err)
-	}
-	return oldValue.ObsoleteToken, nil
+// WebauthnCredentialsCleared returns if the "webauthn_credentials" field was cleared in this mutation.
+func (m *UserIdentityMutation) WebauthnCredentialsCleared() bool {
+	_, ok := m.clearedFields[useridentity.FieldWebauthnCredentials]
+	return ok
 }
 
-// ResetObsoleteToken resets all changes to the "obsolete_token" field.
-func (m *RefreshTokenMutation) ResetObsoleteToken() {
-	m.obsolete_token = nil
+// ResetWebauthnCredentials resets all changes to the "webauthn_credentials" field.
+func (m *UserIdentityMutation) ResetWebauthnCredentials() {
+	m.webauthn_credentials = nil
+	delete(m.clearedFields, useridentity.FieldWebauthnCredentials)
 }
 
 // SetCreatedAt sets the "created_at" field.
-func (m *RefreshTokenMutation) SetCreatedAt(t time.Time) {
+func (m *UserIdentityMutation) SetCreatedAt(t time.Time) {
 	m.created_at = &t
 }
 
 // CreatedAt returns the value of the "created_at" field in the mutation.
-func (m *RefreshTokenMutation) CreatedAt() (r time.Time, exists bool) {
+func (m *UserIdentityMutation) CreatedAt() (r time.Time, exists bool) {
 	v := m.created_at
 	if v == nil {
 		return
@@ -7110,10 +10911,10 @@ func (m *RefreshTokenMutation) CreatedAt() (r time.Time, exists bool) {
 	return *v, true
 }
 
-// OldCreatedAt returns the old "created_at" field's value of the RefreshToken entity.
-// If the RefreshToken object wasn't provided to the builder, the object is fetched from the database.
+// OldCreatedAt returns the old "created_at" field's value of the UserIdentity entity.
+// If the UserIdentity object wasn't provided to the builder, the object is fetched from the database.
 // An error is returned if the mutation operation is not UpdateOne, or the database query fails.
-func (m *RefreshTokenMutation) OldCreatedAt(ctx context.Context) (v time.Time, err error) {
+func (m *UserIdentityMutation) OldCreatedAt(ctx context.Context) (v time.Time, err error) {
 	if !m.op.Is(OpUpdateOne) {
 		return v, errors.New("OldCreatedAt is only allowed on UpdateOne operations")
 	}
@@ -7128,110 +10929,158 @@ func (m *RefreshTokenMutation) OldCreatedAt(ctx context.Context) (v time.Time, e
 }
 
 // ResetCreatedAt resets all changes to the "created_at" field.
-func (m *RefreshTokenMutation) ResetCreatedAt() {
+func (m *UserIdentityMutation) ResetCreatedAt() {
 	m.created_at = nil
 }
 
-// SetLastUsed sets the "last_used" field.
-func (m *RefreshTokenMutation) SetLastUsed(t time.Time) {
-	m.last_used = &t
+// SetLastLogin sets the "last_login" field.
+func (m *UserIdentityMutation) SetLastLogin(t time.Time) {
+	m.last_login = &t
 }
 
-// LastUsed returns the value of the "last_used" field in the mutation.
-func (m *RefreshTokenMutation) LastUsed() (r time.Time, exists bool) {
-	v := m.last_used
+// LastLogin returns the value of the "last_login" field in the mutation.
+func (m *UserIdentityMutation) LastLogin() (r time.Time, exists bool) {
+	v := m.last_login
 	if v == nil {
 		return
 	}
 	return *v, true
 }
 
-// OldLastUsed returns the old "last_used" field's value of the RefreshToken entity.
-// If the RefreshToken object wasn't provided to the builder, the object is fetched from the database.
+// OldLastLogin returns the old "last_login" field's value of the UserIdentity entity.
+// If the UserIdentity object wasn't provided to the builder, the object is fetched from the database.
 // An error is returned if the mutation operation is not UpdateOne, or the database query fails.
-func (m *RefreshTokenMutation) OldLastUsed(ctx context.Context) (v time.Time, err error) {
+func (m *UserIdentityMutation) OldLastLogin(ctx context.Context) (v time.Time, err error) {
 	if !m.op.Is(OpUpdateOne) {
-		return v, errors.New("OldLastUsed is only allowed on UpdateOne operations")
+		return v, errors.New("OldLastLogin is only allowed on UpdateOne operations")
 	}
 	if m.id == nil || m.oldValue == nil {
-		return v, errors.New("OldLastUsed requires an ID field in the mutation")
+		return v, errors.New("OldLastLogin requires an ID field in the mutation")
 	}
 	oldValue, err := m.oldValue(ctx)
 	if err != nil {
-		return v, fmt.Errorf("querying old value for OldLastUsed: %w", err)
+		return v, fmt.Errorf("querying old value for OldLastLogin: %w", err)
 	}
-	return oldValue.LastUsed, nil
+	return oldValue.LastLogin, nil
 }
 
-// ResetLastUsed resets all changes to the "last_used" field.
-func (m *RefreshTokenMutation) ResetLastUsed() {
-	m.last_used = nil
+// ResetLastLogin resets all changes to the "last_login" field.
+func (m *UserIdentityMutation) ResetLastLogin() {
+	m.last_login = nil
 }
 
-// Where appends a list predicates to the RefreshTokenMutation builder.
-func (m *RefreshTokenMutation) Where(ps ...predicate.RefreshToken) {
+// SetBlockedUntil sets the "blocked_until" field.
+func (m *UserIdentityMutation) SetBlockedUntil(t time.Time) {
+	m.blocked_until = &t
+}
+
+// BlockedUntil returns the value of the "blocked_until" field in the mutation.
+func (m *UserIdentityMutation) BlockedUntil() (r time.Time, exists bool) {
+	v := m.blocked_until
+	if v == nil {
+		return
+	}
+	return *v, true
+}
+
+// OldBlockedUntil returns the old "blocked_until" field's value of the UserIdentity entity.
+// If the UserIdentity object wasn't provided to the builder, the object is fetched from the database.
+// An error is returned if the mutation operation is not UpdateOne, or the database query fails.
+func (m *UserIdentityMutation) OldBlockedUntil(ctx context.Context) (v time.Time, err error) {
+	if !m.op.Is(OpUpdateOne) {
+		return v, errors.New("OldBlockedUntil is only allowed on UpdateOne operations")
+	}
+	if m.id == nil || m.oldValue == nil {
+		return v, errors.New("OldBlockedUntil requires an ID field in the mutation")
+	}
+	oldValue, err := m.oldValue(ctx)
+	if err != nil {
+		return v, fmt.Errorf("querying old value for OldBlockedUntil: %w", err)
+	}
+	return oldValue.BlockedUntil, nil
+}
+
+// ResetBlockedUntil resets all changes to the "blocked_until" field.
+func (m *UserIdentityMutation) ResetBlockedUntil() {
+	m.blocked_until = nil
+}
+
+// Where appends a list predicates to the UserIdentityMutation builder.
+func (m *UserIdentityMutation) Where(ps ...predicate.UserIdentity) {
 	m.predicates = append(m.predicates, ps...)
 }
 
+// WhereP appends storage-level predicates to the UserIdentityMutation builder. Using this method,
+// users can use type-assertion to append predicates that do not depend on any generated package.
+func (m *UserIdentityMutation) WhereP(ps ...func(*sql.Selector)) {
+	p := make([]predicate.UserIdentity, len(ps))
+	for i := range ps {
+		p[i] = ps[i]
+	}
+	m.Where(p...)
+}
+
 // Op returns the operation name.
-func (m *RefreshTokenMutation) Op() Op {
+func (m *UserIdentityMutation) Op() Op {
 	return m.op
 }
 
-// Type returns the node type of this mutation (RefreshToken).
-func (m *RefreshTokenMutation) Type() string {
+// SetOp allows setting the mutation operation.
+func (m *UserIdentityMutation) SetOp(op Op) {
+	m.op = op
+}
+
+// Type returns the node type of this mutation (UserIdentity).
+func (m *UserIdentityMutation) Type() string {
 	return m.typ
 }
 
 // Fields returns all fields that were changed during this mutation. Note that in
 // order to get all numeric fields that were incremented/decremented, call
 // AddedFields().
-func (m *RefreshTokenMutation) Fields() []string {
-	fields := make([]string, 0, 15)
-	if m.client_id != nil {
-		fields = append(fields, refreshtoken.FieldClientID)
-	}
-	if m.scopes != nil {
-		fields = append(fields, refreshtoken.FieldScopes)
+func (m *UserIdentityMutation) Fields() []string {
+	fields := make([]string, 0, 14)
+	if m.user_id != nil {
+		fields = append(fields, useridentity.FieldUserID)
 	}
-	if m.nonce != nil {
-		fields = append(fields, refreshtoken.FieldNonce)
+	if m.connector_id != nil {
+		fields = append(fields, useridentity.FieldConnectorID)
 	}
 	if m.claims_user_id != nil {
-		fields = append(fields, refreshtoken.FieldClaimsUserID)
+		fields = append(fields, useridentity.FieldClaimsUserID)
 	}
 	if m.claims_username != nil {
-		fields = append(fields, refreshtoken.FieldClaimsUsername)
+		fields = append(fields, useridentity.FieldClaimsUsername)
+	}
+	if m.claims_preferred_username != nil {
+		fields = append(fields, useridentity.FieldClaimsPreferredUsername)
 	}
 	if m.claims_email != nil {
-		fields = append(fields, refreshtoken.FieldClaimsEmail)
+		fields = append(fields, useridentity.FieldClaimsEmail)
 	}
 	if m.claims_email_verified != nil {
-		fields = append(fields, refreshtoken.FieldClaimsEmailVerified)
+		fields = append(fields, useridentity.FieldClaimsEmailVerified)
 	}
 	if m.claims_groups != nil {
-		fields = append(fields, refreshtoken.FieldClaimsGroups)
-	}
-	if m.claims_preferred_username != nil {
-		fields = append(fields, refreshtoken.FieldClaimsPreferredUsername)
-	}
-	if m.connector_id != nil {
-		fields = append(fields, refreshtoken.FieldConnectorID)
+		fields = append(fields, useridentity.FieldClaimsGroups)
 	}
-	if m.connector_data != nil {
-		fields = append(fields, refreshtoken.FieldConnectorData)
+	if m.consents != nil {
+		fields = append(fields, useridentity.FieldConsents)
 	}
-	if m.token != nil {
-		fields = append(fields, refreshtoken.FieldToken)
+	if m.mfa_secrets != nil {
+		fields = append(fields, useridentity.FieldMfaSecrets)
 	}
-	if m.obsolete_token != nil {
-		fields = append(fields, refreshtoken.FieldObsoleteToken)
+	if m.webauthn_credentials != nil {
+		fields = append(fields, useridentity.FieldWebauthnCredentials)
 	}
 	if m.created_at != nil {
-		fields = append(fields, refreshtoken.FieldCreatedAt)
+		fields = append(fields, useridentity.FieldCreatedAt)
 	}
-	if m.last_used != nil {
-		fields = append(fields, refreshtoken.FieldLastUsed)
+	if m.last_login != nil {
+		fields = append(fields, useridentity.FieldLastLogin)
+	}
+	if m.blocked_until != nil {
+		fields = append(fields, useridentity.FieldBlockedUntil)
 	}
 	return fields
 }
@@ -7239,38 +11088,36 @@ func (m *RefreshTokenMutation) Fields() []string {
 // Field returns the value of a field with the given name. The second boolean
 // return value indicates that this field was not set, or was not defined in the
 // schema.
-func (m *RefreshTokenMutation) Field(name string) (ent.Value, bool) {
+func (m *UserIdentityMutation) Field(name string) (ent.Value, bool) {
 	switch name {
-	case refreshtoken.FieldClientID:
-		return m.ClientID()
-	case refreshtoken.FieldScopes:
-		return m.Scopes()
-	case refreshtoken.FieldNonce:
-		return m.Nonce()
-	case refreshtoken.FieldClaimsUserID:
+	case useridentity.FieldUserID:
+		return m.UserID()
+	case useridentity.FieldConnectorID:
+		return m.ConnectorID()
+	case useridentity.FieldClaimsUserID:
 		return m.ClaimsUserID()
-	case refreshtoken.FieldClaimsUsername:
+	case useridentity.FieldClaimsUsername:
 		return m.ClaimsUsername()
-	case refreshtoken.FieldClaimsEmail:
+	case useridentity.FieldClaimsPreferredUsername:
+		return m.ClaimsPreferredUsername()
+	case useridentity.FieldClaimsEmail:
 		return m.ClaimsEmail()
-	case refreshtoken.FieldClaimsEmailVerified:
+	case useridentity.FieldClaimsEmailVerified:
 		return m.ClaimsEmailVerified()
-	case refreshtoken.FieldClaimsGroups:
+	case useridentity.FieldClaimsGroups:
 		return m.ClaimsGroups()
-	case refreshtoken.FieldClaimsPreferredUsername:
-		return m.ClaimsPreferredUsername()
-	case refreshtoken.FieldConnectorID:
-		return m.ConnectorID()
-	case refreshtoken.FieldConnectorData:
-		return m.ConnectorData()
-	case refreshtoken.FieldToken:
-		return m.Token()
-	case refreshtoken.FieldObsoleteToken:
-		return m.ObsoleteToken()
-	case refreshtoken.FieldCreatedAt:
+	case useridentity.FieldConsents:
+		return m.Consents()
+	case useridentity.FieldMfaSecrets:
+		return m.MfaSecrets()
+	case useridentity.FieldWebauthnCredentials:
+		return m.WebauthnCredentials()
+	case useridentity.FieldCreatedAt:
 		return m.CreatedAt()
-	case refreshtoken.FieldLastUsed:
-		return m.LastUsed()
+	case useridentity.FieldLastLogin:
+		return m.LastLogin()
+	case useridentity.FieldBlockedUntil:
+		return m.BlockedUntil()
 	}
 	return nil, false
 }
@@ -7278,315 +11125,303 @@ func (m *RefreshTokenMutation) Field(name string) (ent.Value, bool) {
 // OldField returns the old value of the field from the database. An error is
 // returned if the mutation operation is not UpdateOne, or the query to the
 // database failed.
-func (m *RefreshTokenMutation) OldField(ctx context.Context, name string) (ent.Value, error) {
+func (m *UserIdentityMutation) OldField(ctx context.Context, name string) (ent.Value, error) {
 	switch name {
-	case refreshtoken.FieldClientID:
-		return m.OldClientID(ctx)
-	case refreshtoken.FieldScopes:
-		return m.OldScopes(ctx)
-	case refreshtoken.FieldNonce:
-		return m.OldNonce(ctx)
-	case refreshtoken.FieldClaimsUserID:
+	case useridentity.FieldUserID:
+		return m.OldUserID(ctx)
+	case useridentity.FieldConnectorID:
+		return m.OldConnectorID(ctx)
+	case useridentity.FieldClaimsUserID:
 		return m.OldClaimsUserID(ctx)
-	case refreshtoken.FieldClaimsUsername:
+	case useridentity.FieldClaimsUsername:
 		return m.OldClaimsUsername(ctx)
-	case refreshtoken.FieldClaimsEmail:
+	case useridentity.FieldClaimsPreferredUsername:
+		return m.OldClaimsPreferredUsername(ctx)
+	case useridentity.FieldClaimsEmail:
 		return m.OldClaimsEmail(ctx)
-	case refreshtoken.FieldClaimsEmailVerified:
+	case useridentity.FieldClaimsEmailVerified:
 		return m.OldClaimsEmailVerified(ctx)
-	case refreshtoken.FieldClaimsGroups:
+	case useridentity.FieldClaimsGroups:
 		return m.OldClaimsGroups(ctx)
-	case refreshtoken.FieldClaimsPreferredUsername:
-		return m.OldClaimsPreferredUsername(ctx)
-	case refreshtoken.FieldConnectorID:
-		return m.OldConnectorID(ctx)
-	case refreshtoken.FieldConnectorData:
-		return m.OldConnectorData(ctx)
-	case refreshtoken.FieldToken:
-		return m.OldToken(ctx)
-	case refreshtoken.FieldObsoleteToken:
-		return m.OldObsoleteToken(ctx)
-	case refreshtoken.FieldCreatedAt:
+	case useridentity.FieldConsents:
+		return m.OldConsents(ctx)
+	case useridentity.FieldMfaSecrets:
+		return m.OldMfaSecrets(ctx)
+	case useridentity.FieldWebauthnCredentials:
+		return m.OldWebauthnCredentials(ctx)
+	case useridentity.FieldCreatedAt:
 		return m.OldCreatedAt(ctx)
-	case refreshtoken.FieldLastUsed:
-		return m.OldLastUsed(ctx)
+	case useridentity.FieldLastLogin:
+		return m.OldLastLogin(ctx)
+	case useridentity.FieldBlockedUntil:
+		return m.OldBlockedUntil(ctx)
 	}
-	return nil, fmt.Errorf("unknown RefreshToken field %s", name)
+	return nil, fmt.Errorf("unknown UserIdentity field %s", name)
 }
 
 // SetField sets the value of a field with the given name. It returns an error if
 // the field is not defined in the schema, or if the type mismatched the field
 // type.
-func (m *RefreshTokenMutation) SetField(name string, value ent.Value) error {
+func (m *UserIdentityMutation) SetField(name string, value ent.Value) error {
 	switch name {
-	case refreshtoken.FieldClientID:
+	case useridentity.FieldUserID:
 		v, ok := value.(string)
 		if !ok {
 			return fmt.Errorf("unexpected type %T for field %s", value, name)
 		}
-		m.SetClientID(v)
+		m.SetUserID(v)
 		return nil
-	case refreshtoken.FieldScopes:
-		v, ok := value.([]string)
+	case useridentity.FieldConnectorID:
+		v, ok := value.(string)
 		if !ok {
 			return fmt.Errorf("unexpected type %T for field %s", value, name)
 		}
-		m.SetScopes(v)
+		m.SetConnectorID(v)
 		return nil
-	case refreshtoken.FieldNonce:
+	case useridentity.FieldClaimsUserID:
 		v, ok := value.(string)
 		if !ok {
 			return fmt.Errorf("unexpected type %T for field %s", value, name)
 		}
-		m.SetNonce(v)
+		m.SetClaimsUserID(v)
 		return nil
-	case refreshtoken.FieldClaimsUserID:
+	case useridentity.FieldClaimsUsername:
 		v, ok := value.(string)
 		if !ok {
 			return fmt.Errorf("unexpected type %T for field %s", value, name)
 		}
-		m.SetClaimsUserID(v)
+		m.SetClaimsUsername(v)
 		return nil
-	case refreshtoken.FieldClaimsUsername:
+	case useridentity.FieldClaimsPreferredUsername:
 		v, ok := value.(string)
 		if !ok {
 			return fmt.Errorf("unexpected type %T for field %s", value, name)
 		}
-		m.SetClaimsUsername(v)
+		m.SetClaimsPreferredUsername(v)
 		return nil
-	case refreshtoken.FieldClaimsEmail:
+	case useridentity.FieldClaimsEmail:
 		v, ok := value.(string)
 		if !ok {
 			return fmt.Errorf("unexpected type %T for field %s", value, name)
 		}
 		m.SetClaimsEmail(v)
 		return nil
-	case refreshtoken.FieldClaimsEmailVerified:
+	case useridentity.FieldClaimsEmailVerified:
 		v, ok := value.(bool)
 		if !ok {
 			return fmt.Errorf("unexpected type %T for field %s", value, name)
 		}
 		m.SetClaimsEmailVerified(v)
 		return nil
-	case refreshtoken.FieldClaimsGroups:
+	case useridentity.FieldClaimsGroups:
 		v, ok := value.([]string)
 		if !ok {
 			return fmt.Errorf("unexpected type %T for field %s", value, name)
 		}
 		m.SetClaimsGroups(v)
 		return nil
-	case refreshtoken.FieldClaimsPreferredUsername:
-		v, ok := value.(string)
-		if !ok {
-			return fmt.Errorf("unexpected type %T for field %s", value, name)
-		}
-		m.SetClaimsPreferredUsername(v)
-		return nil
-	case refreshtoken.FieldConnectorID:
-		v, ok := value.(string)
+	case useridentity.FieldConsents:
+		v, ok := value.([]byte)
 		if !ok {
 			return fmt.Errorf("unexpected type %T for field %s", value, name)
 		}
-		m.SetConnectorID(v)
+		m.SetConsents(v)
 		return nil
-	case refreshtoken.FieldConnectorData:
+	case useridentity.FieldMfaSecrets:
 		v, ok := value.([]byte)
 		if !ok {
 			return fmt.Errorf("unexpected type %T for field %s", value, name)
 		}
-		m.SetConnectorData(v)
+		m.SetMfaSecrets(v)
 		return nil
-	case refreshtoken.FieldToken:
-		v, ok := value.(string)
+	case useridentity.FieldWebauthnCredentials:
+		v, ok := value.([]byte)
 		if !ok {
 			return fmt.Errorf("unexpected type %T for field %s", value, name)
 		}
-		m.SetToken(v)
+		m.SetWebauthnCredentials(v)
 		return nil
-	case refreshtoken.FieldObsoleteToken:
-		v, ok := value.(string)
+	case useridentity.FieldCreatedAt:
+		v, ok := value.(time.Time)
 		if !ok {
 			return fmt.Errorf("unexpected type %T for field %s", value, name)
 		}
-		m.SetObsoleteToken(v)
+		m.SetCreatedAt(v)
 		return nil
-	case refreshtoken.FieldCreatedAt:
+	case useridentity.FieldLastLogin:
 		v, ok := value.(time.Time)
 		if !ok {
 			return fmt.Errorf("unexpected type %T for field %s", value, name)
 		}
-		m.SetCreatedAt(v)
+		m.SetLastLogin(v)
 		return nil
-	case refreshtoken.FieldLastUsed:
+	case useridentity.FieldBlockedUntil:
 		v, ok := value.(time.Time)
 		if !ok {
 			return fmt.Errorf("unexpected type %T for field %s", value, name)
 		}
-		m.SetLastUsed(v)
+		m.SetBlockedUntil(v)
 		return nil
 	}
-	return fmt.Errorf("unknown RefreshToken field %s", name)
+	return fmt.Errorf("unknown UserIdentity field %s", name)
 }
 
 // AddedFields returns all numeric fields that were incremented/decremented during
 // this mutation.
-func (m *RefreshTokenMutation) AddedFields() []string {
+func (m *UserIdentityMutation) AddedFields() []string {
 	return nil
 }
 
 // AddedField returns the numeric value that was incremented/decremented on a field
 // with the given name. The second boolean return value indicates that this field
 // was not set, or was not defined in the schema.
-func (m *RefreshTokenMutation) AddedField(name string) (ent.Value, bool) {
+func (m *UserIdentityMutation) AddedField(name string) (ent.Value, bool) {
 	return nil, false
 }
 
 // AddField adds the value to the field with the given name. It returns an error if
 // the field is not defined in the schema, or if the type mismatched the field
 // type.
-func (m *RefreshTokenMutation) AddField(name string, value ent.Value) error {
+func (m *UserIdentityMutation) AddField(name string, value ent.Value) error {
 	switch name {
 	}
-	return fmt.Errorf("unknown RefreshToken numeric field %s", name)
+	return fmt.Errorf("unknown UserIdentity numeric field %s", name)
 }
 
 // ClearedFields returns all nullable fields that were cleared during this
 // mutation.
-func (m *RefreshTokenMutation) ClearedFields() []string {
+func (m *UserIdentityMutation) ClearedFields() []string {
 	var fields []string
-	if m.FieldCleared(refreshtoken.FieldScopes) {
-		fields = append(fields, refreshtoken.FieldScopes)
+	if m.FieldCleared(useridentity.FieldClaimsGroups) {
+		fields = append(fields, useridentity.FieldClaimsGroups)
 	}
-	if m.FieldCleared(refreshtoken.FieldClaimsGroups) {
-		fields = append(fields, refreshtoken.FieldClaimsGroups)
+	if m.FieldCleared(useridentity.FieldMfaSecrets) {
+		fields = append(fields, useridentity.FieldMfaSecrets)
 	}
-	if m.FieldCleared(refreshtoken.FieldConnectorData) {
-		fields = append(fields, refreshtoken.FieldConnectorData)
+	if m.FieldCleared(useridentity.FieldWebauthnCredentials) {
+		fields = append(fields, useridentity.FieldWebauthnCredentials)
 	}
 	return fields
 }
 
 // FieldCleared returns a boolean indicating if a field with the given name was
 // cleared in this mutation.
-func (m *RefreshTokenMutation) FieldCleared(name string) bool {
+func (m *UserIdentityMutation) FieldCleared(name string) bool {
 	_, ok := m.clearedFields[name]
 	return ok
 }
 
 // ClearField clears the value of the field with the given name. It returns an
 // error if the field is not defined in the schema.
-func (m *RefreshTokenMutation) ClearField(name string) error {
+func (m *UserIdentityMutation) ClearField(name string) error {
 	switch name {
-	case refreshtoken.FieldScopes:
-		m.ClearScopes()
-		return nil
-	case refreshtoken.FieldClaimsGroups:
+	case useridentity.FieldClaimsGroups:
 		m.ClearClaimsGroups()
 		return nil
-	case refreshtoken.FieldConnectorData:
-		m.ClearConnectorData()
+	case useridentity.FieldMfaSecrets:
+		m.ClearMfaSecrets()
+		return nil
+	case useridentity.FieldWebauthnCredentials:
+		m.ClearWebauthnCredentials()
 		return nil
 	}
-	return fmt.Errorf("unknown RefreshToken nullable field %s", name)
+	return fmt.Errorf("unknown UserIdentity nullable field %s", name)
 }
 
 // ResetField resets all changes in the mutation for the field with the given name.
 // It returns an error if the field is not defined in the schema.
-func (m *RefreshTokenMutation) ResetField(name string) error {
+func (m *UserIdentityMutation) ResetField(name string) error {
 	switch name {
-	case refreshtoken.FieldClientID:
-		m.ResetClientID()
-		return nil
-	case refreshtoken.FieldScopes:
-		m.ResetScopes()
+	case useridentity.FieldUserID:
+		m.ResetUserID()
 		return nil
-	case refreshtoken.FieldNonce:
-		m.ResetNonce()
+	case useridentity.FieldConnectorID:
+		m.ResetConnectorID()
 		return nil
-	case refreshtoken.FieldClaimsUserID:
+	case useridentity.FieldClaimsUserID:
 		m.ResetClaimsUserID()
 		return nil
-	case refreshtoken.FieldClaimsUsername:
+	case useridentity.FieldClaimsUsername:
 		m.ResetClaimsUsername()
 		return nil
-	case refreshtoken.FieldClaimsEmail:
+	case useridentity.FieldClaimsPreferredUsername:
+		m.ResetClaimsPreferredUsername()
+		return nil
+	case useridentity.FieldClaimsEmail:
 		m.ResetClaimsEmail()
 		return nil
-	case refreshtoken.FieldClaimsEmailVerified:
+	case useridentity.FieldClaimsEmailVerified:
 		m.ResetClaimsEmailVerified()
 		return nil
-	case refreshtoken.FieldClaimsGroups:
+	case useridentity.FieldClaimsGroups:
 		m.ResetClaimsGroups()
 		return nil
-	case refreshtoken.FieldClaimsPreferredUsername:
-		m.ResetClaimsPreferredUsername()
-		return nil
-	case refreshtoken.FieldConnectorID:
-		m.ResetConnectorID()
-		return nil
-	case refreshtoken.FieldConnectorData:
-		m.ResetConnectorData()
+	case useridentity.FieldConsents:
+		m.ResetConsents()
 		return nil
-	case refreshtoken.FieldToken:
-		m.ResetToken()
+	case useridentity.FieldMfaSecrets:
+		m.ResetMfaSecrets()
 		return nil
-	case refreshtoken.FieldObsoleteToken:
-		m.ResetObsoleteToken()
+	case useridentity.FieldWebauthnCredentials:
+		m.ResetWebauthnCredentials()
 		return nil
-	case refreshtoken.FieldCreatedAt:
+	case useridentity.FieldCreatedAt:
 		m.ResetCreatedAt()
 		return nil
-	case refreshtoken.FieldLastUsed:
-		m.ResetLastUsed()
+	case useridentity.FieldLastLogin:
+		m.ResetLastLogin()
+		return nil
+	case useridentity.FieldBlockedUntil:
+		m.ResetBlockedUntil()
 		return nil
 	}
-	return fmt.Errorf("unknown RefreshToken field %s", name)
+	return fmt.Errorf("unknown UserIdentity field %s", name)
 }
 
 // AddedEdges returns all edge names that were set/added in this mutation.
-func (m *RefreshTokenMutation) AddedEdges() []string {
+func (m *UserIdentityMutation) AddedEdges() []string {
 	edges := make([]string, 0, 0)
 	return edges
 }
 
 // AddedIDs returns all IDs (to other nodes) that were added for the given edge
 // name in this mutation.
-func (m *RefreshTokenMutation) AddedIDs(name string) []ent.Value {
+func (m *UserIdentityMutation) AddedIDs(name string) []ent.Value {
 	return nil
 }
 
 // RemovedEdges returns all edge names that were removed in this mutation.
-func (m *RefreshTokenMutation) RemovedEdges() []string {
+func (m *UserIdentityMutation) RemovedEdges() []string {
 	edges := make([]string, 0, 0)
 	return edges
 }
 
 // RemovedIDs returns all IDs (to other nodes) that were removed for the edge with
 // the given name in this mutation.
-func (m *RefreshTokenMutation) RemovedIDs(name string) []ent.Value {
+func (m *UserIdentityMutation) RemovedIDs(name string) []ent.Value {
 	return nil
 }
 
 // ClearedEdges returns all edge names that were cleared in this mutation.
-func (m *RefreshTokenMutation) ClearedEdges() []string {
+func (m *UserIdentityMutation) ClearedEdges() []string {
 	edges := make([]string, 0, 0)
 	return edges
 }
 
 // EdgeCleared returns a boolean which indicates if the edge with the given name
 // was cleared in this mutation.
-func (m *RefreshTokenMutation) EdgeCleared(name string) bool {
+func (m *UserIdentityMutation) EdgeCleared(name string) bool {
 	return false
 }
 
 // ClearEdge clears the value of the edge with the given name. It returns an error
 // if that edge is not defined in the schema.
-func (m *RefreshTokenMutation) ClearEdge(name string) error {
-	return fmt.Errorf("unknown RefreshToken unique edge %s", name)
+func (m *UserIdentityMutation) ClearEdge(name string) error {
+	return fmt.Errorf("unknown UserIdentity unique edge %s", name)
 }
 
 // ResetEdge resets all changes to the edge with the given name in this mutation.
 // It returns an error if the edge is not defined in the schema.
-func (m *RefreshTokenMutation) ResetEdge(name string) error {
-	return fmt.Errorf("unknown RefreshToken edge %s", name)
+func (m *UserIdentityMutation) ResetEdge(name string) error {
+	return fmt.Errorf("unknown UserIdentity edge %s", name)
 }
diff --git a/storage/ent/db/oauth2client.go b/storage/ent/db/oauth2client.go
index f96ca218e1..a0472ac7a5 100644
--- a/storage/ent/db/oauth2client.go
+++ b/storage/ent/db/oauth2client.go
@@ -7,7 +7,9 @@ import (
 	"fmt"
 	"strings"
 
+	"entgo.io/ent"
 	"entgo.io/ent/dialect/sql"
+	"github.com/dexidp/dex/storage"
 	"github.com/dexidp/dex/storage/ent/db/oauth2client"
 )
 
@@ -28,21 +30,36 @@ type OAuth2Client struct {
 	Name string `json:"name,omitempty"`
 	// LogoURL holds the value of the "logo_url" field.
 	LogoURL string `json:"logo_url,omitempty"`
+	// AllowedConnectors holds the value of the "allowed_connectors" field.
+	AllowedConnectors []string `json:"allowed_connectors,omitempty"`
+	// MfaChain holds the value of the "mfa_chain" field.
+	MfaChain []string `json:"mfa_chain,omitempty"`
+	// PostLogoutRedirectUris holds the value of the "post_logout_redirect_uris" field.
+	PostLogoutRedirectUris []string `json:"post_logout_redirect_uris,omitempty"`
+	// SSOSharedWith holds the value of the "sso_shared_with" field.
+	SSOSharedWith []string `json:"sso_shared_with,omitempty"`
+	// BackchannelLogoutURI holds the value of the "backchannel_logout_uri" field.
+	BackchannelLogoutURI string `json:"backchannel_logout_uri,omitempty"`
+	// RefreshTokenLifetime holds the value of the "refresh_token_lifetime" field.
+	RefreshTokenLifetime string `json:"refresh_token_lifetime,omitempty"`
+	// ClientCredentialsClaims holds the value of the "client_credentials_claims" field.
+	ClientCredentialsClaims *storage.ClientCredentialsClaims `json:"client_credentials_claims,omitempty"`
+	selectValues            sql.SelectValues
 }
 
 // scanValues returns the types for scanning values from sql.Rows.
-func (*OAuth2Client) scanValues(columns []string) ([]interface{}, error) {
-	values := make([]interface{}, len(columns))
+func (*OAuth2Client) scanValues(columns []string) ([]any, error) {
+	values := make([]any, len(columns))
 	for i := range columns {
 		switch columns[i] {
-		case oauth2client.FieldRedirectUris, oauth2client.FieldTrustedPeers:
+		case oauth2client.FieldRedirectUris, oauth2client.FieldTrustedPeers, oauth2client.FieldAllowedConnectors, oauth2client.FieldMfaChain, oauth2client.FieldPostLogoutRedirectUris, oauth2client.FieldSSOSharedWith, oauth2client.FieldClientCredentialsClaims:
 			values[i] = new([]byte)
 		case oauth2client.FieldPublic:
 			values[i] = new(sql.NullBool)
-		case oauth2client.FieldID, oauth2client.FieldSecret, oauth2client.FieldName, oauth2client.FieldLogoURL:
+		case oauth2client.FieldID, oauth2client.FieldSecret, oauth2client.FieldName, oauth2client.FieldLogoURL, oauth2client.FieldBackchannelLogoutURI, oauth2client.FieldRefreshTokenLifetime:
 			values[i] = new(sql.NullString)
 		default:
-			return nil, fmt.Errorf("unexpected column %q for type OAuth2Client", columns[i])
+			values[i] = new(sql.UnknownType)
 		}
 	}
 	return values, nil
@@ -50,7 +67,7 @@ func (*OAuth2Client) scanValues(columns []string) ([]interface{}, error) {
 
 // assignValues assigns the values that were returned from sql.Rows (after scanning)
 // to the OAuth2Client fields.
-func (o *OAuth2Client) assignValues(columns []string, values []interface{}) error {
+func (_m *OAuth2Client) assignValues(columns []string, values []any) error {
 	if m, n := len(values), len(columns); m < n {
 		return fmt.Errorf("mismatch number of scan values: %d != %d", m, n)
 	}
@@ -60,19 +77,19 @@ func (o *OAuth2Client) assignValues(columns []string, values []interface{}) erro
 			if value, ok := values[i].(*sql.NullString); !ok {
 				return fmt.Errorf("unexpected type %T for field id", values[i])
 			} else if value.Valid {
-				o.ID = value.String
+				_m.ID = value.String
 			}
 		case oauth2client.FieldSecret:
 			if value, ok := values[i].(*sql.NullString); !ok {
 				return fmt.Errorf("unexpected type %T for field secret", values[i])
 			} else if value.Valid {
-				o.Secret = value.String
+				_m.Secret = value.String
 			}
 		case oauth2client.FieldRedirectUris:
 			if value, ok := values[i].(*[]byte); !ok {
 				return fmt.Errorf("unexpected type %T for field redirect_uris", values[i])
 			} else if value != nil && len(*value) > 0 {
-				if err := json.Unmarshal(*value, &o.RedirectUris); err != nil {
+				if err := json.Unmarshal(*value, &_m.RedirectUris); err != nil {
 					return fmt.Errorf("unmarshal field redirect_uris: %w", err)
 				}
 			}
@@ -80,7 +97,7 @@ func (o *OAuth2Client) assignValues(columns []string, values []interface{}) erro
 			if value, ok := values[i].(*[]byte); !ok {
 				return fmt.Errorf("unexpected type %T for field trusted_peers", values[i])
 			} else if value != nil && len(*value) > 0 {
-				if err := json.Unmarshal(*value, &o.TrustedPeers); err != nil {
+				if err := json.Unmarshal(*value, &_m.TrustedPeers); err != nil {
 					return fmt.Errorf("unmarshal field trusted_peers: %w", err)
 				}
 			}
@@ -88,74 +105,149 @@ func (o *OAuth2Client) assignValues(columns []string, values []interface{}) erro
 			if value, ok := values[i].(*sql.NullBool); !ok {
 				return fmt.Errorf("unexpected type %T for field public", values[i])
 			} else if value.Valid {
-				o.Public = value.Bool
+				_m.Public = value.Bool
 			}
 		case oauth2client.FieldName:
 			if value, ok := values[i].(*sql.NullString); !ok {
 				return fmt.Errorf("unexpected type %T for field name", values[i])
 			} else if value.Valid {
-				o.Name = value.String
+				_m.Name = value.String
 			}
 		case oauth2client.FieldLogoURL:
 			if value, ok := values[i].(*sql.NullString); !ok {
 				return fmt.Errorf("unexpected type %T for field logo_url", values[i])
 			} else if value.Valid {
-				o.LogoURL = value.String
+				_m.LogoURL = value.String
 			}
+		case oauth2client.FieldAllowedConnectors:
+			if value, ok := values[i].(*[]byte); !ok {
+				return fmt.Errorf("unexpected type %T for field allowed_connectors", values[i])
+			} else if value != nil && len(*value) > 0 {
+				if err := json.Unmarshal(*value, &_m.AllowedConnectors); err != nil {
+					return fmt.Errorf("unmarshal field allowed_connectors: %w", err)
+				}
+			}
+		case oauth2client.FieldMfaChain:
+			if value, ok := values[i].(*[]byte); !ok {
+				return fmt.Errorf("unexpected type %T for field mfa_chain", values[i])
+			} else if value != nil && len(*value) > 0 {
+				if err := json.Unmarshal(*value, &_m.MfaChain); err != nil {
+					return fmt.Errorf("unmarshal field mfa_chain: %w", err)
+				}
+			}
+		case oauth2client.FieldPostLogoutRedirectUris:
+			if value, ok := values[i].(*[]byte); !ok {
+				return fmt.Errorf("unexpected type %T for field post_logout_redirect_uris", values[i])
+			} else if value != nil && len(*value) > 0 {
+				if err := json.Unmarshal(*value, &_m.PostLogoutRedirectUris); err != nil {
+					return fmt.Errorf("unmarshal field post_logout_redirect_uris: %w", err)
+				}
+			}
+		case oauth2client.FieldSSOSharedWith:
+			if value, ok := values[i].(*[]byte); !ok {
+				return fmt.Errorf("unexpected type %T for field sso_shared_with", values[i])
+			} else if value != nil && len(*value) > 0 {
+				if err := json.Unmarshal(*value, &_m.SSOSharedWith); err != nil {
+					return fmt.Errorf("unmarshal field sso_shared_with: %w", err)
+				}
+			}
+		case oauth2client.FieldBackchannelLogoutURI:
+			if value, ok := values[i].(*sql.NullString); !ok {
+				return fmt.Errorf("unexpected type %T for field backchannel_logout_uri", values[i])
+			} else if value.Valid {
+				_m.BackchannelLogoutURI = value.String
+			}
+		case oauth2client.FieldRefreshTokenLifetime:
+			if value, ok := values[i].(*sql.NullString); !ok {
+				return fmt.Errorf("unexpected type %T for field refresh_token_lifetime", values[i])
+			} else if value.Valid {
+				_m.RefreshTokenLifetime = value.String
+			}
+		case oauth2client.FieldClientCredentialsClaims:
+			if value, ok := values[i].(*[]byte); !ok {
+				return fmt.Errorf("unexpected type %T for field client_credentials_claims", values[i])
+			} else if value != nil && len(*value) > 0 {
+				if err := json.Unmarshal(*value, &_m.ClientCredentialsClaims); err != nil {
+					return fmt.Errorf("unmarshal field client_credentials_claims: %w", err)
+				}
+			}
+		default:
+			_m.selectValues.Set(columns[i], values[i])
 		}
 	}
 	return nil
 }
 
+// Value returns the ent.Value that was dynamically selected and assigned to the OAuth2Client.
+// This includes values selected through modifiers, order, etc.
+func (_m *OAuth2Client) Value(name string) (ent.Value, error) {
+	return _m.selectValues.Get(name)
+}
+
 // Update returns a builder for updating this OAuth2Client.
 // Note that you need to call OAuth2Client.Unwrap() before calling this method if this OAuth2Client
 // was returned from a transaction, and the transaction was committed or rolled back.
-func (o *OAuth2Client) Update() *OAuth2ClientUpdateOne {
-	return (&OAuth2ClientClient{config: o.config}).UpdateOne(o)
+func (_m *OAuth2Client) Update() *OAuth2ClientUpdateOne {
+	return NewOAuth2ClientClient(_m.config).UpdateOne(_m)
 }
 
 // Unwrap unwraps the OAuth2Client entity that was returned from a transaction after it was closed,
 // so that all future queries will be executed through the driver which created the transaction.
-func (o *OAuth2Client) Unwrap() *OAuth2Client {
-	_tx, ok := o.config.driver.(*txDriver)
+func (_m *OAuth2Client) Unwrap() *OAuth2Client {
+	_tx, ok := _m.config.driver.(*txDriver)
 	if !ok {
 		panic("db: OAuth2Client is not a transactional entity")
 	}
-	o.config.driver = _tx.drv
-	return o
+	_m.config.driver = _tx.drv
+	return _m
 }
 
 // String implements the fmt.Stringer.
-func (o *OAuth2Client) String() string {
+func (_m *OAuth2Client) String() string {
 	var builder strings.Builder
 	builder.WriteString("OAuth2Client(")
-	builder.WriteString(fmt.Sprintf("id=%v, ", o.ID))
+	builder.WriteString(fmt.Sprintf("id=%v, ", _m.ID))
 	builder.WriteString("secret=")
-	builder.WriteString(o.Secret)
+	builder.WriteString(_m.Secret)
 	builder.WriteString(", ")
 	builder.WriteString("redirect_uris=")
-	builder.WriteString(fmt.Sprintf("%v", o.RedirectUris))
+	builder.WriteString(fmt.Sprintf("%v", _m.RedirectUris))
 	builder.WriteString(", ")
 	builder.WriteString("trusted_peers=")
-	builder.WriteString(fmt.Sprintf("%v", o.TrustedPeers))
+	builder.WriteString(fmt.Sprintf("%v", _m.TrustedPeers))
 	builder.WriteString(", ")
 	builder.WriteString("public=")
-	builder.WriteString(fmt.Sprintf("%v", o.Public))
+	builder.WriteString(fmt.Sprintf("%v", _m.Public))
 	builder.WriteString(", ")
 	builder.WriteString("name=")
-	builder.WriteString(o.Name)
+	builder.WriteString(_m.Name)
 	builder.WriteString(", ")
 	builder.WriteString("logo_url=")
-	builder.WriteString(o.LogoURL)
+	builder.WriteString(_m.LogoURL)
+	builder.WriteString(", ")
+	builder.WriteString("allowed_connectors=")
+	builder.WriteString(fmt.Sprintf("%v", _m.AllowedConnectors))
+	builder.WriteString(", ")
+	builder.WriteString("mfa_chain=")
+	builder.WriteString(fmt.Sprintf("%v", _m.MfaChain))
+	builder.WriteString(", ")
+	builder.WriteString("post_logout_redirect_uris=")
+	builder.WriteString(fmt.Sprintf("%v", _m.PostLogoutRedirectUris))
+	builder.WriteString(", ")
+	builder.WriteString("sso_shared_with=")
+	builder.WriteString(fmt.Sprintf("%v", _m.SSOSharedWith))
+	builder.WriteString(", ")
+	builder.WriteString("backchannel_logout_uri=")
+	builder.WriteString(_m.BackchannelLogoutURI)
+	builder.WriteString(", ")
+	builder.WriteString("refresh_token_lifetime=")
+	builder.WriteString(_m.RefreshTokenLifetime)
+	builder.WriteString(", ")
+	builder.WriteString("client_credentials_claims=")
+	builder.WriteString(fmt.Sprintf("%v", _m.ClientCredentialsClaims))
 	builder.WriteByte(')')
 	return builder.String()
 }
 
 // OAuth2Clients is a parsable slice of OAuth2Client.
 type OAuth2Clients []*OAuth2Client
-
-func (o OAuth2Clients) config(cfg config) {
-	for _i := range o {
-		o[_i].config = cfg
-	}
-}
diff --git a/storage/ent/db/oauth2client/oauth2client.go b/storage/ent/db/oauth2client/oauth2client.go
index 55b00c166b..9f668cb8e7 100644
--- a/storage/ent/db/oauth2client/oauth2client.go
+++ b/storage/ent/db/oauth2client/oauth2client.go
@@ -2,6 +2,10 @@
 
 package oauth2client
 
+import (
+	"entgo.io/ent/dialect/sql"
+)
+
 const (
 	// Label holds the string label denoting the oauth2client type in the database.
 	Label = "oauth2client"
@@ -19,6 +23,20 @@ const (
 	FieldName = "name"
 	// FieldLogoURL holds the string denoting the logo_url field in the database.
 	FieldLogoURL = "logo_url"
+	// FieldAllowedConnectors holds the string denoting the allowed_connectors field in the database.
+	FieldAllowedConnectors = "allowed_connectors"
+	// FieldMfaChain holds the string denoting the mfa_chain field in the database.
+	FieldMfaChain = "mfa_chain"
+	// FieldPostLogoutRedirectUris holds the string denoting the post_logout_redirect_uris field in the database.
+	FieldPostLogoutRedirectUris = "post_logout_redirect_uris"
+	// FieldSSOSharedWith holds the string denoting the sso_shared_with field in the database.
+	FieldSSOSharedWith = "sso_shared_with"
+	// FieldBackchannelLogoutURI holds the string denoting the backchannel_logout_uri field in the database.
+	FieldBackchannelLogoutURI = "backchannel_logout_uri"
+	// FieldRefreshTokenLifetime holds the string denoting the refresh_token_lifetime field in the database.
+	FieldRefreshTokenLifetime = "refresh_token_lifetime"
+	// FieldClientCredentialsClaims holds the string denoting the client_credentials_claims field in the database.
+	FieldClientCredentialsClaims = "client_credentials_claims"
 	// Table holds the table name of the oauth2client in the database.
 	Table = "oauth2clients"
 )
@@ -32,6 +50,13 @@ var Columns = []string{
 	FieldPublic,
 	FieldName,
 	FieldLogoURL,
+	FieldAllowedConnectors,
+	FieldMfaChain,
+	FieldPostLogoutRedirectUris,
+	FieldSSOSharedWith,
+	FieldBackchannelLogoutURI,
+	FieldRefreshTokenLifetime,
+	FieldClientCredentialsClaims,
 }
 
 // ValidColumn reports if the column name is valid (part of the table columns).
@@ -51,6 +76,48 @@ var (
 	NameValidator func(string) error
 	// LogoURLValidator is a validator for the "logo_url" field. It is called by the builders before save.
 	LogoURLValidator func(string) error
+	// DefaultBackchannelLogoutURI holds the default value on creation for the "backchannel_logout_uri" field.
+	DefaultBackchannelLogoutURI string
+	// DefaultRefreshTokenLifetime holds the default value on creation for the "refresh_token_lifetime" field.
+	DefaultRefreshTokenLifetime string
 	// IDValidator is a validator for the "id" field. It is called by the builders before save.
 	IDValidator func(string) error
 )
+
+// OrderOption defines the ordering options for the OAuth2Client queries.
+type OrderOption func(*sql.Selector)
+
+// ByID orders the results by the id field.
+func ByID(opts ...sql.OrderTermOption) OrderOption {
+	return sql.OrderByField(FieldID, opts...).ToFunc()
+}
+
+// BySecret orders the results by the secret field.
+func BySecret(opts ...sql.OrderTermOption) OrderOption {
+	return sql.OrderByField(FieldSecret, opts...).ToFunc()
+}
+
+// ByPublic orders the results by the public field.
+func ByPublic(opts ...sql.OrderTermOption) OrderOption {
+	return sql.OrderByField(FieldPublic, opts...).ToFunc()
+}
+
+// ByName orders the results by the name field.
+func ByName(opts ...sql.OrderTermOption) OrderOption {
+	return sql.OrderByField(FieldName, opts...).ToFunc()
+}
+
+// ByLogoURL orders the results by the logo_url field.
+func ByLogoURL(opts ...sql.OrderTermOption) OrderOption {
+	return sql.OrderByField(FieldLogoURL, opts...).ToFunc()
+}
+
+// ByBackchannelLogoutURI orders the results by the backchannel_logout_uri field.
+func ByBackchannelLogoutURI(opts ...sql.OrderTermOption) OrderOption {
+	return sql.OrderByField(FieldBackchannelLogoutURI, opts...).ToFunc()
+}
+
+// ByRefreshTokenLifetime orders the results by the refresh_token_lifetime field.
+func ByRefreshTokenLifetime(opts ...sql.OrderTermOption) OrderOption {
+	return sql.OrderByField(FieldRefreshTokenLifetime, opts...).ToFunc()
+}
diff --git a/storage/ent/db/oauth2client/where.go b/storage/ent/db/oauth2client/where.go
index d74a6ab78e..4679567982 100644
--- a/storage/ent/db/oauth2client/where.go
+++ b/storage/ent/db/oauth2client/where.go
@@ -9,470 +9,525 @@ import (
 
 // ID filters vertices based on their ID field.
 func ID(id string) predicate.OAuth2Client {
-	return predicate.OAuth2Client(func(s *sql.Selector) {
-		s.Where(sql.EQ(s.C(FieldID), id))
-	})
+	return predicate.OAuth2Client(sql.FieldEQ(FieldID, id))
 }
 
 // IDEQ applies the EQ predicate on the ID field.
 func IDEQ(id string) predicate.OAuth2Client {
-	return predicate.OAuth2Client(func(s *sql.Selector) {
-		s.Where(sql.EQ(s.C(FieldID), id))
-	})
+	return predicate.OAuth2Client(sql.FieldEQ(FieldID, id))
 }
 
 // IDNEQ applies the NEQ predicate on the ID field.
 func IDNEQ(id string) predicate.OAuth2Client {
-	return predicate.OAuth2Client(func(s *sql.Selector) {
-		s.Where(sql.NEQ(s.C(FieldID), id))
-	})
+	return predicate.OAuth2Client(sql.FieldNEQ(FieldID, id))
 }
 
 // IDIn applies the In predicate on the ID field.
 func IDIn(ids ...string) predicate.OAuth2Client {
-	return predicate.OAuth2Client(func(s *sql.Selector) {
-		v := make([]interface{}, len(ids))
-		for i := range v {
-			v[i] = ids[i]
-		}
-		s.Where(sql.In(s.C(FieldID), v...))
-	})
+	return predicate.OAuth2Client(sql.FieldIn(FieldID, ids...))
 }
 
 // IDNotIn applies the NotIn predicate on the ID field.
 func IDNotIn(ids ...string) predicate.OAuth2Client {
-	return predicate.OAuth2Client(func(s *sql.Selector) {
-		v := make([]interface{}, len(ids))
-		for i := range v {
-			v[i] = ids[i]
-		}
-		s.Where(sql.NotIn(s.C(FieldID), v...))
-	})
+	return predicate.OAuth2Client(sql.FieldNotIn(FieldID, ids...))
 }
 
 // IDGT applies the GT predicate on the ID field.
 func IDGT(id string) predicate.OAuth2Client {
-	return predicate.OAuth2Client(func(s *sql.Selector) {
-		s.Where(sql.GT(s.C(FieldID), id))
-	})
+	return predicate.OAuth2Client(sql.FieldGT(FieldID, id))
 }
 
 // IDGTE applies the GTE predicate on the ID field.
 func IDGTE(id string) predicate.OAuth2Client {
-	return predicate.OAuth2Client(func(s *sql.Selector) {
-		s.Where(sql.GTE(s.C(FieldID), id))
-	})
+	return predicate.OAuth2Client(sql.FieldGTE(FieldID, id))
 }
 
 // IDLT applies the LT predicate on the ID field.
 func IDLT(id string) predicate.OAuth2Client {
-	return predicate.OAuth2Client(func(s *sql.Selector) {
-		s.Where(sql.LT(s.C(FieldID), id))
-	})
+	return predicate.OAuth2Client(sql.FieldLT(FieldID, id))
 }
 
 // IDLTE applies the LTE predicate on the ID field.
 func IDLTE(id string) predicate.OAuth2Client {
-	return predicate.OAuth2Client(func(s *sql.Selector) {
-		s.Where(sql.LTE(s.C(FieldID), id))
-	})
+	return predicate.OAuth2Client(sql.FieldLTE(FieldID, id))
+}
+
+// IDEqualFold applies the EqualFold predicate on the ID field.
+func IDEqualFold(id string) predicate.OAuth2Client {
+	return predicate.OAuth2Client(sql.FieldEqualFold(FieldID, id))
+}
+
+// IDContainsFold applies the ContainsFold predicate on the ID field.
+func IDContainsFold(id string) predicate.OAuth2Client {
+	return predicate.OAuth2Client(sql.FieldContainsFold(FieldID, id))
 }
 
 // Secret applies equality check predicate on the "secret" field. It's identical to SecretEQ.
 func Secret(v string) predicate.OAuth2Client {
-	return predicate.OAuth2Client(func(s *sql.Selector) {
-		s.Where(sql.EQ(s.C(FieldSecret), v))
-	})
+	return predicate.OAuth2Client(sql.FieldEQ(FieldSecret, v))
 }
 
 // Public applies equality check predicate on the "public" field. It's identical to PublicEQ.
 func Public(v bool) predicate.OAuth2Client {
-	return predicate.OAuth2Client(func(s *sql.Selector) {
-		s.Where(sql.EQ(s.C(FieldPublic), v))
-	})
+	return predicate.OAuth2Client(sql.FieldEQ(FieldPublic, v))
 }
 
 // Name applies equality check predicate on the "name" field. It's identical to NameEQ.
 func Name(v string) predicate.OAuth2Client {
-	return predicate.OAuth2Client(func(s *sql.Selector) {
-		s.Where(sql.EQ(s.C(FieldName), v))
-	})
+	return predicate.OAuth2Client(sql.FieldEQ(FieldName, v))
 }
 
 // LogoURL applies equality check predicate on the "logo_url" field. It's identical to LogoURLEQ.
 func LogoURL(v string) predicate.OAuth2Client {
-	return predicate.OAuth2Client(func(s *sql.Selector) {
-		s.Where(sql.EQ(s.C(FieldLogoURL), v))
-	})
+	return predicate.OAuth2Client(sql.FieldEQ(FieldLogoURL, v))
+}
+
+// BackchannelLogoutURI applies equality check predicate on the "backchannel_logout_uri" field. It's identical to BackchannelLogoutURIEQ.
+func BackchannelLogoutURI(v string) predicate.OAuth2Client {
+	return predicate.OAuth2Client(sql.FieldEQ(FieldBackchannelLogoutURI, v))
+}
+
+// RefreshTokenLifetime applies equality check predicate on the "refresh_token_lifetime" field. It's identical to RefreshTokenLifetimeEQ.
+func RefreshTokenLifetime(v string) predicate.OAuth2Client {
+	return predicate.OAuth2Client(sql.FieldEQ(FieldRefreshTokenLifetime, v))
 }
 
 // SecretEQ applies the EQ predicate on the "secret" field.
 func SecretEQ(v string) predicate.OAuth2Client {
-	return predicate.OAuth2Client(func(s *sql.Selector) {
-		s.Where(sql.EQ(s.C(FieldSecret), v))
-	})
+	return predicate.OAuth2Client(sql.FieldEQ(FieldSecret, v))
 }
 
 // SecretNEQ applies the NEQ predicate on the "secret" field.
 func SecretNEQ(v string) predicate.OAuth2Client {
-	return predicate.OAuth2Client(func(s *sql.Selector) {
-		s.Where(sql.NEQ(s.C(FieldSecret), v))
-	})
+	return predicate.OAuth2Client(sql.FieldNEQ(FieldSecret, v))
 }
 
 // SecretIn applies the In predicate on the "secret" field.
 func SecretIn(vs ...string) predicate.OAuth2Client {
-	v := make([]interface{}, len(vs))
-	for i := range v {
-		v[i] = vs[i]
-	}
-	return predicate.OAuth2Client(func(s *sql.Selector) {
-		s.Where(sql.In(s.C(FieldSecret), v...))
-	})
+	return predicate.OAuth2Client(sql.FieldIn(FieldSecret, vs...))
 }
 
 // SecretNotIn applies the NotIn predicate on the "secret" field.
 func SecretNotIn(vs ...string) predicate.OAuth2Client {
-	v := make([]interface{}, len(vs))
-	for i := range v {
-		v[i] = vs[i]
-	}
-	return predicate.OAuth2Client(func(s *sql.Selector) {
-		s.Where(sql.NotIn(s.C(FieldSecret), v...))
-	})
+	return predicate.OAuth2Client(sql.FieldNotIn(FieldSecret, vs...))
 }
 
 // SecretGT applies the GT predicate on the "secret" field.
 func SecretGT(v string) predicate.OAuth2Client {
-	return predicate.OAuth2Client(func(s *sql.Selector) {
-		s.Where(sql.GT(s.C(FieldSecret), v))
-	})
+	return predicate.OAuth2Client(sql.FieldGT(FieldSecret, v))
 }
 
 // SecretGTE applies the GTE predicate on the "secret" field.
 func SecretGTE(v string) predicate.OAuth2Client {
-	return predicate.OAuth2Client(func(s *sql.Selector) {
-		s.Where(sql.GTE(s.C(FieldSecret), v))
-	})
+	return predicate.OAuth2Client(sql.FieldGTE(FieldSecret, v))
 }
 
 // SecretLT applies the LT predicate on the "secret" field.
 func SecretLT(v string) predicate.OAuth2Client {
-	return predicate.OAuth2Client(func(s *sql.Selector) {
-		s.Where(sql.LT(s.C(FieldSecret), v))
-	})
+	return predicate.OAuth2Client(sql.FieldLT(FieldSecret, v))
 }
 
 // SecretLTE applies the LTE predicate on the "secret" field.
 func SecretLTE(v string) predicate.OAuth2Client {
-	return predicate.OAuth2Client(func(s *sql.Selector) {
-		s.Where(sql.LTE(s.C(FieldSecret), v))
-	})
+	return predicate.OAuth2Client(sql.FieldLTE(FieldSecret, v))
 }
 
 // SecretContains applies the Contains predicate on the "secret" field.
 func SecretContains(v string) predicate.OAuth2Client {
-	return predicate.OAuth2Client(func(s *sql.Selector) {
-		s.Where(sql.Contains(s.C(FieldSecret), v))
-	})
+	return predicate.OAuth2Client(sql.FieldContains(FieldSecret, v))
 }
 
 // SecretHasPrefix applies the HasPrefix predicate on the "secret" field.
 func SecretHasPrefix(v string) predicate.OAuth2Client {
-	return predicate.OAuth2Client(func(s *sql.Selector) {
-		s.Where(sql.HasPrefix(s.C(FieldSecret), v))
-	})
+	return predicate.OAuth2Client(sql.FieldHasPrefix(FieldSecret, v))
 }
 
 // SecretHasSuffix applies the HasSuffix predicate on the "secret" field.
 func SecretHasSuffix(v string) predicate.OAuth2Client {
-	return predicate.OAuth2Client(func(s *sql.Selector) {
-		s.Where(sql.HasSuffix(s.C(FieldSecret), v))
-	})
+	return predicate.OAuth2Client(sql.FieldHasSuffix(FieldSecret, v))
 }
 
 // SecretEqualFold applies the EqualFold predicate on the "secret" field.
 func SecretEqualFold(v string) predicate.OAuth2Client {
-	return predicate.OAuth2Client(func(s *sql.Selector) {
-		s.Where(sql.EqualFold(s.C(FieldSecret), v))
-	})
+	return predicate.OAuth2Client(sql.FieldEqualFold(FieldSecret, v))
 }
 
 // SecretContainsFold applies the ContainsFold predicate on the "secret" field.
 func SecretContainsFold(v string) predicate.OAuth2Client {
-	return predicate.OAuth2Client(func(s *sql.Selector) {
-		s.Where(sql.ContainsFold(s.C(FieldSecret), v))
-	})
+	return predicate.OAuth2Client(sql.FieldContainsFold(FieldSecret, v))
 }
 
 // RedirectUrisIsNil applies the IsNil predicate on the "redirect_uris" field.
 func RedirectUrisIsNil() predicate.OAuth2Client {
-	return predicate.OAuth2Client(func(s *sql.Selector) {
-		s.Where(sql.IsNull(s.C(FieldRedirectUris)))
-	})
+	return predicate.OAuth2Client(sql.FieldIsNull(FieldRedirectUris))
 }
 
 // RedirectUrisNotNil applies the NotNil predicate on the "redirect_uris" field.
 func RedirectUrisNotNil() predicate.OAuth2Client {
-	return predicate.OAuth2Client(func(s *sql.Selector) {
-		s.Where(sql.NotNull(s.C(FieldRedirectUris)))
-	})
+	return predicate.OAuth2Client(sql.FieldNotNull(FieldRedirectUris))
 }
 
 // TrustedPeersIsNil applies the IsNil predicate on the "trusted_peers" field.
 func TrustedPeersIsNil() predicate.OAuth2Client {
-	return predicate.OAuth2Client(func(s *sql.Selector) {
-		s.Where(sql.IsNull(s.C(FieldTrustedPeers)))
-	})
+	return predicate.OAuth2Client(sql.FieldIsNull(FieldTrustedPeers))
 }
 
 // TrustedPeersNotNil applies the NotNil predicate on the "trusted_peers" field.
 func TrustedPeersNotNil() predicate.OAuth2Client {
-	return predicate.OAuth2Client(func(s *sql.Selector) {
-		s.Where(sql.NotNull(s.C(FieldTrustedPeers)))
-	})
+	return predicate.OAuth2Client(sql.FieldNotNull(FieldTrustedPeers))
 }
 
 // PublicEQ applies the EQ predicate on the "public" field.
 func PublicEQ(v bool) predicate.OAuth2Client {
-	return predicate.OAuth2Client(func(s *sql.Selector) {
-		s.Where(sql.EQ(s.C(FieldPublic), v))
-	})
+	return predicate.OAuth2Client(sql.FieldEQ(FieldPublic, v))
 }
 
 // PublicNEQ applies the NEQ predicate on the "public" field.
 func PublicNEQ(v bool) predicate.OAuth2Client {
-	return predicate.OAuth2Client(func(s *sql.Selector) {
-		s.Where(sql.NEQ(s.C(FieldPublic), v))
-	})
+	return predicate.OAuth2Client(sql.FieldNEQ(FieldPublic, v))
 }
 
 // NameEQ applies the EQ predicate on the "name" field.
 func NameEQ(v string) predicate.OAuth2Client {
-	return predicate.OAuth2Client(func(s *sql.Selector) {
-		s.Where(sql.EQ(s.C(FieldName), v))
-	})
+	return predicate.OAuth2Client(sql.FieldEQ(FieldName, v))
 }
 
 // NameNEQ applies the NEQ predicate on the "name" field.
 func NameNEQ(v string) predicate.OAuth2Client {
-	return predicate.OAuth2Client(func(s *sql.Selector) {
-		s.Where(sql.NEQ(s.C(FieldName), v))
-	})
+	return predicate.OAuth2Client(sql.FieldNEQ(FieldName, v))
 }
 
 // NameIn applies the In predicate on the "name" field.
 func NameIn(vs ...string) predicate.OAuth2Client {
-	v := make([]interface{}, len(vs))
-	for i := range v {
-		v[i] = vs[i]
-	}
-	return predicate.OAuth2Client(func(s *sql.Selector) {
-		s.Where(sql.In(s.C(FieldName), v...))
-	})
+	return predicate.OAuth2Client(sql.FieldIn(FieldName, vs...))
 }
 
 // NameNotIn applies the NotIn predicate on the "name" field.
 func NameNotIn(vs ...string) predicate.OAuth2Client {
-	v := make([]interface{}, len(vs))
-	for i := range v {
-		v[i] = vs[i]
-	}
-	return predicate.OAuth2Client(func(s *sql.Selector) {
-		s.Where(sql.NotIn(s.C(FieldName), v...))
-	})
+	return predicate.OAuth2Client(sql.FieldNotIn(FieldName, vs...))
 }
 
 // NameGT applies the GT predicate on the "name" field.
 func NameGT(v string) predicate.OAuth2Client {
-	return predicate.OAuth2Client(func(s *sql.Selector) {
-		s.Where(sql.GT(s.C(FieldName), v))
-	})
+	return predicate.OAuth2Client(sql.FieldGT(FieldName, v))
 }
 
 // NameGTE applies the GTE predicate on the "name" field.
 func NameGTE(v string) predicate.OAuth2Client {
-	return predicate.OAuth2Client(func(s *sql.Selector) {
-		s.Where(sql.GTE(s.C(FieldName), v))
-	})
+	return predicate.OAuth2Client(sql.FieldGTE(FieldName, v))
 }
 
 // NameLT applies the LT predicate on the "name" field.
 func NameLT(v string) predicate.OAuth2Client {
-	return predicate.OAuth2Client(func(s *sql.Selector) {
-		s.Where(sql.LT(s.C(FieldName), v))
-	})
+	return predicate.OAuth2Client(sql.FieldLT(FieldName, v))
 }
 
 // NameLTE applies the LTE predicate on the "name" field.
 func NameLTE(v string) predicate.OAuth2Client {
-	return predicate.OAuth2Client(func(s *sql.Selector) {
-		s.Where(sql.LTE(s.C(FieldName), v))
-	})
+	return predicate.OAuth2Client(sql.FieldLTE(FieldName, v))
 }
 
 // NameContains applies the Contains predicate on the "name" field.
 func NameContains(v string) predicate.OAuth2Client {
-	return predicate.OAuth2Client(func(s *sql.Selector) {
-		s.Where(sql.Contains(s.C(FieldName), v))
-	})
+	return predicate.OAuth2Client(sql.FieldContains(FieldName, v))
 }
 
 // NameHasPrefix applies the HasPrefix predicate on the "name" field.
 func NameHasPrefix(v string) predicate.OAuth2Client {
-	return predicate.OAuth2Client(func(s *sql.Selector) {
-		s.Where(sql.HasPrefix(s.C(FieldName), v))
-	})
+	return predicate.OAuth2Client(sql.FieldHasPrefix(FieldName, v))
 }
 
 // NameHasSuffix applies the HasSuffix predicate on the "name" field.
 func NameHasSuffix(v string) predicate.OAuth2Client {
-	return predicate.OAuth2Client(func(s *sql.Selector) {
-		s.Where(sql.HasSuffix(s.C(FieldName), v))
-	})
+	return predicate.OAuth2Client(sql.FieldHasSuffix(FieldName, v))
 }
 
 // NameEqualFold applies the EqualFold predicate on the "name" field.
 func NameEqualFold(v string) predicate.OAuth2Client {
-	return predicate.OAuth2Client(func(s *sql.Selector) {
-		s.Where(sql.EqualFold(s.C(FieldName), v))
-	})
+	return predicate.OAuth2Client(sql.FieldEqualFold(FieldName, v))
 }
 
 // NameContainsFold applies the ContainsFold predicate on the "name" field.
 func NameContainsFold(v string) predicate.OAuth2Client {
-	return predicate.OAuth2Client(func(s *sql.Selector) {
-		s.Where(sql.ContainsFold(s.C(FieldName), v))
-	})
+	return predicate.OAuth2Client(sql.FieldContainsFold(FieldName, v))
 }
 
 // LogoURLEQ applies the EQ predicate on the "logo_url" field.
 func LogoURLEQ(v string) predicate.OAuth2Client {
-	return predicate.OAuth2Client(func(s *sql.Selector) {
-		s.Where(sql.EQ(s.C(FieldLogoURL), v))
-	})
+	return predicate.OAuth2Client(sql.FieldEQ(FieldLogoURL, v))
 }
 
 // LogoURLNEQ applies the NEQ predicate on the "logo_url" field.
 func LogoURLNEQ(v string) predicate.OAuth2Client {
-	return predicate.OAuth2Client(func(s *sql.Selector) {
-		s.Where(sql.NEQ(s.C(FieldLogoURL), v))
-	})
+	return predicate.OAuth2Client(sql.FieldNEQ(FieldLogoURL, v))
 }
 
 // LogoURLIn applies the In predicate on the "logo_url" field.
 func LogoURLIn(vs ...string) predicate.OAuth2Client {
-	v := make([]interface{}, len(vs))
-	for i := range v {
-		v[i] = vs[i]
-	}
-	return predicate.OAuth2Client(func(s *sql.Selector) {
-		s.Where(sql.In(s.C(FieldLogoURL), v...))
-	})
+	return predicate.OAuth2Client(sql.FieldIn(FieldLogoURL, vs...))
 }
 
 // LogoURLNotIn applies the NotIn predicate on the "logo_url" field.
 func LogoURLNotIn(vs ...string) predicate.OAuth2Client {
-	v := make([]interface{}, len(vs))
-	for i := range v {
-		v[i] = vs[i]
-	}
-	return predicate.OAuth2Client(func(s *sql.Selector) {
-		s.Where(sql.NotIn(s.C(FieldLogoURL), v...))
-	})
+	return predicate.OAuth2Client(sql.FieldNotIn(FieldLogoURL, vs...))
 }
 
 // LogoURLGT applies the GT predicate on the "logo_url" field.
 func LogoURLGT(v string) predicate.OAuth2Client {
-	return predicate.OAuth2Client(func(s *sql.Selector) {
-		s.Where(sql.GT(s.C(FieldLogoURL), v))
-	})
+	return predicate.OAuth2Client(sql.FieldGT(FieldLogoURL, v))
 }
 
 // LogoURLGTE applies the GTE predicate on the "logo_url" field.
 func LogoURLGTE(v string) predicate.OAuth2Client {
-	return predicate.OAuth2Client(func(s *sql.Selector) {
-		s.Where(sql.GTE(s.C(FieldLogoURL), v))
-	})
+	return predicate.OAuth2Client(sql.FieldGTE(FieldLogoURL, v))
 }
 
 // LogoURLLT applies the LT predicate on the "logo_url" field.
 func LogoURLLT(v string) predicate.OAuth2Client {
-	return predicate.OAuth2Client(func(s *sql.Selector) {
-		s.Where(sql.LT(s.C(FieldLogoURL), v))
-	})
+	return predicate.OAuth2Client(sql.FieldLT(FieldLogoURL, v))
 }
 
 // LogoURLLTE applies the LTE predicate on the "logo_url" field.
 func LogoURLLTE(v string) predicate.OAuth2Client {
-	return predicate.OAuth2Client(func(s *sql.Selector) {
-		s.Where(sql.LTE(s.C(FieldLogoURL), v))
-	})
+	return predicate.OAuth2Client(sql.FieldLTE(FieldLogoURL, v))
 }
 
 // LogoURLContains applies the Contains predicate on the "logo_url" field.
 func LogoURLContains(v string) predicate.OAuth2Client {
-	return predicate.OAuth2Client(func(s *sql.Selector) {
-		s.Where(sql.Contains(s.C(FieldLogoURL), v))
-	})
+	return predicate.OAuth2Client(sql.FieldContains(FieldLogoURL, v))
 }
 
 // LogoURLHasPrefix applies the HasPrefix predicate on the "logo_url" field.
 func LogoURLHasPrefix(v string) predicate.OAuth2Client {
-	return predicate.OAuth2Client(func(s *sql.Selector) {
-		s.Where(sql.HasPrefix(s.C(FieldLogoURL), v))
-	})
+	return predicate.OAuth2Client(sql.FieldHasPrefix(FieldLogoURL, v))
 }
 
 // LogoURLHasSuffix applies the HasSuffix predicate on the "logo_url" field.
 func LogoURLHasSuffix(v string) predicate.OAuth2Client {
-	return predicate.OAuth2Client(func(s *sql.Selector) {
-		s.Where(sql.HasSuffix(s.C(FieldLogoURL), v))
-	})
+	return predicate.OAuth2Client(sql.FieldHasSuffix(FieldLogoURL, v))
 }
 
 // LogoURLEqualFold applies the EqualFold predicate on the "logo_url" field.
 func LogoURLEqualFold(v string) predicate.OAuth2Client {
-	return predicate.OAuth2Client(func(s *sql.Selector) {
-		s.Where(sql.EqualFold(s.C(FieldLogoURL), v))
-	})
+	return predicate.OAuth2Client(sql.FieldEqualFold(FieldLogoURL, v))
 }
 
 // LogoURLContainsFold applies the ContainsFold predicate on the "logo_url" field.
 func LogoURLContainsFold(v string) predicate.OAuth2Client {
-	return predicate.OAuth2Client(func(s *sql.Selector) {
-		s.Where(sql.ContainsFold(s.C(FieldLogoURL), v))
-	})
+	return predicate.OAuth2Client(sql.FieldContainsFold(FieldLogoURL, v))
+}
+
+// AllowedConnectorsIsNil applies the IsNil predicate on the "allowed_connectors" field.
+func AllowedConnectorsIsNil() predicate.OAuth2Client {
+	return predicate.OAuth2Client(sql.FieldIsNull(FieldAllowedConnectors))
+}
+
+// AllowedConnectorsNotNil applies the NotNil predicate on the "allowed_connectors" field.
+func AllowedConnectorsNotNil() predicate.OAuth2Client {
+	return predicate.OAuth2Client(sql.FieldNotNull(FieldAllowedConnectors))
+}
+
+// MfaChainIsNil applies the IsNil predicate on the "mfa_chain" field.
+func MfaChainIsNil() predicate.OAuth2Client {
+	return predicate.OAuth2Client(sql.FieldIsNull(FieldMfaChain))
+}
+
+// MfaChainNotNil applies the NotNil predicate on the "mfa_chain" field.
+func MfaChainNotNil() predicate.OAuth2Client {
+	return predicate.OAuth2Client(sql.FieldNotNull(FieldMfaChain))
+}
+
+// PostLogoutRedirectUrisIsNil applies the IsNil predicate on the "post_logout_redirect_uris" field.
+func PostLogoutRedirectUrisIsNil() predicate.OAuth2Client {
+	return predicate.OAuth2Client(sql.FieldIsNull(FieldPostLogoutRedirectUris))
+}
+
+// PostLogoutRedirectUrisNotNil applies the NotNil predicate on the "post_logout_redirect_uris" field.
+func PostLogoutRedirectUrisNotNil() predicate.OAuth2Client {
+	return predicate.OAuth2Client(sql.FieldNotNull(FieldPostLogoutRedirectUris))
+}
+
+// SSOSharedWithIsNil applies the IsNil predicate on the "sso_shared_with" field.
+func SSOSharedWithIsNil() predicate.OAuth2Client {
+	return predicate.OAuth2Client(sql.FieldIsNull(FieldSSOSharedWith))
+}
+
+// SSOSharedWithNotNil applies the NotNil predicate on the "sso_shared_with" field.
+func SSOSharedWithNotNil() predicate.OAuth2Client {
+	return predicate.OAuth2Client(sql.FieldNotNull(FieldSSOSharedWith))
+}
+
+// BackchannelLogoutURIEQ applies the EQ predicate on the "backchannel_logout_uri" field.
+func BackchannelLogoutURIEQ(v string) predicate.OAuth2Client {
+	return predicate.OAuth2Client(sql.FieldEQ(FieldBackchannelLogoutURI, v))
+}
+
+// BackchannelLogoutURINEQ applies the NEQ predicate on the "backchannel_logout_uri" field.
+func BackchannelLogoutURINEQ(v string) predicate.OAuth2Client {
+	return predicate.OAuth2Client(sql.FieldNEQ(FieldBackchannelLogoutURI, v))
+}
+
+// BackchannelLogoutURIIn applies the In predicate on the "backchannel_logout_uri" field.
+func BackchannelLogoutURIIn(vs ...string) predicate.OAuth2Client {
+	return predicate.OAuth2Client(sql.FieldIn(FieldBackchannelLogoutURI, vs...))
+}
+
+// BackchannelLogoutURINotIn applies the NotIn predicate on the "backchannel_logout_uri" field.
+func BackchannelLogoutURINotIn(vs ...string) predicate.OAuth2Client {
+	return predicate.OAuth2Client(sql.FieldNotIn(FieldBackchannelLogoutURI, vs...))
+}
+
+// BackchannelLogoutURIGT applies the GT predicate on the "backchannel_logout_uri" field.
+func BackchannelLogoutURIGT(v string) predicate.OAuth2Client {
+	return predicate.OAuth2Client(sql.FieldGT(FieldBackchannelLogoutURI, v))
+}
+
+// BackchannelLogoutURIGTE applies the GTE predicate on the "backchannel_logout_uri" field.
+func BackchannelLogoutURIGTE(v string) predicate.OAuth2Client {
+	return predicate.OAuth2Client(sql.FieldGTE(FieldBackchannelLogoutURI, v))
+}
+
+// BackchannelLogoutURILT applies the LT predicate on the "backchannel_logout_uri" field.
+func BackchannelLogoutURILT(v string) predicate.OAuth2Client {
+	return predicate.OAuth2Client(sql.FieldLT(FieldBackchannelLogoutURI, v))
+}
+
+// BackchannelLogoutURILTE applies the LTE predicate on the "backchannel_logout_uri" field.
+func BackchannelLogoutURILTE(v string) predicate.OAuth2Client {
+	return predicate.OAuth2Client(sql.FieldLTE(FieldBackchannelLogoutURI, v))
+}
+
+// BackchannelLogoutURIContains applies the Contains predicate on the "backchannel_logout_uri" field.
+func BackchannelLogoutURIContains(v string) predicate.OAuth2Client {
+	return predicate.OAuth2Client(sql.FieldContains(FieldBackchannelLogoutURI, v))
+}
+
+// BackchannelLogoutURIHasPrefix applies the HasPrefix predicate on the "backchannel_logout_uri" field.
+func BackchannelLogoutURIHasPrefix(v string) predicate.OAuth2Client {
+	return predicate.OAuth2Client(sql.FieldHasPrefix(FieldBackchannelLogoutURI, v))
+}
+
+// BackchannelLogoutURIHasSuffix applies the HasSuffix predicate on the "backchannel_logout_uri" field.
+func BackchannelLogoutURIHasSuffix(v string) predicate.OAuth2Client {
+	return predicate.OAuth2Client(sql.FieldHasSuffix(FieldBackchannelLogoutURI, v))
+}
+
+// BackchannelLogoutURIIsNil applies the IsNil predicate on the "backchannel_logout_uri" field.
+func BackchannelLogoutURIIsNil() predicate.OAuth2Client {
+	return predicate.OAuth2Client(sql.FieldIsNull(FieldBackchannelLogoutURI))
+}
+
+// BackchannelLogoutURINotNil applies the NotNil predicate on the "backchannel_logout_uri" field.
+func BackchannelLogoutURINotNil() predicate.OAuth2Client {
+	return predicate.OAuth2Client(sql.FieldNotNull(FieldBackchannelLogoutURI))
+}
+
+// BackchannelLogoutURIEqualFold applies the EqualFold predicate on the "backchannel_logout_uri" field.
+func BackchannelLogoutURIEqualFold(v string) predicate.OAuth2Client {
+	return predicate.OAuth2Client(sql.FieldEqualFold(FieldBackchannelLogoutURI, v))
+}
+
+// BackchannelLogoutURIContainsFold applies the ContainsFold predicate on the "backchannel_logout_uri" field.
+func BackchannelLogoutURIContainsFold(v string) predicate.OAuth2Client {
+	return predicate.OAuth2Client(sql.FieldContainsFold(FieldBackchannelLogoutURI, v))
+}
+
+// RefreshTokenLifetimeEQ applies the EQ predicate on the "refresh_token_lifetime" field.
+func RefreshTokenLifetimeEQ(v string) predicate.OAuth2Client {
+	return predicate.OAuth2Client(sql.FieldEQ(FieldRefreshTokenLifetime, v))
+}
+
+// RefreshTokenLifetimeNEQ applies the NEQ predicate on the "refresh_token_lifetime" field.
+func RefreshTokenLifetimeNEQ(v string) predicate.OAuth2Client {
+	return predicate.OAuth2Client(sql.FieldNEQ(FieldRefreshTokenLifetime, v))
+}
+
+// RefreshTokenLifetimeIn applies the In predicate on the "refresh_token_lifetime" field.
+func RefreshTokenLifetimeIn(vs ...string) predicate.OAuth2Client {
+	return predicate.OAuth2Client(sql.FieldIn(FieldRefreshTokenLifetime, vs...))
+}
+
+// RefreshTokenLifetimeNotIn applies the NotIn predicate on the "refresh_token_lifetime" field.
+func RefreshTokenLifetimeNotIn(vs ...string) predicate.OAuth2Client {
+	return predicate.OAuth2Client(sql.FieldNotIn(FieldRefreshTokenLifetime, vs...))
+}
+
+// RefreshTokenLifetimeGT applies the GT predicate on the "refresh_token_lifetime" field.
+func RefreshTokenLifetimeGT(v string) predicate.OAuth2Client {
+	return predicate.OAuth2Client(sql.FieldGT(FieldRefreshTokenLifetime, v))
+}
+
+// RefreshTokenLifetimeGTE applies the GTE predicate on the "refresh_token_lifetime" field.
+func RefreshTokenLifetimeGTE(v string) predicate.OAuth2Client {
+	return predicate.OAuth2Client(sql.FieldGTE(FieldRefreshTokenLifetime, v))
+}
+
+// RefreshTokenLifetimeLT applies the LT predicate on the "refresh_token_lifetime" field.
+func RefreshTokenLifetimeLT(v string) predicate.OAuth2Client {
+	return predicate.OAuth2Client(sql.FieldLT(FieldRefreshTokenLifetime, v))
+}
+
+// RefreshTokenLifetimeLTE applies the LTE predicate on the "refresh_token_lifetime" field.
+func RefreshTokenLifetimeLTE(v string) predicate.OAuth2Client {
+	return predicate.OAuth2Client(sql.FieldLTE(FieldRefreshTokenLifetime, v))
+}
+
+// RefreshTokenLifetimeContains applies the Contains predicate on the "refresh_token_lifetime" field.
+func RefreshTokenLifetimeContains(v string) predicate.OAuth2Client {
+	return predicate.OAuth2Client(sql.FieldContains(FieldRefreshTokenLifetime, v))
+}
+
+// RefreshTokenLifetimeHasPrefix applies the HasPrefix predicate on the "refresh_token_lifetime" field.
+func RefreshTokenLifetimeHasPrefix(v string) predicate.OAuth2Client {
+	return predicate.OAuth2Client(sql.FieldHasPrefix(FieldRefreshTokenLifetime, v))
+}
+
+// RefreshTokenLifetimeHasSuffix applies the HasSuffix predicate on the "refresh_token_lifetime" field.
+func RefreshTokenLifetimeHasSuffix(v string) predicate.OAuth2Client {
+	return predicate.OAuth2Client(sql.FieldHasSuffix(FieldRefreshTokenLifetime, v))
+}
+
+// RefreshTokenLifetimeIsNil applies the IsNil predicate on the "refresh_token_lifetime" field.
+func RefreshTokenLifetimeIsNil() predicate.OAuth2Client {
+	return predicate.OAuth2Client(sql.FieldIsNull(FieldRefreshTokenLifetime))
+}
+
+// RefreshTokenLifetimeNotNil applies the NotNil predicate on the "refresh_token_lifetime" field.
+func RefreshTokenLifetimeNotNil() predicate.OAuth2Client {
+	return predicate.OAuth2Client(sql.FieldNotNull(FieldRefreshTokenLifetime))
+}
+
+// RefreshTokenLifetimeEqualFold applies the EqualFold predicate on the "refresh_token_lifetime" field.
+func RefreshTokenLifetimeEqualFold(v string) predicate.OAuth2Client {
+	return predicate.OAuth2Client(sql.FieldEqualFold(FieldRefreshTokenLifetime, v))
+}
+
+// RefreshTokenLifetimeContainsFold applies the ContainsFold predicate on the "refresh_token_lifetime" field.
+func RefreshTokenLifetimeContainsFold(v string) predicate.OAuth2Client {
+	return predicate.OAuth2Client(sql.FieldContainsFold(FieldRefreshTokenLifetime, v))
+}
+
+// ClientCredentialsClaimsIsNil applies the IsNil predicate on the "client_credentials_claims" field.
+func ClientCredentialsClaimsIsNil() predicate.OAuth2Client {
+	return predicate.OAuth2Client(sql.FieldIsNull(FieldClientCredentialsClaims))
+}
+
+// ClientCredentialsClaimsNotNil applies the NotNil predicate on the "client_credentials_claims" field.
+func ClientCredentialsClaimsNotNil() predicate.OAuth2Client {
+	return predicate.OAuth2Client(sql.FieldNotNull(FieldClientCredentialsClaims))
 }
 
 // And groups predicates with the AND operator between them.
 func And(predicates ...predicate.OAuth2Client) predicate.OAuth2Client {
-	return predicate.OAuth2Client(func(s *sql.Selector) {
-		s1 := s.Clone().SetP(nil)
-		for _, p := range predicates {
-			p(s1)
-		}
-		s.Where(s1.P())
-	})
+	return predicate.OAuth2Client(sql.AndPredicates(predicates...))
 }
 
 // Or groups predicates with the OR operator between them.
 func Or(predicates ...predicate.OAuth2Client) predicate.OAuth2Client {
-	return predicate.OAuth2Client(func(s *sql.Selector) {
-		s1 := s.Clone().SetP(nil)
-		for i, p := range predicates {
-			if i > 0 {
-				s1.Or()
-			}
-			p(s1)
-		}
-		s.Where(s1.P())
-	})
+	return predicate.OAuth2Client(sql.OrPredicates(predicates...))
 }
 
 // Not applies the not operator on the given predicate.
 func Not(p predicate.OAuth2Client) predicate.OAuth2Client {
-	return predicate.OAuth2Client(func(s *sql.Selector) {
-		p(s.Not())
-	})
+	return predicate.OAuth2Client(sql.NotPredicates(p))
 }
diff --git a/storage/ent/db/oauth2client_create.go b/storage/ent/db/oauth2client_create.go
index 02c41a8377..019abe1fa0 100644
--- a/storage/ent/db/oauth2client_create.go
+++ b/storage/ent/db/oauth2client_create.go
@@ -9,6 +9,7 @@ import (
 
 	"entgo.io/ent/dialect/sql/sqlgraph"
 	"entgo.io/ent/schema/field"
+	"github.com/dexidp/dex/storage"
 	"github.com/dexidp/dex/storage/ent/db/oauth2client"
 )
 
@@ -20,102 +21,119 @@ type OAuth2ClientCreate struct {
 }
 
 // SetSecret sets the "secret" field.
-func (oc *OAuth2ClientCreate) SetSecret(s string) *OAuth2ClientCreate {
-	oc.mutation.SetSecret(s)
-	return oc
+func (_c *OAuth2ClientCreate) SetSecret(v string) *OAuth2ClientCreate {
+	_c.mutation.SetSecret(v)
+	return _c
 }
 
 // SetRedirectUris sets the "redirect_uris" field.
-func (oc *OAuth2ClientCreate) SetRedirectUris(s []string) *OAuth2ClientCreate {
-	oc.mutation.SetRedirectUris(s)
-	return oc
+func (_c *OAuth2ClientCreate) SetRedirectUris(v []string) *OAuth2ClientCreate {
+	_c.mutation.SetRedirectUris(v)
+	return _c
 }
 
 // SetTrustedPeers sets the "trusted_peers" field.
-func (oc *OAuth2ClientCreate) SetTrustedPeers(s []string) *OAuth2ClientCreate {
-	oc.mutation.SetTrustedPeers(s)
-	return oc
+func (_c *OAuth2ClientCreate) SetTrustedPeers(v []string) *OAuth2ClientCreate {
+	_c.mutation.SetTrustedPeers(v)
+	return _c
 }
 
 // SetPublic sets the "public" field.
-func (oc *OAuth2ClientCreate) SetPublic(b bool) *OAuth2ClientCreate {
-	oc.mutation.SetPublic(b)
-	return oc
+func (_c *OAuth2ClientCreate) SetPublic(v bool) *OAuth2ClientCreate {
+	_c.mutation.SetPublic(v)
+	return _c
 }
 
 // SetName sets the "name" field.
-func (oc *OAuth2ClientCreate) SetName(s string) *OAuth2ClientCreate {
-	oc.mutation.SetName(s)
-	return oc
+func (_c *OAuth2ClientCreate) SetName(v string) *OAuth2ClientCreate {
+	_c.mutation.SetName(v)
+	return _c
 }
 
 // SetLogoURL sets the "logo_url" field.
-func (oc *OAuth2ClientCreate) SetLogoURL(s string) *OAuth2ClientCreate {
-	oc.mutation.SetLogoURL(s)
-	return oc
+func (_c *OAuth2ClientCreate) SetLogoURL(v string) *OAuth2ClientCreate {
+	_c.mutation.SetLogoURL(v)
+	return _c
+}
+
+// SetAllowedConnectors sets the "allowed_connectors" field.
+func (_c *OAuth2ClientCreate) SetAllowedConnectors(v []string) *OAuth2ClientCreate {
+	_c.mutation.SetAllowedConnectors(v)
+	return _c
+}
+
+// SetMfaChain sets the "mfa_chain" field.
+func (_c *OAuth2ClientCreate) SetMfaChain(v []string) *OAuth2ClientCreate {
+	_c.mutation.SetMfaChain(v)
+	return _c
+}
+
+// SetPostLogoutRedirectUris sets the "post_logout_redirect_uris" field.
+func (_c *OAuth2ClientCreate) SetPostLogoutRedirectUris(v []string) *OAuth2ClientCreate {
+	_c.mutation.SetPostLogoutRedirectUris(v)
+	return _c
+}
+
+// SetSSOSharedWith sets the "sso_shared_with" field.
+func (_c *OAuth2ClientCreate) SetSSOSharedWith(v []string) *OAuth2ClientCreate {
+	_c.mutation.SetSSOSharedWith(v)
+	return _c
+}
+
+// SetBackchannelLogoutURI sets the "backchannel_logout_uri" field.
+func (_c *OAuth2ClientCreate) SetBackchannelLogoutURI(v string) *OAuth2ClientCreate {
+	_c.mutation.SetBackchannelLogoutURI(v)
+	return _c
+}
+
+// SetNillableBackchannelLogoutURI sets the "backchannel_logout_uri" field if the given value is not nil.
+func (_c *OAuth2ClientCreate) SetNillableBackchannelLogoutURI(v *string) *OAuth2ClientCreate {
+	if v != nil {
+		_c.SetBackchannelLogoutURI(*v)
+	}
+	return _c
+}
+
+// SetRefreshTokenLifetime sets the "refresh_token_lifetime" field.
+func (_c *OAuth2ClientCreate) SetRefreshTokenLifetime(v string) *OAuth2ClientCreate {
+	_c.mutation.SetRefreshTokenLifetime(v)
+	return _c
+}
+
+// SetNillableRefreshTokenLifetime sets the "refresh_token_lifetime" field if the given value is not nil.
+func (_c *OAuth2ClientCreate) SetNillableRefreshTokenLifetime(v *string) *OAuth2ClientCreate {
+	if v != nil {
+		_c.SetRefreshTokenLifetime(*v)
+	}
+	return _c
+}
+
+// SetClientCredentialsClaims sets the "client_credentials_claims" field.
+func (_c *OAuth2ClientCreate) SetClientCredentialsClaims(v *storage.ClientCredentialsClaims) *OAuth2ClientCreate {
+	_c.mutation.SetClientCredentialsClaims(v)
+	return _c
 }
 
 // SetID sets the "id" field.
-func (oc *OAuth2ClientCreate) SetID(s string) *OAuth2ClientCreate {
-	oc.mutation.SetID(s)
-	return oc
+func (_c *OAuth2ClientCreate) SetID(v string) *OAuth2ClientCreate {
+	_c.mutation.SetID(v)
+	return _c
 }
 
 // Mutation returns the OAuth2ClientMutation object of the builder.
-func (oc *OAuth2ClientCreate) Mutation() *OAuth2ClientMutation {
-	return oc.mutation
+func (_c *OAuth2ClientCreate) Mutation() *OAuth2ClientMutation {
+	return _c.mutation
 }
 
 // Save creates the OAuth2Client in the database.
-func (oc *OAuth2ClientCreate) Save(ctx context.Context) (*OAuth2Client, error) {
-	var (
-		err  error
-		node *OAuth2Client
-	)
-	if len(oc.hooks) == 0 {
-		if err = oc.check(); err != nil {
-			return nil, err
-		}
-		node, err = oc.sqlSave(ctx)
-	} else {
-		var mut Mutator = MutateFunc(func(ctx context.Context, m Mutation) (Value, error) {
-			mutation, ok := m.(*OAuth2ClientMutation)
-			if !ok {
-				return nil, fmt.Errorf("unexpected mutation type %T", m)
-			}
-			if err = oc.check(); err != nil {
-				return nil, err
-			}
-			oc.mutation = mutation
-			if node, err = oc.sqlSave(ctx); err != nil {
-				return nil, err
-			}
-			mutation.id = &node.ID
-			mutation.done = true
-			return node, err
-		})
-		for i := len(oc.hooks) - 1; i >= 0; i-- {
-			if oc.hooks[i] == nil {
-				return nil, fmt.Errorf("db: uninitialized hook (forgotten import db/runtime?)")
-			}
-			mut = oc.hooks[i](mut)
-		}
-		v, err := mut.Mutate(ctx, oc.mutation)
-		if err != nil {
-			return nil, err
-		}
-		nv, ok := v.(*OAuth2Client)
-		if !ok {
-			return nil, fmt.Errorf("unexpected node type %T returned from OAuth2ClientMutation", v)
-		}
-		node = nv
-	}
-	return node, err
+func (_c *OAuth2ClientCreate) Save(ctx context.Context) (*OAuth2Client, error) {
+	_c.defaults()
+	return withHooks(ctx, _c.sqlSave, _c.mutation, _c.hooks)
 }
 
 // SaveX calls Save and panics if Save returns an error.
-func (oc *OAuth2ClientCreate) SaveX(ctx context.Context) *OAuth2Client {
-	v, err := oc.Save(ctx)
+func (_c *OAuth2ClientCreate) SaveX(ctx context.Context) *OAuth2Client {
+	v, err := _c.Save(ctx)
 	if err != nil {
 		panic(err)
 	}
@@ -123,48 +141,60 @@ func (oc *OAuth2ClientCreate) SaveX(ctx context.Context) *OAuth2Client {
 }
 
 // Exec executes the query.
-func (oc *OAuth2ClientCreate) Exec(ctx context.Context) error {
-	_, err := oc.Save(ctx)
+func (_c *OAuth2ClientCreate) Exec(ctx context.Context) error {
+	_, err := _c.Save(ctx)
 	return err
 }
 
 // ExecX is like Exec, but panics if an error occurs.
-func (oc *OAuth2ClientCreate) ExecX(ctx context.Context) {
-	if err := oc.Exec(ctx); err != nil {
+func (_c *OAuth2ClientCreate) ExecX(ctx context.Context) {
+	if err := _c.Exec(ctx); err != nil {
 		panic(err)
 	}
 }
 
+// defaults sets the default values of the builder before save.
+func (_c *OAuth2ClientCreate) defaults() {
+	if _, ok := _c.mutation.BackchannelLogoutURI(); !ok {
+		v := oauth2client.DefaultBackchannelLogoutURI
+		_c.mutation.SetBackchannelLogoutURI(v)
+	}
+	if _, ok := _c.mutation.RefreshTokenLifetime(); !ok {
+		v := oauth2client.DefaultRefreshTokenLifetime
+		_c.mutation.SetRefreshTokenLifetime(v)
+	}
+}
+
 // check runs all checks and user-defined validators on the builder.
-func (oc *OAuth2ClientCreate) check() error {
-	if _, ok := oc.mutation.Secret(); !ok {
+func (_c *OAuth2ClientCreate) check() error {
+	if _, ok := _c.mutation.Secret(); !ok {
 		return &ValidationError{Name: "secret", err: errors.New(`db: missing required field "OAuth2Client.secret"`)}
 	}
-	if v, ok := oc.mutation.Secret(); ok {
+	if v, ok := _c.mutation.Secret(); ok {
 		if err := oauth2client.SecretValidator(v); err != nil {
 			return &ValidationError{Name: "secret", err: fmt.Errorf(`db: validator failed for field "OAuth2Client.secret": %w`, err)}
 		}
 	}
-	if _, ok := oc.mutation.Public(); !ok {
+	if _, ok := _c.mutation.Public(); !ok {
 		return &ValidationError{Name: "public", err: errors.New(`db: missing required field "OAuth2Client.public"`)}
 	}
-	if _, ok := oc.mutation.Name(); !ok {
+	if _, ok := _c.mutation.Name(); !ok {
 		return &ValidationError{Name: "name", err: errors.New(`db: missing required field "OAuth2Client.name"`)}
 	}
-	if v, ok := oc.mutation.Name(); ok {
+	if v, ok := _c.mutation.Name(); ok {
 		if err := oauth2client.NameValidator(v); err != nil {
 			return &ValidationError{Name: "name", err: fmt.Errorf(`db: validator failed for field "OAuth2Client.name": %w`, err)}
 		}
 	}
-	if _, ok := oc.mutation.LogoURL(); !ok {
+	if _, ok := _c.mutation.LogoURL(); !ok {
 		return &ValidationError{Name: "logo_url", err: errors.New(`db: missing required field "OAuth2Client.logo_url"`)}
 	}
-	if v, ok := oc.mutation.LogoURL(); ok {
+	if v, ok := _c.mutation.LogoURL(); ok {
 		if err := oauth2client.LogoURLValidator(v); err != nil {
 			return &ValidationError{Name: "logo_url", err: fmt.Errorf(`db: validator failed for field "OAuth2Client.logo_url": %w`, err)}
 		}
 	}
-	if v, ok := oc.mutation.ID(); ok {
+	if v, ok := _c.mutation.ID(); ok {
 		if err := oauth2client.IDValidator(v); err != nil {
 			return &ValidationError{Name: "id", err: fmt.Errorf(`db: validator failed for field "OAuth2Client.id": %w`, err)}
 		}
@@ -172,9 +202,12 @@ func (oc *OAuth2ClientCreate) check() error {
 	return nil
 }
 
-func (oc *OAuth2ClientCreate) sqlSave(ctx context.Context) (*OAuth2Client, error) {
-	_node, _spec := oc.createSpec()
-	if err := sqlgraph.CreateNode(ctx, oc.driver, _spec); err != nil {
+func (_c *OAuth2ClientCreate) sqlSave(ctx context.Context) (*OAuth2Client, error) {
+	if err := _c.check(); err != nil {
+		return nil, err
+	}
+	_node, _spec := _c.createSpec()
+	if err := sqlgraph.CreateNode(ctx, _c.driver, _spec); err != nil {
 		if sqlgraph.IsConstraintError(err) {
 			err = &ConstraintError{msg: err.Error(), wrap: err}
 		}
@@ -187,89 +220,94 @@ func (oc *OAuth2ClientCreate) sqlSave(ctx context.Context) (*OAuth2Client, error
 			return nil, fmt.Errorf("unexpected OAuth2Client.ID type: %T", _spec.ID.Value)
 		}
 	}
+	_c.mutation.id = &_node.ID
+	_c.mutation.done = true
 	return _node, nil
 }
 
-func (oc *OAuth2ClientCreate) createSpec() (*OAuth2Client, *sqlgraph.CreateSpec) {
+func (_c *OAuth2ClientCreate) createSpec() (*OAuth2Client, *sqlgraph.CreateSpec) {
 	var (
-		_node = &OAuth2Client{config: oc.config}
-		_spec = &sqlgraph.CreateSpec{
-			Table: oauth2client.Table,
-			ID: &sqlgraph.FieldSpec{
-				Type:   field.TypeString,
-				Column: oauth2client.FieldID,
-			},
-		}
+		_node = &OAuth2Client{config: _c.config}
+		_spec = sqlgraph.NewCreateSpec(oauth2client.Table, sqlgraph.NewFieldSpec(oauth2client.FieldID, field.TypeString))
 	)
-	if id, ok := oc.mutation.ID(); ok {
+	if id, ok := _c.mutation.ID(); ok {
 		_node.ID = id
 		_spec.ID.Value = id
 	}
-	if value, ok := oc.mutation.Secret(); ok {
-		_spec.Fields = append(_spec.Fields, &sqlgraph.FieldSpec{
-			Type:   field.TypeString,
-			Value:  value,
-			Column: oauth2client.FieldSecret,
-		})
+	if value, ok := _c.mutation.Secret(); ok {
+		_spec.SetField(oauth2client.FieldSecret, field.TypeString, value)
 		_node.Secret = value
 	}
-	if value, ok := oc.mutation.RedirectUris(); ok {
-		_spec.Fields = append(_spec.Fields, &sqlgraph.FieldSpec{
-			Type:   field.TypeJSON,
-			Value:  value,
-			Column: oauth2client.FieldRedirectUris,
-		})
+	if value, ok := _c.mutation.RedirectUris(); ok {
+		_spec.SetField(oauth2client.FieldRedirectUris, field.TypeJSON, value)
 		_node.RedirectUris = value
 	}
-	if value, ok := oc.mutation.TrustedPeers(); ok {
-		_spec.Fields = append(_spec.Fields, &sqlgraph.FieldSpec{
-			Type:   field.TypeJSON,
-			Value:  value,
-			Column: oauth2client.FieldTrustedPeers,
-		})
+	if value, ok := _c.mutation.TrustedPeers(); ok {
+		_spec.SetField(oauth2client.FieldTrustedPeers, field.TypeJSON, value)
 		_node.TrustedPeers = value
 	}
-	if value, ok := oc.mutation.Public(); ok {
-		_spec.Fields = append(_spec.Fields, &sqlgraph.FieldSpec{
-			Type:   field.TypeBool,
-			Value:  value,
-			Column: oauth2client.FieldPublic,
-		})
+	if value, ok := _c.mutation.Public(); ok {
+		_spec.SetField(oauth2client.FieldPublic, field.TypeBool, value)
 		_node.Public = value
 	}
-	if value, ok := oc.mutation.Name(); ok {
-		_spec.Fields = append(_spec.Fields, &sqlgraph.FieldSpec{
-			Type:   field.TypeString,
-			Value:  value,
-			Column: oauth2client.FieldName,
-		})
+	if value, ok := _c.mutation.Name(); ok {
+		_spec.SetField(oauth2client.FieldName, field.TypeString, value)
 		_node.Name = value
 	}
-	if value, ok := oc.mutation.LogoURL(); ok {
-		_spec.Fields = append(_spec.Fields, &sqlgraph.FieldSpec{
-			Type:   field.TypeString,
-			Value:  value,
-			Column: oauth2client.FieldLogoURL,
-		})
+	if value, ok := _c.mutation.LogoURL(); ok {
+		_spec.SetField(oauth2client.FieldLogoURL, field.TypeString, value)
 		_node.LogoURL = value
 	}
+	if value, ok := _c.mutation.AllowedConnectors(); ok {
+		_spec.SetField(oauth2client.FieldAllowedConnectors, field.TypeJSON, value)
+		_node.AllowedConnectors = value
+	}
+	if value, ok := _c.mutation.MfaChain(); ok {
+		_spec.SetField(oauth2client.FieldMfaChain, field.TypeJSON, value)
+		_node.MfaChain = value
+	}
+	if value, ok := _c.mutation.PostLogoutRedirectUris(); ok {
+		_spec.SetField(oauth2client.FieldPostLogoutRedirectUris, field.TypeJSON, value)
+		_node.PostLogoutRedirectUris = value
+	}
+	if value, ok := _c.mutation.SSOSharedWith(); ok {
+		_spec.SetField(oauth2client.FieldSSOSharedWith, field.TypeJSON, value)
+		_node.SSOSharedWith = value
+	}
+	if value, ok := _c.mutation.BackchannelLogoutURI(); ok {
+		_spec.SetField(oauth2client.FieldBackchannelLogoutURI, field.TypeString, value)
+		_node.BackchannelLogoutURI = value
+	}
+	if value, ok := _c.mutation.RefreshTokenLifetime(); ok {
+		_spec.SetField(oauth2client.FieldRefreshTokenLifetime, field.TypeString, value)
+		_node.RefreshTokenLifetime = value
+	}
+	if value, ok := _c.mutation.ClientCredentialsClaims(); ok {
+		_spec.SetField(oauth2client.FieldClientCredentialsClaims, field.TypeJSON, value)
+		_node.ClientCredentialsClaims = value
+	}
 	return _node, _spec
 }
 
 // OAuth2ClientCreateBulk is the builder for creating many OAuth2Client entities in bulk.
 type OAuth2ClientCreateBulk struct {
 	config
+	err      error
 	builders []*OAuth2ClientCreate
 }
 
 // Save creates the OAuth2Client entities in the database.
-func (ocb *OAuth2ClientCreateBulk) Save(ctx context.Context) ([]*OAuth2Client, error) {
-	specs := make([]*sqlgraph.CreateSpec, len(ocb.builders))
-	nodes := make([]*OAuth2Client, len(ocb.builders))
-	mutators := make([]Mutator, len(ocb.builders))
-	for i := range ocb.builders {
+func (_c *OAuth2ClientCreateBulk) Save(ctx context.Context) ([]*OAuth2Client, error) {
+	if _c.err != nil {
+		return nil, _c.err
+	}
+	specs := make([]*sqlgraph.CreateSpec, len(_c.builders))
+	nodes := make([]*OAuth2Client, len(_c.builders))
+	mutators := make([]Mutator, len(_c.builders))
+	for i := range _c.builders {
 		func(i int, root context.Context) {
-			builder := ocb.builders[i]
+			builder := _c.builders[i]
+			builder.defaults()
 			var mut Mutator = MutateFunc(func(ctx context.Context, m Mutation) (Value, error) {
 				mutation, ok := m.(*OAuth2ClientMutation)
 				if !ok {
@@ -279,14 +317,14 @@ func (ocb *OAuth2ClientCreateBulk) Save(ctx context.Context) ([]*OAuth2Client, e
 					return nil, err
 				}
 				builder.mutation = mutation
-				nodes[i], specs[i] = builder.createSpec()
 				var err error
+				nodes[i], specs[i] = builder.createSpec()
 				if i < len(mutators)-1 {
-					_, err = mutators[i+1].Mutate(root, ocb.builders[i+1].mutation)
+					_, err = mutators[i+1].Mutate(root, _c.builders[i+1].mutation)
 				} else {
 					spec := &sqlgraph.BatchCreateSpec{Nodes: specs}
 					// Invoke the actual operation on the latest mutation in the chain.
-					if err = sqlgraph.BatchCreate(ctx, ocb.driver, spec); err != nil {
+					if err = sqlgraph.BatchCreate(ctx, _c.driver, spec); err != nil {
 						if sqlgraph.IsConstraintError(err) {
 							err = &ConstraintError{msg: err.Error(), wrap: err}
 						}
@@ -306,7 +344,7 @@ func (ocb *OAuth2ClientCreateBulk) Save(ctx context.Context) ([]*OAuth2Client, e
 		}(i, ctx)
 	}
 	if len(mutators) > 0 {
-		if _, err := mutators[0].Mutate(ctx, ocb.builders[0].mutation); err != nil {
+		if _, err := mutators[0].Mutate(ctx, _c.builders[0].mutation); err != nil {
 			return nil, err
 		}
 	}
@@ -314,8 +352,8 @@ func (ocb *OAuth2ClientCreateBulk) Save(ctx context.Context) ([]*OAuth2Client, e
 }
 
 // SaveX is like Save, but panics if an error occurs.
-func (ocb *OAuth2ClientCreateBulk) SaveX(ctx context.Context) []*OAuth2Client {
-	v, err := ocb.Save(ctx)
+func (_c *OAuth2ClientCreateBulk) SaveX(ctx context.Context) []*OAuth2Client {
+	v, err := _c.Save(ctx)
 	if err != nil {
 		panic(err)
 	}
@@ -323,14 +361,14 @@ func (ocb *OAuth2ClientCreateBulk) SaveX(ctx context.Context) []*OAuth2Client {
 }
 
 // Exec executes the query.
-func (ocb *OAuth2ClientCreateBulk) Exec(ctx context.Context) error {
-	_, err := ocb.Save(ctx)
+func (_c *OAuth2ClientCreateBulk) Exec(ctx context.Context) error {
+	_, err := _c.Save(ctx)
 	return err
 }
 
 // ExecX is like Exec, but panics if an error occurs.
-func (ocb *OAuth2ClientCreateBulk) ExecX(ctx context.Context) {
-	if err := ocb.Exec(ctx); err != nil {
+func (_c *OAuth2ClientCreateBulk) ExecX(ctx context.Context) {
+	if err := _c.Exec(ctx); err != nil {
 		panic(err)
 	}
 }
diff --git a/storage/ent/db/oauth2client_delete.go b/storage/ent/db/oauth2client_delete.go
index 239d904dc2..d8c340aedc 100644
--- a/storage/ent/db/oauth2client_delete.go
+++ b/storage/ent/db/oauth2client_delete.go
@@ -4,7 +4,6 @@ package db
 
 import (
 	"context"
-	"fmt"
 
 	"entgo.io/ent/dialect/sql"
 	"entgo.io/ent/dialect/sql/sqlgraph"
@@ -21,84 +20,56 @@ type OAuth2ClientDelete struct {
 }
 
 // Where appends a list predicates to the OAuth2ClientDelete builder.
-func (od *OAuth2ClientDelete) Where(ps ...predicate.OAuth2Client) *OAuth2ClientDelete {
-	od.mutation.Where(ps...)
-	return od
+func (_d *OAuth2ClientDelete) Where(ps ...predicate.OAuth2Client) *OAuth2ClientDelete {
+	_d.mutation.Where(ps...)
+	return _d
 }
 
 // Exec executes the deletion query and returns how many vertices were deleted.
-func (od *OAuth2ClientDelete) Exec(ctx context.Context) (int, error) {
-	var (
-		err      error
-		affected int
-	)
-	if len(od.hooks) == 0 {
-		affected, err = od.sqlExec(ctx)
-	} else {
-		var mut Mutator = MutateFunc(func(ctx context.Context, m Mutation) (Value, error) {
-			mutation, ok := m.(*OAuth2ClientMutation)
-			if !ok {
-				return nil, fmt.Errorf("unexpected mutation type %T", m)
-			}
-			od.mutation = mutation
-			affected, err = od.sqlExec(ctx)
-			mutation.done = true
-			return affected, err
-		})
-		for i := len(od.hooks) - 1; i >= 0; i-- {
-			if od.hooks[i] == nil {
-				return 0, fmt.Errorf("db: uninitialized hook (forgotten import db/runtime?)")
-			}
-			mut = od.hooks[i](mut)
-		}
-		if _, err := mut.Mutate(ctx, od.mutation); err != nil {
-			return 0, err
-		}
-	}
-	return affected, err
+func (_d *OAuth2ClientDelete) Exec(ctx context.Context) (int, error) {
+	return withHooks(ctx, _d.sqlExec, _d.mutation, _d.hooks)
 }
 
 // ExecX is like Exec, but panics if an error occurs.
-func (od *OAuth2ClientDelete) ExecX(ctx context.Context) int {
-	n, err := od.Exec(ctx)
+func (_d *OAuth2ClientDelete) ExecX(ctx context.Context) int {
+	n, err := _d.Exec(ctx)
 	if err != nil {
 		panic(err)
 	}
 	return n
 }
 
-func (od *OAuth2ClientDelete) sqlExec(ctx context.Context) (int, error) {
-	_spec := &sqlgraph.DeleteSpec{
-		Node: &sqlgraph.NodeSpec{
-			Table: oauth2client.Table,
-			ID: &sqlgraph.FieldSpec{
-				Type:   field.TypeString,
-				Column: oauth2client.FieldID,
-			},
-		},
-	}
-	if ps := od.mutation.predicates; len(ps) > 0 {
+func (_d *OAuth2ClientDelete) sqlExec(ctx context.Context) (int, error) {
+	_spec := sqlgraph.NewDeleteSpec(oauth2client.Table, sqlgraph.NewFieldSpec(oauth2client.FieldID, field.TypeString))
+	if ps := _d.mutation.predicates; len(ps) > 0 {
 		_spec.Predicate = func(selector *sql.Selector) {
 			for i := range ps {
 				ps[i](selector)
 			}
 		}
 	}
-	affected, err := sqlgraph.DeleteNodes(ctx, od.driver, _spec)
+	affected, err := sqlgraph.DeleteNodes(ctx, _d.driver, _spec)
 	if err != nil && sqlgraph.IsConstraintError(err) {
 		err = &ConstraintError{msg: err.Error(), wrap: err}
 	}
+	_d.mutation.done = true
 	return affected, err
 }
 
 // OAuth2ClientDeleteOne is the builder for deleting a single OAuth2Client entity.
 type OAuth2ClientDeleteOne struct {
-	od *OAuth2ClientDelete
+	_d *OAuth2ClientDelete
+}
+
+// Where appends a list predicates to the OAuth2ClientDelete builder.
+func (_d *OAuth2ClientDeleteOne) Where(ps ...predicate.OAuth2Client) *OAuth2ClientDeleteOne {
+	_d._d.mutation.Where(ps...)
+	return _d
 }
 
 // Exec executes the deletion query.
-func (odo *OAuth2ClientDeleteOne) Exec(ctx context.Context) error {
-	n, err := odo.od.Exec(ctx)
+func (_d *OAuth2ClientDeleteOne) Exec(ctx context.Context) error {
+	n, err := _d._d.Exec(ctx)
 	switch {
 	case err != nil:
 		return err
@@ -110,6 +81,8 @@ func (odo *OAuth2ClientDeleteOne) Exec(ctx context.Context) error {
 }
 
 // ExecX is like Exec, but panics if an error occurs.
-func (odo *OAuth2ClientDeleteOne) ExecX(ctx context.Context) {
-	odo.od.ExecX(ctx)
+func (_d *OAuth2ClientDeleteOne) ExecX(ctx context.Context) {
+	if err := _d.Exec(ctx); err != nil {
+		panic(err)
+	}
 }
diff --git a/storage/ent/db/oauth2client_query.go b/storage/ent/db/oauth2client_query.go
index 1776c943d2..21e2b114dd 100644
--- a/storage/ent/db/oauth2client_query.go
+++ b/storage/ent/db/oauth2client_query.go
@@ -7,6 +7,7 @@ import (
 	"fmt"
 	"math"
 
+	"entgo.io/ent"
 	"entgo.io/ent/dialect/sql"
 	"entgo.io/ent/dialect/sql/sqlgraph"
 	"entgo.io/ent/schema/field"
@@ -17,11 +18,9 @@ import (
 // OAuth2ClientQuery is the builder for querying OAuth2Client entities.
 type OAuth2ClientQuery struct {
 	config
-	limit      *int
-	offset     *int
-	unique     *bool
-	order      []OrderFunc
-	fields     []string
+	ctx        *QueryContext
+	order      []oauth2client.OrderOption
+	inters     []Interceptor
 	predicates []predicate.OAuth2Client
 	// intermediate query (i.e. traversal path).
 	sql  *sql.Selector
@@ -29,40 +28,40 @@ type OAuth2ClientQuery struct {
 }
 
 // Where adds a new predicate for the OAuth2ClientQuery builder.
-func (oq *OAuth2ClientQuery) Where(ps ...predicate.OAuth2Client) *OAuth2ClientQuery {
-	oq.predicates = append(oq.predicates, ps...)
-	return oq
+func (_q *OAuth2ClientQuery) Where(ps ...predicate.OAuth2Client) *OAuth2ClientQuery {
+	_q.predicates = append(_q.predicates, ps...)
+	return _q
 }
 
-// Limit adds a limit step to the query.
-func (oq *OAuth2ClientQuery) Limit(limit int) *OAuth2ClientQuery {
-	oq.limit = &limit
-	return oq
+// Limit the number of records to be returned by this query.
+func (_q *OAuth2ClientQuery) Limit(limit int) *OAuth2ClientQuery {
+	_q.ctx.Limit = &limit
+	return _q
 }
 
-// Offset adds an offset step to the query.
-func (oq *OAuth2ClientQuery) Offset(offset int) *OAuth2ClientQuery {
-	oq.offset = &offset
-	return oq
+// Offset to start from.
+func (_q *OAuth2ClientQuery) Offset(offset int) *OAuth2ClientQuery {
+	_q.ctx.Offset = &offset
+	return _q
 }
 
 // Unique configures the query builder to filter duplicate records on query.
 // By default, unique is set to true, and can be disabled using this method.
-func (oq *OAuth2ClientQuery) Unique(unique bool) *OAuth2ClientQuery {
-	oq.unique = &unique
-	return oq
+func (_q *OAuth2ClientQuery) Unique(unique bool) *OAuth2ClientQuery {
+	_q.ctx.Unique = &unique
+	return _q
 }
 
-// Order adds an order step to the query.
-func (oq *OAuth2ClientQuery) Order(o ...OrderFunc) *OAuth2ClientQuery {
-	oq.order = append(oq.order, o...)
-	return oq
+// Order specifies how the records should be ordered.
+func (_q *OAuth2ClientQuery) Order(o ...oauth2client.OrderOption) *OAuth2ClientQuery {
+	_q.order = append(_q.order, o...)
+	return _q
 }
 
 // First returns the first OAuth2Client entity from the query.
 // Returns a *NotFoundError when no OAuth2Client was found.
-func (oq *OAuth2ClientQuery) First(ctx context.Context) (*OAuth2Client, error) {
-	nodes, err := oq.Limit(1).All(ctx)
+func (_q *OAuth2ClientQuery) First(ctx context.Context) (*OAuth2Client, error) {
+	nodes, err := _q.Limit(1).All(setContextOp(ctx, _q.ctx, ent.OpQueryFirst))
 	if err != nil {
 		return nil, err
 	}
@@ -73,8 +72,8 @@ func (oq *OAuth2ClientQuery) First(ctx context.Context) (*OAuth2Client, error) {
 }
 
 // FirstX is like First, but panics if an error occurs.
-func (oq *OAuth2ClientQuery) FirstX(ctx context.Context) *OAuth2Client {
-	node, err := oq.First(ctx)
+func (_q *OAuth2ClientQuery) FirstX(ctx context.Context) *OAuth2Client {
+	node, err := _q.First(ctx)
 	if err != nil && !IsNotFound(err) {
 		panic(err)
 	}
@@ -83,9 +82,9 @@ func (oq *OAuth2ClientQuery) FirstX(ctx context.Context) *OAuth2Client {
 
 // FirstID returns the first OAuth2Client ID from the query.
 // Returns a *NotFoundError when no OAuth2Client ID was found.
-func (oq *OAuth2ClientQuery) FirstID(ctx context.Context) (id string, err error) {
+func (_q *OAuth2ClientQuery) FirstID(ctx context.Context) (id string, err error) {
 	var ids []string
-	if ids, err = oq.Limit(1).IDs(ctx); err != nil {
+	if ids, err = _q.Limit(1).IDs(setContextOp(ctx, _q.ctx, ent.OpQueryFirstID)); err != nil {
 		return
 	}
 	if len(ids) == 0 {
@@ -96,8 +95,8 @@ func (oq *OAuth2ClientQuery) FirstID(ctx context.Context) (id string, err error)
 }
 
 // FirstIDX is like FirstID, but panics if an error occurs.
-func (oq *OAuth2ClientQuery) FirstIDX(ctx context.Context) string {
-	id, err := oq.FirstID(ctx)
+func (_q *OAuth2ClientQuery) FirstIDX(ctx context.Context) string {
+	id, err := _q.FirstID(ctx)
 	if err != nil && !IsNotFound(err) {
 		panic(err)
 	}
@@ -107,8 +106,8 @@ func (oq *OAuth2ClientQuery) FirstIDX(ctx context.Context) string {
 // Only returns a single OAuth2Client entity found by the query, ensuring it only returns one.
 // Returns a *NotSingularError when more than one OAuth2Client entity is found.
 // Returns a *NotFoundError when no OAuth2Client entities are found.
-func (oq *OAuth2ClientQuery) Only(ctx context.Context) (*OAuth2Client, error) {
-	nodes, err := oq.Limit(2).All(ctx)
+func (_q *OAuth2ClientQuery) Only(ctx context.Context) (*OAuth2Client, error) {
+	nodes, err := _q.Limit(2).All(setContextOp(ctx, _q.ctx, ent.OpQueryOnly))
 	if err != nil {
 		return nil, err
 	}
@@ -123,8 +122,8 @@ func (oq *OAuth2ClientQuery) Only(ctx context.Context) (*OAuth2Client, error) {
 }
 
 // OnlyX is like Only, but panics if an error occurs.
-func (oq *OAuth2ClientQuery) OnlyX(ctx context.Context) *OAuth2Client {
-	node, err := oq.Only(ctx)
+func (_q *OAuth2ClientQuery) OnlyX(ctx context.Context) *OAuth2Client {
+	node, err := _q.Only(ctx)
 	if err != nil {
 		panic(err)
 	}
@@ -134,9 +133,9 @@ func (oq *OAuth2ClientQuery) OnlyX(ctx context.Context) *OAuth2Client {
 // OnlyID is like Only, but returns the only OAuth2Client ID in the query.
 // Returns a *NotSingularError when more than one OAuth2Client ID is found.
 // Returns a *NotFoundError when no entities are found.
-func (oq *OAuth2ClientQuery) OnlyID(ctx context.Context) (id string, err error) {
+func (_q *OAuth2ClientQuery) OnlyID(ctx context.Context) (id string, err error) {
 	var ids []string
-	if ids, err = oq.Limit(2).IDs(ctx); err != nil {
+	if ids, err = _q.Limit(2).IDs(setContextOp(ctx, _q.ctx, ent.OpQueryOnlyID)); err != nil {
 		return
 	}
 	switch len(ids) {
@@ -151,8 +150,8 @@ func (oq *OAuth2ClientQuery) OnlyID(ctx context.Context) (id string, err error)
 }
 
 // OnlyIDX is like OnlyID, but panics if an error occurs.
-func (oq *OAuth2ClientQuery) OnlyIDX(ctx context.Context) string {
-	id, err := oq.OnlyID(ctx)
+func (_q *OAuth2ClientQuery) OnlyIDX(ctx context.Context) string {
+	id, err := _q.OnlyID(ctx)
 	if err != nil {
 		panic(err)
 	}
@@ -160,16 +159,18 @@ func (oq *OAuth2ClientQuery) OnlyIDX(ctx context.Context) string {
 }
 
 // All executes the query and returns a list of OAuth2Clients.
-func (oq *OAuth2ClientQuery) All(ctx context.Context) ([]*OAuth2Client, error) {
-	if err := oq.prepareQuery(ctx); err != nil {
+func (_q *OAuth2ClientQuery) All(ctx context.Context) ([]*OAuth2Client, error) {
+	ctx = setContextOp(ctx, _q.ctx, ent.OpQueryAll)
+	if err := _q.prepareQuery(ctx); err != nil {
 		return nil, err
 	}
-	return oq.sqlAll(ctx)
+	qr := querierAll[[]*OAuth2Client, *OAuth2ClientQuery]()
+	return withInterceptors[[]*OAuth2Client](ctx, _q, qr, _q.inters)
 }
 
 // AllX is like All, but panics if an error occurs.
-func (oq *OAuth2ClientQuery) AllX(ctx context.Context) []*OAuth2Client {
-	nodes, err := oq.All(ctx)
+func (_q *OAuth2ClientQuery) AllX(ctx context.Context) []*OAuth2Client {
+	nodes, err := _q.All(ctx)
 	if err != nil {
 		panic(err)
 	}
@@ -177,17 +178,20 @@ func (oq *OAuth2ClientQuery) AllX(ctx context.Context) []*OAuth2Client {
 }
 
 // IDs executes the query and returns a list of OAuth2Client IDs.
-func (oq *OAuth2ClientQuery) IDs(ctx context.Context) ([]string, error) {
-	var ids []string
-	if err := oq.Select(oauth2client.FieldID).Scan(ctx, &ids); err != nil {
+func (_q *OAuth2ClientQuery) IDs(ctx context.Context) (ids []string, err error) {
+	if _q.ctx.Unique == nil && _q.path != nil {
+		_q.Unique(true)
+	}
+	ctx = setContextOp(ctx, _q.ctx, ent.OpQueryIDs)
+	if err = _q.Select(oauth2client.FieldID).Scan(ctx, &ids); err != nil {
 		return nil, err
 	}
 	return ids, nil
 }
 
 // IDsX is like IDs, but panics if an error occurs.
-func (oq *OAuth2ClientQuery) IDsX(ctx context.Context) []string {
-	ids, err := oq.IDs(ctx)
+func (_q *OAuth2ClientQuery) IDsX(ctx context.Context) []string {
+	ids, err := _q.IDs(ctx)
 	if err != nil {
 		panic(err)
 	}
@@ -195,16 +199,17 @@ func (oq *OAuth2ClientQuery) IDsX(ctx context.Context) []string {
 }
 
 // Count returns the count of the given query.
-func (oq *OAuth2ClientQuery) Count(ctx context.Context) (int, error) {
-	if err := oq.prepareQuery(ctx); err != nil {
+func (_q *OAuth2ClientQuery) Count(ctx context.Context) (int, error) {
+	ctx = setContextOp(ctx, _q.ctx, ent.OpQueryCount)
+	if err := _q.prepareQuery(ctx); err != nil {
 		return 0, err
 	}
-	return oq.sqlCount(ctx)
+	return withInterceptors[int](ctx, _q, querierCount[*OAuth2ClientQuery](), _q.inters)
 }
 
 // CountX is like Count, but panics if an error occurs.
-func (oq *OAuth2ClientQuery) CountX(ctx context.Context) int {
-	count, err := oq.Count(ctx)
+func (_q *OAuth2ClientQuery) CountX(ctx context.Context) int {
+	count, err := _q.Count(ctx)
 	if err != nil {
 		panic(err)
 	}
@@ -212,16 +217,21 @@ func (oq *OAuth2ClientQuery) CountX(ctx context.Context) int {
 }
 
 // Exist returns true if the query has elements in the graph.
-func (oq *OAuth2ClientQuery) Exist(ctx context.Context) (bool, error) {
-	if err := oq.prepareQuery(ctx); err != nil {
-		return false, err
+func (_q *OAuth2ClientQuery) Exist(ctx context.Context) (bool, error) {
+	ctx = setContextOp(ctx, _q.ctx, ent.OpQueryExist)
+	switch _, err := _q.FirstID(ctx); {
+	case IsNotFound(err):
+		return false, nil
+	case err != nil:
+		return false, fmt.Errorf("db: check existence: %w", err)
+	default:
+		return true, nil
 	}
-	return oq.sqlExist(ctx)
 }
 
 // ExistX is like Exist, but panics if an error occurs.
-func (oq *OAuth2ClientQuery) ExistX(ctx context.Context) bool {
-	exist, err := oq.Exist(ctx)
+func (_q *OAuth2ClientQuery) ExistX(ctx context.Context) bool {
+	exist, err := _q.Exist(ctx)
 	if err != nil {
 		panic(err)
 	}
@@ -230,20 +240,19 @@ func (oq *OAuth2ClientQuery) ExistX(ctx context.Context) bool {
 
 // Clone returns a duplicate of the OAuth2ClientQuery builder, including all associated steps. It can be
 // used to prepare common query builders and use them differently after the clone is made.
-func (oq *OAuth2ClientQuery) Clone() *OAuth2ClientQuery {
-	if oq == nil {
+func (_q *OAuth2ClientQuery) Clone() *OAuth2ClientQuery {
+	if _q == nil {
 		return nil
 	}
 	return &OAuth2ClientQuery{
-		config:     oq.config,
-		limit:      oq.limit,
-		offset:     oq.offset,
-		order:      append([]OrderFunc{}, oq.order...),
-		predicates: append([]predicate.OAuth2Client{}, oq.predicates...),
+		config:     _q.config,
+		ctx:        _q.ctx.Clone(),
+		order:      append([]oauth2client.OrderOption{}, _q.order...),
+		inters:     append([]Interceptor{}, _q.inters...),
+		predicates: append([]predicate.OAuth2Client{}, _q.predicates...),
 		// clone intermediate query.
-		sql:    oq.sql.Clone(),
-		path:   oq.path,
-		unique: oq.unique,
+		sql:  _q.sql.Clone(),
+		path: _q.path,
 	}
 }
 
@@ -261,18 +270,12 @@ func (oq *OAuth2ClientQuery) Clone() *OAuth2ClientQuery {
 //		GroupBy(oauth2client.FieldSecret).
 //		Aggregate(db.Count()).
 //		Scan(ctx, &v)
-//
-func (oq *OAuth2ClientQuery) GroupBy(field string, fields ...string) *OAuth2ClientGroupBy {
-	grbuild := &OAuth2ClientGroupBy{config: oq.config}
-	grbuild.fields = append([]string{field}, fields...)
-	grbuild.path = func(ctx context.Context) (prev *sql.Selector, err error) {
-		if err := oq.prepareQuery(ctx); err != nil {
-			return nil, err
-		}
-		return oq.sqlQuery(ctx), nil
-	}
+func (_q *OAuth2ClientQuery) GroupBy(field string, fields ...string) *OAuth2ClientGroupBy {
+	_q.ctx.Fields = append([]string{field}, fields...)
+	grbuild := &OAuth2ClientGroupBy{build: _q}
+	grbuild.flds = &_q.ctx.Fields
 	grbuild.label = oauth2client.Label
-	grbuild.flds, grbuild.scan = &grbuild.fields, grbuild.Scan
+	grbuild.scan = grbuild.Scan
 	return grbuild
 }
 
@@ -288,48 +291,62 @@ func (oq *OAuth2ClientQuery) GroupBy(field string, fields ...string) *OAuth2Clie
 //	client.OAuth2Client.Query().
 //		Select(oauth2client.FieldSecret).
 //		Scan(ctx, &v)
-//
-func (oq *OAuth2ClientQuery) Select(fields ...string) *OAuth2ClientSelect {
-	oq.fields = append(oq.fields, fields...)
-	selbuild := &OAuth2ClientSelect{OAuth2ClientQuery: oq}
-	selbuild.label = oauth2client.Label
-	selbuild.flds, selbuild.scan = &oq.fields, selbuild.Scan
-	return selbuild
+func (_q *OAuth2ClientQuery) Select(fields ...string) *OAuth2ClientSelect {
+	_q.ctx.Fields = append(_q.ctx.Fields, fields...)
+	sbuild := &OAuth2ClientSelect{OAuth2ClientQuery: _q}
+	sbuild.label = oauth2client.Label
+	sbuild.flds, sbuild.scan = &_q.ctx.Fields, sbuild.Scan
+	return sbuild
+}
+
+// Aggregate returns a OAuth2ClientSelect configured with the given aggregations.
+func (_q *OAuth2ClientQuery) Aggregate(fns ...AggregateFunc) *OAuth2ClientSelect {
+	return _q.Select().Aggregate(fns...)
 }
 
-func (oq *OAuth2ClientQuery) prepareQuery(ctx context.Context) error {
-	for _, f := range oq.fields {
+func (_q *OAuth2ClientQuery) prepareQuery(ctx context.Context) error {
+	for _, inter := range _q.inters {
+		if inter == nil {
+			return fmt.Errorf("db: uninitialized interceptor (forgotten import db/runtime?)")
+		}
+		if trv, ok := inter.(Traverser); ok {
+			if err := trv.Traverse(ctx, _q); err != nil {
+				return err
+			}
+		}
+	}
+	for _, f := range _q.ctx.Fields {
 		if !oauth2client.ValidColumn(f) {
 			return &ValidationError{Name: f, err: fmt.Errorf("db: invalid field %q for query", f)}
 		}
 	}
-	if oq.path != nil {
-		prev, err := oq.path(ctx)
+	if _q.path != nil {
+		prev, err := _q.path(ctx)
 		if err != nil {
 			return err
 		}
-		oq.sql = prev
+		_q.sql = prev
 	}
 	return nil
 }
 
-func (oq *OAuth2ClientQuery) sqlAll(ctx context.Context, hooks ...queryHook) ([]*OAuth2Client, error) {
+func (_q *OAuth2ClientQuery) sqlAll(ctx context.Context, hooks ...queryHook) ([]*OAuth2Client, error) {
 	var (
 		nodes = []*OAuth2Client{}
-		_spec = oq.querySpec()
+		_spec = _q.querySpec()
 	)
-	_spec.ScanValues = func(columns []string) ([]interface{}, error) {
+	_spec.ScanValues = func(columns []string) ([]any, error) {
 		return (*OAuth2Client).scanValues(nil, columns)
 	}
-	_spec.Assign = func(columns []string, values []interface{}) error {
-		node := &OAuth2Client{config: oq.config}
+	_spec.Assign = func(columns []string, values []any) error {
+		node := &OAuth2Client{config: _q.config}
 		nodes = append(nodes, node)
 		return node.assignValues(columns, values)
 	}
 	for i := range hooks {
 		hooks[i](ctx, _spec)
 	}
-	if err := sqlgraph.QueryNodes(ctx, oq.driver, _spec); err != nil {
+	if err := sqlgraph.QueryNodes(ctx, _q.driver, _spec); err != nil {
 		return nil, err
 	}
 	if len(nodes) == 0 {
@@ -338,40 +355,24 @@ func (oq *OAuth2ClientQuery) sqlAll(ctx context.Context, hooks ...queryHook) ([]
 	return nodes, nil
 }
 
-func (oq *OAuth2ClientQuery) sqlCount(ctx context.Context) (int, error) {
-	_spec := oq.querySpec()
-	_spec.Node.Columns = oq.fields
-	if len(oq.fields) > 0 {
-		_spec.Unique = oq.unique != nil && *oq.unique
-	}
-	return sqlgraph.CountNodes(ctx, oq.driver, _spec)
-}
-
-func (oq *OAuth2ClientQuery) sqlExist(ctx context.Context) (bool, error) {
-	n, err := oq.sqlCount(ctx)
-	if err != nil {
-		return false, fmt.Errorf("db: check existence: %w", err)
+func (_q *OAuth2ClientQuery) sqlCount(ctx context.Context) (int, error) {
+	_spec := _q.querySpec()
+	_spec.Node.Columns = _q.ctx.Fields
+	if len(_q.ctx.Fields) > 0 {
+		_spec.Unique = _q.ctx.Unique != nil && *_q.ctx.Unique
 	}
-	return n > 0, nil
+	return sqlgraph.CountNodes(ctx, _q.driver, _spec)
 }
 
-func (oq *OAuth2ClientQuery) querySpec() *sqlgraph.QuerySpec {
-	_spec := &sqlgraph.QuerySpec{
-		Node: &sqlgraph.NodeSpec{
-			Table:   oauth2client.Table,
-			Columns: oauth2client.Columns,
-			ID: &sqlgraph.FieldSpec{
-				Type:   field.TypeString,
-				Column: oauth2client.FieldID,
-			},
-		},
-		From:   oq.sql,
-		Unique: true,
-	}
-	if unique := oq.unique; unique != nil {
+func (_q *OAuth2ClientQuery) querySpec() *sqlgraph.QuerySpec {
+	_spec := sqlgraph.NewQuerySpec(oauth2client.Table, oauth2client.Columns, sqlgraph.NewFieldSpec(oauth2client.FieldID, field.TypeString))
+	_spec.From = _q.sql
+	if unique := _q.ctx.Unique; unique != nil {
 		_spec.Unique = *unique
+	} else if _q.path != nil {
+		_spec.Unique = true
 	}
-	if fields := oq.fields; len(fields) > 0 {
+	if fields := _q.ctx.Fields; len(fields) > 0 {
 		_spec.Node.Columns = make([]string, 0, len(fields))
 		_spec.Node.Columns = append(_spec.Node.Columns, oauth2client.FieldID)
 		for i := range fields {
@@ -380,20 +381,20 @@ func (oq *OAuth2ClientQuery) querySpec() *sqlgraph.QuerySpec {
 			}
 		}
 	}
-	if ps := oq.predicates; len(ps) > 0 {
+	if ps := _q.predicates; len(ps) > 0 {
 		_spec.Predicate = func(selector *sql.Selector) {
 			for i := range ps {
 				ps[i](selector)
 			}
 		}
 	}
-	if limit := oq.limit; limit != nil {
+	if limit := _q.ctx.Limit; limit != nil {
 		_spec.Limit = *limit
 	}
-	if offset := oq.offset; offset != nil {
+	if offset := _q.ctx.Offset; offset != nil {
 		_spec.Offset = *offset
 	}
-	if ps := oq.order; len(ps) > 0 {
+	if ps := _q.order; len(ps) > 0 {
 		_spec.Order = func(selector *sql.Selector) {
 			for i := range ps {
 				ps[i](selector)
@@ -403,33 +404,33 @@ func (oq *OAuth2ClientQuery) querySpec() *sqlgraph.QuerySpec {
 	return _spec
 }
 
-func (oq *OAuth2ClientQuery) sqlQuery(ctx context.Context) *sql.Selector {
-	builder := sql.Dialect(oq.driver.Dialect())
+func (_q *OAuth2ClientQuery) sqlQuery(ctx context.Context) *sql.Selector {
+	builder := sql.Dialect(_q.driver.Dialect())
 	t1 := builder.Table(oauth2client.Table)
-	columns := oq.fields
+	columns := _q.ctx.Fields
 	if len(columns) == 0 {
 		columns = oauth2client.Columns
 	}
 	selector := builder.Select(t1.Columns(columns...)...).From(t1)
-	if oq.sql != nil {
-		selector = oq.sql
+	if _q.sql != nil {
+		selector = _q.sql
 		selector.Select(selector.Columns(columns...)...)
 	}
-	if oq.unique != nil && *oq.unique {
+	if _q.ctx.Unique != nil && *_q.ctx.Unique {
 		selector.Distinct()
 	}
-	for _, p := range oq.predicates {
+	for _, p := range _q.predicates {
 		p(selector)
 	}
-	for _, p := range oq.order {
+	for _, p := range _q.order {
 		p(selector)
 	}
-	if offset := oq.offset; offset != nil {
+	if offset := _q.ctx.Offset; offset != nil {
 		// limit is mandatory for offset clause. We start
 		// with default value, and override it below if needed.
 		selector.Offset(*offset).Limit(math.MaxInt32)
 	}
-	if limit := oq.limit; limit != nil {
+	if limit := _q.ctx.Limit; limit != nil {
 		selector.Limit(*limit)
 	}
 	return selector
@@ -437,90 +438,88 @@ func (oq *OAuth2ClientQuery) sqlQuery(ctx context.Context) *sql.Selector {
 
 // OAuth2ClientGroupBy is the group-by builder for OAuth2Client entities.
 type OAuth2ClientGroupBy struct {
-	config
 	selector
-	fields []string
-	fns    []AggregateFunc
-	// intermediate query (i.e. traversal path).
-	sql  *sql.Selector
-	path func(context.Context) (*sql.Selector, error)
+	build *OAuth2ClientQuery
 }
 
 // Aggregate adds the given aggregation functions to the group-by query.
-func (ogb *OAuth2ClientGroupBy) Aggregate(fns ...AggregateFunc) *OAuth2ClientGroupBy {
-	ogb.fns = append(ogb.fns, fns...)
-	return ogb
+func (_g *OAuth2ClientGroupBy) Aggregate(fns ...AggregateFunc) *OAuth2ClientGroupBy {
+	_g.fns = append(_g.fns, fns...)
+	return _g
 }
 
-// Scan applies the group-by query and scans the result into the given value.
-func (ogb *OAuth2ClientGroupBy) Scan(ctx context.Context, v interface{}) error {
-	query, err := ogb.path(ctx)
-	if err != nil {
+// Scan applies the selector query and scans the result into the given value.
+func (_g *OAuth2ClientGroupBy) Scan(ctx context.Context, v any) error {
+	ctx = setContextOp(ctx, _g.build.ctx, ent.OpQueryGroupBy)
+	if err := _g.build.prepareQuery(ctx); err != nil {
 		return err
 	}
-	ogb.sql = query
-	return ogb.sqlScan(ctx, v)
+	return scanWithInterceptors[*OAuth2ClientQuery, *OAuth2ClientGroupBy](ctx, _g.build, _g, _g.build.inters, v)
 }
 
-func (ogb *OAuth2ClientGroupBy) sqlScan(ctx context.Context, v interface{}) error {
-	for _, f := range ogb.fields {
-		if !oauth2client.ValidColumn(f) {
-			return &ValidationError{Name: f, err: fmt.Errorf("invalid field %q for group-by", f)}
+func (_g *OAuth2ClientGroupBy) sqlScan(ctx context.Context, root *OAuth2ClientQuery, v any) error {
+	selector := root.sqlQuery(ctx).Select()
+	aggregation := make([]string, 0, len(_g.fns))
+	for _, fn := range _g.fns {
+		aggregation = append(aggregation, fn(selector))
+	}
+	if len(selector.SelectedColumns()) == 0 {
+		columns := make([]string, 0, len(*_g.flds)+len(_g.fns))
+		for _, f := range *_g.flds {
+			columns = append(columns, selector.C(f))
 		}
+		columns = append(columns, aggregation...)
+		selector.Select(columns...)
 	}
-	selector := ogb.sqlQuery()
+	selector.GroupBy(selector.Columns(*_g.flds...)...)
 	if err := selector.Err(); err != nil {
 		return err
 	}
 	rows := &sql.Rows{}
 	query, args := selector.Query()
-	if err := ogb.driver.Query(ctx, query, args, rows); err != nil {
+	if err := _g.build.driver.Query(ctx, query, args, rows); err != nil {
 		return err
 	}
 	defer rows.Close()
 	return sql.ScanSlice(rows, v)
 }
 
-func (ogb *OAuth2ClientGroupBy) sqlQuery() *sql.Selector {
-	selector := ogb.sql.Select()
-	aggregation := make([]string, 0, len(ogb.fns))
-	for _, fn := range ogb.fns {
-		aggregation = append(aggregation, fn(selector))
-	}
-	// If no columns were selected in a custom aggregation function, the default
-	// selection is the fields used for "group-by", and the aggregation functions.
-	if len(selector.SelectedColumns()) == 0 {
-		columns := make([]string, 0, len(ogb.fields)+len(ogb.fns))
-		for _, f := range ogb.fields {
-			columns = append(columns, selector.C(f))
-		}
-		columns = append(columns, aggregation...)
-		selector.Select(columns...)
-	}
-	return selector.GroupBy(selector.Columns(ogb.fields...)...)
-}
-
 // OAuth2ClientSelect is the builder for selecting fields of OAuth2Client entities.
 type OAuth2ClientSelect struct {
 	*OAuth2ClientQuery
 	selector
-	// intermediate query (i.e. traversal path).
-	sql *sql.Selector
+}
+
+// Aggregate adds the given aggregation functions to the selector query.
+func (_s *OAuth2ClientSelect) Aggregate(fns ...AggregateFunc) *OAuth2ClientSelect {
+	_s.fns = append(_s.fns, fns...)
+	return _s
 }
 
 // Scan applies the selector query and scans the result into the given value.
-func (os *OAuth2ClientSelect) Scan(ctx context.Context, v interface{}) error {
-	if err := os.prepareQuery(ctx); err != nil {
+func (_s *OAuth2ClientSelect) Scan(ctx context.Context, v any) error {
+	ctx = setContextOp(ctx, _s.ctx, ent.OpQuerySelect)
+	if err := _s.prepareQuery(ctx); err != nil {
 		return err
 	}
-	os.sql = os.OAuth2ClientQuery.sqlQuery(ctx)
-	return os.sqlScan(ctx, v)
+	return scanWithInterceptors[*OAuth2ClientQuery, *OAuth2ClientSelect](ctx, _s.OAuth2ClientQuery, _s, _s.inters, v)
 }
 
-func (os *OAuth2ClientSelect) sqlScan(ctx context.Context, v interface{}) error {
+func (_s *OAuth2ClientSelect) sqlScan(ctx context.Context, root *OAuth2ClientQuery, v any) error {
+	selector := root.sqlQuery(ctx)
+	aggregation := make([]string, 0, len(_s.fns))
+	for _, fn := range _s.fns {
+		aggregation = append(aggregation, fn(selector))
+	}
+	switch n := len(*_s.selector.flds); {
+	case n == 0 && len(aggregation) > 0:
+		selector.Select(aggregation...)
+	case n != 0 && len(aggregation) > 0:
+		selector.AppendSelect(aggregation...)
+	}
 	rows := &sql.Rows{}
-	query, args := os.sql.Query()
-	if err := os.driver.Query(ctx, query, args, rows); err != nil {
+	query, args := selector.Query()
+	if err := _s.driver.Query(ctx, query, args, rows); err != nil {
 		return err
 	}
 	defer rows.Close()
diff --git a/storage/ent/db/oauth2client_update.go b/storage/ent/db/oauth2client_update.go
index aeddbba63c..c80d2f5603 100644
--- a/storage/ent/db/oauth2client_update.go
+++ b/storage/ent/db/oauth2client_update.go
@@ -9,7 +9,9 @@ import (
 
 	"entgo.io/ent/dialect/sql"
 	"entgo.io/ent/dialect/sql/sqlgraph"
+	"entgo.io/ent/dialect/sql/sqljson"
 	"entgo.io/ent/schema/field"
+	"github.com/dexidp/dex/storage"
 	"github.com/dexidp/dex/storage/ent/db/oauth2client"
 	"github.com/dexidp/dex/storage/ent/db/predicate"
 )
@@ -22,105 +24,240 @@ type OAuth2ClientUpdate struct {
 }
 
 // Where appends a list predicates to the OAuth2ClientUpdate builder.
-func (ou *OAuth2ClientUpdate) Where(ps ...predicate.OAuth2Client) *OAuth2ClientUpdate {
-	ou.mutation.Where(ps...)
-	return ou
+func (_u *OAuth2ClientUpdate) Where(ps ...predicate.OAuth2Client) *OAuth2ClientUpdate {
+	_u.mutation.Where(ps...)
+	return _u
 }
 
 // SetSecret sets the "secret" field.
-func (ou *OAuth2ClientUpdate) SetSecret(s string) *OAuth2ClientUpdate {
-	ou.mutation.SetSecret(s)
-	return ou
+func (_u *OAuth2ClientUpdate) SetSecret(v string) *OAuth2ClientUpdate {
+	_u.mutation.SetSecret(v)
+	return _u
+}
+
+// SetNillableSecret sets the "secret" field if the given value is not nil.
+func (_u *OAuth2ClientUpdate) SetNillableSecret(v *string) *OAuth2ClientUpdate {
+	if v != nil {
+		_u.SetSecret(*v)
+	}
+	return _u
 }
 
 // SetRedirectUris sets the "redirect_uris" field.
-func (ou *OAuth2ClientUpdate) SetRedirectUris(s []string) *OAuth2ClientUpdate {
-	ou.mutation.SetRedirectUris(s)
-	return ou
+func (_u *OAuth2ClientUpdate) SetRedirectUris(v []string) *OAuth2ClientUpdate {
+	_u.mutation.SetRedirectUris(v)
+	return _u
+}
+
+// AppendRedirectUris appends value to the "redirect_uris" field.
+func (_u *OAuth2ClientUpdate) AppendRedirectUris(v []string) *OAuth2ClientUpdate {
+	_u.mutation.AppendRedirectUris(v)
+	return _u
 }
 
 // ClearRedirectUris clears the value of the "redirect_uris" field.
-func (ou *OAuth2ClientUpdate) ClearRedirectUris() *OAuth2ClientUpdate {
-	ou.mutation.ClearRedirectUris()
-	return ou
+func (_u *OAuth2ClientUpdate) ClearRedirectUris() *OAuth2ClientUpdate {
+	_u.mutation.ClearRedirectUris()
+	return _u
 }
 
 // SetTrustedPeers sets the "trusted_peers" field.
-func (ou *OAuth2ClientUpdate) SetTrustedPeers(s []string) *OAuth2ClientUpdate {
-	ou.mutation.SetTrustedPeers(s)
-	return ou
+func (_u *OAuth2ClientUpdate) SetTrustedPeers(v []string) *OAuth2ClientUpdate {
+	_u.mutation.SetTrustedPeers(v)
+	return _u
+}
+
+// AppendTrustedPeers appends value to the "trusted_peers" field.
+func (_u *OAuth2ClientUpdate) AppendTrustedPeers(v []string) *OAuth2ClientUpdate {
+	_u.mutation.AppendTrustedPeers(v)
+	return _u
 }
 
 // ClearTrustedPeers clears the value of the "trusted_peers" field.
-func (ou *OAuth2ClientUpdate) ClearTrustedPeers() *OAuth2ClientUpdate {
-	ou.mutation.ClearTrustedPeers()
-	return ou
+func (_u *OAuth2ClientUpdate) ClearTrustedPeers() *OAuth2ClientUpdate {
+	_u.mutation.ClearTrustedPeers()
+	return _u
 }
 
 // SetPublic sets the "public" field.
-func (ou *OAuth2ClientUpdate) SetPublic(b bool) *OAuth2ClientUpdate {
-	ou.mutation.SetPublic(b)
-	return ou
+func (_u *OAuth2ClientUpdate) SetPublic(v bool) *OAuth2ClientUpdate {
+	_u.mutation.SetPublic(v)
+	return _u
+}
+
+// SetNillablePublic sets the "public" field if the given value is not nil.
+func (_u *OAuth2ClientUpdate) SetNillablePublic(v *bool) *OAuth2ClientUpdate {
+	if v != nil {
+		_u.SetPublic(*v)
+	}
+	return _u
 }
 
 // SetName sets the "name" field.
-func (ou *OAuth2ClientUpdate) SetName(s string) *OAuth2ClientUpdate {
-	ou.mutation.SetName(s)
-	return ou
+func (_u *OAuth2ClientUpdate) SetName(v string) *OAuth2ClientUpdate {
+	_u.mutation.SetName(v)
+	return _u
+}
+
+// SetNillableName sets the "name" field if the given value is not nil.
+func (_u *OAuth2ClientUpdate) SetNillableName(v *string) *OAuth2ClientUpdate {
+	if v != nil {
+		_u.SetName(*v)
+	}
+	return _u
 }
 
 // SetLogoURL sets the "logo_url" field.
-func (ou *OAuth2ClientUpdate) SetLogoURL(s string) *OAuth2ClientUpdate {
-	ou.mutation.SetLogoURL(s)
-	return ou
+func (_u *OAuth2ClientUpdate) SetLogoURL(v string) *OAuth2ClientUpdate {
+	_u.mutation.SetLogoURL(v)
+	return _u
+}
+
+// SetNillableLogoURL sets the "logo_url" field if the given value is not nil.
+func (_u *OAuth2ClientUpdate) SetNillableLogoURL(v *string) *OAuth2ClientUpdate {
+	if v != nil {
+		_u.SetLogoURL(*v)
+	}
+	return _u
+}
+
+// SetAllowedConnectors sets the "allowed_connectors" field.
+func (_u *OAuth2ClientUpdate) SetAllowedConnectors(v []string) *OAuth2ClientUpdate {
+	_u.mutation.SetAllowedConnectors(v)
+	return _u
+}
+
+// AppendAllowedConnectors appends value to the "allowed_connectors" field.
+func (_u *OAuth2ClientUpdate) AppendAllowedConnectors(v []string) *OAuth2ClientUpdate {
+	_u.mutation.AppendAllowedConnectors(v)
+	return _u
+}
+
+// ClearAllowedConnectors clears the value of the "allowed_connectors" field.
+func (_u *OAuth2ClientUpdate) ClearAllowedConnectors() *OAuth2ClientUpdate {
+	_u.mutation.ClearAllowedConnectors()
+	return _u
+}
+
+// SetMfaChain sets the "mfa_chain" field.
+func (_u *OAuth2ClientUpdate) SetMfaChain(v []string) *OAuth2ClientUpdate {
+	_u.mutation.SetMfaChain(v)
+	return _u
+}
+
+// AppendMfaChain appends value to the "mfa_chain" field.
+func (_u *OAuth2ClientUpdate) AppendMfaChain(v []string) *OAuth2ClientUpdate {
+	_u.mutation.AppendMfaChain(v)
+	return _u
+}
+
+// ClearMfaChain clears the value of the "mfa_chain" field.
+func (_u *OAuth2ClientUpdate) ClearMfaChain() *OAuth2ClientUpdate {
+	_u.mutation.ClearMfaChain()
+	return _u
+}
+
+// SetPostLogoutRedirectUris sets the "post_logout_redirect_uris" field.
+func (_u *OAuth2ClientUpdate) SetPostLogoutRedirectUris(v []string) *OAuth2ClientUpdate {
+	_u.mutation.SetPostLogoutRedirectUris(v)
+	return _u
+}
+
+// AppendPostLogoutRedirectUris appends value to the "post_logout_redirect_uris" field.
+func (_u *OAuth2ClientUpdate) AppendPostLogoutRedirectUris(v []string) *OAuth2ClientUpdate {
+	_u.mutation.AppendPostLogoutRedirectUris(v)
+	return _u
+}
+
+// ClearPostLogoutRedirectUris clears the value of the "post_logout_redirect_uris" field.
+func (_u *OAuth2ClientUpdate) ClearPostLogoutRedirectUris() *OAuth2ClientUpdate {
+	_u.mutation.ClearPostLogoutRedirectUris()
+	return _u
+}
+
+// SetSSOSharedWith sets the "sso_shared_with" field.
+func (_u *OAuth2ClientUpdate) SetSSOSharedWith(v []string) *OAuth2ClientUpdate {
+	_u.mutation.SetSSOSharedWith(v)
+	return _u
+}
+
+// AppendSSOSharedWith appends value to the "sso_shared_with" field.
+func (_u *OAuth2ClientUpdate) AppendSSOSharedWith(v []string) *OAuth2ClientUpdate {
+	_u.mutation.AppendSSOSharedWith(v)
+	return _u
+}
+
+// ClearSSOSharedWith clears the value of the "sso_shared_with" field.
+func (_u *OAuth2ClientUpdate) ClearSSOSharedWith() *OAuth2ClientUpdate {
+	_u.mutation.ClearSSOSharedWith()
+	return _u
+}
+
+// SetBackchannelLogoutURI sets the "backchannel_logout_uri" field.
+func (_u *OAuth2ClientUpdate) SetBackchannelLogoutURI(v string) *OAuth2ClientUpdate {
+	_u.mutation.SetBackchannelLogoutURI(v)
+	return _u
+}
+
+// SetNillableBackchannelLogoutURI sets the "backchannel_logout_uri" field if the given value is not nil.
+func (_u *OAuth2ClientUpdate) SetNillableBackchannelLogoutURI(v *string) *OAuth2ClientUpdate {
+	if v != nil {
+		_u.SetBackchannelLogoutURI(*v)
+	}
+	return _u
+}
+
+// ClearBackchannelLogoutURI clears the value of the "backchannel_logout_uri" field.
+func (_u *OAuth2ClientUpdate) ClearBackchannelLogoutURI() *OAuth2ClientUpdate {
+	_u.mutation.ClearBackchannelLogoutURI()
+	return _u
+}
+
+// SetRefreshTokenLifetime sets the "refresh_token_lifetime" field.
+func (_u *OAuth2ClientUpdate) SetRefreshTokenLifetime(v string) *OAuth2ClientUpdate {
+	_u.mutation.SetRefreshTokenLifetime(v)
+	return _u
+}
+
+// SetNillableRefreshTokenLifetime sets the "refresh_token_lifetime" field if the given value is not nil.
+func (_u *OAuth2ClientUpdate) SetNillableRefreshTokenLifetime(v *string) *OAuth2ClientUpdate {
+	if v != nil {
+		_u.SetRefreshTokenLifetime(*v)
+	}
+	return _u
+}
+
+// ClearRefreshTokenLifetime clears the value of the "refresh_token_lifetime" field.
+func (_u *OAuth2ClientUpdate) ClearRefreshTokenLifetime() *OAuth2ClientUpdate {
+	_u.mutation.ClearRefreshTokenLifetime()
+	return _u
+}
+
+// SetClientCredentialsClaims sets the "client_credentials_claims" field.
+func (_u *OAuth2ClientUpdate) SetClientCredentialsClaims(v *storage.ClientCredentialsClaims) *OAuth2ClientUpdate {
+	_u.mutation.SetClientCredentialsClaims(v)
+	return _u
+}
+
+// ClearClientCredentialsClaims clears the value of the "client_credentials_claims" field.
+func (_u *OAuth2ClientUpdate) ClearClientCredentialsClaims() *OAuth2ClientUpdate {
+	_u.mutation.ClearClientCredentialsClaims()
+	return _u
 }
 
 // Mutation returns the OAuth2ClientMutation object of the builder.
-func (ou *OAuth2ClientUpdate) Mutation() *OAuth2ClientMutation {
-	return ou.mutation
+func (_u *OAuth2ClientUpdate) Mutation() *OAuth2ClientMutation {
+	return _u.mutation
 }
 
 // Save executes the query and returns the number of nodes affected by the update operation.
-func (ou *OAuth2ClientUpdate) Save(ctx context.Context) (int, error) {
-	var (
-		err      error
-		affected int
-	)
-	if len(ou.hooks) == 0 {
-		if err = ou.check(); err != nil {
-			return 0, err
-		}
-		affected, err = ou.sqlSave(ctx)
-	} else {
-		var mut Mutator = MutateFunc(func(ctx context.Context, m Mutation) (Value, error) {
-			mutation, ok := m.(*OAuth2ClientMutation)
-			if !ok {
-				return nil, fmt.Errorf("unexpected mutation type %T", m)
-			}
-			if err = ou.check(); err != nil {
-				return 0, err
-			}
-			ou.mutation = mutation
-			affected, err = ou.sqlSave(ctx)
-			mutation.done = true
-			return affected, err
-		})
-		for i := len(ou.hooks) - 1; i >= 0; i-- {
-			if ou.hooks[i] == nil {
-				return 0, fmt.Errorf("db: uninitialized hook (forgotten import db/runtime?)")
-			}
-			mut = ou.hooks[i](mut)
-		}
-		if _, err := mut.Mutate(ctx, ou.mutation); err != nil {
-			return 0, err
-		}
-	}
-	return affected, err
+func (_u *OAuth2ClientUpdate) Save(ctx context.Context) (int, error) {
+	return withHooks(ctx, _u.sqlSave, _u.mutation, _u.hooks)
 }
 
 // SaveX is like Save, but panics if an error occurs.
-func (ou *OAuth2ClientUpdate) SaveX(ctx context.Context) int {
-	affected, err := ou.Save(ctx)
+func (_u *OAuth2ClientUpdate) SaveX(ctx context.Context) int {
+	affected, err := _u.Save(ctx)
 	if err != nil {
 		panic(err)
 	}
@@ -128,31 +265,31 @@ func (ou *OAuth2ClientUpdate) SaveX(ctx context.Context) int {
 }
 
 // Exec executes the query.
-func (ou *OAuth2ClientUpdate) Exec(ctx context.Context) error {
-	_, err := ou.Save(ctx)
+func (_u *OAuth2ClientUpdate) Exec(ctx context.Context) error {
+	_, err := _u.Save(ctx)
 	return err
 }
 
 // ExecX is like Exec, but panics if an error occurs.
-func (ou *OAuth2ClientUpdate) ExecX(ctx context.Context) {
-	if err := ou.Exec(ctx); err != nil {
+func (_u *OAuth2ClientUpdate) ExecX(ctx context.Context) {
+	if err := _u.Exec(ctx); err != nil {
 		panic(err)
 	}
 }
 
 // check runs all checks and user-defined validators on the builder.
-func (ou *OAuth2ClientUpdate) check() error {
-	if v, ok := ou.mutation.Secret(); ok {
+func (_u *OAuth2ClientUpdate) check() error {
+	if v, ok := _u.mutation.Secret(); ok {
 		if err := oauth2client.SecretValidator(v); err != nil {
 			return &ValidationError{Name: "secret", err: fmt.Errorf(`db: validator failed for field "OAuth2Client.secret": %w`, err)}
 		}
 	}
-	if v, ok := ou.mutation.Name(); ok {
+	if v, ok := _u.mutation.Name(); ok {
 		if err := oauth2client.NameValidator(v); err != nil {
 			return &ValidationError{Name: "name", err: fmt.Errorf(`db: validator failed for field "OAuth2Client.name": %w`, err)}
 		}
 	}
-	if v, ok := ou.mutation.LogoURL(); ok {
+	if v, ok := _u.mutation.LogoURL(); ok {
 		if err := oauth2client.LogoURLValidator(v); err != nil {
 			return &ValidationError{Name: "logo_url", err: fmt.Errorf(`db: validator failed for field "OAuth2Client.logo_url": %w`, err)}
 		}
@@ -160,79 +297,115 @@ func (ou *OAuth2ClientUpdate) check() error {
 	return nil
 }
 
-func (ou *OAuth2ClientUpdate) sqlSave(ctx context.Context) (n int, err error) {
-	_spec := &sqlgraph.UpdateSpec{
-		Node: &sqlgraph.NodeSpec{
-			Table:   oauth2client.Table,
-			Columns: oauth2client.Columns,
-			ID: &sqlgraph.FieldSpec{
-				Type:   field.TypeString,
-				Column: oauth2client.FieldID,
-			},
-		},
+func (_u *OAuth2ClientUpdate) sqlSave(ctx context.Context) (_node int, err error) {
+	if err := _u.check(); err != nil {
+		return _node, err
 	}
-	if ps := ou.mutation.predicates; len(ps) > 0 {
+	_spec := sqlgraph.NewUpdateSpec(oauth2client.Table, oauth2client.Columns, sqlgraph.NewFieldSpec(oauth2client.FieldID, field.TypeString))
+	if ps := _u.mutation.predicates; len(ps) > 0 {
 		_spec.Predicate = func(selector *sql.Selector) {
 			for i := range ps {
 				ps[i](selector)
 			}
 		}
 	}
-	if value, ok := ou.mutation.Secret(); ok {
-		_spec.Fields.Set = append(_spec.Fields.Set, &sqlgraph.FieldSpec{
-			Type:   field.TypeString,
-			Value:  value,
-			Column: oauth2client.FieldSecret,
-		})
+	if value, ok := _u.mutation.Secret(); ok {
+		_spec.SetField(oauth2client.FieldSecret, field.TypeString, value)
 	}
-	if value, ok := ou.mutation.RedirectUris(); ok {
-		_spec.Fields.Set = append(_spec.Fields.Set, &sqlgraph.FieldSpec{
-			Type:   field.TypeJSON,
-			Value:  value,
-			Column: oauth2client.FieldRedirectUris,
-		})
+	if value, ok := _u.mutation.RedirectUris(); ok {
+		_spec.SetField(oauth2client.FieldRedirectUris, field.TypeJSON, value)
 	}
-	if ou.mutation.RedirectUrisCleared() {
-		_spec.Fields.Clear = append(_spec.Fields.Clear, &sqlgraph.FieldSpec{
-			Type:   field.TypeJSON,
-			Column: oauth2client.FieldRedirectUris,
+	if value, ok := _u.mutation.AppendedRedirectUris(); ok {
+		_spec.AddModifier(func(u *sql.UpdateBuilder) {
+			sqljson.Append(u, oauth2client.FieldRedirectUris, value)
 		})
 	}
-	if value, ok := ou.mutation.TrustedPeers(); ok {
-		_spec.Fields.Set = append(_spec.Fields.Set, &sqlgraph.FieldSpec{
-			Type:   field.TypeJSON,
-			Value:  value,
-			Column: oauth2client.FieldTrustedPeers,
+	if _u.mutation.RedirectUrisCleared() {
+		_spec.ClearField(oauth2client.FieldRedirectUris, field.TypeJSON)
+	}
+	if value, ok := _u.mutation.TrustedPeers(); ok {
+		_spec.SetField(oauth2client.FieldTrustedPeers, field.TypeJSON, value)
+	}
+	if value, ok := _u.mutation.AppendedTrustedPeers(); ok {
+		_spec.AddModifier(func(u *sql.UpdateBuilder) {
+			sqljson.Append(u, oauth2client.FieldTrustedPeers, value)
 		})
 	}
-	if ou.mutation.TrustedPeersCleared() {
-		_spec.Fields.Clear = append(_spec.Fields.Clear, &sqlgraph.FieldSpec{
-			Type:   field.TypeJSON,
-			Column: oauth2client.FieldTrustedPeers,
+	if _u.mutation.TrustedPeersCleared() {
+		_spec.ClearField(oauth2client.FieldTrustedPeers, field.TypeJSON)
+	}
+	if value, ok := _u.mutation.Public(); ok {
+		_spec.SetField(oauth2client.FieldPublic, field.TypeBool, value)
+	}
+	if value, ok := _u.mutation.Name(); ok {
+		_spec.SetField(oauth2client.FieldName, field.TypeString, value)
+	}
+	if value, ok := _u.mutation.LogoURL(); ok {
+		_spec.SetField(oauth2client.FieldLogoURL, field.TypeString, value)
+	}
+	if value, ok := _u.mutation.AllowedConnectors(); ok {
+		_spec.SetField(oauth2client.FieldAllowedConnectors, field.TypeJSON, value)
+	}
+	if value, ok := _u.mutation.AppendedAllowedConnectors(); ok {
+		_spec.AddModifier(func(u *sql.UpdateBuilder) {
+			sqljson.Append(u, oauth2client.FieldAllowedConnectors, value)
 		})
 	}
-	if value, ok := ou.mutation.Public(); ok {
-		_spec.Fields.Set = append(_spec.Fields.Set, &sqlgraph.FieldSpec{
-			Type:   field.TypeBool,
-			Value:  value,
-			Column: oauth2client.FieldPublic,
+	if _u.mutation.AllowedConnectorsCleared() {
+		_spec.ClearField(oauth2client.FieldAllowedConnectors, field.TypeJSON)
+	}
+	if value, ok := _u.mutation.MfaChain(); ok {
+		_spec.SetField(oauth2client.FieldMfaChain, field.TypeJSON, value)
+	}
+	if value, ok := _u.mutation.AppendedMfaChain(); ok {
+		_spec.AddModifier(func(u *sql.UpdateBuilder) {
+			sqljson.Append(u, oauth2client.FieldMfaChain, value)
 		})
 	}
-	if value, ok := ou.mutation.Name(); ok {
-		_spec.Fields.Set = append(_spec.Fields.Set, &sqlgraph.FieldSpec{
-			Type:   field.TypeString,
-			Value:  value,
-			Column: oauth2client.FieldName,
+	if _u.mutation.MfaChainCleared() {
+		_spec.ClearField(oauth2client.FieldMfaChain, field.TypeJSON)
+	}
+	if value, ok := _u.mutation.PostLogoutRedirectUris(); ok {
+		_spec.SetField(oauth2client.FieldPostLogoutRedirectUris, field.TypeJSON, value)
+	}
+	if value, ok := _u.mutation.AppendedPostLogoutRedirectUris(); ok {
+		_spec.AddModifier(func(u *sql.UpdateBuilder) {
+			sqljson.Append(u, oauth2client.FieldPostLogoutRedirectUris, value)
 		})
 	}
-	if value, ok := ou.mutation.LogoURL(); ok {
-		_spec.Fields.Set = append(_spec.Fields.Set, &sqlgraph.FieldSpec{
-			Type:   field.TypeString,
-			Value:  value,
-			Column: oauth2client.FieldLogoURL,
+	if _u.mutation.PostLogoutRedirectUrisCleared() {
+		_spec.ClearField(oauth2client.FieldPostLogoutRedirectUris, field.TypeJSON)
+	}
+	if value, ok := _u.mutation.SSOSharedWith(); ok {
+		_spec.SetField(oauth2client.FieldSSOSharedWith, field.TypeJSON, value)
+	}
+	if value, ok := _u.mutation.AppendedSSOSharedWith(); ok {
+		_spec.AddModifier(func(u *sql.UpdateBuilder) {
+			sqljson.Append(u, oauth2client.FieldSSOSharedWith, value)
 		})
 	}
-	if n, err = sqlgraph.UpdateNodes(ctx, ou.driver, _spec); err != nil {
+	if _u.mutation.SSOSharedWithCleared() {
+		_spec.ClearField(oauth2client.FieldSSOSharedWith, field.TypeJSON)
+	}
+	if value, ok := _u.mutation.BackchannelLogoutURI(); ok {
+		_spec.SetField(oauth2client.FieldBackchannelLogoutURI, field.TypeString, value)
+	}
+	if _u.mutation.BackchannelLogoutURICleared() {
+		_spec.ClearField(oauth2client.FieldBackchannelLogoutURI, field.TypeString)
+	}
+	if value, ok := _u.mutation.RefreshTokenLifetime(); ok {
+		_spec.SetField(oauth2client.FieldRefreshTokenLifetime, field.TypeString, value)
+	}
+	if _u.mutation.RefreshTokenLifetimeCleared() {
+		_spec.ClearField(oauth2client.FieldRefreshTokenLifetime, field.TypeString)
+	}
+	if value, ok := _u.mutation.ClientCredentialsClaims(); ok {
+		_spec.SetField(oauth2client.FieldClientCredentialsClaims, field.TypeJSON, value)
+	}
+	if _u.mutation.ClientCredentialsClaimsCleared() {
+		_spec.ClearField(oauth2client.FieldClientCredentialsClaims, field.TypeJSON)
+	}
+	if _node, err = sqlgraph.UpdateNodes(ctx, _u.driver, _spec); err != nil {
 		if _, ok := err.(*sqlgraph.NotFoundError); ok {
 			err = &NotFoundError{oauth2client.Label}
 		} else if sqlgraph.IsConstraintError(err) {
@@ -240,7 +413,8 @@ func (ou *OAuth2ClientUpdate) sqlSave(ctx context.Context) (n int, err error) {
 		}
 		return 0, err
 	}
-	return n, nil
+	_u.mutation.done = true
+	return _node, nil
 }
 
 // OAuth2ClientUpdateOne is the builder for updating a single OAuth2Client entity.
@@ -252,112 +426,247 @@ type OAuth2ClientUpdateOne struct {
 }
 
 // SetSecret sets the "secret" field.
-func (ouo *OAuth2ClientUpdateOne) SetSecret(s string) *OAuth2ClientUpdateOne {
-	ouo.mutation.SetSecret(s)
-	return ouo
+func (_u *OAuth2ClientUpdateOne) SetSecret(v string) *OAuth2ClientUpdateOne {
+	_u.mutation.SetSecret(v)
+	return _u
+}
+
+// SetNillableSecret sets the "secret" field if the given value is not nil.
+func (_u *OAuth2ClientUpdateOne) SetNillableSecret(v *string) *OAuth2ClientUpdateOne {
+	if v != nil {
+		_u.SetSecret(*v)
+	}
+	return _u
 }
 
 // SetRedirectUris sets the "redirect_uris" field.
-func (ouo *OAuth2ClientUpdateOne) SetRedirectUris(s []string) *OAuth2ClientUpdateOne {
-	ouo.mutation.SetRedirectUris(s)
-	return ouo
+func (_u *OAuth2ClientUpdateOne) SetRedirectUris(v []string) *OAuth2ClientUpdateOne {
+	_u.mutation.SetRedirectUris(v)
+	return _u
+}
+
+// AppendRedirectUris appends value to the "redirect_uris" field.
+func (_u *OAuth2ClientUpdateOne) AppendRedirectUris(v []string) *OAuth2ClientUpdateOne {
+	_u.mutation.AppendRedirectUris(v)
+	return _u
 }
 
 // ClearRedirectUris clears the value of the "redirect_uris" field.
-func (ouo *OAuth2ClientUpdateOne) ClearRedirectUris() *OAuth2ClientUpdateOne {
-	ouo.mutation.ClearRedirectUris()
-	return ouo
+func (_u *OAuth2ClientUpdateOne) ClearRedirectUris() *OAuth2ClientUpdateOne {
+	_u.mutation.ClearRedirectUris()
+	return _u
 }
 
 // SetTrustedPeers sets the "trusted_peers" field.
-func (ouo *OAuth2ClientUpdateOne) SetTrustedPeers(s []string) *OAuth2ClientUpdateOne {
-	ouo.mutation.SetTrustedPeers(s)
-	return ouo
+func (_u *OAuth2ClientUpdateOne) SetTrustedPeers(v []string) *OAuth2ClientUpdateOne {
+	_u.mutation.SetTrustedPeers(v)
+	return _u
+}
+
+// AppendTrustedPeers appends value to the "trusted_peers" field.
+func (_u *OAuth2ClientUpdateOne) AppendTrustedPeers(v []string) *OAuth2ClientUpdateOne {
+	_u.mutation.AppendTrustedPeers(v)
+	return _u
 }
 
 // ClearTrustedPeers clears the value of the "trusted_peers" field.
-func (ouo *OAuth2ClientUpdateOne) ClearTrustedPeers() *OAuth2ClientUpdateOne {
-	ouo.mutation.ClearTrustedPeers()
-	return ouo
+func (_u *OAuth2ClientUpdateOne) ClearTrustedPeers() *OAuth2ClientUpdateOne {
+	_u.mutation.ClearTrustedPeers()
+	return _u
 }
 
 // SetPublic sets the "public" field.
-func (ouo *OAuth2ClientUpdateOne) SetPublic(b bool) *OAuth2ClientUpdateOne {
-	ouo.mutation.SetPublic(b)
-	return ouo
+func (_u *OAuth2ClientUpdateOne) SetPublic(v bool) *OAuth2ClientUpdateOne {
+	_u.mutation.SetPublic(v)
+	return _u
+}
+
+// SetNillablePublic sets the "public" field if the given value is not nil.
+func (_u *OAuth2ClientUpdateOne) SetNillablePublic(v *bool) *OAuth2ClientUpdateOne {
+	if v != nil {
+		_u.SetPublic(*v)
+	}
+	return _u
 }
 
 // SetName sets the "name" field.
-func (ouo *OAuth2ClientUpdateOne) SetName(s string) *OAuth2ClientUpdateOne {
-	ouo.mutation.SetName(s)
-	return ouo
+func (_u *OAuth2ClientUpdateOne) SetName(v string) *OAuth2ClientUpdateOne {
+	_u.mutation.SetName(v)
+	return _u
+}
+
+// SetNillableName sets the "name" field if the given value is not nil.
+func (_u *OAuth2ClientUpdateOne) SetNillableName(v *string) *OAuth2ClientUpdateOne {
+	if v != nil {
+		_u.SetName(*v)
+	}
+	return _u
 }
 
 // SetLogoURL sets the "logo_url" field.
-func (ouo *OAuth2ClientUpdateOne) SetLogoURL(s string) *OAuth2ClientUpdateOne {
-	ouo.mutation.SetLogoURL(s)
-	return ouo
+func (_u *OAuth2ClientUpdateOne) SetLogoURL(v string) *OAuth2ClientUpdateOne {
+	_u.mutation.SetLogoURL(v)
+	return _u
+}
+
+// SetNillableLogoURL sets the "logo_url" field if the given value is not nil.
+func (_u *OAuth2ClientUpdateOne) SetNillableLogoURL(v *string) *OAuth2ClientUpdateOne {
+	if v != nil {
+		_u.SetLogoURL(*v)
+	}
+	return _u
+}
+
+// SetAllowedConnectors sets the "allowed_connectors" field.
+func (_u *OAuth2ClientUpdateOne) SetAllowedConnectors(v []string) *OAuth2ClientUpdateOne {
+	_u.mutation.SetAllowedConnectors(v)
+	return _u
+}
+
+// AppendAllowedConnectors appends value to the "allowed_connectors" field.
+func (_u *OAuth2ClientUpdateOne) AppendAllowedConnectors(v []string) *OAuth2ClientUpdateOne {
+	_u.mutation.AppendAllowedConnectors(v)
+	return _u
+}
+
+// ClearAllowedConnectors clears the value of the "allowed_connectors" field.
+func (_u *OAuth2ClientUpdateOne) ClearAllowedConnectors() *OAuth2ClientUpdateOne {
+	_u.mutation.ClearAllowedConnectors()
+	return _u
+}
+
+// SetMfaChain sets the "mfa_chain" field.
+func (_u *OAuth2ClientUpdateOne) SetMfaChain(v []string) *OAuth2ClientUpdateOne {
+	_u.mutation.SetMfaChain(v)
+	return _u
+}
+
+// AppendMfaChain appends value to the "mfa_chain" field.
+func (_u *OAuth2ClientUpdateOne) AppendMfaChain(v []string) *OAuth2ClientUpdateOne {
+	_u.mutation.AppendMfaChain(v)
+	return _u
+}
+
+// ClearMfaChain clears the value of the "mfa_chain" field.
+func (_u *OAuth2ClientUpdateOne) ClearMfaChain() *OAuth2ClientUpdateOne {
+	_u.mutation.ClearMfaChain()
+	return _u
+}
+
+// SetPostLogoutRedirectUris sets the "post_logout_redirect_uris" field.
+func (_u *OAuth2ClientUpdateOne) SetPostLogoutRedirectUris(v []string) *OAuth2ClientUpdateOne {
+	_u.mutation.SetPostLogoutRedirectUris(v)
+	return _u
+}
+
+// AppendPostLogoutRedirectUris appends value to the "post_logout_redirect_uris" field.
+func (_u *OAuth2ClientUpdateOne) AppendPostLogoutRedirectUris(v []string) *OAuth2ClientUpdateOne {
+	_u.mutation.AppendPostLogoutRedirectUris(v)
+	return _u
+}
+
+// ClearPostLogoutRedirectUris clears the value of the "post_logout_redirect_uris" field.
+func (_u *OAuth2ClientUpdateOne) ClearPostLogoutRedirectUris() *OAuth2ClientUpdateOne {
+	_u.mutation.ClearPostLogoutRedirectUris()
+	return _u
+}
+
+// SetSSOSharedWith sets the "sso_shared_with" field.
+func (_u *OAuth2ClientUpdateOne) SetSSOSharedWith(v []string) *OAuth2ClientUpdateOne {
+	_u.mutation.SetSSOSharedWith(v)
+	return _u
+}
+
+// AppendSSOSharedWith appends value to the "sso_shared_with" field.
+func (_u *OAuth2ClientUpdateOne) AppendSSOSharedWith(v []string) *OAuth2ClientUpdateOne {
+	_u.mutation.AppendSSOSharedWith(v)
+	return _u
+}
+
+// ClearSSOSharedWith clears the value of the "sso_shared_with" field.
+func (_u *OAuth2ClientUpdateOne) ClearSSOSharedWith() *OAuth2ClientUpdateOne {
+	_u.mutation.ClearSSOSharedWith()
+	return _u
+}
+
+// SetBackchannelLogoutURI sets the "backchannel_logout_uri" field.
+func (_u *OAuth2ClientUpdateOne) SetBackchannelLogoutURI(v string) *OAuth2ClientUpdateOne {
+	_u.mutation.SetBackchannelLogoutURI(v)
+	return _u
+}
+
+// SetNillableBackchannelLogoutURI sets the "backchannel_logout_uri" field if the given value is not nil.
+func (_u *OAuth2ClientUpdateOne) SetNillableBackchannelLogoutURI(v *string) *OAuth2ClientUpdateOne {
+	if v != nil {
+		_u.SetBackchannelLogoutURI(*v)
+	}
+	return _u
+}
+
+// ClearBackchannelLogoutURI clears the value of the "backchannel_logout_uri" field.
+func (_u *OAuth2ClientUpdateOne) ClearBackchannelLogoutURI() *OAuth2ClientUpdateOne {
+	_u.mutation.ClearBackchannelLogoutURI()
+	return _u
+}
+
+// SetRefreshTokenLifetime sets the "refresh_token_lifetime" field.
+func (_u *OAuth2ClientUpdateOne) SetRefreshTokenLifetime(v string) *OAuth2ClientUpdateOne {
+	_u.mutation.SetRefreshTokenLifetime(v)
+	return _u
+}
+
+// SetNillableRefreshTokenLifetime sets the "refresh_token_lifetime" field if the given value is not nil.
+func (_u *OAuth2ClientUpdateOne) SetNillableRefreshTokenLifetime(v *string) *OAuth2ClientUpdateOne {
+	if v != nil {
+		_u.SetRefreshTokenLifetime(*v)
+	}
+	return _u
+}
+
+// ClearRefreshTokenLifetime clears the value of the "refresh_token_lifetime" field.
+func (_u *OAuth2ClientUpdateOne) ClearRefreshTokenLifetime() *OAuth2ClientUpdateOne {
+	_u.mutation.ClearRefreshTokenLifetime()
+	return _u
+}
+
+// SetClientCredentialsClaims sets the "client_credentials_claims" field.
+func (_u *OAuth2ClientUpdateOne) SetClientCredentialsClaims(v *storage.ClientCredentialsClaims) *OAuth2ClientUpdateOne {
+	_u.mutation.SetClientCredentialsClaims(v)
+	return _u
+}
+
+// ClearClientCredentialsClaims clears the value of the "client_credentials_claims" field.
+func (_u *OAuth2ClientUpdateOne) ClearClientCredentialsClaims() *OAuth2ClientUpdateOne {
+	_u.mutation.ClearClientCredentialsClaims()
+	return _u
 }
 
 // Mutation returns the OAuth2ClientMutation object of the builder.
-func (ouo *OAuth2ClientUpdateOne) Mutation() *OAuth2ClientMutation {
-	return ouo.mutation
+func (_u *OAuth2ClientUpdateOne) Mutation() *OAuth2ClientMutation {
+	return _u.mutation
+}
+
+// Where appends a list predicates to the OAuth2ClientUpdate builder.
+func (_u *OAuth2ClientUpdateOne) Where(ps ...predicate.OAuth2Client) *OAuth2ClientUpdateOne {
+	_u.mutation.Where(ps...)
+	return _u
 }
 
 // Select allows selecting one or more fields (columns) of the returned entity.
 // The default is selecting all fields defined in the entity schema.
-func (ouo *OAuth2ClientUpdateOne) Select(field string, fields ...string) *OAuth2ClientUpdateOne {
-	ouo.fields = append([]string{field}, fields...)
-	return ouo
+func (_u *OAuth2ClientUpdateOne) Select(field string, fields ...string) *OAuth2ClientUpdateOne {
+	_u.fields = append([]string{field}, fields...)
+	return _u
 }
 
 // Save executes the query and returns the updated OAuth2Client entity.
-func (ouo *OAuth2ClientUpdateOne) Save(ctx context.Context) (*OAuth2Client, error) {
-	var (
-		err  error
-		node *OAuth2Client
-	)
-	if len(ouo.hooks) == 0 {
-		if err = ouo.check(); err != nil {
-			return nil, err
-		}
-		node, err = ouo.sqlSave(ctx)
-	} else {
-		var mut Mutator = MutateFunc(func(ctx context.Context, m Mutation) (Value, error) {
-			mutation, ok := m.(*OAuth2ClientMutation)
-			if !ok {
-				return nil, fmt.Errorf("unexpected mutation type %T", m)
-			}
-			if err = ouo.check(); err != nil {
-				return nil, err
-			}
-			ouo.mutation = mutation
-			node, err = ouo.sqlSave(ctx)
-			mutation.done = true
-			return node, err
-		})
-		for i := len(ouo.hooks) - 1; i >= 0; i-- {
-			if ouo.hooks[i] == nil {
-				return nil, fmt.Errorf("db: uninitialized hook (forgotten import db/runtime?)")
-			}
-			mut = ouo.hooks[i](mut)
-		}
-		v, err := mut.Mutate(ctx, ouo.mutation)
-		if err != nil {
-			return nil, err
-		}
-		nv, ok := v.(*OAuth2Client)
-		if !ok {
-			return nil, fmt.Errorf("unexpected node type %T returned from OAuth2ClientMutation", v)
-		}
-		node = nv
-	}
-	return node, err
+func (_u *OAuth2ClientUpdateOne) Save(ctx context.Context) (*OAuth2Client, error) {
+	return withHooks(ctx, _u.sqlSave, _u.mutation, _u.hooks)
 }
 
 // SaveX is like Save, but panics if an error occurs.
-func (ouo *OAuth2ClientUpdateOne) SaveX(ctx context.Context) *OAuth2Client {
-	node, err := ouo.Save(ctx)
+func (_u *OAuth2ClientUpdateOne) SaveX(ctx context.Context) *OAuth2Client {
+	node, err := _u.Save(ctx)
 	if err != nil {
 		panic(err)
 	}
@@ -365,31 +674,31 @@ func (ouo *OAuth2ClientUpdateOne) SaveX(ctx context.Context) *OAuth2Client {
 }
 
 // Exec executes the query on the entity.
-func (ouo *OAuth2ClientUpdateOne) Exec(ctx context.Context) error {
-	_, err := ouo.Save(ctx)
+func (_u *OAuth2ClientUpdateOne) Exec(ctx context.Context) error {
+	_, err := _u.Save(ctx)
 	return err
 }
 
 // ExecX is like Exec, but panics if an error occurs.
-func (ouo *OAuth2ClientUpdateOne) ExecX(ctx context.Context) {
-	if err := ouo.Exec(ctx); err != nil {
+func (_u *OAuth2ClientUpdateOne) ExecX(ctx context.Context) {
+	if err := _u.Exec(ctx); err != nil {
 		panic(err)
 	}
 }
 
 // check runs all checks and user-defined validators on the builder.
-func (ouo *OAuth2ClientUpdateOne) check() error {
-	if v, ok := ouo.mutation.Secret(); ok {
+func (_u *OAuth2ClientUpdateOne) check() error {
+	if v, ok := _u.mutation.Secret(); ok {
 		if err := oauth2client.SecretValidator(v); err != nil {
 			return &ValidationError{Name: "secret", err: fmt.Errorf(`db: validator failed for field "OAuth2Client.secret": %w`, err)}
 		}
 	}
-	if v, ok := ouo.mutation.Name(); ok {
+	if v, ok := _u.mutation.Name(); ok {
 		if err := oauth2client.NameValidator(v); err != nil {
 			return &ValidationError{Name: "name", err: fmt.Errorf(`db: validator failed for field "OAuth2Client.name": %w`, err)}
 		}
 	}
-	if v, ok := ouo.mutation.LogoURL(); ok {
+	if v, ok := _u.mutation.LogoURL(); ok {
 		if err := oauth2client.LogoURLValidator(v); err != nil {
 			return &ValidationError{Name: "logo_url", err: fmt.Errorf(`db: validator failed for field "OAuth2Client.logo_url": %w`, err)}
 		}
@@ -397,23 +706,17 @@ func (ouo *OAuth2ClientUpdateOne) check() error {
 	return nil
 }
 
-func (ouo *OAuth2ClientUpdateOne) sqlSave(ctx context.Context) (_node *OAuth2Client, err error) {
-	_spec := &sqlgraph.UpdateSpec{
-		Node: &sqlgraph.NodeSpec{
-			Table:   oauth2client.Table,
-			Columns: oauth2client.Columns,
-			ID: &sqlgraph.FieldSpec{
-				Type:   field.TypeString,
-				Column: oauth2client.FieldID,
-			},
-		},
+func (_u *OAuth2ClientUpdateOne) sqlSave(ctx context.Context) (_node *OAuth2Client, err error) {
+	if err := _u.check(); err != nil {
+		return _node, err
 	}
-	id, ok := ouo.mutation.ID()
+	_spec := sqlgraph.NewUpdateSpec(oauth2client.Table, oauth2client.Columns, sqlgraph.NewFieldSpec(oauth2client.FieldID, field.TypeString))
+	id, ok := _u.mutation.ID()
 	if !ok {
 		return nil, &ValidationError{Name: "id", err: errors.New(`db: missing "OAuth2Client.id" for update`)}
 	}
 	_spec.Node.ID.Value = id
-	if fields := ouo.fields; len(fields) > 0 {
+	if fields := _u.fields; len(fields) > 0 {
 		_spec.Node.Columns = make([]string, 0, len(fields))
 		_spec.Node.Columns = append(_spec.Node.Columns, oauth2client.FieldID)
 		for _, f := range fields {
@@ -425,71 +728,113 @@ func (ouo *OAuth2ClientUpdateOne) sqlSave(ctx context.Context) (_node *OAuth2Cli
 			}
 		}
 	}
-	if ps := ouo.mutation.predicates; len(ps) > 0 {
+	if ps := _u.mutation.predicates; len(ps) > 0 {
 		_spec.Predicate = func(selector *sql.Selector) {
 			for i := range ps {
 				ps[i](selector)
 			}
 		}
 	}
-	if value, ok := ouo.mutation.Secret(); ok {
-		_spec.Fields.Set = append(_spec.Fields.Set, &sqlgraph.FieldSpec{
-			Type:   field.TypeString,
-			Value:  value,
-			Column: oauth2client.FieldSecret,
-		})
+	if value, ok := _u.mutation.Secret(); ok {
+		_spec.SetField(oauth2client.FieldSecret, field.TypeString, value)
 	}
-	if value, ok := ouo.mutation.RedirectUris(); ok {
-		_spec.Fields.Set = append(_spec.Fields.Set, &sqlgraph.FieldSpec{
-			Type:   field.TypeJSON,
-			Value:  value,
-			Column: oauth2client.FieldRedirectUris,
-		})
+	if value, ok := _u.mutation.RedirectUris(); ok {
+		_spec.SetField(oauth2client.FieldRedirectUris, field.TypeJSON, value)
 	}
-	if ouo.mutation.RedirectUrisCleared() {
-		_spec.Fields.Clear = append(_spec.Fields.Clear, &sqlgraph.FieldSpec{
-			Type:   field.TypeJSON,
-			Column: oauth2client.FieldRedirectUris,
+	if value, ok := _u.mutation.AppendedRedirectUris(); ok {
+		_spec.AddModifier(func(u *sql.UpdateBuilder) {
+			sqljson.Append(u, oauth2client.FieldRedirectUris, value)
 		})
 	}
-	if value, ok := ouo.mutation.TrustedPeers(); ok {
-		_spec.Fields.Set = append(_spec.Fields.Set, &sqlgraph.FieldSpec{
-			Type:   field.TypeJSON,
-			Value:  value,
-			Column: oauth2client.FieldTrustedPeers,
+	if _u.mutation.RedirectUrisCleared() {
+		_spec.ClearField(oauth2client.FieldRedirectUris, field.TypeJSON)
+	}
+	if value, ok := _u.mutation.TrustedPeers(); ok {
+		_spec.SetField(oauth2client.FieldTrustedPeers, field.TypeJSON, value)
+	}
+	if value, ok := _u.mutation.AppendedTrustedPeers(); ok {
+		_spec.AddModifier(func(u *sql.UpdateBuilder) {
+			sqljson.Append(u, oauth2client.FieldTrustedPeers, value)
 		})
 	}
-	if ouo.mutation.TrustedPeersCleared() {
-		_spec.Fields.Clear = append(_spec.Fields.Clear, &sqlgraph.FieldSpec{
-			Type:   field.TypeJSON,
-			Column: oauth2client.FieldTrustedPeers,
+	if _u.mutation.TrustedPeersCleared() {
+		_spec.ClearField(oauth2client.FieldTrustedPeers, field.TypeJSON)
+	}
+	if value, ok := _u.mutation.Public(); ok {
+		_spec.SetField(oauth2client.FieldPublic, field.TypeBool, value)
+	}
+	if value, ok := _u.mutation.Name(); ok {
+		_spec.SetField(oauth2client.FieldName, field.TypeString, value)
+	}
+	if value, ok := _u.mutation.LogoURL(); ok {
+		_spec.SetField(oauth2client.FieldLogoURL, field.TypeString, value)
+	}
+	if value, ok := _u.mutation.AllowedConnectors(); ok {
+		_spec.SetField(oauth2client.FieldAllowedConnectors, field.TypeJSON, value)
+	}
+	if value, ok := _u.mutation.AppendedAllowedConnectors(); ok {
+		_spec.AddModifier(func(u *sql.UpdateBuilder) {
+			sqljson.Append(u, oauth2client.FieldAllowedConnectors, value)
 		})
 	}
-	if value, ok := ouo.mutation.Public(); ok {
-		_spec.Fields.Set = append(_spec.Fields.Set, &sqlgraph.FieldSpec{
-			Type:   field.TypeBool,
-			Value:  value,
-			Column: oauth2client.FieldPublic,
+	if _u.mutation.AllowedConnectorsCleared() {
+		_spec.ClearField(oauth2client.FieldAllowedConnectors, field.TypeJSON)
+	}
+	if value, ok := _u.mutation.MfaChain(); ok {
+		_spec.SetField(oauth2client.FieldMfaChain, field.TypeJSON, value)
+	}
+	if value, ok := _u.mutation.AppendedMfaChain(); ok {
+		_spec.AddModifier(func(u *sql.UpdateBuilder) {
+			sqljson.Append(u, oauth2client.FieldMfaChain, value)
 		})
 	}
-	if value, ok := ouo.mutation.Name(); ok {
-		_spec.Fields.Set = append(_spec.Fields.Set, &sqlgraph.FieldSpec{
-			Type:   field.TypeString,
-			Value:  value,
-			Column: oauth2client.FieldName,
+	if _u.mutation.MfaChainCleared() {
+		_spec.ClearField(oauth2client.FieldMfaChain, field.TypeJSON)
+	}
+	if value, ok := _u.mutation.PostLogoutRedirectUris(); ok {
+		_spec.SetField(oauth2client.FieldPostLogoutRedirectUris, field.TypeJSON, value)
+	}
+	if value, ok := _u.mutation.AppendedPostLogoutRedirectUris(); ok {
+		_spec.AddModifier(func(u *sql.UpdateBuilder) {
+			sqljson.Append(u, oauth2client.FieldPostLogoutRedirectUris, value)
 		})
 	}
-	if value, ok := ouo.mutation.LogoURL(); ok {
-		_spec.Fields.Set = append(_spec.Fields.Set, &sqlgraph.FieldSpec{
-			Type:   field.TypeString,
-			Value:  value,
-			Column: oauth2client.FieldLogoURL,
+	if _u.mutation.PostLogoutRedirectUrisCleared() {
+		_spec.ClearField(oauth2client.FieldPostLogoutRedirectUris, field.TypeJSON)
+	}
+	if value, ok := _u.mutation.SSOSharedWith(); ok {
+		_spec.SetField(oauth2client.FieldSSOSharedWith, field.TypeJSON, value)
+	}
+	if value, ok := _u.mutation.AppendedSSOSharedWith(); ok {
+		_spec.AddModifier(func(u *sql.UpdateBuilder) {
+			sqljson.Append(u, oauth2client.FieldSSOSharedWith, value)
 		})
 	}
-	_node = &OAuth2Client{config: ouo.config}
+	if _u.mutation.SSOSharedWithCleared() {
+		_spec.ClearField(oauth2client.FieldSSOSharedWith, field.TypeJSON)
+	}
+	if value, ok := _u.mutation.BackchannelLogoutURI(); ok {
+		_spec.SetField(oauth2client.FieldBackchannelLogoutURI, field.TypeString, value)
+	}
+	if _u.mutation.BackchannelLogoutURICleared() {
+		_spec.ClearField(oauth2client.FieldBackchannelLogoutURI, field.TypeString)
+	}
+	if value, ok := _u.mutation.RefreshTokenLifetime(); ok {
+		_spec.SetField(oauth2client.FieldRefreshTokenLifetime, field.TypeString, value)
+	}
+	if _u.mutation.RefreshTokenLifetimeCleared() {
+		_spec.ClearField(oauth2client.FieldRefreshTokenLifetime, field.TypeString)
+	}
+	if value, ok := _u.mutation.ClientCredentialsClaims(); ok {
+		_spec.SetField(oauth2client.FieldClientCredentialsClaims, field.TypeJSON, value)
+	}
+	if _u.mutation.ClientCredentialsClaimsCleared() {
+		_spec.ClearField(oauth2client.FieldClientCredentialsClaims, field.TypeJSON)
+	}
+	_node = &OAuth2Client{config: _u.config}
 	_spec.Assign = _node.assignValues
 	_spec.ScanValues = _node.scanValues
-	if err = sqlgraph.UpdateNode(ctx, ouo.driver, _spec); err != nil {
+	if err = sqlgraph.UpdateNode(ctx, _u.driver, _spec); err != nil {
 		if _, ok := err.(*sqlgraph.NotFoundError); ok {
 			err = &NotFoundError{oauth2client.Label}
 		} else if sqlgraph.IsConstraintError(err) {
@@ -497,5 +842,6 @@ func (ouo *OAuth2ClientUpdateOne) sqlSave(ctx context.Context) (_node *OAuth2Cli
 		}
 		return nil, err
 	}
+	_u.mutation.done = true
 	return _node, nil
 }
diff --git a/storage/ent/db/offlinesession.go b/storage/ent/db/offlinesession.go
index 4b797e2672..b19fd9c6d2 100644
--- a/storage/ent/db/offlinesession.go
+++ b/storage/ent/db/offlinesession.go
@@ -6,6 +6,7 @@ import (
 	"fmt"
 	"strings"
 
+	"entgo.io/ent"
 	"entgo.io/ent/dialect/sql"
 	"github.com/dexidp/dex/storage/ent/db/offlinesession"
 )
@@ -23,11 +24,12 @@ type OfflineSession struct {
 	Refresh []byte `json:"refresh,omitempty"`
 	// ConnectorData holds the value of the "connector_data" field.
 	ConnectorData *[]byte `json:"connector_data,omitempty"`
+	selectValues  sql.SelectValues
 }
 
 // scanValues returns the types for scanning values from sql.Rows.
-func (*OfflineSession) scanValues(columns []string) ([]interface{}, error) {
-	values := make([]interface{}, len(columns))
+func (*OfflineSession) scanValues(columns []string) ([]any, error) {
+	values := make([]any, len(columns))
 	for i := range columns {
 		switch columns[i] {
 		case offlinesession.FieldRefresh, offlinesession.FieldConnectorData:
@@ -35,7 +37,7 @@ func (*OfflineSession) scanValues(columns []string) ([]interface{}, error) {
 		case offlinesession.FieldID, offlinesession.FieldUserID, offlinesession.FieldConnID:
 			values[i] = new(sql.NullString)
 		default:
-			return nil, fmt.Errorf("unexpected column %q for type OfflineSession", columns[i])
+			values[i] = new(sql.UnknownType)
 		}
 	}
 	return values, nil
@@ -43,7 +45,7 @@ func (*OfflineSession) scanValues(columns []string) ([]interface{}, error) {
 
 // assignValues assigns the values that were returned from sql.Rows (after scanning)
 // to the OfflineSession fields.
-func (os *OfflineSession) assignValues(columns []string, values []interface{}) error {
+func (_m *OfflineSession) assignValues(columns []string, values []any) error {
 	if m, n := len(values), len(columns); m < n {
 		return fmt.Errorf("mismatch number of scan values: %d != %d", m, n)
 	}
@@ -53,70 +55,78 @@ func (os *OfflineSession) assignValues(columns []string, values []interface{}) e
 			if value, ok := values[i].(*sql.NullString); !ok {
 				return fmt.Errorf("unexpected type %T for field id", values[i])
 			} else if value.Valid {
-				os.ID = value.String
+				_m.ID = value.String
 			}
 		case offlinesession.FieldUserID:
 			if value, ok := values[i].(*sql.NullString); !ok {
 				return fmt.Errorf("unexpected type %T for field user_id", values[i])
 			} else if value.Valid {
-				os.UserID = value.String
+				_m.UserID = value.String
 			}
 		case offlinesession.FieldConnID:
 			if value, ok := values[i].(*sql.NullString); !ok {
 				return fmt.Errorf("unexpected type %T for field conn_id", values[i])
 			} else if value.Valid {
-				os.ConnID = value.String
+				_m.ConnID = value.String
 			}
 		case offlinesession.FieldRefresh:
 			if value, ok := values[i].(*[]byte); !ok {
 				return fmt.Errorf("unexpected type %T for field refresh", values[i])
 			} else if value != nil {
-				os.Refresh = *value
+				_m.Refresh = *value
 			}
 		case offlinesession.FieldConnectorData:
 			if value, ok := values[i].(*[]byte); !ok {
 				return fmt.Errorf("unexpected type %T for field connector_data", values[i])
 			} else if value != nil {
-				os.ConnectorData = value
+				_m.ConnectorData = value
 			}
+		default:
+			_m.selectValues.Set(columns[i], values[i])
 		}
 	}
 	return nil
 }
 
+// Value returns the ent.Value that was dynamically selected and assigned to the OfflineSession.
+// This includes values selected through modifiers, order, etc.
+func (_m *OfflineSession) Value(name string) (ent.Value, error) {
+	return _m.selectValues.Get(name)
+}
+
 // Update returns a builder for updating this OfflineSession.
 // Note that you need to call OfflineSession.Unwrap() before calling this method if this OfflineSession
 // was returned from a transaction, and the transaction was committed or rolled back.
-func (os *OfflineSession) Update() *OfflineSessionUpdateOne {
-	return (&OfflineSessionClient{config: os.config}).UpdateOne(os)
+func (_m *OfflineSession) Update() *OfflineSessionUpdateOne {
+	return NewOfflineSessionClient(_m.config).UpdateOne(_m)
 }
 
 // Unwrap unwraps the OfflineSession entity that was returned from a transaction after it was closed,
 // so that all future queries will be executed through the driver which created the transaction.
-func (os *OfflineSession) Unwrap() *OfflineSession {
-	_tx, ok := os.config.driver.(*txDriver)
+func (_m *OfflineSession) Unwrap() *OfflineSession {
+	_tx, ok := _m.config.driver.(*txDriver)
 	if !ok {
 		panic("db: OfflineSession is not a transactional entity")
 	}
-	os.config.driver = _tx.drv
-	return os
+	_m.config.driver = _tx.drv
+	return _m
 }
 
 // String implements the fmt.Stringer.
-func (os *OfflineSession) String() string {
+func (_m *OfflineSession) String() string {
 	var builder strings.Builder
 	builder.WriteString("OfflineSession(")
-	builder.WriteString(fmt.Sprintf("id=%v, ", os.ID))
+	builder.WriteString(fmt.Sprintf("id=%v, ", _m.ID))
 	builder.WriteString("user_id=")
-	builder.WriteString(os.UserID)
+	builder.WriteString(_m.UserID)
 	builder.WriteString(", ")
 	builder.WriteString("conn_id=")
-	builder.WriteString(os.ConnID)
+	builder.WriteString(_m.ConnID)
 	builder.WriteString(", ")
 	builder.WriteString("refresh=")
-	builder.WriteString(fmt.Sprintf("%v", os.Refresh))
+	builder.WriteString(fmt.Sprintf("%v", _m.Refresh))
 	builder.WriteString(", ")
-	if v := os.ConnectorData; v != nil {
+	if v := _m.ConnectorData; v != nil {
 		builder.WriteString("connector_data=")
 		builder.WriteString(fmt.Sprintf("%v", *v))
 	}
@@ -126,9 +136,3 @@ func (os *OfflineSession) String() string {
 
 // OfflineSessions is a parsable slice of OfflineSession.
 type OfflineSessions []*OfflineSession
-
-func (os OfflineSessions) config(cfg config) {
-	for _i := range os {
-		os[_i].config = cfg
-	}
-}
diff --git a/storage/ent/db/offlinesession/offlinesession.go b/storage/ent/db/offlinesession/offlinesession.go
index f996fe18d7..e7dbc446b7 100644
--- a/storage/ent/db/offlinesession/offlinesession.go
+++ b/storage/ent/db/offlinesession/offlinesession.go
@@ -2,6 +2,10 @@
 
 package offlinesession
 
+import (
+	"entgo.io/ent/dialect/sql"
+)
+
 const (
 	// Label holds the string label denoting the offlinesession type in the database.
 	Label = "offline_session"
@@ -46,3 +50,21 @@ var (
 	// IDValidator is a validator for the "id" field. It is called by the builders before save.
 	IDValidator func(string) error
 )
+
+// OrderOption defines the ordering options for the OfflineSession queries.
+type OrderOption func(*sql.Selector)
+
+// ByID orders the results by the id field.
+func ByID(opts ...sql.OrderTermOption) OrderOption {
+	return sql.OrderByField(FieldID, opts...).ToFunc()
+}
+
+// ByUserID orders the results by the user_id field.
+func ByUserID(opts ...sql.OrderTermOption) OrderOption {
+	return sql.OrderByField(FieldUserID, opts...).ToFunc()
+}
+
+// ByConnID orders the results by the conn_id field.
+func ByConnID(opts ...sql.OrderTermOption) OrderOption {
+	return sql.OrderByField(FieldConnID, opts...).ToFunc()
+}
diff --git a/storage/ent/db/offlinesession/where.go b/storage/ent/db/offlinesession/where.go
index 2dbab2537e..e0f19ab2ce 100644
--- a/storage/ent/db/offlinesession/where.go
+++ b/storage/ent/db/offlinesession/where.go
@@ -9,471 +9,310 @@ import (
 
 // ID filters vertices based on their ID field.
 func ID(id string) predicate.OfflineSession {
-	return predicate.OfflineSession(func(s *sql.Selector) {
-		s.Where(sql.EQ(s.C(FieldID), id))
-	})
+	return predicate.OfflineSession(sql.FieldEQ(FieldID, id))
 }
 
 // IDEQ applies the EQ predicate on the ID field.
 func IDEQ(id string) predicate.OfflineSession {
-	return predicate.OfflineSession(func(s *sql.Selector) {
-		s.Where(sql.EQ(s.C(FieldID), id))
-	})
+	return predicate.OfflineSession(sql.FieldEQ(FieldID, id))
 }
 
 // IDNEQ applies the NEQ predicate on the ID field.
 func IDNEQ(id string) predicate.OfflineSession {
-	return predicate.OfflineSession(func(s *sql.Selector) {
-		s.Where(sql.NEQ(s.C(FieldID), id))
-	})
+	return predicate.OfflineSession(sql.FieldNEQ(FieldID, id))
 }
 
 // IDIn applies the In predicate on the ID field.
 func IDIn(ids ...string) predicate.OfflineSession {
-	return predicate.OfflineSession(func(s *sql.Selector) {
-		v := make([]interface{}, len(ids))
-		for i := range v {
-			v[i] = ids[i]
-		}
-		s.Where(sql.In(s.C(FieldID), v...))
-	})
+	return predicate.OfflineSession(sql.FieldIn(FieldID, ids...))
 }
 
 // IDNotIn applies the NotIn predicate on the ID field.
 func IDNotIn(ids ...string) predicate.OfflineSession {
-	return predicate.OfflineSession(func(s *sql.Selector) {
-		v := make([]interface{}, len(ids))
-		for i := range v {
-			v[i] = ids[i]
-		}
-		s.Where(sql.NotIn(s.C(FieldID), v...))
-	})
+	return predicate.OfflineSession(sql.FieldNotIn(FieldID, ids...))
 }
 
 // IDGT applies the GT predicate on the ID field.
 func IDGT(id string) predicate.OfflineSession {
-	return predicate.OfflineSession(func(s *sql.Selector) {
-		s.Where(sql.GT(s.C(FieldID), id))
-	})
+	return predicate.OfflineSession(sql.FieldGT(FieldID, id))
 }
 
 // IDGTE applies the GTE predicate on the ID field.
 func IDGTE(id string) predicate.OfflineSession {
-	return predicate.OfflineSession(func(s *sql.Selector) {
-		s.Where(sql.GTE(s.C(FieldID), id))
-	})
+	return predicate.OfflineSession(sql.FieldGTE(FieldID, id))
 }
 
 // IDLT applies the LT predicate on the ID field.
 func IDLT(id string) predicate.OfflineSession {
-	return predicate.OfflineSession(func(s *sql.Selector) {
-		s.Where(sql.LT(s.C(FieldID), id))
-	})
+	return predicate.OfflineSession(sql.FieldLT(FieldID, id))
 }
 
 // IDLTE applies the LTE predicate on the ID field.
 func IDLTE(id string) predicate.OfflineSession {
-	return predicate.OfflineSession(func(s *sql.Selector) {
-		s.Where(sql.LTE(s.C(FieldID), id))
-	})
+	return predicate.OfflineSession(sql.FieldLTE(FieldID, id))
+}
+
+// IDEqualFold applies the EqualFold predicate on the ID field.
+func IDEqualFold(id string) predicate.OfflineSession {
+	return predicate.OfflineSession(sql.FieldEqualFold(FieldID, id))
+}
+
+// IDContainsFold applies the ContainsFold predicate on the ID field.
+func IDContainsFold(id string) predicate.OfflineSession {
+	return predicate.OfflineSession(sql.FieldContainsFold(FieldID, id))
 }
 
 // UserID applies equality check predicate on the "user_id" field. It's identical to UserIDEQ.
 func UserID(v string) predicate.OfflineSession {
-	return predicate.OfflineSession(func(s *sql.Selector) {
-		s.Where(sql.EQ(s.C(FieldUserID), v))
-	})
+	return predicate.OfflineSession(sql.FieldEQ(FieldUserID, v))
 }
 
 // ConnID applies equality check predicate on the "conn_id" field. It's identical to ConnIDEQ.
 func ConnID(v string) predicate.OfflineSession {
-	return predicate.OfflineSession(func(s *sql.Selector) {
-		s.Where(sql.EQ(s.C(FieldConnID), v))
-	})
+	return predicate.OfflineSession(sql.FieldEQ(FieldConnID, v))
 }
 
 // Refresh applies equality check predicate on the "refresh" field. It's identical to RefreshEQ.
 func Refresh(v []byte) predicate.OfflineSession {
-	return predicate.OfflineSession(func(s *sql.Selector) {
-		s.Where(sql.EQ(s.C(FieldRefresh), v))
-	})
+	return predicate.OfflineSession(sql.FieldEQ(FieldRefresh, v))
 }
 
 // ConnectorData applies equality check predicate on the "connector_data" field. It's identical to ConnectorDataEQ.
 func ConnectorData(v []byte) predicate.OfflineSession {
-	return predicate.OfflineSession(func(s *sql.Selector) {
-		s.Where(sql.EQ(s.C(FieldConnectorData), v))
-	})
+	return predicate.OfflineSession(sql.FieldEQ(FieldConnectorData, v))
 }
 
 // UserIDEQ applies the EQ predicate on the "user_id" field.
 func UserIDEQ(v string) predicate.OfflineSession {
-	return predicate.OfflineSession(func(s *sql.Selector) {
-		s.Where(sql.EQ(s.C(FieldUserID), v))
-	})
+	return predicate.OfflineSession(sql.FieldEQ(FieldUserID, v))
 }
 
 // UserIDNEQ applies the NEQ predicate on the "user_id" field.
 func UserIDNEQ(v string) predicate.OfflineSession {
-	return predicate.OfflineSession(func(s *sql.Selector) {
-		s.Where(sql.NEQ(s.C(FieldUserID), v))
-	})
+	return predicate.OfflineSession(sql.FieldNEQ(FieldUserID, v))
 }
 
 // UserIDIn applies the In predicate on the "user_id" field.
 func UserIDIn(vs ...string) predicate.OfflineSession {
-	v := make([]interface{}, len(vs))
-	for i := range v {
-		v[i] = vs[i]
-	}
-	return predicate.OfflineSession(func(s *sql.Selector) {
-		s.Where(sql.In(s.C(FieldUserID), v...))
-	})
+	return predicate.OfflineSession(sql.FieldIn(FieldUserID, vs...))
 }
 
 // UserIDNotIn applies the NotIn predicate on the "user_id" field.
 func UserIDNotIn(vs ...string) predicate.OfflineSession {
-	v := make([]interface{}, len(vs))
-	for i := range v {
-		v[i] = vs[i]
-	}
-	return predicate.OfflineSession(func(s *sql.Selector) {
-		s.Where(sql.NotIn(s.C(FieldUserID), v...))
-	})
+	return predicate.OfflineSession(sql.FieldNotIn(FieldUserID, vs...))
 }
 
 // UserIDGT applies the GT predicate on the "user_id" field.
 func UserIDGT(v string) predicate.OfflineSession {
-	return predicate.OfflineSession(func(s *sql.Selector) {
-		s.Where(sql.GT(s.C(FieldUserID), v))
-	})
+	return predicate.OfflineSession(sql.FieldGT(FieldUserID, v))
 }
 
 // UserIDGTE applies the GTE predicate on the "user_id" field.
 func UserIDGTE(v string) predicate.OfflineSession {
-	return predicate.OfflineSession(func(s *sql.Selector) {
-		s.Where(sql.GTE(s.C(FieldUserID), v))
-	})
+	return predicate.OfflineSession(sql.FieldGTE(FieldUserID, v))
 }
 
 // UserIDLT applies the LT predicate on the "user_id" field.
 func UserIDLT(v string) predicate.OfflineSession {
-	return predicate.OfflineSession(func(s *sql.Selector) {
-		s.Where(sql.LT(s.C(FieldUserID), v))
-	})
+	return predicate.OfflineSession(sql.FieldLT(FieldUserID, v))
 }
 
 // UserIDLTE applies the LTE predicate on the "user_id" field.
 func UserIDLTE(v string) predicate.OfflineSession {
-	return predicate.OfflineSession(func(s *sql.Selector) {
-		s.Where(sql.LTE(s.C(FieldUserID), v))
-	})
+	return predicate.OfflineSession(sql.FieldLTE(FieldUserID, v))
 }
 
 // UserIDContains applies the Contains predicate on the "user_id" field.
 func UserIDContains(v string) predicate.OfflineSession {
-	return predicate.OfflineSession(func(s *sql.Selector) {
-		s.Where(sql.Contains(s.C(FieldUserID), v))
-	})
+	return predicate.OfflineSession(sql.FieldContains(FieldUserID, v))
 }
 
 // UserIDHasPrefix applies the HasPrefix predicate on the "user_id" field.
 func UserIDHasPrefix(v string) predicate.OfflineSession {
-	return predicate.OfflineSession(func(s *sql.Selector) {
-		s.Where(sql.HasPrefix(s.C(FieldUserID), v))
-	})
+	return predicate.OfflineSession(sql.FieldHasPrefix(FieldUserID, v))
 }
 
 // UserIDHasSuffix applies the HasSuffix predicate on the "user_id" field.
 func UserIDHasSuffix(v string) predicate.OfflineSession {
-	return predicate.OfflineSession(func(s *sql.Selector) {
-		s.Where(sql.HasSuffix(s.C(FieldUserID), v))
-	})
+	return predicate.OfflineSession(sql.FieldHasSuffix(FieldUserID, v))
 }
 
 // UserIDEqualFold applies the EqualFold predicate on the "user_id" field.
 func UserIDEqualFold(v string) predicate.OfflineSession {
-	return predicate.OfflineSession(func(s *sql.Selector) {
-		s.Where(sql.EqualFold(s.C(FieldUserID), v))
-	})
+	return predicate.OfflineSession(sql.FieldEqualFold(FieldUserID, v))
 }
 
 // UserIDContainsFold applies the ContainsFold predicate on the "user_id" field.
 func UserIDContainsFold(v string) predicate.OfflineSession {
-	return predicate.OfflineSession(func(s *sql.Selector) {
-		s.Where(sql.ContainsFold(s.C(FieldUserID), v))
-	})
+	return predicate.OfflineSession(sql.FieldContainsFold(FieldUserID, v))
 }
 
 // ConnIDEQ applies the EQ predicate on the "conn_id" field.
 func ConnIDEQ(v string) predicate.OfflineSession {
-	return predicate.OfflineSession(func(s *sql.Selector) {
-		s.Where(sql.EQ(s.C(FieldConnID), v))
-	})
+	return predicate.OfflineSession(sql.FieldEQ(FieldConnID, v))
 }
 
 // ConnIDNEQ applies the NEQ predicate on the "conn_id" field.
 func ConnIDNEQ(v string) predicate.OfflineSession {
-	return predicate.OfflineSession(func(s *sql.Selector) {
-		s.Where(sql.NEQ(s.C(FieldConnID), v))
-	})
+	return predicate.OfflineSession(sql.FieldNEQ(FieldConnID, v))
 }
 
 // ConnIDIn applies the In predicate on the "conn_id" field.
 func ConnIDIn(vs ...string) predicate.OfflineSession {
-	v := make([]interface{}, len(vs))
-	for i := range v {
-		v[i] = vs[i]
-	}
-	return predicate.OfflineSession(func(s *sql.Selector) {
-		s.Where(sql.In(s.C(FieldConnID), v...))
-	})
+	return predicate.OfflineSession(sql.FieldIn(FieldConnID, vs...))
 }
 
 // ConnIDNotIn applies the NotIn predicate on the "conn_id" field.
 func ConnIDNotIn(vs ...string) predicate.OfflineSession {
-	v := make([]interface{}, len(vs))
-	for i := range v {
-		v[i] = vs[i]
-	}
-	return predicate.OfflineSession(func(s *sql.Selector) {
-		s.Where(sql.NotIn(s.C(FieldConnID), v...))
-	})
+	return predicate.OfflineSession(sql.FieldNotIn(FieldConnID, vs...))
 }
 
 // ConnIDGT applies the GT predicate on the "conn_id" field.
 func ConnIDGT(v string) predicate.OfflineSession {
-	return predicate.OfflineSession(func(s *sql.Selector) {
-		s.Where(sql.GT(s.C(FieldConnID), v))
-	})
+	return predicate.OfflineSession(sql.FieldGT(FieldConnID, v))
 }
 
 // ConnIDGTE applies the GTE predicate on the "conn_id" field.
 func ConnIDGTE(v string) predicate.OfflineSession {
-	return predicate.OfflineSession(func(s *sql.Selector) {
-		s.Where(sql.GTE(s.C(FieldConnID), v))
-	})
+	return predicate.OfflineSession(sql.FieldGTE(FieldConnID, v))
 }
 
 // ConnIDLT applies the LT predicate on the "conn_id" field.
 func ConnIDLT(v string) predicate.OfflineSession {
-	return predicate.OfflineSession(func(s *sql.Selector) {
-		s.Where(sql.LT(s.C(FieldConnID), v))
-	})
+	return predicate.OfflineSession(sql.FieldLT(FieldConnID, v))
 }
 
 // ConnIDLTE applies the LTE predicate on the "conn_id" field.
 func ConnIDLTE(v string) predicate.OfflineSession {
-	return predicate.OfflineSession(func(s *sql.Selector) {
-		s.Where(sql.LTE(s.C(FieldConnID), v))
-	})
+	return predicate.OfflineSession(sql.FieldLTE(FieldConnID, v))
 }
 
 // ConnIDContains applies the Contains predicate on the "conn_id" field.
 func ConnIDContains(v string) predicate.OfflineSession {
-	return predicate.OfflineSession(func(s *sql.Selector) {
-		s.Where(sql.Contains(s.C(FieldConnID), v))
-	})
+	return predicate.OfflineSession(sql.FieldContains(FieldConnID, v))
 }
 
 // ConnIDHasPrefix applies the HasPrefix predicate on the "conn_id" field.
 func ConnIDHasPrefix(v string) predicate.OfflineSession {
-	return predicate.OfflineSession(func(s *sql.Selector) {
-		s.Where(sql.HasPrefix(s.C(FieldConnID), v))
-	})
+	return predicate.OfflineSession(sql.FieldHasPrefix(FieldConnID, v))
 }
 
 // ConnIDHasSuffix applies the HasSuffix predicate on the "conn_id" field.
 func ConnIDHasSuffix(v string) predicate.OfflineSession {
-	return predicate.OfflineSession(func(s *sql.Selector) {
-		s.Where(sql.HasSuffix(s.C(FieldConnID), v))
-	})
+	return predicate.OfflineSession(sql.FieldHasSuffix(FieldConnID, v))
 }
 
 // ConnIDEqualFold applies the EqualFold predicate on the "conn_id" field.
 func ConnIDEqualFold(v string) predicate.OfflineSession {
-	return predicate.OfflineSession(func(s *sql.Selector) {
-		s.Where(sql.EqualFold(s.C(FieldConnID), v))
-	})
+	return predicate.OfflineSession(sql.FieldEqualFold(FieldConnID, v))
 }
 
 // ConnIDContainsFold applies the ContainsFold predicate on the "conn_id" field.
 func ConnIDContainsFold(v string) predicate.OfflineSession {
-	return predicate.OfflineSession(func(s *sql.Selector) {
-		s.Where(sql.ContainsFold(s.C(FieldConnID), v))
-	})
+	return predicate.OfflineSession(sql.FieldContainsFold(FieldConnID, v))
 }
 
 // RefreshEQ applies the EQ predicate on the "refresh" field.
 func RefreshEQ(v []byte) predicate.OfflineSession {
-	return predicate.OfflineSession(func(s *sql.Selector) {
-		s.Where(sql.EQ(s.C(FieldRefresh), v))
-	})
+	return predicate.OfflineSession(sql.FieldEQ(FieldRefresh, v))
 }
 
 // RefreshNEQ applies the NEQ predicate on the "refresh" field.
 func RefreshNEQ(v []byte) predicate.OfflineSession {
-	return predicate.OfflineSession(func(s *sql.Selector) {
-		s.Where(sql.NEQ(s.C(FieldRefresh), v))
-	})
+	return predicate.OfflineSession(sql.FieldNEQ(FieldRefresh, v))
 }
 
 // RefreshIn applies the In predicate on the "refresh" field.
 func RefreshIn(vs ...[]byte) predicate.OfflineSession {
-	v := make([]interface{}, len(vs))
-	for i := range v {
-		v[i] = vs[i]
-	}
-	return predicate.OfflineSession(func(s *sql.Selector) {
-		s.Where(sql.In(s.C(FieldRefresh), v...))
-	})
+	return predicate.OfflineSession(sql.FieldIn(FieldRefresh, vs...))
 }
 
 // RefreshNotIn applies the NotIn predicate on the "refresh" field.
 func RefreshNotIn(vs ...[]byte) predicate.OfflineSession {
-	v := make([]interface{}, len(vs))
-	for i := range v {
-		v[i] = vs[i]
-	}
-	return predicate.OfflineSession(func(s *sql.Selector) {
-		s.Where(sql.NotIn(s.C(FieldRefresh), v...))
-	})
+	return predicate.OfflineSession(sql.FieldNotIn(FieldRefresh, vs...))
 }
 
 // RefreshGT applies the GT predicate on the "refresh" field.
 func RefreshGT(v []byte) predicate.OfflineSession {
-	return predicate.OfflineSession(func(s *sql.Selector) {
-		s.Where(sql.GT(s.C(FieldRefresh), v))
-	})
+	return predicate.OfflineSession(sql.FieldGT(FieldRefresh, v))
 }
 
 // RefreshGTE applies the GTE predicate on the "refresh" field.
 func RefreshGTE(v []byte) predicate.OfflineSession {
-	return predicate.OfflineSession(func(s *sql.Selector) {
-		s.Where(sql.GTE(s.C(FieldRefresh), v))
-	})
+	return predicate.OfflineSession(sql.FieldGTE(FieldRefresh, v))
 }
 
 // RefreshLT applies the LT predicate on the "refresh" field.
 func RefreshLT(v []byte) predicate.OfflineSession {
-	return predicate.OfflineSession(func(s *sql.Selector) {
-		s.Where(sql.LT(s.C(FieldRefresh), v))
-	})
+	return predicate.OfflineSession(sql.FieldLT(FieldRefresh, v))
 }
 
 // RefreshLTE applies the LTE predicate on the "refresh" field.
 func RefreshLTE(v []byte) predicate.OfflineSession {
-	return predicate.OfflineSession(func(s *sql.Selector) {
-		s.Where(sql.LTE(s.C(FieldRefresh), v))
-	})
+	return predicate.OfflineSession(sql.FieldLTE(FieldRefresh, v))
 }
 
 // ConnectorDataEQ applies the EQ predicate on the "connector_data" field.
 func ConnectorDataEQ(v []byte) predicate.OfflineSession {
-	return predicate.OfflineSession(func(s *sql.Selector) {
-		s.Where(sql.EQ(s.C(FieldConnectorData), v))
-	})
+	return predicate.OfflineSession(sql.FieldEQ(FieldConnectorData, v))
 }
 
 // ConnectorDataNEQ applies the NEQ predicate on the "connector_data" field.
 func ConnectorDataNEQ(v []byte) predicate.OfflineSession {
-	return predicate.OfflineSession(func(s *sql.Selector) {
-		s.Where(sql.NEQ(s.C(FieldConnectorData), v))
-	})
+	return predicate.OfflineSession(sql.FieldNEQ(FieldConnectorData, v))
 }
 
 // ConnectorDataIn applies the In predicate on the "connector_data" field.
 func ConnectorDataIn(vs ...[]byte) predicate.OfflineSession {
-	v := make([]interface{}, len(vs))
-	for i := range v {
-		v[i] = vs[i]
-	}
-	return predicate.OfflineSession(func(s *sql.Selector) {
-		s.Where(sql.In(s.C(FieldConnectorData), v...))
-	})
+	return predicate.OfflineSession(sql.FieldIn(FieldConnectorData, vs...))
 }
 
 // ConnectorDataNotIn applies the NotIn predicate on the "connector_data" field.
 func ConnectorDataNotIn(vs ...[]byte) predicate.OfflineSession {
-	v := make([]interface{}, len(vs))
-	for i := range v {
-		v[i] = vs[i]
-	}
-	return predicate.OfflineSession(func(s *sql.Selector) {
-		s.Where(sql.NotIn(s.C(FieldConnectorData), v...))
-	})
+	return predicate.OfflineSession(sql.FieldNotIn(FieldConnectorData, vs...))
 }
 
 // ConnectorDataGT applies the GT predicate on the "connector_data" field.
 func ConnectorDataGT(v []byte) predicate.OfflineSession {
-	return predicate.OfflineSession(func(s *sql.Selector) {
-		s.Where(sql.GT(s.C(FieldConnectorData), v))
-	})
+	return predicate.OfflineSession(sql.FieldGT(FieldConnectorData, v))
 }
 
 // ConnectorDataGTE applies the GTE predicate on the "connector_data" field.
 func ConnectorDataGTE(v []byte) predicate.OfflineSession {
-	return predicate.OfflineSession(func(s *sql.Selector) {
-		s.Where(sql.GTE(s.C(FieldConnectorData), v))
-	})
+	return predicate.OfflineSession(sql.FieldGTE(FieldConnectorData, v))
 }
 
 // ConnectorDataLT applies the LT predicate on the "connector_data" field.
 func ConnectorDataLT(v []byte) predicate.OfflineSession {
-	return predicate.OfflineSession(func(s *sql.Selector) {
-		s.Where(sql.LT(s.C(FieldConnectorData), v))
-	})
+	return predicate.OfflineSession(sql.FieldLT(FieldConnectorData, v))
 }
 
 // ConnectorDataLTE applies the LTE predicate on the "connector_data" field.
 func ConnectorDataLTE(v []byte) predicate.OfflineSession {
-	return predicate.OfflineSession(func(s *sql.Selector) {
-		s.Where(sql.LTE(s.C(FieldConnectorData), v))
-	})
+	return predicate.OfflineSession(sql.FieldLTE(FieldConnectorData, v))
 }
 
 // ConnectorDataIsNil applies the IsNil predicate on the "connector_data" field.
 func ConnectorDataIsNil() predicate.OfflineSession {
-	return predicate.OfflineSession(func(s *sql.Selector) {
-		s.Where(sql.IsNull(s.C(FieldConnectorData)))
-	})
+	return predicate.OfflineSession(sql.FieldIsNull(FieldConnectorData))
 }
 
 // ConnectorDataNotNil applies the NotNil predicate on the "connector_data" field.
 func ConnectorDataNotNil() predicate.OfflineSession {
-	return predicate.OfflineSession(func(s *sql.Selector) {
-		s.Where(sql.NotNull(s.C(FieldConnectorData)))
-	})
+	return predicate.OfflineSession(sql.FieldNotNull(FieldConnectorData))
 }
 
 // And groups predicates with the AND operator between them.
 func And(predicates ...predicate.OfflineSession) predicate.OfflineSession {
-	return predicate.OfflineSession(func(s *sql.Selector) {
-		s1 := s.Clone().SetP(nil)
-		for _, p := range predicates {
-			p(s1)
-		}
-		s.Where(s1.P())
-	})
+	return predicate.OfflineSession(sql.AndPredicates(predicates...))
 }
 
 // Or groups predicates with the OR operator between them.
 func Or(predicates ...predicate.OfflineSession) predicate.OfflineSession {
-	return predicate.OfflineSession(func(s *sql.Selector) {
-		s1 := s.Clone().SetP(nil)
-		for i, p := range predicates {
-			if i > 0 {
-				s1.Or()
-			}
-			p(s1)
-		}
-		s.Where(s1.P())
-	})
+	return predicate.OfflineSession(sql.OrPredicates(predicates...))
 }
 
 // Not applies the not operator on the given predicate.
 func Not(p predicate.OfflineSession) predicate.OfflineSession {
-	return predicate.OfflineSession(func(s *sql.Selector) {
-		p(s.Not())
-	})
+	return predicate.OfflineSession(sql.NotPredicates(p))
 }
diff --git a/storage/ent/db/offlinesession_create.go b/storage/ent/db/offlinesession_create.go
index 82b8014f1b..a3ccbbf390 100644
--- a/storage/ent/db/offlinesession_create.go
+++ b/storage/ent/db/offlinesession_create.go
@@ -20,90 +20,48 @@ type OfflineSessionCreate struct {
 }
 
 // SetUserID sets the "user_id" field.
-func (osc *OfflineSessionCreate) SetUserID(s string) *OfflineSessionCreate {
-	osc.mutation.SetUserID(s)
-	return osc
+func (_c *OfflineSessionCreate) SetUserID(v string) *OfflineSessionCreate {
+	_c.mutation.SetUserID(v)
+	return _c
 }
 
 // SetConnID sets the "conn_id" field.
-func (osc *OfflineSessionCreate) SetConnID(s string) *OfflineSessionCreate {
-	osc.mutation.SetConnID(s)
-	return osc
+func (_c *OfflineSessionCreate) SetConnID(v string) *OfflineSessionCreate {
+	_c.mutation.SetConnID(v)
+	return _c
 }
 
 // SetRefresh sets the "refresh" field.
-func (osc *OfflineSessionCreate) SetRefresh(b []byte) *OfflineSessionCreate {
-	osc.mutation.SetRefresh(b)
-	return osc
+func (_c *OfflineSessionCreate) SetRefresh(v []byte) *OfflineSessionCreate {
+	_c.mutation.SetRefresh(v)
+	return _c
 }
 
 // SetConnectorData sets the "connector_data" field.
-func (osc *OfflineSessionCreate) SetConnectorData(b []byte) *OfflineSessionCreate {
-	osc.mutation.SetConnectorData(b)
-	return osc
+func (_c *OfflineSessionCreate) SetConnectorData(v []byte) *OfflineSessionCreate {
+	_c.mutation.SetConnectorData(v)
+	return _c
 }
 
 // SetID sets the "id" field.
-func (osc *OfflineSessionCreate) SetID(s string) *OfflineSessionCreate {
-	osc.mutation.SetID(s)
-	return osc
+func (_c *OfflineSessionCreate) SetID(v string) *OfflineSessionCreate {
+	_c.mutation.SetID(v)
+	return _c
 }
 
 // Mutation returns the OfflineSessionMutation object of the builder.
-func (osc *OfflineSessionCreate) Mutation() *OfflineSessionMutation {
-	return osc.mutation
+func (_c *OfflineSessionCreate) Mutation() *OfflineSessionMutation {
+	return _c.mutation
 }
 
 // Save creates the OfflineSession in the database.
-func (osc *OfflineSessionCreate) Save(ctx context.Context) (*OfflineSession, error) {
-	var (
-		err  error
-		node *OfflineSession
-	)
-	if len(osc.hooks) == 0 {
-		if err = osc.check(); err != nil {
-			return nil, err
-		}
-		node, err = osc.sqlSave(ctx)
-	} else {
-		var mut Mutator = MutateFunc(func(ctx context.Context, m Mutation) (Value, error) {
-			mutation, ok := m.(*OfflineSessionMutation)
-			if !ok {
-				return nil, fmt.Errorf("unexpected mutation type %T", m)
-			}
-			if err = osc.check(); err != nil {
-				return nil, err
-			}
-			osc.mutation = mutation
-			if node, err = osc.sqlSave(ctx); err != nil {
-				return nil, err
-			}
-			mutation.id = &node.ID
-			mutation.done = true
-			return node, err
-		})
-		for i := len(osc.hooks) - 1; i >= 0; i-- {
-			if osc.hooks[i] == nil {
-				return nil, fmt.Errorf("db: uninitialized hook (forgotten import db/runtime?)")
-			}
-			mut = osc.hooks[i](mut)
-		}
-		v, err := mut.Mutate(ctx, osc.mutation)
-		if err != nil {
-			return nil, err
-		}
-		nv, ok := v.(*OfflineSession)
-		if !ok {
-			return nil, fmt.Errorf("unexpected node type %T returned from OfflineSessionMutation", v)
-		}
-		node = nv
-	}
-	return node, err
+func (_c *OfflineSessionCreate) Save(ctx context.Context) (*OfflineSession, error) {
+	return withHooks(ctx, _c.sqlSave, _c.mutation, _c.hooks)
 }
 
 // SaveX calls Save and panics if Save returns an error.
-func (osc *OfflineSessionCreate) SaveX(ctx context.Context) *OfflineSession {
-	v, err := osc.Save(ctx)
+func (_c *OfflineSessionCreate) SaveX(ctx context.Context) *OfflineSession {
+	v, err := _c.Save(ctx)
 	if err != nil {
 		panic(err)
 	}
@@ -111,40 +69,40 @@ func (osc *OfflineSessionCreate) SaveX(ctx context.Context) *OfflineSession {
 }
 
 // Exec executes the query.
-func (osc *OfflineSessionCreate) Exec(ctx context.Context) error {
-	_, err := osc.Save(ctx)
+func (_c *OfflineSessionCreate) Exec(ctx context.Context) error {
+	_, err := _c.Save(ctx)
 	return err
 }
 
 // ExecX is like Exec, but panics if an error occurs.
-func (osc *OfflineSessionCreate) ExecX(ctx context.Context) {
-	if err := osc.Exec(ctx); err != nil {
+func (_c *OfflineSessionCreate) ExecX(ctx context.Context) {
+	if err := _c.Exec(ctx); err != nil {
 		panic(err)
 	}
 }
 
 // check runs all checks and user-defined validators on the builder.
-func (osc *OfflineSessionCreate) check() error {
-	if _, ok := osc.mutation.UserID(); !ok {
+func (_c *OfflineSessionCreate) check() error {
+	if _, ok := _c.mutation.UserID(); !ok {
 		return &ValidationError{Name: "user_id", err: errors.New(`db: missing required field "OfflineSession.user_id"`)}
 	}
-	if v, ok := osc.mutation.UserID(); ok {
+	if v, ok := _c.mutation.UserID(); ok {
 		if err := offlinesession.UserIDValidator(v); err != nil {
 			return &ValidationError{Name: "user_id", err: fmt.Errorf(`db: validator failed for field "OfflineSession.user_id": %w`, err)}
 		}
 	}
-	if _, ok := osc.mutation.ConnID(); !ok {
+	if _, ok := _c.mutation.ConnID(); !ok {
 		return &ValidationError{Name: "conn_id", err: errors.New(`db: missing required field "OfflineSession.conn_id"`)}
 	}
-	if v, ok := osc.mutation.ConnID(); ok {
+	if v, ok := _c.mutation.ConnID(); ok {
 		if err := offlinesession.ConnIDValidator(v); err != nil {
 			return &ValidationError{Name: "conn_id", err: fmt.Errorf(`db: validator failed for field "OfflineSession.conn_id": %w`, err)}
 		}
 	}
-	if _, ok := osc.mutation.Refresh(); !ok {
+	if _, ok := _c.mutation.Refresh(); !ok {
 		return &ValidationError{Name: "refresh", err: errors.New(`db: missing required field "OfflineSession.refresh"`)}
 	}
-	if v, ok := osc.mutation.ID(); ok {
+	if v, ok := _c.mutation.ID(); ok {
 		if err := offlinesession.IDValidator(v); err != nil {
 			return &ValidationError{Name: "id", err: fmt.Errorf(`db: validator failed for field "OfflineSession.id": %w`, err)}
 		}
@@ -152,9 +110,12 @@ func (osc *OfflineSessionCreate) check() error {
 	return nil
 }
 
-func (osc *OfflineSessionCreate) sqlSave(ctx context.Context) (*OfflineSession, error) {
-	_node, _spec := osc.createSpec()
-	if err := sqlgraph.CreateNode(ctx, osc.driver, _spec); err != nil {
+func (_c *OfflineSessionCreate) sqlSave(ctx context.Context) (*OfflineSession, error) {
+	if err := _c.check(); err != nil {
+		return nil, err
+	}
+	_node, _spec := _c.createSpec()
+	if err := sqlgraph.CreateNode(ctx, _c.driver, _spec); err != nil {
 		if sqlgraph.IsConstraintError(err) {
 			err = &ConstraintError{msg: err.Error(), wrap: err}
 		}
@@ -167,54 +128,34 @@ func (osc *OfflineSessionCreate) sqlSave(ctx context.Context) (*OfflineSession,
 			return nil, fmt.Errorf("unexpected OfflineSession.ID type: %T", _spec.ID.Value)
 		}
 	}
+	_c.mutation.id = &_node.ID
+	_c.mutation.done = true
 	return _node, nil
 }
 
-func (osc *OfflineSessionCreate) createSpec() (*OfflineSession, *sqlgraph.CreateSpec) {
+func (_c *OfflineSessionCreate) createSpec() (*OfflineSession, *sqlgraph.CreateSpec) {
 	var (
-		_node = &OfflineSession{config: osc.config}
-		_spec = &sqlgraph.CreateSpec{
-			Table: offlinesession.Table,
-			ID: &sqlgraph.FieldSpec{
-				Type:   field.TypeString,
-				Column: offlinesession.FieldID,
-			},
-		}
+		_node = &OfflineSession{config: _c.config}
+		_spec = sqlgraph.NewCreateSpec(offlinesession.Table, sqlgraph.NewFieldSpec(offlinesession.FieldID, field.TypeString))
 	)
-	if id, ok := osc.mutation.ID(); ok {
+	if id, ok := _c.mutation.ID(); ok {
 		_node.ID = id
 		_spec.ID.Value = id
 	}
-	if value, ok := osc.mutation.UserID(); ok {
-		_spec.Fields = append(_spec.Fields, &sqlgraph.FieldSpec{
-			Type:   field.TypeString,
-			Value:  value,
-			Column: offlinesession.FieldUserID,
-		})
+	if value, ok := _c.mutation.UserID(); ok {
+		_spec.SetField(offlinesession.FieldUserID, field.TypeString, value)
 		_node.UserID = value
 	}
-	if value, ok := osc.mutation.ConnID(); ok {
-		_spec.Fields = append(_spec.Fields, &sqlgraph.FieldSpec{
-			Type:   field.TypeString,
-			Value:  value,
-			Column: offlinesession.FieldConnID,
-		})
+	if value, ok := _c.mutation.ConnID(); ok {
+		_spec.SetField(offlinesession.FieldConnID, field.TypeString, value)
 		_node.ConnID = value
 	}
-	if value, ok := osc.mutation.Refresh(); ok {
-		_spec.Fields = append(_spec.Fields, &sqlgraph.FieldSpec{
-			Type:   field.TypeBytes,
-			Value:  value,
-			Column: offlinesession.FieldRefresh,
-		})
+	if value, ok := _c.mutation.Refresh(); ok {
+		_spec.SetField(offlinesession.FieldRefresh, field.TypeBytes, value)
 		_node.Refresh = value
 	}
-	if value, ok := osc.mutation.ConnectorData(); ok {
-		_spec.Fields = append(_spec.Fields, &sqlgraph.FieldSpec{
-			Type:   field.TypeBytes,
-			Value:  value,
-			Column: offlinesession.FieldConnectorData,
-		})
+	if value, ok := _c.mutation.ConnectorData(); ok {
+		_spec.SetField(offlinesession.FieldConnectorData, field.TypeBytes, value)
 		_node.ConnectorData = &value
 	}
 	return _node, _spec
@@ -223,17 +164,21 @@ func (osc *OfflineSessionCreate) createSpec() (*OfflineSession, *sqlgraph.Create
 // OfflineSessionCreateBulk is the builder for creating many OfflineSession entities in bulk.
 type OfflineSessionCreateBulk struct {
 	config
+	err      error
 	builders []*OfflineSessionCreate
 }
 
 // Save creates the OfflineSession entities in the database.
-func (oscb *OfflineSessionCreateBulk) Save(ctx context.Context) ([]*OfflineSession, error) {
-	specs := make([]*sqlgraph.CreateSpec, len(oscb.builders))
-	nodes := make([]*OfflineSession, len(oscb.builders))
-	mutators := make([]Mutator, len(oscb.builders))
-	for i := range oscb.builders {
+func (_c *OfflineSessionCreateBulk) Save(ctx context.Context) ([]*OfflineSession, error) {
+	if _c.err != nil {
+		return nil, _c.err
+	}
+	specs := make([]*sqlgraph.CreateSpec, len(_c.builders))
+	nodes := make([]*OfflineSession, len(_c.builders))
+	mutators := make([]Mutator, len(_c.builders))
+	for i := range _c.builders {
 		func(i int, root context.Context) {
-			builder := oscb.builders[i]
+			builder := _c.builders[i]
 			var mut Mutator = MutateFunc(func(ctx context.Context, m Mutation) (Value, error) {
 				mutation, ok := m.(*OfflineSessionMutation)
 				if !ok {
@@ -243,14 +188,14 @@ func (oscb *OfflineSessionCreateBulk) Save(ctx context.Context) ([]*OfflineSessi
 					return nil, err
 				}
 				builder.mutation = mutation
-				nodes[i], specs[i] = builder.createSpec()
 				var err error
+				nodes[i], specs[i] = builder.createSpec()
 				if i < len(mutators)-1 {
-					_, err = mutators[i+1].Mutate(root, oscb.builders[i+1].mutation)
+					_, err = mutators[i+1].Mutate(root, _c.builders[i+1].mutation)
 				} else {
 					spec := &sqlgraph.BatchCreateSpec{Nodes: specs}
 					// Invoke the actual operation on the latest mutation in the chain.
-					if err = sqlgraph.BatchCreate(ctx, oscb.driver, spec); err != nil {
+					if err = sqlgraph.BatchCreate(ctx, _c.driver, spec); err != nil {
 						if sqlgraph.IsConstraintError(err) {
 							err = &ConstraintError{msg: err.Error(), wrap: err}
 						}
@@ -270,7 +215,7 @@ func (oscb *OfflineSessionCreateBulk) Save(ctx context.Context) ([]*OfflineSessi
 		}(i, ctx)
 	}
 	if len(mutators) > 0 {
-		if _, err := mutators[0].Mutate(ctx, oscb.builders[0].mutation); err != nil {
+		if _, err := mutators[0].Mutate(ctx, _c.builders[0].mutation); err != nil {
 			return nil, err
 		}
 	}
@@ -278,8 +223,8 @@ func (oscb *OfflineSessionCreateBulk) Save(ctx context.Context) ([]*OfflineSessi
 }
 
 // SaveX is like Save, but panics if an error occurs.
-func (oscb *OfflineSessionCreateBulk) SaveX(ctx context.Context) []*OfflineSession {
-	v, err := oscb.Save(ctx)
+func (_c *OfflineSessionCreateBulk) SaveX(ctx context.Context) []*OfflineSession {
+	v, err := _c.Save(ctx)
 	if err != nil {
 		panic(err)
 	}
@@ -287,14 +232,14 @@ func (oscb *OfflineSessionCreateBulk) SaveX(ctx context.Context) []*OfflineSessi
 }
 
 // Exec executes the query.
-func (oscb *OfflineSessionCreateBulk) Exec(ctx context.Context) error {
-	_, err := oscb.Save(ctx)
+func (_c *OfflineSessionCreateBulk) Exec(ctx context.Context) error {
+	_, err := _c.Save(ctx)
 	return err
 }
 
 // ExecX is like Exec, but panics if an error occurs.
-func (oscb *OfflineSessionCreateBulk) ExecX(ctx context.Context) {
-	if err := oscb.Exec(ctx); err != nil {
+func (_c *OfflineSessionCreateBulk) ExecX(ctx context.Context) {
+	if err := _c.Exec(ctx); err != nil {
 		panic(err)
 	}
 }
diff --git a/storage/ent/db/offlinesession_delete.go b/storage/ent/db/offlinesession_delete.go
index b9c60ba9a3..ea03cd507e 100644
--- a/storage/ent/db/offlinesession_delete.go
+++ b/storage/ent/db/offlinesession_delete.go
@@ -4,7 +4,6 @@ package db
 
 import (
 	"context"
-	"fmt"
 
 	"entgo.io/ent/dialect/sql"
 	"entgo.io/ent/dialect/sql/sqlgraph"
@@ -21,84 +20,56 @@ type OfflineSessionDelete struct {
 }
 
 // Where appends a list predicates to the OfflineSessionDelete builder.
-func (osd *OfflineSessionDelete) Where(ps ...predicate.OfflineSession) *OfflineSessionDelete {
-	osd.mutation.Where(ps...)
-	return osd
+func (_d *OfflineSessionDelete) Where(ps ...predicate.OfflineSession) *OfflineSessionDelete {
+	_d.mutation.Where(ps...)
+	return _d
 }
 
 // Exec executes the deletion query and returns how many vertices were deleted.
-func (osd *OfflineSessionDelete) Exec(ctx context.Context) (int, error) {
-	var (
-		err      error
-		affected int
-	)
-	if len(osd.hooks) == 0 {
-		affected, err = osd.sqlExec(ctx)
-	} else {
-		var mut Mutator = MutateFunc(func(ctx context.Context, m Mutation) (Value, error) {
-			mutation, ok := m.(*OfflineSessionMutation)
-			if !ok {
-				return nil, fmt.Errorf("unexpected mutation type %T", m)
-			}
-			osd.mutation = mutation
-			affected, err = osd.sqlExec(ctx)
-			mutation.done = true
-			return affected, err
-		})
-		for i := len(osd.hooks) - 1; i >= 0; i-- {
-			if osd.hooks[i] == nil {
-				return 0, fmt.Errorf("db: uninitialized hook (forgotten import db/runtime?)")
-			}
-			mut = osd.hooks[i](mut)
-		}
-		if _, err := mut.Mutate(ctx, osd.mutation); err != nil {
-			return 0, err
-		}
-	}
-	return affected, err
+func (_d *OfflineSessionDelete) Exec(ctx context.Context) (int, error) {
+	return withHooks(ctx, _d.sqlExec, _d.mutation, _d.hooks)
 }
 
 // ExecX is like Exec, but panics if an error occurs.
-func (osd *OfflineSessionDelete) ExecX(ctx context.Context) int {
-	n, err := osd.Exec(ctx)
+func (_d *OfflineSessionDelete) ExecX(ctx context.Context) int {
+	n, err := _d.Exec(ctx)
 	if err != nil {
 		panic(err)
 	}
 	return n
 }
 
-func (osd *OfflineSessionDelete) sqlExec(ctx context.Context) (int, error) {
-	_spec := &sqlgraph.DeleteSpec{
-		Node: &sqlgraph.NodeSpec{
-			Table: offlinesession.Table,
-			ID: &sqlgraph.FieldSpec{
-				Type:   field.TypeString,
-				Column: offlinesession.FieldID,
-			},
-		},
-	}
-	if ps := osd.mutation.predicates; len(ps) > 0 {
+func (_d *OfflineSessionDelete) sqlExec(ctx context.Context) (int, error) {
+	_spec := sqlgraph.NewDeleteSpec(offlinesession.Table, sqlgraph.NewFieldSpec(offlinesession.FieldID, field.TypeString))
+	if ps := _d.mutation.predicates; len(ps) > 0 {
 		_spec.Predicate = func(selector *sql.Selector) {
 			for i := range ps {
 				ps[i](selector)
 			}
 		}
 	}
-	affected, err := sqlgraph.DeleteNodes(ctx, osd.driver, _spec)
+	affected, err := sqlgraph.DeleteNodes(ctx, _d.driver, _spec)
 	if err != nil && sqlgraph.IsConstraintError(err) {
 		err = &ConstraintError{msg: err.Error(), wrap: err}
 	}
+	_d.mutation.done = true
 	return affected, err
 }
 
 // OfflineSessionDeleteOne is the builder for deleting a single OfflineSession entity.
 type OfflineSessionDeleteOne struct {
-	osd *OfflineSessionDelete
+	_d *OfflineSessionDelete
+}
+
+// Where appends a list predicates to the OfflineSessionDelete builder.
+func (_d *OfflineSessionDeleteOne) Where(ps ...predicate.OfflineSession) *OfflineSessionDeleteOne {
+	_d._d.mutation.Where(ps...)
+	return _d
 }
 
 // Exec executes the deletion query.
-func (osdo *OfflineSessionDeleteOne) Exec(ctx context.Context) error {
-	n, err := osdo.osd.Exec(ctx)
+func (_d *OfflineSessionDeleteOne) Exec(ctx context.Context) error {
+	n, err := _d._d.Exec(ctx)
 	switch {
 	case err != nil:
 		return err
@@ -110,6 +81,8 @@ func (osdo *OfflineSessionDeleteOne) Exec(ctx context.Context) error {
 }
 
 // ExecX is like Exec, but panics if an error occurs.
-func (osdo *OfflineSessionDeleteOne) ExecX(ctx context.Context) {
-	osdo.osd.ExecX(ctx)
+func (_d *OfflineSessionDeleteOne) ExecX(ctx context.Context) {
+	if err := _d.Exec(ctx); err != nil {
+		panic(err)
+	}
 }
diff --git a/storage/ent/db/offlinesession_query.go b/storage/ent/db/offlinesession_query.go
index e5e09cf16d..22723620d4 100644
--- a/storage/ent/db/offlinesession_query.go
+++ b/storage/ent/db/offlinesession_query.go
@@ -7,6 +7,7 @@ import (
 	"fmt"
 	"math"
 
+	"entgo.io/ent"
 	"entgo.io/ent/dialect/sql"
 	"entgo.io/ent/dialect/sql/sqlgraph"
 	"entgo.io/ent/schema/field"
@@ -17,11 +18,9 @@ import (
 // OfflineSessionQuery is the builder for querying OfflineSession entities.
 type OfflineSessionQuery struct {
 	config
-	limit      *int
-	offset     *int
-	unique     *bool
-	order      []OrderFunc
-	fields     []string
+	ctx        *QueryContext
+	order      []offlinesession.OrderOption
+	inters     []Interceptor
 	predicates []predicate.OfflineSession
 	// intermediate query (i.e. traversal path).
 	sql  *sql.Selector
@@ -29,40 +28,40 @@ type OfflineSessionQuery struct {
 }
 
 // Where adds a new predicate for the OfflineSessionQuery builder.
-func (osq *OfflineSessionQuery) Where(ps ...predicate.OfflineSession) *OfflineSessionQuery {
-	osq.predicates = append(osq.predicates, ps...)
-	return osq
+func (_q *OfflineSessionQuery) Where(ps ...predicate.OfflineSession) *OfflineSessionQuery {
+	_q.predicates = append(_q.predicates, ps...)
+	return _q
 }
 
-// Limit adds a limit step to the query.
-func (osq *OfflineSessionQuery) Limit(limit int) *OfflineSessionQuery {
-	osq.limit = &limit
-	return osq
+// Limit the number of records to be returned by this query.
+func (_q *OfflineSessionQuery) Limit(limit int) *OfflineSessionQuery {
+	_q.ctx.Limit = &limit
+	return _q
 }
 
-// Offset adds an offset step to the query.
-func (osq *OfflineSessionQuery) Offset(offset int) *OfflineSessionQuery {
-	osq.offset = &offset
-	return osq
+// Offset to start from.
+func (_q *OfflineSessionQuery) Offset(offset int) *OfflineSessionQuery {
+	_q.ctx.Offset = &offset
+	return _q
 }
 
 // Unique configures the query builder to filter duplicate records on query.
 // By default, unique is set to true, and can be disabled using this method.
-func (osq *OfflineSessionQuery) Unique(unique bool) *OfflineSessionQuery {
-	osq.unique = &unique
-	return osq
+func (_q *OfflineSessionQuery) Unique(unique bool) *OfflineSessionQuery {
+	_q.ctx.Unique = &unique
+	return _q
 }
 
-// Order adds an order step to the query.
-func (osq *OfflineSessionQuery) Order(o ...OrderFunc) *OfflineSessionQuery {
-	osq.order = append(osq.order, o...)
-	return osq
+// Order specifies how the records should be ordered.
+func (_q *OfflineSessionQuery) Order(o ...offlinesession.OrderOption) *OfflineSessionQuery {
+	_q.order = append(_q.order, o...)
+	return _q
 }
 
 // First returns the first OfflineSession entity from the query.
 // Returns a *NotFoundError when no OfflineSession was found.
-func (osq *OfflineSessionQuery) First(ctx context.Context) (*OfflineSession, error) {
-	nodes, err := osq.Limit(1).All(ctx)
+func (_q *OfflineSessionQuery) First(ctx context.Context) (*OfflineSession, error) {
+	nodes, err := _q.Limit(1).All(setContextOp(ctx, _q.ctx, ent.OpQueryFirst))
 	if err != nil {
 		return nil, err
 	}
@@ -73,8 +72,8 @@ func (osq *OfflineSessionQuery) First(ctx context.Context) (*OfflineSession, err
 }
 
 // FirstX is like First, but panics if an error occurs.
-func (osq *OfflineSessionQuery) FirstX(ctx context.Context) *OfflineSession {
-	node, err := osq.First(ctx)
+func (_q *OfflineSessionQuery) FirstX(ctx context.Context) *OfflineSession {
+	node, err := _q.First(ctx)
 	if err != nil && !IsNotFound(err) {
 		panic(err)
 	}
@@ -83,9 +82,9 @@ func (osq *OfflineSessionQuery) FirstX(ctx context.Context) *OfflineSession {
 
 // FirstID returns the first OfflineSession ID from the query.
 // Returns a *NotFoundError when no OfflineSession ID was found.
-func (osq *OfflineSessionQuery) FirstID(ctx context.Context) (id string, err error) {
+func (_q *OfflineSessionQuery) FirstID(ctx context.Context) (id string, err error) {
 	var ids []string
-	if ids, err = osq.Limit(1).IDs(ctx); err != nil {
+	if ids, err = _q.Limit(1).IDs(setContextOp(ctx, _q.ctx, ent.OpQueryFirstID)); err != nil {
 		return
 	}
 	if len(ids) == 0 {
@@ -96,8 +95,8 @@ func (osq *OfflineSessionQuery) FirstID(ctx context.Context) (id string, err err
 }
 
 // FirstIDX is like FirstID, but panics if an error occurs.
-func (osq *OfflineSessionQuery) FirstIDX(ctx context.Context) string {
-	id, err := osq.FirstID(ctx)
+func (_q *OfflineSessionQuery) FirstIDX(ctx context.Context) string {
+	id, err := _q.FirstID(ctx)
 	if err != nil && !IsNotFound(err) {
 		panic(err)
 	}
@@ -107,8 +106,8 @@ func (osq *OfflineSessionQuery) FirstIDX(ctx context.Context) string {
 // Only returns a single OfflineSession entity found by the query, ensuring it only returns one.
 // Returns a *NotSingularError when more than one OfflineSession entity is found.
 // Returns a *NotFoundError when no OfflineSession entities are found.
-func (osq *OfflineSessionQuery) Only(ctx context.Context) (*OfflineSession, error) {
-	nodes, err := osq.Limit(2).All(ctx)
+func (_q *OfflineSessionQuery) Only(ctx context.Context) (*OfflineSession, error) {
+	nodes, err := _q.Limit(2).All(setContextOp(ctx, _q.ctx, ent.OpQueryOnly))
 	if err != nil {
 		return nil, err
 	}
@@ -123,8 +122,8 @@ func (osq *OfflineSessionQuery) Only(ctx context.Context) (*OfflineSession, erro
 }
 
 // OnlyX is like Only, but panics if an error occurs.
-func (osq *OfflineSessionQuery) OnlyX(ctx context.Context) *OfflineSession {
-	node, err := osq.Only(ctx)
+func (_q *OfflineSessionQuery) OnlyX(ctx context.Context) *OfflineSession {
+	node, err := _q.Only(ctx)
 	if err != nil {
 		panic(err)
 	}
@@ -134,9 +133,9 @@ func (osq *OfflineSessionQuery) OnlyX(ctx context.Context) *OfflineSession {
 // OnlyID is like Only, but returns the only OfflineSession ID in the query.
 // Returns a *NotSingularError when more than one OfflineSession ID is found.
 // Returns a *NotFoundError when no entities are found.
-func (osq *OfflineSessionQuery) OnlyID(ctx context.Context) (id string, err error) {
+func (_q *OfflineSessionQuery) OnlyID(ctx context.Context) (id string, err error) {
 	var ids []string
-	if ids, err = osq.Limit(2).IDs(ctx); err != nil {
+	if ids, err = _q.Limit(2).IDs(setContextOp(ctx, _q.ctx, ent.OpQueryOnlyID)); err != nil {
 		return
 	}
 	switch len(ids) {
@@ -151,8 +150,8 @@ func (osq *OfflineSessionQuery) OnlyID(ctx context.Context) (id string, err erro
 }
 
 // OnlyIDX is like OnlyID, but panics if an error occurs.
-func (osq *OfflineSessionQuery) OnlyIDX(ctx context.Context) string {
-	id, err := osq.OnlyID(ctx)
+func (_q *OfflineSessionQuery) OnlyIDX(ctx context.Context) string {
+	id, err := _q.OnlyID(ctx)
 	if err != nil {
 		panic(err)
 	}
@@ -160,16 +159,18 @@ func (osq *OfflineSessionQuery) OnlyIDX(ctx context.Context) string {
 }
 
 // All executes the query and returns a list of OfflineSessions.
-func (osq *OfflineSessionQuery) All(ctx context.Context) ([]*OfflineSession, error) {
-	if err := osq.prepareQuery(ctx); err != nil {
+func (_q *OfflineSessionQuery) All(ctx context.Context) ([]*OfflineSession, error) {
+	ctx = setContextOp(ctx, _q.ctx, ent.OpQueryAll)
+	if err := _q.prepareQuery(ctx); err != nil {
 		return nil, err
 	}
-	return osq.sqlAll(ctx)
+	qr := querierAll[[]*OfflineSession, *OfflineSessionQuery]()
+	return withInterceptors[[]*OfflineSession](ctx, _q, qr, _q.inters)
 }
 
 // AllX is like All, but panics if an error occurs.
-func (osq *OfflineSessionQuery) AllX(ctx context.Context) []*OfflineSession {
-	nodes, err := osq.All(ctx)
+func (_q *OfflineSessionQuery) AllX(ctx context.Context) []*OfflineSession {
+	nodes, err := _q.All(ctx)
 	if err != nil {
 		panic(err)
 	}
@@ -177,17 +178,20 @@ func (osq *OfflineSessionQuery) AllX(ctx context.Context) []*OfflineSession {
 }
 
 // IDs executes the query and returns a list of OfflineSession IDs.
-func (osq *OfflineSessionQuery) IDs(ctx context.Context) ([]string, error) {
-	var ids []string
-	if err := osq.Select(offlinesession.FieldID).Scan(ctx, &ids); err != nil {
+func (_q *OfflineSessionQuery) IDs(ctx context.Context) (ids []string, err error) {
+	if _q.ctx.Unique == nil && _q.path != nil {
+		_q.Unique(true)
+	}
+	ctx = setContextOp(ctx, _q.ctx, ent.OpQueryIDs)
+	if err = _q.Select(offlinesession.FieldID).Scan(ctx, &ids); err != nil {
 		return nil, err
 	}
 	return ids, nil
 }
 
 // IDsX is like IDs, but panics if an error occurs.
-func (osq *OfflineSessionQuery) IDsX(ctx context.Context) []string {
-	ids, err := osq.IDs(ctx)
+func (_q *OfflineSessionQuery) IDsX(ctx context.Context) []string {
+	ids, err := _q.IDs(ctx)
 	if err != nil {
 		panic(err)
 	}
@@ -195,16 +199,17 @@ func (osq *OfflineSessionQuery) IDsX(ctx context.Context) []string {
 }
 
 // Count returns the count of the given query.
-func (osq *OfflineSessionQuery) Count(ctx context.Context) (int, error) {
-	if err := osq.prepareQuery(ctx); err != nil {
+func (_q *OfflineSessionQuery) Count(ctx context.Context) (int, error) {
+	ctx = setContextOp(ctx, _q.ctx, ent.OpQueryCount)
+	if err := _q.prepareQuery(ctx); err != nil {
 		return 0, err
 	}
-	return osq.sqlCount(ctx)
+	return withInterceptors[int](ctx, _q, querierCount[*OfflineSessionQuery](), _q.inters)
 }
 
 // CountX is like Count, but panics if an error occurs.
-func (osq *OfflineSessionQuery) CountX(ctx context.Context) int {
-	count, err := osq.Count(ctx)
+func (_q *OfflineSessionQuery) CountX(ctx context.Context) int {
+	count, err := _q.Count(ctx)
 	if err != nil {
 		panic(err)
 	}
@@ -212,16 +217,21 @@ func (osq *OfflineSessionQuery) CountX(ctx context.Context) int {
 }
 
 // Exist returns true if the query has elements in the graph.
-func (osq *OfflineSessionQuery) Exist(ctx context.Context) (bool, error) {
-	if err := osq.prepareQuery(ctx); err != nil {
-		return false, err
+func (_q *OfflineSessionQuery) Exist(ctx context.Context) (bool, error) {
+	ctx = setContextOp(ctx, _q.ctx, ent.OpQueryExist)
+	switch _, err := _q.FirstID(ctx); {
+	case IsNotFound(err):
+		return false, nil
+	case err != nil:
+		return false, fmt.Errorf("db: check existence: %w", err)
+	default:
+		return true, nil
 	}
-	return osq.sqlExist(ctx)
 }
 
 // ExistX is like Exist, but panics if an error occurs.
-func (osq *OfflineSessionQuery) ExistX(ctx context.Context) bool {
-	exist, err := osq.Exist(ctx)
+func (_q *OfflineSessionQuery) ExistX(ctx context.Context) bool {
+	exist, err := _q.Exist(ctx)
 	if err != nil {
 		panic(err)
 	}
@@ -230,20 +240,19 @@ func (osq *OfflineSessionQuery) ExistX(ctx context.Context) bool {
 
 // Clone returns a duplicate of the OfflineSessionQuery builder, including all associated steps. It can be
 // used to prepare common query builders and use them differently after the clone is made.
-func (osq *OfflineSessionQuery) Clone() *OfflineSessionQuery {
-	if osq == nil {
+func (_q *OfflineSessionQuery) Clone() *OfflineSessionQuery {
+	if _q == nil {
 		return nil
 	}
 	return &OfflineSessionQuery{
-		config:     osq.config,
-		limit:      osq.limit,
-		offset:     osq.offset,
-		order:      append([]OrderFunc{}, osq.order...),
-		predicates: append([]predicate.OfflineSession{}, osq.predicates...),
+		config:     _q.config,
+		ctx:        _q.ctx.Clone(),
+		order:      append([]offlinesession.OrderOption{}, _q.order...),
+		inters:     append([]Interceptor{}, _q.inters...),
+		predicates: append([]predicate.OfflineSession{}, _q.predicates...),
 		// clone intermediate query.
-		sql:    osq.sql.Clone(),
-		path:   osq.path,
-		unique: osq.unique,
+		sql:  _q.sql.Clone(),
+		path: _q.path,
 	}
 }
 
@@ -261,18 +270,12 @@ func (osq *OfflineSessionQuery) Clone() *OfflineSessionQuery {
 //		GroupBy(offlinesession.FieldUserID).
 //		Aggregate(db.Count()).
 //		Scan(ctx, &v)
-//
-func (osq *OfflineSessionQuery) GroupBy(field string, fields ...string) *OfflineSessionGroupBy {
-	grbuild := &OfflineSessionGroupBy{config: osq.config}
-	grbuild.fields = append([]string{field}, fields...)
-	grbuild.path = func(ctx context.Context) (prev *sql.Selector, err error) {
-		if err := osq.prepareQuery(ctx); err != nil {
-			return nil, err
-		}
-		return osq.sqlQuery(ctx), nil
-	}
+func (_q *OfflineSessionQuery) GroupBy(field string, fields ...string) *OfflineSessionGroupBy {
+	_q.ctx.Fields = append([]string{field}, fields...)
+	grbuild := &OfflineSessionGroupBy{build: _q}
+	grbuild.flds = &_q.ctx.Fields
 	grbuild.label = offlinesession.Label
-	grbuild.flds, grbuild.scan = &grbuild.fields, grbuild.Scan
+	grbuild.scan = grbuild.Scan
 	return grbuild
 }
 
@@ -288,48 +291,62 @@ func (osq *OfflineSessionQuery) GroupBy(field string, fields ...string) *Offline
 //	client.OfflineSession.Query().
 //		Select(offlinesession.FieldUserID).
 //		Scan(ctx, &v)
-//
-func (osq *OfflineSessionQuery) Select(fields ...string) *OfflineSessionSelect {
-	osq.fields = append(osq.fields, fields...)
-	selbuild := &OfflineSessionSelect{OfflineSessionQuery: osq}
-	selbuild.label = offlinesession.Label
-	selbuild.flds, selbuild.scan = &osq.fields, selbuild.Scan
-	return selbuild
+func (_q *OfflineSessionQuery) Select(fields ...string) *OfflineSessionSelect {
+	_q.ctx.Fields = append(_q.ctx.Fields, fields...)
+	sbuild := &OfflineSessionSelect{OfflineSessionQuery: _q}
+	sbuild.label = offlinesession.Label
+	sbuild.flds, sbuild.scan = &_q.ctx.Fields, sbuild.Scan
+	return sbuild
+}
+
+// Aggregate returns a OfflineSessionSelect configured with the given aggregations.
+func (_q *OfflineSessionQuery) Aggregate(fns ...AggregateFunc) *OfflineSessionSelect {
+	return _q.Select().Aggregate(fns...)
 }
 
-func (osq *OfflineSessionQuery) prepareQuery(ctx context.Context) error {
-	for _, f := range osq.fields {
+func (_q *OfflineSessionQuery) prepareQuery(ctx context.Context) error {
+	for _, inter := range _q.inters {
+		if inter == nil {
+			return fmt.Errorf("db: uninitialized interceptor (forgotten import db/runtime?)")
+		}
+		if trv, ok := inter.(Traverser); ok {
+			if err := trv.Traverse(ctx, _q); err != nil {
+				return err
+			}
+		}
+	}
+	for _, f := range _q.ctx.Fields {
 		if !offlinesession.ValidColumn(f) {
 			return &ValidationError{Name: f, err: fmt.Errorf("db: invalid field %q for query", f)}
 		}
 	}
-	if osq.path != nil {
-		prev, err := osq.path(ctx)
+	if _q.path != nil {
+		prev, err := _q.path(ctx)
 		if err != nil {
 			return err
 		}
-		osq.sql = prev
+		_q.sql = prev
 	}
 	return nil
 }
 
-func (osq *OfflineSessionQuery) sqlAll(ctx context.Context, hooks ...queryHook) ([]*OfflineSession, error) {
+func (_q *OfflineSessionQuery) sqlAll(ctx context.Context, hooks ...queryHook) ([]*OfflineSession, error) {
 	var (
 		nodes = []*OfflineSession{}
-		_spec = osq.querySpec()
+		_spec = _q.querySpec()
 	)
-	_spec.ScanValues = func(columns []string) ([]interface{}, error) {
+	_spec.ScanValues = func(columns []string) ([]any, error) {
 		return (*OfflineSession).scanValues(nil, columns)
 	}
-	_spec.Assign = func(columns []string, values []interface{}) error {
-		node := &OfflineSession{config: osq.config}
+	_spec.Assign = func(columns []string, values []any) error {
+		node := &OfflineSession{config: _q.config}
 		nodes = append(nodes, node)
 		return node.assignValues(columns, values)
 	}
 	for i := range hooks {
 		hooks[i](ctx, _spec)
 	}
-	if err := sqlgraph.QueryNodes(ctx, osq.driver, _spec); err != nil {
+	if err := sqlgraph.QueryNodes(ctx, _q.driver, _spec); err != nil {
 		return nil, err
 	}
 	if len(nodes) == 0 {
@@ -338,40 +355,24 @@ func (osq *OfflineSessionQuery) sqlAll(ctx context.Context, hooks ...queryHook)
 	return nodes, nil
 }
 
-func (osq *OfflineSessionQuery) sqlCount(ctx context.Context) (int, error) {
-	_spec := osq.querySpec()
-	_spec.Node.Columns = osq.fields
-	if len(osq.fields) > 0 {
-		_spec.Unique = osq.unique != nil && *osq.unique
-	}
-	return sqlgraph.CountNodes(ctx, osq.driver, _spec)
-}
-
-func (osq *OfflineSessionQuery) sqlExist(ctx context.Context) (bool, error) {
-	n, err := osq.sqlCount(ctx)
-	if err != nil {
-		return false, fmt.Errorf("db: check existence: %w", err)
+func (_q *OfflineSessionQuery) sqlCount(ctx context.Context) (int, error) {
+	_spec := _q.querySpec()
+	_spec.Node.Columns = _q.ctx.Fields
+	if len(_q.ctx.Fields) > 0 {
+		_spec.Unique = _q.ctx.Unique != nil && *_q.ctx.Unique
 	}
-	return n > 0, nil
+	return sqlgraph.CountNodes(ctx, _q.driver, _spec)
 }
 
-func (osq *OfflineSessionQuery) querySpec() *sqlgraph.QuerySpec {
-	_spec := &sqlgraph.QuerySpec{
-		Node: &sqlgraph.NodeSpec{
-			Table:   offlinesession.Table,
-			Columns: offlinesession.Columns,
-			ID: &sqlgraph.FieldSpec{
-				Type:   field.TypeString,
-				Column: offlinesession.FieldID,
-			},
-		},
-		From:   osq.sql,
-		Unique: true,
-	}
-	if unique := osq.unique; unique != nil {
+func (_q *OfflineSessionQuery) querySpec() *sqlgraph.QuerySpec {
+	_spec := sqlgraph.NewQuerySpec(offlinesession.Table, offlinesession.Columns, sqlgraph.NewFieldSpec(offlinesession.FieldID, field.TypeString))
+	_spec.From = _q.sql
+	if unique := _q.ctx.Unique; unique != nil {
 		_spec.Unique = *unique
+	} else if _q.path != nil {
+		_spec.Unique = true
 	}
-	if fields := osq.fields; len(fields) > 0 {
+	if fields := _q.ctx.Fields; len(fields) > 0 {
 		_spec.Node.Columns = make([]string, 0, len(fields))
 		_spec.Node.Columns = append(_spec.Node.Columns, offlinesession.FieldID)
 		for i := range fields {
@@ -380,20 +381,20 @@ func (osq *OfflineSessionQuery) querySpec() *sqlgraph.QuerySpec {
 			}
 		}
 	}
-	if ps := osq.predicates; len(ps) > 0 {
+	if ps := _q.predicates; len(ps) > 0 {
 		_spec.Predicate = func(selector *sql.Selector) {
 			for i := range ps {
 				ps[i](selector)
 			}
 		}
 	}
-	if limit := osq.limit; limit != nil {
+	if limit := _q.ctx.Limit; limit != nil {
 		_spec.Limit = *limit
 	}
-	if offset := osq.offset; offset != nil {
+	if offset := _q.ctx.Offset; offset != nil {
 		_spec.Offset = *offset
 	}
-	if ps := osq.order; len(ps) > 0 {
+	if ps := _q.order; len(ps) > 0 {
 		_spec.Order = func(selector *sql.Selector) {
 			for i := range ps {
 				ps[i](selector)
@@ -403,33 +404,33 @@ func (osq *OfflineSessionQuery) querySpec() *sqlgraph.QuerySpec {
 	return _spec
 }
 
-func (osq *OfflineSessionQuery) sqlQuery(ctx context.Context) *sql.Selector {
-	builder := sql.Dialect(osq.driver.Dialect())
+func (_q *OfflineSessionQuery) sqlQuery(ctx context.Context) *sql.Selector {
+	builder := sql.Dialect(_q.driver.Dialect())
 	t1 := builder.Table(offlinesession.Table)
-	columns := osq.fields
+	columns := _q.ctx.Fields
 	if len(columns) == 0 {
 		columns = offlinesession.Columns
 	}
 	selector := builder.Select(t1.Columns(columns...)...).From(t1)
-	if osq.sql != nil {
-		selector = osq.sql
+	if _q.sql != nil {
+		selector = _q.sql
 		selector.Select(selector.Columns(columns...)...)
 	}
-	if osq.unique != nil && *osq.unique {
+	if _q.ctx.Unique != nil && *_q.ctx.Unique {
 		selector.Distinct()
 	}
-	for _, p := range osq.predicates {
+	for _, p := range _q.predicates {
 		p(selector)
 	}
-	for _, p := range osq.order {
+	for _, p := range _q.order {
 		p(selector)
 	}
-	if offset := osq.offset; offset != nil {
+	if offset := _q.ctx.Offset; offset != nil {
 		// limit is mandatory for offset clause. We start
 		// with default value, and override it below if needed.
 		selector.Offset(*offset).Limit(math.MaxInt32)
 	}
-	if limit := osq.limit; limit != nil {
+	if limit := _q.ctx.Limit; limit != nil {
 		selector.Limit(*limit)
 	}
 	return selector
@@ -437,90 +438,88 @@ func (osq *OfflineSessionQuery) sqlQuery(ctx context.Context) *sql.Selector {
 
 // OfflineSessionGroupBy is the group-by builder for OfflineSession entities.
 type OfflineSessionGroupBy struct {
-	config
 	selector
-	fields []string
-	fns    []AggregateFunc
-	// intermediate query (i.e. traversal path).
-	sql  *sql.Selector
-	path func(context.Context) (*sql.Selector, error)
+	build *OfflineSessionQuery
 }
 
 // Aggregate adds the given aggregation functions to the group-by query.
-func (osgb *OfflineSessionGroupBy) Aggregate(fns ...AggregateFunc) *OfflineSessionGroupBy {
-	osgb.fns = append(osgb.fns, fns...)
-	return osgb
+func (_g *OfflineSessionGroupBy) Aggregate(fns ...AggregateFunc) *OfflineSessionGroupBy {
+	_g.fns = append(_g.fns, fns...)
+	return _g
 }
 
-// Scan applies the group-by query and scans the result into the given value.
-func (osgb *OfflineSessionGroupBy) Scan(ctx context.Context, v interface{}) error {
-	query, err := osgb.path(ctx)
-	if err != nil {
+// Scan applies the selector query and scans the result into the given value.
+func (_g *OfflineSessionGroupBy) Scan(ctx context.Context, v any) error {
+	ctx = setContextOp(ctx, _g.build.ctx, ent.OpQueryGroupBy)
+	if err := _g.build.prepareQuery(ctx); err != nil {
 		return err
 	}
-	osgb.sql = query
-	return osgb.sqlScan(ctx, v)
+	return scanWithInterceptors[*OfflineSessionQuery, *OfflineSessionGroupBy](ctx, _g.build, _g, _g.build.inters, v)
 }
 
-func (osgb *OfflineSessionGroupBy) sqlScan(ctx context.Context, v interface{}) error {
-	for _, f := range osgb.fields {
-		if !offlinesession.ValidColumn(f) {
-			return &ValidationError{Name: f, err: fmt.Errorf("invalid field %q for group-by", f)}
+func (_g *OfflineSessionGroupBy) sqlScan(ctx context.Context, root *OfflineSessionQuery, v any) error {
+	selector := root.sqlQuery(ctx).Select()
+	aggregation := make([]string, 0, len(_g.fns))
+	for _, fn := range _g.fns {
+		aggregation = append(aggregation, fn(selector))
+	}
+	if len(selector.SelectedColumns()) == 0 {
+		columns := make([]string, 0, len(*_g.flds)+len(_g.fns))
+		for _, f := range *_g.flds {
+			columns = append(columns, selector.C(f))
 		}
+		columns = append(columns, aggregation...)
+		selector.Select(columns...)
 	}
-	selector := osgb.sqlQuery()
+	selector.GroupBy(selector.Columns(*_g.flds...)...)
 	if err := selector.Err(); err != nil {
 		return err
 	}
 	rows := &sql.Rows{}
 	query, args := selector.Query()
-	if err := osgb.driver.Query(ctx, query, args, rows); err != nil {
+	if err := _g.build.driver.Query(ctx, query, args, rows); err != nil {
 		return err
 	}
 	defer rows.Close()
 	return sql.ScanSlice(rows, v)
 }
 
-func (osgb *OfflineSessionGroupBy) sqlQuery() *sql.Selector {
-	selector := osgb.sql.Select()
-	aggregation := make([]string, 0, len(osgb.fns))
-	for _, fn := range osgb.fns {
-		aggregation = append(aggregation, fn(selector))
-	}
-	// If no columns were selected in a custom aggregation function, the default
-	// selection is the fields used for "group-by", and the aggregation functions.
-	if len(selector.SelectedColumns()) == 0 {
-		columns := make([]string, 0, len(osgb.fields)+len(osgb.fns))
-		for _, f := range osgb.fields {
-			columns = append(columns, selector.C(f))
-		}
-		columns = append(columns, aggregation...)
-		selector.Select(columns...)
-	}
-	return selector.GroupBy(selector.Columns(osgb.fields...)...)
-}
-
 // OfflineSessionSelect is the builder for selecting fields of OfflineSession entities.
 type OfflineSessionSelect struct {
 	*OfflineSessionQuery
 	selector
-	// intermediate query (i.e. traversal path).
-	sql *sql.Selector
+}
+
+// Aggregate adds the given aggregation functions to the selector query.
+func (_s *OfflineSessionSelect) Aggregate(fns ...AggregateFunc) *OfflineSessionSelect {
+	_s.fns = append(_s.fns, fns...)
+	return _s
 }
 
 // Scan applies the selector query and scans the result into the given value.
-func (oss *OfflineSessionSelect) Scan(ctx context.Context, v interface{}) error {
-	if err := oss.prepareQuery(ctx); err != nil {
+func (_s *OfflineSessionSelect) Scan(ctx context.Context, v any) error {
+	ctx = setContextOp(ctx, _s.ctx, ent.OpQuerySelect)
+	if err := _s.prepareQuery(ctx); err != nil {
 		return err
 	}
-	oss.sql = oss.OfflineSessionQuery.sqlQuery(ctx)
-	return oss.sqlScan(ctx, v)
+	return scanWithInterceptors[*OfflineSessionQuery, *OfflineSessionSelect](ctx, _s.OfflineSessionQuery, _s, _s.inters, v)
 }
 
-func (oss *OfflineSessionSelect) sqlScan(ctx context.Context, v interface{}) error {
+func (_s *OfflineSessionSelect) sqlScan(ctx context.Context, root *OfflineSessionQuery, v any) error {
+	selector := root.sqlQuery(ctx)
+	aggregation := make([]string, 0, len(_s.fns))
+	for _, fn := range _s.fns {
+		aggregation = append(aggregation, fn(selector))
+	}
+	switch n := len(*_s.selector.flds); {
+	case n == 0 && len(aggregation) > 0:
+		selector.Select(aggregation...)
+	case n != 0 && len(aggregation) > 0:
+		selector.AppendSelect(aggregation...)
+	}
 	rows := &sql.Rows{}
-	query, args := oss.sql.Query()
-	if err := oss.driver.Query(ctx, query, args, rows); err != nil {
+	query, args := selector.Query()
+	if err := _s.driver.Query(ctx, query, args, rows); err != nil {
 		return err
 	}
 	defer rows.Close()
diff --git a/storage/ent/db/offlinesession_update.go b/storage/ent/db/offlinesession_update.go
index f9f1d9cbf1..8eca1b76f0 100644
--- a/storage/ent/db/offlinesession_update.go
+++ b/storage/ent/db/offlinesession_update.go
@@ -22,87 +22,70 @@ type OfflineSessionUpdate struct {
 }
 
 // Where appends a list predicates to the OfflineSessionUpdate builder.
-func (osu *OfflineSessionUpdate) Where(ps ...predicate.OfflineSession) *OfflineSessionUpdate {
-	osu.mutation.Where(ps...)
-	return osu
+func (_u *OfflineSessionUpdate) Where(ps ...predicate.OfflineSession) *OfflineSessionUpdate {
+	_u.mutation.Where(ps...)
+	return _u
 }
 
 // SetUserID sets the "user_id" field.
-func (osu *OfflineSessionUpdate) SetUserID(s string) *OfflineSessionUpdate {
-	osu.mutation.SetUserID(s)
-	return osu
+func (_u *OfflineSessionUpdate) SetUserID(v string) *OfflineSessionUpdate {
+	_u.mutation.SetUserID(v)
+	return _u
+}
+
+// SetNillableUserID sets the "user_id" field if the given value is not nil.
+func (_u *OfflineSessionUpdate) SetNillableUserID(v *string) *OfflineSessionUpdate {
+	if v != nil {
+		_u.SetUserID(*v)
+	}
+	return _u
 }
 
 // SetConnID sets the "conn_id" field.
-func (osu *OfflineSessionUpdate) SetConnID(s string) *OfflineSessionUpdate {
-	osu.mutation.SetConnID(s)
-	return osu
+func (_u *OfflineSessionUpdate) SetConnID(v string) *OfflineSessionUpdate {
+	_u.mutation.SetConnID(v)
+	return _u
+}
+
+// SetNillableConnID sets the "conn_id" field if the given value is not nil.
+func (_u *OfflineSessionUpdate) SetNillableConnID(v *string) *OfflineSessionUpdate {
+	if v != nil {
+		_u.SetConnID(*v)
+	}
+	return _u
 }
 
 // SetRefresh sets the "refresh" field.
-func (osu *OfflineSessionUpdate) SetRefresh(b []byte) *OfflineSessionUpdate {
-	osu.mutation.SetRefresh(b)
-	return osu
+func (_u *OfflineSessionUpdate) SetRefresh(v []byte) *OfflineSessionUpdate {
+	_u.mutation.SetRefresh(v)
+	return _u
 }
 
 // SetConnectorData sets the "connector_data" field.
-func (osu *OfflineSessionUpdate) SetConnectorData(b []byte) *OfflineSessionUpdate {
-	osu.mutation.SetConnectorData(b)
-	return osu
+func (_u *OfflineSessionUpdate) SetConnectorData(v []byte) *OfflineSessionUpdate {
+	_u.mutation.SetConnectorData(v)
+	return _u
 }
 
 // ClearConnectorData clears the value of the "connector_data" field.
-func (osu *OfflineSessionUpdate) ClearConnectorData() *OfflineSessionUpdate {
-	osu.mutation.ClearConnectorData()
-	return osu
+func (_u *OfflineSessionUpdate) ClearConnectorData() *OfflineSessionUpdate {
+	_u.mutation.ClearConnectorData()
+	return _u
 }
 
 // Mutation returns the OfflineSessionMutation object of the builder.
-func (osu *OfflineSessionUpdate) Mutation() *OfflineSessionMutation {
-	return osu.mutation
+func (_u *OfflineSessionUpdate) Mutation() *OfflineSessionMutation {
+	return _u.mutation
 }
 
 // Save executes the query and returns the number of nodes affected by the update operation.
-func (osu *OfflineSessionUpdate) Save(ctx context.Context) (int, error) {
-	var (
-		err      error
-		affected int
-	)
-	if len(osu.hooks) == 0 {
-		if err = osu.check(); err != nil {
-			return 0, err
-		}
-		affected, err = osu.sqlSave(ctx)
-	} else {
-		var mut Mutator = MutateFunc(func(ctx context.Context, m Mutation) (Value, error) {
-			mutation, ok := m.(*OfflineSessionMutation)
-			if !ok {
-				return nil, fmt.Errorf("unexpected mutation type %T", m)
-			}
-			if err = osu.check(); err != nil {
-				return 0, err
-			}
-			osu.mutation = mutation
-			affected, err = osu.sqlSave(ctx)
-			mutation.done = true
-			return affected, err
-		})
-		for i := len(osu.hooks) - 1; i >= 0; i-- {
-			if osu.hooks[i] == nil {
-				return 0, fmt.Errorf("db: uninitialized hook (forgotten import db/runtime?)")
-			}
-			mut = osu.hooks[i](mut)
-		}
-		if _, err := mut.Mutate(ctx, osu.mutation); err != nil {
-			return 0, err
-		}
-	}
-	return affected, err
+func (_u *OfflineSessionUpdate) Save(ctx context.Context) (int, error) {
+	return withHooks(ctx, _u.sqlSave, _u.mutation, _u.hooks)
 }
 
 // SaveX is like Save, but panics if an error occurs.
-func (osu *OfflineSessionUpdate) SaveX(ctx context.Context) int {
-	affected, err := osu.Save(ctx)
+func (_u *OfflineSessionUpdate) SaveX(ctx context.Context) int {
+	affected, err := _u.Save(ctx)
 	if err != nil {
 		panic(err)
 	}
@@ -110,26 +93,26 @@ func (osu *OfflineSessionUpdate) SaveX(ctx context.Context) int {
 }
 
 // Exec executes the query.
-func (osu *OfflineSessionUpdate) Exec(ctx context.Context) error {
-	_, err := osu.Save(ctx)
+func (_u *OfflineSessionUpdate) Exec(ctx context.Context) error {
+	_, err := _u.Save(ctx)
 	return err
 }
 
 // ExecX is like Exec, but panics if an error occurs.
-func (osu *OfflineSessionUpdate) ExecX(ctx context.Context) {
-	if err := osu.Exec(ctx); err != nil {
+func (_u *OfflineSessionUpdate) ExecX(ctx context.Context) {
+	if err := _u.Exec(ctx); err != nil {
 		panic(err)
 	}
 }
 
 // check runs all checks and user-defined validators on the builder.
-func (osu *OfflineSessionUpdate) check() error {
-	if v, ok := osu.mutation.UserID(); ok {
+func (_u *OfflineSessionUpdate) check() error {
+	if v, ok := _u.mutation.UserID(); ok {
 		if err := offlinesession.UserIDValidator(v); err != nil {
 			return &ValidationError{Name: "user_id", err: fmt.Errorf(`db: validator failed for field "OfflineSession.user_id": %w`, err)}
 		}
 	}
-	if v, ok := osu.mutation.ConnID(); ok {
+	if v, ok := _u.mutation.ConnID(); ok {
 		if err := offlinesession.ConnIDValidator(v); err != nil {
 			return &ValidationError{Name: "conn_id", err: fmt.Errorf(`db: validator failed for field "OfflineSession.conn_id": %w`, err)}
 		}
@@ -137,59 +120,34 @@ func (osu *OfflineSessionUpdate) check() error {
 	return nil
 }
 
-func (osu *OfflineSessionUpdate) sqlSave(ctx context.Context) (n int, err error) {
-	_spec := &sqlgraph.UpdateSpec{
-		Node: &sqlgraph.NodeSpec{
-			Table:   offlinesession.Table,
-			Columns: offlinesession.Columns,
-			ID: &sqlgraph.FieldSpec{
-				Type:   field.TypeString,
-				Column: offlinesession.FieldID,
-			},
-		},
+func (_u *OfflineSessionUpdate) sqlSave(ctx context.Context) (_node int, err error) {
+	if err := _u.check(); err != nil {
+		return _node, err
 	}
-	if ps := osu.mutation.predicates; len(ps) > 0 {
+	_spec := sqlgraph.NewUpdateSpec(offlinesession.Table, offlinesession.Columns, sqlgraph.NewFieldSpec(offlinesession.FieldID, field.TypeString))
+	if ps := _u.mutation.predicates; len(ps) > 0 {
 		_spec.Predicate = func(selector *sql.Selector) {
 			for i := range ps {
 				ps[i](selector)
 			}
 		}
 	}
-	if value, ok := osu.mutation.UserID(); ok {
-		_spec.Fields.Set = append(_spec.Fields.Set, &sqlgraph.FieldSpec{
-			Type:   field.TypeString,
-			Value:  value,
-			Column: offlinesession.FieldUserID,
-		})
+	if value, ok := _u.mutation.UserID(); ok {
+		_spec.SetField(offlinesession.FieldUserID, field.TypeString, value)
 	}
-	if value, ok := osu.mutation.ConnID(); ok {
-		_spec.Fields.Set = append(_spec.Fields.Set, &sqlgraph.FieldSpec{
-			Type:   field.TypeString,
-			Value:  value,
-			Column: offlinesession.FieldConnID,
-		})
+	if value, ok := _u.mutation.ConnID(); ok {
+		_spec.SetField(offlinesession.FieldConnID, field.TypeString, value)
 	}
-	if value, ok := osu.mutation.Refresh(); ok {
-		_spec.Fields.Set = append(_spec.Fields.Set, &sqlgraph.FieldSpec{
-			Type:   field.TypeBytes,
-			Value:  value,
-			Column: offlinesession.FieldRefresh,
-		})
+	if value, ok := _u.mutation.Refresh(); ok {
+		_spec.SetField(offlinesession.FieldRefresh, field.TypeBytes, value)
 	}
-	if value, ok := osu.mutation.ConnectorData(); ok {
-		_spec.Fields.Set = append(_spec.Fields.Set, &sqlgraph.FieldSpec{
-			Type:   field.TypeBytes,
-			Value:  value,
-			Column: offlinesession.FieldConnectorData,
-		})
+	if value, ok := _u.mutation.ConnectorData(); ok {
+		_spec.SetField(offlinesession.FieldConnectorData, field.TypeBytes, value)
 	}
-	if osu.mutation.ConnectorDataCleared() {
-		_spec.Fields.Clear = append(_spec.Fields.Clear, &sqlgraph.FieldSpec{
-			Type:   field.TypeBytes,
-			Column: offlinesession.FieldConnectorData,
-		})
+	if _u.mutation.ConnectorDataCleared() {
+		_spec.ClearField(offlinesession.FieldConnectorData, field.TypeBytes)
 	}
-	if n, err = sqlgraph.UpdateNodes(ctx, osu.driver, _spec); err != nil {
+	if _node, err = sqlgraph.UpdateNodes(ctx, _u.driver, _spec); err != nil {
 		if _, ok := err.(*sqlgraph.NotFoundError); ok {
 			err = &NotFoundError{offlinesession.Label}
 		} else if sqlgraph.IsConstraintError(err) {
@@ -197,7 +155,8 @@ func (osu *OfflineSessionUpdate) sqlSave(ctx context.Context) (n int, err error)
 		}
 		return 0, err
 	}
-	return n, nil
+	_u.mutation.done = true
+	return _node, nil
 }
 
 // OfflineSessionUpdateOne is the builder for updating a single OfflineSession entity.
@@ -209,94 +168,77 @@ type OfflineSessionUpdateOne struct {
 }
 
 // SetUserID sets the "user_id" field.
-func (osuo *OfflineSessionUpdateOne) SetUserID(s string) *OfflineSessionUpdateOne {
-	osuo.mutation.SetUserID(s)
-	return osuo
+func (_u *OfflineSessionUpdateOne) SetUserID(v string) *OfflineSessionUpdateOne {
+	_u.mutation.SetUserID(v)
+	return _u
+}
+
+// SetNillableUserID sets the "user_id" field if the given value is not nil.
+func (_u *OfflineSessionUpdateOne) SetNillableUserID(v *string) *OfflineSessionUpdateOne {
+	if v != nil {
+		_u.SetUserID(*v)
+	}
+	return _u
 }
 
 // SetConnID sets the "conn_id" field.
-func (osuo *OfflineSessionUpdateOne) SetConnID(s string) *OfflineSessionUpdateOne {
-	osuo.mutation.SetConnID(s)
-	return osuo
+func (_u *OfflineSessionUpdateOne) SetConnID(v string) *OfflineSessionUpdateOne {
+	_u.mutation.SetConnID(v)
+	return _u
+}
+
+// SetNillableConnID sets the "conn_id" field if the given value is not nil.
+func (_u *OfflineSessionUpdateOne) SetNillableConnID(v *string) *OfflineSessionUpdateOne {
+	if v != nil {
+		_u.SetConnID(*v)
+	}
+	return _u
 }
 
 // SetRefresh sets the "refresh" field.
-func (osuo *OfflineSessionUpdateOne) SetRefresh(b []byte) *OfflineSessionUpdateOne {
-	osuo.mutation.SetRefresh(b)
-	return osuo
+func (_u *OfflineSessionUpdateOne) SetRefresh(v []byte) *OfflineSessionUpdateOne {
+	_u.mutation.SetRefresh(v)
+	return _u
 }
 
 // SetConnectorData sets the "connector_data" field.
-func (osuo *OfflineSessionUpdateOne) SetConnectorData(b []byte) *OfflineSessionUpdateOne {
-	osuo.mutation.SetConnectorData(b)
-	return osuo
+func (_u *OfflineSessionUpdateOne) SetConnectorData(v []byte) *OfflineSessionUpdateOne {
+	_u.mutation.SetConnectorData(v)
+	return _u
 }
 
 // ClearConnectorData clears the value of the "connector_data" field.
-func (osuo *OfflineSessionUpdateOne) ClearConnectorData() *OfflineSessionUpdateOne {
-	osuo.mutation.ClearConnectorData()
-	return osuo
+func (_u *OfflineSessionUpdateOne) ClearConnectorData() *OfflineSessionUpdateOne {
+	_u.mutation.ClearConnectorData()
+	return _u
 }
 
 // Mutation returns the OfflineSessionMutation object of the builder.
-func (osuo *OfflineSessionUpdateOne) Mutation() *OfflineSessionMutation {
-	return osuo.mutation
+func (_u *OfflineSessionUpdateOne) Mutation() *OfflineSessionMutation {
+	return _u.mutation
+}
+
+// Where appends a list predicates to the OfflineSessionUpdate builder.
+func (_u *OfflineSessionUpdateOne) Where(ps ...predicate.OfflineSession) *OfflineSessionUpdateOne {
+	_u.mutation.Where(ps...)
+	return _u
 }
 
 // Select allows selecting one or more fields (columns) of the returned entity.
 // The default is selecting all fields defined in the entity schema.
-func (osuo *OfflineSessionUpdateOne) Select(field string, fields ...string) *OfflineSessionUpdateOne {
-	osuo.fields = append([]string{field}, fields...)
-	return osuo
+func (_u *OfflineSessionUpdateOne) Select(field string, fields ...string) *OfflineSessionUpdateOne {
+	_u.fields = append([]string{field}, fields...)
+	return _u
 }
 
 // Save executes the query and returns the updated OfflineSession entity.
-func (osuo *OfflineSessionUpdateOne) Save(ctx context.Context) (*OfflineSession, error) {
-	var (
-		err  error
-		node *OfflineSession
-	)
-	if len(osuo.hooks) == 0 {
-		if err = osuo.check(); err != nil {
-			return nil, err
-		}
-		node, err = osuo.sqlSave(ctx)
-	} else {
-		var mut Mutator = MutateFunc(func(ctx context.Context, m Mutation) (Value, error) {
-			mutation, ok := m.(*OfflineSessionMutation)
-			if !ok {
-				return nil, fmt.Errorf("unexpected mutation type %T", m)
-			}
-			if err = osuo.check(); err != nil {
-				return nil, err
-			}
-			osuo.mutation = mutation
-			node, err = osuo.sqlSave(ctx)
-			mutation.done = true
-			return node, err
-		})
-		for i := len(osuo.hooks) - 1; i >= 0; i-- {
-			if osuo.hooks[i] == nil {
-				return nil, fmt.Errorf("db: uninitialized hook (forgotten import db/runtime?)")
-			}
-			mut = osuo.hooks[i](mut)
-		}
-		v, err := mut.Mutate(ctx, osuo.mutation)
-		if err != nil {
-			return nil, err
-		}
-		nv, ok := v.(*OfflineSession)
-		if !ok {
-			return nil, fmt.Errorf("unexpected node type %T returned from OfflineSessionMutation", v)
-		}
-		node = nv
-	}
-	return node, err
+func (_u *OfflineSessionUpdateOne) Save(ctx context.Context) (*OfflineSession, error) {
+	return withHooks(ctx, _u.sqlSave, _u.mutation, _u.hooks)
 }
 
 // SaveX is like Save, but panics if an error occurs.
-func (osuo *OfflineSessionUpdateOne) SaveX(ctx context.Context) *OfflineSession {
-	node, err := osuo.Save(ctx)
+func (_u *OfflineSessionUpdateOne) SaveX(ctx context.Context) *OfflineSession {
+	node, err := _u.Save(ctx)
 	if err != nil {
 		panic(err)
 	}
@@ -304,26 +246,26 @@ func (osuo *OfflineSessionUpdateOne) SaveX(ctx context.Context) *OfflineSession
 }
 
 // Exec executes the query on the entity.
-func (osuo *OfflineSessionUpdateOne) Exec(ctx context.Context) error {
-	_, err := osuo.Save(ctx)
+func (_u *OfflineSessionUpdateOne) Exec(ctx context.Context) error {
+	_, err := _u.Save(ctx)
 	return err
 }
 
 // ExecX is like Exec, but panics if an error occurs.
-func (osuo *OfflineSessionUpdateOne) ExecX(ctx context.Context) {
-	if err := osuo.Exec(ctx); err != nil {
+func (_u *OfflineSessionUpdateOne) ExecX(ctx context.Context) {
+	if err := _u.Exec(ctx); err != nil {
 		panic(err)
 	}
 }
 
 // check runs all checks and user-defined validators on the builder.
-func (osuo *OfflineSessionUpdateOne) check() error {
-	if v, ok := osuo.mutation.UserID(); ok {
+func (_u *OfflineSessionUpdateOne) check() error {
+	if v, ok := _u.mutation.UserID(); ok {
 		if err := offlinesession.UserIDValidator(v); err != nil {
 			return &ValidationError{Name: "user_id", err: fmt.Errorf(`db: validator failed for field "OfflineSession.user_id": %w`, err)}
 		}
 	}
-	if v, ok := osuo.mutation.ConnID(); ok {
+	if v, ok := _u.mutation.ConnID(); ok {
 		if err := offlinesession.ConnIDValidator(v); err != nil {
 			return &ValidationError{Name: "conn_id", err: fmt.Errorf(`db: validator failed for field "OfflineSession.conn_id": %w`, err)}
 		}
@@ -331,23 +273,17 @@ func (osuo *OfflineSessionUpdateOne) check() error {
 	return nil
 }
 
-func (osuo *OfflineSessionUpdateOne) sqlSave(ctx context.Context) (_node *OfflineSession, err error) {
-	_spec := &sqlgraph.UpdateSpec{
-		Node: &sqlgraph.NodeSpec{
-			Table:   offlinesession.Table,
-			Columns: offlinesession.Columns,
-			ID: &sqlgraph.FieldSpec{
-				Type:   field.TypeString,
-				Column: offlinesession.FieldID,
-			},
-		},
+func (_u *OfflineSessionUpdateOne) sqlSave(ctx context.Context) (_node *OfflineSession, err error) {
+	if err := _u.check(); err != nil {
+		return _node, err
 	}
-	id, ok := osuo.mutation.ID()
+	_spec := sqlgraph.NewUpdateSpec(offlinesession.Table, offlinesession.Columns, sqlgraph.NewFieldSpec(offlinesession.FieldID, field.TypeString))
+	id, ok := _u.mutation.ID()
 	if !ok {
 		return nil, &ValidationError{Name: "id", err: errors.New(`db: missing "OfflineSession.id" for update`)}
 	}
 	_spec.Node.ID.Value = id
-	if fields := osuo.fields; len(fields) > 0 {
+	if fields := _u.fields; len(fields) > 0 {
 		_spec.Node.Columns = make([]string, 0, len(fields))
 		_spec.Node.Columns = append(_spec.Node.Columns, offlinesession.FieldID)
 		for _, f := range fields {
@@ -359,51 +295,32 @@ func (osuo *OfflineSessionUpdateOne) sqlSave(ctx context.Context) (_node *Offlin
 			}
 		}
 	}
-	if ps := osuo.mutation.predicates; len(ps) > 0 {
+	if ps := _u.mutation.predicates; len(ps) > 0 {
 		_spec.Predicate = func(selector *sql.Selector) {
 			for i := range ps {
 				ps[i](selector)
 			}
 		}
 	}
-	if value, ok := osuo.mutation.UserID(); ok {
-		_spec.Fields.Set = append(_spec.Fields.Set, &sqlgraph.FieldSpec{
-			Type:   field.TypeString,
-			Value:  value,
-			Column: offlinesession.FieldUserID,
-		})
+	if value, ok := _u.mutation.UserID(); ok {
+		_spec.SetField(offlinesession.FieldUserID, field.TypeString, value)
 	}
-	if value, ok := osuo.mutation.ConnID(); ok {
-		_spec.Fields.Set = append(_spec.Fields.Set, &sqlgraph.FieldSpec{
-			Type:   field.TypeString,
-			Value:  value,
-			Column: offlinesession.FieldConnID,
-		})
+	if value, ok := _u.mutation.ConnID(); ok {
+		_spec.SetField(offlinesession.FieldConnID, field.TypeString, value)
 	}
-	if value, ok := osuo.mutation.Refresh(); ok {
-		_spec.Fields.Set = append(_spec.Fields.Set, &sqlgraph.FieldSpec{
-			Type:   field.TypeBytes,
-			Value:  value,
-			Column: offlinesession.FieldRefresh,
-		})
+	if value, ok := _u.mutation.Refresh(); ok {
+		_spec.SetField(offlinesession.FieldRefresh, field.TypeBytes, value)
 	}
-	if value, ok := osuo.mutation.ConnectorData(); ok {
-		_spec.Fields.Set = append(_spec.Fields.Set, &sqlgraph.FieldSpec{
-			Type:   field.TypeBytes,
-			Value:  value,
-			Column: offlinesession.FieldConnectorData,
-		})
+	if value, ok := _u.mutation.ConnectorData(); ok {
+		_spec.SetField(offlinesession.FieldConnectorData, field.TypeBytes, value)
 	}
-	if osuo.mutation.ConnectorDataCleared() {
-		_spec.Fields.Clear = append(_spec.Fields.Clear, &sqlgraph.FieldSpec{
-			Type:   field.TypeBytes,
-			Column: offlinesession.FieldConnectorData,
-		})
+	if _u.mutation.ConnectorDataCleared() {
+		_spec.ClearField(offlinesession.FieldConnectorData, field.TypeBytes)
 	}
-	_node = &OfflineSession{config: osuo.config}
+	_node = &OfflineSession{config: _u.config}
 	_spec.Assign = _node.assignValues
 	_spec.ScanValues = _node.scanValues
-	if err = sqlgraph.UpdateNode(ctx, osuo.driver, _spec); err != nil {
+	if err = sqlgraph.UpdateNode(ctx, _u.driver, _spec); err != nil {
 		if _, ok := err.(*sqlgraph.NotFoundError); ok {
 			err = &NotFoundError{offlinesession.Label}
 		} else if sqlgraph.IsConstraintError(err) {
@@ -411,5 +328,6 @@ func (osuo *OfflineSessionUpdateOne) sqlSave(ctx context.Context) (_node *Offlin
 		}
 		return nil, err
 	}
+	_u.mutation.done = true
 	return _node, nil
 }
diff --git a/storage/ent/db/password.go b/storage/ent/db/password.go
index cd30ec54ed..2bcd02175e 100644
--- a/storage/ent/db/password.go
+++ b/storage/ent/db/password.go
@@ -3,9 +3,11 @@
 package db
 
 import (
+	"encoding/json"
 	"fmt"
 	"strings"
 
+	"entgo.io/ent"
 	"entgo.io/ent/dialect/sql"
 	"github.com/dexidp/dex/storage/ent/db/password"
 )
@@ -21,23 +23,34 @@ type Password struct {
 	Hash []byte `json:"hash,omitempty"`
 	// Username holds the value of the "username" field.
 	Username string `json:"username,omitempty"`
+	// Name holds the value of the "name" field.
+	Name string `json:"name,omitempty"`
+	// PreferredUsername holds the value of the "preferred_username" field.
+	PreferredUsername string `json:"preferred_username,omitempty"`
+	// EmailVerified holds the value of the "email_verified" field.
+	EmailVerified *bool `json:"email_verified,omitempty"`
 	// UserID holds the value of the "user_id" field.
 	UserID string `json:"user_id,omitempty"`
+	// Groups holds the value of the "groups" field.
+	Groups       []string `json:"groups,omitempty"`
+	selectValues sql.SelectValues
 }
 
 // scanValues returns the types for scanning values from sql.Rows.
-func (*Password) scanValues(columns []string) ([]interface{}, error) {
-	values := make([]interface{}, len(columns))
+func (*Password) scanValues(columns []string) ([]any, error) {
+	values := make([]any, len(columns))
 	for i := range columns {
 		switch columns[i] {
-		case password.FieldHash:
+		case password.FieldHash, password.FieldGroups:
 			values[i] = new([]byte)
+		case password.FieldEmailVerified:
+			values[i] = new(sql.NullBool)
 		case password.FieldID:
 			values[i] = new(sql.NullInt64)
-		case password.FieldEmail, password.FieldUsername, password.FieldUserID:
+		case password.FieldEmail, password.FieldUsername, password.FieldName, password.FieldPreferredUsername, password.FieldUserID:
 			values[i] = new(sql.NullString)
 		default:
-			return nil, fmt.Errorf("unexpected column %q for type Password", columns[i])
+			values[i] = new(sql.UnknownType)
 		}
 	}
 	return values, nil
@@ -45,7 +58,7 @@ func (*Password) scanValues(columns []string) ([]interface{}, error) {
 
 // assignValues assigns the values that were returned from sql.Rows (after scanning)
 // to the Password fields.
-func (pa *Password) assignValues(columns []string, values []interface{}) error {
+func (_m *Password) assignValues(columns []string, values []any) error {
 	if m, n := len(values), len(columns); m < n {
 		return fmt.Errorf("mismatch number of scan values: %d != %d", m, n)
 	}
@@ -56,79 +69,122 @@ func (pa *Password) assignValues(columns []string, values []interface{}) error {
 			if !ok {
 				return fmt.Errorf("unexpected type %T for field id", value)
 			}
-			pa.ID = int(value.Int64)
+			_m.ID = int(value.Int64)
 		case password.FieldEmail:
 			if value, ok := values[i].(*sql.NullString); !ok {
 				return fmt.Errorf("unexpected type %T for field email", values[i])
 			} else if value.Valid {
-				pa.Email = value.String
+				_m.Email = value.String
 			}
 		case password.FieldHash:
 			if value, ok := values[i].(*[]byte); !ok {
 				return fmt.Errorf("unexpected type %T for field hash", values[i])
 			} else if value != nil {
-				pa.Hash = *value
+				_m.Hash = *value
 			}
 		case password.FieldUsername:
 			if value, ok := values[i].(*sql.NullString); !ok {
 				return fmt.Errorf("unexpected type %T for field username", values[i])
 			} else if value.Valid {
-				pa.Username = value.String
+				_m.Username = value.String
+			}
+		case password.FieldName:
+			if value, ok := values[i].(*sql.NullString); !ok {
+				return fmt.Errorf("unexpected type %T for field name", values[i])
+			} else if value.Valid {
+				_m.Name = value.String
+			}
+		case password.FieldPreferredUsername:
+			if value, ok := values[i].(*sql.NullString); !ok {
+				return fmt.Errorf("unexpected type %T for field preferred_username", values[i])
+			} else if value.Valid {
+				_m.PreferredUsername = value.String
+			}
+		case password.FieldEmailVerified:
+			if value, ok := values[i].(*sql.NullBool); !ok {
+				return fmt.Errorf("unexpected type %T for field email_verified", values[i])
+			} else if value.Valid {
+				_m.EmailVerified = new(bool)
+				*_m.EmailVerified = value.Bool
 			}
 		case password.FieldUserID:
 			if value, ok := values[i].(*sql.NullString); !ok {
 				return fmt.Errorf("unexpected type %T for field user_id", values[i])
 			} else if value.Valid {
-				pa.UserID = value.String
+				_m.UserID = value.String
+			}
+		case password.FieldGroups:
+			if value, ok := values[i].(*[]byte); !ok {
+				return fmt.Errorf("unexpected type %T for field groups", values[i])
+			} else if value != nil && len(*value) > 0 {
+				if err := json.Unmarshal(*value, &_m.Groups); err != nil {
+					return fmt.Errorf("unmarshal field groups: %w", err)
+				}
 			}
+		default:
+			_m.selectValues.Set(columns[i], values[i])
 		}
 	}
 	return nil
 }
 
+// Value returns the ent.Value that was dynamically selected and assigned to the Password.
+// This includes values selected through modifiers, order, etc.
+func (_m *Password) Value(name string) (ent.Value, error) {
+	return _m.selectValues.Get(name)
+}
+
 // Update returns a builder for updating this Password.
 // Note that you need to call Password.Unwrap() before calling this method if this Password
 // was returned from a transaction, and the transaction was committed or rolled back.
-func (pa *Password) Update() *PasswordUpdateOne {
-	return (&PasswordClient{config: pa.config}).UpdateOne(pa)
+func (_m *Password) Update() *PasswordUpdateOne {
+	return NewPasswordClient(_m.config).UpdateOne(_m)
 }
 
 // Unwrap unwraps the Password entity that was returned from a transaction after it was closed,
 // so that all future queries will be executed through the driver which created the transaction.
-func (pa *Password) Unwrap() *Password {
-	_tx, ok := pa.config.driver.(*txDriver)
+func (_m *Password) Unwrap() *Password {
+	_tx, ok := _m.config.driver.(*txDriver)
 	if !ok {
 		panic("db: Password is not a transactional entity")
 	}
-	pa.config.driver = _tx.drv
-	return pa
+	_m.config.driver = _tx.drv
+	return _m
 }
 
 // String implements the fmt.Stringer.
-func (pa *Password) String() string {
+func (_m *Password) String() string {
 	var builder strings.Builder
 	builder.WriteString("Password(")
-	builder.WriteString(fmt.Sprintf("id=%v, ", pa.ID))
+	builder.WriteString(fmt.Sprintf("id=%v, ", _m.ID))
 	builder.WriteString("email=")
-	builder.WriteString(pa.Email)
+	builder.WriteString(_m.Email)
 	builder.WriteString(", ")
 	builder.WriteString("hash=")
-	builder.WriteString(fmt.Sprintf("%v", pa.Hash))
+	builder.WriteString(fmt.Sprintf("%v", _m.Hash))
 	builder.WriteString(", ")
 	builder.WriteString("username=")
-	builder.WriteString(pa.Username)
+	builder.WriteString(_m.Username)
+	builder.WriteString(", ")
+	builder.WriteString("name=")
+	builder.WriteString(_m.Name)
+	builder.WriteString(", ")
+	builder.WriteString("preferred_username=")
+	builder.WriteString(_m.PreferredUsername)
+	builder.WriteString(", ")
+	if v := _m.EmailVerified; v != nil {
+		builder.WriteString("email_verified=")
+		builder.WriteString(fmt.Sprintf("%v", *v))
+	}
 	builder.WriteString(", ")
 	builder.WriteString("user_id=")
-	builder.WriteString(pa.UserID)
+	builder.WriteString(_m.UserID)
+	builder.WriteString(", ")
+	builder.WriteString("groups=")
+	builder.WriteString(fmt.Sprintf("%v", _m.Groups))
 	builder.WriteByte(')')
 	return builder.String()
 }
 
 // Passwords is a parsable slice of Password.
 type Passwords []*Password
-
-func (pa Passwords) config(cfg config) {
-	for _i := range pa {
-		pa[_i].config = cfg
-	}
-}
diff --git a/storage/ent/db/password/password.go b/storage/ent/db/password/password.go
index 34fcac69b8..62080ecf23 100644
--- a/storage/ent/db/password/password.go
+++ b/storage/ent/db/password/password.go
@@ -2,6 +2,10 @@
 
 package password
 
+import (
+	"entgo.io/ent/dialect/sql"
+)
+
 const (
 	// Label holds the string label denoting the password type in the database.
 	Label = "password"
@@ -13,8 +17,16 @@ const (
 	FieldHash = "hash"
 	// FieldUsername holds the string denoting the username field in the database.
 	FieldUsername = "username"
+	// FieldName holds the string denoting the name field in the database.
+	FieldName = "name"
+	// FieldPreferredUsername holds the string denoting the preferred_username field in the database.
+	FieldPreferredUsername = "preferred_username"
+	// FieldEmailVerified holds the string denoting the email_verified field in the database.
+	FieldEmailVerified = "email_verified"
 	// FieldUserID holds the string denoting the user_id field in the database.
 	FieldUserID = "user_id"
+	// FieldGroups holds the string denoting the groups field in the database.
+	FieldGroups = "groups"
 	// Table holds the table name of the password in the database.
 	Table = "passwords"
 )
@@ -25,7 +37,11 @@ var Columns = []string{
 	FieldEmail,
 	FieldHash,
 	FieldUsername,
+	FieldName,
+	FieldPreferredUsername,
+	FieldEmailVerified,
 	FieldUserID,
+	FieldGroups,
 }
 
 // ValidColumn reports if the column name is valid (part of the table columns).
@@ -43,6 +59,48 @@ var (
 	EmailValidator func(string) error
 	// UsernameValidator is a validator for the "username" field. It is called by the builders before save.
 	UsernameValidator func(string) error
+	// DefaultName holds the default value on creation for the "name" field.
+	DefaultName string
+	// DefaultPreferredUsername holds the default value on creation for the "preferred_username" field.
+	DefaultPreferredUsername string
 	// UserIDValidator is a validator for the "user_id" field. It is called by the builders before save.
 	UserIDValidator func(string) error
 )
+
+// OrderOption defines the ordering options for the Password queries.
+type OrderOption func(*sql.Selector)
+
+// ByID orders the results by the id field.
+func ByID(opts ...sql.OrderTermOption) OrderOption {
+	return sql.OrderByField(FieldID, opts...).ToFunc()
+}
+
+// ByEmail orders the results by the email field.
+func ByEmail(opts ...sql.OrderTermOption) OrderOption {
+	return sql.OrderByField(FieldEmail, opts...).ToFunc()
+}
+
+// ByUsername orders the results by the username field.
+func ByUsername(opts ...sql.OrderTermOption) OrderOption {
+	return sql.OrderByField(FieldUsername, opts...).ToFunc()
+}
+
+// ByName orders the results by the name field.
+func ByName(opts ...sql.OrderTermOption) OrderOption {
+	return sql.OrderByField(FieldName, opts...).ToFunc()
+}
+
+// ByPreferredUsername orders the results by the preferred_username field.
+func ByPreferredUsername(opts ...sql.OrderTermOption) OrderOption {
+	return sql.OrderByField(FieldPreferredUsername, opts...).ToFunc()
+}
+
+// ByEmailVerified orders the results by the email_verified field.
+func ByEmailVerified(opts ...sql.OrderTermOption) OrderOption {
+	return sql.OrderByField(FieldEmailVerified, opts...).ToFunc()
+}
+
+// ByUserID orders the results by the user_id field.
+func ByUserID(opts ...sql.OrderTermOption) OrderOption {
+	return sql.OrderByField(FieldUserID, opts...).ToFunc()
+}
diff --git a/storage/ent/db/password/where.go b/storage/ent/db/password/where.go
index e33c134f2e..91607186c6 100644
--- a/storage/ent/db/password/where.go
+++ b/storage/ent/db/password/where.go
@@ -9,492 +9,490 @@ import (
 
 // ID filters vertices based on their ID field.
 func ID(id int) predicate.Password {
-	return predicate.Password(func(s *sql.Selector) {
-		s.Where(sql.EQ(s.C(FieldID), id))
-	})
+	return predicate.Password(sql.FieldEQ(FieldID, id))
 }
 
 // IDEQ applies the EQ predicate on the ID field.
 func IDEQ(id int) predicate.Password {
-	return predicate.Password(func(s *sql.Selector) {
-		s.Where(sql.EQ(s.C(FieldID), id))
-	})
+	return predicate.Password(sql.FieldEQ(FieldID, id))
 }
 
 // IDNEQ applies the NEQ predicate on the ID field.
 func IDNEQ(id int) predicate.Password {
-	return predicate.Password(func(s *sql.Selector) {
-		s.Where(sql.NEQ(s.C(FieldID), id))
-	})
+	return predicate.Password(sql.FieldNEQ(FieldID, id))
 }
 
 // IDIn applies the In predicate on the ID field.
 func IDIn(ids ...int) predicate.Password {
-	return predicate.Password(func(s *sql.Selector) {
-		v := make([]interface{}, len(ids))
-		for i := range v {
-			v[i] = ids[i]
-		}
-		s.Where(sql.In(s.C(FieldID), v...))
-	})
+	return predicate.Password(sql.FieldIn(FieldID, ids...))
 }
 
 // IDNotIn applies the NotIn predicate on the ID field.
 func IDNotIn(ids ...int) predicate.Password {
-	return predicate.Password(func(s *sql.Selector) {
-		v := make([]interface{}, len(ids))
-		for i := range v {
-			v[i] = ids[i]
-		}
-		s.Where(sql.NotIn(s.C(FieldID), v...))
-	})
+	return predicate.Password(sql.FieldNotIn(FieldID, ids...))
 }
 
 // IDGT applies the GT predicate on the ID field.
 func IDGT(id int) predicate.Password {
-	return predicate.Password(func(s *sql.Selector) {
-		s.Where(sql.GT(s.C(FieldID), id))
-	})
+	return predicate.Password(sql.FieldGT(FieldID, id))
 }
 
 // IDGTE applies the GTE predicate on the ID field.
 func IDGTE(id int) predicate.Password {
-	return predicate.Password(func(s *sql.Selector) {
-		s.Where(sql.GTE(s.C(FieldID), id))
-	})
+	return predicate.Password(sql.FieldGTE(FieldID, id))
 }
 
 // IDLT applies the LT predicate on the ID field.
 func IDLT(id int) predicate.Password {
-	return predicate.Password(func(s *sql.Selector) {
-		s.Where(sql.LT(s.C(FieldID), id))
-	})
+	return predicate.Password(sql.FieldLT(FieldID, id))
 }
 
 // IDLTE applies the LTE predicate on the ID field.
 func IDLTE(id int) predicate.Password {
-	return predicate.Password(func(s *sql.Selector) {
-		s.Where(sql.LTE(s.C(FieldID), id))
-	})
+	return predicate.Password(sql.FieldLTE(FieldID, id))
 }
 
 // Email applies equality check predicate on the "email" field. It's identical to EmailEQ.
 func Email(v string) predicate.Password {
-	return predicate.Password(func(s *sql.Selector) {
-		s.Where(sql.EQ(s.C(FieldEmail), v))
-	})
+	return predicate.Password(sql.FieldEQ(FieldEmail, v))
 }
 
 // Hash applies equality check predicate on the "hash" field. It's identical to HashEQ.
 func Hash(v []byte) predicate.Password {
-	return predicate.Password(func(s *sql.Selector) {
-		s.Where(sql.EQ(s.C(FieldHash), v))
-	})
+	return predicate.Password(sql.FieldEQ(FieldHash, v))
 }
 
 // Username applies equality check predicate on the "username" field. It's identical to UsernameEQ.
 func Username(v string) predicate.Password {
-	return predicate.Password(func(s *sql.Selector) {
-		s.Where(sql.EQ(s.C(FieldUsername), v))
-	})
+	return predicate.Password(sql.FieldEQ(FieldUsername, v))
+}
+
+// Name applies equality check predicate on the "name" field. It's identical to NameEQ.
+func Name(v string) predicate.Password {
+	return predicate.Password(sql.FieldEQ(FieldName, v))
+}
+
+// PreferredUsername applies equality check predicate on the "preferred_username" field. It's identical to PreferredUsernameEQ.
+func PreferredUsername(v string) predicate.Password {
+	return predicate.Password(sql.FieldEQ(FieldPreferredUsername, v))
+}
+
+// EmailVerified applies equality check predicate on the "email_verified" field. It's identical to EmailVerifiedEQ.
+func EmailVerified(v bool) predicate.Password {
+	return predicate.Password(sql.FieldEQ(FieldEmailVerified, v))
 }
 
 // UserID applies equality check predicate on the "user_id" field. It's identical to UserIDEQ.
 func UserID(v string) predicate.Password {
-	return predicate.Password(func(s *sql.Selector) {
-		s.Where(sql.EQ(s.C(FieldUserID), v))
-	})
+	return predicate.Password(sql.FieldEQ(FieldUserID, v))
 }
 
 // EmailEQ applies the EQ predicate on the "email" field.
 func EmailEQ(v string) predicate.Password {
-	return predicate.Password(func(s *sql.Selector) {
-		s.Where(sql.EQ(s.C(FieldEmail), v))
-	})
+	return predicate.Password(sql.FieldEQ(FieldEmail, v))
 }
 
 // EmailNEQ applies the NEQ predicate on the "email" field.
 func EmailNEQ(v string) predicate.Password {
-	return predicate.Password(func(s *sql.Selector) {
-		s.Where(sql.NEQ(s.C(FieldEmail), v))
-	})
+	return predicate.Password(sql.FieldNEQ(FieldEmail, v))
 }
 
 // EmailIn applies the In predicate on the "email" field.
 func EmailIn(vs ...string) predicate.Password {
-	v := make([]interface{}, len(vs))
-	for i := range v {
-		v[i] = vs[i]
-	}
-	return predicate.Password(func(s *sql.Selector) {
-		s.Where(sql.In(s.C(FieldEmail), v...))
-	})
+	return predicate.Password(sql.FieldIn(FieldEmail, vs...))
 }
 
 // EmailNotIn applies the NotIn predicate on the "email" field.
 func EmailNotIn(vs ...string) predicate.Password {
-	v := make([]interface{}, len(vs))
-	for i := range v {
-		v[i] = vs[i]
-	}
-	return predicate.Password(func(s *sql.Selector) {
-		s.Where(sql.NotIn(s.C(FieldEmail), v...))
-	})
+	return predicate.Password(sql.FieldNotIn(FieldEmail, vs...))
 }
 
 // EmailGT applies the GT predicate on the "email" field.
 func EmailGT(v string) predicate.Password {
-	return predicate.Password(func(s *sql.Selector) {
-		s.Where(sql.GT(s.C(FieldEmail), v))
-	})
+	return predicate.Password(sql.FieldGT(FieldEmail, v))
 }
 
 // EmailGTE applies the GTE predicate on the "email" field.
 func EmailGTE(v string) predicate.Password {
-	return predicate.Password(func(s *sql.Selector) {
-		s.Where(sql.GTE(s.C(FieldEmail), v))
-	})
+	return predicate.Password(sql.FieldGTE(FieldEmail, v))
 }
 
 // EmailLT applies the LT predicate on the "email" field.
 func EmailLT(v string) predicate.Password {
-	return predicate.Password(func(s *sql.Selector) {
-		s.Where(sql.LT(s.C(FieldEmail), v))
-	})
+	return predicate.Password(sql.FieldLT(FieldEmail, v))
 }
 
 // EmailLTE applies the LTE predicate on the "email" field.
 func EmailLTE(v string) predicate.Password {
-	return predicate.Password(func(s *sql.Selector) {
-		s.Where(sql.LTE(s.C(FieldEmail), v))
-	})
+	return predicate.Password(sql.FieldLTE(FieldEmail, v))
 }
 
 // EmailContains applies the Contains predicate on the "email" field.
 func EmailContains(v string) predicate.Password {
-	return predicate.Password(func(s *sql.Selector) {
-		s.Where(sql.Contains(s.C(FieldEmail), v))
-	})
+	return predicate.Password(sql.FieldContains(FieldEmail, v))
 }
 
 // EmailHasPrefix applies the HasPrefix predicate on the "email" field.
 func EmailHasPrefix(v string) predicate.Password {
-	return predicate.Password(func(s *sql.Selector) {
-		s.Where(sql.HasPrefix(s.C(FieldEmail), v))
-	})
+	return predicate.Password(sql.FieldHasPrefix(FieldEmail, v))
 }
 
 // EmailHasSuffix applies the HasSuffix predicate on the "email" field.
 func EmailHasSuffix(v string) predicate.Password {
-	return predicate.Password(func(s *sql.Selector) {
-		s.Where(sql.HasSuffix(s.C(FieldEmail), v))
-	})
+	return predicate.Password(sql.FieldHasSuffix(FieldEmail, v))
 }
 
 // EmailEqualFold applies the EqualFold predicate on the "email" field.
 func EmailEqualFold(v string) predicate.Password {
-	return predicate.Password(func(s *sql.Selector) {
-		s.Where(sql.EqualFold(s.C(FieldEmail), v))
-	})
+	return predicate.Password(sql.FieldEqualFold(FieldEmail, v))
 }
 
 // EmailContainsFold applies the ContainsFold predicate on the "email" field.
 func EmailContainsFold(v string) predicate.Password {
-	return predicate.Password(func(s *sql.Selector) {
-		s.Where(sql.ContainsFold(s.C(FieldEmail), v))
-	})
+	return predicate.Password(sql.FieldContainsFold(FieldEmail, v))
 }
 
 // HashEQ applies the EQ predicate on the "hash" field.
 func HashEQ(v []byte) predicate.Password {
-	return predicate.Password(func(s *sql.Selector) {
-		s.Where(sql.EQ(s.C(FieldHash), v))
-	})
+	return predicate.Password(sql.FieldEQ(FieldHash, v))
 }
 
 // HashNEQ applies the NEQ predicate on the "hash" field.
 func HashNEQ(v []byte) predicate.Password {
-	return predicate.Password(func(s *sql.Selector) {
-		s.Where(sql.NEQ(s.C(FieldHash), v))
-	})
+	return predicate.Password(sql.FieldNEQ(FieldHash, v))
 }
 
 // HashIn applies the In predicate on the "hash" field.
 func HashIn(vs ...[]byte) predicate.Password {
-	v := make([]interface{}, len(vs))
-	for i := range v {
-		v[i] = vs[i]
-	}
-	return predicate.Password(func(s *sql.Selector) {
-		s.Where(sql.In(s.C(FieldHash), v...))
-	})
+	return predicate.Password(sql.FieldIn(FieldHash, vs...))
 }
 
 // HashNotIn applies the NotIn predicate on the "hash" field.
 func HashNotIn(vs ...[]byte) predicate.Password {
-	v := make([]interface{}, len(vs))
-	for i := range v {
-		v[i] = vs[i]
-	}
-	return predicate.Password(func(s *sql.Selector) {
-		s.Where(sql.NotIn(s.C(FieldHash), v...))
-	})
+	return predicate.Password(sql.FieldNotIn(FieldHash, vs...))
 }
 
 // HashGT applies the GT predicate on the "hash" field.
 func HashGT(v []byte) predicate.Password {
-	return predicate.Password(func(s *sql.Selector) {
-		s.Where(sql.GT(s.C(FieldHash), v))
-	})
+	return predicate.Password(sql.FieldGT(FieldHash, v))
 }
 
 // HashGTE applies the GTE predicate on the "hash" field.
 func HashGTE(v []byte) predicate.Password {
-	return predicate.Password(func(s *sql.Selector) {
-		s.Where(sql.GTE(s.C(FieldHash), v))
-	})
+	return predicate.Password(sql.FieldGTE(FieldHash, v))
 }
 
 // HashLT applies the LT predicate on the "hash" field.
 func HashLT(v []byte) predicate.Password {
-	return predicate.Password(func(s *sql.Selector) {
-		s.Where(sql.LT(s.C(FieldHash), v))
-	})
+	return predicate.Password(sql.FieldLT(FieldHash, v))
 }
 
 // HashLTE applies the LTE predicate on the "hash" field.
 func HashLTE(v []byte) predicate.Password {
-	return predicate.Password(func(s *sql.Selector) {
-		s.Where(sql.LTE(s.C(FieldHash), v))
-	})
+	return predicate.Password(sql.FieldLTE(FieldHash, v))
 }
 
 // UsernameEQ applies the EQ predicate on the "username" field.
 func UsernameEQ(v string) predicate.Password {
-	return predicate.Password(func(s *sql.Selector) {
-		s.Where(sql.EQ(s.C(FieldUsername), v))
-	})
+	return predicate.Password(sql.FieldEQ(FieldUsername, v))
 }
 
 // UsernameNEQ applies the NEQ predicate on the "username" field.
 func UsernameNEQ(v string) predicate.Password {
-	return predicate.Password(func(s *sql.Selector) {
-		s.Where(sql.NEQ(s.C(FieldUsername), v))
-	})
+	return predicate.Password(sql.FieldNEQ(FieldUsername, v))
 }
 
 // UsernameIn applies the In predicate on the "username" field.
 func UsernameIn(vs ...string) predicate.Password {
-	v := make([]interface{}, len(vs))
-	for i := range v {
-		v[i] = vs[i]
-	}
-	return predicate.Password(func(s *sql.Selector) {
-		s.Where(sql.In(s.C(FieldUsername), v...))
-	})
+	return predicate.Password(sql.FieldIn(FieldUsername, vs...))
 }
 
 // UsernameNotIn applies the NotIn predicate on the "username" field.
 func UsernameNotIn(vs ...string) predicate.Password {
-	v := make([]interface{}, len(vs))
-	for i := range v {
-		v[i] = vs[i]
-	}
-	return predicate.Password(func(s *sql.Selector) {
-		s.Where(sql.NotIn(s.C(FieldUsername), v...))
-	})
+	return predicate.Password(sql.FieldNotIn(FieldUsername, vs...))
 }
 
 // UsernameGT applies the GT predicate on the "username" field.
 func UsernameGT(v string) predicate.Password {
-	return predicate.Password(func(s *sql.Selector) {
-		s.Where(sql.GT(s.C(FieldUsername), v))
-	})
+	return predicate.Password(sql.FieldGT(FieldUsername, v))
 }
 
 // UsernameGTE applies the GTE predicate on the "username" field.
 func UsernameGTE(v string) predicate.Password {
-	return predicate.Password(func(s *sql.Selector) {
-		s.Where(sql.GTE(s.C(FieldUsername), v))
-	})
+	return predicate.Password(sql.FieldGTE(FieldUsername, v))
 }
 
 // UsernameLT applies the LT predicate on the "username" field.
 func UsernameLT(v string) predicate.Password {
-	return predicate.Password(func(s *sql.Selector) {
-		s.Where(sql.LT(s.C(FieldUsername), v))
-	})
+	return predicate.Password(sql.FieldLT(FieldUsername, v))
 }
 
 // UsernameLTE applies the LTE predicate on the "username" field.
 func UsernameLTE(v string) predicate.Password {
-	return predicate.Password(func(s *sql.Selector) {
-		s.Where(sql.LTE(s.C(FieldUsername), v))
-	})
+	return predicate.Password(sql.FieldLTE(FieldUsername, v))
 }
 
 // UsernameContains applies the Contains predicate on the "username" field.
 func UsernameContains(v string) predicate.Password {
-	return predicate.Password(func(s *sql.Selector) {
-		s.Where(sql.Contains(s.C(FieldUsername), v))
-	})
+	return predicate.Password(sql.FieldContains(FieldUsername, v))
 }
 
 // UsernameHasPrefix applies the HasPrefix predicate on the "username" field.
 func UsernameHasPrefix(v string) predicate.Password {
-	return predicate.Password(func(s *sql.Selector) {
-		s.Where(sql.HasPrefix(s.C(FieldUsername), v))
-	})
+	return predicate.Password(sql.FieldHasPrefix(FieldUsername, v))
 }
 
 // UsernameHasSuffix applies the HasSuffix predicate on the "username" field.
 func UsernameHasSuffix(v string) predicate.Password {
-	return predicate.Password(func(s *sql.Selector) {
-		s.Where(sql.HasSuffix(s.C(FieldUsername), v))
-	})
+	return predicate.Password(sql.FieldHasSuffix(FieldUsername, v))
 }
 
 // UsernameEqualFold applies the EqualFold predicate on the "username" field.
 func UsernameEqualFold(v string) predicate.Password {
-	return predicate.Password(func(s *sql.Selector) {
-		s.Where(sql.EqualFold(s.C(FieldUsername), v))
-	})
+	return predicate.Password(sql.FieldEqualFold(FieldUsername, v))
 }
 
 // UsernameContainsFold applies the ContainsFold predicate on the "username" field.
 func UsernameContainsFold(v string) predicate.Password {
-	return predicate.Password(func(s *sql.Selector) {
-		s.Where(sql.ContainsFold(s.C(FieldUsername), v))
-	})
+	return predicate.Password(sql.FieldContainsFold(FieldUsername, v))
+}
+
+// NameEQ applies the EQ predicate on the "name" field.
+func NameEQ(v string) predicate.Password {
+	return predicate.Password(sql.FieldEQ(FieldName, v))
+}
+
+// NameNEQ applies the NEQ predicate on the "name" field.
+func NameNEQ(v string) predicate.Password {
+	return predicate.Password(sql.FieldNEQ(FieldName, v))
+}
+
+// NameIn applies the In predicate on the "name" field.
+func NameIn(vs ...string) predicate.Password {
+	return predicate.Password(sql.FieldIn(FieldName, vs...))
+}
+
+// NameNotIn applies the NotIn predicate on the "name" field.
+func NameNotIn(vs ...string) predicate.Password {
+	return predicate.Password(sql.FieldNotIn(FieldName, vs...))
+}
+
+// NameGT applies the GT predicate on the "name" field.
+func NameGT(v string) predicate.Password {
+	return predicate.Password(sql.FieldGT(FieldName, v))
+}
+
+// NameGTE applies the GTE predicate on the "name" field.
+func NameGTE(v string) predicate.Password {
+	return predicate.Password(sql.FieldGTE(FieldName, v))
+}
+
+// NameLT applies the LT predicate on the "name" field.
+func NameLT(v string) predicate.Password {
+	return predicate.Password(sql.FieldLT(FieldName, v))
+}
+
+// NameLTE applies the LTE predicate on the "name" field.
+func NameLTE(v string) predicate.Password {
+	return predicate.Password(sql.FieldLTE(FieldName, v))
+}
+
+// NameContains applies the Contains predicate on the "name" field.
+func NameContains(v string) predicate.Password {
+	return predicate.Password(sql.FieldContains(FieldName, v))
+}
+
+// NameHasPrefix applies the HasPrefix predicate on the "name" field.
+func NameHasPrefix(v string) predicate.Password {
+	return predicate.Password(sql.FieldHasPrefix(FieldName, v))
+}
+
+// NameHasSuffix applies the HasSuffix predicate on the "name" field.
+func NameHasSuffix(v string) predicate.Password {
+	return predicate.Password(sql.FieldHasSuffix(FieldName, v))
+}
+
+// NameEqualFold applies the EqualFold predicate on the "name" field.
+func NameEqualFold(v string) predicate.Password {
+	return predicate.Password(sql.FieldEqualFold(FieldName, v))
+}
+
+// NameContainsFold applies the ContainsFold predicate on the "name" field.
+func NameContainsFold(v string) predicate.Password {
+	return predicate.Password(sql.FieldContainsFold(FieldName, v))
+}
+
+// PreferredUsernameEQ applies the EQ predicate on the "preferred_username" field.
+func PreferredUsernameEQ(v string) predicate.Password {
+	return predicate.Password(sql.FieldEQ(FieldPreferredUsername, v))
+}
+
+// PreferredUsernameNEQ applies the NEQ predicate on the "preferred_username" field.
+func PreferredUsernameNEQ(v string) predicate.Password {
+	return predicate.Password(sql.FieldNEQ(FieldPreferredUsername, v))
+}
+
+// PreferredUsernameIn applies the In predicate on the "preferred_username" field.
+func PreferredUsernameIn(vs ...string) predicate.Password {
+	return predicate.Password(sql.FieldIn(FieldPreferredUsername, vs...))
+}
+
+// PreferredUsernameNotIn applies the NotIn predicate on the "preferred_username" field.
+func PreferredUsernameNotIn(vs ...string) predicate.Password {
+	return predicate.Password(sql.FieldNotIn(FieldPreferredUsername, vs...))
+}
+
+// PreferredUsernameGT applies the GT predicate on the "preferred_username" field.
+func PreferredUsernameGT(v string) predicate.Password {
+	return predicate.Password(sql.FieldGT(FieldPreferredUsername, v))
+}
+
+// PreferredUsernameGTE applies the GTE predicate on the "preferred_username" field.
+func PreferredUsernameGTE(v string) predicate.Password {
+	return predicate.Password(sql.FieldGTE(FieldPreferredUsername, v))
+}
+
+// PreferredUsernameLT applies the LT predicate on the "preferred_username" field.
+func PreferredUsernameLT(v string) predicate.Password {
+	return predicate.Password(sql.FieldLT(FieldPreferredUsername, v))
+}
+
+// PreferredUsernameLTE applies the LTE predicate on the "preferred_username" field.
+func PreferredUsernameLTE(v string) predicate.Password {
+	return predicate.Password(sql.FieldLTE(FieldPreferredUsername, v))
+}
+
+// PreferredUsernameContains applies the Contains predicate on the "preferred_username" field.
+func PreferredUsernameContains(v string) predicate.Password {
+	return predicate.Password(sql.FieldContains(FieldPreferredUsername, v))
+}
+
+// PreferredUsernameHasPrefix applies the HasPrefix predicate on the "preferred_username" field.
+func PreferredUsernameHasPrefix(v string) predicate.Password {
+	return predicate.Password(sql.FieldHasPrefix(FieldPreferredUsername, v))
+}
+
+// PreferredUsernameHasSuffix applies the HasSuffix predicate on the "preferred_username" field.
+func PreferredUsernameHasSuffix(v string) predicate.Password {
+	return predicate.Password(sql.FieldHasSuffix(FieldPreferredUsername, v))
+}
+
+// PreferredUsernameEqualFold applies the EqualFold predicate on the "preferred_username" field.
+func PreferredUsernameEqualFold(v string) predicate.Password {
+	return predicate.Password(sql.FieldEqualFold(FieldPreferredUsername, v))
+}
+
+// PreferredUsernameContainsFold applies the ContainsFold predicate on the "preferred_username" field.
+func PreferredUsernameContainsFold(v string) predicate.Password {
+	return predicate.Password(sql.FieldContainsFold(FieldPreferredUsername, v))
+}
+
+// EmailVerifiedEQ applies the EQ predicate on the "email_verified" field.
+func EmailVerifiedEQ(v bool) predicate.Password {
+	return predicate.Password(sql.FieldEQ(FieldEmailVerified, v))
+}
+
+// EmailVerifiedNEQ applies the NEQ predicate on the "email_verified" field.
+func EmailVerifiedNEQ(v bool) predicate.Password {
+	return predicate.Password(sql.FieldNEQ(FieldEmailVerified, v))
+}
+
+// EmailVerifiedIsNil applies the IsNil predicate on the "email_verified" field.
+func EmailVerifiedIsNil() predicate.Password {
+	return predicate.Password(sql.FieldIsNull(FieldEmailVerified))
+}
+
+// EmailVerifiedNotNil applies the NotNil predicate on the "email_verified" field.
+func EmailVerifiedNotNil() predicate.Password {
+	return predicate.Password(sql.FieldNotNull(FieldEmailVerified))
 }
 
 // UserIDEQ applies the EQ predicate on the "user_id" field.
 func UserIDEQ(v string) predicate.Password {
-	return predicate.Password(func(s *sql.Selector) {
-		s.Where(sql.EQ(s.C(FieldUserID), v))
-	})
+	return predicate.Password(sql.FieldEQ(FieldUserID, v))
 }
 
 // UserIDNEQ applies the NEQ predicate on the "user_id" field.
 func UserIDNEQ(v string) predicate.Password {
-	return predicate.Password(func(s *sql.Selector) {
-		s.Where(sql.NEQ(s.C(FieldUserID), v))
-	})
+	return predicate.Password(sql.FieldNEQ(FieldUserID, v))
 }
 
 // UserIDIn applies the In predicate on the "user_id" field.
 func UserIDIn(vs ...string) predicate.Password {
-	v := make([]interface{}, len(vs))
-	for i := range v {
-		v[i] = vs[i]
-	}
-	return predicate.Password(func(s *sql.Selector) {
-		s.Where(sql.In(s.C(FieldUserID), v...))
-	})
+	return predicate.Password(sql.FieldIn(FieldUserID, vs...))
 }
 
 // UserIDNotIn applies the NotIn predicate on the "user_id" field.
 func UserIDNotIn(vs ...string) predicate.Password {
-	v := make([]interface{}, len(vs))
-	for i := range v {
-		v[i] = vs[i]
-	}
-	return predicate.Password(func(s *sql.Selector) {
-		s.Where(sql.NotIn(s.C(FieldUserID), v...))
-	})
+	return predicate.Password(sql.FieldNotIn(FieldUserID, vs...))
 }
 
 // UserIDGT applies the GT predicate on the "user_id" field.
 func UserIDGT(v string) predicate.Password {
-	return predicate.Password(func(s *sql.Selector) {
-		s.Where(sql.GT(s.C(FieldUserID), v))
-	})
+	return predicate.Password(sql.FieldGT(FieldUserID, v))
 }
 
 // UserIDGTE applies the GTE predicate on the "user_id" field.
 func UserIDGTE(v string) predicate.Password {
-	return predicate.Password(func(s *sql.Selector) {
-		s.Where(sql.GTE(s.C(FieldUserID), v))
-	})
+	return predicate.Password(sql.FieldGTE(FieldUserID, v))
 }
 
 // UserIDLT applies the LT predicate on the "user_id" field.
 func UserIDLT(v string) predicate.Password {
-	return predicate.Password(func(s *sql.Selector) {
-		s.Where(sql.LT(s.C(FieldUserID), v))
-	})
+	return predicate.Password(sql.FieldLT(FieldUserID, v))
 }
 
 // UserIDLTE applies the LTE predicate on the "user_id" field.
 func UserIDLTE(v string) predicate.Password {
-	return predicate.Password(func(s *sql.Selector) {
-		s.Where(sql.LTE(s.C(FieldUserID), v))
-	})
+	return predicate.Password(sql.FieldLTE(FieldUserID, v))
 }
 
 // UserIDContains applies the Contains predicate on the "user_id" field.
 func UserIDContains(v string) predicate.Password {
-	return predicate.Password(func(s *sql.Selector) {
-		s.Where(sql.Contains(s.C(FieldUserID), v))
-	})
+	return predicate.Password(sql.FieldContains(FieldUserID, v))
 }
 
 // UserIDHasPrefix applies the HasPrefix predicate on the "user_id" field.
 func UserIDHasPrefix(v string) predicate.Password {
-	return predicate.Password(func(s *sql.Selector) {
-		s.Where(sql.HasPrefix(s.C(FieldUserID), v))
-	})
+	return predicate.Password(sql.FieldHasPrefix(FieldUserID, v))
 }
 
 // UserIDHasSuffix applies the HasSuffix predicate on the "user_id" field.
 func UserIDHasSuffix(v string) predicate.Password {
-	return predicate.Password(func(s *sql.Selector) {
-		s.Where(sql.HasSuffix(s.C(FieldUserID), v))
-	})
+	return predicate.Password(sql.FieldHasSuffix(FieldUserID, v))
 }
 
 // UserIDEqualFold applies the EqualFold predicate on the "user_id" field.
 func UserIDEqualFold(v string) predicate.Password {
-	return predicate.Password(func(s *sql.Selector) {
-		s.Where(sql.EqualFold(s.C(FieldUserID), v))
-	})
+	return predicate.Password(sql.FieldEqualFold(FieldUserID, v))
 }
 
 // UserIDContainsFold applies the ContainsFold predicate on the "user_id" field.
 func UserIDContainsFold(v string) predicate.Password {
-	return predicate.Password(func(s *sql.Selector) {
-		s.Where(sql.ContainsFold(s.C(FieldUserID), v))
-	})
+	return predicate.Password(sql.FieldContainsFold(FieldUserID, v))
+}
+
+// GroupsIsNil applies the IsNil predicate on the "groups" field.
+func GroupsIsNil() predicate.Password {
+	return predicate.Password(sql.FieldIsNull(FieldGroups))
+}
+
+// GroupsNotNil applies the NotNil predicate on the "groups" field.
+func GroupsNotNil() predicate.Password {
+	return predicate.Password(sql.FieldNotNull(FieldGroups))
 }
 
 // And groups predicates with the AND operator between them.
 func And(predicates ...predicate.Password) predicate.Password {
-	return predicate.Password(func(s *sql.Selector) {
-		s1 := s.Clone().SetP(nil)
-		for _, p := range predicates {
-			p(s1)
-		}
-		s.Where(s1.P())
-	})
+	return predicate.Password(sql.AndPredicates(predicates...))
 }
 
 // Or groups predicates with the OR operator between them.
 func Or(predicates ...predicate.Password) predicate.Password {
-	return predicate.Password(func(s *sql.Selector) {
-		s1 := s.Clone().SetP(nil)
-		for i, p := range predicates {
-			if i > 0 {
-				s1.Or()
-			}
-			p(s1)
-		}
-		s.Where(s1.P())
-	})
+	return predicate.Password(sql.OrPredicates(predicates...))
 }
 
 // Not applies the not operator on the given predicate.
 func Not(p predicate.Password) predicate.Password {
-	return predicate.Password(func(s *sql.Selector) {
-		p(s.Not())
-	})
+	return predicate.Password(sql.NotPredicates(p))
 }
diff --git a/storage/ent/db/password_create.go b/storage/ent/db/password_create.go
index 277a5c8321..229b3a93b9 100644
--- a/storage/ent/db/password_create.go
+++ b/storage/ent/db/password_create.go
@@ -20,84 +20,91 @@ type PasswordCreate struct {
 }
 
 // SetEmail sets the "email" field.
-func (pc *PasswordCreate) SetEmail(s string) *PasswordCreate {
-	pc.mutation.SetEmail(s)
-	return pc
+func (_c *PasswordCreate) SetEmail(v string) *PasswordCreate {
+	_c.mutation.SetEmail(v)
+	return _c
 }
 
 // SetHash sets the "hash" field.
-func (pc *PasswordCreate) SetHash(b []byte) *PasswordCreate {
-	pc.mutation.SetHash(b)
-	return pc
+func (_c *PasswordCreate) SetHash(v []byte) *PasswordCreate {
+	_c.mutation.SetHash(v)
+	return _c
 }
 
 // SetUsername sets the "username" field.
-func (pc *PasswordCreate) SetUsername(s string) *PasswordCreate {
-	pc.mutation.SetUsername(s)
-	return pc
+func (_c *PasswordCreate) SetUsername(v string) *PasswordCreate {
+	_c.mutation.SetUsername(v)
+	return _c
+}
+
+// SetName sets the "name" field.
+func (_c *PasswordCreate) SetName(v string) *PasswordCreate {
+	_c.mutation.SetName(v)
+	return _c
+}
+
+// SetNillableName sets the "name" field if the given value is not nil.
+func (_c *PasswordCreate) SetNillableName(v *string) *PasswordCreate {
+	if v != nil {
+		_c.SetName(*v)
+	}
+	return _c
+}
+
+// SetPreferredUsername sets the "preferred_username" field.
+func (_c *PasswordCreate) SetPreferredUsername(v string) *PasswordCreate {
+	_c.mutation.SetPreferredUsername(v)
+	return _c
+}
+
+// SetNillablePreferredUsername sets the "preferred_username" field if the given value is not nil.
+func (_c *PasswordCreate) SetNillablePreferredUsername(v *string) *PasswordCreate {
+	if v != nil {
+		_c.SetPreferredUsername(*v)
+	}
+	return _c
+}
+
+// SetEmailVerified sets the "email_verified" field.
+func (_c *PasswordCreate) SetEmailVerified(v bool) *PasswordCreate {
+	_c.mutation.SetEmailVerified(v)
+	return _c
+}
+
+// SetNillableEmailVerified sets the "email_verified" field if the given value is not nil.
+func (_c *PasswordCreate) SetNillableEmailVerified(v *bool) *PasswordCreate {
+	if v != nil {
+		_c.SetEmailVerified(*v)
+	}
+	return _c
 }
 
 // SetUserID sets the "user_id" field.
-func (pc *PasswordCreate) SetUserID(s string) *PasswordCreate {
-	pc.mutation.SetUserID(s)
-	return pc
+func (_c *PasswordCreate) SetUserID(v string) *PasswordCreate {
+	_c.mutation.SetUserID(v)
+	return _c
+}
+
+// SetGroups sets the "groups" field.
+func (_c *PasswordCreate) SetGroups(v []string) *PasswordCreate {
+	_c.mutation.SetGroups(v)
+	return _c
 }
 
 // Mutation returns the PasswordMutation object of the builder.
-func (pc *PasswordCreate) Mutation() *PasswordMutation {
-	return pc.mutation
+func (_c *PasswordCreate) Mutation() *PasswordMutation {
+	return _c.mutation
 }
 
 // Save creates the Password in the database.
-func (pc *PasswordCreate) Save(ctx context.Context) (*Password, error) {
-	var (
-		err  error
-		node *Password
-	)
-	if len(pc.hooks) == 0 {
-		if err = pc.check(); err != nil {
-			return nil, err
-		}
-		node, err = pc.sqlSave(ctx)
-	} else {
-		var mut Mutator = MutateFunc(func(ctx context.Context, m Mutation) (Value, error) {
-			mutation, ok := m.(*PasswordMutation)
-			if !ok {
-				return nil, fmt.Errorf("unexpected mutation type %T", m)
-			}
-			if err = pc.check(); err != nil {
-				return nil, err
-			}
-			pc.mutation = mutation
-			if node, err = pc.sqlSave(ctx); err != nil {
-				return nil, err
-			}
-			mutation.id = &node.ID
-			mutation.done = true
-			return node, err
-		})
-		for i := len(pc.hooks) - 1; i >= 0; i-- {
-			if pc.hooks[i] == nil {
-				return nil, fmt.Errorf("db: uninitialized hook (forgotten import db/runtime?)")
-			}
-			mut = pc.hooks[i](mut)
-		}
-		v, err := mut.Mutate(ctx, pc.mutation)
-		if err != nil {
-			return nil, err
-		}
-		nv, ok := v.(*Password)
-		if !ok {
-			return nil, fmt.Errorf("unexpected node type %T returned from PasswordMutation", v)
-		}
-		node = nv
-	}
-	return node, err
+func (_c *PasswordCreate) Save(ctx context.Context) (*Password, error) {
+	_c.defaults()
+	return withHooks(ctx, _c.sqlSave, _c.mutation, _c.hooks)
 }
 
 // SaveX calls Save and panics if Save returns an error.
-func (pc *PasswordCreate) SaveX(ctx context.Context) *Password {
-	v, err := pc.Save(ctx)
+func (_c *PasswordCreate) SaveX(ctx context.Context) *Password {
+	v, err := _c.Save(ctx)
 	if err != nil {
 		panic(err)
 	}
@@ -105,43 +112,61 @@ func (pc *PasswordCreate) SaveX(ctx context.Context) *Password {
 }
 
 // Exec executes the query.
-func (pc *PasswordCreate) Exec(ctx context.Context) error {
-	_, err := pc.Save(ctx)
+func (_c *PasswordCreate) Exec(ctx context.Context) error {
+	_, err := _c.Save(ctx)
 	return err
 }
 
 // ExecX is like Exec, but panics if an error occurs.
-func (pc *PasswordCreate) ExecX(ctx context.Context) {
-	if err := pc.Exec(ctx); err != nil {
+func (_c *PasswordCreate) ExecX(ctx context.Context) {
+	if err := _c.Exec(ctx); err != nil {
 		panic(err)
 	}
 }
 
+// defaults sets the default values of the builder before save.
+func (_c *PasswordCreate) defaults() {
+	if _, ok := _c.mutation.Name(); !ok {
+		v := password.DefaultName
+		_c.mutation.SetName(v)
+	}
+	if _, ok := _c.mutation.PreferredUsername(); !ok {
+		v := password.DefaultPreferredUsername
+		_c.mutation.SetPreferredUsername(v)
+	}
+}
+
 // check runs all checks and user-defined validators on the builder.
-func (pc *PasswordCreate) check() error {
-	if _, ok := pc.mutation.Email(); !ok {
+func (_c *PasswordCreate) check() error {
+	if _, ok := _c.mutation.Email(); !ok {
 		return &ValidationError{Name: "email", err: errors.New(`db: missing required field "Password.email"`)}
 	}
-	if v, ok := pc.mutation.Email(); ok {
+	if v, ok := _c.mutation.Email(); ok {
 		if err := password.EmailValidator(v); err != nil {
 			return &ValidationError{Name: "email", err: fmt.Errorf(`db: validator failed for field "Password.email": %w`, err)}
 		}
 	}
-	if _, ok := pc.mutation.Hash(); !ok {
+	if _, ok := _c.mutation.Hash(); !ok {
 		return &ValidationError{Name: "hash", err: errors.New(`db: missing required field "Password.hash"`)}
 	}
-	if _, ok := pc.mutation.Username(); !ok {
+	if _, ok := _c.mutation.Username(); !ok {
 		return &ValidationError{Name: "username", err: errors.New(`db: missing required field "Password.username"`)}
 	}
-	if v, ok := pc.mutation.Username(); ok {
+	if v, ok := _c.mutation.Username(); ok {
 		if err := password.UsernameValidator(v); err != nil {
 			return &ValidationError{Name: "username", err: fmt.Errorf(`db: validator failed for field "Password.username": %w`, err)}
 		}
 	}
-	if _, ok := pc.mutation.UserID(); !ok {
+	if _, ok := _c.mutation.Name(); !ok {
+		return &ValidationError{Name: "name", err: errors.New(`db: missing required field "Password.name"`)}
+	}
+	if _, ok := _c.mutation.PreferredUsername(); !ok {
+		return &ValidationError{Name: "preferred_username", err: errors.New(`db: missing required field "Password.preferred_username"`)}
+	}
+	if _, ok := _c.mutation.UserID(); !ok {
 		return &ValidationError{Name: "user_id", err: errors.New(`db: missing required field "Password.user_id"`)}
 	}
-	if v, ok := pc.mutation.UserID(); ok {
+	if v, ok := _c.mutation.UserID(); ok {
 		if err := password.UserIDValidator(v); err != nil {
 			return &ValidationError{Name: "user_id", err: fmt.Errorf(`db: validator failed for field "Password.user_id": %w`, err)}
 		}
@@ -149,9 +174,12 @@ func (pc *PasswordCreate) check() error {
 	return nil
 }
 
-func (pc *PasswordCreate) sqlSave(ctx context.Context) (*Password, error) {
-	_node, _spec := pc.createSpec()
-	if err := sqlgraph.CreateNode(ctx, pc.driver, _spec); err != nil {
+func (_c *PasswordCreate) sqlSave(ctx context.Context) (*Password, error) {
+	if err := _c.check(); err != nil {
+		return nil, err
+	}
+	_node, _spec := _c.createSpec()
+	if err := sqlgraph.CreateNode(ctx, _c.driver, _spec); err != nil {
 		if sqlgraph.IsConstraintError(err) {
 			err = &ConstraintError{msg: err.Error(), wrap: err}
 		}
@@ -159,69 +187,70 @@ func (pc *PasswordCreate) sqlSave(ctx context.Context) (*Password, error) {
 	}
 	id := _spec.ID.Value.(int64)
 	_node.ID = int(id)
+	_c.mutation.id = &_node.ID
+	_c.mutation.done = true
 	return _node, nil
 }
 
-func (pc *PasswordCreate) createSpec() (*Password, *sqlgraph.CreateSpec) {
+func (_c *PasswordCreate) createSpec() (*Password, *sqlgraph.CreateSpec) {
 	var (
-		_node = &Password{config: pc.config}
-		_spec = &sqlgraph.CreateSpec{
-			Table: password.Table,
-			ID: &sqlgraph.FieldSpec{
-				Type:   field.TypeInt,
-				Column: password.FieldID,
-			},
-		}
+		_node = &Password{config: _c.config}
+		_spec = sqlgraph.NewCreateSpec(password.Table, sqlgraph.NewFieldSpec(password.FieldID, field.TypeInt))
 	)
-	if value, ok := pc.mutation.Email(); ok {
-		_spec.Fields = append(_spec.Fields, &sqlgraph.FieldSpec{
-			Type:   field.TypeString,
-			Value:  value,
-			Column: password.FieldEmail,
-		})
+	if value, ok := _c.mutation.Email(); ok {
+		_spec.SetField(password.FieldEmail, field.TypeString, value)
 		_node.Email = value
 	}
-	if value, ok := pc.mutation.Hash(); ok {
-		_spec.Fields = append(_spec.Fields, &sqlgraph.FieldSpec{
-			Type:   field.TypeBytes,
-			Value:  value,
-			Column: password.FieldHash,
-		})
+	if value, ok := _c.mutation.Hash(); ok {
+		_spec.SetField(password.FieldHash, field.TypeBytes, value)
 		_node.Hash = value
 	}
-	if value, ok := pc.mutation.Username(); ok {
-		_spec.Fields = append(_spec.Fields, &sqlgraph.FieldSpec{
-			Type:   field.TypeString,
-			Value:  value,
-			Column: password.FieldUsername,
-		})
+	if value, ok := _c.mutation.Username(); ok {
+		_spec.SetField(password.FieldUsername, field.TypeString, value)
 		_node.Username = value
 	}
-	if value, ok := pc.mutation.UserID(); ok {
-		_spec.Fields = append(_spec.Fields, &sqlgraph.FieldSpec{
-			Type:   field.TypeString,
-			Value:  value,
-			Column: password.FieldUserID,
-		})
+	if value, ok := _c.mutation.Name(); ok {
+		_spec.SetField(password.FieldName, field.TypeString, value)
+		_node.Name = value
+	}
+	if value, ok := _c.mutation.PreferredUsername(); ok {
+		_spec.SetField(password.FieldPreferredUsername, field.TypeString, value)
+		_node.PreferredUsername = value
+	}
+	if value, ok := _c.mutation.EmailVerified(); ok {
+		_spec.SetField(password.FieldEmailVerified, field.TypeBool, value)
+		_node.EmailVerified = &value
+	}
+	if value, ok := _c.mutation.UserID(); ok {
+		_spec.SetField(password.FieldUserID, field.TypeString, value)
 		_node.UserID = value
 	}
+	if value, ok := _c.mutation.Groups(); ok {
+		_spec.SetField(password.FieldGroups, field.TypeJSON, value)
+		_node.Groups = value
+	}
 	return _node, _spec
 }
 
 // PasswordCreateBulk is the builder for creating many Password entities in bulk.
 type PasswordCreateBulk struct {
 	config
+	err      error
 	builders []*PasswordCreate
 }
 
 // Save creates the Password entities in the database.
-func (pcb *PasswordCreateBulk) Save(ctx context.Context) ([]*Password, error) {
-	specs := make([]*sqlgraph.CreateSpec, len(pcb.builders))
-	nodes := make([]*Password, len(pcb.builders))
-	mutators := make([]Mutator, len(pcb.builders))
-	for i := range pcb.builders {
+func (_c *PasswordCreateBulk) Save(ctx context.Context) ([]*Password, error) {
+	if _c.err != nil {
+		return nil, _c.err
+	}
+	specs := make([]*sqlgraph.CreateSpec, len(_c.builders))
+	nodes := make([]*Password, len(_c.builders))
+	mutators := make([]Mutator, len(_c.builders))
+	for i := range _c.builders {
 		func(i int, root context.Context) {
-			builder := pcb.builders[i]
+			builder := _c.builders[i]
+			builder.defaults()
 			var mut Mutator = MutateFunc(func(ctx context.Context, m Mutation) (Value, error) {
 				mutation, ok := m.(*PasswordMutation)
 				if !ok {
@@ -231,14 +260,14 @@ func (pcb *PasswordCreateBulk) Save(ctx context.Context) ([]*Password, error) {
 					return nil, err
 				}
 				builder.mutation = mutation
-				nodes[i], specs[i] = builder.createSpec()
 				var err error
+				nodes[i], specs[i] = builder.createSpec()
 				if i < len(mutators)-1 {
-					_, err = mutators[i+1].Mutate(root, pcb.builders[i+1].mutation)
+					_, err = mutators[i+1].Mutate(root, _c.builders[i+1].mutation)
 				} else {
 					spec := &sqlgraph.BatchCreateSpec{Nodes: specs}
 					// Invoke the actual operation on the latest mutation in the chain.
-					if err = sqlgraph.BatchCreate(ctx, pcb.driver, spec); err != nil {
+					if err = sqlgraph.BatchCreate(ctx, _c.driver, spec); err != nil {
 						if sqlgraph.IsConstraintError(err) {
 							err = &ConstraintError{msg: err.Error(), wrap: err}
 						}
@@ -262,7 +291,7 @@ func (pcb *PasswordCreateBulk) Save(ctx context.Context) ([]*Password, error) {
 		}(i, ctx)
 	}
 	if len(mutators) > 0 {
-		if _, err := mutators[0].Mutate(ctx, pcb.builders[0].mutation); err != nil {
+		if _, err := mutators[0].Mutate(ctx, _c.builders[0].mutation); err != nil {
 			return nil, err
 		}
 	}
@@ -270,8 +299,8 @@ func (pcb *PasswordCreateBulk) Save(ctx context.Context) ([]*Password, error) {
 }
 
 // SaveX is like Save, but panics if an error occurs.
-func (pcb *PasswordCreateBulk) SaveX(ctx context.Context) []*Password {
-	v, err := pcb.Save(ctx)
+func (_c *PasswordCreateBulk) SaveX(ctx context.Context) []*Password {
+	v, err := _c.Save(ctx)
 	if err != nil {
 		panic(err)
 	}
@@ -279,14 +308,14 @@ func (pcb *PasswordCreateBulk) SaveX(ctx context.Context) []*Password {
 }
 
 // Exec executes the query.
-func (pcb *PasswordCreateBulk) Exec(ctx context.Context) error {
-	_, err := pcb.Save(ctx)
+func (_c *PasswordCreateBulk) Exec(ctx context.Context) error {
+	_, err := _c.Save(ctx)
 	return err
 }
 
 // ExecX is like Exec, but panics if an error occurs.
-func (pcb *PasswordCreateBulk) ExecX(ctx context.Context) {
-	if err := pcb.Exec(ctx); err != nil {
+func (_c *PasswordCreateBulk) ExecX(ctx context.Context) {
+	if err := _c.Exec(ctx); err != nil {
 		panic(err)
 	}
 }
diff --git a/storage/ent/db/password_delete.go b/storage/ent/db/password_delete.go
index 6bbe5af57b..35ecfbc30d 100644
--- a/storage/ent/db/password_delete.go
+++ b/storage/ent/db/password_delete.go
@@ -4,7 +4,6 @@ package db
 
 import (
 	"context"
-	"fmt"
 
 	"entgo.io/ent/dialect/sql"
 	"entgo.io/ent/dialect/sql/sqlgraph"
@@ -21,84 +20,56 @@ type PasswordDelete struct {
 }
 
 // Where appends a list predicates to the PasswordDelete builder.
-func (pd *PasswordDelete) Where(ps ...predicate.Password) *PasswordDelete {
-	pd.mutation.Where(ps...)
-	return pd
+func (_d *PasswordDelete) Where(ps ...predicate.Password) *PasswordDelete {
+	_d.mutation.Where(ps...)
+	return _d
 }
 
 // Exec executes the deletion query and returns how many vertices were deleted.
-func (pd *PasswordDelete) Exec(ctx context.Context) (int, error) {
-	var (
-		err      error
-		affected int
-	)
-	if len(pd.hooks) == 0 {
-		affected, err = pd.sqlExec(ctx)
-	} else {
-		var mut Mutator = MutateFunc(func(ctx context.Context, m Mutation) (Value, error) {
-			mutation, ok := m.(*PasswordMutation)
-			if !ok {
-				return nil, fmt.Errorf("unexpected mutation type %T", m)
-			}
-			pd.mutation = mutation
-			affected, err = pd.sqlExec(ctx)
-			mutation.done = true
-			return affected, err
-		})
-		for i := len(pd.hooks) - 1; i >= 0; i-- {
-			if pd.hooks[i] == nil {
-				return 0, fmt.Errorf("db: uninitialized hook (forgotten import db/runtime?)")
-			}
-			mut = pd.hooks[i](mut)
-		}
-		if _, err := mut.Mutate(ctx, pd.mutation); err != nil {
-			return 0, err
-		}
-	}
-	return affected, err
+func (_d *PasswordDelete) Exec(ctx context.Context) (int, error) {
+	return withHooks(ctx, _d.sqlExec, _d.mutation, _d.hooks)
 }
 
 // ExecX is like Exec, but panics if an error occurs.
-func (pd *PasswordDelete) ExecX(ctx context.Context) int {
-	n, err := pd.Exec(ctx)
+func (_d *PasswordDelete) ExecX(ctx context.Context) int {
+	n, err := _d.Exec(ctx)
 	if err != nil {
 		panic(err)
 	}
 	return n
 }
 
-func (pd *PasswordDelete) sqlExec(ctx context.Context) (int, error) {
-	_spec := &sqlgraph.DeleteSpec{
-		Node: &sqlgraph.NodeSpec{
-			Table: password.Table,
-			ID: &sqlgraph.FieldSpec{
-				Type:   field.TypeInt,
-				Column: password.FieldID,
-			},
-		},
-	}
-	if ps := pd.mutation.predicates; len(ps) > 0 {
+func (_d *PasswordDelete) sqlExec(ctx context.Context) (int, error) {
+	_spec := sqlgraph.NewDeleteSpec(password.Table, sqlgraph.NewFieldSpec(password.FieldID, field.TypeInt))
+	if ps := _d.mutation.predicates; len(ps) > 0 {
 		_spec.Predicate = func(selector *sql.Selector) {
 			for i := range ps {
 				ps[i](selector)
 			}
 		}
 	}
-	affected, err := sqlgraph.DeleteNodes(ctx, pd.driver, _spec)
+	affected, err := sqlgraph.DeleteNodes(ctx, _d.driver, _spec)
 	if err != nil && sqlgraph.IsConstraintError(err) {
 		err = &ConstraintError{msg: err.Error(), wrap: err}
 	}
+	_d.mutation.done = true
 	return affected, err
 }
 
 // PasswordDeleteOne is the builder for deleting a single Password entity.
 type PasswordDeleteOne struct {
-	pd *PasswordDelete
+	_d *PasswordDelete
+}
+
+// Where appends a list predicates to the PasswordDelete builder.
+func (_d *PasswordDeleteOne) Where(ps ...predicate.Password) *PasswordDeleteOne {
+	_d._d.mutation.Where(ps...)
+	return _d
 }
 
 // Exec executes the deletion query.
-func (pdo *PasswordDeleteOne) Exec(ctx context.Context) error {
-	n, err := pdo.pd.Exec(ctx)
+func (_d *PasswordDeleteOne) Exec(ctx context.Context) error {
+	n, err := _d._d.Exec(ctx)
 	switch {
 	case err != nil:
 		return err
@@ -110,6 +81,8 @@ func (pdo *PasswordDeleteOne) Exec(ctx context.Context) error {
 }
 
 // ExecX is like Exec, but panics if an error occurs.
-func (pdo *PasswordDeleteOne) ExecX(ctx context.Context) {
-	pdo.pd.ExecX(ctx)
+func (_d *PasswordDeleteOne) ExecX(ctx context.Context) {
+	if err := _d.Exec(ctx); err != nil {
+		panic(err)
+	}
 }
diff --git a/storage/ent/db/password_query.go b/storage/ent/db/password_query.go
index 0da4d08aef..eaeb28bba0 100644
--- a/storage/ent/db/password_query.go
+++ b/storage/ent/db/password_query.go
@@ -7,6 +7,7 @@ import (
 	"fmt"
 	"math"
 
+	"entgo.io/ent"
 	"entgo.io/ent/dialect/sql"
 	"entgo.io/ent/dialect/sql/sqlgraph"
 	"entgo.io/ent/schema/field"
@@ -17,11 +18,9 @@ import (
 // PasswordQuery is the builder for querying Password entities.
 type PasswordQuery struct {
 	config
-	limit      *int
-	offset     *int
-	unique     *bool
-	order      []OrderFunc
-	fields     []string
+	ctx        *QueryContext
+	order      []password.OrderOption
+	inters     []Interceptor
 	predicates []predicate.Password
 	// intermediate query (i.e. traversal path).
 	sql  *sql.Selector
@@ -29,40 +28,40 @@ type PasswordQuery struct {
 }
 
 // Where adds a new predicate for the PasswordQuery builder.
-func (pq *PasswordQuery) Where(ps ...predicate.Password) *PasswordQuery {
-	pq.predicates = append(pq.predicates, ps...)
-	return pq
+func (_q *PasswordQuery) Where(ps ...predicate.Password) *PasswordQuery {
+	_q.predicates = append(_q.predicates, ps...)
+	return _q
 }
 
-// Limit adds a limit step to the query.
-func (pq *PasswordQuery) Limit(limit int) *PasswordQuery {
-	pq.limit = &limit
-	return pq
+// Limit the number of records to be returned by this query.
+func (_q *PasswordQuery) Limit(limit int) *PasswordQuery {
+	_q.ctx.Limit = &limit
+	return _q
 }
 
-// Offset adds an offset step to the query.
-func (pq *PasswordQuery) Offset(offset int) *PasswordQuery {
-	pq.offset = &offset
-	return pq
+// Offset to start from.
+func (_q *PasswordQuery) Offset(offset int) *PasswordQuery {
+	_q.ctx.Offset = &offset
+	return _q
 }
 
 // Unique configures the query builder to filter duplicate records on query.
 // By default, unique is set to true, and can be disabled using this method.
-func (pq *PasswordQuery) Unique(unique bool) *PasswordQuery {
-	pq.unique = &unique
-	return pq
+func (_q *PasswordQuery) Unique(unique bool) *PasswordQuery {
+	_q.ctx.Unique = &unique
+	return _q
 }
 
-// Order adds an order step to the query.
-func (pq *PasswordQuery) Order(o ...OrderFunc) *PasswordQuery {
-	pq.order = append(pq.order, o...)
-	return pq
+// Order specifies how the records should be ordered.
+func (_q *PasswordQuery) Order(o ...password.OrderOption) *PasswordQuery {
+	_q.order = append(_q.order, o...)
+	return _q
 }
 
 // First returns the first Password entity from the query.
 // Returns a *NotFoundError when no Password was found.
-func (pq *PasswordQuery) First(ctx context.Context) (*Password, error) {
-	nodes, err := pq.Limit(1).All(ctx)
+func (_q *PasswordQuery) First(ctx context.Context) (*Password, error) {
+	nodes, err := _q.Limit(1).All(setContextOp(ctx, _q.ctx, ent.OpQueryFirst))
 	if err != nil {
 		return nil, err
 	}
@@ -73,8 +72,8 @@ func (pq *PasswordQuery) First(ctx context.Context) (*Password, error) {
 }
 
 // FirstX is like First, but panics if an error occurs.
-func (pq *PasswordQuery) FirstX(ctx context.Context) *Password {
-	node, err := pq.First(ctx)
+func (_q *PasswordQuery) FirstX(ctx context.Context) *Password {
+	node, err := _q.First(ctx)
 	if err != nil && !IsNotFound(err) {
 		panic(err)
 	}
@@ -83,9 +82,9 @@ func (pq *PasswordQuery) FirstX(ctx context.Context) *Password {
 
 // FirstID returns the first Password ID from the query.
 // Returns a *NotFoundError when no Password ID was found.
-func (pq *PasswordQuery) FirstID(ctx context.Context) (id int, err error) {
+func (_q *PasswordQuery) FirstID(ctx context.Context) (id int, err error) {
 	var ids []int
-	if ids, err = pq.Limit(1).IDs(ctx); err != nil {
+	if ids, err = _q.Limit(1).IDs(setContextOp(ctx, _q.ctx, ent.OpQueryFirstID)); err != nil {
 		return
 	}
 	if len(ids) == 0 {
@@ -96,8 +95,8 @@ func (pq *PasswordQuery) FirstID(ctx context.Context) (id int, err error) {
 }
 
 // FirstIDX is like FirstID, but panics if an error occurs.
-func (pq *PasswordQuery) FirstIDX(ctx context.Context) int {
-	id, err := pq.FirstID(ctx)
+func (_q *PasswordQuery) FirstIDX(ctx context.Context) int {
+	id, err := _q.FirstID(ctx)
 	if err != nil && !IsNotFound(err) {
 		panic(err)
 	}
@@ -107,8 +106,8 @@ func (pq *PasswordQuery) FirstIDX(ctx context.Context) int {
 // Only returns a single Password entity found by the query, ensuring it only returns one.
 // Returns a *NotSingularError when more than one Password entity is found.
 // Returns a *NotFoundError when no Password entities are found.
-func (pq *PasswordQuery) Only(ctx context.Context) (*Password, error) {
-	nodes, err := pq.Limit(2).All(ctx)
+func (_q *PasswordQuery) Only(ctx context.Context) (*Password, error) {
+	nodes, err := _q.Limit(2).All(setContextOp(ctx, _q.ctx, ent.OpQueryOnly))
 	if err != nil {
 		return nil, err
 	}
@@ -123,8 +122,8 @@ func (pq *PasswordQuery) Only(ctx context.Context) (*Password, error) {
 }
 
 // OnlyX is like Only, but panics if an error occurs.
-func (pq *PasswordQuery) OnlyX(ctx context.Context) *Password {
-	node, err := pq.Only(ctx)
+func (_q *PasswordQuery) OnlyX(ctx context.Context) *Password {
+	node, err := _q.Only(ctx)
 	if err != nil {
 		panic(err)
 	}
@@ -134,9 +133,9 @@ func (pq *PasswordQuery) OnlyX(ctx context.Context) *Password {
 // OnlyID is like Only, but returns the only Password ID in the query.
 // Returns a *NotSingularError when more than one Password ID is found.
 // Returns a *NotFoundError when no entities are found.
-func (pq *PasswordQuery) OnlyID(ctx context.Context) (id int, err error) {
+func (_q *PasswordQuery) OnlyID(ctx context.Context) (id int, err error) {
 	var ids []int
-	if ids, err = pq.Limit(2).IDs(ctx); err != nil {
+	if ids, err = _q.Limit(2).IDs(setContextOp(ctx, _q.ctx, ent.OpQueryOnlyID)); err != nil {
 		return
 	}
 	switch len(ids) {
@@ -151,8 +150,8 @@ func (pq *PasswordQuery) OnlyID(ctx context.Context) (id int, err error) {
 }
 
 // OnlyIDX is like OnlyID, but panics if an error occurs.
-func (pq *PasswordQuery) OnlyIDX(ctx context.Context) int {
-	id, err := pq.OnlyID(ctx)
+func (_q *PasswordQuery) OnlyIDX(ctx context.Context) int {
+	id, err := _q.OnlyID(ctx)
 	if err != nil {
 		panic(err)
 	}
@@ -160,16 +159,18 @@ func (pq *PasswordQuery) OnlyIDX(ctx context.Context) int {
 }
 
 // All executes the query and returns a list of Passwords.
-func (pq *PasswordQuery) All(ctx context.Context) ([]*Password, error) {
-	if err := pq.prepareQuery(ctx); err != nil {
+func (_q *PasswordQuery) All(ctx context.Context) ([]*Password, error) {
+	ctx = setContextOp(ctx, _q.ctx, ent.OpQueryAll)
+	if err := _q.prepareQuery(ctx); err != nil {
 		return nil, err
 	}
-	return pq.sqlAll(ctx)
+	qr := querierAll[[]*Password, *PasswordQuery]()
+	return withInterceptors[[]*Password](ctx, _q, qr, _q.inters)
 }
 
 // AllX is like All, but panics if an error occurs.
-func (pq *PasswordQuery) AllX(ctx context.Context) []*Password {
-	nodes, err := pq.All(ctx)
+func (_q *PasswordQuery) AllX(ctx context.Context) []*Password {
+	nodes, err := _q.All(ctx)
 	if err != nil {
 		panic(err)
 	}
@@ -177,17 +178,20 @@ func (pq *PasswordQuery) AllX(ctx context.Context) []*Password {
 }
 
 // IDs executes the query and returns a list of Password IDs.
-func (pq *PasswordQuery) IDs(ctx context.Context) ([]int, error) {
-	var ids []int
-	if err := pq.Select(password.FieldID).Scan(ctx, &ids); err != nil {
+func (_q *PasswordQuery) IDs(ctx context.Context) (ids []int, err error) {
+	if _q.ctx.Unique == nil && _q.path != nil {
+		_q.Unique(true)
+	}
+	ctx = setContextOp(ctx, _q.ctx, ent.OpQueryIDs)
+	if err = _q.Select(password.FieldID).Scan(ctx, &ids); err != nil {
 		return nil, err
 	}
 	return ids, nil
 }
 
 // IDsX is like IDs, but panics if an error occurs.
-func (pq *PasswordQuery) IDsX(ctx context.Context) []int {
-	ids, err := pq.IDs(ctx)
+func (_q *PasswordQuery) IDsX(ctx context.Context) []int {
+	ids, err := _q.IDs(ctx)
 	if err != nil {
 		panic(err)
 	}
@@ -195,16 +199,17 @@ func (pq *PasswordQuery) IDsX(ctx context.Context) []int {
 }
 
 // Count returns the count of the given query.
-func (pq *PasswordQuery) Count(ctx context.Context) (int, error) {
-	if err := pq.prepareQuery(ctx); err != nil {
+func (_q *PasswordQuery) Count(ctx context.Context) (int, error) {
+	ctx = setContextOp(ctx, _q.ctx, ent.OpQueryCount)
+	if err := _q.prepareQuery(ctx); err != nil {
 		return 0, err
 	}
-	return pq.sqlCount(ctx)
+	return withInterceptors[int](ctx, _q, querierCount[*PasswordQuery](), _q.inters)
 }
 
 // CountX is like Count, but panics if an error occurs.
-func (pq *PasswordQuery) CountX(ctx context.Context) int {
-	count, err := pq.Count(ctx)
+func (_q *PasswordQuery) CountX(ctx context.Context) int {
+	count, err := _q.Count(ctx)
 	if err != nil {
 		panic(err)
 	}
@@ -212,16 +217,21 @@ func (pq *PasswordQuery) CountX(ctx context.Context) int {
 }
 
 // Exist returns true if the query has elements in the graph.
-func (pq *PasswordQuery) Exist(ctx context.Context) (bool, error) {
-	if err := pq.prepareQuery(ctx); err != nil {
-		return false, err
+func (_q *PasswordQuery) Exist(ctx context.Context) (bool, error) {
+	ctx = setContextOp(ctx, _q.ctx, ent.OpQueryExist)
+	switch _, err := _q.FirstID(ctx); {
+	case IsNotFound(err):
+		return false, nil
+	case err != nil:
+		return false, fmt.Errorf("db: check existence: %w", err)
+	default:
+		return true, nil
 	}
-	return pq.sqlExist(ctx)
 }
 
 // ExistX is like Exist, but panics if an error occurs.
-func (pq *PasswordQuery) ExistX(ctx context.Context) bool {
-	exist, err := pq.Exist(ctx)
+func (_q *PasswordQuery) ExistX(ctx context.Context) bool {
+	exist, err := _q.Exist(ctx)
 	if err != nil {
 		panic(err)
 	}
@@ -230,20 +240,19 @@ func (pq *PasswordQuery) ExistX(ctx context.Context) bool {
 
 // Clone returns a duplicate of the PasswordQuery builder, including all associated steps. It can be
 // used to prepare common query builders and use them differently after the clone is made.
-func (pq *PasswordQuery) Clone() *PasswordQuery {
-	if pq == nil {
+func (_q *PasswordQuery) Clone() *PasswordQuery {
+	if _q == nil {
 		return nil
 	}
 	return &PasswordQuery{
-		config:     pq.config,
-		limit:      pq.limit,
-		offset:     pq.offset,
-		order:      append([]OrderFunc{}, pq.order...),
-		predicates: append([]predicate.Password{}, pq.predicates...),
+		config:     _q.config,
+		ctx:        _q.ctx.Clone(),
+		order:      append([]password.OrderOption{}, _q.order...),
+		inters:     append([]Interceptor{}, _q.inters...),
+		predicates: append([]predicate.Password{}, _q.predicates...),
 		// clone intermediate query.
-		sql:    pq.sql.Clone(),
-		path:   pq.path,
-		unique: pq.unique,
+		sql:  _q.sql.Clone(),
+		path: _q.path,
 	}
 }
 
@@ -261,18 +270,12 @@ func (pq *PasswordQuery) Clone() *PasswordQuery {
 //		GroupBy(password.FieldEmail).
 //		Aggregate(db.Count()).
 //		Scan(ctx, &v)
-//
-func (pq *PasswordQuery) GroupBy(field string, fields ...string) *PasswordGroupBy {
-	grbuild := &PasswordGroupBy{config: pq.config}
-	grbuild.fields = append([]string{field}, fields...)
-	grbuild.path = func(ctx context.Context) (prev *sql.Selector, err error) {
-		if err := pq.prepareQuery(ctx); err != nil {
-			return nil, err
-		}
-		return pq.sqlQuery(ctx), nil
-	}
+func (_q *PasswordQuery) GroupBy(field string, fields ...string) *PasswordGroupBy {
+	_q.ctx.Fields = append([]string{field}, fields...)
+	grbuild := &PasswordGroupBy{build: _q}
+	grbuild.flds = &_q.ctx.Fields
 	grbuild.label = password.Label
-	grbuild.flds, grbuild.scan = &grbuild.fields, grbuild.Scan
+	grbuild.scan = grbuild.Scan
 	return grbuild
 }
 
@@ -288,48 +291,62 @@ func (pq *PasswordQuery) GroupBy(field string, fields ...string) *PasswordGroupB
 //	client.Password.Query().
 //		Select(password.FieldEmail).
 //		Scan(ctx, &v)
-//
-func (pq *PasswordQuery) Select(fields ...string) *PasswordSelect {
-	pq.fields = append(pq.fields, fields...)
-	selbuild := &PasswordSelect{PasswordQuery: pq}
-	selbuild.label = password.Label
-	selbuild.flds, selbuild.scan = &pq.fields, selbuild.Scan
-	return selbuild
+func (_q *PasswordQuery) Select(fields ...string) *PasswordSelect {
+	_q.ctx.Fields = append(_q.ctx.Fields, fields...)
+	sbuild := &PasswordSelect{PasswordQuery: _q}
+	sbuild.label = password.Label
+	sbuild.flds, sbuild.scan = &_q.ctx.Fields, sbuild.Scan
+	return sbuild
+}
+
+// Aggregate returns a PasswordSelect configured with the given aggregations.
+func (_q *PasswordQuery) Aggregate(fns ...AggregateFunc) *PasswordSelect {
+	return _q.Select().Aggregate(fns...)
 }
 
-func (pq *PasswordQuery) prepareQuery(ctx context.Context) error {
-	for _, f := range pq.fields {
+func (_q *PasswordQuery) prepareQuery(ctx context.Context) error {
+	for _, inter := range _q.inters {
+		if inter == nil {
+			return fmt.Errorf("db: uninitialized interceptor (forgotten import db/runtime?)")
+		}
+		if trv, ok := inter.(Traverser); ok {
+			if err := trv.Traverse(ctx, _q); err != nil {
+				return err
+			}
+		}
+	}
+	for _, f := range _q.ctx.Fields {
 		if !password.ValidColumn(f) {
 			return &ValidationError{Name: f, err: fmt.Errorf("db: invalid field %q for query", f)}
 		}
 	}
-	if pq.path != nil {
-		prev, err := pq.path(ctx)
+	if _q.path != nil {
+		prev, err := _q.path(ctx)
 		if err != nil {
 			return err
 		}
-		pq.sql = prev
+		_q.sql = prev
 	}
 	return nil
 }
 
-func (pq *PasswordQuery) sqlAll(ctx context.Context, hooks ...queryHook) ([]*Password, error) {
+func (_q *PasswordQuery) sqlAll(ctx context.Context, hooks ...queryHook) ([]*Password, error) {
 	var (
 		nodes = []*Password{}
-		_spec = pq.querySpec()
+		_spec = _q.querySpec()
 	)
-	_spec.ScanValues = func(columns []string) ([]interface{}, error) {
+	_spec.ScanValues = func(columns []string) ([]any, error) {
 		return (*Password).scanValues(nil, columns)
 	}
-	_spec.Assign = func(columns []string, values []interface{}) error {
-		node := &Password{config: pq.config}
+	_spec.Assign = func(columns []string, values []any) error {
+		node := &Password{config: _q.config}
 		nodes = append(nodes, node)
 		return node.assignValues(columns, values)
 	}
 	for i := range hooks {
 		hooks[i](ctx, _spec)
 	}
-	if err := sqlgraph.QueryNodes(ctx, pq.driver, _spec); err != nil {
+	if err := sqlgraph.QueryNodes(ctx, _q.driver, _spec); err != nil {
 		return nil, err
 	}
 	if len(nodes) == 0 {
@@ -338,40 +355,24 @@ func (pq *PasswordQuery) sqlAll(ctx context.Context, hooks ...queryHook) ([]*Pas
 	return nodes, nil
 }
 
-func (pq *PasswordQuery) sqlCount(ctx context.Context) (int, error) {
-	_spec := pq.querySpec()
-	_spec.Node.Columns = pq.fields
-	if len(pq.fields) > 0 {
-		_spec.Unique = pq.unique != nil && *pq.unique
-	}
-	return sqlgraph.CountNodes(ctx, pq.driver, _spec)
-}
-
-func (pq *PasswordQuery) sqlExist(ctx context.Context) (bool, error) {
-	n, err := pq.sqlCount(ctx)
-	if err != nil {
-		return false, fmt.Errorf("db: check existence: %w", err)
+func (_q *PasswordQuery) sqlCount(ctx context.Context) (int, error) {
+	_spec := _q.querySpec()
+	_spec.Node.Columns = _q.ctx.Fields
+	if len(_q.ctx.Fields) > 0 {
+		_spec.Unique = _q.ctx.Unique != nil && *_q.ctx.Unique
 	}
-	return n > 0, nil
+	return sqlgraph.CountNodes(ctx, _q.driver, _spec)
 }
 
-func (pq *PasswordQuery) querySpec() *sqlgraph.QuerySpec {
-	_spec := &sqlgraph.QuerySpec{
-		Node: &sqlgraph.NodeSpec{
-			Table:   password.Table,
-			Columns: password.Columns,
-			ID: &sqlgraph.FieldSpec{
-				Type:   field.TypeInt,
-				Column: password.FieldID,
-			},
-		},
-		From:   pq.sql,
-		Unique: true,
-	}
-	if unique := pq.unique; unique != nil {
+func (_q *PasswordQuery) querySpec() *sqlgraph.QuerySpec {
+	_spec := sqlgraph.NewQuerySpec(password.Table, password.Columns, sqlgraph.NewFieldSpec(password.FieldID, field.TypeInt))
+	_spec.From = _q.sql
+	if unique := _q.ctx.Unique; unique != nil {
 		_spec.Unique = *unique
+	} else if _q.path != nil {
+		_spec.Unique = true
 	}
-	if fields := pq.fields; len(fields) > 0 {
+	if fields := _q.ctx.Fields; len(fields) > 0 {
 		_spec.Node.Columns = make([]string, 0, len(fields))
 		_spec.Node.Columns = append(_spec.Node.Columns, password.FieldID)
 		for i := range fields {
@@ -380,20 +381,20 @@ func (pq *PasswordQuery) querySpec() *sqlgraph.QuerySpec {
 			}
 		}
 	}
-	if ps := pq.predicates; len(ps) > 0 {
+	if ps := _q.predicates; len(ps) > 0 {
 		_spec.Predicate = func(selector *sql.Selector) {
 			for i := range ps {
 				ps[i](selector)
 			}
 		}
 	}
-	if limit := pq.limit; limit != nil {
+	if limit := _q.ctx.Limit; limit != nil {
 		_spec.Limit = *limit
 	}
-	if offset := pq.offset; offset != nil {
+	if offset := _q.ctx.Offset; offset != nil {
 		_spec.Offset = *offset
 	}
-	if ps := pq.order; len(ps) > 0 {
+	if ps := _q.order; len(ps) > 0 {
 		_spec.Order = func(selector *sql.Selector) {
 			for i := range ps {
 				ps[i](selector)
@@ -403,33 +404,33 @@ func (pq *PasswordQuery) querySpec() *sqlgraph.QuerySpec {
 	return _spec
 }
 
-func (pq *PasswordQuery) sqlQuery(ctx context.Context) *sql.Selector {
-	builder := sql.Dialect(pq.driver.Dialect())
+func (_q *PasswordQuery) sqlQuery(ctx context.Context) *sql.Selector {
+	builder := sql.Dialect(_q.driver.Dialect())
 	t1 := builder.Table(password.Table)
-	columns := pq.fields
+	columns := _q.ctx.Fields
 	if len(columns) == 0 {
 		columns = password.Columns
 	}
 	selector := builder.Select(t1.Columns(columns...)...).From(t1)
-	if pq.sql != nil {
-		selector = pq.sql
+	if _q.sql != nil {
+		selector = _q.sql
 		selector.Select(selector.Columns(columns...)...)
 	}
-	if pq.unique != nil && *pq.unique {
+	if _q.ctx.Unique != nil && *_q.ctx.Unique {
 		selector.Distinct()
 	}
-	for _, p := range pq.predicates {
+	for _, p := range _q.predicates {
 		p(selector)
 	}
-	for _, p := range pq.order {
+	for _, p := range _q.order {
 		p(selector)
 	}
-	if offset := pq.offset; offset != nil {
+	if offset := _q.ctx.Offset; offset != nil {
 		// limit is mandatory for offset clause. We start
 		// with default value, and override it below if needed.
 		selector.Offset(*offset).Limit(math.MaxInt32)
 	}
-	if limit := pq.limit; limit != nil {
+	if limit := _q.ctx.Limit; limit != nil {
 		selector.Limit(*limit)
 	}
 	return selector
@@ -437,90 +438,88 @@ func (pq *PasswordQuery) sqlQuery(ctx context.Context) *sql.Selector {
 
 // PasswordGroupBy is the group-by builder for Password entities.
 type PasswordGroupBy struct {
-	config
 	selector
-	fields []string
-	fns    []AggregateFunc
-	// intermediate query (i.e. traversal path).
-	sql  *sql.Selector
-	path func(context.Context) (*sql.Selector, error)
+	build *PasswordQuery
 }
 
 // Aggregate adds the given aggregation functions to the group-by query.
-func (pgb *PasswordGroupBy) Aggregate(fns ...AggregateFunc) *PasswordGroupBy {
-	pgb.fns = append(pgb.fns, fns...)
-	return pgb
+func (_g *PasswordGroupBy) Aggregate(fns ...AggregateFunc) *PasswordGroupBy {
+	_g.fns = append(_g.fns, fns...)
+	return _g
 }
 
-// Scan applies the group-by query and scans the result into the given value.
-func (pgb *PasswordGroupBy) Scan(ctx context.Context, v interface{}) error {
-	query, err := pgb.path(ctx)
-	if err != nil {
+// Scan applies the selector query and scans the result into the given value.
+func (_g *PasswordGroupBy) Scan(ctx context.Context, v any) error {
+	ctx = setContextOp(ctx, _g.build.ctx, ent.OpQueryGroupBy)
+	if err := _g.build.prepareQuery(ctx); err != nil {
 		return err
 	}
-	pgb.sql = query
-	return pgb.sqlScan(ctx, v)
+	return scanWithInterceptors[*PasswordQuery, *PasswordGroupBy](ctx, _g.build, _g, _g.build.inters, v)
 }
 
-func (pgb *PasswordGroupBy) sqlScan(ctx context.Context, v interface{}) error {
-	for _, f := range pgb.fields {
-		if !password.ValidColumn(f) {
-			return &ValidationError{Name: f, err: fmt.Errorf("invalid field %q for group-by", f)}
+func (_g *PasswordGroupBy) sqlScan(ctx context.Context, root *PasswordQuery, v any) error {
+	selector := root.sqlQuery(ctx).Select()
+	aggregation := make([]string, 0, len(_g.fns))
+	for _, fn := range _g.fns {
+		aggregation = append(aggregation, fn(selector))
+	}
+	if len(selector.SelectedColumns()) == 0 {
+		columns := make([]string, 0, len(*_g.flds)+len(_g.fns))
+		for _, f := range *_g.flds {
+			columns = append(columns, selector.C(f))
 		}
+		columns = append(columns, aggregation...)
+		selector.Select(columns...)
 	}
-	selector := pgb.sqlQuery()
+	selector.GroupBy(selector.Columns(*_g.flds...)...)
 	if err := selector.Err(); err != nil {
 		return err
 	}
 	rows := &sql.Rows{}
 	query, args := selector.Query()
-	if err := pgb.driver.Query(ctx, query, args, rows); err != nil {
+	if err := _g.build.driver.Query(ctx, query, args, rows); err != nil {
 		return err
 	}
 	defer rows.Close()
 	return sql.ScanSlice(rows, v)
 }
 
-func (pgb *PasswordGroupBy) sqlQuery() *sql.Selector {
-	selector := pgb.sql.Select()
-	aggregation := make([]string, 0, len(pgb.fns))
-	for _, fn := range pgb.fns {
-		aggregation = append(aggregation, fn(selector))
-	}
-	// If no columns were selected in a custom aggregation function, the default
-	// selection is the fields used for "group-by", and the aggregation functions.
-	if len(selector.SelectedColumns()) == 0 {
-		columns := make([]string, 0, len(pgb.fields)+len(pgb.fns))
-		for _, f := range pgb.fields {
-			columns = append(columns, selector.C(f))
-		}
-		columns = append(columns, aggregation...)
-		selector.Select(columns...)
-	}
-	return selector.GroupBy(selector.Columns(pgb.fields...)...)
-}
-
 // PasswordSelect is the builder for selecting fields of Password entities.
 type PasswordSelect struct {
 	*PasswordQuery
 	selector
-	// intermediate query (i.e. traversal path).
-	sql *sql.Selector
+}
+
+// Aggregate adds the given aggregation functions to the selector query.
+func (_s *PasswordSelect) Aggregate(fns ...AggregateFunc) *PasswordSelect {
+	_s.fns = append(_s.fns, fns...)
+	return _s
 }
 
 // Scan applies the selector query and scans the result into the given value.
-func (ps *PasswordSelect) Scan(ctx context.Context, v interface{}) error {
-	if err := ps.prepareQuery(ctx); err != nil {
+func (_s *PasswordSelect) Scan(ctx context.Context, v any) error {
+	ctx = setContextOp(ctx, _s.ctx, ent.OpQuerySelect)
+	if err := _s.prepareQuery(ctx); err != nil {
 		return err
 	}
-	ps.sql = ps.PasswordQuery.sqlQuery(ctx)
-	return ps.sqlScan(ctx, v)
+	return scanWithInterceptors[*PasswordQuery, *PasswordSelect](ctx, _s.PasswordQuery, _s, _s.inters, v)
 }
 
-func (ps *PasswordSelect) sqlScan(ctx context.Context, v interface{}) error {
+func (_s *PasswordSelect) sqlScan(ctx context.Context, root *PasswordQuery, v any) error {
+	selector := root.sqlQuery(ctx)
+	aggregation := make([]string, 0, len(_s.fns))
+	for _, fn := range _s.fns {
+		aggregation = append(aggregation, fn(selector))
+	}
+	switch n := len(*_s.selector.flds); {
+	case n == 0 && len(aggregation) > 0:
+		selector.Select(aggregation...)
+	case n != 0 && len(aggregation) > 0:
+		selector.AppendSelect(aggregation...)
+	}
 	rows := &sql.Rows{}
-	query, args := ps.sql.Query()
-	if err := ps.driver.Query(ctx, query, args, rows); err != nil {
+	query, args := selector.Query()
+	if err := _s.driver.Query(ctx, query, args, rows); err != nil {
 		return err
 	}
 	defer rows.Close()
diff --git a/storage/ent/db/password_update.go b/storage/ent/db/password_update.go
index 8d149991a8..bda17ab6a3 100644
--- a/storage/ent/db/password_update.go
+++ b/storage/ent/db/password_update.go
@@ -9,6 +9,7 @@ import (
 
 	"entgo.io/ent/dialect/sql"
 	"entgo.io/ent/dialect/sql/sqlgraph"
+	"entgo.io/ent/dialect/sql/sqljson"
 	"entgo.io/ent/schema/field"
 	"github.com/dexidp/dex/storage/ent/db/password"
 	"github.com/dexidp/dex/storage/ent/db/predicate"
@@ -22,81 +23,138 @@ type PasswordUpdate struct {
 }
 
 // Where appends a list predicates to the PasswordUpdate builder.
-func (pu *PasswordUpdate) Where(ps ...predicate.Password) *PasswordUpdate {
-	pu.mutation.Where(ps...)
-	return pu
+func (_u *PasswordUpdate) Where(ps ...predicate.Password) *PasswordUpdate {
+	_u.mutation.Where(ps...)
+	return _u
 }
 
 // SetEmail sets the "email" field.
-func (pu *PasswordUpdate) SetEmail(s string) *PasswordUpdate {
-	pu.mutation.SetEmail(s)
-	return pu
+func (_u *PasswordUpdate) SetEmail(v string) *PasswordUpdate {
+	_u.mutation.SetEmail(v)
+	return _u
+}
+
+// SetNillableEmail sets the "email" field if the given value is not nil.
+func (_u *PasswordUpdate) SetNillableEmail(v *string) *PasswordUpdate {
+	if v != nil {
+		_u.SetEmail(*v)
+	}
+	return _u
 }
 
 // SetHash sets the "hash" field.
-func (pu *PasswordUpdate) SetHash(b []byte) *PasswordUpdate {
-	pu.mutation.SetHash(b)
-	return pu
+func (_u *PasswordUpdate) SetHash(v []byte) *PasswordUpdate {
+	_u.mutation.SetHash(v)
+	return _u
 }
 
 // SetUsername sets the "username" field.
-func (pu *PasswordUpdate) SetUsername(s string) *PasswordUpdate {
-	pu.mutation.SetUsername(s)
-	return pu
+func (_u *PasswordUpdate) SetUsername(v string) *PasswordUpdate {
+	_u.mutation.SetUsername(v)
+	return _u
+}
+
+// SetNillableUsername sets the "username" field if the given value is not nil.
+func (_u *PasswordUpdate) SetNillableUsername(v *string) *PasswordUpdate {
+	if v != nil {
+		_u.SetUsername(*v)
+	}
+	return _u
+}
+
+// SetName sets the "name" field.
+func (_u *PasswordUpdate) SetName(v string) *PasswordUpdate {
+	_u.mutation.SetName(v)
+	return _u
+}
+
+// SetNillableName sets the "name" field if the given value is not nil.
+func (_u *PasswordUpdate) SetNillableName(v *string) *PasswordUpdate {
+	if v != nil {
+		_u.SetName(*v)
+	}
+	return _u
+}
+
+// SetPreferredUsername sets the "preferred_username" field.
+func (_u *PasswordUpdate) SetPreferredUsername(v string) *PasswordUpdate {
+	_u.mutation.SetPreferredUsername(v)
+	return _u
+}
+
+// SetNillablePreferredUsername sets the "preferred_username" field if the given value is not nil.
+func (_u *PasswordUpdate) SetNillablePreferredUsername(v *string) *PasswordUpdate {
+	if v != nil {
+		_u.SetPreferredUsername(*v)
+	}
+	return _u
+}
+
+// SetEmailVerified sets the "email_verified" field.
+func (_u *PasswordUpdate) SetEmailVerified(v bool) *PasswordUpdate {
+	_u.mutation.SetEmailVerified(v)
+	return _u
+}
+
+// SetNillableEmailVerified sets the "email_verified" field if the given value is not nil.
+func (_u *PasswordUpdate) SetNillableEmailVerified(v *bool) *PasswordUpdate {
+	if v != nil {
+		_u.SetEmailVerified(*v)
+	}
+	return _u
+}
+
+// ClearEmailVerified clears the value of the "email_verified" field.
+func (_u *PasswordUpdate) ClearEmailVerified() *PasswordUpdate {
+	_u.mutation.ClearEmailVerified()
+	return _u
 }
 
 // SetUserID sets the "user_id" field.
-func (pu *PasswordUpdate) SetUserID(s string) *PasswordUpdate {
-	pu.mutation.SetUserID(s)
-	return pu
+func (_u *PasswordUpdate) SetUserID(v string) *PasswordUpdate {
+	_u.mutation.SetUserID(v)
+	return _u
+}
+
+// SetNillableUserID sets the "user_id" field if the given value is not nil.
+func (_u *PasswordUpdate) SetNillableUserID(v *string) *PasswordUpdate {
+	if v != nil {
+		_u.SetUserID(*v)
+	}
+	return _u
+}
+
+// SetGroups sets the "groups" field.
+func (_u *PasswordUpdate) SetGroups(v []string) *PasswordUpdate {
+	_u.mutation.SetGroups(v)
+	return _u
+}
+
+// AppendGroups appends value to the "groups" field.
+func (_u *PasswordUpdate) AppendGroups(v []string) *PasswordUpdate {
+	_u.mutation.AppendGroups(v)
+	return _u
+}
+
+// ClearGroups clears the value of the "groups" field.
+func (_u *PasswordUpdate) ClearGroups() *PasswordUpdate {
+	_u.mutation.ClearGroups()
+	return _u
 }
 
 // Mutation returns the PasswordMutation object of the builder.
-func (pu *PasswordUpdate) Mutation() *PasswordMutation {
-	return pu.mutation
+func (_u *PasswordUpdate) Mutation() *PasswordMutation {
+	return _u.mutation
 }
 
 // Save executes the query and returns the number of nodes affected by the update operation.
-func (pu *PasswordUpdate) Save(ctx context.Context) (int, error) {
-	var (
-		err      error
-		affected int
-	)
-	if len(pu.hooks) == 0 {
-		if err = pu.check(); err != nil {
-			return 0, err
-		}
-		affected, err = pu.sqlSave(ctx)
-	} else {
-		var mut Mutator = MutateFunc(func(ctx context.Context, m Mutation) (Value, error) {
-			mutation, ok := m.(*PasswordMutation)
-			if !ok {
-				return nil, fmt.Errorf("unexpected mutation type %T", m)
-			}
-			if err = pu.check(); err != nil {
-				return 0, err
-			}
-			pu.mutation = mutation
-			affected, err = pu.sqlSave(ctx)
-			mutation.done = true
-			return affected, err
-		})
-		for i := len(pu.hooks) - 1; i >= 0; i-- {
-			if pu.hooks[i] == nil {
-				return 0, fmt.Errorf("db: uninitialized hook (forgotten import db/runtime?)")
-			}
-			mut = pu.hooks[i](mut)
-		}
-		if _, err := mut.Mutate(ctx, pu.mutation); err != nil {
-			return 0, err
-		}
-	}
-	return affected, err
+func (_u *PasswordUpdate) Save(ctx context.Context) (int, error) {
+	return withHooks(ctx, _u.sqlSave, _u.mutation, _u.hooks)
 }
 
 // SaveX is like Save, but panics if an error occurs.
-func (pu *PasswordUpdate) SaveX(ctx context.Context) int {
-	affected, err := pu.Save(ctx)
+func (_u *PasswordUpdate) SaveX(ctx context.Context) int {
+	affected, err := _u.Save(ctx)
 	if err != nil {
 		panic(err)
 	}
@@ -104,31 +162,31 @@ func (pu *PasswordUpdate) SaveX(ctx context.Context) int {
 }
 
 // Exec executes the query.
-func (pu *PasswordUpdate) Exec(ctx context.Context) error {
-	_, err := pu.Save(ctx)
+func (_u *PasswordUpdate) Exec(ctx context.Context) error {
+	_, err := _u.Save(ctx)
 	return err
 }
 
 // ExecX is like Exec, but panics if an error occurs.
-func (pu *PasswordUpdate) ExecX(ctx context.Context) {
-	if err := pu.Exec(ctx); err != nil {
+func (_u *PasswordUpdate) ExecX(ctx context.Context) {
+	if err := _u.Exec(ctx); err != nil {
 		panic(err)
 	}
 }
 
 // check runs all checks and user-defined validators on the builder.
-func (pu *PasswordUpdate) check() error {
-	if v, ok := pu.mutation.Email(); ok {
+func (_u *PasswordUpdate) check() error {
+	if v, ok := _u.mutation.Email(); ok {
 		if err := password.EmailValidator(v); err != nil {
 			return &ValidationError{Name: "email", err: fmt.Errorf(`db: validator failed for field "Password.email": %w`, err)}
 		}
 	}
-	if v, ok := pu.mutation.Username(); ok {
+	if v, ok := _u.mutation.Username(); ok {
 		if err := password.UsernameValidator(v); err != nil {
 			return &ValidationError{Name: "username", err: fmt.Errorf(`db: validator failed for field "Password.username": %w`, err)}
 		}
 	}
-	if v, ok := pu.mutation.UserID(); ok {
+	if v, ok := _u.mutation.UserID(); ok {
 		if err := password.UserIDValidator(v); err != nil {
 			return &ValidationError{Name: "user_id", err: fmt.Errorf(`db: validator failed for field "Password.user_id": %w`, err)}
 		}
@@ -136,53 +194,54 @@ func (pu *PasswordUpdate) check() error {
 	return nil
 }
 
-func (pu *PasswordUpdate) sqlSave(ctx context.Context) (n int, err error) {
-	_spec := &sqlgraph.UpdateSpec{
-		Node: &sqlgraph.NodeSpec{
-			Table:   password.Table,
-			Columns: password.Columns,
-			ID: &sqlgraph.FieldSpec{
-				Type:   field.TypeInt,
-				Column: password.FieldID,
-			},
-		},
+func (_u *PasswordUpdate) sqlSave(ctx context.Context) (_node int, err error) {
+	if err := _u.check(); err != nil {
+		return _node, err
 	}
-	if ps := pu.mutation.predicates; len(ps) > 0 {
+	_spec := sqlgraph.NewUpdateSpec(password.Table, password.Columns, sqlgraph.NewFieldSpec(password.FieldID, field.TypeInt))
+	if ps := _u.mutation.predicates; len(ps) > 0 {
 		_spec.Predicate = func(selector *sql.Selector) {
 			for i := range ps {
 				ps[i](selector)
 			}
 		}
 	}
-	if value, ok := pu.mutation.Email(); ok {
-		_spec.Fields.Set = append(_spec.Fields.Set, &sqlgraph.FieldSpec{
-			Type:   field.TypeString,
-			Value:  value,
-			Column: password.FieldEmail,
-		})
+	if value, ok := _u.mutation.Email(); ok {
+		_spec.SetField(password.FieldEmail, field.TypeString, value)
 	}
-	if value, ok := pu.mutation.Hash(); ok {
-		_spec.Fields.Set = append(_spec.Fields.Set, &sqlgraph.FieldSpec{
-			Type:   field.TypeBytes,
-			Value:  value,
-			Column: password.FieldHash,
-		})
+	if value, ok := _u.mutation.Hash(); ok {
+		_spec.SetField(password.FieldHash, field.TypeBytes, value)
 	}
-	if value, ok := pu.mutation.Username(); ok {
-		_spec.Fields.Set = append(_spec.Fields.Set, &sqlgraph.FieldSpec{
-			Type:   field.TypeString,
-			Value:  value,
-			Column: password.FieldUsername,
-		})
+	if value, ok := _u.mutation.Username(); ok {
+		_spec.SetField(password.FieldUsername, field.TypeString, value)
+	}
+	if value, ok := _u.mutation.Name(); ok {
+		_spec.SetField(password.FieldName, field.TypeString, value)
+	}
+	if value, ok := _u.mutation.PreferredUsername(); ok {
+		_spec.SetField(password.FieldPreferredUsername, field.TypeString, value)
+	}
+	if value, ok := _u.mutation.EmailVerified(); ok {
+		_spec.SetField(password.FieldEmailVerified, field.TypeBool, value)
+	}
+	if _u.mutation.EmailVerifiedCleared() {
+		_spec.ClearField(password.FieldEmailVerified, field.TypeBool)
 	}
-	if value, ok := pu.mutation.UserID(); ok {
-		_spec.Fields.Set = append(_spec.Fields.Set, &sqlgraph.FieldSpec{
-			Type:   field.TypeString,
-			Value:  value,
-			Column: password.FieldUserID,
+	if value, ok := _u.mutation.UserID(); ok {
+		_spec.SetField(password.FieldUserID, field.TypeString, value)
+	}
+	if value, ok := _u.mutation.Groups(); ok {
+		_spec.SetField(password.FieldGroups, field.TypeJSON, value)
+	}
+	if value, ok := _u.mutation.AppendedGroups(); ok {
+		_spec.AddModifier(func(u *sql.UpdateBuilder) {
+			sqljson.Append(u, password.FieldGroups, value)
 		})
 	}
-	if n, err = sqlgraph.UpdateNodes(ctx, pu.driver, _spec); err != nil {
+	if _u.mutation.GroupsCleared() {
+		_spec.ClearField(password.FieldGroups, field.TypeJSON)
+	}
+	if _node, err = sqlgraph.UpdateNodes(ctx, _u.driver, _spec); err != nil {
 		if _, ok := err.(*sqlgraph.NotFoundError); ok {
 			err = &NotFoundError{password.Label}
 		} else if sqlgraph.IsConstraintError(err) {
@@ -190,7 +249,8 @@ func (pu *PasswordUpdate) sqlSave(ctx context.Context) (n int, err error) {
 		}
 		return 0, err
 	}
-	return n, nil
+	_u.mutation.done = true
+	return _node, nil
 }
 
 // PasswordUpdateOne is the builder for updating a single Password entity.
@@ -202,88 +262,145 @@ type PasswordUpdateOne struct {
 }
 
 // SetEmail sets the "email" field.
-func (puo *PasswordUpdateOne) SetEmail(s string) *PasswordUpdateOne {
-	puo.mutation.SetEmail(s)
-	return puo
+func (_u *PasswordUpdateOne) SetEmail(v string) *PasswordUpdateOne {
+	_u.mutation.SetEmail(v)
+	return _u
+}
+
+// SetNillableEmail sets the "email" field if the given value is not nil.
+func (_u *PasswordUpdateOne) SetNillableEmail(v *string) *PasswordUpdateOne {
+	if v != nil {
+		_u.SetEmail(*v)
+	}
+	return _u
 }
 
 // SetHash sets the "hash" field.
-func (puo *PasswordUpdateOne) SetHash(b []byte) *PasswordUpdateOne {
-	puo.mutation.SetHash(b)
-	return puo
+func (_u *PasswordUpdateOne) SetHash(v []byte) *PasswordUpdateOne {
+	_u.mutation.SetHash(v)
+	return _u
 }
 
 // SetUsername sets the "username" field.
-func (puo *PasswordUpdateOne) SetUsername(s string) *PasswordUpdateOne {
-	puo.mutation.SetUsername(s)
-	return puo
+func (_u *PasswordUpdateOne) SetUsername(v string) *PasswordUpdateOne {
+	_u.mutation.SetUsername(v)
+	return _u
+}
+
+// SetNillableUsername sets the "username" field if the given value is not nil.
+func (_u *PasswordUpdateOne) SetNillableUsername(v *string) *PasswordUpdateOne {
+	if v != nil {
+		_u.SetUsername(*v)
+	}
+	return _u
+}
+
+// SetName sets the "name" field.
+func (_u *PasswordUpdateOne) SetName(v string) *PasswordUpdateOne {
+	_u.mutation.SetName(v)
+	return _u
+}
+
+// SetNillableName sets the "name" field if the given value is not nil.
+func (_u *PasswordUpdateOne) SetNillableName(v *string) *PasswordUpdateOne {
+	if v != nil {
+		_u.SetName(*v)
+	}
+	return _u
+}
+
+// SetPreferredUsername sets the "preferred_username" field.
+func (_u *PasswordUpdateOne) SetPreferredUsername(v string) *PasswordUpdateOne {
+	_u.mutation.SetPreferredUsername(v)
+	return _u
+}
+
+// SetNillablePreferredUsername sets the "preferred_username" field if the given value is not nil.
+func (_u *PasswordUpdateOne) SetNillablePreferredUsername(v *string) *PasswordUpdateOne {
+	if v != nil {
+		_u.SetPreferredUsername(*v)
+	}
+	return _u
+}
+
+// SetEmailVerified sets the "email_verified" field.
+func (_u *PasswordUpdateOne) SetEmailVerified(v bool) *PasswordUpdateOne {
+	_u.mutation.SetEmailVerified(v)
+	return _u
+}
+
+// SetNillableEmailVerified sets the "email_verified" field if the given value is not nil.
+func (_u *PasswordUpdateOne) SetNillableEmailVerified(v *bool) *PasswordUpdateOne {
+	if v != nil {
+		_u.SetEmailVerified(*v)
+	}
+	return _u
+}
+
+// ClearEmailVerified clears the value of the "email_verified" field.
+func (_u *PasswordUpdateOne) ClearEmailVerified() *PasswordUpdateOne {
+	_u.mutation.ClearEmailVerified()
+	return _u
 }
 
 // SetUserID sets the "user_id" field.
-func (puo *PasswordUpdateOne) SetUserID(s string) *PasswordUpdateOne {
-	puo.mutation.SetUserID(s)
-	return puo
+func (_u *PasswordUpdateOne) SetUserID(v string) *PasswordUpdateOne {
+	_u.mutation.SetUserID(v)
+	return _u
+}
+
+// SetNillableUserID sets the "user_id" field if the given value is not nil.
+func (_u *PasswordUpdateOne) SetNillableUserID(v *string) *PasswordUpdateOne {
+	if v != nil {
+		_u.SetUserID(*v)
+	}
+	return _u
+}
+
+// SetGroups sets the "groups" field.
+func (_u *PasswordUpdateOne) SetGroups(v []string) *PasswordUpdateOne {
+	_u.mutation.SetGroups(v)
+	return _u
+}
+
+// AppendGroups appends value to the "groups" field.
+func (_u *PasswordUpdateOne) AppendGroups(v []string) *PasswordUpdateOne {
+	_u.mutation.AppendGroups(v)
+	return _u
+}
+
+// ClearGroups clears the value of the "groups" field.
+func (_u *PasswordUpdateOne) ClearGroups() *PasswordUpdateOne {
+	_u.mutation.ClearGroups()
+	return _u
 }
 
 // Mutation returns the PasswordMutation object of the builder.
-func (puo *PasswordUpdateOne) Mutation() *PasswordMutation {
-	return puo.mutation
+func (_u *PasswordUpdateOne) Mutation() *PasswordMutation {
+	return _u.mutation
+}
+
+// Where appends a list predicates to the PasswordUpdate builder.
+func (_u *PasswordUpdateOne) Where(ps ...predicate.Password) *PasswordUpdateOne {
+	_u.mutation.Where(ps...)
+	return _u
 }
 
 // Select allows selecting one or more fields (columns) of the returned entity.
 // The default is selecting all fields defined in the entity schema.
-func (puo *PasswordUpdateOne) Select(field string, fields ...string) *PasswordUpdateOne {
-	puo.fields = append([]string{field}, fields...)
-	return puo
+func (_u *PasswordUpdateOne) Select(field string, fields ...string) *PasswordUpdateOne {
+	_u.fields = append([]string{field}, fields...)
+	return _u
 }
 
 // Save executes the query and returns the updated Password entity.
-func (puo *PasswordUpdateOne) Save(ctx context.Context) (*Password, error) {
-	var (
-		err  error
-		node *Password
-	)
-	if len(puo.hooks) == 0 {
-		if err = puo.check(); err != nil {
-			return nil, err
-		}
-		node, err = puo.sqlSave(ctx)
-	} else {
-		var mut Mutator = MutateFunc(func(ctx context.Context, m Mutation) (Value, error) {
-			mutation, ok := m.(*PasswordMutation)
-			if !ok {
-				return nil, fmt.Errorf("unexpected mutation type %T", m)
-			}
-			if err = puo.check(); err != nil {
-				return nil, err
-			}
-			puo.mutation = mutation
-			node, err = puo.sqlSave(ctx)
-			mutation.done = true
-			return node, err
-		})
-		for i := len(puo.hooks) - 1; i >= 0; i-- {
-			if puo.hooks[i] == nil {
-				return nil, fmt.Errorf("db: uninitialized hook (forgotten import db/runtime?)")
-			}
-			mut = puo.hooks[i](mut)
-		}
-		v, err := mut.Mutate(ctx, puo.mutation)
-		if err != nil {
-			return nil, err
-		}
-		nv, ok := v.(*Password)
-		if !ok {
-			return nil, fmt.Errorf("unexpected node type %T returned from PasswordMutation", v)
-		}
-		node = nv
-	}
-	return node, err
+func (_u *PasswordUpdateOne) Save(ctx context.Context) (*Password, error) {
+	return withHooks(ctx, _u.sqlSave, _u.mutation, _u.hooks)
 }
 
 // SaveX is like Save, but panics if an error occurs.
-func (puo *PasswordUpdateOne) SaveX(ctx context.Context) *Password {
-	node, err := puo.Save(ctx)
+func (_u *PasswordUpdateOne) SaveX(ctx context.Context) *Password {
+	node, err := _u.Save(ctx)
 	if err != nil {
 		panic(err)
 	}
@@ -291,31 +408,31 @@ func (puo *PasswordUpdateOne) SaveX(ctx context.Context) *Password {
 }
 
 // Exec executes the query on the entity.
-func (puo *PasswordUpdateOne) Exec(ctx context.Context) error {
-	_, err := puo.Save(ctx)
+func (_u *PasswordUpdateOne) Exec(ctx context.Context) error {
+	_, err := _u.Save(ctx)
 	return err
 }
 
 // ExecX is like Exec, but panics if an error occurs.
-func (puo *PasswordUpdateOne) ExecX(ctx context.Context) {
-	if err := puo.Exec(ctx); err != nil {
+func (_u *PasswordUpdateOne) ExecX(ctx context.Context) {
+	if err := _u.Exec(ctx); err != nil {
 		panic(err)
 	}
 }
 
 // check runs all checks and user-defined validators on the builder.
-func (puo *PasswordUpdateOne) check() error {
-	if v, ok := puo.mutation.Email(); ok {
+func (_u *PasswordUpdateOne) check() error {
+	if v, ok := _u.mutation.Email(); ok {
 		if err := password.EmailValidator(v); err != nil {
 			return &ValidationError{Name: "email", err: fmt.Errorf(`db: validator failed for field "Password.email": %w`, err)}
 		}
 	}
-	if v, ok := puo.mutation.Username(); ok {
+	if v, ok := _u.mutation.Username(); ok {
 		if err := password.UsernameValidator(v); err != nil {
 			return &ValidationError{Name: "username", err: fmt.Errorf(`db: validator failed for field "Password.username": %w`, err)}
 		}
 	}
-	if v, ok := puo.mutation.UserID(); ok {
+	if v, ok := _u.mutation.UserID(); ok {
 		if err := password.UserIDValidator(v); err != nil {
 			return &ValidationError{Name: "user_id", err: fmt.Errorf(`db: validator failed for field "Password.user_id": %w`, err)}
 		}
@@ -323,23 +440,17 @@ func (puo *PasswordUpdateOne) check() error {
 	return nil
 }
 
-func (puo *PasswordUpdateOne) sqlSave(ctx context.Context) (_node *Password, err error) {
-	_spec := &sqlgraph.UpdateSpec{
-		Node: &sqlgraph.NodeSpec{
-			Table:   password.Table,
-			Columns: password.Columns,
-			ID: &sqlgraph.FieldSpec{
-				Type:   field.TypeInt,
-				Column: password.FieldID,
-			},
-		},
+func (_u *PasswordUpdateOne) sqlSave(ctx context.Context) (_node *Password, err error) {
+	if err := _u.check(); err != nil {
+		return _node, err
 	}
-	id, ok := puo.mutation.ID()
+	_spec := sqlgraph.NewUpdateSpec(password.Table, password.Columns, sqlgraph.NewFieldSpec(password.FieldID, field.TypeInt))
+	id, ok := _u.mutation.ID()
 	if !ok {
 		return nil, &ValidationError{Name: "id", err: errors.New(`db: missing "Password.id" for update`)}
 	}
 	_spec.Node.ID.Value = id
-	if fields := puo.fields; len(fields) > 0 {
+	if fields := _u.fields; len(fields) > 0 {
 		_spec.Node.Columns = make([]string, 0, len(fields))
 		_spec.Node.Columns = append(_spec.Node.Columns, password.FieldID)
 		for _, f := range fields {
@@ -351,45 +462,52 @@ func (puo *PasswordUpdateOne) sqlSave(ctx context.Context) (_node *Password, err
 			}
 		}
 	}
-	if ps := puo.mutation.predicates; len(ps) > 0 {
+	if ps := _u.mutation.predicates; len(ps) > 0 {
 		_spec.Predicate = func(selector *sql.Selector) {
 			for i := range ps {
 				ps[i](selector)
 			}
 		}
 	}
-	if value, ok := puo.mutation.Email(); ok {
-		_spec.Fields.Set = append(_spec.Fields.Set, &sqlgraph.FieldSpec{
-			Type:   field.TypeString,
-			Value:  value,
-			Column: password.FieldEmail,
-		})
+	if value, ok := _u.mutation.Email(); ok {
+		_spec.SetField(password.FieldEmail, field.TypeString, value)
 	}
-	if value, ok := puo.mutation.Hash(); ok {
-		_spec.Fields.Set = append(_spec.Fields.Set, &sqlgraph.FieldSpec{
-			Type:   field.TypeBytes,
-			Value:  value,
-			Column: password.FieldHash,
-		})
+	if value, ok := _u.mutation.Hash(); ok {
+		_spec.SetField(password.FieldHash, field.TypeBytes, value)
 	}
-	if value, ok := puo.mutation.Username(); ok {
-		_spec.Fields.Set = append(_spec.Fields.Set, &sqlgraph.FieldSpec{
-			Type:   field.TypeString,
-			Value:  value,
-			Column: password.FieldUsername,
-		})
+	if value, ok := _u.mutation.Username(); ok {
+		_spec.SetField(password.FieldUsername, field.TypeString, value)
+	}
+	if value, ok := _u.mutation.Name(); ok {
+		_spec.SetField(password.FieldName, field.TypeString, value)
 	}
-	if value, ok := puo.mutation.UserID(); ok {
-		_spec.Fields.Set = append(_spec.Fields.Set, &sqlgraph.FieldSpec{
-			Type:   field.TypeString,
-			Value:  value,
-			Column: password.FieldUserID,
+	if value, ok := _u.mutation.PreferredUsername(); ok {
+		_spec.SetField(password.FieldPreferredUsername, field.TypeString, value)
+	}
+	if value, ok := _u.mutation.EmailVerified(); ok {
+		_spec.SetField(password.FieldEmailVerified, field.TypeBool, value)
+	}
+	if _u.mutation.EmailVerifiedCleared() {
+		_spec.ClearField(password.FieldEmailVerified, field.TypeBool)
+	}
+	if value, ok := _u.mutation.UserID(); ok {
+		_spec.SetField(password.FieldUserID, field.TypeString, value)
+	}
+	if value, ok := _u.mutation.Groups(); ok {
+		_spec.SetField(password.FieldGroups, field.TypeJSON, value)
+	}
+	if value, ok := _u.mutation.AppendedGroups(); ok {
+		_spec.AddModifier(func(u *sql.UpdateBuilder) {
+			sqljson.Append(u, password.FieldGroups, value)
 		})
 	}
-	_node = &Password{config: puo.config}
+	if _u.mutation.GroupsCleared() {
+		_spec.ClearField(password.FieldGroups, field.TypeJSON)
+	}
+	_node = &Password{config: _u.config}
 	_spec.Assign = _node.assignValues
 	_spec.ScanValues = _node.scanValues
-	if err = sqlgraph.UpdateNode(ctx, puo.driver, _spec); err != nil {
+	if err = sqlgraph.UpdateNode(ctx, _u.driver, _spec); err != nil {
 		if _, ok := err.(*sqlgraph.NotFoundError); ok {
 			err = &NotFoundError{password.Label}
 		} else if sqlgraph.IsConstraintError(err) {
@@ -397,5 +515,6 @@ func (puo *PasswordUpdateOne) sqlSave(ctx context.Context) (_node *Password, err
 		}
 		return nil, err
 	}
+	_u.mutation.done = true
 	return _node, nil
 }
diff --git a/storage/ent/db/predicate/predicate.go b/storage/ent/db/predicate/predicate.go
index ed07a0719c..9e977a2af1 100644
--- a/storage/ent/db/predicate/predicate.go
+++ b/storage/ent/db/predicate/predicate.go
@@ -12,6 +12,9 @@ type AuthCode func(*sql.Selector)
 // AuthRequest is the predicate function for authrequest builders.
 type AuthRequest func(*sql.Selector)
 
+// AuthSession is the predicate function for authsession builders.
+type AuthSession func(*sql.Selector)
+
 // Connector is the predicate function for connector builders.
 type Connector func(*sql.Selector)
 
@@ -35,3 +38,6 @@ type Password func(*sql.Selector)
 
 // RefreshToken is the predicate function for refreshtoken builders.
 type RefreshToken func(*sql.Selector)
+
+// UserIdentity is the predicate function for useridentity builders.
+type UserIdentity func(*sql.Selector)
diff --git a/storage/ent/db/refreshtoken.go b/storage/ent/db/refreshtoken.go
index b5c75bb101..12f5910a7a 100644
--- a/storage/ent/db/refreshtoken.go
+++ b/storage/ent/db/refreshtoken.go
@@ -8,6 +8,7 @@ import (
 	"strings"
 	"time"
 
+	"entgo.io/ent"
 	"entgo.io/ent/dialect/sql"
 	"github.com/dexidp/dex/storage/ent/db/refreshtoken"
 )
@@ -46,12 +47,13 @@ type RefreshToken struct {
 	// CreatedAt holds the value of the "created_at" field.
 	CreatedAt time.Time `json:"created_at,omitempty"`
 	// LastUsed holds the value of the "last_used" field.
-	LastUsed time.Time `json:"last_used,omitempty"`
+	LastUsed     time.Time `json:"last_used,omitempty"`
+	selectValues sql.SelectValues
 }
 
 // scanValues returns the types for scanning values from sql.Rows.
-func (*RefreshToken) scanValues(columns []string) ([]interface{}, error) {
-	values := make([]interface{}, len(columns))
+func (*RefreshToken) scanValues(columns []string) ([]any, error) {
+	values := make([]any, len(columns))
 	for i := range columns {
 		switch columns[i] {
 		case refreshtoken.FieldScopes, refreshtoken.FieldClaimsGroups, refreshtoken.FieldConnectorData:
@@ -63,7 +65,7 @@ func (*RefreshToken) scanValues(columns []string) ([]interface{}, error) {
 		case refreshtoken.FieldCreatedAt, refreshtoken.FieldLastUsed:
 			values[i] = new(sql.NullTime)
 		default:
-			return nil, fmt.Errorf("unexpected column %q for type RefreshToken", columns[i])
+			values[i] = new(sql.UnknownType)
 		}
 	}
 	return values, nil
@@ -71,7 +73,7 @@ func (*RefreshToken) scanValues(columns []string) ([]interface{}, error) {
 
 // assignValues assigns the values that were returned from sql.Rows (after scanning)
 // to the RefreshToken fields.
-func (rt *RefreshToken) assignValues(columns []string, values []interface{}) error {
+func (_m *RefreshToken) assignValues(columns []string, values []any) error {
 	if m, n := len(values), len(columns); m < n {
 		return fmt.Errorf("mismatch number of scan values: %d != %d", m, n)
 	}
@@ -81,19 +83,19 @@ func (rt *RefreshToken) assignValues(columns []string, values []interface{}) err
 			if value, ok := values[i].(*sql.NullString); !ok {
 				return fmt.Errorf("unexpected type %T for field id", values[i])
 			} else if value.Valid {
-				rt.ID = value.String
+				_m.ID = value.String
 			}
 		case refreshtoken.FieldClientID:
 			if value, ok := values[i].(*sql.NullString); !ok {
 				return fmt.Errorf("unexpected type %T for field client_id", values[i])
 			} else if value.Valid {
-				rt.ClientID = value.String
+				_m.ClientID = value.String
 			}
 		case refreshtoken.FieldScopes:
 			if value, ok := values[i].(*[]byte); !ok {
 				return fmt.Errorf("unexpected type %T for field scopes", values[i])
 			} else if value != nil && len(*value) > 0 {
-				if err := json.Unmarshal(*value, &rt.Scopes); err != nil {
+				if err := json.Unmarshal(*value, &_m.Scopes); err != nil {
 					return fmt.Errorf("unmarshal field scopes: %w", err)
 				}
 			}
@@ -101,37 +103,37 @@ func (rt *RefreshToken) assignValues(columns []string, values []interface{}) err
 			if value, ok := values[i].(*sql.NullString); !ok {
 				return fmt.Errorf("unexpected type %T for field nonce", values[i])
 			} else if value.Valid {
-				rt.Nonce = value.String
+				_m.Nonce = value.String
 			}
 		case refreshtoken.FieldClaimsUserID:
 			if value, ok := values[i].(*sql.NullString); !ok {
 				return fmt.Errorf("unexpected type %T for field claims_user_id", values[i])
 			} else if value.Valid {
-				rt.ClaimsUserID = value.String
+				_m.ClaimsUserID = value.String
 			}
 		case refreshtoken.FieldClaimsUsername:
 			if value, ok := values[i].(*sql.NullString); !ok {
 				return fmt.Errorf("unexpected type %T for field claims_username", values[i])
 			} else if value.Valid {
-				rt.ClaimsUsername = value.String
+				_m.ClaimsUsername = value.String
 			}
 		case refreshtoken.FieldClaimsEmail:
 			if value, ok := values[i].(*sql.NullString); !ok {
 				return fmt.Errorf("unexpected type %T for field claims_email", values[i])
 			} else if value.Valid {
-				rt.ClaimsEmail = value.String
+				_m.ClaimsEmail = value.String
 			}
 		case refreshtoken.FieldClaimsEmailVerified:
 			if value, ok := values[i].(*sql.NullBool); !ok {
 				return fmt.Errorf("unexpected type %T for field claims_email_verified", values[i])
 			} else if value.Valid {
-				rt.ClaimsEmailVerified = value.Bool
+				_m.ClaimsEmailVerified = value.Bool
 			}
 		case refreshtoken.FieldClaimsGroups:
 			if value, ok := values[i].(*[]byte); !ok {
 				return fmt.Errorf("unexpected type %T for field claims_groups", values[i])
 			} else if value != nil && len(*value) > 0 {
-				if err := json.Unmarshal(*value, &rt.ClaimsGroups); err != nil {
+				if err := json.Unmarshal(*value, &_m.ClaimsGroups); err != nil {
 					return fmt.Errorf("unmarshal field claims_groups: %w", err)
 				}
 			}
@@ -139,127 +141,129 @@ func (rt *RefreshToken) assignValues(columns []string, values []interface{}) err
 			if value, ok := values[i].(*sql.NullString); !ok {
 				return fmt.Errorf("unexpected type %T for field claims_preferred_username", values[i])
 			} else if value.Valid {
-				rt.ClaimsPreferredUsername = value.String
+				_m.ClaimsPreferredUsername = value.String
 			}
 		case refreshtoken.FieldConnectorID:
 			if value, ok := values[i].(*sql.NullString); !ok {
 				return fmt.Errorf("unexpected type %T for field connector_id", values[i])
 			} else if value.Valid {
-				rt.ConnectorID = value.String
+				_m.ConnectorID = value.String
 			}
 		case refreshtoken.FieldConnectorData:
 			if value, ok := values[i].(*[]byte); !ok {
 				return fmt.Errorf("unexpected type %T for field connector_data", values[i])
 			} else if value != nil {
-				rt.ConnectorData = value
+				_m.ConnectorData = value
 			}
 		case refreshtoken.FieldToken:
 			if value, ok := values[i].(*sql.NullString); !ok {
 				return fmt.Errorf("unexpected type %T for field token", values[i])
 			} else if value.Valid {
-				rt.Token = value.String
+				_m.Token = value.String
 			}
 		case refreshtoken.FieldObsoleteToken:
 			if value, ok := values[i].(*sql.NullString); !ok {
 				return fmt.Errorf("unexpected type %T for field obsolete_token", values[i])
 			} else if value.Valid {
-				rt.ObsoleteToken = value.String
+				_m.ObsoleteToken = value.String
 			}
 		case refreshtoken.FieldCreatedAt:
 			if value, ok := values[i].(*sql.NullTime); !ok {
 				return fmt.Errorf("unexpected type %T for field created_at", values[i])
 			} else if value.Valid {
-				rt.CreatedAt = value.Time
+				_m.CreatedAt = value.Time
 			}
 		case refreshtoken.FieldLastUsed:
 			if value, ok := values[i].(*sql.NullTime); !ok {
 				return fmt.Errorf("unexpected type %T for field last_used", values[i])
 			} else if value.Valid {
-				rt.LastUsed = value.Time
+				_m.LastUsed = value.Time
 			}
+		default:
+			_m.selectValues.Set(columns[i], values[i])
 		}
 	}
 	return nil
 }
 
+// Value returns the ent.Value that was dynamically selected and assigned to the RefreshToken.
+// This includes values selected through modifiers, order, etc.
+func (_m *RefreshToken) Value(name string) (ent.Value, error) {
+	return _m.selectValues.Get(name)
+}
+
 // Update returns a builder for updating this RefreshToken.
 // Note that you need to call RefreshToken.Unwrap() before calling this method if this RefreshToken
 // was returned from a transaction, and the transaction was committed or rolled back.
-func (rt *RefreshToken) Update() *RefreshTokenUpdateOne {
-	return (&RefreshTokenClient{config: rt.config}).UpdateOne(rt)
+func (_m *RefreshToken) Update() *RefreshTokenUpdateOne {
+	return NewRefreshTokenClient(_m.config).UpdateOne(_m)
 }
 
 // Unwrap unwraps the RefreshToken entity that was returned from a transaction after it was closed,
 // so that all future queries will be executed through the driver which created the transaction.
-func (rt *RefreshToken) Unwrap() *RefreshToken {
-	_tx, ok := rt.config.driver.(*txDriver)
+func (_m *RefreshToken) Unwrap() *RefreshToken {
+	_tx, ok := _m.config.driver.(*txDriver)
 	if !ok {
 		panic("db: RefreshToken is not a transactional entity")
 	}
-	rt.config.driver = _tx.drv
-	return rt
+	_m.config.driver = _tx.drv
+	return _m
 }
 
 // String implements the fmt.Stringer.
-func (rt *RefreshToken) String() string {
+func (_m *RefreshToken) String() string {
 	var builder strings.Builder
 	builder.WriteString("RefreshToken(")
-	builder.WriteString(fmt.Sprintf("id=%v, ", rt.ID))
+	builder.WriteString(fmt.Sprintf("id=%v, ", _m.ID))
 	builder.WriteString("client_id=")
-	builder.WriteString(rt.ClientID)
+	builder.WriteString(_m.ClientID)
 	builder.WriteString(", ")
 	builder.WriteString("scopes=")
-	builder.WriteString(fmt.Sprintf("%v", rt.Scopes))
+	builder.WriteString(fmt.Sprintf("%v", _m.Scopes))
 	builder.WriteString(", ")
 	builder.WriteString("nonce=")
-	builder.WriteString(rt.Nonce)
+	builder.WriteString(_m.Nonce)
 	builder.WriteString(", ")
 	builder.WriteString("claims_user_id=")
-	builder.WriteString(rt.ClaimsUserID)
+	builder.WriteString(_m.ClaimsUserID)
 	builder.WriteString(", ")
 	builder.WriteString("claims_username=")
-	builder.WriteString(rt.ClaimsUsername)
+	builder.WriteString(_m.ClaimsUsername)
 	builder.WriteString(", ")
 	builder.WriteString("claims_email=")
-	builder.WriteString(rt.ClaimsEmail)
+	builder.WriteString(_m.ClaimsEmail)
 	builder.WriteString(", ")
 	builder.WriteString("claims_email_verified=")
-	builder.WriteString(fmt.Sprintf("%v", rt.ClaimsEmailVerified))
+	builder.WriteString(fmt.Sprintf("%v", _m.ClaimsEmailVerified))
 	builder.WriteString(", ")
 	builder.WriteString("claims_groups=")
-	builder.WriteString(fmt.Sprintf("%v", rt.ClaimsGroups))
+	builder.WriteString(fmt.Sprintf("%v", _m.ClaimsGroups))
 	builder.WriteString(", ")
 	builder.WriteString("claims_preferred_username=")
-	builder.WriteString(rt.ClaimsPreferredUsername)
+	builder.WriteString(_m.ClaimsPreferredUsername)
 	builder.WriteString(", ")
 	builder.WriteString("connector_id=")
-	builder.WriteString(rt.ConnectorID)
+	builder.WriteString(_m.ConnectorID)
 	builder.WriteString(", ")
-	if v := rt.ConnectorData; v != nil {
+	if v := _m.ConnectorData; v != nil {
 		builder.WriteString("connector_data=")
 		builder.WriteString(fmt.Sprintf("%v", *v))
 	}
 	builder.WriteString(", ")
 	builder.WriteString("token=")
-	builder.WriteString(rt.Token)
+	builder.WriteString(_m.Token)
 	builder.WriteString(", ")
 	builder.WriteString("obsolete_token=")
-	builder.WriteString(rt.ObsoleteToken)
+	builder.WriteString(_m.ObsoleteToken)
 	builder.WriteString(", ")
 	builder.WriteString("created_at=")
-	builder.WriteString(rt.CreatedAt.Format(time.ANSIC))
+	builder.WriteString(_m.CreatedAt.Format(time.ANSIC))
 	builder.WriteString(", ")
 	builder.WriteString("last_used=")
-	builder.WriteString(rt.LastUsed.Format(time.ANSIC))
+	builder.WriteString(_m.LastUsed.Format(time.ANSIC))
 	builder.WriteByte(')')
 	return builder.String()
 }
 
 // RefreshTokens is a parsable slice of RefreshToken.
 type RefreshTokens []*RefreshToken
-
-func (rt RefreshTokens) config(cfg config) {
-	for _i := range rt {
-		rt[_i].config = cfg
-	}
-}
diff --git a/storage/ent/db/refreshtoken/refreshtoken.go b/storage/ent/db/refreshtoken/refreshtoken.go
index d11d84075a..1163113d6b 100644
--- a/storage/ent/db/refreshtoken/refreshtoken.go
+++ b/storage/ent/db/refreshtoken/refreshtoken.go
@@ -4,6 +4,8 @@ package refreshtoken
 
 import (
 	"time"
+
+	"entgo.io/ent/dialect/sql"
 )
 
 const (
@@ -101,3 +103,71 @@ var (
 	// IDValidator is a validator for the "id" field. It is called by the builders before save.
 	IDValidator func(string) error
 )
+
+// OrderOption defines the ordering options for the RefreshToken queries.
+type OrderOption func(*sql.Selector)
+
+// ByID orders the results by the id field.
+func ByID(opts ...sql.OrderTermOption) OrderOption {
+	return sql.OrderByField(FieldID, opts...).ToFunc()
+}
+
+// ByClientID orders the results by the client_id field.
+func ByClientID(opts ...sql.OrderTermOption) OrderOption {
+	return sql.OrderByField(FieldClientID, opts...).ToFunc()
+}
+
+// ByNonce orders the results by the nonce field.
+func ByNonce(opts ...sql.OrderTermOption) OrderOption {
+	return sql.OrderByField(FieldNonce, opts...).ToFunc()
+}
+
+// ByClaimsUserID orders the results by the claims_user_id field.
+func ByClaimsUserID(opts ...sql.OrderTermOption) OrderOption {
+	return sql.OrderByField(FieldClaimsUserID, opts...).ToFunc()
+}
+
+// ByClaimsUsername orders the results by the claims_username field.
+func ByClaimsUsername(opts ...sql.OrderTermOption) OrderOption {
+	return sql.OrderByField(FieldClaimsUsername, opts...).ToFunc()
+}
+
+// ByClaimsEmail orders the results by the claims_email field.
+func ByClaimsEmail(opts ...sql.OrderTermOption) OrderOption {
+	return sql.OrderByField(FieldClaimsEmail, opts...).ToFunc()
+}
+
+// ByClaimsEmailVerified orders the results by the claims_email_verified field.
+func ByClaimsEmailVerified(opts ...sql.OrderTermOption) OrderOption {
+	return sql.OrderByField(FieldClaimsEmailVerified, opts...).ToFunc()
+}
+
+// ByClaimsPreferredUsername orders the results by the claims_preferred_username field.
+func ByClaimsPreferredUsername(opts ...sql.OrderTermOption) OrderOption {
+	return sql.OrderByField(FieldClaimsPreferredUsername, opts...).ToFunc()
+}
+
+// ByConnectorID orders the results by the connector_id field.
+func ByConnectorID(opts ...sql.OrderTermOption) OrderOption {
+	return sql.OrderByField(FieldConnectorID, opts...).ToFunc()
+}
+
+// ByToken orders the results by the token field.
+func ByToken(opts ...sql.OrderTermOption) OrderOption {
+	return sql.OrderByField(FieldToken, opts...).ToFunc()
+}
+
+// ByObsoleteToken orders the results by the obsolete_token field.
+func ByObsoleteToken(opts ...sql.OrderTermOption) OrderOption {
+	return sql.OrderByField(FieldObsoleteToken, opts...).ToFunc()
+}
+
+// ByCreatedAt orders the results by the created_at field.
+func ByCreatedAt(opts ...sql.OrderTermOption) OrderOption {
+	return sql.OrderByField(FieldCreatedAt, opts...).ToFunc()
+}
+
+// ByLastUsed orders the results by the last_used field.
+func ByLastUsed(opts ...sql.OrderTermOption) OrderOption {
+	return sql.OrderByField(FieldLastUsed, opts...).ToFunc()
+}
diff --git a/storage/ent/db/refreshtoken/where.go b/storage/ent/db/refreshtoken/where.go
index e6abf9824b..9fece40fcc 100644
--- a/storage/ent/db/refreshtoken/where.go
+++ b/storage/ent/db/refreshtoken/where.go
@@ -11,1333 +11,880 @@ import (
 
 // ID filters vertices based on their ID field.
 func ID(id string) predicate.RefreshToken {
-	return predicate.RefreshToken(func(s *sql.Selector) {
-		s.Where(sql.EQ(s.C(FieldID), id))
-	})
+	return predicate.RefreshToken(sql.FieldEQ(FieldID, id))
 }
 
 // IDEQ applies the EQ predicate on the ID field.
 func IDEQ(id string) predicate.RefreshToken {
-	return predicate.RefreshToken(func(s *sql.Selector) {
-		s.Where(sql.EQ(s.C(FieldID), id))
-	})
+	return predicate.RefreshToken(sql.FieldEQ(FieldID, id))
 }
 
 // IDNEQ applies the NEQ predicate on the ID field.
 func IDNEQ(id string) predicate.RefreshToken {
-	return predicate.RefreshToken(func(s *sql.Selector) {
-		s.Where(sql.NEQ(s.C(FieldID), id))
-	})
+	return predicate.RefreshToken(sql.FieldNEQ(FieldID, id))
 }
 
 // IDIn applies the In predicate on the ID field.
 func IDIn(ids ...string) predicate.RefreshToken {
-	return predicate.RefreshToken(func(s *sql.Selector) {
-		v := make([]interface{}, len(ids))
-		for i := range v {
-			v[i] = ids[i]
-		}
-		s.Where(sql.In(s.C(FieldID), v...))
-	})
+	return predicate.RefreshToken(sql.FieldIn(FieldID, ids...))
 }
 
 // IDNotIn applies the NotIn predicate on the ID field.
 func IDNotIn(ids ...string) predicate.RefreshToken {
-	return predicate.RefreshToken(func(s *sql.Selector) {
-		v := make([]interface{}, len(ids))
-		for i := range v {
-			v[i] = ids[i]
-		}
-		s.Where(sql.NotIn(s.C(FieldID), v...))
-	})
+	return predicate.RefreshToken(sql.FieldNotIn(FieldID, ids...))
 }
 
 // IDGT applies the GT predicate on the ID field.
 func IDGT(id string) predicate.RefreshToken {
-	return predicate.RefreshToken(func(s *sql.Selector) {
-		s.Where(sql.GT(s.C(FieldID), id))
-	})
+	return predicate.RefreshToken(sql.FieldGT(FieldID, id))
 }
 
 // IDGTE applies the GTE predicate on the ID field.
 func IDGTE(id string) predicate.RefreshToken {
-	return predicate.RefreshToken(func(s *sql.Selector) {
-		s.Where(sql.GTE(s.C(FieldID), id))
-	})
+	return predicate.RefreshToken(sql.FieldGTE(FieldID, id))
 }
 
 // IDLT applies the LT predicate on the ID field.
 func IDLT(id string) predicate.RefreshToken {
-	return predicate.RefreshToken(func(s *sql.Selector) {
-		s.Where(sql.LT(s.C(FieldID), id))
-	})
+	return predicate.RefreshToken(sql.FieldLT(FieldID, id))
 }
 
 // IDLTE applies the LTE predicate on the ID field.
 func IDLTE(id string) predicate.RefreshToken {
-	return predicate.RefreshToken(func(s *sql.Selector) {
-		s.Where(sql.LTE(s.C(FieldID), id))
-	})
+	return predicate.RefreshToken(sql.FieldLTE(FieldID, id))
+}
+
+// IDEqualFold applies the EqualFold predicate on the ID field.
+func IDEqualFold(id string) predicate.RefreshToken {
+	return predicate.RefreshToken(sql.FieldEqualFold(FieldID, id))
+}
+
+// IDContainsFold applies the ContainsFold predicate on the ID field.
+func IDContainsFold(id string) predicate.RefreshToken {
+	return predicate.RefreshToken(sql.FieldContainsFold(FieldID, id))
 }
 
 // ClientID applies equality check predicate on the "client_id" field. It's identical to ClientIDEQ.
 func ClientID(v string) predicate.RefreshToken {
-	return predicate.RefreshToken(func(s *sql.Selector) {
-		s.Where(sql.EQ(s.C(FieldClientID), v))
-	})
+	return predicate.RefreshToken(sql.FieldEQ(FieldClientID, v))
 }
 
 // Nonce applies equality check predicate on the "nonce" field. It's identical to NonceEQ.
 func Nonce(v string) predicate.RefreshToken {
-	return predicate.RefreshToken(func(s *sql.Selector) {
-		s.Where(sql.EQ(s.C(FieldNonce), v))
-	})
+	return predicate.RefreshToken(sql.FieldEQ(FieldNonce, v))
 }
 
 // ClaimsUserID applies equality check predicate on the "claims_user_id" field. It's identical to ClaimsUserIDEQ.
 func ClaimsUserID(v string) predicate.RefreshToken {
-	return predicate.RefreshToken(func(s *sql.Selector) {
-		s.Where(sql.EQ(s.C(FieldClaimsUserID), v))
-	})
+	return predicate.RefreshToken(sql.FieldEQ(FieldClaimsUserID, v))
 }
 
 // ClaimsUsername applies equality check predicate on the "claims_username" field. It's identical to ClaimsUsernameEQ.
 func ClaimsUsername(v string) predicate.RefreshToken {
-	return predicate.RefreshToken(func(s *sql.Selector) {
-		s.Where(sql.EQ(s.C(FieldClaimsUsername), v))
-	})
+	return predicate.RefreshToken(sql.FieldEQ(FieldClaimsUsername, v))
 }
 
 // ClaimsEmail applies equality check predicate on the "claims_email" field. It's identical to ClaimsEmailEQ.
 func ClaimsEmail(v string) predicate.RefreshToken {
-	return predicate.RefreshToken(func(s *sql.Selector) {
-		s.Where(sql.EQ(s.C(FieldClaimsEmail), v))
-	})
+	return predicate.RefreshToken(sql.FieldEQ(FieldClaimsEmail, v))
 }
 
 // ClaimsEmailVerified applies equality check predicate on the "claims_email_verified" field. It's identical to ClaimsEmailVerifiedEQ.
 func ClaimsEmailVerified(v bool) predicate.RefreshToken {
-	return predicate.RefreshToken(func(s *sql.Selector) {
-		s.Where(sql.EQ(s.C(FieldClaimsEmailVerified), v))
-	})
+	return predicate.RefreshToken(sql.FieldEQ(FieldClaimsEmailVerified, v))
 }
 
 // ClaimsPreferredUsername applies equality check predicate on the "claims_preferred_username" field. It's identical to ClaimsPreferredUsernameEQ.
 func ClaimsPreferredUsername(v string) predicate.RefreshToken {
-	return predicate.RefreshToken(func(s *sql.Selector) {
-		s.Where(sql.EQ(s.C(FieldClaimsPreferredUsername), v))
-	})
+	return predicate.RefreshToken(sql.FieldEQ(FieldClaimsPreferredUsername, v))
 }
 
 // ConnectorID applies equality check predicate on the "connector_id" field. It's identical to ConnectorIDEQ.
 func ConnectorID(v string) predicate.RefreshToken {
-	return predicate.RefreshToken(func(s *sql.Selector) {
-		s.Where(sql.EQ(s.C(FieldConnectorID), v))
-	})
+	return predicate.RefreshToken(sql.FieldEQ(FieldConnectorID, v))
 }
 
 // ConnectorData applies equality check predicate on the "connector_data" field. It's identical to ConnectorDataEQ.
 func ConnectorData(v []byte) predicate.RefreshToken {
-	return predicate.RefreshToken(func(s *sql.Selector) {
-		s.Where(sql.EQ(s.C(FieldConnectorData), v))
-	})
+	return predicate.RefreshToken(sql.FieldEQ(FieldConnectorData, v))
 }
 
 // Token applies equality check predicate on the "token" field. It's identical to TokenEQ.
 func Token(v string) predicate.RefreshToken {
-	return predicate.RefreshToken(func(s *sql.Selector) {
-		s.Where(sql.EQ(s.C(FieldToken), v))
-	})
+	return predicate.RefreshToken(sql.FieldEQ(FieldToken, v))
 }
 
 // ObsoleteToken applies equality check predicate on the "obsolete_token" field. It's identical to ObsoleteTokenEQ.
 func ObsoleteToken(v string) predicate.RefreshToken {
-	return predicate.RefreshToken(func(s *sql.Selector) {
-		s.Where(sql.EQ(s.C(FieldObsoleteToken), v))
-	})
+	return predicate.RefreshToken(sql.FieldEQ(FieldObsoleteToken, v))
 }
 
 // CreatedAt applies equality check predicate on the "created_at" field. It's identical to CreatedAtEQ.
 func CreatedAt(v time.Time) predicate.RefreshToken {
-	return predicate.RefreshToken(func(s *sql.Selector) {
-		s.Where(sql.EQ(s.C(FieldCreatedAt), v))
-	})
+	return predicate.RefreshToken(sql.FieldEQ(FieldCreatedAt, v))
 }
 
 // LastUsed applies equality check predicate on the "last_used" field. It's identical to LastUsedEQ.
 func LastUsed(v time.Time) predicate.RefreshToken {
-	return predicate.RefreshToken(func(s *sql.Selector) {
-		s.Where(sql.EQ(s.C(FieldLastUsed), v))
-	})
+	return predicate.RefreshToken(sql.FieldEQ(FieldLastUsed, v))
 }
 
 // ClientIDEQ applies the EQ predicate on the "client_id" field.
 func ClientIDEQ(v string) predicate.RefreshToken {
-	return predicate.RefreshToken(func(s *sql.Selector) {
-		s.Where(sql.EQ(s.C(FieldClientID), v))
-	})
+	return predicate.RefreshToken(sql.FieldEQ(FieldClientID, v))
 }
 
 // ClientIDNEQ applies the NEQ predicate on the "client_id" field.
 func ClientIDNEQ(v string) predicate.RefreshToken {
-	return predicate.RefreshToken(func(s *sql.Selector) {
-		s.Where(sql.NEQ(s.C(FieldClientID), v))
-	})
+	return predicate.RefreshToken(sql.FieldNEQ(FieldClientID, v))
 }
 
 // ClientIDIn applies the In predicate on the "client_id" field.
 func ClientIDIn(vs ...string) predicate.RefreshToken {
-	v := make([]interface{}, len(vs))
-	for i := range v {
-		v[i] = vs[i]
-	}
-	return predicate.RefreshToken(func(s *sql.Selector) {
-		s.Where(sql.In(s.C(FieldClientID), v...))
-	})
+	return predicate.RefreshToken(sql.FieldIn(FieldClientID, vs...))
 }
 
 // ClientIDNotIn applies the NotIn predicate on the "client_id" field.
 func ClientIDNotIn(vs ...string) predicate.RefreshToken {
-	v := make([]interface{}, len(vs))
-	for i := range v {
-		v[i] = vs[i]
-	}
-	return predicate.RefreshToken(func(s *sql.Selector) {
-		s.Where(sql.NotIn(s.C(FieldClientID), v...))
-	})
+	return predicate.RefreshToken(sql.FieldNotIn(FieldClientID, vs...))
 }
 
 // ClientIDGT applies the GT predicate on the "client_id" field.
 func ClientIDGT(v string) predicate.RefreshToken {
-	return predicate.RefreshToken(func(s *sql.Selector) {
-		s.Where(sql.GT(s.C(FieldClientID), v))
-	})
+	return predicate.RefreshToken(sql.FieldGT(FieldClientID, v))
 }
 
 // ClientIDGTE applies the GTE predicate on the "client_id" field.
 func ClientIDGTE(v string) predicate.RefreshToken {
-	return predicate.RefreshToken(func(s *sql.Selector) {
-		s.Where(sql.GTE(s.C(FieldClientID), v))
-	})
+	return predicate.RefreshToken(sql.FieldGTE(FieldClientID, v))
 }
 
 // ClientIDLT applies the LT predicate on the "client_id" field.
 func ClientIDLT(v string) predicate.RefreshToken {
-	return predicate.RefreshToken(func(s *sql.Selector) {
-		s.Where(sql.LT(s.C(FieldClientID), v))
-	})
+	return predicate.RefreshToken(sql.FieldLT(FieldClientID, v))
 }
 
 // ClientIDLTE applies the LTE predicate on the "client_id" field.
 func ClientIDLTE(v string) predicate.RefreshToken {
-	return predicate.RefreshToken(func(s *sql.Selector) {
-		s.Where(sql.LTE(s.C(FieldClientID), v))
-	})
+	return predicate.RefreshToken(sql.FieldLTE(FieldClientID, v))
 }
 
 // ClientIDContains applies the Contains predicate on the "client_id" field.
 func ClientIDContains(v string) predicate.RefreshToken {
-	return predicate.RefreshToken(func(s *sql.Selector) {
-		s.Where(sql.Contains(s.C(FieldClientID), v))
-	})
+	return predicate.RefreshToken(sql.FieldContains(FieldClientID, v))
 }
 
 // ClientIDHasPrefix applies the HasPrefix predicate on the "client_id" field.
 func ClientIDHasPrefix(v string) predicate.RefreshToken {
-	return predicate.RefreshToken(func(s *sql.Selector) {
-		s.Where(sql.HasPrefix(s.C(FieldClientID), v))
-	})
+	return predicate.RefreshToken(sql.FieldHasPrefix(FieldClientID, v))
 }
 
 // ClientIDHasSuffix applies the HasSuffix predicate on the "client_id" field.
 func ClientIDHasSuffix(v string) predicate.RefreshToken {
-	return predicate.RefreshToken(func(s *sql.Selector) {
-		s.Where(sql.HasSuffix(s.C(FieldClientID), v))
-	})
+	return predicate.RefreshToken(sql.FieldHasSuffix(FieldClientID, v))
 }
 
 // ClientIDEqualFold applies the EqualFold predicate on the "client_id" field.
 func ClientIDEqualFold(v string) predicate.RefreshToken {
-	return predicate.RefreshToken(func(s *sql.Selector) {
-		s.Where(sql.EqualFold(s.C(FieldClientID), v))
-	})
+	return predicate.RefreshToken(sql.FieldEqualFold(FieldClientID, v))
 }
 
 // ClientIDContainsFold applies the ContainsFold predicate on the "client_id" field.
 func ClientIDContainsFold(v string) predicate.RefreshToken {
-	return predicate.RefreshToken(func(s *sql.Selector) {
-		s.Where(sql.ContainsFold(s.C(FieldClientID), v))
-	})
+	return predicate.RefreshToken(sql.FieldContainsFold(FieldClientID, v))
 }
 
 // ScopesIsNil applies the IsNil predicate on the "scopes" field.
 func ScopesIsNil() predicate.RefreshToken {
-	return predicate.RefreshToken(func(s *sql.Selector) {
-		s.Where(sql.IsNull(s.C(FieldScopes)))
-	})
+	return predicate.RefreshToken(sql.FieldIsNull(FieldScopes))
 }
 
 // ScopesNotNil applies the NotNil predicate on the "scopes" field.
 func ScopesNotNil() predicate.RefreshToken {
-	return predicate.RefreshToken(func(s *sql.Selector) {
-		s.Where(sql.NotNull(s.C(FieldScopes)))
-	})
+	return predicate.RefreshToken(sql.FieldNotNull(FieldScopes))
 }
 
 // NonceEQ applies the EQ predicate on the "nonce" field.
 func NonceEQ(v string) predicate.RefreshToken {
-	return predicate.RefreshToken(func(s *sql.Selector) {
-		s.Where(sql.EQ(s.C(FieldNonce), v))
-	})
+	return predicate.RefreshToken(sql.FieldEQ(FieldNonce, v))
 }
 
 // NonceNEQ applies the NEQ predicate on the "nonce" field.
 func NonceNEQ(v string) predicate.RefreshToken {
-	return predicate.RefreshToken(func(s *sql.Selector) {
-		s.Where(sql.NEQ(s.C(FieldNonce), v))
-	})
+	return predicate.RefreshToken(sql.FieldNEQ(FieldNonce, v))
 }
 
 // NonceIn applies the In predicate on the "nonce" field.
 func NonceIn(vs ...string) predicate.RefreshToken {
-	v := make([]interface{}, len(vs))
-	for i := range v {
-		v[i] = vs[i]
-	}
-	return predicate.RefreshToken(func(s *sql.Selector) {
-		s.Where(sql.In(s.C(FieldNonce), v...))
-	})
+	return predicate.RefreshToken(sql.FieldIn(FieldNonce, vs...))
 }
 
 // NonceNotIn applies the NotIn predicate on the "nonce" field.
 func NonceNotIn(vs ...string) predicate.RefreshToken {
-	v := make([]interface{}, len(vs))
-	for i := range v {
-		v[i] = vs[i]
-	}
-	return predicate.RefreshToken(func(s *sql.Selector) {
-		s.Where(sql.NotIn(s.C(FieldNonce), v...))
-	})
+	return predicate.RefreshToken(sql.FieldNotIn(FieldNonce, vs...))
 }
 
 // NonceGT applies the GT predicate on the "nonce" field.
 func NonceGT(v string) predicate.RefreshToken {
-	return predicate.RefreshToken(func(s *sql.Selector) {
-		s.Where(sql.GT(s.C(FieldNonce), v))
-	})
+	return predicate.RefreshToken(sql.FieldGT(FieldNonce, v))
 }
 
 // NonceGTE applies the GTE predicate on the "nonce" field.
 func NonceGTE(v string) predicate.RefreshToken {
-	return predicate.RefreshToken(func(s *sql.Selector) {
-		s.Where(sql.GTE(s.C(FieldNonce), v))
-	})
+	return predicate.RefreshToken(sql.FieldGTE(FieldNonce, v))
 }
 
 // NonceLT applies the LT predicate on the "nonce" field.
 func NonceLT(v string) predicate.RefreshToken {
-	return predicate.RefreshToken(func(s *sql.Selector) {
-		s.Where(sql.LT(s.C(FieldNonce), v))
-	})
+	return predicate.RefreshToken(sql.FieldLT(FieldNonce, v))
 }
 
 // NonceLTE applies the LTE predicate on the "nonce" field.
 func NonceLTE(v string) predicate.RefreshToken {
-	return predicate.RefreshToken(func(s *sql.Selector) {
-		s.Where(sql.LTE(s.C(FieldNonce), v))
-	})
+	return predicate.RefreshToken(sql.FieldLTE(FieldNonce, v))
 }
 
 // NonceContains applies the Contains predicate on the "nonce" field.
 func NonceContains(v string) predicate.RefreshToken {
-	return predicate.RefreshToken(func(s *sql.Selector) {
-		s.Where(sql.Contains(s.C(FieldNonce), v))
-	})
+	return predicate.RefreshToken(sql.FieldContains(FieldNonce, v))
 }
 
 // NonceHasPrefix applies the HasPrefix predicate on the "nonce" field.
 func NonceHasPrefix(v string) predicate.RefreshToken {
-	return predicate.RefreshToken(func(s *sql.Selector) {
-		s.Where(sql.HasPrefix(s.C(FieldNonce), v))
-	})
+	return predicate.RefreshToken(sql.FieldHasPrefix(FieldNonce, v))
 }
 
 // NonceHasSuffix applies the HasSuffix predicate on the "nonce" field.
 func NonceHasSuffix(v string) predicate.RefreshToken {
-	return predicate.RefreshToken(func(s *sql.Selector) {
-		s.Where(sql.HasSuffix(s.C(FieldNonce), v))
-	})
+	return predicate.RefreshToken(sql.FieldHasSuffix(FieldNonce, v))
 }
 
 // NonceEqualFold applies the EqualFold predicate on the "nonce" field.
 func NonceEqualFold(v string) predicate.RefreshToken {
-	return predicate.RefreshToken(func(s *sql.Selector) {
-		s.Where(sql.EqualFold(s.C(FieldNonce), v))
-	})
+	return predicate.RefreshToken(sql.FieldEqualFold(FieldNonce, v))
 }
 
 // NonceContainsFold applies the ContainsFold predicate on the "nonce" field.
 func NonceContainsFold(v string) predicate.RefreshToken {
-	return predicate.RefreshToken(func(s *sql.Selector) {
-		s.Where(sql.ContainsFold(s.C(FieldNonce), v))
-	})
+	return predicate.RefreshToken(sql.FieldContainsFold(FieldNonce, v))
 }
 
 // ClaimsUserIDEQ applies the EQ predicate on the "claims_user_id" field.
 func ClaimsUserIDEQ(v string) predicate.RefreshToken {
-	return predicate.RefreshToken(func(s *sql.Selector) {
-		s.Where(sql.EQ(s.C(FieldClaimsUserID), v))
-	})
+	return predicate.RefreshToken(sql.FieldEQ(FieldClaimsUserID, v))
 }
 
 // ClaimsUserIDNEQ applies the NEQ predicate on the "claims_user_id" field.
 func ClaimsUserIDNEQ(v string) predicate.RefreshToken {
-	return predicate.RefreshToken(func(s *sql.Selector) {
-		s.Where(sql.NEQ(s.C(FieldClaimsUserID), v))
-	})
+	return predicate.RefreshToken(sql.FieldNEQ(FieldClaimsUserID, v))
 }
 
 // ClaimsUserIDIn applies the In predicate on the "claims_user_id" field.
 func ClaimsUserIDIn(vs ...string) predicate.RefreshToken {
-	v := make([]interface{}, len(vs))
-	for i := range v {
-		v[i] = vs[i]
-	}
-	return predicate.RefreshToken(func(s *sql.Selector) {
-		s.Where(sql.In(s.C(FieldClaimsUserID), v...))
-	})
+	return predicate.RefreshToken(sql.FieldIn(FieldClaimsUserID, vs...))
 }
 
 // ClaimsUserIDNotIn applies the NotIn predicate on the "claims_user_id" field.
 func ClaimsUserIDNotIn(vs ...string) predicate.RefreshToken {
-	v := make([]interface{}, len(vs))
-	for i := range v {
-		v[i] = vs[i]
-	}
-	return predicate.RefreshToken(func(s *sql.Selector) {
-		s.Where(sql.NotIn(s.C(FieldClaimsUserID), v...))
-	})
+	return predicate.RefreshToken(sql.FieldNotIn(FieldClaimsUserID, vs...))
 }
 
 // ClaimsUserIDGT applies the GT predicate on the "claims_user_id" field.
 func ClaimsUserIDGT(v string) predicate.RefreshToken {
-	return predicate.RefreshToken(func(s *sql.Selector) {
-		s.Where(sql.GT(s.C(FieldClaimsUserID), v))
-	})
+	return predicate.RefreshToken(sql.FieldGT(FieldClaimsUserID, v))
 }
 
 // ClaimsUserIDGTE applies the GTE predicate on the "claims_user_id" field.
 func ClaimsUserIDGTE(v string) predicate.RefreshToken {
-	return predicate.RefreshToken(func(s *sql.Selector) {
-		s.Where(sql.GTE(s.C(FieldClaimsUserID), v))
-	})
+	return predicate.RefreshToken(sql.FieldGTE(FieldClaimsUserID, v))
 }
 
 // ClaimsUserIDLT applies the LT predicate on the "claims_user_id" field.
 func ClaimsUserIDLT(v string) predicate.RefreshToken {
-	return predicate.RefreshToken(func(s *sql.Selector) {
-		s.Where(sql.LT(s.C(FieldClaimsUserID), v))
-	})
+	return predicate.RefreshToken(sql.FieldLT(FieldClaimsUserID, v))
 }
 
 // ClaimsUserIDLTE applies the LTE predicate on the "claims_user_id" field.
 func ClaimsUserIDLTE(v string) predicate.RefreshToken {
-	return predicate.RefreshToken(func(s *sql.Selector) {
-		s.Where(sql.LTE(s.C(FieldClaimsUserID), v))
-	})
+	return predicate.RefreshToken(sql.FieldLTE(FieldClaimsUserID, v))
 }
 
 // ClaimsUserIDContains applies the Contains predicate on the "claims_user_id" field.
 func ClaimsUserIDContains(v string) predicate.RefreshToken {
-	return predicate.RefreshToken(func(s *sql.Selector) {
-		s.Where(sql.Contains(s.C(FieldClaimsUserID), v))
-	})
+	return predicate.RefreshToken(sql.FieldContains(FieldClaimsUserID, v))
 }
 
 // ClaimsUserIDHasPrefix applies the HasPrefix predicate on the "claims_user_id" field.
 func ClaimsUserIDHasPrefix(v string) predicate.RefreshToken {
-	return predicate.RefreshToken(func(s *sql.Selector) {
-		s.Where(sql.HasPrefix(s.C(FieldClaimsUserID), v))
-	})
+	return predicate.RefreshToken(sql.FieldHasPrefix(FieldClaimsUserID, v))
 }
 
 // ClaimsUserIDHasSuffix applies the HasSuffix predicate on the "claims_user_id" field.
 func ClaimsUserIDHasSuffix(v string) predicate.RefreshToken {
-	return predicate.RefreshToken(func(s *sql.Selector) {
-		s.Where(sql.HasSuffix(s.C(FieldClaimsUserID), v))
-	})
+	return predicate.RefreshToken(sql.FieldHasSuffix(FieldClaimsUserID, v))
 }
 
 // ClaimsUserIDEqualFold applies the EqualFold predicate on the "claims_user_id" field.
 func ClaimsUserIDEqualFold(v string) predicate.RefreshToken {
-	return predicate.RefreshToken(func(s *sql.Selector) {
-		s.Where(sql.EqualFold(s.C(FieldClaimsUserID), v))
-	})
+	return predicate.RefreshToken(sql.FieldEqualFold(FieldClaimsUserID, v))
 }
 
 // ClaimsUserIDContainsFold applies the ContainsFold predicate on the "claims_user_id" field.
 func ClaimsUserIDContainsFold(v string) predicate.RefreshToken {
-	return predicate.RefreshToken(func(s *sql.Selector) {
-		s.Where(sql.ContainsFold(s.C(FieldClaimsUserID), v))
-	})
+	return predicate.RefreshToken(sql.FieldContainsFold(FieldClaimsUserID, v))
 }
 
 // ClaimsUsernameEQ applies the EQ predicate on the "claims_username" field.
 func ClaimsUsernameEQ(v string) predicate.RefreshToken {
-	return predicate.RefreshToken(func(s *sql.Selector) {
-		s.Where(sql.EQ(s.C(FieldClaimsUsername), v))
-	})
+	return predicate.RefreshToken(sql.FieldEQ(FieldClaimsUsername, v))
 }
 
 // ClaimsUsernameNEQ applies the NEQ predicate on the "claims_username" field.
 func ClaimsUsernameNEQ(v string) predicate.RefreshToken {
-	return predicate.RefreshToken(func(s *sql.Selector) {
-		s.Where(sql.NEQ(s.C(FieldClaimsUsername), v))
-	})
+	return predicate.RefreshToken(sql.FieldNEQ(FieldClaimsUsername, v))
 }
 
 // ClaimsUsernameIn applies the In predicate on the "claims_username" field.
 func ClaimsUsernameIn(vs ...string) predicate.RefreshToken {
-	v := make([]interface{}, len(vs))
-	for i := range v {
-		v[i] = vs[i]
-	}
-	return predicate.RefreshToken(func(s *sql.Selector) {
-		s.Where(sql.In(s.C(FieldClaimsUsername), v...))
-	})
+	return predicate.RefreshToken(sql.FieldIn(FieldClaimsUsername, vs...))
 }
 
 // ClaimsUsernameNotIn applies the NotIn predicate on the "claims_username" field.
 func ClaimsUsernameNotIn(vs ...string) predicate.RefreshToken {
-	v := make([]interface{}, len(vs))
-	for i := range v {
-		v[i] = vs[i]
-	}
-	return predicate.RefreshToken(func(s *sql.Selector) {
-		s.Where(sql.NotIn(s.C(FieldClaimsUsername), v...))
-	})
+	return predicate.RefreshToken(sql.FieldNotIn(FieldClaimsUsername, vs...))
 }
 
 // ClaimsUsernameGT applies the GT predicate on the "claims_username" field.
 func ClaimsUsernameGT(v string) predicate.RefreshToken {
-	return predicate.RefreshToken(func(s *sql.Selector) {
-		s.Where(sql.GT(s.C(FieldClaimsUsername), v))
-	})
+	return predicate.RefreshToken(sql.FieldGT(FieldClaimsUsername, v))
 }
 
 // ClaimsUsernameGTE applies the GTE predicate on the "claims_username" field.
 func ClaimsUsernameGTE(v string) predicate.RefreshToken {
-	return predicate.RefreshToken(func(s *sql.Selector) {
-		s.Where(sql.GTE(s.C(FieldClaimsUsername), v))
-	})
+	return predicate.RefreshToken(sql.FieldGTE(FieldClaimsUsername, v))
 }
 
 // ClaimsUsernameLT applies the LT predicate on the "claims_username" field.
 func ClaimsUsernameLT(v string) predicate.RefreshToken {
-	return predicate.RefreshToken(func(s *sql.Selector) {
-		s.Where(sql.LT(s.C(FieldClaimsUsername), v))
-	})
+	return predicate.RefreshToken(sql.FieldLT(FieldClaimsUsername, v))
 }
 
 // ClaimsUsernameLTE applies the LTE predicate on the "claims_username" field.
 func ClaimsUsernameLTE(v string) predicate.RefreshToken {
-	return predicate.RefreshToken(func(s *sql.Selector) {
-		s.Where(sql.LTE(s.C(FieldClaimsUsername), v))
-	})
+	return predicate.RefreshToken(sql.FieldLTE(FieldClaimsUsername, v))
 }
 
 // ClaimsUsernameContains applies the Contains predicate on the "claims_username" field.
 func ClaimsUsernameContains(v string) predicate.RefreshToken {
-	return predicate.RefreshToken(func(s *sql.Selector) {
-		s.Where(sql.Contains(s.C(FieldClaimsUsername), v))
-	})
+	return predicate.RefreshToken(sql.FieldContains(FieldClaimsUsername, v))
 }
 
 // ClaimsUsernameHasPrefix applies the HasPrefix predicate on the "claims_username" field.
 func ClaimsUsernameHasPrefix(v string) predicate.RefreshToken {
-	return predicate.RefreshToken(func(s *sql.Selector) {
-		s.Where(sql.HasPrefix(s.C(FieldClaimsUsername), v))
-	})
+	return predicate.RefreshToken(sql.FieldHasPrefix(FieldClaimsUsername, v))
 }
 
 // ClaimsUsernameHasSuffix applies the HasSuffix predicate on the "claims_username" field.
 func ClaimsUsernameHasSuffix(v string) predicate.RefreshToken {
-	return predicate.RefreshToken(func(s *sql.Selector) {
-		s.Where(sql.HasSuffix(s.C(FieldClaimsUsername), v))
-	})
+	return predicate.RefreshToken(sql.FieldHasSuffix(FieldClaimsUsername, v))
 }
 
 // ClaimsUsernameEqualFold applies the EqualFold predicate on the "claims_username" field.
 func ClaimsUsernameEqualFold(v string) predicate.RefreshToken {
-	return predicate.RefreshToken(func(s *sql.Selector) {
-		s.Where(sql.EqualFold(s.C(FieldClaimsUsername), v))
-	})
+	return predicate.RefreshToken(sql.FieldEqualFold(FieldClaimsUsername, v))
 }
 
 // ClaimsUsernameContainsFold applies the ContainsFold predicate on the "claims_username" field.
 func ClaimsUsernameContainsFold(v string) predicate.RefreshToken {
-	return predicate.RefreshToken(func(s *sql.Selector) {
-		s.Where(sql.ContainsFold(s.C(FieldClaimsUsername), v))
-	})
+	return predicate.RefreshToken(sql.FieldContainsFold(FieldClaimsUsername, v))
 }
 
 // ClaimsEmailEQ applies the EQ predicate on the "claims_email" field.
 func ClaimsEmailEQ(v string) predicate.RefreshToken {
-	return predicate.RefreshToken(func(s *sql.Selector) {
-		s.Where(sql.EQ(s.C(FieldClaimsEmail), v))
-	})
+	return predicate.RefreshToken(sql.FieldEQ(FieldClaimsEmail, v))
 }
 
 // ClaimsEmailNEQ applies the NEQ predicate on the "claims_email" field.
 func ClaimsEmailNEQ(v string) predicate.RefreshToken {
-	return predicate.RefreshToken(func(s *sql.Selector) {
-		s.Where(sql.NEQ(s.C(FieldClaimsEmail), v))
-	})
+	return predicate.RefreshToken(sql.FieldNEQ(FieldClaimsEmail, v))
 }
 
 // ClaimsEmailIn applies the In predicate on the "claims_email" field.
 func ClaimsEmailIn(vs ...string) predicate.RefreshToken {
-	v := make([]interface{}, len(vs))
-	for i := range v {
-		v[i] = vs[i]
-	}
-	return predicate.RefreshToken(func(s *sql.Selector) {
-		s.Where(sql.In(s.C(FieldClaimsEmail), v...))
-	})
+	return predicate.RefreshToken(sql.FieldIn(FieldClaimsEmail, vs...))
 }
 
 // ClaimsEmailNotIn applies the NotIn predicate on the "claims_email" field.
 func ClaimsEmailNotIn(vs ...string) predicate.RefreshToken {
-	v := make([]interface{}, len(vs))
-	for i := range v {
-		v[i] = vs[i]
-	}
-	return predicate.RefreshToken(func(s *sql.Selector) {
-		s.Where(sql.NotIn(s.C(FieldClaimsEmail), v...))
-	})
+	return predicate.RefreshToken(sql.FieldNotIn(FieldClaimsEmail, vs...))
 }
 
 // ClaimsEmailGT applies the GT predicate on the "claims_email" field.
 func ClaimsEmailGT(v string) predicate.RefreshToken {
-	return predicate.RefreshToken(func(s *sql.Selector) {
-		s.Where(sql.GT(s.C(FieldClaimsEmail), v))
-	})
+	return predicate.RefreshToken(sql.FieldGT(FieldClaimsEmail, v))
 }
 
 // ClaimsEmailGTE applies the GTE predicate on the "claims_email" field.
 func ClaimsEmailGTE(v string) predicate.RefreshToken {
-	return predicate.RefreshToken(func(s *sql.Selector) {
-		s.Where(sql.GTE(s.C(FieldClaimsEmail), v))
-	})
+	return predicate.RefreshToken(sql.FieldGTE(FieldClaimsEmail, v))
 }
 
 // ClaimsEmailLT applies the LT predicate on the "claims_email" field.
 func ClaimsEmailLT(v string) predicate.RefreshToken {
-	return predicate.RefreshToken(func(s *sql.Selector) {
-		s.Where(sql.LT(s.C(FieldClaimsEmail), v))
-	})
+	return predicate.RefreshToken(sql.FieldLT(FieldClaimsEmail, v))
 }
 
 // ClaimsEmailLTE applies the LTE predicate on the "claims_email" field.
 func ClaimsEmailLTE(v string) predicate.RefreshToken {
-	return predicate.RefreshToken(func(s *sql.Selector) {
-		s.Where(sql.LTE(s.C(FieldClaimsEmail), v))
-	})
+	return predicate.RefreshToken(sql.FieldLTE(FieldClaimsEmail, v))
 }
 
 // ClaimsEmailContains applies the Contains predicate on the "claims_email" field.
 func ClaimsEmailContains(v string) predicate.RefreshToken {
-	return predicate.RefreshToken(func(s *sql.Selector) {
-		s.Where(sql.Contains(s.C(FieldClaimsEmail), v))
-	})
+	return predicate.RefreshToken(sql.FieldContains(FieldClaimsEmail, v))
 }
 
 // ClaimsEmailHasPrefix applies the HasPrefix predicate on the "claims_email" field.
 func ClaimsEmailHasPrefix(v string) predicate.RefreshToken {
-	return predicate.RefreshToken(func(s *sql.Selector) {
-		s.Where(sql.HasPrefix(s.C(FieldClaimsEmail), v))
-	})
+	return predicate.RefreshToken(sql.FieldHasPrefix(FieldClaimsEmail, v))
 }
 
 // ClaimsEmailHasSuffix applies the HasSuffix predicate on the "claims_email" field.
 func ClaimsEmailHasSuffix(v string) predicate.RefreshToken {
-	return predicate.RefreshToken(func(s *sql.Selector) {
-		s.Where(sql.HasSuffix(s.C(FieldClaimsEmail), v))
-	})
+	return predicate.RefreshToken(sql.FieldHasSuffix(FieldClaimsEmail, v))
 }
 
 // ClaimsEmailEqualFold applies the EqualFold predicate on the "claims_email" field.
 func ClaimsEmailEqualFold(v string) predicate.RefreshToken {
-	return predicate.RefreshToken(func(s *sql.Selector) {
-		s.Where(sql.EqualFold(s.C(FieldClaimsEmail), v))
-	})
+	return predicate.RefreshToken(sql.FieldEqualFold(FieldClaimsEmail, v))
 }
 
 // ClaimsEmailContainsFold applies the ContainsFold predicate on the "claims_email" field.
 func ClaimsEmailContainsFold(v string) predicate.RefreshToken {
-	return predicate.RefreshToken(func(s *sql.Selector) {
-		s.Where(sql.ContainsFold(s.C(FieldClaimsEmail), v))
-	})
+	return predicate.RefreshToken(sql.FieldContainsFold(FieldClaimsEmail, v))
 }
 
 // ClaimsEmailVerifiedEQ applies the EQ predicate on the "claims_email_verified" field.
 func ClaimsEmailVerifiedEQ(v bool) predicate.RefreshToken {
-	return predicate.RefreshToken(func(s *sql.Selector) {
-		s.Where(sql.EQ(s.C(FieldClaimsEmailVerified), v))
-	})
+	return predicate.RefreshToken(sql.FieldEQ(FieldClaimsEmailVerified, v))
 }
 
 // ClaimsEmailVerifiedNEQ applies the NEQ predicate on the "claims_email_verified" field.
 func ClaimsEmailVerifiedNEQ(v bool) predicate.RefreshToken {
-	return predicate.RefreshToken(func(s *sql.Selector) {
-		s.Where(sql.NEQ(s.C(FieldClaimsEmailVerified), v))
-	})
+	return predicate.RefreshToken(sql.FieldNEQ(FieldClaimsEmailVerified, v))
 }
 
 // ClaimsGroupsIsNil applies the IsNil predicate on the "claims_groups" field.
 func ClaimsGroupsIsNil() predicate.RefreshToken {
-	return predicate.RefreshToken(func(s *sql.Selector) {
-		s.Where(sql.IsNull(s.C(FieldClaimsGroups)))
-	})
+	return predicate.RefreshToken(sql.FieldIsNull(FieldClaimsGroups))
 }
 
 // ClaimsGroupsNotNil applies the NotNil predicate on the "claims_groups" field.
 func ClaimsGroupsNotNil() predicate.RefreshToken {
-	return predicate.RefreshToken(func(s *sql.Selector) {
-		s.Where(sql.NotNull(s.C(FieldClaimsGroups)))
-	})
+	return predicate.RefreshToken(sql.FieldNotNull(FieldClaimsGroups))
 }
 
 // ClaimsPreferredUsernameEQ applies the EQ predicate on the "claims_preferred_username" field.
 func ClaimsPreferredUsernameEQ(v string) predicate.RefreshToken {
-	return predicate.RefreshToken(func(s *sql.Selector) {
-		s.Where(sql.EQ(s.C(FieldClaimsPreferredUsername), v))
-	})
+	return predicate.RefreshToken(sql.FieldEQ(FieldClaimsPreferredUsername, v))
 }
 
 // ClaimsPreferredUsernameNEQ applies the NEQ predicate on the "claims_preferred_username" field.
 func ClaimsPreferredUsernameNEQ(v string) predicate.RefreshToken {
-	return predicate.RefreshToken(func(s *sql.Selector) {
-		s.Where(sql.NEQ(s.C(FieldClaimsPreferredUsername), v))
-	})
+	return predicate.RefreshToken(sql.FieldNEQ(FieldClaimsPreferredUsername, v))
 }
 
 // ClaimsPreferredUsernameIn applies the In predicate on the "claims_preferred_username" field.
 func ClaimsPreferredUsernameIn(vs ...string) predicate.RefreshToken {
-	v := make([]interface{}, len(vs))
-	for i := range v {
-		v[i] = vs[i]
-	}
-	return predicate.RefreshToken(func(s *sql.Selector) {
-		s.Where(sql.In(s.C(FieldClaimsPreferredUsername), v...))
-	})
+	return predicate.RefreshToken(sql.FieldIn(FieldClaimsPreferredUsername, vs...))
 }
 
 // ClaimsPreferredUsernameNotIn applies the NotIn predicate on the "claims_preferred_username" field.
 func ClaimsPreferredUsernameNotIn(vs ...string) predicate.RefreshToken {
-	v := make([]interface{}, len(vs))
-	for i := range v {
-		v[i] = vs[i]
-	}
-	return predicate.RefreshToken(func(s *sql.Selector) {
-		s.Where(sql.NotIn(s.C(FieldClaimsPreferredUsername), v...))
-	})
+	return predicate.RefreshToken(sql.FieldNotIn(FieldClaimsPreferredUsername, vs...))
 }
 
 // ClaimsPreferredUsernameGT applies the GT predicate on the "claims_preferred_username" field.
 func ClaimsPreferredUsernameGT(v string) predicate.RefreshToken {
-	return predicate.RefreshToken(func(s *sql.Selector) {
-		s.Where(sql.GT(s.C(FieldClaimsPreferredUsername), v))
-	})
+	return predicate.RefreshToken(sql.FieldGT(FieldClaimsPreferredUsername, v))
 }
 
 // ClaimsPreferredUsernameGTE applies the GTE predicate on the "claims_preferred_username" field.
 func ClaimsPreferredUsernameGTE(v string) predicate.RefreshToken {
-	return predicate.RefreshToken(func(s *sql.Selector) {
-		s.Where(sql.GTE(s.C(FieldClaimsPreferredUsername), v))
-	})
+	return predicate.RefreshToken(sql.FieldGTE(FieldClaimsPreferredUsername, v))
 }
 
 // ClaimsPreferredUsernameLT applies the LT predicate on the "claims_preferred_username" field.
 func ClaimsPreferredUsernameLT(v string) predicate.RefreshToken {
-	return predicate.RefreshToken(func(s *sql.Selector) {
-		s.Where(sql.LT(s.C(FieldClaimsPreferredUsername), v))
-	})
+	return predicate.RefreshToken(sql.FieldLT(FieldClaimsPreferredUsername, v))
 }
 
 // ClaimsPreferredUsernameLTE applies the LTE predicate on the "claims_preferred_username" field.
 func ClaimsPreferredUsernameLTE(v string) predicate.RefreshToken {
-	return predicate.RefreshToken(func(s *sql.Selector) {
-		s.Where(sql.LTE(s.C(FieldClaimsPreferredUsername), v))
-	})
+	return predicate.RefreshToken(sql.FieldLTE(FieldClaimsPreferredUsername, v))
 }
 
 // ClaimsPreferredUsernameContains applies the Contains predicate on the "claims_preferred_username" field.
 func ClaimsPreferredUsernameContains(v string) predicate.RefreshToken {
-	return predicate.RefreshToken(func(s *sql.Selector) {
-		s.Where(sql.Contains(s.C(FieldClaimsPreferredUsername), v))
-	})
+	return predicate.RefreshToken(sql.FieldContains(FieldClaimsPreferredUsername, v))
 }
 
 // ClaimsPreferredUsernameHasPrefix applies the HasPrefix predicate on the "claims_preferred_username" field.
 func ClaimsPreferredUsernameHasPrefix(v string) predicate.RefreshToken {
-	return predicate.RefreshToken(func(s *sql.Selector) {
-		s.Where(sql.HasPrefix(s.C(FieldClaimsPreferredUsername), v))
-	})
+	return predicate.RefreshToken(sql.FieldHasPrefix(FieldClaimsPreferredUsername, v))
 }
 
 // ClaimsPreferredUsernameHasSuffix applies the HasSuffix predicate on the "claims_preferred_username" field.
 func ClaimsPreferredUsernameHasSuffix(v string) predicate.RefreshToken {
-	return predicate.RefreshToken(func(s *sql.Selector) {
-		s.Where(sql.HasSuffix(s.C(FieldClaimsPreferredUsername), v))
-	})
+	return predicate.RefreshToken(sql.FieldHasSuffix(FieldClaimsPreferredUsername, v))
 }
 
 // ClaimsPreferredUsernameEqualFold applies the EqualFold predicate on the "claims_preferred_username" field.
 func ClaimsPreferredUsernameEqualFold(v string) predicate.RefreshToken {
-	return predicate.RefreshToken(func(s *sql.Selector) {
-		s.Where(sql.EqualFold(s.C(FieldClaimsPreferredUsername), v))
-	})
+	return predicate.RefreshToken(sql.FieldEqualFold(FieldClaimsPreferredUsername, v))
 }
 
 // ClaimsPreferredUsernameContainsFold applies the ContainsFold predicate on the "claims_preferred_username" field.
 func ClaimsPreferredUsernameContainsFold(v string) predicate.RefreshToken {
-	return predicate.RefreshToken(func(s *sql.Selector) {
-		s.Where(sql.ContainsFold(s.C(FieldClaimsPreferredUsername), v))
-	})
+	return predicate.RefreshToken(sql.FieldContainsFold(FieldClaimsPreferredUsername, v))
 }
 
 // ConnectorIDEQ applies the EQ predicate on the "connector_id" field.
 func ConnectorIDEQ(v string) predicate.RefreshToken {
-	return predicate.RefreshToken(func(s *sql.Selector) {
-		s.Where(sql.EQ(s.C(FieldConnectorID), v))
-	})
+	return predicate.RefreshToken(sql.FieldEQ(FieldConnectorID, v))
 }
 
 // ConnectorIDNEQ applies the NEQ predicate on the "connector_id" field.
 func ConnectorIDNEQ(v string) predicate.RefreshToken {
-	return predicate.RefreshToken(func(s *sql.Selector) {
-		s.Where(sql.NEQ(s.C(FieldConnectorID), v))
-	})
+	return predicate.RefreshToken(sql.FieldNEQ(FieldConnectorID, v))
 }
 
 // ConnectorIDIn applies the In predicate on the "connector_id" field.
 func ConnectorIDIn(vs ...string) predicate.RefreshToken {
-	v := make([]interface{}, len(vs))
-	for i := range v {
-		v[i] = vs[i]
-	}
-	return predicate.RefreshToken(func(s *sql.Selector) {
-		s.Where(sql.In(s.C(FieldConnectorID), v...))
-	})
+	return predicate.RefreshToken(sql.FieldIn(FieldConnectorID, vs...))
 }
 
 // ConnectorIDNotIn applies the NotIn predicate on the "connector_id" field.
 func ConnectorIDNotIn(vs ...string) predicate.RefreshToken {
-	v := make([]interface{}, len(vs))
-	for i := range v {
-		v[i] = vs[i]
-	}
-	return predicate.RefreshToken(func(s *sql.Selector) {
-		s.Where(sql.NotIn(s.C(FieldConnectorID), v...))
-	})
+	return predicate.RefreshToken(sql.FieldNotIn(FieldConnectorID, vs...))
 }
 
 // ConnectorIDGT applies the GT predicate on the "connector_id" field.
 func ConnectorIDGT(v string) predicate.RefreshToken {
-	return predicate.RefreshToken(func(s *sql.Selector) {
-		s.Where(sql.GT(s.C(FieldConnectorID), v))
-	})
+	return predicate.RefreshToken(sql.FieldGT(FieldConnectorID, v))
 }
 
 // ConnectorIDGTE applies the GTE predicate on the "connector_id" field.
 func ConnectorIDGTE(v string) predicate.RefreshToken {
-	return predicate.RefreshToken(func(s *sql.Selector) {
-		s.Where(sql.GTE(s.C(FieldConnectorID), v))
-	})
+	return predicate.RefreshToken(sql.FieldGTE(FieldConnectorID, v))
 }
 
 // ConnectorIDLT applies the LT predicate on the "connector_id" field.
 func ConnectorIDLT(v string) predicate.RefreshToken {
-	return predicate.RefreshToken(func(s *sql.Selector) {
-		s.Where(sql.LT(s.C(FieldConnectorID), v))
-	})
+	return predicate.RefreshToken(sql.FieldLT(FieldConnectorID, v))
 }
 
 // ConnectorIDLTE applies the LTE predicate on the "connector_id" field.
 func ConnectorIDLTE(v string) predicate.RefreshToken {
-	return predicate.RefreshToken(func(s *sql.Selector) {
-		s.Where(sql.LTE(s.C(FieldConnectorID), v))
-	})
+	return predicate.RefreshToken(sql.FieldLTE(FieldConnectorID, v))
 }
 
 // ConnectorIDContains applies the Contains predicate on the "connector_id" field.
 func ConnectorIDContains(v string) predicate.RefreshToken {
-	return predicate.RefreshToken(func(s *sql.Selector) {
-		s.Where(sql.Contains(s.C(FieldConnectorID), v))
-	})
+	return predicate.RefreshToken(sql.FieldContains(FieldConnectorID, v))
 }
 
 // ConnectorIDHasPrefix applies the HasPrefix predicate on the "connector_id" field.
 func ConnectorIDHasPrefix(v string) predicate.RefreshToken {
-	return predicate.RefreshToken(func(s *sql.Selector) {
-		s.Where(sql.HasPrefix(s.C(FieldConnectorID), v))
-	})
+	return predicate.RefreshToken(sql.FieldHasPrefix(FieldConnectorID, v))
 }
 
 // ConnectorIDHasSuffix applies the HasSuffix predicate on the "connector_id" field.
 func ConnectorIDHasSuffix(v string) predicate.RefreshToken {
-	return predicate.RefreshToken(func(s *sql.Selector) {
-		s.Where(sql.HasSuffix(s.C(FieldConnectorID), v))
-	})
+	return predicate.RefreshToken(sql.FieldHasSuffix(FieldConnectorID, v))
 }
 
 // ConnectorIDEqualFold applies the EqualFold predicate on the "connector_id" field.
 func ConnectorIDEqualFold(v string) predicate.RefreshToken {
-	return predicate.RefreshToken(func(s *sql.Selector) {
-		s.Where(sql.EqualFold(s.C(FieldConnectorID), v))
-	})
+	return predicate.RefreshToken(sql.FieldEqualFold(FieldConnectorID, v))
 }
 
 // ConnectorIDContainsFold applies the ContainsFold predicate on the "connector_id" field.
 func ConnectorIDContainsFold(v string) predicate.RefreshToken {
-	return predicate.RefreshToken(func(s *sql.Selector) {
-		s.Where(sql.ContainsFold(s.C(FieldConnectorID), v))
-	})
+	return predicate.RefreshToken(sql.FieldContainsFold(FieldConnectorID, v))
 }
 
 // ConnectorDataEQ applies the EQ predicate on the "connector_data" field.
 func ConnectorDataEQ(v []byte) predicate.RefreshToken {
-	return predicate.RefreshToken(func(s *sql.Selector) {
-		s.Where(sql.EQ(s.C(FieldConnectorData), v))
-	})
+	return predicate.RefreshToken(sql.FieldEQ(FieldConnectorData, v))
 }
 
 // ConnectorDataNEQ applies the NEQ predicate on the "connector_data" field.
 func ConnectorDataNEQ(v []byte) predicate.RefreshToken {
-	return predicate.RefreshToken(func(s *sql.Selector) {
-		s.Where(sql.NEQ(s.C(FieldConnectorData), v))
-	})
+	return predicate.RefreshToken(sql.FieldNEQ(FieldConnectorData, v))
 }
 
 // ConnectorDataIn applies the In predicate on the "connector_data" field.
 func ConnectorDataIn(vs ...[]byte) predicate.RefreshToken {
-	v := make([]interface{}, len(vs))
-	for i := range v {
-		v[i] = vs[i]
-	}
-	return predicate.RefreshToken(func(s *sql.Selector) {
-		s.Where(sql.In(s.C(FieldConnectorData), v...))
-	})
+	return predicate.RefreshToken(sql.FieldIn(FieldConnectorData, vs...))
 }
 
 // ConnectorDataNotIn applies the NotIn predicate on the "connector_data" field.
 func ConnectorDataNotIn(vs ...[]byte) predicate.RefreshToken {
-	v := make([]interface{}, len(vs))
-	for i := range v {
-		v[i] = vs[i]
-	}
-	return predicate.RefreshToken(func(s *sql.Selector) {
-		s.Where(sql.NotIn(s.C(FieldConnectorData), v...))
-	})
+	return predicate.RefreshToken(sql.FieldNotIn(FieldConnectorData, vs...))
 }
 
 // ConnectorDataGT applies the GT predicate on the "connector_data" field.
 func ConnectorDataGT(v []byte) predicate.RefreshToken {
-	return predicate.RefreshToken(func(s *sql.Selector) {
-		s.Where(sql.GT(s.C(FieldConnectorData), v))
-	})
+	return predicate.RefreshToken(sql.FieldGT(FieldConnectorData, v))
 }
 
 // ConnectorDataGTE applies the GTE predicate on the "connector_data" field.
 func ConnectorDataGTE(v []byte) predicate.RefreshToken {
-	return predicate.RefreshToken(func(s *sql.Selector) {
-		s.Where(sql.GTE(s.C(FieldConnectorData), v))
-	})
+	return predicate.RefreshToken(sql.FieldGTE(FieldConnectorData, v))
 }
 
 // ConnectorDataLT applies the LT predicate on the "connector_data" field.
 func ConnectorDataLT(v []byte) predicate.RefreshToken {
-	return predicate.RefreshToken(func(s *sql.Selector) {
-		s.Where(sql.LT(s.C(FieldConnectorData), v))
-	})
+	return predicate.RefreshToken(sql.FieldLT(FieldConnectorData, v))
 }
 
 // ConnectorDataLTE applies the LTE predicate on the "connector_data" field.
 func ConnectorDataLTE(v []byte) predicate.RefreshToken {
-	return predicate.RefreshToken(func(s *sql.Selector) {
-		s.Where(sql.LTE(s.C(FieldConnectorData), v))
-	})
+	return predicate.RefreshToken(sql.FieldLTE(FieldConnectorData, v))
 }
 
 // ConnectorDataIsNil applies the IsNil predicate on the "connector_data" field.
 func ConnectorDataIsNil() predicate.RefreshToken {
-	return predicate.RefreshToken(func(s *sql.Selector) {
-		s.Where(sql.IsNull(s.C(FieldConnectorData)))
-	})
+	return predicate.RefreshToken(sql.FieldIsNull(FieldConnectorData))
 }
 
 // ConnectorDataNotNil applies the NotNil predicate on the "connector_data" field.
 func ConnectorDataNotNil() predicate.RefreshToken {
-	return predicate.RefreshToken(func(s *sql.Selector) {
-		s.Where(sql.NotNull(s.C(FieldConnectorData)))
-	})
+	return predicate.RefreshToken(sql.FieldNotNull(FieldConnectorData))
 }
 
 // TokenEQ applies the EQ predicate on the "token" field.
 func TokenEQ(v string) predicate.RefreshToken {
-	return predicate.RefreshToken(func(s *sql.Selector) {
-		s.Where(sql.EQ(s.C(FieldToken), v))
-	})
+	return predicate.RefreshToken(sql.FieldEQ(FieldToken, v))
 }
 
 // TokenNEQ applies the NEQ predicate on the "token" field.
 func TokenNEQ(v string) predicate.RefreshToken {
-	return predicate.RefreshToken(func(s *sql.Selector) {
-		s.Where(sql.NEQ(s.C(FieldToken), v))
-	})
+	return predicate.RefreshToken(sql.FieldNEQ(FieldToken, v))
 }
 
 // TokenIn applies the In predicate on the "token" field.
 func TokenIn(vs ...string) predicate.RefreshToken {
-	v := make([]interface{}, len(vs))
-	for i := range v {
-		v[i] = vs[i]
-	}
-	return predicate.RefreshToken(func(s *sql.Selector) {
-		s.Where(sql.In(s.C(FieldToken), v...))
-	})
+	return predicate.RefreshToken(sql.FieldIn(FieldToken, vs...))
 }
 
 // TokenNotIn applies the NotIn predicate on the "token" field.
 func TokenNotIn(vs ...string) predicate.RefreshToken {
-	v := make([]interface{}, len(vs))
-	for i := range v {
-		v[i] = vs[i]
-	}
-	return predicate.RefreshToken(func(s *sql.Selector) {
-		s.Where(sql.NotIn(s.C(FieldToken), v...))
-	})
+	return predicate.RefreshToken(sql.FieldNotIn(FieldToken, vs...))
 }
 
 // TokenGT applies the GT predicate on the "token" field.
 func TokenGT(v string) predicate.RefreshToken {
-	return predicate.RefreshToken(func(s *sql.Selector) {
-		s.Where(sql.GT(s.C(FieldToken), v))
-	})
+	return predicate.RefreshToken(sql.FieldGT(FieldToken, v))
 }
 
 // TokenGTE applies the GTE predicate on the "token" field.
 func TokenGTE(v string) predicate.RefreshToken {
-	return predicate.RefreshToken(func(s *sql.Selector) {
-		s.Where(sql.GTE(s.C(FieldToken), v))
-	})
+	return predicate.RefreshToken(sql.FieldGTE(FieldToken, v))
 }
 
 // TokenLT applies the LT predicate on the "token" field.
 func TokenLT(v string) predicate.RefreshToken {
-	return predicate.RefreshToken(func(s *sql.Selector) {
-		s.Where(sql.LT(s.C(FieldToken), v))
-	})
+	return predicate.RefreshToken(sql.FieldLT(FieldToken, v))
 }
 
 // TokenLTE applies the LTE predicate on the "token" field.
 func TokenLTE(v string) predicate.RefreshToken {
-	return predicate.RefreshToken(func(s *sql.Selector) {
-		s.Where(sql.LTE(s.C(FieldToken), v))
-	})
+	return predicate.RefreshToken(sql.FieldLTE(FieldToken, v))
 }
 
 // TokenContains applies the Contains predicate on the "token" field.
 func TokenContains(v string) predicate.RefreshToken {
-	return predicate.RefreshToken(func(s *sql.Selector) {
-		s.Where(sql.Contains(s.C(FieldToken), v))
-	})
+	return predicate.RefreshToken(sql.FieldContains(FieldToken, v))
 }
 
 // TokenHasPrefix applies the HasPrefix predicate on the "token" field.
 func TokenHasPrefix(v string) predicate.RefreshToken {
-	return predicate.RefreshToken(func(s *sql.Selector) {
-		s.Where(sql.HasPrefix(s.C(FieldToken), v))
-	})
+	return predicate.RefreshToken(sql.FieldHasPrefix(FieldToken, v))
 }
 
 // TokenHasSuffix applies the HasSuffix predicate on the "token" field.
 func TokenHasSuffix(v string) predicate.RefreshToken {
-	return predicate.RefreshToken(func(s *sql.Selector) {
-		s.Where(sql.HasSuffix(s.C(FieldToken), v))
-	})
+	return predicate.RefreshToken(sql.FieldHasSuffix(FieldToken, v))
 }
 
 // TokenEqualFold applies the EqualFold predicate on the "token" field.
 func TokenEqualFold(v string) predicate.RefreshToken {
-	return predicate.RefreshToken(func(s *sql.Selector) {
-		s.Where(sql.EqualFold(s.C(FieldToken), v))
-	})
+	return predicate.RefreshToken(sql.FieldEqualFold(FieldToken, v))
 }
 
 // TokenContainsFold applies the ContainsFold predicate on the "token" field.
 func TokenContainsFold(v string) predicate.RefreshToken {
-	return predicate.RefreshToken(func(s *sql.Selector) {
-		s.Where(sql.ContainsFold(s.C(FieldToken), v))
-	})
+	return predicate.RefreshToken(sql.FieldContainsFold(FieldToken, v))
 }
 
 // ObsoleteTokenEQ applies the EQ predicate on the "obsolete_token" field.
 func ObsoleteTokenEQ(v string) predicate.RefreshToken {
-	return predicate.RefreshToken(func(s *sql.Selector) {
-		s.Where(sql.EQ(s.C(FieldObsoleteToken), v))
-	})
+	return predicate.RefreshToken(sql.FieldEQ(FieldObsoleteToken, v))
 }
 
 // ObsoleteTokenNEQ applies the NEQ predicate on the "obsolete_token" field.
 func ObsoleteTokenNEQ(v string) predicate.RefreshToken {
-	return predicate.RefreshToken(func(s *sql.Selector) {
-		s.Where(sql.NEQ(s.C(FieldObsoleteToken), v))
-	})
+	return predicate.RefreshToken(sql.FieldNEQ(FieldObsoleteToken, v))
 }
 
 // ObsoleteTokenIn applies the In predicate on the "obsolete_token" field.
 func ObsoleteTokenIn(vs ...string) predicate.RefreshToken {
-	v := make([]interface{}, len(vs))
-	for i := range v {
-		v[i] = vs[i]
-	}
-	return predicate.RefreshToken(func(s *sql.Selector) {
-		s.Where(sql.In(s.C(FieldObsoleteToken), v...))
-	})
+	return predicate.RefreshToken(sql.FieldIn(FieldObsoleteToken, vs...))
 }
 
 // ObsoleteTokenNotIn applies the NotIn predicate on the "obsolete_token" field.
 func ObsoleteTokenNotIn(vs ...string) predicate.RefreshToken {
-	v := make([]interface{}, len(vs))
-	for i := range v {
-		v[i] = vs[i]
-	}
-	return predicate.RefreshToken(func(s *sql.Selector) {
-		s.Where(sql.NotIn(s.C(FieldObsoleteToken), v...))
-	})
+	return predicate.RefreshToken(sql.FieldNotIn(FieldObsoleteToken, vs...))
 }
 
 // ObsoleteTokenGT applies the GT predicate on the "obsolete_token" field.
 func ObsoleteTokenGT(v string) predicate.RefreshToken {
-	return predicate.RefreshToken(func(s *sql.Selector) {
-		s.Where(sql.GT(s.C(FieldObsoleteToken), v))
-	})
+	return predicate.RefreshToken(sql.FieldGT(FieldObsoleteToken, v))
 }
 
 // ObsoleteTokenGTE applies the GTE predicate on the "obsolete_token" field.
 func ObsoleteTokenGTE(v string) predicate.RefreshToken {
-	return predicate.RefreshToken(func(s *sql.Selector) {
-		s.Where(sql.GTE(s.C(FieldObsoleteToken), v))
-	})
+	return predicate.RefreshToken(sql.FieldGTE(FieldObsoleteToken, v))
 }
 
 // ObsoleteTokenLT applies the LT predicate on the "obsolete_token" field.
 func ObsoleteTokenLT(v string) predicate.RefreshToken {
-	return predicate.RefreshToken(func(s *sql.Selector) {
-		s.Where(sql.LT(s.C(FieldObsoleteToken), v))
-	})
+	return predicate.RefreshToken(sql.FieldLT(FieldObsoleteToken, v))
 }
 
 // ObsoleteTokenLTE applies the LTE predicate on the "obsolete_token" field.
 func ObsoleteTokenLTE(v string) predicate.RefreshToken {
-	return predicate.RefreshToken(func(s *sql.Selector) {
-		s.Where(sql.LTE(s.C(FieldObsoleteToken), v))
-	})
+	return predicate.RefreshToken(sql.FieldLTE(FieldObsoleteToken, v))
 }
 
 // ObsoleteTokenContains applies the Contains predicate on the "obsolete_token" field.
 func ObsoleteTokenContains(v string) predicate.RefreshToken {
-	return predicate.RefreshToken(func(s *sql.Selector) {
-		s.Where(sql.Contains(s.C(FieldObsoleteToken), v))
-	})
+	return predicate.RefreshToken(sql.FieldContains(FieldObsoleteToken, v))
 }
 
 // ObsoleteTokenHasPrefix applies the HasPrefix predicate on the "obsolete_token" field.
 func ObsoleteTokenHasPrefix(v string) predicate.RefreshToken {
-	return predicate.RefreshToken(func(s *sql.Selector) {
-		s.Where(sql.HasPrefix(s.C(FieldObsoleteToken), v))
-	})
+	return predicate.RefreshToken(sql.FieldHasPrefix(FieldObsoleteToken, v))
 }
 
 // ObsoleteTokenHasSuffix applies the HasSuffix predicate on the "obsolete_token" field.
 func ObsoleteTokenHasSuffix(v string) predicate.RefreshToken {
-	return predicate.RefreshToken(func(s *sql.Selector) {
-		s.Where(sql.HasSuffix(s.C(FieldObsoleteToken), v))
-	})
+	return predicate.RefreshToken(sql.FieldHasSuffix(FieldObsoleteToken, v))
 }
 
 // ObsoleteTokenEqualFold applies the EqualFold predicate on the "obsolete_token" field.
 func ObsoleteTokenEqualFold(v string) predicate.RefreshToken {
-	return predicate.RefreshToken(func(s *sql.Selector) {
-		s.Where(sql.EqualFold(s.C(FieldObsoleteToken), v))
-	})
+	return predicate.RefreshToken(sql.FieldEqualFold(FieldObsoleteToken, v))
 }
 
 // ObsoleteTokenContainsFold applies the ContainsFold predicate on the "obsolete_token" field.
 func ObsoleteTokenContainsFold(v string) predicate.RefreshToken {
-	return predicate.RefreshToken(func(s *sql.Selector) {
-		s.Where(sql.ContainsFold(s.C(FieldObsoleteToken), v))
-	})
+	return predicate.RefreshToken(sql.FieldContainsFold(FieldObsoleteToken, v))
 }
 
 // CreatedAtEQ applies the EQ predicate on the "created_at" field.
 func CreatedAtEQ(v time.Time) predicate.RefreshToken {
-	return predicate.RefreshToken(func(s *sql.Selector) {
-		s.Where(sql.EQ(s.C(FieldCreatedAt), v))
-	})
+	return predicate.RefreshToken(sql.FieldEQ(FieldCreatedAt, v))
 }
 
 // CreatedAtNEQ applies the NEQ predicate on the "created_at" field.
 func CreatedAtNEQ(v time.Time) predicate.RefreshToken {
-	return predicate.RefreshToken(func(s *sql.Selector) {
-		s.Where(sql.NEQ(s.C(FieldCreatedAt), v))
-	})
+	return predicate.RefreshToken(sql.FieldNEQ(FieldCreatedAt, v))
 }
 
 // CreatedAtIn applies the In predicate on the "created_at" field.
 func CreatedAtIn(vs ...time.Time) predicate.RefreshToken {
-	v := make([]interface{}, len(vs))
-	for i := range v {
-		v[i] = vs[i]
-	}
-	return predicate.RefreshToken(func(s *sql.Selector) {
-		s.Where(sql.In(s.C(FieldCreatedAt), v...))
-	})
+	return predicate.RefreshToken(sql.FieldIn(FieldCreatedAt, vs...))
 }
 
 // CreatedAtNotIn applies the NotIn predicate on the "created_at" field.
 func CreatedAtNotIn(vs ...time.Time) predicate.RefreshToken {
-	v := make([]interface{}, len(vs))
-	for i := range v {
-		v[i] = vs[i]
-	}
-	return predicate.RefreshToken(func(s *sql.Selector) {
-		s.Where(sql.NotIn(s.C(FieldCreatedAt), v...))
-	})
+	return predicate.RefreshToken(sql.FieldNotIn(FieldCreatedAt, vs...))
 }
 
 // CreatedAtGT applies the GT predicate on the "created_at" field.
 func CreatedAtGT(v time.Time) predicate.RefreshToken {
-	return predicate.RefreshToken(func(s *sql.Selector) {
-		s.Where(sql.GT(s.C(FieldCreatedAt), v))
-	})
+	return predicate.RefreshToken(sql.FieldGT(FieldCreatedAt, v))
 }
 
 // CreatedAtGTE applies the GTE predicate on the "created_at" field.
 func CreatedAtGTE(v time.Time) predicate.RefreshToken {
-	return predicate.RefreshToken(func(s *sql.Selector) {
-		s.Where(sql.GTE(s.C(FieldCreatedAt), v))
-	})
+	return predicate.RefreshToken(sql.FieldGTE(FieldCreatedAt, v))
 }
 
 // CreatedAtLT applies the LT predicate on the "created_at" field.
 func CreatedAtLT(v time.Time) predicate.RefreshToken {
-	return predicate.RefreshToken(func(s *sql.Selector) {
-		s.Where(sql.LT(s.C(FieldCreatedAt), v))
-	})
+	return predicate.RefreshToken(sql.FieldLT(FieldCreatedAt, v))
 }
 
 // CreatedAtLTE applies the LTE predicate on the "created_at" field.
 func CreatedAtLTE(v time.Time) predicate.RefreshToken {
-	return predicate.RefreshToken(func(s *sql.Selector) {
-		s.Where(sql.LTE(s.C(FieldCreatedAt), v))
-	})
+	return predicate.RefreshToken(sql.FieldLTE(FieldCreatedAt, v))
 }
 
 // LastUsedEQ applies the EQ predicate on the "last_used" field.
 func LastUsedEQ(v time.Time) predicate.RefreshToken {
-	return predicate.RefreshToken(func(s *sql.Selector) {
-		s.Where(sql.EQ(s.C(FieldLastUsed), v))
-	})
+	return predicate.RefreshToken(sql.FieldEQ(FieldLastUsed, v))
 }
 
 // LastUsedNEQ applies the NEQ predicate on the "last_used" field.
 func LastUsedNEQ(v time.Time) predicate.RefreshToken {
-	return predicate.RefreshToken(func(s *sql.Selector) {
-		s.Where(sql.NEQ(s.C(FieldLastUsed), v))
-	})
+	return predicate.RefreshToken(sql.FieldNEQ(FieldLastUsed, v))
 }
 
 // LastUsedIn applies the In predicate on the "last_used" field.
 func LastUsedIn(vs ...time.Time) predicate.RefreshToken {
-	v := make([]interface{}, len(vs))
-	for i := range v {
-		v[i] = vs[i]
-	}
-	return predicate.RefreshToken(func(s *sql.Selector) {
-		s.Where(sql.In(s.C(FieldLastUsed), v...))
-	})
+	return predicate.RefreshToken(sql.FieldIn(FieldLastUsed, vs...))
 }
 
 // LastUsedNotIn applies the NotIn predicate on the "last_used" field.
 func LastUsedNotIn(vs ...time.Time) predicate.RefreshToken {
-	v := make([]interface{}, len(vs))
-	for i := range v {
-		v[i] = vs[i]
-	}
-	return predicate.RefreshToken(func(s *sql.Selector) {
-		s.Where(sql.NotIn(s.C(FieldLastUsed), v...))
-	})
+	return predicate.RefreshToken(sql.FieldNotIn(FieldLastUsed, vs...))
 }
 
 // LastUsedGT applies the GT predicate on the "last_used" field.
 func LastUsedGT(v time.Time) predicate.RefreshToken {
-	return predicate.RefreshToken(func(s *sql.Selector) {
-		s.Where(sql.GT(s.C(FieldLastUsed), v))
-	})
+	return predicate.RefreshToken(sql.FieldGT(FieldLastUsed, v))
 }
 
 // LastUsedGTE applies the GTE predicate on the "last_used" field.
 func LastUsedGTE(v time.Time) predicate.RefreshToken {
-	return predicate.RefreshToken(func(s *sql.Selector) {
-		s.Where(sql.GTE(s.C(FieldLastUsed), v))
-	})
+	return predicate.RefreshToken(sql.FieldGTE(FieldLastUsed, v))
 }
 
 // LastUsedLT applies the LT predicate on the "last_used" field.
 func LastUsedLT(v time.Time) predicate.RefreshToken {
-	return predicate.RefreshToken(func(s *sql.Selector) {
-		s.Where(sql.LT(s.C(FieldLastUsed), v))
-	})
+	return predicate.RefreshToken(sql.FieldLT(FieldLastUsed, v))
 }
 
 // LastUsedLTE applies the LTE predicate on the "last_used" field.
 func LastUsedLTE(v time.Time) predicate.RefreshToken {
-	return predicate.RefreshToken(func(s *sql.Selector) {
-		s.Where(sql.LTE(s.C(FieldLastUsed), v))
-	})
+	return predicate.RefreshToken(sql.FieldLTE(FieldLastUsed, v))
 }
 
 // And groups predicates with the AND operator between them.
 func And(predicates ...predicate.RefreshToken) predicate.RefreshToken {
-	return predicate.RefreshToken(func(s *sql.Selector) {
-		s1 := s.Clone().SetP(nil)
-		for _, p := range predicates {
-			p(s1)
-		}
-		s.Where(s1.P())
-	})
+	return predicate.RefreshToken(sql.AndPredicates(predicates...))
 }
 
 // Or groups predicates with the OR operator between them.
 func Or(predicates ...predicate.RefreshToken) predicate.RefreshToken {
-	return predicate.RefreshToken(func(s *sql.Selector) {
-		s1 := s.Clone().SetP(nil)
-		for i, p := range predicates {
-			if i > 0 {
-				s1.Or()
-			}
-			p(s1)
-		}
-		s.Where(s1.P())
-	})
+	return predicate.RefreshToken(sql.OrPredicates(predicates...))
 }
 
 // Not applies the not operator on the given predicate.
 func Not(p predicate.RefreshToken) predicate.RefreshToken {
-	return predicate.RefreshToken(func(s *sql.Selector) {
-		p(s.Not())
-	})
+	return predicate.RefreshToken(sql.NotPredicates(p))
 }
diff --git a/storage/ent/db/refreshtoken_create.go b/storage/ent/db/refreshtoken_create.go
index e2bd6c2fad..2feb6f2c27 100644
--- a/storage/ent/db/refreshtoken_create.go
+++ b/storage/ent/db/refreshtoken_create.go
@@ -21,197 +21,155 @@ type RefreshTokenCreate struct {
 }
 
 // SetClientID sets the "client_id" field.
-func (rtc *RefreshTokenCreate) SetClientID(s string) *RefreshTokenCreate {
-	rtc.mutation.SetClientID(s)
-	return rtc
+func (_c *RefreshTokenCreate) SetClientID(v string) *RefreshTokenCreate {
+	_c.mutation.SetClientID(v)
+	return _c
 }
 
 // SetScopes sets the "scopes" field.
-func (rtc *RefreshTokenCreate) SetScopes(s []string) *RefreshTokenCreate {
-	rtc.mutation.SetScopes(s)
-	return rtc
+func (_c *RefreshTokenCreate) SetScopes(v []string) *RefreshTokenCreate {
+	_c.mutation.SetScopes(v)
+	return _c
 }
 
 // SetNonce sets the "nonce" field.
-func (rtc *RefreshTokenCreate) SetNonce(s string) *RefreshTokenCreate {
-	rtc.mutation.SetNonce(s)
-	return rtc
+func (_c *RefreshTokenCreate) SetNonce(v string) *RefreshTokenCreate {
+	_c.mutation.SetNonce(v)
+	return _c
 }
 
 // SetClaimsUserID sets the "claims_user_id" field.
-func (rtc *RefreshTokenCreate) SetClaimsUserID(s string) *RefreshTokenCreate {
-	rtc.mutation.SetClaimsUserID(s)
-	return rtc
+func (_c *RefreshTokenCreate) SetClaimsUserID(v string) *RefreshTokenCreate {
+	_c.mutation.SetClaimsUserID(v)
+	return _c
 }
 
 // SetClaimsUsername sets the "claims_username" field.
-func (rtc *RefreshTokenCreate) SetClaimsUsername(s string) *RefreshTokenCreate {
-	rtc.mutation.SetClaimsUsername(s)
-	return rtc
+func (_c *RefreshTokenCreate) SetClaimsUsername(v string) *RefreshTokenCreate {
+	_c.mutation.SetClaimsUsername(v)
+	return _c
 }
 
 // SetClaimsEmail sets the "claims_email" field.
-func (rtc *RefreshTokenCreate) SetClaimsEmail(s string) *RefreshTokenCreate {
-	rtc.mutation.SetClaimsEmail(s)
-	return rtc
+func (_c *RefreshTokenCreate) SetClaimsEmail(v string) *RefreshTokenCreate {
+	_c.mutation.SetClaimsEmail(v)
+	return _c
 }
 
 // SetClaimsEmailVerified sets the "claims_email_verified" field.
-func (rtc *RefreshTokenCreate) SetClaimsEmailVerified(b bool) *RefreshTokenCreate {
-	rtc.mutation.SetClaimsEmailVerified(b)
-	return rtc
+func (_c *RefreshTokenCreate) SetClaimsEmailVerified(v bool) *RefreshTokenCreate {
+	_c.mutation.SetClaimsEmailVerified(v)
+	return _c
 }
 
 // SetClaimsGroups sets the "claims_groups" field.
-func (rtc *RefreshTokenCreate) SetClaimsGroups(s []string) *RefreshTokenCreate {
-	rtc.mutation.SetClaimsGroups(s)
-	return rtc
+func (_c *RefreshTokenCreate) SetClaimsGroups(v []string) *RefreshTokenCreate {
+	_c.mutation.SetClaimsGroups(v)
+	return _c
 }
 
 // SetClaimsPreferredUsername sets the "claims_preferred_username" field.
-func (rtc *RefreshTokenCreate) SetClaimsPreferredUsername(s string) *RefreshTokenCreate {
-	rtc.mutation.SetClaimsPreferredUsername(s)
-	return rtc
+func (_c *RefreshTokenCreate) SetClaimsPreferredUsername(v string) *RefreshTokenCreate {
+	_c.mutation.SetClaimsPreferredUsername(v)
+	return _c
 }
 
 // SetNillableClaimsPreferredUsername sets the "claims_preferred_username" field if the given value is not nil.
-func (rtc *RefreshTokenCreate) SetNillableClaimsPreferredUsername(s *string) *RefreshTokenCreate {
-	if s != nil {
-		rtc.SetClaimsPreferredUsername(*s)
+func (_c *RefreshTokenCreate) SetNillableClaimsPreferredUsername(v *string) *RefreshTokenCreate {
+	if v != nil {
+		_c.SetClaimsPreferredUsername(*v)
 	}
-	return rtc
+	return _c
 }
 
 // SetConnectorID sets the "connector_id" field.
-func (rtc *RefreshTokenCreate) SetConnectorID(s string) *RefreshTokenCreate {
-	rtc.mutation.SetConnectorID(s)
-	return rtc
+func (_c *RefreshTokenCreate) SetConnectorID(v string) *RefreshTokenCreate {
+	_c.mutation.SetConnectorID(v)
+	return _c
 }
 
 // SetConnectorData sets the "connector_data" field.
-func (rtc *RefreshTokenCreate) SetConnectorData(b []byte) *RefreshTokenCreate {
-	rtc.mutation.SetConnectorData(b)
-	return rtc
+func (_c *RefreshTokenCreate) SetConnectorData(v []byte) *RefreshTokenCreate {
+	_c.mutation.SetConnectorData(v)
+	return _c
 }
 
 // SetToken sets the "token" field.
-func (rtc *RefreshTokenCreate) SetToken(s string) *RefreshTokenCreate {
-	rtc.mutation.SetToken(s)
-	return rtc
+func (_c *RefreshTokenCreate) SetToken(v string) *RefreshTokenCreate {
+	_c.mutation.SetToken(v)
+	return _c
 }
 
 // SetNillableToken sets the "token" field if the given value is not nil.
-func (rtc *RefreshTokenCreate) SetNillableToken(s *string) *RefreshTokenCreate {
-	if s != nil {
-		rtc.SetToken(*s)
+func (_c *RefreshTokenCreate) SetNillableToken(v *string) *RefreshTokenCreate {
+	if v != nil {
+		_c.SetToken(*v)
 	}
-	return rtc
+	return _c
 }
 
 // SetObsoleteToken sets the "obsolete_token" field.
-func (rtc *RefreshTokenCreate) SetObsoleteToken(s string) *RefreshTokenCreate {
-	rtc.mutation.SetObsoleteToken(s)
-	return rtc
+func (_c *RefreshTokenCreate) SetObsoleteToken(v string) *RefreshTokenCreate {
+	_c.mutation.SetObsoleteToken(v)
+	return _c
 }
 
 // SetNillableObsoleteToken sets the "obsolete_token" field if the given value is not nil.
-func (rtc *RefreshTokenCreate) SetNillableObsoleteToken(s *string) *RefreshTokenCreate {
-	if s != nil {
-		rtc.SetObsoleteToken(*s)
+func (_c *RefreshTokenCreate) SetNillableObsoleteToken(v *string) *RefreshTokenCreate {
+	if v != nil {
+		_c.SetObsoleteToken(*v)
 	}
-	return rtc
+	return _c
 }
 
 // SetCreatedAt sets the "created_at" field.
-func (rtc *RefreshTokenCreate) SetCreatedAt(t time.Time) *RefreshTokenCreate {
-	rtc.mutation.SetCreatedAt(t)
-	return rtc
+func (_c *RefreshTokenCreate) SetCreatedAt(v time.Time) *RefreshTokenCreate {
+	_c.mutation.SetCreatedAt(v)
+	return _c
 }
 
 // SetNillableCreatedAt sets the "created_at" field if the given value is not nil.
-func (rtc *RefreshTokenCreate) SetNillableCreatedAt(t *time.Time) *RefreshTokenCreate {
-	if t != nil {
-		rtc.SetCreatedAt(*t)
+func (_c *RefreshTokenCreate) SetNillableCreatedAt(v *time.Time) *RefreshTokenCreate {
+	if v != nil {
+		_c.SetCreatedAt(*v)
 	}
-	return rtc
+	return _c
 }
 
 // SetLastUsed sets the "last_used" field.
-func (rtc *RefreshTokenCreate) SetLastUsed(t time.Time) *RefreshTokenCreate {
-	rtc.mutation.SetLastUsed(t)
-	return rtc
+func (_c *RefreshTokenCreate) SetLastUsed(v time.Time) *RefreshTokenCreate {
+	_c.mutation.SetLastUsed(v)
+	return _c
 }
 
 // SetNillableLastUsed sets the "last_used" field if the given value is not nil.
-func (rtc *RefreshTokenCreate) SetNillableLastUsed(t *time.Time) *RefreshTokenCreate {
-	if t != nil {
-		rtc.SetLastUsed(*t)
+func (_c *RefreshTokenCreate) SetNillableLastUsed(v *time.Time) *RefreshTokenCreate {
+	if v != nil {
+		_c.SetLastUsed(*v)
 	}
-	return rtc
+	return _c
 }
 
 // SetID sets the "id" field.
-func (rtc *RefreshTokenCreate) SetID(s string) *RefreshTokenCreate {
-	rtc.mutation.SetID(s)
-	return rtc
+func (_c *RefreshTokenCreate) SetID(v string) *RefreshTokenCreate {
+	_c.mutation.SetID(v)
+	return _c
 }
 
 // Mutation returns the RefreshTokenMutation object of the builder.
-func (rtc *RefreshTokenCreate) Mutation() *RefreshTokenMutation {
-	return rtc.mutation
+func (_c *RefreshTokenCreate) Mutation() *RefreshTokenMutation {
+	return _c.mutation
 }
 
 // Save creates the RefreshToken in the database.
-func (rtc *RefreshTokenCreate) Save(ctx context.Context) (*RefreshToken, error) {
-	var (
-		err  error
-		node *RefreshToken
-	)
-	rtc.defaults()
-	if len(rtc.hooks) == 0 {
-		if err = rtc.check(); err != nil {
-			return nil, err
-		}
-		node, err = rtc.sqlSave(ctx)
-	} else {
-		var mut Mutator = MutateFunc(func(ctx context.Context, m Mutation) (Value, error) {
-			mutation, ok := m.(*RefreshTokenMutation)
-			if !ok {
-				return nil, fmt.Errorf("unexpected mutation type %T", m)
-			}
-			if err = rtc.check(); err != nil {
-				return nil, err
-			}
-			rtc.mutation = mutation
-			if node, err = rtc.sqlSave(ctx); err != nil {
-				return nil, err
-			}
-			mutation.id = &node.ID
-			mutation.done = true
-			return node, err
-		})
-		for i := len(rtc.hooks) - 1; i >= 0; i-- {
-			if rtc.hooks[i] == nil {
-				return nil, fmt.Errorf("db: uninitialized hook (forgotten import db/runtime?)")
-			}
-			mut = rtc.hooks[i](mut)
-		}
-		v, err := mut.Mutate(ctx, rtc.mutation)
-		if err != nil {
-			return nil, err
-		}
-		nv, ok := v.(*RefreshToken)
-		if !ok {
-			return nil, fmt.Errorf("unexpected node type %T returned from RefreshTokenMutation", v)
-		}
-		node = nv
-	}
-	return node, err
+func (_c *RefreshTokenCreate) Save(ctx context.Context) (*RefreshToken, error) {
+	_c.defaults()
+	return withHooks(ctx, _c.sqlSave, _c.mutation, _c.hooks)
 }
 
 // SaveX calls Save and panics if Save returns an error.
-func (rtc *RefreshTokenCreate) SaveX(ctx context.Context) *RefreshToken {
-	v, err := rtc.Save(ctx)
+func (_c *RefreshTokenCreate) SaveX(ctx context.Context) *RefreshToken {
+	v, err := _c.Save(ctx)
 	if err != nil {
 		panic(err)
 	}
@@ -219,111 +177,111 @@ func (rtc *RefreshTokenCreate) SaveX(ctx context.Context) *RefreshToken {
 }
 
 // Exec executes the query.
-func (rtc *RefreshTokenCreate) Exec(ctx context.Context) error {
-	_, err := rtc.Save(ctx)
+func (_c *RefreshTokenCreate) Exec(ctx context.Context) error {
+	_, err := _c.Save(ctx)
 	return err
 }
 
 // ExecX is like Exec, but panics if an error occurs.
-func (rtc *RefreshTokenCreate) ExecX(ctx context.Context) {
-	if err := rtc.Exec(ctx); err != nil {
+func (_c *RefreshTokenCreate) ExecX(ctx context.Context) {
+	if err := _c.Exec(ctx); err != nil {
 		panic(err)
 	}
 }
 
 // defaults sets the default values of the builder before save.
-func (rtc *RefreshTokenCreate) defaults() {
-	if _, ok := rtc.mutation.ClaimsPreferredUsername(); !ok {
+func (_c *RefreshTokenCreate) defaults() {
+	if _, ok := _c.mutation.ClaimsPreferredUsername(); !ok {
 		v := refreshtoken.DefaultClaimsPreferredUsername
-		rtc.mutation.SetClaimsPreferredUsername(v)
+		_c.mutation.SetClaimsPreferredUsername(v)
 	}
-	if _, ok := rtc.mutation.Token(); !ok {
+	if _, ok := _c.mutation.Token(); !ok {
 		v := refreshtoken.DefaultToken
-		rtc.mutation.SetToken(v)
+		_c.mutation.SetToken(v)
 	}
-	if _, ok := rtc.mutation.ObsoleteToken(); !ok {
+	if _, ok := _c.mutation.ObsoleteToken(); !ok {
 		v := refreshtoken.DefaultObsoleteToken
-		rtc.mutation.SetObsoleteToken(v)
+		_c.mutation.SetObsoleteToken(v)
 	}
-	if _, ok := rtc.mutation.CreatedAt(); !ok {
+	if _, ok := _c.mutation.CreatedAt(); !ok {
 		v := refreshtoken.DefaultCreatedAt()
-		rtc.mutation.SetCreatedAt(v)
+		_c.mutation.SetCreatedAt(v)
 	}
-	if _, ok := rtc.mutation.LastUsed(); !ok {
+	if _, ok := _c.mutation.LastUsed(); !ok {
 		v := refreshtoken.DefaultLastUsed()
-		rtc.mutation.SetLastUsed(v)
+		_c.mutation.SetLastUsed(v)
 	}
 }
 
 // check runs all checks and user-defined validators on the builder.
-func (rtc *RefreshTokenCreate) check() error {
-	if _, ok := rtc.mutation.ClientID(); !ok {
+func (_c *RefreshTokenCreate) check() error {
+	if _, ok := _c.mutation.ClientID(); !ok {
 		return &ValidationError{Name: "client_id", err: errors.New(`db: missing required field "RefreshToken.client_id"`)}
 	}
-	if v, ok := rtc.mutation.ClientID(); ok {
+	if v, ok := _c.mutation.ClientID(); ok {
 		if err := refreshtoken.ClientIDValidator(v); err != nil {
 			return &ValidationError{Name: "client_id", err: fmt.Errorf(`db: validator failed for field "RefreshToken.client_id": %w`, err)}
 		}
 	}
-	if _, ok := rtc.mutation.Nonce(); !ok {
+	if _, ok := _c.mutation.Nonce(); !ok {
 		return &ValidationError{Name: "nonce", err: errors.New(`db: missing required field "RefreshToken.nonce"`)}
 	}
-	if v, ok := rtc.mutation.Nonce(); ok {
+	if v, ok := _c.mutation.Nonce(); ok {
 		if err := refreshtoken.NonceValidator(v); err != nil {
 			return &ValidationError{Name: "nonce", err: fmt.Errorf(`db: validator failed for field "RefreshToken.nonce": %w`, err)}
 		}
 	}
-	if _, ok := rtc.mutation.ClaimsUserID(); !ok {
+	if _, ok := _c.mutation.ClaimsUserID(); !ok {
 		return &ValidationError{Name: "claims_user_id", err: errors.New(`db: missing required field "RefreshToken.claims_user_id"`)}
 	}
-	if v, ok := rtc.mutation.ClaimsUserID(); ok {
+	if v, ok := _c.mutation.ClaimsUserID(); ok {
 		if err := refreshtoken.ClaimsUserIDValidator(v); err != nil {
 			return &ValidationError{Name: "claims_user_id", err: fmt.Errorf(`db: validator failed for field "RefreshToken.claims_user_id": %w`, err)}
 		}
 	}
-	if _, ok := rtc.mutation.ClaimsUsername(); !ok {
+	if _, ok := _c.mutation.ClaimsUsername(); !ok {
 		return &ValidationError{Name: "claims_username", err: errors.New(`db: missing required field "RefreshToken.claims_username"`)}
 	}
-	if v, ok := rtc.mutation.ClaimsUsername(); ok {
+	if v, ok := _c.mutation.ClaimsUsername(); ok {
 		if err := refreshtoken.ClaimsUsernameValidator(v); err != nil {
 			return &ValidationError{Name: "claims_username", err: fmt.Errorf(`db: validator failed for field "RefreshToken.claims_username": %w`, err)}
 		}
 	}
-	if _, ok := rtc.mutation.ClaimsEmail(); !ok {
+	if _, ok := _c.mutation.ClaimsEmail(); !ok {
 		return &ValidationError{Name: "claims_email", err: errors.New(`db: missing required field "RefreshToken.claims_email"`)}
 	}
-	if v, ok := rtc.mutation.ClaimsEmail(); ok {
+	if v, ok := _c.mutation.ClaimsEmail(); ok {
 		if err := refreshtoken.ClaimsEmailValidator(v); err != nil {
 			return &ValidationError{Name: "claims_email", err: fmt.Errorf(`db: validator failed for field "RefreshToken.claims_email": %w`, err)}
 		}
 	}
-	if _, ok := rtc.mutation.ClaimsEmailVerified(); !ok {
+	if _, ok := _c.mutation.ClaimsEmailVerified(); !ok {
 		return &ValidationError{Name: "claims_email_verified", err: errors.New(`db: missing required field "RefreshToken.claims_email_verified"`)}
 	}
-	if _, ok := rtc.mutation.ClaimsPreferredUsername(); !ok {
+	if _, ok := _c.mutation.ClaimsPreferredUsername(); !ok {
 		return &ValidationError{Name: "claims_preferred_username", err: errors.New(`db: missing required field "RefreshToken.claims_preferred_username"`)}
 	}
-	if _, ok := rtc.mutation.ConnectorID(); !ok {
+	if _, ok := _c.mutation.ConnectorID(); !ok {
 		return &ValidationError{Name: "connector_id", err: errors.New(`db: missing required field "RefreshToken.connector_id"`)}
 	}
-	if v, ok := rtc.mutation.ConnectorID(); ok {
+	if v, ok := _c.mutation.ConnectorID(); ok {
 		if err := refreshtoken.ConnectorIDValidator(v); err != nil {
 			return &ValidationError{Name: "connector_id", err: fmt.Errorf(`db: validator failed for field "RefreshToken.connector_id": %w`, err)}
 		}
 	}
-	if _, ok := rtc.mutation.Token(); !ok {
+	if _, ok := _c.mutation.Token(); !ok {
 		return &ValidationError{Name: "token", err: errors.New(`db: missing required field "RefreshToken.token"`)}
 	}
-	if _, ok := rtc.mutation.ObsoleteToken(); !ok {
+	if _, ok := _c.mutation.ObsoleteToken(); !ok {
 		return &ValidationError{Name: "obsolete_token", err: errors.New(`db: missing required field "RefreshToken.obsolete_token"`)}
 	}
-	if _, ok := rtc.mutation.CreatedAt(); !ok {
+	if _, ok := _c.mutation.CreatedAt(); !ok {
 		return &ValidationError{Name: "created_at", err: errors.New(`db: missing required field "RefreshToken.created_at"`)}
 	}
-	if _, ok := rtc.mutation.LastUsed(); !ok {
+	if _, ok := _c.mutation.LastUsed(); !ok {
 		return &ValidationError{Name: "last_used", err: errors.New(`db: missing required field "RefreshToken.last_used"`)}
 	}
-	if v, ok := rtc.mutation.ID(); ok {
+	if v, ok := _c.mutation.ID(); ok {
 		if err := refreshtoken.IDValidator(v); err != nil {
 			return &ValidationError{Name: "id", err: fmt.Errorf(`db: validator failed for field "RefreshToken.id": %w`, err)}
 		}
@@ -331,9 +289,12 @@ func (rtc *RefreshTokenCreate) check() error {
 	return nil
 }
 
-func (rtc *RefreshTokenCreate) sqlSave(ctx context.Context) (*RefreshToken, error) {
-	_node, _spec := rtc.createSpec()
-	if err := sqlgraph.CreateNode(ctx, rtc.driver, _spec); err != nil {
+func (_c *RefreshTokenCreate) sqlSave(ctx context.Context) (*RefreshToken, error) {
+	if err := _c.check(); err != nil {
+		return nil, err
+	}
+	_node, _spec := _c.createSpec()
+	if err := sqlgraph.CreateNode(ctx, _c.driver, _spec); err != nil {
 		if sqlgraph.IsConstraintError(err) {
 			err = &ConstraintError{msg: err.Error(), wrap: err}
 		}
@@ -346,142 +307,78 @@ func (rtc *RefreshTokenCreate) sqlSave(ctx context.Context) (*RefreshToken, erro
 			return nil, fmt.Errorf("unexpected RefreshToken.ID type: %T", _spec.ID.Value)
 		}
 	}
+	_c.mutation.id = &_node.ID
+	_c.mutation.done = true
 	return _node, nil
 }
 
-func (rtc *RefreshTokenCreate) createSpec() (*RefreshToken, *sqlgraph.CreateSpec) {
+func (_c *RefreshTokenCreate) createSpec() (*RefreshToken, *sqlgraph.CreateSpec) {
 	var (
-		_node = &RefreshToken{config: rtc.config}
-		_spec = &sqlgraph.CreateSpec{
-			Table: refreshtoken.Table,
-			ID: &sqlgraph.FieldSpec{
-				Type:   field.TypeString,
-				Column: refreshtoken.FieldID,
-			},
-		}
+		_node = &RefreshToken{config: _c.config}
+		_spec = sqlgraph.NewCreateSpec(refreshtoken.Table, sqlgraph.NewFieldSpec(refreshtoken.FieldID, field.TypeString))
 	)
-	if id, ok := rtc.mutation.ID(); ok {
+	if id, ok := _c.mutation.ID(); ok {
 		_node.ID = id
 		_spec.ID.Value = id
 	}
-	if value, ok := rtc.mutation.ClientID(); ok {
-		_spec.Fields = append(_spec.Fields, &sqlgraph.FieldSpec{
-			Type:   field.TypeString,
-			Value:  value,
-			Column: refreshtoken.FieldClientID,
-		})
+	if value, ok := _c.mutation.ClientID(); ok {
+		_spec.SetField(refreshtoken.FieldClientID, field.TypeString, value)
 		_node.ClientID = value
 	}
-	if value, ok := rtc.mutation.Scopes(); ok {
-		_spec.Fields = append(_spec.Fields, &sqlgraph.FieldSpec{
-			Type:   field.TypeJSON,
-			Value:  value,
-			Column: refreshtoken.FieldScopes,
-		})
+	if value, ok := _c.mutation.Scopes(); ok {
+		_spec.SetField(refreshtoken.FieldScopes, field.TypeJSON, value)
 		_node.Scopes = value
 	}
-	if value, ok := rtc.mutation.Nonce(); ok {
-		_spec.Fields = append(_spec.Fields, &sqlgraph.FieldSpec{
-			Type:   field.TypeString,
-			Value:  value,
-			Column: refreshtoken.FieldNonce,
-		})
+	if value, ok := _c.mutation.Nonce(); ok {
+		_spec.SetField(refreshtoken.FieldNonce, field.TypeString, value)
 		_node.Nonce = value
 	}
-	if value, ok := rtc.mutation.ClaimsUserID(); ok {
-		_spec.Fields = append(_spec.Fields, &sqlgraph.FieldSpec{
-			Type:   field.TypeString,
-			Value:  value,
-			Column: refreshtoken.FieldClaimsUserID,
-		})
+	if value, ok := _c.mutation.ClaimsUserID(); ok {
+		_spec.SetField(refreshtoken.FieldClaimsUserID, field.TypeString, value)
 		_node.ClaimsUserID = value
 	}
-	if value, ok := rtc.mutation.ClaimsUsername(); ok {
-		_spec.Fields = append(_spec.Fields, &sqlgraph.FieldSpec{
-			Type:   field.TypeString,
-			Value:  value,
-			Column: refreshtoken.FieldClaimsUsername,
-		})
+	if value, ok := _c.mutation.ClaimsUsername(); ok {
+		_spec.SetField(refreshtoken.FieldClaimsUsername, field.TypeString, value)
 		_node.ClaimsUsername = value
 	}
-	if value, ok := rtc.mutation.ClaimsEmail(); ok {
-		_spec.Fields = append(_spec.Fields, &sqlgraph.FieldSpec{
-			Type:   field.TypeString,
-			Value:  value,
-			Column: refreshtoken.FieldClaimsEmail,
-		})
+	if value, ok := _c.mutation.ClaimsEmail(); ok {
+		_spec.SetField(refreshtoken.FieldClaimsEmail, field.TypeString, value)
 		_node.ClaimsEmail = value
 	}
-	if value, ok := rtc.mutation.ClaimsEmailVerified(); ok {
-		_spec.Fields = append(_spec.Fields, &sqlgraph.FieldSpec{
-			Type:   field.TypeBool,
-			Value:  value,
-			Column: refreshtoken.FieldClaimsEmailVerified,
-		})
+	if value, ok := _c.mutation.ClaimsEmailVerified(); ok {
+		_spec.SetField(refreshtoken.FieldClaimsEmailVerified, field.TypeBool, value)
 		_node.ClaimsEmailVerified = value
 	}
-	if value, ok := rtc.mutation.ClaimsGroups(); ok {
-		_spec.Fields = append(_spec.Fields, &sqlgraph.FieldSpec{
-			Type:   field.TypeJSON,
-			Value:  value,
-			Column: refreshtoken.FieldClaimsGroups,
-		})
+	if value, ok := _c.mutation.ClaimsGroups(); ok {
+		_spec.SetField(refreshtoken.FieldClaimsGroups, field.TypeJSON, value)
 		_node.ClaimsGroups = value
 	}
-	if value, ok := rtc.mutation.ClaimsPreferredUsername(); ok {
-		_spec.Fields = append(_spec.Fields, &sqlgraph.FieldSpec{
-			Type:   field.TypeString,
-			Value:  value,
-			Column: refreshtoken.FieldClaimsPreferredUsername,
-		})
+	if value, ok := _c.mutation.ClaimsPreferredUsername(); ok {
+		_spec.SetField(refreshtoken.FieldClaimsPreferredUsername, field.TypeString, value)
 		_node.ClaimsPreferredUsername = value
 	}
-	if value, ok := rtc.mutation.ConnectorID(); ok {
-		_spec.Fields = append(_spec.Fields, &sqlgraph.FieldSpec{
-			Type:   field.TypeString,
-			Value:  value,
-			Column: refreshtoken.FieldConnectorID,
-		})
+	if value, ok := _c.mutation.ConnectorID(); ok {
+		_spec.SetField(refreshtoken.FieldConnectorID, field.TypeString, value)
 		_node.ConnectorID = value
 	}
-	if value, ok := rtc.mutation.ConnectorData(); ok {
-		_spec.Fields = append(_spec.Fields, &sqlgraph.FieldSpec{
-			Type:   field.TypeBytes,
-			Value:  value,
-			Column: refreshtoken.FieldConnectorData,
-		})
+	if value, ok := _c.mutation.ConnectorData(); ok {
+		_spec.SetField(refreshtoken.FieldConnectorData, field.TypeBytes, value)
 		_node.ConnectorData = &value
 	}
-	if value, ok := rtc.mutation.Token(); ok {
-		_spec.Fields = append(_spec.Fields, &sqlgraph.FieldSpec{
-			Type:   field.TypeString,
-			Value:  value,
-			Column: refreshtoken.FieldToken,
-		})
+	if value, ok := _c.mutation.Token(); ok {
+		_spec.SetField(refreshtoken.FieldToken, field.TypeString, value)
 		_node.Token = value
 	}
-	if value, ok := rtc.mutation.ObsoleteToken(); ok {
-		_spec.Fields = append(_spec.Fields, &sqlgraph.FieldSpec{
-			Type:   field.TypeString,
-			Value:  value,
-			Column: refreshtoken.FieldObsoleteToken,
-		})
+	if value, ok := _c.mutation.ObsoleteToken(); ok {
+		_spec.SetField(refreshtoken.FieldObsoleteToken, field.TypeString, value)
 		_node.ObsoleteToken = value
 	}
-	if value, ok := rtc.mutation.CreatedAt(); ok {
-		_spec.Fields = append(_spec.Fields, &sqlgraph.FieldSpec{
-			Type:   field.TypeTime,
-			Value:  value,
-			Column: refreshtoken.FieldCreatedAt,
-		})
+	if value, ok := _c.mutation.CreatedAt(); ok {
+		_spec.SetField(refreshtoken.FieldCreatedAt, field.TypeTime, value)
 		_node.CreatedAt = value
 	}
-	if value, ok := rtc.mutation.LastUsed(); ok {
-		_spec.Fields = append(_spec.Fields, &sqlgraph.FieldSpec{
-			Type:   field.TypeTime,
-			Value:  value,
-			Column: refreshtoken.FieldLastUsed,
-		})
+	if value, ok := _c.mutation.LastUsed(); ok {
+		_spec.SetField(refreshtoken.FieldLastUsed, field.TypeTime, value)
 		_node.LastUsed = value
 	}
 	return _node, _spec
@@ -490,17 +387,21 @@ func (rtc *RefreshTokenCreate) createSpec() (*RefreshToken, *sqlgraph.CreateSpec
 // RefreshTokenCreateBulk is the builder for creating many RefreshToken entities in bulk.
 type RefreshTokenCreateBulk struct {
 	config
+	err      error
 	builders []*RefreshTokenCreate
 }
 
 // Save creates the RefreshToken entities in the database.
-func (rtcb *RefreshTokenCreateBulk) Save(ctx context.Context) ([]*RefreshToken, error) {
-	specs := make([]*sqlgraph.CreateSpec, len(rtcb.builders))
-	nodes := make([]*RefreshToken, len(rtcb.builders))
-	mutators := make([]Mutator, len(rtcb.builders))
-	for i := range rtcb.builders {
+func (_c *RefreshTokenCreateBulk) Save(ctx context.Context) ([]*RefreshToken, error) {
+	if _c.err != nil {
+		return nil, _c.err
+	}
+	specs := make([]*sqlgraph.CreateSpec, len(_c.builders))
+	nodes := make([]*RefreshToken, len(_c.builders))
+	mutators := make([]Mutator, len(_c.builders))
+	for i := range _c.builders {
 		func(i int, root context.Context) {
-			builder := rtcb.builders[i]
+			builder := _c.builders[i]
 			builder.defaults()
 			var mut Mutator = MutateFunc(func(ctx context.Context, m Mutation) (Value, error) {
 				mutation, ok := m.(*RefreshTokenMutation)
@@ -511,14 +412,14 @@ func (rtcb *RefreshTokenCreateBulk) Save(ctx context.Context) ([]*RefreshToken,
 					return nil, err
 				}
 				builder.mutation = mutation
-				nodes[i], specs[i] = builder.createSpec()
 				var err error
+				nodes[i], specs[i] = builder.createSpec()
 				if i < len(mutators)-1 {
-					_, err = mutators[i+1].Mutate(root, rtcb.builders[i+1].mutation)
+					_, err = mutators[i+1].Mutate(root, _c.builders[i+1].mutation)
 				} else {
 					spec := &sqlgraph.BatchCreateSpec{Nodes: specs}
 					// Invoke the actual operation on the latest mutation in the chain.
-					if err = sqlgraph.BatchCreate(ctx, rtcb.driver, spec); err != nil {
+					if err = sqlgraph.BatchCreate(ctx, _c.driver, spec); err != nil {
 						if sqlgraph.IsConstraintError(err) {
 							err = &ConstraintError{msg: err.Error(), wrap: err}
 						}
@@ -538,7 +439,7 @@ func (rtcb *RefreshTokenCreateBulk) Save(ctx context.Context) ([]*RefreshToken,
 		}(i, ctx)
 	}
 	if len(mutators) > 0 {
-		if _, err := mutators[0].Mutate(ctx, rtcb.builders[0].mutation); err != nil {
+		if _, err := mutators[0].Mutate(ctx, _c.builders[0].mutation); err != nil {
 			return nil, err
 		}
 	}
@@ -546,8 +447,8 @@ func (rtcb *RefreshTokenCreateBulk) Save(ctx context.Context) ([]*RefreshToken,
 }
 
 // SaveX is like Save, but panics if an error occurs.
-func (rtcb *RefreshTokenCreateBulk) SaveX(ctx context.Context) []*RefreshToken {
-	v, err := rtcb.Save(ctx)
+func (_c *RefreshTokenCreateBulk) SaveX(ctx context.Context) []*RefreshToken {
+	v, err := _c.Save(ctx)
 	if err != nil {
 		panic(err)
 	}
@@ -555,14 +456,14 @@ func (rtcb *RefreshTokenCreateBulk) SaveX(ctx context.Context) []*RefreshToken {
 }
 
 // Exec executes the query.
-func (rtcb *RefreshTokenCreateBulk) Exec(ctx context.Context) error {
-	_, err := rtcb.Save(ctx)
+func (_c *RefreshTokenCreateBulk) Exec(ctx context.Context) error {
+	_, err := _c.Save(ctx)
 	return err
 }
 
 // ExecX is like Exec, but panics if an error occurs.
-func (rtcb *RefreshTokenCreateBulk) ExecX(ctx context.Context) {
-	if err := rtcb.Exec(ctx); err != nil {
+func (_c *RefreshTokenCreateBulk) ExecX(ctx context.Context) {
+	if err := _c.Exec(ctx); err != nil {
 		panic(err)
 	}
 }
diff --git a/storage/ent/db/refreshtoken_delete.go b/storage/ent/db/refreshtoken_delete.go
index 2c8d7c1e80..3e85fd5bd6 100644
--- a/storage/ent/db/refreshtoken_delete.go
+++ b/storage/ent/db/refreshtoken_delete.go
@@ -4,7 +4,6 @@ package db
 
 import (
 	"context"
-	"fmt"
 
 	"entgo.io/ent/dialect/sql"
 	"entgo.io/ent/dialect/sql/sqlgraph"
@@ -21,84 +20,56 @@ type RefreshTokenDelete struct {
 }
 
 // Where appends a list predicates to the RefreshTokenDelete builder.
-func (rtd *RefreshTokenDelete) Where(ps ...predicate.RefreshToken) *RefreshTokenDelete {
-	rtd.mutation.Where(ps...)
-	return rtd
+func (_d *RefreshTokenDelete) Where(ps ...predicate.RefreshToken) *RefreshTokenDelete {
+	_d.mutation.Where(ps...)
+	return _d
 }
 
 // Exec executes the deletion query and returns how many vertices were deleted.
-func (rtd *RefreshTokenDelete) Exec(ctx context.Context) (int, error) {
-	var (
-		err      error
-		affected int
-	)
-	if len(rtd.hooks) == 0 {
-		affected, err = rtd.sqlExec(ctx)
-	} else {
-		var mut Mutator = MutateFunc(func(ctx context.Context, m Mutation) (Value, error) {
-			mutation, ok := m.(*RefreshTokenMutation)
-			if !ok {
-				return nil, fmt.Errorf("unexpected mutation type %T", m)
-			}
-			rtd.mutation = mutation
-			affected, err = rtd.sqlExec(ctx)
-			mutation.done = true
-			return affected, err
-		})
-		for i := len(rtd.hooks) - 1; i >= 0; i-- {
-			if rtd.hooks[i] == nil {
-				return 0, fmt.Errorf("db: uninitialized hook (forgotten import db/runtime?)")
-			}
-			mut = rtd.hooks[i](mut)
-		}
-		if _, err := mut.Mutate(ctx, rtd.mutation); err != nil {
-			return 0, err
-		}
-	}
-	return affected, err
+func (_d *RefreshTokenDelete) Exec(ctx context.Context) (int, error) {
+	return withHooks(ctx, _d.sqlExec, _d.mutation, _d.hooks)
 }
 
 // ExecX is like Exec, but panics if an error occurs.
-func (rtd *RefreshTokenDelete) ExecX(ctx context.Context) int {
-	n, err := rtd.Exec(ctx)
+func (_d *RefreshTokenDelete) ExecX(ctx context.Context) int {
+	n, err := _d.Exec(ctx)
 	if err != nil {
 		panic(err)
 	}
 	return n
 }
 
-func (rtd *RefreshTokenDelete) sqlExec(ctx context.Context) (int, error) {
-	_spec := &sqlgraph.DeleteSpec{
-		Node: &sqlgraph.NodeSpec{
-			Table: refreshtoken.Table,
-			ID: &sqlgraph.FieldSpec{
-				Type:   field.TypeString,
-				Column: refreshtoken.FieldID,
-			},
-		},
-	}
-	if ps := rtd.mutation.predicates; len(ps) > 0 {
+func (_d *RefreshTokenDelete) sqlExec(ctx context.Context) (int, error) {
+	_spec := sqlgraph.NewDeleteSpec(refreshtoken.Table, sqlgraph.NewFieldSpec(refreshtoken.FieldID, field.TypeString))
+	if ps := _d.mutation.predicates; len(ps) > 0 {
 		_spec.Predicate = func(selector *sql.Selector) {
 			for i := range ps {
 				ps[i](selector)
 			}
 		}
 	}
-	affected, err := sqlgraph.DeleteNodes(ctx, rtd.driver, _spec)
+	affected, err := sqlgraph.DeleteNodes(ctx, _d.driver, _spec)
 	if err != nil && sqlgraph.IsConstraintError(err) {
 		err = &ConstraintError{msg: err.Error(), wrap: err}
 	}
+	_d.mutation.done = true
 	return affected, err
 }
 
 // RefreshTokenDeleteOne is the builder for deleting a single RefreshToken entity.
 type RefreshTokenDeleteOne struct {
-	rtd *RefreshTokenDelete
+	_d *RefreshTokenDelete
+}
+
+// Where appends a list predicates to the RefreshTokenDelete builder.
+func (_d *RefreshTokenDeleteOne) Where(ps ...predicate.RefreshToken) *RefreshTokenDeleteOne {
+	_d._d.mutation.Where(ps...)
+	return _d
 }
 
 // Exec executes the deletion query.
-func (rtdo *RefreshTokenDeleteOne) Exec(ctx context.Context) error {
-	n, err := rtdo.rtd.Exec(ctx)
+func (_d *RefreshTokenDeleteOne) Exec(ctx context.Context) error {
+	n, err := _d._d.Exec(ctx)
 	switch {
 	case err != nil:
 		return err
@@ -110,6 +81,8 @@ func (rtdo *RefreshTokenDeleteOne) Exec(ctx context.Context) error {
 }
 
 // ExecX is like Exec, but panics if an error occurs.
-func (rtdo *RefreshTokenDeleteOne) ExecX(ctx context.Context) {
-	rtdo.rtd.ExecX(ctx)
+func (_d *RefreshTokenDeleteOne) ExecX(ctx context.Context) {
+	if err := _d.Exec(ctx); err != nil {
+		panic(err)
+	}
 }
diff --git a/storage/ent/db/refreshtoken_query.go b/storage/ent/db/refreshtoken_query.go
index a90ac2f912..e6f399b0e1 100644
--- a/storage/ent/db/refreshtoken_query.go
+++ b/storage/ent/db/refreshtoken_query.go
@@ -7,6 +7,7 @@ import (
 	"fmt"
 	"math"
 
+	"entgo.io/ent"
 	"entgo.io/ent/dialect/sql"
 	"entgo.io/ent/dialect/sql/sqlgraph"
 	"entgo.io/ent/schema/field"
@@ -17,11 +18,9 @@ import (
 // RefreshTokenQuery is the builder for querying RefreshToken entities.
 type RefreshTokenQuery struct {
 	config
-	limit      *int
-	offset     *int
-	unique     *bool
-	order      []OrderFunc
-	fields     []string
+	ctx        *QueryContext
+	order      []refreshtoken.OrderOption
+	inters     []Interceptor
 	predicates []predicate.RefreshToken
 	// intermediate query (i.e. traversal path).
 	sql  *sql.Selector
@@ -29,40 +28,40 @@ type RefreshTokenQuery struct {
 }
 
 // Where adds a new predicate for the RefreshTokenQuery builder.
-func (rtq *RefreshTokenQuery) Where(ps ...predicate.RefreshToken) *RefreshTokenQuery {
-	rtq.predicates = append(rtq.predicates, ps...)
-	return rtq
+func (_q *RefreshTokenQuery) Where(ps ...predicate.RefreshToken) *RefreshTokenQuery {
+	_q.predicates = append(_q.predicates, ps...)
+	return _q
 }
 
-// Limit adds a limit step to the query.
-func (rtq *RefreshTokenQuery) Limit(limit int) *RefreshTokenQuery {
-	rtq.limit = &limit
-	return rtq
+// Limit the number of records to be returned by this query.
+func (_q *RefreshTokenQuery) Limit(limit int) *RefreshTokenQuery {
+	_q.ctx.Limit = &limit
+	return _q
 }
 
-// Offset adds an offset step to the query.
-func (rtq *RefreshTokenQuery) Offset(offset int) *RefreshTokenQuery {
-	rtq.offset = &offset
-	return rtq
+// Offset to start from.
+func (_q *RefreshTokenQuery) Offset(offset int) *RefreshTokenQuery {
+	_q.ctx.Offset = &offset
+	return _q
 }
 
 // Unique configures the query builder to filter duplicate records on query.
 // By default, unique is set to true, and can be disabled using this method.
-func (rtq *RefreshTokenQuery) Unique(unique bool) *RefreshTokenQuery {
-	rtq.unique = &unique
-	return rtq
+func (_q *RefreshTokenQuery) Unique(unique bool) *RefreshTokenQuery {
+	_q.ctx.Unique = &unique
+	return _q
 }
 
-// Order adds an order step to the query.
-func (rtq *RefreshTokenQuery) Order(o ...OrderFunc) *RefreshTokenQuery {
-	rtq.order = append(rtq.order, o...)
-	return rtq
+// Order specifies how the records should be ordered.
+func (_q *RefreshTokenQuery) Order(o ...refreshtoken.OrderOption) *RefreshTokenQuery {
+	_q.order = append(_q.order, o...)
+	return _q
 }
 
 // First returns the first RefreshToken entity from the query.
 // Returns a *NotFoundError when no RefreshToken was found.
-func (rtq *RefreshTokenQuery) First(ctx context.Context) (*RefreshToken, error) {
-	nodes, err := rtq.Limit(1).All(ctx)
+func (_q *RefreshTokenQuery) First(ctx context.Context) (*RefreshToken, error) {
+	nodes, err := _q.Limit(1).All(setContextOp(ctx, _q.ctx, ent.OpQueryFirst))
 	if err != nil {
 		return nil, err
 	}
@@ -73,8 +72,8 @@ func (rtq *RefreshTokenQuery) First(ctx context.Context) (*RefreshToken, error)
 }
 
 // FirstX is like First, but panics if an error occurs.
-func (rtq *RefreshTokenQuery) FirstX(ctx context.Context) *RefreshToken {
-	node, err := rtq.First(ctx)
+func (_q *RefreshTokenQuery) FirstX(ctx context.Context) *RefreshToken {
+	node, err := _q.First(ctx)
 	if err != nil && !IsNotFound(err) {
 		panic(err)
 	}
@@ -83,9 +82,9 @@ func (rtq *RefreshTokenQuery) FirstX(ctx context.Context) *RefreshToken {
 
 // FirstID returns the first RefreshToken ID from the query.
 // Returns a *NotFoundError when no RefreshToken ID was found.
-func (rtq *RefreshTokenQuery) FirstID(ctx context.Context) (id string, err error) {
+func (_q *RefreshTokenQuery) FirstID(ctx context.Context) (id string, err error) {
 	var ids []string
-	if ids, err = rtq.Limit(1).IDs(ctx); err != nil {
+	if ids, err = _q.Limit(1).IDs(setContextOp(ctx, _q.ctx, ent.OpQueryFirstID)); err != nil {
 		return
 	}
 	if len(ids) == 0 {
@@ -96,8 +95,8 @@ func (rtq *RefreshTokenQuery) FirstID(ctx context.Context) (id string, err error
 }
 
 // FirstIDX is like FirstID, but panics if an error occurs.
-func (rtq *RefreshTokenQuery) FirstIDX(ctx context.Context) string {
-	id, err := rtq.FirstID(ctx)
+func (_q *RefreshTokenQuery) FirstIDX(ctx context.Context) string {
+	id, err := _q.FirstID(ctx)
 	if err != nil && !IsNotFound(err) {
 		panic(err)
 	}
@@ -107,8 +106,8 @@ func (rtq *RefreshTokenQuery) FirstIDX(ctx context.Context) string {
 // Only returns a single RefreshToken entity found by the query, ensuring it only returns one.
 // Returns a *NotSingularError when more than one RefreshToken entity is found.
 // Returns a *NotFoundError when no RefreshToken entities are found.
-func (rtq *RefreshTokenQuery) Only(ctx context.Context) (*RefreshToken, error) {
-	nodes, err := rtq.Limit(2).All(ctx)
+func (_q *RefreshTokenQuery) Only(ctx context.Context) (*RefreshToken, error) {
+	nodes, err := _q.Limit(2).All(setContextOp(ctx, _q.ctx, ent.OpQueryOnly))
 	if err != nil {
 		return nil, err
 	}
@@ -123,8 +122,8 @@ func (rtq *RefreshTokenQuery) Only(ctx context.Context) (*RefreshToken, error) {
 }
 
 // OnlyX is like Only, but panics if an error occurs.
-func (rtq *RefreshTokenQuery) OnlyX(ctx context.Context) *RefreshToken {
-	node, err := rtq.Only(ctx)
+func (_q *RefreshTokenQuery) OnlyX(ctx context.Context) *RefreshToken {
+	node, err := _q.Only(ctx)
 	if err != nil {
 		panic(err)
 	}
@@ -134,9 +133,9 @@ func (rtq *RefreshTokenQuery) OnlyX(ctx context.Context) *RefreshToken {
 // OnlyID is like Only, but returns the only RefreshToken ID in the query.
 // Returns a *NotSingularError when more than one RefreshToken ID is found.
 // Returns a *NotFoundError when no entities are found.
-func (rtq *RefreshTokenQuery) OnlyID(ctx context.Context) (id string, err error) {
+func (_q *RefreshTokenQuery) OnlyID(ctx context.Context) (id string, err error) {
 	var ids []string
-	if ids, err = rtq.Limit(2).IDs(ctx); err != nil {
+	if ids, err = _q.Limit(2).IDs(setContextOp(ctx, _q.ctx, ent.OpQueryOnlyID)); err != nil {
 		return
 	}
 	switch len(ids) {
@@ -151,8 +150,8 @@ func (rtq *RefreshTokenQuery) OnlyID(ctx context.Context) (id string, err error)
 }
 
 // OnlyIDX is like OnlyID, but panics if an error occurs.
-func (rtq *RefreshTokenQuery) OnlyIDX(ctx context.Context) string {
-	id, err := rtq.OnlyID(ctx)
+func (_q *RefreshTokenQuery) OnlyIDX(ctx context.Context) string {
+	id, err := _q.OnlyID(ctx)
 	if err != nil {
 		panic(err)
 	}
@@ -160,16 +159,18 @@ func (rtq *RefreshTokenQuery) OnlyIDX(ctx context.Context) string {
 }
 
 // All executes the query and returns a list of RefreshTokens.
-func (rtq *RefreshTokenQuery) All(ctx context.Context) ([]*RefreshToken, error) {
-	if err := rtq.prepareQuery(ctx); err != nil {
+func (_q *RefreshTokenQuery) All(ctx context.Context) ([]*RefreshToken, error) {
+	ctx = setContextOp(ctx, _q.ctx, ent.OpQueryAll)
+	if err := _q.prepareQuery(ctx); err != nil {
 		return nil, err
 	}
-	return rtq.sqlAll(ctx)
+	qr := querierAll[[]*RefreshToken, *RefreshTokenQuery]()
+	return withInterceptors[[]*RefreshToken](ctx, _q, qr, _q.inters)
 }
 
 // AllX is like All, but panics if an error occurs.
-func (rtq *RefreshTokenQuery) AllX(ctx context.Context) []*RefreshToken {
-	nodes, err := rtq.All(ctx)
+func (_q *RefreshTokenQuery) AllX(ctx context.Context) []*RefreshToken {
+	nodes, err := _q.All(ctx)
 	if err != nil {
 		panic(err)
 	}
@@ -177,17 +178,20 @@ func (rtq *RefreshTokenQuery) AllX(ctx context.Context) []*RefreshToken {
 }
 
 // IDs executes the query and returns a list of RefreshToken IDs.
-func (rtq *RefreshTokenQuery) IDs(ctx context.Context) ([]string, error) {
-	var ids []string
-	if err := rtq.Select(refreshtoken.FieldID).Scan(ctx, &ids); err != nil {
+func (_q *RefreshTokenQuery) IDs(ctx context.Context) (ids []string, err error) {
+	if _q.ctx.Unique == nil && _q.path != nil {
+		_q.Unique(true)
+	}
+	ctx = setContextOp(ctx, _q.ctx, ent.OpQueryIDs)
+	if err = _q.Select(refreshtoken.FieldID).Scan(ctx, &ids); err != nil {
 		return nil, err
 	}
 	return ids, nil
 }
 
 // IDsX is like IDs, but panics if an error occurs.
-func (rtq *RefreshTokenQuery) IDsX(ctx context.Context) []string {
-	ids, err := rtq.IDs(ctx)
+func (_q *RefreshTokenQuery) IDsX(ctx context.Context) []string {
+	ids, err := _q.IDs(ctx)
 	if err != nil {
 		panic(err)
 	}
@@ -195,16 +199,17 @@ func (rtq *RefreshTokenQuery) IDsX(ctx context.Context) []string {
 }
 
 // Count returns the count of the given query.
-func (rtq *RefreshTokenQuery) Count(ctx context.Context) (int, error) {
-	if err := rtq.prepareQuery(ctx); err != nil {
+func (_q *RefreshTokenQuery) Count(ctx context.Context) (int, error) {
+	ctx = setContextOp(ctx, _q.ctx, ent.OpQueryCount)
+	if err := _q.prepareQuery(ctx); err != nil {
 		return 0, err
 	}
-	return rtq.sqlCount(ctx)
+	return withInterceptors[int](ctx, _q, querierCount[*RefreshTokenQuery](), _q.inters)
 }
 
 // CountX is like Count, but panics if an error occurs.
-func (rtq *RefreshTokenQuery) CountX(ctx context.Context) int {
-	count, err := rtq.Count(ctx)
+func (_q *RefreshTokenQuery) CountX(ctx context.Context) int {
+	count, err := _q.Count(ctx)
 	if err != nil {
 		panic(err)
 	}
@@ -212,16 +217,21 @@ func (rtq *RefreshTokenQuery) CountX(ctx context.Context) int {
 }
 
 // Exist returns true if the query has elements in the graph.
-func (rtq *RefreshTokenQuery) Exist(ctx context.Context) (bool, error) {
-	if err := rtq.prepareQuery(ctx); err != nil {
-		return false, err
+func (_q *RefreshTokenQuery) Exist(ctx context.Context) (bool, error) {
+	ctx = setContextOp(ctx, _q.ctx, ent.OpQueryExist)
+	switch _, err := _q.FirstID(ctx); {
+	case IsNotFound(err):
+		return false, nil
+	case err != nil:
+		return false, fmt.Errorf("db: check existence: %w", err)
+	default:
+		return true, nil
 	}
-	return rtq.sqlExist(ctx)
 }
 
 // ExistX is like Exist, but panics if an error occurs.
-func (rtq *RefreshTokenQuery) ExistX(ctx context.Context) bool {
-	exist, err := rtq.Exist(ctx)
+func (_q *RefreshTokenQuery) ExistX(ctx context.Context) bool {
+	exist, err := _q.Exist(ctx)
 	if err != nil {
 		panic(err)
 	}
@@ -230,20 +240,19 @@ func (rtq *RefreshTokenQuery) ExistX(ctx context.Context) bool {
 
 // Clone returns a duplicate of the RefreshTokenQuery builder, including all associated steps. It can be
 // used to prepare common query builders and use them differently after the clone is made.
-func (rtq *RefreshTokenQuery) Clone() *RefreshTokenQuery {
-	if rtq == nil {
+func (_q *RefreshTokenQuery) Clone() *RefreshTokenQuery {
+	if _q == nil {
 		return nil
 	}
 	return &RefreshTokenQuery{
-		config:     rtq.config,
-		limit:      rtq.limit,
-		offset:     rtq.offset,
-		order:      append([]OrderFunc{}, rtq.order...),
-		predicates: append([]predicate.RefreshToken{}, rtq.predicates...),
+		config:     _q.config,
+		ctx:        _q.ctx.Clone(),
+		order:      append([]refreshtoken.OrderOption{}, _q.order...),
+		inters:     append([]Interceptor{}, _q.inters...),
+		predicates: append([]predicate.RefreshToken{}, _q.predicates...),
 		// clone intermediate query.
-		sql:    rtq.sql.Clone(),
-		path:   rtq.path,
-		unique: rtq.unique,
+		sql:  _q.sql.Clone(),
+		path: _q.path,
 	}
 }
 
@@ -261,18 +270,12 @@ func (rtq *RefreshTokenQuery) Clone() *RefreshTokenQuery {
 //		GroupBy(refreshtoken.FieldClientID).
 //		Aggregate(db.Count()).
 //		Scan(ctx, &v)
-//
-func (rtq *RefreshTokenQuery) GroupBy(field string, fields ...string) *RefreshTokenGroupBy {
-	grbuild := &RefreshTokenGroupBy{config: rtq.config}
-	grbuild.fields = append([]string{field}, fields...)
-	grbuild.path = func(ctx context.Context) (prev *sql.Selector, err error) {
-		if err := rtq.prepareQuery(ctx); err != nil {
-			return nil, err
-		}
-		return rtq.sqlQuery(ctx), nil
-	}
+func (_q *RefreshTokenQuery) GroupBy(field string, fields ...string) *RefreshTokenGroupBy {
+	_q.ctx.Fields = append([]string{field}, fields...)
+	grbuild := &RefreshTokenGroupBy{build: _q}
+	grbuild.flds = &_q.ctx.Fields
 	grbuild.label = refreshtoken.Label
-	grbuild.flds, grbuild.scan = &grbuild.fields, grbuild.Scan
+	grbuild.scan = grbuild.Scan
 	return grbuild
 }
 
@@ -288,48 +291,62 @@ func (rtq *RefreshTokenQuery) GroupBy(field string, fields ...string) *RefreshTo
 //	client.RefreshToken.Query().
 //		Select(refreshtoken.FieldClientID).
 //		Scan(ctx, &v)
-//
-func (rtq *RefreshTokenQuery) Select(fields ...string) *RefreshTokenSelect {
-	rtq.fields = append(rtq.fields, fields...)
-	selbuild := &RefreshTokenSelect{RefreshTokenQuery: rtq}
-	selbuild.label = refreshtoken.Label
-	selbuild.flds, selbuild.scan = &rtq.fields, selbuild.Scan
-	return selbuild
+func (_q *RefreshTokenQuery) Select(fields ...string) *RefreshTokenSelect {
+	_q.ctx.Fields = append(_q.ctx.Fields, fields...)
+	sbuild := &RefreshTokenSelect{RefreshTokenQuery: _q}
+	sbuild.label = refreshtoken.Label
+	sbuild.flds, sbuild.scan = &_q.ctx.Fields, sbuild.Scan
+	return sbuild
+}
+
+// Aggregate returns a RefreshTokenSelect configured with the given aggregations.
+func (_q *RefreshTokenQuery) Aggregate(fns ...AggregateFunc) *RefreshTokenSelect {
+	return _q.Select().Aggregate(fns...)
 }
 
-func (rtq *RefreshTokenQuery) prepareQuery(ctx context.Context) error {
-	for _, f := range rtq.fields {
+func (_q *RefreshTokenQuery) prepareQuery(ctx context.Context) error {
+	for _, inter := range _q.inters {
+		if inter == nil {
+			return fmt.Errorf("db: uninitialized interceptor (forgotten import db/runtime?)")
+		}
+		if trv, ok := inter.(Traverser); ok {
+			if err := trv.Traverse(ctx, _q); err != nil {
+				return err
+			}
+		}
+	}
+	for _, f := range _q.ctx.Fields {
 		if !refreshtoken.ValidColumn(f) {
 			return &ValidationError{Name: f, err: fmt.Errorf("db: invalid field %q for query", f)}
 		}
 	}
-	if rtq.path != nil {
-		prev, err := rtq.path(ctx)
+	if _q.path != nil {
+		prev, err := _q.path(ctx)
 		if err != nil {
 			return err
 		}
-		rtq.sql = prev
+		_q.sql = prev
 	}
 	return nil
 }
 
-func (rtq *RefreshTokenQuery) sqlAll(ctx context.Context, hooks ...queryHook) ([]*RefreshToken, error) {
+func (_q *RefreshTokenQuery) sqlAll(ctx context.Context, hooks ...queryHook) ([]*RefreshToken, error) {
 	var (
 		nodes = []*RefreshToken{}
-		_spec = rtq.querySpec()
+		_spec = _q.querySpec()
 	)
-	_spec.ScanValues = func(columns []string) ([]interface{}, error) {
+	_spec.ScanValues = func(columns []string) ([]any, error) {
 		return (*RefreshToken).scanValues(nil, columns)
 	}
-	_spec.Assign = func(columns []string, values []interface{}) error {
-		node := &RefreshToken{config: rtq.config}
+	_spec.Assign = func(columns []string, values []any) error {
+		node := &RefreshToken{config: _q.config}
 		nodes = append(nodes, node)
 		return node.assignValues(columns, values)
 	}
 	for i := range hooks {
 		hooks[i](ctx, _spec)
 	}
-	if err := sqlgraph.QueryNodes(ctx, rtq.driver, _spec); err != nil {
+	if err := sqlgraph.QueryNodes(ctx, _q.driver, _spec); err != nil {
 		return nil, err
 	}
 	if len(nodes) == 0 {
@@ -338,40 +355,24 @@ func (rtq *RefreshTokenQuery) sqlAll(ctx context.Context, hooks ...queryHook) ([
 	return nodes, nil
 }
 
-func (rtq *RefreshTokenQuery) sqlCount(ctx context.Context) (int, error) {
-	_spec := rtq.querySpec()
-	_spec.Node.Columns = rtq.fields
-	if len(rtq.fields) > 0 {
-		_spec.Unique = rtq.unique != nil && *rtq.unique
-	}
-	return sqlgraph.CountNodes(ctx, rtq.driver, _spec)
-}
-
-func (rtq *RefreshTokenQuery) sqlExist(ctx context.Context) (bool, error) {
-	n, err := rtq.sqlCount(ctx)
-	if err != nil {
-		return false, fmt.Errorf("db: check existence: %w", err)
+func (_q *RefreshTokenQuery) sqlCount(ctx context.Context) (int, error) {
+	_spec := _q.querySpec()
+	_spec.Node.Columns = _q.ctx.Fields
+	if len(_q.ctx.Fields) > 0 {
+		_spec.Unique = _q.ctx.Unique != nil && *_q.ctx.Unique
 	}
-	return n > 0, nil
+	return sqlgraph.CountNodes(ctx, _q.driver, _spec)
 }
 
-func (rtq *RefreshTokenQuery) querySpec() *sqlgraph.QuerySpec {
-	_spec := &sqlgraph.QuerySpec{
-		Node: &sqlgraph.NodeSpec{
-			Table:   refreshtoken.Table,
-			Columns: refreshtoken.Columns,
-			ID: &sqlgraph.FieldSpec{
-				Type:   field.TypeString,
-				Column: refreshtoken.FieldID,
-			},
-		},
-		From:   rtq.sql,
-		Unique: true,
-	}
-	if unique := rtq.unique; unique != nil {
+func (_q *RefreshTokenQuery) querySpec() *sqlgraph.QuerySpec {
+	_spec := sqlgraph.NewQuerySpec(refreshtoken.Table, refreshtoken.Columns, sqlgraph.NewFieldSpec(refreshtoken.FieldID, field.TypeString))
+	_spec.From = _q.sql
+	if unique := _q.ctx.Unique; unique != nil {
 		_spec.Unique = *unique
+	} else if _q.path != nil {
+		_spec.Unique = true
 	}
-	if fields := rtq.fields; len(fields) > 0 {
+	if fields := _q.ctx.Fields; len(fields) > 0 {
 		_spec.Node.Columns = make([]string, 0, len(fields))
 		_spec.Node.Columns = append(_spec.Node.Columns, refreshtoken.FieldID)
 		for i := range fields {
@@ -380,20 +381,20 @@ func (rtq *RefreshTokenQuery) querySpec() *sqlgraph.QuerySpec {
 			}
 		}
 	}
-	if ps := rtq.predicates; len(ps) > 0 {
+	if ps := _q.predicates; len(ps) > 0 {
 		_spec.Predicate = func(selector *sql.Selector) {
 			for i := range ps {
 				ps[i](selector)
 			}
 		}
 	}
-	if limit := rtq.limit; limit != nil {
+	if limit := _q.ctx.Limit; limit != nil {
 		_spec.Limit = *limit
 	}
-	if offset := rtq.offset; offset != nil {
+	if offset := _q.ctx.Offset; offset != nil {
 		_spec.Offset = *offset
 	}
-	if ps := rtq.order; len(ps) > 0 {
+	if ps := _q.order; len(ps) > 0 {
 		_spec.Order = func(selector *sql.Selector) {
 			for i := range ps {
 				ps[i](selector)
@@ -403,33 +404,33 @@ func (rtq *RefreshTokenQuery) querySpec() *sqlgraph.QuerySpec {
 	return _spec
 }
 
-func (rtq *RefreshTokenQuery) sqlQuery(ctx context.Context) *sql.Selector {
-	builder := sql.Dialect(rtq.driver.Dialect())
+func (_q *RefreshTokenQuery) sqlQuery(ctx context.Context) *sql.Selector {
+	builder := sql.Dialect(_q.driver.Dialect())
 	t1 := builder.Table(refreshtoken.Table)
-	columns := rtq.fields
+	columns := _q.ctx.Fields
 	if len(columns) == 0 {
 		columns = refreshtoken.Columns
 	}
 	selector := builder.Select(t1.Columns(columns...)...).From(t1)
-	if rtq.sql != nil {
-		selector = rtq.sql
+	if _q.sql != nil {
+		selector = _q.sql
 		selector.Select(selector.Columns(columns...)...)
 	}
-	if rtq.unique != nil && *rtq.unique {
+	if _q.ctx.Unique != nil && *_q.ctx.Unique {
 		selector.Distinct()
 	}
-	for _, p := range rtq.predicates {
+	for _, p := range _q.predicates {
 		p(selector)
 	}
-	for _, p := range rtq.order {
+	for _, p := range _q.order {
 		p(selector)
 	}
-	if offset := rtq.offset; offset != nil {
+	if offset := _q.ctx.Offset; offset != nil {
 		// limit is mandatory for offset clause. We start
 		// with default value, and override it below if needed.
 		selector.Offset(*offset).Limit(math.MaxInt32)
 	}
-	if limit := rtq.limit; limit != nil {
+	if limit := _q.ctx.Limit; limit != nil {
 		selector.Limit(*limit)
 	}
 	return selector
@@ -437,90 +438,88 @@ func (rtq *RefreshTokenQuery) sqlQuery(ctx context.Context) *sql.Selector {
 
 // RefreshTokenGroupBy is the group-by builder for RefreshToken entities.
 type RefreshTokenGroupBy struct {
-	config
 	selector
-	fields []string
-	fns    []AggregateFunc
-	// intermediate query (i.e. traversal path).
-	sql  *sql.Selector
-	path func(context.Context) (*sql.Selector, error)
+	build *RefreshTokenQuery
 }
 
 // Aggregate adds the given aggregation functions to the group-by query.
-func (rtgb *RefreshTokenGroupBy) Aggregate(fns ...AggregateFunc) *RefreshTokenGroupBy {
-	rtgb.fns = append(rtgb.fns, fns...)
-	return rtgb
+func (_g *RefreshTokenGroupBy) Aggregate(fns ...AggregateFunc) *RefreshTokenGroupBy {
+	_g.fns = append(_g.fns, fns...)
+	return _g
 }
 
-// Scan applies the group-by query and scans the result into the given value.
-func (rtgb *RefreshTokenGroupBy) Scan(ctx context.Context, v interface{}) error {
-	query, err := rtgb.path(ctx)
-	if err != nil {
+// Scan applies the selector query and scans the result into the given value.
+func (_g *RefreshTokenGroupBy) Scan(ctx context.Context, v any) error {
+	ctx = setContextOp(ctx, _g.build.ctx, ent.OpQueryGroupBy)
+	if err := _g.build.prepareQuery(ctx); err != nil {
 		return err
 	}
-	rtgb.sql = query
-	return rtgb.sqlScan(ctx, v)
+	return scanWithInterceptors[*RefreshTokenQuery, *RefreshTokenGroupBy](ctx, _g.build, _g, _g.build.inters, v)
 }
 
-func (rtgb *RefreshTokenGroupBy) sqlScan(ctx context.Context, v interface{}) error {
-	for _, f := range rtgb.fields {
-		if !refreshtoken.ValidColumn(f) {
-			return &ValidationError{Name: f, err: fmt.Errorf("invalid field %q for group-by", f)}
+func (_g *RefreshTokenGroupBy) sqlScan(ctx context.Context, root *RefreshTokenQuery, v any) error {
+	selector := root.sqlQuery(ctx).Select()
+	aggregation := make([]string, 0, len(_g.fns))
+	for _, fn := range _g.fns {
+		aggregation = append(aggregation, fn(selector))
+	}
+	if len(selector.SelectedColumns()) == 0 {
+		columns := make([]string, 0, len(*_g.flds)+len(_g.fns))
+		for _, f := range *_g.flds {
+			columns = append(columns, selector.C(f))
 		}
+		columns = append(columns, aggregation...)
+		selector.Select(columns...)
 	}
-	selector := rtgb.sqlQuery()
+	selector.GroupBy(selector.Columns(*_g.flds...)...)
 	if err := selector.Err(); err != nil {
 		return err
 	}
 	rows := &sql.Rows{}
 	query, args := selector.Query()
-	if err := rtgb.driver.Query(ctx, query, args, rows); err != nil {
+	if err := _g.build.driver.Query(ctx, query, args, rows); err != nil {
 		return err
 	}
 	defer rows.Close()
 	return sql.ScanSlice(rows, v)
 }
 
-func (rtgb *RefreshTokenGroupBy) sqlQuery() *sql.Selector {
-	selector := rtgb.sql.Select()
-	aggregation := make([]string, 0, len(rtgb.fns))
-	for _, fn := range rtgb.fns {
-		aggregation = append(aggregation, fn(selector))
-	}
-	// If no columns were selected in a custom aggregation function, the default
-	// selection is the fields used for "group-by", and the aggregation functions.
-	if len(selector.SelectedColumns()) == 0 {
-		columns := make([]string, 0, len(rtgb.fields)+len(rtgb.fns))
-		for _, f := range rtgb.fields {
-			columns = append(columns, selector.C(f))
-		}
-		columns = append(columns, aggregation...)
-		selector.Select(columns...)
-	}
-	return selector.GroupBy(selector.Columns(rtgb.fields...)...)
-}
-
 // RefreshTokenSelect is the builder for selecting fields of RefreshToken entities.
 type RefreshTokenSelect struct {
 	*RefreshTokenQuery
 	selector
-	// intermediate query (i.e. traversal path).
-	sql *sql.Selector
+}
+
+// Aggregate adds the given aggregation functions to the selector query.
+func (_s *RefreshTokenSelect) Aggregate(fns ...AggregateFunc) *RefreshTokenSelect {
+	_s.fns = append(_s.fns, fns...)
+	return _s
 }
 
 // Scan applies the selector query and scans the result into the given value.
-func (rts *RefreshTokenSelect) Scan(ctx context.Context, v interface{}) error {
-	if err := rts.prepareQuery(ctx); err != nil {
+func (_s *RefreshTokenSelect) Scan(ctx context.Context, v any) error {
+	ctx = setContextOp(ctx, _s.ctx, ent.OpQuerySelect)
+	if err := _s.prepareQuery(ctx); err != nil {
 		return err
 	}
-	rts.sql = rts.RefreshTokenQuery.sqlQuery(ctx)
-	return rts.sqlScan(ctx, v)
+	return scanWithInterceptors[*RefreshTokenQuery, *RefreshTokenSelect](ctx, _s.RefreshTokenQuery, _s, _s.inters, v)
 }
 
-func (rts *RefreshTokenSelect) sqlScan(ctx context.Context, v interface{}) error {
+func (_s *RefreshTokenSelect) sqlScan(ctx context.Context, root *RefreshTokenQuery, v any) error {
+	selector := root.sqlQuery(ctx)
+	aggregation := make([]string, 0, len(_s.fns))
+	for _, fn := range _s.fns {
+		aggregation = append(aggregation, fn(selector))
+	}
+	switch n := len(*_s.selector.flds); {
+	case n == 0 && len(aggregation) > 0:
+		selector.Select(aggregation...)
+	case n != 0 && len(aggregation) > 0:
+		selector.AppendSelect(aggregation...)
+	}
 	rows := &sql.Rows{}
-	query, args := rts.sql.Query()
-	if err := rts.driver.Query(ctx, query, args, rows); err != nil {
+	query, args := selector.Query()
+	if err := _s.driver.Query(ctx, query, args, rows); err != nil {
 		return err
 	}
 	defer rows.Close()
diff --git a/storage/ent/db/refreshtoken_update.go b/storage/ent/db/refreshtoken_update.go
index 6c11c7f73c..cdf8cee86e 100644
--- a/storage/ent/db/refreshtoken_update.go
+++ b/storage/ent/db/refreshtoken_update.go
@@ -10,6 +10,7 @@ import (
 
 	"entgo.io/ent/dialect/sql"
 	"entgo.io/ent/dialect/sql/sqlgraph"
+	"entgo.io/ent/dialect/sql/sqljson"
 	"entgo.io/ent/schema/field"
 	"github.com/dexidp/dex/storage/ent/db/predicate"
 	"github.com/dexidp/dex/storage/ent/db/refreshtoken"
@@ -23,205 +24,240 @@ type RefreshTokenUpdate struct {
 }
 
 // Where appends a list predicates to the RefreshTokenUpdate builder.
-func (rtu *RefreshTokenUpdate) Where(ps ...predicate.RefreshToken) *RefreshTokenUpdate {
-	rtu.mutation.Where(ps...)
-	return rtu
+func (_u *RefreshTokenUpdate) Where(ps ...predicate.RefreshToken) *RefreshTokenUpdate {
+	_u.mutation.Where(ps...)
+	return _u
 }
 
 // SetClientID sets the "client_id" field.
-func (rtu *RefreshTokenUpdate) SetClientID(s string) *RefreshTokenUpdate {
-	rtu.mutation.SetClientID(s)
-	return rtu
+func (_u *RefreshTokenUpdate) SetClientID(v string) *RefreshTokenUpdate {
+	_u.mutation.SetClientID(v)
+	return _u
+}
+
+// SetNillableClientID sets the "client_id" field if the given value is not nil.
+func (_u *RefreshTokenUpdate) SetNillableClientID(v *string) *RefreshTokenUpdate {
+	if v != nil {
+		_u.SetClientID(*v)
+	}
+	return _u
 }
 
 // SetScopes sets the "scopes" field.
-func (rtu *RefreshTokenUpdate) SetScopes(s []string) *RefreshTokenUpdate {
-	rtu.mutation.SetScopes(s)
-	return rtu
+func (_u *RefreshTokenUpdate) SetScopes(v []string) *RefreshTokenUpdate {
+	_u.mutation.SetScopes(v)
+	return _u
+}
+
+// AppendScopes appends value to the "scopes" field.
+func (_u *RefreshTokenUpdate) AppendScopes(v []string) *RefreshTokenUpdate {
+	_u.mutation.AppendScopes(v)
+	return _u
 }
 
 // ClearScopes clears the value of the "scopes" field.
-func (rtu *RefreshTokenUpdate) ClearScopes() *RefreshTokenUpdate {
-	rtu.mutation.ClearScopes()
-	return rtu
+func (_u *RefreshTokenUpdate) ClearScopes() *RefreshTokenUpdate {
+	_u.mutation.ClearScopes()
+	return _u
 }
 
 // SetNonce sets the "nonce" field.
-func (rtu *RefreshTokenUpdate) SetNonce(s string) *RefreshTokenUpdate {
-	rtu.mutation.SetNonce(s)
-	return rtu
+func (_u *RefreshTokenUpdate) SetNonce(v string) *RefreshTokenUpdate {
+	_u.mutation.SetNonce(v)
+	return _u
+}
+
+// SetNillableNonce sets the "nonce" field if the given value is not nil.
+func (_u *RefreshTokenUpdate) SetNillableNonce(v *string) *RefreshTokenUpdate {
+	if v != nil {
+		_u.SetNonce(*v)
+	}
+	return _u
 }
 
 // SetClaimsUserID sets the "claims_user_id" field.
-func (rtu *RefreshTokenUpdate) SetClaimsUserID(s string) *RefreshTokenUpdate {
-	rtu.mutation.SetClaimsUserID(s)
-	return rtu
+func (_u *RefreshTokenUpdate) SetClaimsUserID(v string) *RefreshTokenUpdate {
+	_u.mutation.SetClaimsUserID(v)
+	return _u
+}
+
+// SetNillableClaimsUserID sets the "claims_user_id" field if the given value is not nil.
+func (_u *RefreshTokenUpdate) SetNillableClaimsUserID(v *string) *RefreshTokenUpdate {
+	if v != nil {
+		_u.SetClaimsUserID(*v)
+	}
+	return _u
 }
 
 // SetClaimsUsername sets the "claims_username" field.
-func (rtu *RefreshTokenUpdate) SetClaimsUsername(s string) *RefreshTokenUpdate {
-	rtu.mutation.SetClaimsUsername(s)
-	return rtu
+func (_u *RefreshTokenUpdate) SetClaimsUsername(v string) *RefreshTokenUpdate {
+	_u.mutation.SetClaimsUsername(v)
+	return _u
+}
+
+// SetNillableClaimsUsername sets the "claims_username" field if the given value is not nil.
+func (_u *RefreshTokenUpdate) SetNillableClaimsUsername(v *string) *RefreshTokenUpdate {
+	if v != nil {
+		_u.SetClaimsUsername(*v)
+	}
+	return _u
 }
 
 // SetClaimsEmail sets the "claims_email" field.
-func (rtu *RefreshTokenUpdate) SetClaimsEmail(s string) *RefreshTokenUpdate {
-	rtu.mutation.SetClaimsEmail(s)
-	return rtu
+func (_u *RefreshTokenUpdate) SetClaimsEmail(v string) *RefreshTokenUpdate {
+	_u.mutation.SetClaimsEmail(v)
+	return _u
+}
+
+// SetNillableClaimsEmail sets the "claims_email" field if the given value is not nil.
+func (_u *RefreshTokenUpdate) SetNillableClaimsEmail(v *string) *RefreshTokenUpdate {
+	if v != nil {
+		_u.SetClaimsEmail(*v)
+	}
+	return _u
 }
 
 // SetClaimsEmailVerified sets the "claims_email_verified" field.
-func (rtu *RefreshTokenUpdate) SetClaimsEmailVerified(b bool) *RefreshTokenUpdate {
-	rtu.mutation.SetClaimsEmailVerified(b)
-	return rtu
+func (_u *RefreshTokenUpdate) SetClaimsEmailVerified(v bool) *RefreshTokenUpdate {
+	_u.mutation.SetClaimsEmailVerified(v)
+	return _u
+}
+
+// SetNillableClaimsEmailVerified sets the "claims_email_verified" field if the given value is not nil.
+func (_u *RefreshTokenUpdate) SetNillableClaimsEmailVerified(v *bool) *RefreshTokenUpdate {
+	if v != nil {
+		_u.SetClaimsEmailVerified(*v)
+	}
+	return _u
 }
 
 // SetClaimsGroups sets the "claims_groups" field.
-func (rtu *RefreshTokenUpdate) SetClaimsGroups(s []string) *RefreshTokenUpdate {
-	rtu.mutation.SetClaimsGroups(s)
-	return rtu
+func (_u *RefreshTokenUpdate) SetClaimsGroups(v []string) *RefreshTokenUpdate {
+	_u.mutation.SetClaimsGroups(v)
+	return _u
+}
+
+// AppendClaimsGroups appends value to the "claims_groups" field.
+func (_u *RefreshTokenUpdate) AppendClaimsGroups(v []string) *RefreshTokenUpdate {
+	_u.mutation.AppendClaimsGroups(v)
+	return _u
 }
 
 // ClearClaimsGroups clears the value of the "claims_groups" field.
-func (rtu *RefreshTokenUpdate) ClearClaimsGroups() *RefreshTokenUpdate {
-	rtu.mutation.ClearClaimsGroups()
-	return rtu
+func (_u *RefreshTokenUpdate) ClearClaimsGroups() *RefreshTokenUpdate {
+	_u.mutation.ClearClaimsGroups()
+	return _u
 }
 
 // SetClaimsPreferredUsername sets the "claims_preferred_username" field.
-func (rtu *RefreshTokenUpdate) SetClaimsPreferredUsername(s string) *RefreshTokenUpdate {
-	rtu.mutation.SetClaimsPreferredUsername(s)
-	return rtu
+func (_u *RefreshTokenUpdate) SetClaimsPreferredUsername(v string) *RefreshTokenUpdate {
+	_u.mutation.SetClaimsPreferredUsername(v)
+	return _u
 }
 
 // SetNillableClaimsPreferredUsername sets the "claims_preferred_username" field if the given value is not nil.
-func (rtu *RefreshTokenUpdate) SetNillableClaimsPreferredUsername(s *string) *RefreshTokenUpdate {
-	if s != nil {
-		rtu.SetClaimsPreferredUsername(*s)
+func (_u *RefreshTokenUpdate) SetNillableClaimsPreferredUsername(v *string) *RefreshTokenUpdate {
+	if v != nil {
+		_u.SetClaimsPreferredUsername(*v)
 	}
-	return rtu
+	return _u
 }
 
 // SetConnectorID sets the "connector_id" field.
-func (rtu *RefreshTokenUpdate) SetConnectorID(s string) *RefreshTokenUpdate {
-	rtu.mutation.SetConnectorID(s)
-	return rtu
+func (_u *RefreshTokenUpdate) SetConnectorID(v string) *RefreshTokenUpdate {
+	_u.mutation.SetConnectorID(v)
+	return _u
+}
+
+// SetNillableConnectorID sets the "connector_id" field if the given value is not nil.
+func (_u *RefreshTokenUpdate) SetNillableConnectorID(v *string) *RefreshTokenUpdate {
+	if v != nil {
+		_u.SetConnectorID(*v)
+	}
+	return _u
 }
 
 // SetConnectorData sets the "connector_data" field.
-func (rtu *RefreshTokenUpdate) SetConnectorData(b []byte) *RefreshTokenUpdate {
-	rtu.mutation.SetConnectorData(b)
-	return rtu
+func (_u *RefreshTokenUpdate) SetConnectorData(v []byte) *RefreshTokenUpdate {
+	_u.mutation.SetConnectorData(v)
+	return _u
 }
 
 // ClearConnectorData clears the value of the "connector_data" field.
-func (rtu *RefreshTokenUpdate) ClearConnectorData() *RefreshTokenUpdate {
-	rtu.mutation.ClearConnectorData()
-	return rtu
+func (_u *RefreshTokenUpdate) ClearConnectorData() *RefreshTokenUpdate {
+	_u.mutation.ClearConnectorData()
+	return _u
 }
 
 // SetToken sets the "token" field.
-func (rtu *RefreshTokenUpdate) SetToken(s string) *RefreshTokenUpdate {
-	rtu.mutation.SetToken(s)
-	return rtu
+func (_u *RefreshTokenUpdate) SetToken(v string) *RefreshTokenUpdate {
+	_u.mutation.SetToken(v)
+	return _u
 }
 
 // SetNillableToken sets the "token" field if the given value is not nil.
-func (rtu *RefreshTokenUpdate) SetNillableToken(s *string) *RefreshTokenUpdate {
-	if s != nil {
-		rtu.SetToken(*s)
+func (_u *RefreshTokenUpdate) SetNillableToken(v *string) *RefreshTokenUpdate {
+	if v != nil {
+		_u.SetToken(*v)
 	}
-	return rtu
+	return _u
 }
 
 // SetObsoleteToken sets the "obsolete_token" field.
-func (rtu *RefreshTokenUpdate) SetObsoleteToken(s string) *RefreshTokenUpdate {
-	rtu.mutation.SetObsoleteToken(s)
-	return rtu
+func (_u *RefreshTokenUpdate) SetObsoleteToken(v string) *RefreshTokenUpdate {
+	_u.mutation.SetObsoleteToken(v)
+	return _u
 }
 
 // SetNillableObsoleteToken sets the "obsolete_token" field if the given value is not nil.
-func (rtu *RefreshTokenUpdate) SetNillableObsoleteToken(s *string) *RefreshTokenUpdate {
-	if s != nil {
-		rtu.SetObsoleteToken(*s)
+func (_u *RefreshTokenUpdate) SetNillableObsoleteToken(v *string) *RefreshTokenUpdate {
+	if v != nil {
+		_u.SetObsoleteToken(*v)
 	}
-	return rtu
+	return _u
 }
 
 // SetCreatedAt sets the "created_at" field.
-func (rtu *RefreshTokenUpdate) SetCreatedAt(t time.Time) *RefreshTokenUpdate {
-	rtu.mutation.SetCreatedAt(t)
-	return rtu
+func (_u *RefreshTokenUpdate) SetCreatedAt(v time.Time) *RefreshTokenUpdate {
+	_u.mutation.SetCreatedAt(v)
+	return _u
 }
 
 // SetNillableCreatedAt sets the "created_at" field if the given value is not nil.
-func (rtu *RefreshTokenUpdate) SetNillableCreatedAt(t *time.Time) *RefreshTokenUpdate {
-	if t != nil {
-		rtu.SetCreatedAt(*t)
+func (_u *RefreshTokenUpdate) SetNillableCreatedAt(v *time.Time) *RefreshTokenUpdate {
+	if v != nil {
+		_u.SetCreatedAt(*v)
 	}
-	return rtu
+	return _u
 }
 
 // SetLastUsed sets the "last_used" field.
-func (rtu *RefreshTokenUpdate) SetLastUsed(t time.Time) *RefreshTokenUpdate {
-	rtu.mutation.SetLastUsed(t)
-	return rtu
+func (_u *RefreshTokenUpdate) SetLastUsed(v time.Time) *RefreshTokenUpdate {
+	_u.mutation.SetLastUsed(v)
+	return _u
 }
 
 // SetNillableLastUsed sets the "last_used" field if the given value is not nil.
-func (rtu *RefreshTokenUpdate) SetNillableLastUsed(t *time.Time) *RefreshTokenUpdate {
-	if t != nil {
-		rtu.SetLastUsed(*t)
+func (_u *RefreshTokenUpdate) SetNillableLastUsed(v *time.Time) *RefreshTokenUpdate {
+	if v != nil {
+		_u.SetLastUsed(*v)
 	}
-	return rtu
+	return _u
 }
 
 // Mutation returns the RefreshTokenMutation object of the builder.
-func (rtu *RefreshTokenUpdate) Mutation() *RefreshTokenMutation {
-	return rtu.mutation
+func (_u *RefreshTokenUpdate) Mutation() *RefreshTokenMutation {
+	return _u.mutation
 }
 
 // Save executes the query and returns the number of nodes affected by the update operation.
-func (rtu *RefreshTokenUpdate) Save(ctx context.Context) (int, error) {
-	var (
-		err      error
-		affected int
-	)
-	if len(rtu.hooks) == 0 {
-		if err = rtu.check(); err != nil {
-			return 0, err
-		}
-		affected, err = rtu.sqlSave(ctx)
-	} else {
-		var mut Mutator = MutateFunc(func(ctx context.Context, m Mutation) (Value, error) {
-			mutation, ok := m.(*RefreshTokenMutation)
-			if !ok {
-				return nil, fmt.Errorf("unexpected mutation type %T", m)
-			}
-			if err = rtu.check(); err != nil {
-				return 0, err
-			}
-			rtu.mutation = mutation
-			affected, err = rtu.sqlSave(ctx)
-			mutation.done = true
-			return affected, err
-		})
-		for i := len(rtu.hooks) - 1; i >= 0; i-- {
-			if rtu.hooks[i] == nil {
-				return 0, fmt.Errorf("db: uninitialized hook (forgotten import db/runtime?)")
-			}
-			mut = rtu.hooks[i](mut)
-		}
-		if _, err := mut.Mutate(ctx, rtu.mutation); err != nil {
-			return 0, err
-		}
-	}
-	return affected, err
+func (_u *RefreshTokenUpdate) Save(ctx context.Context) (int, error) {
+	return withHooks(ctx, _u.sqlSave, _u.mutation, _u.hooks)
 }
 
 // SaveX is like Save, but panics if an error occurs.
-func (rtu *RefreshTokenUpdate) SaveX(ctx context.Context) int {
-	affected, err := rtu.Save(ctx)
+func (_u *RefreshTokenUpdate) SaveX(ctx context.Context) int {
+	affected, err := _u.Save(ctx)
 	if err != nil {
 		panic(err)
 	}
@@ -229,46 +265,46 @@ func (rtu *RefreshTokenUpdate) SaveX(ctx context.Context) int {
 }
 
 // Exec executes the query.
-func (rtu *RefreshTokenUpdate) Exec(ctx context.Context) error {
-	_, err := rtu.Save(ctx)
+func (_u *RefreshTokenUpdate) Exec(ctx context.Context) error {
+	_, err := _u.Save(ctx)
 	return err
 }
 
 // ExecX is like Exec, but panics if an error occurs.
-func (rtu *RefreshTokenUpdate) ExecX(ctx context.Context) {
-	if err := rtu.Exec(ctx); err != nil {
+func (_u *RefreshTokenUpdate) ExecX(ctx context.Context) {
+	if err := _u.Exec(ctx); err != nil {
 		panic(err)
 	}
 }
 
 // check runs all checks and user-defined validators on the builder.
-func (rtu *RefreshTokenUpdate) check() error {
-	if v, ok := rtu.mutation.ClientID(); ok {
+func (_u *RefreshTokenUpdate) check() error {
+	if v, ok := _u.mutation.ClientID(); ok {
 		if err := refreshtoken.ClientIDValidator(v); err != nil {
 			return &ValidationError{Name: "client_id", err: fmt.Errorf(`db: validator failed for field "RefreshToken.client_id": %w`, err)}
 		}
 	}
-	if v, ok := rtu.mutation.Nonce(); ok {
+	if v, ok := _u.mutation.Nonce(); ok {
 		if err := refreshtoken.NonceValidator(v); err != nil {
 			return &ValidationError{Name: "nonce", err: fmt.Errorf(`db: validator failed for field "RefreshToken.nonce": %w`, err)}
 		}
 	}
-	if v, ok := rtu.mutation.ClaimsUserID(); ok {
+	if v, ok := _u.mutation.ClaimsUserID(); ok {
 		if err := refreshtoken.ClaimsUserIDValidator(v); err != nil {
 			return &ValidationError{Name: "claims_user_id", err: fmt.Errorf(`db: validator failed for field "RefreshToken.claims_user_id": %w`, err)}
 		}
 	}
-	if v, ok := rtu.mutation.ClaimsUsername(); ok {
+	if v, ok := _u.mutation.ClaimsUsername(); ok {
 		if err := refreshtoken.ClaimsUsernameValidator(v); err != nil {
 			return &ValidationError{Name: "claims_username", err: fmt.Errorf(`db: validator failed for field "RefreshToken.claims_username": %w`, err)}
 		}
 	}
-	if v, ok := rtu.mutation.ClaimsEmail(); ok {
+	if v, ok := _u.mutation.ClaimsEmail(); ok {
 		if err := refreshtoken.ClaimsEmailValidator(v); err != nil {
 			return &ValidationError{Name: "claims_email", err: fmt.Errorf(`db: validator failed for field "RefreshToken.claims_email": %w`, err)}
 		}
 	}
-	if v, ok := rtu.mutation.ConnectorID(); ok {
+	if v, ok := _u.mutation.ConnectorID(); ok {
 		if err := refreshtoken.ConnectorIDValidator(v); err != nil {
 			return &ValidationError{Name: "connector_id", err: fmt.Errorf(`db: validator failed for field "RefreshToken.connector_id": %w`, err)}
 		}
@@ -276,148 +312,83 @@ func (rtu *RefreshTokenUpdate) check() error {
 	return nil
 }
 
-func (rtu *RefreshTokenUpdate) sqlSave(ctx context.Context) (n int, err error) {
-	_spec := &sqlgraph.UpdateSpec{
-		Node: &sqlgraph.NodeSpec{
-			Table:   refreshtoken.Table,
-			Columns: refreshtoken.Columns,
-			ID: &sqlgraph.FieldSpec{
-				Type:   field.TypeString,
-				Column: refreshtoken.FieldID,
-			},
-		},
+func (_u *RefreshTokenUpdate) sqlSave(ctx context.Context) (_node int, err error) {
+	if err := _u.check(); err != nil {
+		return _node, err
 	}
-	if ps := rtu.mutation.predicates; len(ps) > 0 {
+	_spec := sqlgraph.NewUpdateSpec(refreshtoken.Table, refreshtoken.Columns, sqlgraph.NewFieldSpec(refreshtoken.FieldID, field.TypeString))
+	if ps := _u.mutation.predicates; len(ps) > 0 {
 		_spec.Predicate = func(selector *sql.Selector) {
 			for i := range ps {
 				ps[i](selector)
 			}
 		}
 	}
-	if value, ok := rtu.mutation.ClientID(); ok {
-		_spec.Fields.Set = append(_spec.Fields.Set, &sqlgraph.FieldSpec{
-			Type:   field.TypeString,
-			Value:  value,
-			Column: refreshtoken.FieldClientID,
-		})
+	if value, ok := _u.mutation.ClientID(); ok {
+		_spec.SetField(refreshtoken.FieldClientID, field.TypeString, value)
 	}
-	if value, ok := rtu.mutation.Scopes(); ok {
-		_spec.Fields.Set = append(_spec.Fields.Set, &sqlgraph.FieldSpec{
-			Type:   field.TypeJSON,
-			Value:  value,
-			Column: refreshtoken.FieldScopes,
-		})
+	if value, ok := _u.mutation.Scopes(); ok {
+		_spec.SetField(refreshtoken.FieldScopes, field.TypeJSON, value)
 	}
-	if rtu.mutation.ScopesCleared() {
-		_spec.Fields.Clear = append(_spec.Fields.Clear, &sqlgraph.FieldSpec{
-			Type:   field.TypeJSON,
-			Column: refreshtoken.FieldScopes,
+	if value, ok := _u.mutation.AppendedScopes(); ok {
+		_spec.AddModifier(func(u *sql.UpdateBuilder) {
+			sqljson.Append(u, refreshtoken.FieldScopes, value)
 		})
 	}
-	if value, ok := rtu.mutation.Nonce(); ok {
-		_spec.Fields.Set = append(_spec.Fields.Set, &sqlgraph.FieldSpec{
-			Type:   field.TypeString,
-			Value:  value,
-			Column: refreshtoken.FieldNonce,
-		})
+	if _u.mutation.ScopesCleared() {
+		_spec.ClearField(refreshtoken.FieldScopes, field.TypeJSON)
 	}
-	if value, ok := rtu.mutation.ClaimsUserID(); ok {
-		_spec.Fields.Set = append(_spec.Fields.Set, &sqlgraph.FieldSpec{
-			Type:   field.TypeString,
-			Value:  value,
-			Column: refreshtoken.FieldClaimsUserID,
-		})
+	if value, ok := _u.mutation.Nonce(); ok {
+		_spec.SetField(refreshtoken.FieldNonce, field.TypeString, value)
 	}
-	if value, ok := rtu.mutation.ClaimsUsername(); ok {
-		_spec.Fields.Set = append(_spec.Fields.Set, &sqlgraph.FieldSpec{
-			Type:   field.TypeString,
-			Value:  value,
-			Column: refreshtoken.FieldClaimsUsername,
-		})
+	if value, ok := _u.mutation.ClaimsUserID(); ok {
+		_spec.SetField(refreshtoken.FieldClaimsUserID, field.TypeString, value)
 	}
-	if value, ok := rtu.mutation.ClaimsEmail(); ok {
-		_spec.Fields.Set = append(_spec.Fields.Set, &sqlgraph.FieldSpec{
-			Type:   field.TypeString,
-			Value:  value,
-			Column: refreshtoken.FieldClaimsEmail,
-		})
+	if value, ok := _u.mutation.ClaimsUsername(); ok {
+		_spec.SetField(refreshtoken.FieldClaimsUsername, field.TypeString, value)
 	}
-	if value, ok := rtu.mutation.ClaimsEmailVerified(); ok {
-		_spec.Fields.Set = append(_spec.Fields.Set, &sqlgraph.FieldSpec{
-			Type:   field.TypeBool,
-			Value:  value,
-			Column: refreshtoken.FieldClaimsEmailVerified,
-		})
+	if value, ok := _u.mutation.ClaimsEmail(); ok {
+		_spec.SetField(refreshtoken.FieldClaimsEmail, field.TypeString, value)
 	}
-	if value, ok := rtu.mutation.ClaimsGroups(); ok {
-		_spec.Fields.Set = append(_spec.Fields.Set, &sqlgraph.FieldSpec{
-			Type:   field.TypeJSON,
-			Value:  value,
-			Column: refreshtoken.FieldClaimsGroups,
-		})
+	if value, ok := _u.mutation.ClaimsEmailVerified(); ok {
+		_spec.SetField(refreshtoken.FieldClaimsEmailVerified, field.TypeBool, value)
 	}
-	if rtu.mutation.ClaimsGroupsCleared() {
-		_spec.Fields.Clear = append(_spec.Fields.Clear, &sqlgraph.FieldSpec{
-			Type:   field.TypeJSON,
-			Column: refreshtoken.FieldClaimsGroups,
-		})
+	if value, ok := _u.mutation.ClaimsGroups(); ok {
+		_spec.SetField(refreshtoken.FieldClaimsGroups, field.TypeJSON, value)
 	}
-	if value, ok := rtu.mutation.ClaimsPreferredUsername(); ok {
-		_spec.Fields.Set = append(_spec.Fields.Set, &sqlgraph.FieldSpec{
-			Type:   field.TypeString,
-			Value:  value,
-			Column: refreshtoken.FieldClaimsPreferredUsername,
+	if value, ok := _u.mutation.AppendedClaimsGroups(); ok {
+		_spec.AddModifier(func(u *sql.UpdateBuilder) {
+			sqljson.Append(u, refreshtoken.FieldClaimsGroups, value)
 		})
 	}
-	if value, ok := rtu.mutation.ConnectorID(); ok {
-		_spec.Fields.Set = append(_spec.Fields.Set, &sqlgraph.FieldSpec{
-			Type:   field.TypeString,
-			Value:  value,
-			Column: refreshtoken.FieldConnectorID,
-		})
+	if _u.mutation.ClaimsGroupsCleared() {
+		_spec.ClearField(refreshtoken.FieldClaimsGroups, field.TypeJSON)
 	}
-	if value, ok := rtu.mutation.ConnectorData(); ok {
-		_spec.Fields.Set = append(_spec.Fields.Set, &sqlgraph.FieldSpec{
-			Type:   field.TypeBytes,
-			Value:  value,
-			Column: refreshtoken.FieldConnectorData,
-		})
+	if value, ok := _u.mutation.ClaimsPreferredUsername(); ok {
+		_spec.SetField(refreshtoken.FieldClaimsPreferredUsername, field.TypeString, value)
 	}
-	if rtu.mutation.ConnectorDataCleared() {
-		_spec.Fields.Clear = append(_spec.Fields.Clear, &sqlgraph.FieldSpec{
-			Type:   field.TypeBytes,
-			Column: refreshtoken.FieldConnectorData,
-		})
+	if value, ok := _u.mutation.ConnectorID(); ok {
+		_spec.SetField(refreshtoken.FieldConnectorID, field.TypeString, value)
 	}
-	if value, ok := rtu.mutation.Token(); ok {
-		_spec.Fields.Set = append(_spec.Fields.Set, &sqlgraph.FieldSpec{
-			Type:   field.TypeString,
-			Value:  value,
-			Column: refreshtoken.FieldToken,
-		})
+	if value, ok := _u.mutation.ConnectorData(); ok {
+		_spec.SetField(refreshtoken.FieldConnectorData, field.TypeBytes, value)
 	}
-	if value, ok := rtu.mutation.ObsoleteToken(); ok {
-		_spec.Fields.Set = append(_spec.Fields.Set, &sqlgraph.FieldSpec{
-			Type:   field.TypeString,
-			Value:  value,
-			Column: refreshtoken.FieldObsoleteToken,
-		})
+	if _u.mutation.ConnectorDataCleared() {
+		_spec.ClearField(refreshtoken.FieldConnectorData, field.TypeBytes)
 	}
-	if value, ok := rtu.mutation.CreatedAt(); ok {
-		_spec.Fields.Set = append(_spec.Fields.Set, &sqlgraph.FieldSpec{
-			Type:   field.TypeTime,
-			Value:  value,
-			Column: refreshtoken.FieldCreatedAt,
-		})
+	if value, ok := _u.mutation.Token(); ok {
+		_spec.SetField(refreshtoken.FieldToken, field.TypeString, value)
 	}
-	if value, ok := rtu.mutation.LastUsed(); ok {
-		_spec.Fields.Set = append(_spec.Fields.Set, &sqlgraph.FieldSpec{
-			Type:   field.TypeTime,
-			Value:  value,
-			Column: refreshtoken.FieldLastUsed,
-		})
+	if value, ok := _u.mutation.ObsoleteToken(); ok {
+		_spec.SetField(refreshtoken.FieldObsoleteToken, field.TypeString, value)
+	}
+	if value, ok := _u.mutation.CreatedAt(); ok {
+		_spec.SetField(refreshtoken.FieldCreatedAt, field.TypeTime, value)
+	}
+	if value, ok := _u.mutation.LastUsed(); ok {
+		_spec.SetField(refreshtoken.FieldLastUsed, field.TypeTime, value)
 	}
-	if n, err = sqlgraph.UpdateNodes(ctx, rtu.driver, _spec); err != nil {
+	if _node, err = sqlgraph.UpdateNodes(ctx, _u.driver, _spec); err != nil {
 		if _, ok := err.(*sqlgraph.NotFoundError); ok {
 			err = &NotFoundError{refreshtoken.Label}
 		} else if sqlgraph.IsConstraintError(err) {
@@ -425,7 +396,8 @@ func (rtu *RefreshTokenUpdate) sqlSave(ctx context.Context) (n int, err error) {
 		}
 		return 0, err
 	}
-	return n, nil
+	_u.mutation.done = true
+	return _node, nil
 }
 
 // RefreshTokenUpdateOne is the builder for updating a single RefreshToken entity.
@@ -437,212 +409,247 @@ type RefreshTokenUpdateOne struct {
 }
 
 // SetClientID sets the "client_id" field.
-func (rtuo *RefreshTokenUpdateOne) SetClientID(s string) *RefreshTokenUpdateOne {
-	rtuo.mutation.SetClientID(s)
-	return rtuo
+func (_u *RefreshTokenUpdateOne) SetClientID(v string) *RefreshTokenUpdateOne {
+	_u.mutation.SetClientID(v)
+	return _u
+}
+
+// SetNillableClientID sets the "client_id" field if the given value is not nil.
+func (_u *RefreshTokenUpdateOne) SetNillableClientID(v *string) *RefreshTokenUpdateOne {
+	if v != nil {
+		_u.SetClientID(*v)
+	}
+	return _u
 }
 
 // SetScopes sets the "scopes" field.
-func (rtuo *RefreshTokenUpdateOne) SetScopes(s []string) *RefreshTokenUpdateOne {
-	rtuo.mutation.SetScopes(s)
-	return rtuo
+func (_u *RefreshTokenUpdateOne) SetScopes(v []string) *RefreshTokenUpdateOne {
+	_u.mutation.SetScopes(v)
+	return _u
+}
+
+// AppendScopes appends value to the "scopes" field.
+func (_u *RefreshTokenUpdateOne) AppendScopes(v []string) *RefreshTokenUpdateOne {
+	_u.mutation.AppendScopes(v)
+	return _u
 }
 
 // ClearScopes clears the value of the "scopes" field.
-func (rtuo *RefreshTokenUpdateOne) ClearScopes() *RefreshTokenUpdateOne {
-	rtuo.mutation.ClearScopes()
-	return rtuo
+func (_u *RefreshTokenUpdateOne) ClearScopes() *RefreshTokenUpdateOne {
+	_u.mutation.ClearScopes()
+	return _u
 }
 
 // SetNonce sets the "nonce" field.
-func (rtuo *RefreshTokenUpdateOne) SetNonce(s string) *RefreshTokenUpdateOne {
-	rtuo.mutation.SetNonce(s)
-	return rtuo
+func (_u *RefreshTokenUpdateOne) SetNonce(v string) *RefreshTokenUpdateOne {
+	_u.mutation.SetNonce(v)
+	return _u
+}
+
+// SetNillableNonce sets the "nonce" field if the given value is not nil.
+func (_u *RefreshTokenUpdateOne) SetNillableNonce(v *string) *RefreshTokenUpdateOne {
+	if v != nil {
+		_u.SetNonce(*v)
+	}
+	return _u
 }
 
 // SetClaimsUserID sets the "claims_user_id" field.
-func (rtuo *RefreshTokenUpdateOne) SetClaimsUserID(s string) *RefreshTokenUpdateOne {
-	rtuo.mutation.SetClaimsUserID(s)
-	return rtuo
+func (_u *RefreshTokenUpdateOne) SetClaimsUserID(v string) *RefreshTokenUpdateOne {
+	_u.mutation.SetClaimsUserID(v)
+	return _u
+}
+
+// SetNillableClaimsUserID sets the "claims_user_id" field if the given value is not nil.
+func (_u *RefreshTokenUpdateOne) SetNillableClaimsUserID(v *string) *RefreshTokenUpdateOne {
+	if v != nil {
+		_u.SetClaimsUserID(*v)
+	}
+	return _u
 }
 
 // SetClaimsUsername sets the "claims_username" field.
-func (rtuo *RefreshTokenUpdateOne) SetClaimsUsername(s string) *RefreshTokenUpdateOne {
-	rtuo.mutation.SetClaimsUsername(s)
-	return rtuo
+func (_u *RefreshTokenUpdateOne) SetClaimsUsername(v string) *RefreshTokenUpdateOne {
+	_u.mutation.SetClaimsUsername(v)
+	return _u
+}
+
+// SetNillableClaimsUsername sets the "claims_username" field if the given value is not nil.
+func (_u *RefreshTokenUpdateOne) SetNillableClaimsUsername(v *string) *RefreshTokenUpdateOne {
+	if v != nil {
+		_u.SetClaimsUsername(*v)
+	}
+	return _u
 }
 
 // SetClaimsEmail sets the "claims_email" field.
-func (rtuo *RefreshTokenUpdateOne) SetClaimsEmail(s string) *RefreshTokenUpdateOne {
-	rtuo.mutation.SetClaimsEmail(s)
-	return rtuo
+func (_u *RefreshTokenUpdateOne) SetClaimsEmail(v string) *RefreshTokenUpdateOne {
+	_u.mutation.SetClaimsEmail(v)
+	return _u
+}
+
+// SetNillableClaimsEmail sets the "claims_email" field if the given value is not nil.
+func (_u *RefreshTokenUpdateOne) SetNillableClaimsEmail(v *string) *RefreshTokenUpdateOne {
+	if v != nil {
+		_u.SetClaimsEmail(*v)
+	}
+	return _u
 }
 
 // SetClaimsEmailVerified sets the "claims_email_verified" field.
-func (rtuo *RefreshTokenUpdateOne) SetClaimsEmailVerified(b bool) *RefreshTokenUpdateOne {
-	rtuo.mutation.SetClaimsEmailVerified(b)
-	return rtuo
+func (_u *RefreshTokenUpdateOne) SetClaimsEmailVerified(v bool) *RefreshTokenUpdateOne {
+	_u.mutation.SetClaimsEmailVerified(v)
+	return _u
+}
+
+// SetNillableClaimsEmailVerified sets the "claims_email_verified" field if the given value is not nil.
+func (_u *RefreshTokenUpdateOne) SetNillableClaimsEmailVerified(v *bool) *RefreshTokenUpdateOne {
+	if v != nil {
+		_u.SetClaimsEmailVerified(*v)
+	}
+	return _u
 }
 
 // SetClaimsGroups sets the "claims_groups" field.
-func (rtuo *RefreshTokenUpdateOne) SetClaimsGroups(s []string) *RefreshTokenUpdateOne {
-	rtuo.mutation.SetClaimsGroups(s)
-	return rtuo
+func (_u *RefreshTokenUpdateOne) SetClaimsGroups(v []string) *RefreshTokenUpdateOne {
+	_u.mutation.SetClaimsGroups(v)
+	return _u
+}
+
+// AppendClaimsGroups appends value to the "claims_groups" field.
+func (_u *RefreshTokenUpdateOne) AppendClaimsGroups(v []string) *RefreshTokenUpdateOne {
+	_u.mutation.AppendClaimsGroups(v)
+	return _u
 }
 
 // ClearClaimsGroups clears the value of the "claims_groups" field.
-func (rtuo *RefreshTokenUpdateOne) ClearClaimsGroups() *RefreshTokenUpdateOne {
-	rtuo.mutation.ClearClaimsGroups()
-	return rtuo
+func (_u *RefreshTokenUpdateOne) ClearClaimsGroups() *RefreshTokenUpdateOne {
+	_u.mutation.ClearClaimsGroups()
+	return _u
 }
 
 // SetClaimsPreferredUsername sets the "claims_preferred_username" field.
-func (rtuo *RefreshTokenUpdateOne) SetClaimsPreferredUsername(s string) *RefreshTokenUpdateOne {
-	rtuo.mutation.SetClaimsPreferredUsername(s)
-	return rtuo
+func (_u *RefreshTokenUpdateOne) SetClaimsPreferredUsername(v string) *RefreshTokenUpdateOne {
+	_u.mutation.SetClaimsPreferredUsername(v)
+	return _u
 }
 
 // SetNillableClaimsPreferredUsername sets the "claims_preferred_username" field if the given value is not nil.
-func (rtuo *RefreshTokenUpdateOne) SetNillableClaimsPreferredUsername(s *string) *RefreshTokenUpdateOne {
-	if s != nil {
-		rtuo.SetClaimsPreferredUsername(*s)
+func (_u *RefreshTokenUpdateOne) SetNillableClaimsPreferredUsername(v *string) *RefreshTokenUpdateOne {
+	if v != nil {
+		_u.SetClaimsPreferredUsername(*v)
 	}
-	return rtuo
+	return _u
 }
 
 // SetConnectorID sets the "connector_id" field.
-func (rtuo *RefreshTokenUpdateOne) SetConnectorID(s string) *RefreshTokenUpdateOne {
-	rtuo.mutation.SetConnectorID(s)
-	return rtuo
+func (_u *RefreshTokenUpdateOne) SetConnectorID(v string) *RefreshTokenUpdateOne {
+	_u.mutation.SetConnectorID(v)
+	return _u
+}
+
+// SetNillableConnectorID sets the "connector_id" field if the given value is not nil.
+func (_u *RefreshTokenUpdateOne) SetNillableConnectorID(v *string) *RefreshTokenUpdateOne {
+	if v != nil {
+		_u.SetConnectorID(*v)
+	}
+	return _u
 }
 
 // SetConnectorData sets the "connector_data" field.
-func (rtuo *RefreshTokenUpdateOne) SetConnectorData(b []byte) *RefreshTokenUpdateOne {
-	rtuo.mutation.SetConnectorData(b)
-	return rtuo
+func (_u *RefreshTokenUpdateOne) SetConnectorData(v []byte) *RefreshTokenUpdateOne {
+	_u.mutation.SetConnectorData(v)
+	return _u
 }
 
 // ClearConnectorData clears the value of the "connector_data" field.
-func (rtuo *RefreshTokenUpdateOne) ClearConnectorData() *RefreshTokenUpdateOne {
-	rtuo.mutation.ClearConnectorData()
-	return rtuo
+func (_u *RefreshTokenUpdateOne) ClearConnectorData() *RefreshTokenUpdateOne {
+	_u.mutation.ClearConnectorData()
+	return _u
 }
 
 // SetToken sets the "token" field.
-func (rtuo *RefreshTokenUpdateOne) SetToken(s string) *RefreshTokenUpdateOne {
-	rtuo.mutation.SetToken(s)
-	return rtuo
+func (_u *RefreshTokenUpdateOne) SetToken(v string) *RefreshTokenUpdateOne {
+	_u.mutation.SetToken(v)
+	return _u
 }
 
 // SetNillableToken sets the "token" field if the given value is not nil.
-func (rtuo *RefreshTokenUpdateOne) SetNillableToken(s *string) *RefreshTokenUpdateOne {
-	if s != nil {
-		rtuo.SetToken(*s)
+func (_u *RefreshTokenUpdateOne) SetNillableToken(v *string) *RefreshTokenUpdateOne {
+	if v != nil {
+		_u.SetToken(*v)
 	}
-	return rtuo
+	return _u
 }
 
 // SetObsoleteToken sets the "obsolete_token" field.
-func (rtuo *RefreshTokenUpdateOne) SetObsoleteToken(s string) *RefreshTokenUpdateOne {
-	rtuo.mutation.SetObsoleteToken(s)
-	return rtuo
+func (_u *RefreshTokenUpdateOne) SetObsoleteToken(v string) *RefreshTokenUpdateOne {
+	_u.mutation.SetObsoleteToken(v)
+	return _u
 }
 
 // SetNillableObsoleteToken sets the "obsolete_token" field if the given value is not nil.
-func (rtuo *RefreshTokenUpdateOne) SetNillableObsoleteToken(s *string) *RefreshTokenUpdateOne {
-	if s != nil {
-		rtuo.SetObsoleteToken(*s)
+func (_u *RefreshTokenUpdateOne) SetNillableObsoleteToken(v *string) *RefreshTokenUpdateOne {
+	if v != nil {
+		_u.SetObsoleteToken(*v)
 	}
-	return rtuo
+	return _u
 }
 
 // SetCreatedAt sets the "created_at" field.
-func (rtuo *RefreshTokenUpdateOne) SetCreatedAt(t time.Time) *RefreshTokenUpdateOne {
-	rtuo.mutation.SetCreatedAt(t)
-	return rtuo
+func (_u *RefreshTokenUpdateOne) SetCreatedAt(v time.Time) *RefreshTokenUpdateOne {
+	_u.mutation.SetCreatedAt(v)
+	return _u
 }
 
 // SetNillableCreatedAt sets the "created_at" field if the given value is not nil.
-func (rtuo *RefreshTokenUpdateOne) SetNillableCreatedAt(t *time.Time) *RefreshTokenUpdateOne {
-	if t != nil {
-		rtuo.SetCreatedAt(*t)
+func (_u *RefreshTokenUpdateOne) SetNillableCreatedAt(v *time.Time) *RefreshTokenUpdateOne {
+	if v != nil {
+		_u.SetCreatedAt(*v)
 	}
-	return rtuo
+	return _u
 }
 
 // SetLastUsed sets the "last_used" field.
-func (rtuo *RefreshTokenUpdateOne) SetLastUsed(t time.Time) *RefreshTokenUpdateOne {
-	rtuo.mutation.SetLastUsed(t)
-	return rtuo
+func (_u *RefreshTokenUpdateOne) SetLastUsed(v time.Time) *RefreshTokenUpdateOne {
+	_u.mutation.SetLastUsed(v)
+	return _u
 }
 
 // SetNillableLastUsed sets the "last_used" field if the given value is not nil.
-func (rtuo *RefreshTokenUpdateOne) SetNillableLastUsed(t *time.Time) *RefreshTokenUpdateOne {
-	if t != nil {
-		rtuo.SetLastUsed(*t)
+func (_u *RefreshTokenUpdateOne) SetNillableLastUsed(v *time.Time) *RefreshTokenUpdateOne {
+	if v != nil {
+		_u.SetLastUsed(*v)
 	}
-	return rtuo
+	return _u
 }
 
 // Mutation returns the RefreshTokenMutation object of the builder.
-func (rtuo *RefreshTokenUpdateOne) Mutation() *RefreshTokenMutation {
-	return rtuo.mutation
+func (_u *RefreshTokenUpdateOne) Mutation() *RefreshTokenMutation {
+	return _u.mutation
+}
+
+// Where appends a list predicates to the RefreshTokenUpdate builder.
+func (_u *RefreshTokenUpdateOne) Where(ps ...predicate.RefreshToken) *RefreshTokenUpdateOne {
+	_u.mutation.Where(ps...)
+	return _u
 }
 
 // Select allows selecting one or more fields (columns) of the returned entity.
 // The default is selecting all fields defined in the entity schema.
-func (rtuo *RefreshTokenUpdateOne) Select(field string, fields ...string) *RefreshTokenUpdateOne {
-	rtuo.fields = append([]string{field}, fields...)
-	return rtuo
+func (_u *RefreshTokenUpdateOne) Select(field string, fields ...string) *RefreshTokenUpdateOne {
+	_u.fields = append([]string{field}, fields...)
+	return _u
 }
 
 // Save executes the query and returns the updated RefreshToken entity.
-func (rtuo *RefreshTokenUpdateOne) Save(ctx context.Context) (*RefreshToken, error) {
-	var (
-		err  error
-		node *RefreshToken
-	)
-	if len(rtuo.hooks) == 0 {
-		if err = rtuo.check(); err != nil {
-			return nil, err
-		}
-		node, err = rtuo.sqlSave(ctx)
-	} else {
-		var mut Mutator = MutateFunc(func(ctx context.Context, m Mutation) (Value, error) {
-			mutation, ok := m.(*RefreshTokenMutation)
-			if !ok {
-				return nil, fmt.Errorf("unexpected mutation type %T", m)
-			}
-			if err = rtuo.check(); err != nil {
-				return nil, err
-			}
-			rtuo.mutation = mutation
-			node, err = rtuo.sqlSave(ctx)
-			mutation.done = true
-			return node, err
-		})
-		for i := len(rtuo.hooks) - 1; i >= 0; i-- {
-			if rtuo.hooks[i] == nil {
-				return nil, fmt.Errorf("db: uninitialized hook (forgotten import db/runtime?)")
-			}
-			mut = rtuo.hooks[i](mut)
-		}
-		v, err := mut.Mutate(ctx, rtuo.mutation)
-		if err != nil {
-			return nil, err
-		}
-		nv, ok := v.(*RefreshToken)
-		if !ok {
-			return nil, fmt.Errorf("unexpected node type %T returned from RefreshTokenMutation", v)
-		}
-		node = nv
-	}
-	return node, err
+func (_u *RefreshTokenUpdateOne) Save(ctx context.Context) (*RefreshToken, error) {
+	return withHooks(ctx, _u.sqlSave, _u.mutation, _u.hooks)
 }
 
 // SaveX is like Save, but panics if an error occurs.
-func (rtuo *RefreshTokenUpdateOne) SaveX(ctx context.Context) *RefreshToken {
-	node, err := rtuo.Save(ctx)
+func (_u *RefreshTokenUpdateOne) SaveX(ctx context.Context) *RefreshToken {
+	node, err := _u.Save(ctx)
 	if err != nil {
 		panic(err)
 	}
@@ -650,46 +657,46 @@ func (rtuo *RefreshTokenUpdateOne) SaveX(ctx context.Context) *RefreshToken {
 }
 
 // Exec executes the query on the entity.
-func (rtuo *RefreshTokenUpdateOne) Exec(ctx context.Context) error {
-	_, err := rtuo.Save(ctx)
+func (_u *RefreshTokenUpdateOne) Exec(ctx context.Context) error {
+	_, err := _u.Save(ctx)
 	return err
 }
 
 // ExecX is like Exec, but panics if an error occurs.
-func (rtuo *RefreshTokenUpdateOne) ExecX(ctx context.Context) {
-	if err := rtuo.Exec(ctx); err != nil {
+func (_u *RefreshTokenUpdateOne) ExecX(ctx context.Context) {
+	if err := _u.Exec(ctx); err != nil {
 		panic(err)
 	}
 }
 
 // check runs all checks and user-defined validators on the builder.
-func (rtuo *RefreshTokenUpdateOne) check() error {
-	if v, ok := rtuo.mutation.ClientID(); ok {
+func (_u *RefreshTokenUpdateOne) check() error {
+	if v, ok := _u.mutation.ClientID(); ok {
 		if err := refreshtoken.ClientIDValidator(v); err != nil {
 			return &ValidationError{Name: "client_id", err: fmt.Errorf(`db: validator failed for field "RefreshToken.client_id": %w`, err)}
 		}
 	}
-	if v, ok := rtuo.mutation.Nonce(); ok {
+	if v, ok := _u.mutation.Nonce(); ok {
 		if err := refreshtoken.NonceValidator(v); err != nil {
 			return &ValidationError{Name: "nonce", err: fmt.Errorf(`db: validator failed for field "RefreshToken.nonce": %w`, err)}
 		}
 	}
-	if v, ok := rtuo.mutation.ClaimsUserID(); ok {
+	if v, ok := _u.mutation.ClaimsUserID(); ok {
 		if err := refreshtoken.ClaimsUserIDValidator(v); err != nil {
 			return &ValidationError{Name: "claims_user_id", err: fmt.Errorf(`db: validator failed for field "RefreshToken.claims_user_id": %w`, err)}
 		}
 	}
-	if v, ok := rtuo.mutation.ClaimsUsername(); ok {
+	if v, ok := _u.mutation.ClaimsUsername(); ok {
 		if err := refreshtoken.ClaimsUsernameValidator(v); err != nil {
 			return &ValidationError{Name: "claims_username", err: fmt.Errorf(`db: validator failed for field "RefreshToken.claims_username": %w`, err)}
 		}
 	}
-	if v, ok := rtuo.mutation.ClaimsEmail(); ok {
+	if v, ok := _u.mutation.ClaimsEmail(); ok {
 		if err := refreshtoken.ClaimsEmailValidator(v); err != nil {
 			return &ValidationError{Name: "claims_email", err: fmt.Errorf(`db: validator failed for field "RefreshToken.claims_email": %w`, err)}
 		}
 	}
-	if v, ok := rtuo.mutation.ConnectorID(); ok {
+	if v, ok := _u.mutation.ConnectorID(); ok {
 		if err := refreshtoken.ConnectorIDValidator(v); err != nil {
 			return &ValidationError{Name: "connector_id", err: fmt.Errorf(`db: validator failed for field "RefreshToken.connector_id": %w`, err)}
 		}
@@ -697,23 +704,17 @@ func (rtuo *RefreshTokenUpdateOne) check() error {
 	return nil
 }
 
-func (rtuo *RefreshTokenUpdateOne) sqlSave(ctx context.Context) (_node *RefreshToken, err error) {
-	_spec := &sqlgraph.UpdateSpec{
-		Node: &sqlgraph.NodeSpec{
-			Table:   refreshtoken.Table,
-			Columns: refreshtoken.Columns,
-			ID: &sqlgraph.FieldSpec{
-				Type:   field.TypeString,
-				Column: refreshtoken.FieldID,
-			},
-		},
+func (_u *RefreshTokenUpdateOne) sqlSave(ctx context.Context) (_node *RefreshToken, err error) {
+	if err := _u.check(); err != nil {
+		return _node, err
 	}
-	id, ok := rtuo.mutation.ID()
+	_spec := sqlgraph.NewUpdateSpec(refreshtoken.Table, refreshtoken.Columns, sqlgraph.NewFieldSpec(refreshtoken.FieldID, field.TypeString))
+	id, ok := _u.mutation.ID()
 	if !ok {
 		return nil, &ValidationError{Name: "id", err: errors.New(`db: missing "RefreshToken.id" for update`)}
 	}
 	_spec.Node.ID.Value = id
-	if fields := rtuo.fields; len(fields) > 0 {
+	if fields := _u.fields; len(fields) > 0 {
 		_spec.Node.Columns = make([]string, 0, len(fields))
 		_spec.Node.Columns = append(_spec.Node.Columns, refreshtoken.FieldID)
 		for _, f := range fields {
@@ -725,140 +726,81 @@ func (rtuo *RefreshTokenUpdateOne) sqlSave(ctx context.Context) (_node *RefreshT
 			}
 		}
 	}
-	if ps := rtuo.mutation.predicates; len(ps) > 0 {
+	if ps := _u.mutation.predicates; len(ps) > 0 {
 		_spec.Predicate = func(selector *sql.Selector) {
 			for i := range ps {
 				ps[i](selector)
 			}
 		}
 	}
-	if value, ok := rtuo.mutation.ClientID(); ok {
-		_spec.Fields.Set = append(_spec.Fields.Set, &sqlgraph.FieldSpec{
-			Type:   field.TypeString,
-			Value:  value,
-			Column: refreshtoken.FieldClientID,
-		})
+	if value, ok := _u.mutation.ClientID(); ok {
+		_spec.SetField(refreshtoken.FieldClientID, field.TypeString, value)
 	}
-	if value, ok := rtuo.mutation.Scopes(); ok {
-		_spec.Fields.Set = append(_spec.Fields.Set, &sqlgraph.FieldSpec{
-			Type:   field.TypeJSON,
-			Value:  value,
-			Column: refreshtoken.FieldScopes,
-		})
+	if value, ok := _u.mutation.Scopes(); ok {
+		_spec.SetField(refreshtoken.FieldScopes, field.TypeJSON, value)
 	}
-	if rtuo.mutation.ScopesCleared() {
-		_spec.Fields.Clear = append(_spec.Fields.Clear, &sqlgraph.FieldSpec{
-			Type:   field.TypeJSON,
-			Column: refreshtoken.FieldScopes,
+	if value, ok := _u.mutation.AppendedScopes(); ok {
+		_spec.AddModifier(func(u *sql.UpdateBuilder) {
+			sqljson.Append(u, refreshtoken.FieldScopes, value)
 		})
 	}
-	if value, ok := rtuo.mutation.Nonce(); ok {
-		_spec.Fields.Set = append(_spec.Fields.Set, &sqlgraph.FieldSpec{
-			Type:   field.TypeString,
-			Value:  value,
-			Column: refreshtoken.FieldNonce,
-		})
+	if _u.mutation.ScopesCleared() {
+		_spec.ClearField(refreshtoken.FieldScopes, field.TypeJSON)
 	}
-	if value, ok := rtuo.mutation.ClaimsUserID(); ok {
-		_spec.Fields.Set = append(_spec.Fields.Set, &sqlgraph.FieldSpec{
-			Type:   field.TypeString,
-			Value:  value,
-			Column: refreshtoken.FieldClaimsUserID,
-		})
+	if value, ok := _u.mutation.Nonce(); ok {
+		_spec.SetField(refreshtoken.FieldNonce, field.TypeString, value)
 	}
-	if value, ok := rtuo.mutation.ClaimsUsername(); ok {
-		_spec.Fields.Set = append(_spec.Fields.Set, &sqlgraph.FieldSpec{
-			Type:   field.TypeString,
-			Value:  value,
-			Column: refreshtoken.FieldClaimsUsername,
-		})
+	if value, ok := _u.mutation.ClaimsUserID(); ok {
+		_spec.SetField(refreshtoken.FieldClaimsUserID, field.TypeString, value)
 	}
-	if value, ok := rtuo.mutation.ClaimsEmail(); ok {
-		_spec.Fields.Set = append(_spec.Fields.Set, &sqlgraph.FieldSpec{
-			Type:   field.TypeString,
-			Value:  value,
-			Column: refreshtoken.FieldClaimsEmail,
-		})
+	if value, ok := _u.mutation.ClaimsUsername(); ok {
+		_spec.SetField(refreshtoken.FieldClaimsUsername, field.TypeString, value)
 	}
-	if value, ok := rtuo.mutation.ClaimsEmailVerified(); ok {
-		_spec.Fields.Set = append(_spec.Fields.Set, &sqlgraph.FieldSpec{
-			Type:   field.TypeBool,
-			Value:  value,
-			Column: refreshtoken.FieldClaimsEmailVerified,
-		})
+	if value, ok := _u.mutation.ClaimsEmail(); ok {
+		_spec.SetField(refreshtoken.FieldClaimsEmail, field.TypeString, value)
 	}
-	if value, ok := rtuo.mutation.ClaimsGroups(); ok {
-		_spec.Fields.Set = append(_spec.Fields.Set, &sqlgraph.FieldSpec{
-			Type:   field.TypeJSON,
-			Value:  value,
-			Column: refreshtoken.FieldClaimsGroups,
-		})
+	if value, ok := _u.mutation.ClaimsEmailVerified(); ok {
+		_spec.SetField(refreshtoken.FieldClaimsEmailVerified, field.TypeBool, value)
 	}
-	if rtuo.mutation.ClaimsGroupsCleared() {
-		_spec.Fields.Clear = append(_spec.Fields.Clear, &sqlgraph.FieldSpec{
-			Type:   field.TypeJSON,
-			Column: refreshtoken.FieldClaimsGroups,
-		})
+	if value, ok := _u.mutation.ClaimsGroups(); ok {
+		_spec.SetField(refreshtoken.FieldClaimsGroups, field.TypeJSON, value)
 	}
-	if value, ok := rtuo.mutation.ClaimsPreferredUsername(); ok {
-		_spec.Fields.Set = append(_spec.Fields.Set, &sqlgraph.FieldSpec{
-			Type:   field.TypeString,
-			Value:  value,
-			Column: refreshtoken.FieldClaimsPreferredUsername,
+	if value, ok := _u.mutation.AppendedClaimsGroups(); ok {
+		_spec.AddModifier(func(u *sql.UpdateBuilder) {
+			sqljson.Append(u, refreshtoken.FieldClaimsGroups, value)
 		})
 	}
-	if value, ok := rtuo.mutation.ConnectorID(); ok {
-		_spec.Fields.Set = append(_spec.Fields.Set, &sqlgraph.FieldSpec{
-			Type:   field.TypeString,
-			Value:  value,
-			Column: refreshtoken.FieldConnectorID,
-		})
+	if _u.mutation.ClaimsGroupsCleared() {
+		_spec.ClearField(refreshtoken.FieldClaimsGroups, field.TypeJSON)
 	}
-	if value, ok := rtuo.mutation.ConnectorData(); ok {
-		_spec.Fields.Set = append(_spec.Fields.Set, &sqlgraph.FieldSpec{
-			Type:   field.TypeBytes,
-			Value:  value,
-			Column: refreshtoken.FieldConnectorData,
-		})
+	if value, ok := _u.mutation.ClaimsPreferredUsername(); ok {
+		_spec.SetField(refreshtoken.FieldClaimsPreferredUsername, field.TypeString, value)
 	}
-	if rtuo.mutation.ConnectorDataCleared() {
-		_spec.Fields.Clear = append(_spec.Fields.Clear, &sqlgraph.FieldSpec{
-			Type:   field.TypeBytes,
-			Column: refreshtoken.FieldConnectorData,
-		})
+	if value, ok := _u.mutation.ConnectorID(); ok {
+		_spec.SetField(refreshtoken.FieldConnectorID, field.TypeString, value)
 	}
-	if value, ok := rtuo.mutation.Token(); ok {
-		_spec.Fields.Set = append(_spec.Fields.Set, &sqlgraph.FieldSpec{
-			Type:   field.TypeString,
-			Value:  value,
-			Column: refreshtoken.FieldToken,
-		})
+	if value, ok := _u.mutation.ConnectorData(); ok {
+		_spec.SetField(refreshtoken.FieldConnectorData, field.TypeBytes, value)
 	}
-	if value, ok := rtuo.mutation.ObsoleteToken(); ok {
-		_spec.Fields.Set = append(_spec.Fields.Set, &sqlgraph.FieldSpec{
-			Type:   field.TypeString,
-			Value:  value,
-			Column: refreshtoken.FieldObsoleteToken,
-		})
+	if _u.mutation.ConnectorDataCleared() {
+		_spec.ClearField(refreshtoken.FieldConnectorData, field.TypeBytes)
 	}
-	if value, ok := rtuo.mutation.CreatedAt(); ok {
-		_spec.Fields.Set = append(_spec.Fields.Set, &sqlgraph.FieldSpec{
-			Type:   field.TypeTime,
-			Value:  value,
-			Column: refreshtoken.FieldCreatedAt,
-		})
+	if value, ok := _u.mutation.Token(); ok {
+		_spec.SetField(refreshtoken.FieldToken, field.TypeString, value)
 	}
-	if value, ok := rtuo.mutation.LastUsed(); ok {
-		_spec.Fields.Set = append(_spec.Fields.Set, &sqlgraph.FieldSpec{
-			Type:   field.TypeTime,
-			Value:  value,
-			Column: refreshtoken.FieldLastUsed,
-		})
+	if value, ok := _u.mutation.ObsoleteToken(); ok {
+		_spec.SetField(refreshtoken.FieldObsoleteToken, field.TypeString, value)
+	}
+	if value, ok := _u.mutation.CreatedAt(); ok {
+		_spec.SetField(refreshtoken.FieldCreatedAt, field.TypeTime, value)
+	}
+	if value, ok := _u.mutation.LastUsed(); ok {
+		_spec.SetField(refreshtoken.FieldLastUsed, field.TypeTime, value)
 	}
-	_node = &RefreshToken{config: rtuo.config}
+	_node = &RefreshToken{config: _u.config}
 	_spec.Assign = _node.assignValues
 	_spec.ScanValues = _node.scanValues
-	if err = sqlgraph.UpdateNode(ctx, rtuo.driver, _spec); err != nil {
+	if err = sqlgraph.UpdateNode(ctx, _u.driver, _spec); err != nil {
 		if _, ok := err.(*sqlgraph.NotFoundError); ok {
 			err = &NotFoundError{refreshtoken.Label}
 		} else if sqlgraph.IsConstraintError(err) {
@@ -866,5 +808,6 @@ func (rtuo *RefreshTokenUpdateOne) sqlSave(ctx context.Context) (_node *RefreshT
 		}
 		return nil, err
 	}
+	_u.mutation.done = true
 	return _node, nil
 }
diff --git a/storage/ent/db/runtime.go b/storage/ent/db/runtime.go
index 797c97613b..c53ae1a5ef 100644
--- a/storage/ent/db/runtime.go
+++ b/storage/ent/db/runtime.go
@@ -7,6 +7,7 @@ import (
 
 	"github.com/dexidp/dex/storage/ent/db/authcode"
 	"github.com/dexidp/dex/storage/ent/db/authrequest"
+	"github.com/dexidp/dex/storage/ent/db/authsession"
 	"github.com/dexidp/dex/storage/ent/db/connector"
 	"github.com/dexidp/dex/storage/ent/db/devicerequest"
 	"github.com/dexidp/dex/storage/ent/db/devicetoken"
@@ -15,6 +16,7 @@ import (
 	"github.com/dexidp/dex/storage/ent/db/offlinesession"
 	"github.com/dexidp/dex/storage/ent/db/password"
 	"github.com/dexidp/dex/storage/ent/db/refreshtoken"
+	"github.com/dexidp/dex/storage/ent/db/useridentity"
 	"github.com/dexidp/dex/storage/ent/schema"
 )
 
@@ -64,6 +66,10 @@ func init() {
 	authcodeDescCodeChallengeMethod := authcodeFields[15].Descriptor()
 	// authcode.DefaultCodeChallengeMethod holds the default value on creation for the code_challenge_method field.
 	authcode.DefaultCodeChallengeMethod = authcodeDescCodeChallengeMethod.Default.(string)
+	// authcodeDescSessionID is the schema descriptor for session_id field.
+	authcodeDescSessionID := authcodeFields[17].Descriptor()
+	// authcode.DefaultSessionID holds the default value on creation for the session_id field.
+	authcode.DefaultSessionID = authcodeDescSessionID.Default.(string)
 	// authcodeDescID is the schema descriptor for id field.
 	authcodeDescID := authcodeFields[0].Descriptor()
 	// authcode.IDValidator is a validator for the "id" field. It is called by the builders before save.
@@ -82,10 +88,48 @@ func init() {
 	authrequestDescCodeChallengeMethod := authrequestFields[19].Descriptor()
 	// authrequest.DefaultCodeChallengeMethod holds the default value on creation for the code_challenge_method field.
 	authrequest.DefaultCodeChallengeMethod = authrequestDescCodeChallengeMethod.Default.(string)
+	// authrequestDescMfaValidated is the schema descriptor for mfa_validated field.
+	authrequestDescMfaValidated := authrequestFields[21].Descriptor()
+	// authrequest.DefaultMfaValidated holds the default value on creation for the mfa_validated field.
+	authrequest.DefaultMfaValidated = authrequestDescMfaValidated.Default.(bool)
+	// authrequestDescPrompt is the schema descriptor for prompt field.
+	authrequestDescPrompt := authrequestFields[23].Descriptor()
+	// authrequest.DefaultPrompt holds the default value on creation for the prompt field.
+	authrequest.DefaultPrompt = authrequestDescPrompt.Default.(string)
+	// authrequestDescMaxAge is the schema descriptor for max_age field.
+	authrequestDescMaxAge := authrequestFields[24].Descriptor()
+	// authrequest.DefaultMaxAge holds the default value on creation for the max_age field.
+	authrequest.DefaultMaxAge = authrequestDescMaxAge.Default.(int)
 	// authrequestDescID is the schema descriptor for id field.
 	authrequestDescID := authrequestFields[0].Descriptor()
 	// authrequest.IDValidator is a validator for the "id" field. It is called by the builders before save.
 	authrequest.IDValidator = authrequestDescID.Validators[0].(func(string) error)
+	authsessionFields := schema.AuthSession{}.Fields()
+	_ = authsessionFields
+	// authsessionDescUserID is the schema descriptor for user_id field.
+	authsessionDescUserID := authsessionFields[1].Descriptor()
+	// authsession.UserIDValidator is a validator for the "user_id" field. It is called by the builders before save.
+	authsession.UserIDValidator = authsessionDescUserID.Validators[0].(func(string) error)
+	// authsessionDescConnectorID is the schema descriptor for connector_id field.
+	authsessionDescConnectorID := authsessionFields[2].Descriptor()
+	// authsession.ConnectorIDValidator is a validator for the "connector_id" field. It is called by the builders before save.
+	authsession.ConnectorIDValidator = authsessionDescConnectorID.Validators[0].(func(string) error)
+	// authsessionDescSecret is the schema descriptor for secret field.
+	authsessionDescSecret := authsessionFields[3].Descriptor()
+	// authsession.SecretValidator is a validator for the "secret" field. It is called by the builders before save.
+	authsession.SecretValidator = authsessionDescSecret.Validators[0].(func(string) error)
+	// authsessionDescIPAddress is the schema descriptor for ip_address field.
+	authsessionDescIPAddress := authsessionFields[7].Descriptor()
+	// authsession.DefaultIPAddress holds the default value on creation for the ip_address field.
+	authsession.DefaultIPAddress = authsessionDescIPAddress.Default.(string)
+	// authsessionDescUserAgent is the schema descriptor for user_agent field.
+	authsessionDescUserAgent := authsessionFields[8].Descriptor()
+	// authsession.DefaultUserAgent holds the default value on creation for the user_agent field.
+	authsession.DefaultUserAgent = authsessionDescUserAgent.Default.(string)
+	// authsessionDescID is the schema descriptor for id field.
+	authsessionDescID := authsessionFields[0].Descriptor()
+	// authsession.IDValidator is a validator for the "id" field. It is called by the builders before save.
+	authsession.IDValidator = authsessionDescID.Validators[0].(func(string) error)
 	connectorFields := schema.Connector{}.Fields()
 	_ = connectorFields
 	// connectorDescType is the schema descriptor for type field.
@@ -170,6 +214,14 @@ func init() {
 	oauth2clientDescLogoURL := oauth2clientFields[6].Descriptor()
 	// oauth2client.LogoURLValidator is a validator for the "logo_url" field. It is called by the builders before save.
 	oauth2client.LogoURLValidator = oauth2clientDescLogoURL.Validators[0].(func(string) error)
+	// oauth2clientDescBackchannelLogoutURI is the schema descriptor for backchannel_logout_uri field.
+	oauth2clientDescBackchannelLogoutURI := oauth2clientFields[11].Descriptor()
+	// oauth2client.DefaultBackchannelLogoutURI holds the default value on creation for the backchannel_logout_uri field.
+	oauth2client.DefaultBackchannelLogoutURI = oauth2clientDescBackchannelLogoutURI.Default.(string)
+	// oauth2clientDescRefreshTokenLifetime is the schema descriptor for refresh_token_lifetime field.
+	oauth2clientDescRefreshTokenLifetime := oauth2clientFields[12].Descriptor()
+	// oauth2client.DefaultRefreshTokenLifetime holds the default value on creation for the refresh_token_lifetime field.
+	oauth2client.DefaultRefreshTokenLifetime = oauth2clientDescRefreshTokenLifetime.Default.(string)
 	// oauth2clientDescID is the schema descriptor for id field.
 	oauth2clientDescID := oauth2clientFields[0].Descriptor()
 	// oauth2client.IDValidator is a validator for the "id" field. It is called by the builders before save.
@@ -212,8 +264,16 @@ func init() {
 	passwordDescUsername := passwordFields[2].Descriptor()
 	// password.UsernameValidator is a validator for the "username" field. It is called by the builders before save.
 	password.UsernameValidator = passwordDescUsername.Validators[0].(func(string) error)
+	// passwordDescName is the schema descriptor for name field.
+	passwordDescName := passwordFields[3].Descriptor()
+	// password.DefaultName holds the default value on creation for the name field.
+	password.DefaultName = passwordDescName.Default.(string)
+	// passwordDescPreferredUsername is the schema descriptor for preferred_username field.
+	passwordDescPreferredUsername := passwordFields[4].Descriptor()
+	// password.DefaultPreferredUsername holds the default value on creation for the preferred_username field.
+	password.DefaultPreferredUsername = passwordDescPreferredUsername.Default.(string)
 	// passwordDescUserID is the schema descriptor for user_id field.
-	passwordDescUserID := passwordFields[3].Descriptor()
+	passwordDescUserID := passwordFields[6].Descriptor()
 	// password.UserIDValidator is a validator for the "user_id" field. It is called by the builders before save.
 	password.UserIDValidator = passwordDescUserID.Validators[0].(func(string) error)
 	refreshtokenFields := schema.RefreshToken{}.Fields()
@@ -266,4 +326,38 @@ func init() {
 	refreshtokenDescID := refreshtokenFields[0].Descriptor()
 	// refreshtoken.IDValidator is a validator for the "id" field. It is called by the builders before save.
 	refreshtoken.IDValidator = refreshtokenDescID.Validators[0].(func(string) error)
+	useridentityFields := schema.UserIdentity{}.Fields()
+	_ = useridentityFields
+	// useridentityDescUserID is the schema descriptor for user_id field.
+	useridentityDescUserID := useridentityFields[1].Descriptor()
+	// useridentity.UserIDValidator is a validator for the "user_id" field. It is called by the builders before save.
+	useridentity.UserIDValidator = useridentityDescUserID.Validators[0].(func(string) error)
+	// useridentityDescConnectorID is the schema descriptor for connector_id field.
+	useridentityDescConnectorID := useridentityFields[2].Descriptor()
+	// useridentity.ConnectorIDValidator is a validator for the "connector_id" field. It is called by the builders before save.
+	useridentity.ConnectorIDValidator = useridentityDescConnectorID.Validators[0].(func(string) error)
+	// useridentityDescClaimsUserID is the schema descriptor for claims_user_id field.
+	useridentityDescClaimsUserID := useridentityFields[3].Descriptor()
+	// useridentity.DefaultClaimsUserID holds the default value on creation for the claims_user_id field.
+	useridentity.DefaultClaimsUserID = useridentityDescClaimsUserID.Default.(string)
+	// useridentityDescClaimsUsername is the schema descriptor for claims_username field.
+	useridentityDescClaimsUsername := useridentityFields[4].Descriptor()
+	// useridentity.DefaultClaimsUsername holds the default value on creation for the claims_username field.
+	useridentity.DefaultClaimsUsername = useridentityDescClaimsUsername.Default.(string)
+	// useridentityDescClaimsPreferredUsername is the schema descriptor for claims_preferred_username field.
+	useridentityDescClaimsPreferredUsername := useridentityFields[5].Descriptor()
+	// useridentity.DefaultClaimsPreferredUsername holds the default value on creation for the claims_preferred_username field.
+	useridentity.DefaultClaimsPreferredUsername = useridentityDescClaimsPreferredUsername.Default.(string)
+	// useridentityDescClaimsEmail is the schema descriptor for claims_email field.
+	useridentityDescClaimsEmail := useridentityFields[6].Descriptor()
+	// useridentity.DefaultClaimsEmail holds the default value on creation for the claims_email field.
+	useridentity.DefaultClaimsEmail = useridentityDescClaimsEmail.Default.(string)
+	// useridentityDescClaimsEmailVerified is the schema descriptor for claims_email_verified field.
+	useridentityDescClaimsEmailVerified := useridentityFields[7].Descriptor()
+	// useridentity.DefaultClaimsEmailVerified holds the default value on creation for the claims_email_verified field.
+	useridentity.DefaultClaimsEmailVerified = useridentityDescClaimsEmailVerified.Default.(bool)
+	// useridentityDescID is the schema descriptor for id field.
+	useridentityDescID := useridentityFields[0].Descriptor()
+	// useridentity.IDValidator is a validator for the "id" field. It is called by the builders before save.
+	useridentity.IDValidator = useridentityDescID.Validators[0].(func(string) error)
 }
diff --git a/storage/ent/db/runtime/runtime.go b/storage/ent/db/runtime/runtime.go
index 9000ac4746..634d2685d7 100644
--- a/storage/ent/db/runtime/runtime.go
+++ b/storage/ent/db/runtime/runtime.go
@@ -5,6 +5,6 @@ package runtime
 // The schema-stitching logic is generated in github.com/dexidp/dex/storage/ent/db/runtime.go
 
 const (
-	Version = "v0.11.2"                                         // Version of ent codegen.
-	Sum     = "h1:UM2/BUhF2FfsxPHRxLjQbhqJNaDdVlOwNIAMLs2jyto=" // Sum of ent codegen.
+	Version = "v0.14.6"                                         // Version of ent codegen.
+	Sum     = "h1:/f2696BpwuWAEEG6PVGWflg6+Inrpq4pRWuNlWz/Skk=" // Sum of ent codegen.
 )
diff --git a/storage/ent/db/tx.go b/storage/ent/db/tx.go
index 73d1944790..94f279354f 100644
--- a/storage/ent/db/tx.go
+++ b/storage/ent/db/tx.go
@@ -16,6 +16,8 @@ type Tx struct {
 	AuthCode *AuthCodeClient
 	// AuthRequest is the client for interacting with the AuthRequest builders.
 	AuthRequest *AuthRequestClient
+	// AuthSession is the client for interacting with the AuthSession builders.
+	AuthSession *AuthSessionClient
 	// Connector is the client for interacting with the Connector builders.
 	Connector *ConnectorClient
 	// DeviceRequest is the client for interacting with the DeviceRequest builders.
@@ -32,16 +34,12 @@ type Tx struct {
 	Password *PasswordClient
 	// RefreshToken is the client for interacting with the RefreshToken builders.
 	RefreshToken *RefreshTokenClient
+	// UserIdentity is the client for interacting with the UserIdentity builders.
+	UserIdentity *UserIdentityClient
 
 	// lazily loaded.
 	client     *Client
 	clientOnce sync.Once
-
-	// completion callbacks.
-	mu         sync.Mutex
-	onCommit   []CommitHook
-	onRollback []RollbackHook
-
 	// ctx lives for the life of the transaction. It is
 	// the same context used by the underlying connection.
 	ctx context.Context
@@ -86,9 +84,9 @@ func (tx *Tx) Commit() error {
 	var fn Committer = CommitFunc(func(context.Context, *Tx) error {
 		return txDriver.tx.Commit()
 	})
-	tx.mu.Lock()
-	hooks := append([]CommitHook(nil), tx.onCommit...)
-	tx.mu.Unlock()
+	txDriver.mu.Lock()
+	hooks := append([]CommitHook(nil), txDriver.onCommit...)
+	txDriver.mu.Unlock()
 	for i := len(hooks) - 1; i >= 0; i-- {
 		fn = hooks[i](fn)
 	}
@@ -97,9 +95,10 @@ func (tx *Tx) Commit() error {
 
 // OnCommit adds a hook to call on commit.
 func (tx *Tx) OnCommit(f CommitHook) {
-	tx.mu.Lock()
-	defer tx.mu.Unlock()
-	tx.onCommit = append(tx.onCommit, f)
+	txDriver := tx.config.driver.(*txDriver)
+	txDriver.mu.Lock()
+	txDriver.onCommit = append(txDriver.onCommit, f)
+	txDriver.mu.Unlock()
 }
 
 type (
@@ -141,9 +140,9 @@ func (tx *Tx) Rollback() error {
 	var fn Rollbacker = RollbackFunc(func(context.Context, *Tx) error {
 		return txDriver.tx.Rollback()
 	})
-	tx.mu.Lock()
-	hooks := append([]RollbackHook(nil), tx.onRollback...)
-	tx.mu.Unlock()
+	txDriver.mu.Lock()
+	hooks := append([]RollbackHook(nil), txDriver.onRollback...)
+	txDriver.mu.Unlock()
 	for i := len(hooks) - 1; i >= 0; i-- {
 		fn = hooks[i](fn)
 	}
@@ -152,9 +151,10 @@ func (tx *Tx) Rollback() error {
 
 // OnRollback adds a hook to call on rollback.
 func (tx *Tx) OnRollback(f RollbackHook) {
-	tx.mu.Lock()
-	defer tx.mu.Unlock()
-	tx.onRollback = append(tx.onRollback, f)
+	txDriver := tx.config.driver.(*txDriver)
+	txDriver.mu.Lock()
+	txDriver.onRollback = append(txDriver.onRollback, f)
+	txDriver.mu.Unlock()
 }
 
 // Client returns a Client that binds to current transaction.
@@ -169,6 +169,7 @@ func (tx *Tx) Client() *Client {
 func (tx *Tx) init() {
 	tx.AuthCode = NewAuthCodeClient(tx.config)
 	tx.AuthRequest = NewAuthRequestClient(tx.config)
+	tx.AuthSession = NewAuthSessionClient(tx.config)
 	tx.Connector = NewConnectorClient(tx.config)
 	tx.DeviceRequest = NewDeviceRequestClient(tx.config)
 	tx.DeviceToken = NewDeviceTokenClient(tx.config)
@@ -177,6 +178,7 @@ func (tx *Tx) init() {
 	tx.OfflineSession = NewOfflineSessionClient(tx.config)
 	tx.Password = NewPasswordClient(tx.config)
 	tx.RefreshToken = NewRefreshTokenClient(tx.config)
+	tx.UserIdentity = NewUserIdentityClient(tx.config)
 }
 
 // txDriver wraps the given dialect.Tx with a nop dialect.Driver implementation.
@@ -195,6 +197,10 @@ type txDriver struct {
 	drv dialect.Driver
 	// tx is the underlying transaction.
 	tx dialect.Tx
+	// completion hooks.
+	mu         sync.Mutex
+	onCommit   []CommitHook
+	onRollback []RollbackHook
 }
 
 // newTx creates a new transactional driver.
@@ -225,12 +231,12 @@ func (*txDriver) Commit() error { return nil }
 func (*txDriver) Rollback() error { return nil }
 
 // Exec calls tx.Exec.
-func (tx *txDriver) Exec(ctx context.Context, query string, args, v interface{}) error {
+func (tx *txDriver) Exec(ctx context.Context, query string, args, v any) error {
 	return tx.tx.Exec(ctx, query, args, v)
 }
 
 // Query calls tx.Query.
-func (tx *txDriver) Query(ctx context.Context, query string, args, v interface{}) error {
+func (tx *txDriver) Query(ctx context.Context, query string, args, v any) error {
 	return tx.tx.Query(ctx, query, args, v)
 }
 
diff --git a/storage/ent/db/useridentity.go b/storage/ent/db/useridentity.go
new file mode 100644
index 0000000000..eaa0edbfdf
--- /dev/null
+++ b/storage/ent/db/useridentity.go
@@ -0,0 +1,258 @@
+// Code generated by ent, DO NOT EDIT.
+
+package db
+
+import (
+	"encoding/json"
+	"fmt"
+	"strings"
+	"time"
+
+	"entgo.io/ent"
+	"entgo.io/ent/dialect/sql"
+	"github.com/dexidp/dex/storage/ent/db/useridentity"
+)
+
+// UserIdentity is the model entity for the UserIdentity schema.
+type UserIdentity struct {
+	config `json:"-"`
+	// ID of the ent.
+	ID string `json:"id,omitempty"`
+	// UserID holds the value of the "user_id" field.
+	UserID string `json:"user_id,omitempty"`
+	// ConnectorID holds the value of the "connector_id" field.
+	ConnectorID string `json:"connector_id,omitempty"`
+	// ClaimsUserID holds the value of the "claims_user_id" field.
+	ClaimsUserID string `json:"claims_user_id,omitempty"`
+	// ClaimsUsername holds the value of the "claims_username" field.
+	ClaimsUsername string `json:"claims_username,omitempty"`
+	// ClaimsPreferredUsername holds the value of the "claims_preferred_username" field.
+	ClaimsPreferredUsername string `json:"claims_preferred_username,omitempty"`
+	// ClaimsEmail holds the value of the "claims_email" field.
+	ClaimsEmail string `json:"claims_email,omitempty"`
+	// ClaimsEmailVerified holds the value of the "claims_email_verified" field.
+	ClaimsEmailVerified bool `json:"claims_email_verified,omitempty"`
+	// ClaimsGroups holds the value of the "claims_groups" field.
+	ClaimsGroups []string `json:"claims_groups,omitempty"`
+	// Consents holds the value of the "consents" field.
+	Consents []byte `json:"consents,omitempty"`
+	// MfaSecrets holds the value of the "mfa_secrets" field.
+	MfaSecrets *[]byte `json:"mfa_secrets,omitempty"`
+	// WebauthnCredentials holds the value of the "webauthn_credentials" field.
+	WebauthnCredentials *[]byte `json:"webauthn_credentials,omitempty"`
+	// CreatedAt holds the value of the "created_at" field.
+	CreatedAt time.Time `json:"created_at,omitempty"`
+	// LastLogin holds the value of the "last_login" field.
+	LastLogin time.Time `json:"last_login,omitempty"`
+	// BlockedUntil holds the value of the "blocked_until" field.
+	BlockedUntil time.Time `json:"blocked_until,omitempty"`
+	selectValues sql.SelectValues
+}
+
+// scanValues returns the types for scanning values from sql.Rows.
+func (*UserIdentity) scanValues(columns []string) ([]any, error) {
+	values := make([]any, len(columns))
+	for i := range columns {
+		switch columns[i] {
+		case useridentity.FieldClaimsGroups, useridentity.FieldConsents, useridentity.FieldMfaSecrets, useridentity.FieldWebauthnCredentials:
+			values[i] = new([]byte)
+		case useridentity.FieldClaimsEmailVerified:
+			values[i] = new(sql.NullBool)
+		case useridentity.FieldID, useridentity.FieldUserID, useridentity.FieldConnectorID, useridentity.FieldClaimsUserID, useridentity.FieldClaimsUsername, useridentity.FieldClaimsPreferredUsername, useridentity.FieldClaimsEmail:
+			values[i] = new(sql.NullString)
+		case useridentity.FieldCreatedAt, useridentity.FieldLastLogin, useridentity.FieldBlockedUntil:
+			values[i] = new(sql.NullTime)
+		default:
+			values[i] = new(sql.UnknownType)
+		}
+	}
+	return values, nil
+}
+
+// assignValues assigns the values that were returned from sql.Rows (after scanning)
+// to the UserIdentity fields.
+func (_m *UserIdentity) assignValues(columns []string, values []any) error {
+	if m, n := len(values), len(columns); m < n {
+		return fmt.Errorf("mismatch number of scan values: %d != %d", m, n)
+	}
+	for i := range columns {
+		switch columns[i] {
+		case useridentity.FieldID:
+			if value, ok := values[i].(*sql.NullString); !ok {
+				return fmt.Errorf("unexpected type %T for field id", values[i])
+			} else if value.Valid {
+				_m.ID = value.String
+			}
+		case useridentity.FieldUserID:
+			if value, ok := values[i].(*sql.NullString); !ok {
+				return fmt.Errorf("unexpected type %T for field user_id", values[i])
+			} else if value.Valid {
+				_m.UserID = value.String
+			}
+		case useridentity.FieldConnectorID:
+			if value, ok := values[i].(*sql.NullString); !ok {
+				return fmt.Errorf("unexpected type %T for field connector_id", values[i])
+			} else if value.Valid {
+				_m.ConnectorID = value.String
+			}
+		case useridentity.FieldClaimsUserID:
+			if value, ok := values[i].(*sql.NullString); !ok {
+				return fmt.Errorf("unexpected type %T for field claims_user_id", values[i])
+			} else if value.Valid {
+				_m.ClaimsUserID = value.String
+			}
+		case useridentity.FieldClaimsUsername:
+			if value, ok := values[i].(*sql.NullString); !ok {
+				return fmt.Errorf("unexpected type %T for field claims_username", values[i])
+			} else if value.Valid {
+				_m.ClaimsUsername = value.String
+			}
+		case useridentity.FieldClaimsPreferredUsername:
+			if value, ok := values[i].(*sql.NullString); !ok {
+				return fmt.Errorf("unexpected type %T for field claims_preferred_username", values[i])
+			} else if value.Valid {
+				_m.ClaimsPreferredUsername = value.String
+			}
+		case useridentity.FieldClaimsEmail:
+			if value, ok := values[i].(*sql.NullString); !ok {
+				return fmt.Errorf("unexpected type %T for field claims_email", values[i])
+			} else if value.Valid {
+				_m.ClaimsEmail = value.String
+			}
+		case useridentity.FieldClaimsEmailVerified:
+			if value, ok := values[i].(*sql.NullBool); !ok {
+				return fmt.Errorf("unexpected type %T for field claims_email_verified", values[i])
+			} else if value.Valid {
+				_m.ClaimsEmailVerified = value.Bool
+			}
+		case useridentity.FieldClaimsGroups:
+			if value, ok := values[i].(*[]byte); !ok {
+				return fmt.Errorf("unexpected type %T for field claims_groups", values[i])
+			} else if value != nil && len(*value) > 0 {
+				if err := json.Unmarshal(*value, &_m.ClaimsGroups); err != nil {
+					return fmt.Errorf("unmarshal field claims_groups: %w", err)
+				}
+			}
+		case useridentity.FieldConsents:
+			if value, ok := values[i].(*[]byte); !ok {
+				return fmt.Errorf("unexpected type %T for field consents", values[i])
+			} else if value != nil {
+				_m.Consents = *value
+			}
+		case useridentity.FieldMfaSecrets:
+			if value, ok := values[i].(*[]byte); !ok {
+				return fmt.Errorf("unexpected type %T for field mfa_secrets", values[i])
+			} else if value != nil {
+				_m.MfaSecrets = value
+			}
+		case useridentity.FieldWebauthnCredentials:
+			if value, ok := values[i].(*[]byte); !ok {
+				return fmt.Errorf("unexpected type %T for field webauthn_credentials", values[i])
+			} else if value != nil {
+				_m.WebauthnCredentials = value
+			}
+		case useridentity.FieldCreatedAt:
+			if value, ok := values[i].(*sql.NullTime); !ok {
+				return fmt.Errorf("unexpected type %T for field created_at", values[i])
+			} else if value.Valid {
+				_m.CreatedAt = value.Time
+			}
+		case useridentity.FieldLastLogin:
+			if value, ok := values[i].(*sql.NullTime); !ok {
+				return fmt.Errorf("unexpected type %T for field last_login", values[i])
+			} else if value.Valid {
+				_m.LastLogin = value.Time
+			}
+		case useridentity.FieldBlockedUntil:
+			if value, ok := values[i].(*sql.NullTime); !ok {
+				return fmt.Errorf("unexpected type %T for field blocked_until", values[i])
+			} else if value.Valid {
+				_m.BlockedUntil = value.Time
+			}
+		default:
+			_m.selectValues.Set(columns[i], values[i])
+		}
+	}
+	return nil
+}
+
+// Value returns the ent.Value that was dynamically selected and assigned to the UserIdentity.
+// This includes values selected through modifiers, order, etc.
+func (_m *UserIdentity) Value(name string) (ent.Value, error) {
+	return _m.selectValues.Get(name)
+}
+
+// Update returns a builder for updating this UserIdentity.
+// Note that you need to call UserIdentity.Unwrap() before calling this method if this UserIdentity
+// was returned from a transaction, and the transaction was committed or rolled back.
+func (_m *UserIdentity) Update() *UserIdentityUpdateOne {
+	return NewUserIdentityClient(_m.config).UpdateOne(_m)
+}
+
+// Unwrap unwraps the UserIdentity entity that was returned from a transaction after it was closed,
+// so that all future queries will be executed through the driver which created the transaction.
+func (_m *UserIdentity) Unwrap() *UserIdentity {
+	_tx, ok := _m.config.driver.(*txDriver)
+	if !ok {
+		panic("db: UserIdentity is not a transactional entity")
+	}
+	_m.config.driver = _tx.drv
+	return _m
+}
+
+// String implements the fmt.Stringer.
+func (_m *UserIdentity) String() string {
+	var builder strings.Builder
+	builder.WriteString("UserIdentity(")
+	builder.WriteString(fmt.Sprintf("id=%v, ", _m.ID))
+	builder.WriteString("user_id=")
+	builder.WriteString(_m.UserID)
+	builder.WriteString(", ")
+	builder.WriteString("connector_id=")
+	builder.WriteString(_m.ConnectorID)
+	builder.WriteString(", ")
+	builder.WriteString("claims_user_id=")
+	builder.WriteString(_m.ClaimsUserID)
+	builder.WriteString(", ")
+	builder.WriteString("claims_username=")
+	builder.WriteString(_m.ClaimsUsername)
+	builder.WriteString(", ")
+	builder.WriteString("claims_preferred_username=")
+	builder.WriteString(_m.ClaimsPreferredUsername)
+	builder.WriteString(", ")
+	builder.WriteString("claims_email=")
+	builder.WriteString(_m.ClaimsEmail)
+	builder.WriteString(", ")
+	builder.WriteString("claims_email_verified=")
+	builder.WriteString(fmt.Sprintf("%v", _m.ClaimsEmailVerified))
+	builder.WriteString(", ")
+	builder.WriteString("claims_groups=")
+	builder.WriteString(fmt.Sprintf("%v", _m.ClaimsGroups))
+	builder.WriteString(", ")
+	builder.WriteString("consents=")
+	builder.WriteString(fmt.Sprintf("%v", _m.Consents))
+	builder.WriteString(", ")
+	if v := _m.MfaSecrets; v != nil {
+		builder.WriteString("mfa_secrets=")
+		builder.WriteString(fmt.Sprintf("%v", *v))
+	}
+	builder.WriteString(", ")
+	if v := _m.WebauthnCredentials; v != nil {
+		builder.WriteString("webauthn_credentials=")
+		builder.WriteString(fmt.Sprintf("%v", *v))
+	}
+	builder.WriteString(", ")
+	builder.WriteString("created_at=")
+	builder.WriteString(_m.CreatedAt.Format(time.ANSIC))
+	builder.WriteString(", ")
+	builder.WriteString("last_login=")
+	builder.WriteString(_m.LastLogin.Format(time.ANSIC))
+	builder.WriteString(", ")
+	builder.WriteString("blocked_until=")
+	builder.WriteString(_m.BlockedUntil.Format(time.ANSIC))
+	builder.WriteByte(')')
+	return builder.String()
+}
+
+// UserIdentities is a parsable slice of UserIdentity.
+type UserIdentities []*UserIdentity
diff --git a/storage/ent/db/useridentity/useridentity.go b/storage/ent/db/useridentity/useridentity.go
new file mode 100644
index 0000000000..63781c7840
--- /dev/null
+++ b/storage/ent/db/useridentity/useridentity.go
@@ -0,0 +1,150 @@
+// Code generated by ent, DO NOT EDIT.
+
+package useridentity
+
+import (
+	"entgo.io/ent/dialect/sql"
+)
+
+const (
+	// Label holds the string label denoting the useridentity type in the database.
+	Label = "user_identity"
+	// FieldID holds the string denoting the id field in the database.
+	FieldID = "id"
+	// FieldUserID holds the string denoting the user_id field in the database.
+	FieldUserID = "user_id"
+	// FieldConnectorID holds the string denoting the connector_id field in the database.
+	FieldConnectorID = "connector_id"
+	// FieldClaimsUserID holds the string denoting the claims_user_id field in the database.
+	FieldClaimsUserID = "claims_user_id"
+	// FieldClaimsUsername holds the string denoting the claims_username field in the database.
+	FieldClaimsUsername = "claims_username"
+	// FieldClaimsPreferredUsername holds the string denoting the claims_preferred_username field in the database.
+	FieldClaimsPreferredUsername = "claims_preferred_username"
+	// FieldClaimsEmail holds the string denoting the claims_email field in the database.
+	FieldClaimsEmail = "claims_email"
+	// FieldClaimsEmailVerified holds the string denoting the claims_email_verified field in the database.
+	FieldClaimsEmailVerified = "claims_email_verified"
+	// FieldClaimsGroups holds the string denoting the claims_groups field in the database.
+	FieldClaimsGroups = "claims_groups"
+	// FieldConsents holds the string denoting the consents field in the database.
+	FieldConsents = "consents"
+	// FieldMfaSecrets holds the string denoting the mfa_secrets field in the database.
+	FieldMfaSecrets = "mfa_secrets"
+	// FieldWebauthnCredentials holds the string denoting the webauthn_credentials field in the database.
+	FieldWebauthnCredentials = "webauthn_credentials"
+	// FieldCreatedAt holds the string denoting the created_at field in the database.
+	FieldCreatedAt = "created_at"
+	// FieldLastLogin holds the string denoting the last_login field in the database.
+	FieldLastLogin = "last_login"
+	// FieldBlockedUntil holds the string denoting the blocked_until field in the database.
+	FieldBlockedUntil = "blocked_until"
+	// Table holds the table name of the useridentity in the database.
+	Table = "user_identities"
+)
+
+// Columns holds all SQL columns for useridentity fields.
+var Columns = []string{
+	FieldID,
+	FieldUserID,
+	FieldConnectorID,
+	FieldClaimsUserID,
+	FieldClaimsUsername,
+	FieldClaimsPreferredUsername,
+	FieldClaimsEmail,
+	FieldClaimsEmailVerified,
+	FieldClaimsGroups,
+	FieldConsents,
+	FieldMfaSecrets,
+	FieldWebauthnCredentials,
+	FieldCreatedAt,
+	FieldLastLogin,
+	FieldBlockedUntil,
+}
+
+// ValidColumn reports if the column name is valid (part of the table columns).
+func ValidColumn(column string) bool {
+	for i := range Columns {
+		if column == Columns[i] {
+			return true
+		}
+	}
+	return false
+}
+
+var (
+	// UserIDValidator is a validator for the "user_id" field. It is called by the builders before save.
+	UserIDValidator func(string) error
+	// ConnectorIDValidator is a validator for the "connector_id" field. It is called by the builders before save.
+	ConnectorIDValidator func(string) error
+	// DefaultClaimsUserID holds the default value on creation for the "claims_user_id" field.
+	DefaultClaimsUserID string
+	// DefaultClaimsUsername holds the default value on creation for the "claims_username" field.
+	DefaultClaimsUsername string
+	// DefaultClaimsPreferredUsername holds the default value on creation for the "claims_preferred_username" field.
+	DefaultClaimsPreferredUsername string
+	// DefaultClaimsEmail holds the default value on creation for the "claims_email" field.
+	DefaultClaimsEmail string
+	// DefaultClaimsEmailVerified holds the default value on creation for the "claims_email_verified" field.
+	DefaultClaimsEmailVerified bool
+	// IDValidator is a validator for the "id" field. It is called by the builders before save.
+	IDValidator func(string) error
+)
+
+// OrderOption defines the ordering options for the UserIdentity queries.
+type OrderOption func(*sql.Selector)
+
+// ByID orders the results by the id field.
+func ByID(opts ...sql.OrderTermOption) OrderOption {
+	return sql.OrderByField(FieldID, opts...).ToFunc()
+}
+
+// ByUserID orders the results by the user_id field.
+func ByUserID(opts ...sql.OrderTermOption) OrderOption {
+	return sql.OrderByField(FieldUserID, opts...).ToFunc()
+}
+
+// ByConnectorID orders the results by the connector_id field.
+func ByConnectorID(opts ...sql.OrderTermOption) OrderOption {
+	return sql.OrderByField(FieldConnectorID, opts...).ToFunc()
+}
+
+// ByClaimsUserID orders the results by the claims_user_id field.
+func ByClaimsUserID(opts ...sql.OrderTermOption) OrderOption {
+	return sql.OrderByField(FieldClaimsUserID, opts...).ToFunc()
+}
+
+// ByClaimsUsername orders the results by the claims_username field.
+func ByClaimsUsername(opts ...sql.OrderTermOption) OrderOption {
+	return sql.OrderByField(FieldClaimsUsername, opts...).ToFunc()
+}
+
+// ByClaimsPreferredUsername orders the results by the claims_preferred_username field.
+func ByClaimsPreferredUsername(opts ...sql.OrderTermOption) OrderOption {
+	return sql.OrderByField(FieldClaimsPreferredUsername, opts...).ToFunc()
+}
+
+// ByClaimsEmail orders the results by the claims_email field.
+func ByClaimsEmail(opts ...sql.OrderTermOption) OrderOption {
+	return sql.OrderByField(FieldClaimsEmail, opts...).ToFunc()
+}
+
+// ByClaimsEmailVerified orders the results by the claims_email_verified field.
+func ByClaimsEmailVerified(opts ...sql.OrderTermOption) OrderOption {
+	return sql.OrderByField(FieldClaimsEmailVerified, opts...).ToFunc()
+}
+
+// ByCreatedAt orders the results by the created_at field.
+func ByCreatedAt(opts ...sql.OrderTermOption) OrderOption {
+	return sql.OrderByField(FieldCreatedAt, opts...).ToFunc()
+}
+
+// ByLastLogin orders the results by the last_login field.
+func ByLastLogin(opts ...sql.OrderTermOption) OrderOption {
+	return sql.OrderByField(FieldLastLogin, opts...).ToFunc()
+}
+
+// ByBlockedUntil orders the results by the blocked_until field.
+func ByBlockedUntil(opts ...sql.OrderTermOption) OrderOption {
+	return sql.OrderByField(FieldBlockedUntil, opts...).ToFunc()
+}
diff --git a/storage/ent/db/useridentity/where.go b/storage/ent/db/useridentity/where.go
new file mode 100644
index 0000000000..e902d359d1
--- /dev/null
+++ b/storage/ent/db/useridentity/where.go
@@ -0,0 +1,815 @@
+// Code generated by ent, DO NOT EDIT.
+
+package useridentity
+
+import (
+	"time"
+
+	"entgo.io/ent/dialect/sql"
+	"github.com/dexidp/dex/storage/ent/db/predicate"
+)
+
+// ID filters vertices based on their ID field.
+func ID(id string) predicate.UserIdentity {
+	return predicate.UserIdentity(sql.FieldEQ(FieldID, id))
+}
+
+// IDEQ applies the EQ predicate on the ID field.
+func IDEQ(id string) predicate.UserIdentity {
+	return predicate.UserIdentity(sql.FieldEQ(FieldID, id))
+}
+
+// IDNEQ applies the NEQ predicate on the ID field.
+func IDNEQ(id string) predicate.UserIdentity {
+	return predicate.UserIdentity(sql.FieldNEQ(FieldID, id))
+}
+
+// IDIn applies the In predicate on the ID field.
+func IDIn(ids ...string) predicate.UserIdentity {
+	return predicate.UserIdentity(sql.FieldIn(FieldID, ids...))
+}
+
+// IDNotIn applies the NotIn predicate on the ID field.
+func IDNotIn(ids ...string) predicate.UserIdentity {
+	return predicate.UserIdentity(sql.FieldNotIn(FieldID, ids...))
+}
+
+// IDGT applies the GT predicate on the ID field.
+func IDGT(id string) predicate.UserIdentity {
+	return predicate.UserIdentity(sql.FieldGT(FieldID, id))
+}
+
+// IDGTE applies the GTE predicate on the ID field.
+func IDGTE(id string) predicate.UserIdentity {
+	return predicate.UserIdentity(sql.FieldGTE(FieldID, id))
+}
+
+// IDLT applies the LT predicate on the ID field.
+func IDLT(id string) predicate.UserIdentity {
+	return predicate.UserIdentity(sql.FieldLT(FieldID, id))
+}
+
+// IDLTE applies the LTE predicate on the ID field.
+func IDLTE(id string) predicate.UserIdentity {
+	return predicate.UserIdentity(sql.FieldLTE(FieldID, id))
+}
+
+// IDEqualFold applies the EqualFold predicate on the ID field.
+func IDEqualFold(id string) predicate.UserIdentity {
+	return predicate.UserIdentity(sql.FieldEqualFold(FieldID, id))
+}
+
+// IDContainsFold applies the ContainsFold predicate on the ID field.
+func IDContainsFold(id string) predicate.UserIdentity {
+	return predicate.UserIdentity(sql.FieldContainsFold(FieldID, id))
+}
+
+// UserID applies equality check predicate on the "user_id" field. It's identical to UserIDEQ.
+func UserID(v string) predicate.UserIdentity {
+	return predicate.UserIdentity(sql.FieldEQ(FieldUserID, v))
+}
+
+// ConnectorID applies equality check predicate on the "connector_id" field. It's identical to ConnectorIDEQ.
+func ConnectorID(v string) predicate.UserIdentity {
+	return predicate.UserIdentity(sql.FieldEQ(FieldConnectorID, v))
+}
+
+// ClaimsUserID applies equality check predicate on the "claims_user_id" field. It's identical to ClaimsUserIDEQ.
+func ClaimsUserID(v string) predicate.UserIdentity {
+	return predicate.UserIdentity(sql.FieldEQ(FieldClaimsUserID, v))
+}
+
+// ClaimsUsername applies equality check predicate on the "claims_username" field. It's identical to ClaimsUsernameEQ.
+func ClaimsUsername(v string) predicate.UserIdentity {
+	return predicate.UserIdentity(sql.FieldEQ(FieldClaimsUsername, v))
+}
+
+// ClaimsPreferredUsername applies equality check predicate on the "claims_preferred_username" field. It's identical to ClaimsPreferredUsernameEQ.
+func ClaimsPreferredUsername(v string) predicate.UserIdentity {
+	return predicate.UserIdentity(sql.FieldEQ(FieldClaimsPreferredUsername, v))
+}
+
+// ClaimsEmail applies equality check predicate on the "claims_email" field. It's identical to ClaimsEmailEQ.
+func ClaimsEmail(v string) predicate.UserIdentity {
+	return predicate.UserIdentity(sql.FieldEQ(FieldClaimsEmail, v))
+}
+
+// ClaimsEmailVerified applies equality check predicate on the "claims_email_verified" field. It's identical to ClaimsEmailVerifiedEQ.
+func ClaimsEmailVerified(v bool) predicate.UserIdentity {
+	return predicate.UserIdentity(sql.FieldEQ(FieldClaimsEmailVerified, v))
+}
+
+// Consents applies equality check predicate on the "consents" field. It's identical to ConsentsEQ.
+func Consents(v []byte) predicate.UserIdentity {
+	return predicate.UserIdentity(sql.FieldEQ(FieldConsents, v))
+}
+
+// MfaSecrets applies equality check predicate on the "mfa_secrets" field. It's identical to MfaSecretsEQ.
+func MfaSecrets(v []byte) predicate.UserIdentity {
+	return predicate.UserIdentity(sql.FieldEQ(FieldMfaSecrets, v))
+}
+
+// WebauthnCredentials applies equality check predicate on the "webauthn_credentials" field. It's identical to WebauthnCredentialsEQ.
+func WebauthnCredentials(v []byte) predicate.UserIdentity {
+	return predicate.UserIdentity(sql.FieldEQ(FieldWebauthnCredentials, v))
+}
+
+// CreatedAt applies equality check predicate on the "created_at" field. It's identical to CreatedAtEQ.
+func CreatedAt(v time.Time) predicate.UserIdentity {
+	return predicate.UserIdentity(sql.FieldEQ(FieldCreatedAt, v))
+}
+
+// LastLogin applies equality check predicate on the "last_login" field. It's identical to LastLoginEQ.
+func LastLogin(v time.Time) predicate.UserIdentity {
+	return predicate.UserIdentity(sql.FieldEQ(FieldLastLogin, v))
+}
+
+// BlockedUntil applies equality check predicate on the "blocked_until" field. It's identical to BlockedUntilEQ.
+func BlockedUntil(v time.Time) predicate.UserIdentity {
+	return predicate.UserIdentity(sql.FieldEQ(FieldBlockedUntil, v))
+}
+
+// UserIDEQ applies the EQ predicate on the "user_id" field.
+func UserIDEQ(v string) predicate.UserIdentity {
+	return predicate.UserIdentity(sql.FieldEQ(FieldUserID, v))
+}
+
+// UserIDNEQ applies the NEQ predicate on the "user_id" field.
+func UserIDNEQ(v string) predicate.UserIdentity {
+	return predicate.UserIdentity(sql.FieldNEQ(FieldUserID, v))
+}
+
+// UserIDIn applies the In predicate on the "user_id" field.
+func UserIDIn(vs ...string) predicate.UserIdentity {
+	return predicate.UserIdentity(sql.FieldIn(FieldUserID, vs...))
+}
+
+// UserIDNotIn applies the NotIn predicate on the "user_id" field.
+func UserIDNotIn(vs ...string) predicate.UserIdentity {
+	return predicate.UserIdentity(sql.FieldNotIn(FieldUserID, vs...))
+}
+
+// UserIDGT applies the GT predicate on the "user_id" field.
+func UserIDGT(v string) predicate.UserIdentity {
+	return predicate.UserIdentity(sql.FieldGT(FieldUserID, v))
+}
+
+// UserIDGTE applies the GTE predicate on the "user_id" field.
+func UserIDGTE(v string) predicate.UserIdentity {
+	return predicate.UserIdentity(sql.FieldGTE(FieldUserID, v))
+}
+
+// UserIDLT applies the LT predicate on the "user_id" field.
+func UserIDLT(v string) predicate.UserIdentity {
+	return predicate.UserIdentity(sql.FieldLT(FieldUserID, v))
+}
+
+// UserIDLTE applies the LTE predicate on the "user_id" field.
+func UserIDLTE(v string) predicate.UserIdentity {
+	return predicate.UserIdentity(sql.FieldLTE(FieldUserID, v))
+}
+
+// UserIDContains applies the Contains predicate on the "user_id" field.
+func UserIDContains(v string) predicate.UserIdentity {
+	return predicate.UserIdentity(sql.FieldContains(FieldUserID, v))
+}
+
+// UserIDHasPrefix applies the HasPrefix predicate on the "user_id" field.
+func UserIDHasPrefix(v string) predicate.UserIdentity {
+	return predicate.UserIdentity(sql.FieldHasPrefix(FieldUserID, v))
+}
+
+// UserIDHasSuffix applies the HasSuffix predicate on the "user_id" field.
+func UserIDHasSuffix(v string) predicate.UserIdentity {
+	return predicate.UserIdentity(sql.FieldHasSuffix(FieldUserID, v))
+}
+
+// UserIDEqualFold applies the EqualFold predicate on the "user_id" field.
+func UserIDEqualFold(v string) predicate.UserIdentity {
+	return predicate.UserIdentity(sql.FieldEqualFold(FieldUserID, v))
+}
+
+// UserIDContainsFold applies the ContainsFold predicate on the "user_id" field.
+func UserIDContainsFold(v string) predicate.UserIdentity {
+	return predicate.UserIdentity(sql.FieldContainsFold(FieldUserID, v))
+}
+
+// ConnectorIDEQ applies the EQ predicate on the "connector_id" field.
+func ConnectorIDEQ(v string) predicate.UserIdentity {
+	return predicate.UserIdentity(sql.FieldEQ(FieldConnectorID, v))
+}
+
+// ConnectorIDNEQ applies the NEQ predicate on the "connector_id" field.
+func ConnectorIDNEQ(v string) predicate.UserIdentity {
+	return predicate.UserIdentity(sql.FieldNEQ(FieldConnectorID, v))
+}
+
+// ConnectorIDIn applies the In predicate on the "connector_id" field.
+func ConnectorIDIn(vs ...string) predicate.UserIdentity {
+	return predicate.UserIdentity(sql.FieldIn(FieldConnectorID, vs...))
+}
+
+// ConnectorIDNotIn applies the NotIn predicate on the "connector_id" field.
+func ConnectorIDNotIn(vs ...string) predicate.UserIdentity {
+	return predicate.UserIdentity(sql.FieldNotIn(FieldConnectorID, vs...))
+}
+
+// ConnectorIDGT applies the GT predicate on the "connector_id" field.
+func ConnectorIDGT(v string) predicate.UserIdentity {
+	return predicate.UserIdentity(sql.FieldGT(FieldConnectorID, v))
+}
+
+// ConnectorIDGTE applies the GTE predicate on the "connector_id" field.
+func ConnectorIDGTE(v string) predicate.UserIdentity {
+	return predicate.UserIdentity(sql.FieldGTE(FieldConnectorID, v))
+}
+
+// ConnectorIDLT applies the LT predicate on the "connector_id" field.
+func ConnectorIDLT(v string) predicate.UserIdentity {
+	return predicate.UserIdentity(sql.FieldLT(FieldConnectorID, v))
+}
+
+// ConnectorIDLTE applies the LTE predicate on the "connector_id" field.
+func ConnectorIDLTE(v string) predicate.UserIdentity {
+	return predicate.UserIdentity(sql.FieldLTE(FieldConnectorID, v))
+}
+
+// ConnectorIDContains applies the Contains predicate on the "connector_id" field.
+func ConnectorIDContains(v string) predicate.UserIdentity {
+	return predicate.UserIdentity(sql.FieldContains(FieldConnectorID, v))
+}
+
+// ConnectorIDHasPrefix applies the HasPrefix predicate on the "connector_id" field.
+func ConnectorIDHasPrefix(v string) predicate.UserIdentity {
+	return predicate.UserIdentity(sql.FieldHasPrefix(FieldConnectorID, v))
+}
+
+// ConnectorIDHasSuffix applies the HasSuffix predicate on the "connector_id" field.
+func ConnectorIDHasSuffix(v string) predicate.UserIdentity {
+	return predicate.UserIdentity(sql.FieldHasSuffix(FieldConnectorID, v))
+}
+
+// ConnectorIDEqualFold applies the EqualFold predicate on the "connector_id" field.
+func ConnectorIDEqualFold(v string) predicate.UserIdentity {
+	return predicate.UserIdentity(sql.FieldEqualFold(FieldConnectorID, v))
+}
+
+// ConnectorIDContainsFold applies the ContainsFold predicate on the "connector_id" field.
+func ConnectorIDContainsFold(v string) predicate.UserIdentity {
+	return predicate.UserIdentity(sql.FieldContainsFold(FieldConnectorID, v))
+}
+
+// ClaimsUserIDEQ applies the EQ predicate on the "claims_user_id" field.
+func ClaimsUserIDEQ(v string) predicate.UserIdentity {
+	return predicate.UserIdentity(sql.FieldEQ(FieldClaimsUserID, v))
+}
+
+// ClaimsUserIDNEQ applies the NEQ predicate on the "claims_user_id" field.
+func ClaimsUserIDNEQ(v string) predicate.UserIdentity {
+	return predicate.UserIdentity(sql.FieldNEQ(FieldClaimsUserID, v))
+}
+
+// ClaimsUserIDIn applies the In predicate on the "claims_user_id" field.
+func ClaimsUserIDIn(vs ...string) predicate.UserIdentity {
+	return predicate.UserIdentity(sql.FieldIn(FieldClaimsUserID, vs...))
+}
+
+// ClaimsUserIDNotIn applies the NotIn predicate on the "claims_user_id" field.
+func ClaimsUserIDNotIn(vs ...string) predicate.UserIdentity {
+	return predicate.UserIdentity(sql.FieldNotIn(FieldClaimsUserID, vs...))
+}
+
+// ClaimsUserIDGT applies the GT predicate on the "claims_user_id" field.
+func ClaimsUserIDGT(v string) predicate.UserIdentity {
+	return predicate.UserIdentity(sql.FieldGT(FieldClaimsUserID, v))
+}
+
+// ClaimsUserIDGTE applies the GTE predicate on the "claims_user_id" field.
+func ClaimsUserIDGTE(v string) predicate.UserIdentity {
+	return predicate.UserIdentity(sql.FieldGTE(FieldClaimsUserID, v))
+}
+
+// ClaimsUserIDLT applies the LT predicate on the "claims_user_id" field.
+func ClaimsUserIDLT(v string) predicate.UserIdentity {
+	return predicate.UserIdentity(sql.FieldLT(FieldClaimsUserID, v))
+}
+
+// ClaimsUserIDLTE applies the LTE predicate on the "claims_user_id" field.
+func ClaimsUserIDLTE(v string) predicate.UserIdentity {
+	return predicate.UserIdentity(sql.FieldLTE(FieldClaimsUserID, v))
+}
+
+// ClaimsUserIDContains applies the Contains predicate on the "claims_user_id" field.
+func ClaimsUserIDContains(v string) predicate.UserIdentity {
+	return predicate.UserIdentity(sql.FieldContains(FieldClaimsUserID, v))
+}
+
+// ClaimsUserIDHasPrefix applies the HasPrefix predicate on the "claims_user_id" field.
+func ClaimsUserIDHasPrefix(v string) predicate.UserIdentity {
+	return predicate.UserIdentity(sql.FieldHasPrefix(FieldClaimsUserID, v))
+}
+
+// ClaimsUserIDHasSuffix applies the HasSuffix predicate on the "claims_user_id" field.
+func ClaimsUserIDHasSuffix(v string) predicate.UserIdentity {
+	return predicate.UserIdentity(sql.FieldHasSuffix(FieldClaimsUserID, v))
+}
+
+// ClaimsUserIDEqualFold applies the EqualFold predicate on the "claims_user_id" field.
+func ClaimsUserIDEqualFold(v string) predicate.UserIdentity {
+	return predicate.UserIdentity(sql.FieldEqualFold(FieldClaimsUserID, v))
+}
+
+// ClaimsUserIDContainsFold applies the ContainsFold predicate on the "claims_user_id" field.
+func ClaimsUserIDContainsFold(v string) predicate.UserIdentity {
+	return predicate.UserIdentity(sql.FieldContainsFold(FieldClaimsUserID, v))
+}
+
+// ClaimsUsernameEQ applies the EQ predicate on the "claims_username" field.
+func ClaimsUsernameEQ(v string) predicate.UserIdentity {
+	return predicate.UserIdentity(sql.FieldEQ(FieldClaimsUsername, v))
+}
+
+// ClaimsUsernameNEQ applies the NEQ predicate on the "claims_username" field.
+func ClaimsUsernameNEQ(v string) predicate.UserIdentity {
+	return predicate.UserIdentity(sql.FieldNEQ(FieldClaimsUsername, v))
+}
+
+// ClaimsUsernameIn applies the In predicate on the "claims_username" field.
+func ClaimsUsernameIn(vs ...string) predicate.UserIdentity {
+	return predicate.UserIdentity(sql.FieldIn(FieldClaimsUsername, vs...))
+}
+
+// ClaimsUsernameNotIn applies the NotIn predicate on the "claims_username" field.
+func ClaimsUsernameNotIn(vs ...string) predicate.UserIdentity {
+	return predicate.UserIdentity(sql.FieldNotIn(FieldClaimsUsername, vs...))
+}
+
+// ClaimsUsernameGT applies the GT predicate on the "claims_username" field.
+func ClaimsUsernameGT(v string) predicate.UserIdentity {
+	return predicate.UserIdentity(sql.FieldGT(FieldClaimsUsername, v))
+}
+
+// ClaimsUsernameGTE applies the GTE predicate on the "claims_username" field.
+func ClaimsUsernameGTE(v string) predicate.UserIdentity {
+	return predicate.UserIdentity(sql.FieldGTE(FieldClaimsUsername, v))
+}
+
+// ClaimsUsernameLT applies the LT predicate on the "claims_username" field.
+func ClaimsUsernameLT(v string) predicate.UserIdentity {
+	return predicate.UserIdentity(sql.FieldLT(FieldClaimsUsername, v))
+}
+
+// ClaimsUsernameLTE applies the LTE predicate on the "claims_username" field.
+func ClaimsUsernameLTE(v string) predicate.UserIdentity {
+	return predicate.UserIdentity(sql.FieldLTE(FieldClaimsUsername, v))
+}
+
+// ClaimsUsernameContains applies the Contains predicate on the "claims_username" field.
+func ClaimsUsernameContains(v string) predicate.UserIdentity {
+	return predicate.UserIdentity(sql.FieldContains(FieldClaimsUsername, v))
+}
+
+// ClaimsUsernameHasPrefix applies the HasPrefix predicate on the "claims_username" field.
+func ClaimsUsernameHasPrefix(v string) predicate.UserIdentity {
+	return predicate.UserIdentity(sql.FieldHasPrefix(FieldClaimsUsername, v))
+}
+
+// ClaimsUsernameHasSuffix applies the HasSuffix predicate on the "claims_username" field.
+func ClaimsUsernameHasSuffix(v string) predicate.UserIdentity {
+	return predicate.UserIdentity(sql.FieldHasSuffix(FieldClaimsUsername, v))
+}
+
+// ClaimsUsernameEqualFold applies the EqualFold predicate on the "claims_username" field.
+func ClaimsUsernameEqualFold(v string) predicate.UserIdentity {
+	return predicate.UserIdentity(sql.FieldEqualFold(FieldClaimsUsername, v))
+}
+
+// ClaimsUsernameContainsFold applies the ContainsFold predicate on the "claims_username" field.
+func ClaimsUsernameContainsFold(v string) predicate.UserIdentity {
+	return predicate.UserIdentity(sql.FieldContainsFold(FieldClaimsUsername, v))
+}
+
+// ClaimsPreferredUsernameEQ applies the EQ predicate on the "claims_preferred_username" field.
+func ClaimsPreferredUsernameEQ(v string) predicate.UserIdentity {
+	return predicate.UserIdentity(sql.FieldEQ(FieldClaimsPreferredUsername, v))
+}
+
+// ClaimsPreferredUsernameNEQ applies the NEQ predicate on the "claims_preferred_username" field.
+func ClaimsPreferredUsernameNEQ(v string) predicate.UserIdentity {
+	return predicate.UserIdentity(sql.FieldNEQ(FieldClaimsPreferredUsername, v))
+}
+
+// ClaimsPreferredUsernameIn applies the In predicate on the "claims_preferred_username" field.
+func ClaimsPreferredUsernameIn(vs ...string) predicate.UserIdentity {
+	return predicate.UserIdentity(sql.FieldIn(FieldClaimsPreferredUsername, vs...))
+}
+
+// ClaimsPreferredUsernameNotIn applies the NotIn predicate on the "claims_preferred_username" field.
+func ClaimsPreferredUsernameNotIn(vs ...string) predicate.UserIdentity {
+	return predicate.UserIdentity(sql.FieldNotIn(FieldClaimsPreferredUsername, vs...))
+}
+
+// ClaimsPreferredUsernameGT applies the GT predicate on the "claims_preferred_username" field.
+func ClaimsPreferredUsernameGT(v string) predicate.UserIdentity {
+	return predicate.UserIdentity(sql.FieldGT(FieldClaimsPreferredUsername, v))
+}
+
+// ClaimsPreferredUsernameGTE applies the GTE predicate on the "claims_preferred_username" field.
+func ClaimsPreferredUsernameGTE(v string) predicate.UserIdentity {
+	return predicate.UserIdentity(sql.FieldGTE(FieldClaimsPreferredUsername, v))
+}
+
+// ClaimsPreferredUsernameLT applies the LT predicate on the "claims_preferred_username" field.
+func ClaimsPreferredUsernameLT(v string) predicate.UserIdentity {
+	return predicate.UserIdentity(sql.FieldLT(FieldClaimsPreferredUsername, v))
+}
+
+// ClaimsPreferredUsernameLTE applies the LTE predicate on the "claims_preferred_username" field.
+func ClaimsPreferredUsernameLTE(v string) predicate.UserIdentity {
+	return predicate.UserIdentity(sql.FieldLTE(FieldClaimsPreferredUsername, v))
+}
+
+// ClaimsPreferredUsernameContains applies the Contains predicate on the "claims_preferred_username" field.
+func ClaimsPreferredUsernameContains(v string) predicate.UserIdentity {
+	return predicate.UserIdentity(sql.FieldContains(FieldClaimsPreferredUsername, v))
+}
+
+// ClaimsPreferredUsernameHasPrefix applies the HasPrefix predicate on the "claims_preferred_username" field.
+func ClaimsPreferredUsernameHasPrefix(v string) predicate.UserIdentity {
+	return predicate.UserIdentity(sql.FieldHasPrefix(FieldClaimsPreferredUsername, v))
+}
+
+// ClaimsPreferredUsernameHasSuffix applies the HasSuffix predicate on the "claims_preferred_username" field.
+func ClaimsPreferredUsernameHasSuffix(v string) predicate.UserIdentity {
+	return predicate.UserIdentity(sql.FieldHasSuffix(FieldClaimsPreferredUsername, v))
+}
+
+// ClaimsPreferredUsernameEqualFold applies the EqualFold predicate on the "claims_preferred_username" field.
+func ClaimsPreferredUsernameEqualFold(v string) predicate.UserIdentity {
+	return predicate.UserIdentity(sql.FieldEqualFold(FieldClaimsPreferredUsername, v))
+}
+
+// ClaimsPreferredUsernameContainsFold applies the ContainsFold predicate on the "claims_preferred_username" field.
+func ClaimsPreferredUsernameContainsFold(v string) predicate.UserIdentity {
+	return predicate.UserIdentity(sql.FieldContainsFold(FieldClaimsPreferredUsername, v))
+}
+
+// ClaimsEmailEQ applies the EQ predicate on the "claims_email" field.
+func ClaimsEmailEQ(v string) predicate.UserIdentity {
+	return predicate.UserIdentity(sql.FieldEQ(FieldClaimsEmail, v))
+}
+
+// ClaimsEmailNEQ applies the NEQ predicate on the "claims_email" field.
+func ClaimsEmailNEQ(v string) predicate.UserIdentity {
+	return predicate.UserIdentity(sql.FieldNEQ(FieldClaimsEmail, v))
+}
+
+// ClaimsEmailIn applies the In predicate on the "claims_email" field.
+func ClaimsEmailIn(vs ...string) predicate.UserIdentity {
+	return predicate.UserIdentity(sql.FieldIn(FieldClaimsEmail, vs...))
+}
+
+// ClaimsEmailNotIn applies the NotIn predicate on the "claims_email" field.
+func ClaimsEmailNotIn(vs ...string) predicate.UserIdentity {
+	return predicate.UserIdentity(sql.FieldNotIn(FieldClaimsEmail, vs...))
+}
+
+// ClaimsEmailGT applies the GT predicate on the "claims_email" field.
+func ClaimsEmailGT(v string) predicate.UserIdentity {
+	return predicate.UserIdentity(sql.FieldGT(FieldClaimsEmail, v))
+}
+
+// ClaimsEmailGTE applies the GTE predicate on the "claims_email" field.
+func ClaimsEmailGTE(v string) predicate.UserIdentity {
+	return predicate.UserIdentity(sql.FieldGTE(FieldClaimsEmail, v))
+}
+
+// ClaimsEmailLT applies the LT predicate on the "claims_email" field.
+func ClaimsEmailLT(v string) predicate.UserIdentity {
+	return predicate.UserIdentity(sql.FieldLT(FieldClaimsEmail, v))
+}
+
+// ClaimsEmailLTE applies the LTE predicate on the "claims_email" field.
+func ClaimsEmailLTE(v string) predicate.UserIdentity {
+	return predicate.UserIdentity(sql.FieldLTE(FieldClaimsEmail, v))
+}
+
+// ClaimsEmailContains applies the Contains predicate on the "claims_email" field.
+func ClaimsEmailContains(v string) predicate.UserIdentity {
+	return predicate.UserIdentity(sql.FieldContains(FieldClaimsEmail, v))
+}
+
+// ClaimsEmailHasPrefix applies the HasPrefix predicate on the "claims_email" field.
+func ClaimsEmailHasPrefix(v string) predicate.UserIdentity {
+	return predicate.UserIdentity(sql.FieldHasPrefix(FieldClaimsEmail, v))
+}
+
+// ClaimsEmailHasSuffix applies the HasSuffix predicate on the "claims_email" field.
+func ClaimsEmailHasSuffix(v string) predicate.UserIdentity {
+	return predicate.UserIdentity(sql.FieldHasSuffix(FieldClaimsEmail, v))
+}
+
+// ClaimsEmailEqualFold applies the EqualFold predicate on the "claims_email" field.
+func ClaimsEmailEqualFold(v string) predicate.UserIdentity {
+	return predicate.UserIdentity(sql.FieldEqualFold(FieldClaimsEmail, v))
+}
+
+// ClaimsEmailContainsFold applies the ContainsFold predicate on the "claims_email" field.
+func ClaimsEmailContainsFold(v string) predicate.UserIdentity {
+	return predicate.UserIdentity(sql.FieldContainsFold(FieldClaimsEmail, v))
+}
+
+// ClaimsEmailVerifiedEQ applies the EQ predicate on the "claims_email_verified" field.
+func ClaimsEmailVerifiedEQ(v bool) predicate.UserIdentity {
+	return predicate.UserIdentity(sql.FieldEQ(FieldClaimsEmailVerified, v))
+}
+
+// ClaimsEmailVerifiedNEQ applies the NEQ predicate on the "claims_email_verified" field.
+func ClaimsEmailVerifiedNEQ(v bool) predicate.UserIdentity {
+	return predicate.UserIdentity(sql.FieldNEQ(FieldClaimsEmailVerified, v))
+}
+
+// ClaimsGroupsIsNil applies the IsNil predicate on the "claims_groups" field.
+func ClaimsGroupsIsNil() predicate.UserIdentity {
+	return predicate.UserIdentity(sql.FieldIsNull(FieldClaimsGroups))
+}
+
+// ClaimsGroupsNotNil applies the NotNil predicate on the "claims_groups" field.
+func ClaimsGroupsNotNil() predicate.UserIdentity {
+	return predicate.UserIdentity(sql.FieldNotNull(FieldClaimsGroups))
+}
+
+// ConsentsEQ applies the EQ predicate on the "consents" field.
+func ConsentsEQ(v []byte) predicate.UserIdentity {
+	return predicate.UserIdentity(sql.FieldEQ(FieldConsents, v))
+}
+
+// ConsentsNEQ applies the NEQ predicate on the "consents" field.
+func ConsentsNEQ(v []byte) predicate.UserIdentity {
+	return predicate.UserIdentity(sql.FieldNEQ(FieldConsents, v))
+}
+
+// ConsentsIn applies the In predicate on the "consents" field.
+func ConsentsIn(vs ...[]byte) predicate.UserIdentity {
+	return predicate.UserIdentity(sql.FieldIn(FieldConsents, vs...))
+}
+
+// ConsentsNotIn applies the NotIn predicate on the "consents" field.
+func ConsentsNotIn(vs ...[]byte) predicate.UserIdentity {
+	return predicate.UserIdentity(sql.FieldNotIn(FieldConsents, vs...))
+}
+
+// ConsentsGT applies the GT predicate on the "consents" field.
+func ConsentsGT(v []byte) predicate.UserIdentity {
+	return predicate.UserIdentity(sql.FieldGT(FieldConsents, v))
+}
+
+// ConsentsGTE applies the GTE predicate on the "consents" field.
+func ConsentsGTE(v []byte) predicate.UserIdentity {
+	return predicate.UserIdentity(sql.FieldGTE(FieldConsents, v))
+}
+
+// ConsentsLT applies the LT predicate on the "consents" field.
+func ConsentsLT(v []byte) predicate.UserIdentity {
+	return predicate.UserIdentity(sql.FieldLT(FieldConsents, v))
+}
+
+// ConsentsLTE applies the LTE predicate on the "consents" field.
+func ConsentsLTE(v []byte) predicate.UserIdentity {
+	return predicate.UserIdentity(sql.FieldLTE(FieldConsents, v))
+}
+
+// MfaSecretsEQ applies the EQ predicate on the "mfa_secrets" field.
+func MfaSecretsEQ(v []byte) predicate.UserIdentity {
+	return predicate.UserIdentity(sql.FieldEQ(FieldMfaSecrets, v))
+}
+
+// MfaSecretsNEQ applies the NEQ predicate on the "mfa_secrets" field.
+func MfaSecretsNEQ(v []byte) predicate.UserIdentity {
+	return predicate.UserIdentity(sql.FieldNEQ(FieldMfaSecrets, v))
+}
+
+// MfaSecretsIn applies the In predicate on the "mfa_secrets" field.
+func MfaSecretsIn(vs ...[]byte) predicate.UserIdentity {
+	return predicate.UserIdentity(sql.FieldIn(FieldMfaSecrets, vs...))
+}
+
+// MfaSecretsNotIn applies the NotIn predicate on the "mfa_secrets" field.
+func MfaSecretsNotIn(vs ...[]byte) predicate.UserIdentity {
+	return predicate.UserIdentity(sql.FieldNotIn(FieldMfaSecrets, vs...))
+}
+
+// MfaSecretsGT applies the GT predicate on the "mfa_secrets" field.
+func MfaSecretsGT(v []byte) predicate.UserIdentity {
+	return predicate.UserIdentity(sql.FieldGT(FieldMfaSecrets, v))
+}
+
+// MfaSecretsGTE applies the GTE predicate on the "mfa_secrets" field.
+func MfaSecretsGTE(v []byte) predicate.UserIdentity {
+	return predicate.UserIdentity(sql.FieldGTE(FieldMfaSecrets, v))
+}
+
+// MfaSecretsLT applies the LT predicate on the "mfa_secrets" field.
+func MfaSecretsLT(v []byte) predicate.UserIdentity {
+	return predicate.UserIdentity(sql.FieldLT(FieldMfaSecrets, v))
+}
+
+// MfaSecretsLTE applies the LTE predicate on the "mfa_secrets" field.
+func MfaSecretsLTE(v []byte) predicate.UserIdentity {
+	return predicate.UserIdentity(sql.FieldLTE(FieldMfaSecrets, v))
+}
+
+// MfaSecretsIsNil applies the IsNil predicate on the "mfa_secrets" field.
+func MfaSecretsIsNil() predicate.UserIdentity {
+	return predicate.UserIdentity(sql.FieldIsNull(FieldMfaSecrets))
+}
+
+// MfaSecretsNotNil applies the NotNil predicate on the "mfa_secrets" field.
+func MfaSecretsNotNil() predicate.UserIdentity {
+	return predicate.UserIdentity(sql.FieldNotNull(FieldMfaSecrets))
+}
+
+// WebauthnCredentialsEQ applies the EQ predicate on the "webauthn_credentials" field.
+func WebauthnCredentialsEQ(v []byte) predicate.UserIdentity {
+	return predicate.UserIdentity(sql.FieldEQ(FieldWebauthnCredentials, v))
+}
+
+// WebauthnCredentialsNEQ applies the NEQ predicate on the "webauthn_credentials" field.
+func WebauthnCredentialsNEQ(v []byte) predicate.UserIdentity {
+	return predicate.UserIdentity(sql.FieldNEQ(FieldWebauthnCredentials, v))
+}
+
+// WebauthnCredentialsIn applies the In predicate on the "webauthn_credentials" field.
+func WebauthnCredentialsIn(vs ...[]byte) predicate.UserIdentity {
+	return predicate.UserIdentity(sql.FieldIn(FieldWebauthnCredentials, vs...))
+}
+
+// WebauthnCredentialsNotIn applies the NotIn predicate on the "webauthn_credentials" field.
+func WebauthnCredentialsNotIn(vs ...[]byte) predicate.UserIdentity {
+	return predicate.UserIdentity(sql.FieldNotIn(FieldWebauthnCredentials, vs...))
+}
+
+// WebauthnCredentialsGT applies the GT predicate on the "webauthn_credentials" field.
+func WebauthnCredentialsGT(v []byte) predicate.UserIdentity {
+	return predicate.UserIdentity(sql.FieldGT(FieldWebauthnCredentials, v))
+}
+
+// WebauthnCredentialsGTE applies the GTE predicate on the "webauthn_credentials" field.
+func WebauthnCredentialsGTE(v []byte) predicate.UserIdentity {
+	return predicate.UserIdentity(sql.FieldGTE(FieldWebauthnCredentials, v))
+}
+
+// WebauthnCredentialsLT applies the LT predicate on the "webauthn_credentials" field.
+func WebauthnCredentialsLT(v []byte) predicate.UserIdentity {
+	return predicate.UserIdentity(sql.FieldLT(FieldWebauthnCredentials, v))
+}
+
+// WebauthnCredentialsLTE applies the LTE predicate on the "webauthn_credentials" field.
+func WebauthnCredentialsLTE(v []byte) predicate.UserIdentity {
+	return predicate.UserIdentity(sql.FieldLTE(FieldWebauthnCredentials, v))
+}
+
+// WebauthnCredentialsIsNil applies the IsNil predicate on the "webauthn_credentials" field.
+func WebauthnCredentialsIsNil() predicate.UserIdentity {
+	return predicate.UserIdentity(sql.FieldIsNull(FieldWebauthnCredentials))
+}
+
+// WebauthnCredentialsNotNil applies the NotNil predicate on the "webauthn_credentials" field.
+func WebauthnCredentialsNotNil() predicate.UserIdentity {
+	return predicate.UserIdentity(sql.FieldNotNull(FieldWebauthnCredentials))
+}
+
+// CreatedAtEQ applies the EQ predicate on the "created_at" field.
+func CreatedAtEQ(v time.Time) predicate.UserIdentity {
+	return predicate.UserIdentity(sql.FieldEQ(FieldCreatedAt, v))
+}
+
+// CreatedAtNEQ applies the NEQ predicate on the "created_at" field.
+func CreatedAtNEQ(v time.Time) predicate.UserIdentity {
+	return predicate.UserIdentity(sql.FieldNEQ(FieldCreatedAt, v))
+}
+
+// CreatedAtIn applies the In predicate on the "created_at" field.
+func CreatedAtIn(vs ...time.Time) predicate.UserIdentity {
+	return predicate.UserIdentity(sql.FieldIn(FieldCreatedAt, vs...))
+}
+
+// CreatedAtNotIn applies the NotIn predicate on the "created_at" field.
+func CreatedAtNotIn(vs ...time.Time) predicate.UserIdentity {
+	return predicate.UserIdentity(sql.FieldNotIn(FieldCreatedAt, vs...))
+}
+
+// CreatedAtGT applies the GT predicate on the "created_at" field.
+func CreatedAtGT(v time.Time) predicate.UserIdentity {
+	return predicate.UserIdentity(sql.FieldGT(FieldCreatedAt, v))
+}
+
+// CreatedAtGTE applies the GTE predicate on the "created_at" field.
+func CreatedAtGTE(v time.Time) predicate.UserIdentity {
+	return predicate.UserIdentity(sql.FieldGTE(FieldCreatedAt, v))
+}
+
+// CreatedAtLT applies the LT predicate on the "created_at" field.
+func CreatedAtLT(v time.Time) predicate.UserIdentity {
+	return predicate.UserIdentity(sql.FieldLT(FieldCreatedAt, v))
+}
+
+// CreatedAtLTE applies the LTE predicate on the "created_at" field.
+func CreatedAtLTE(v time.Time) predicate.UserIdentity {
+	return predicate.UserIdentity(sql.FieldLTE(FieldCreatedAt, v))
+}
+
+// LastLoginEQ applies the EQ predicate on the "last_login" field.
+func LastLoginEQ(v time.Time) predicate.UserIdentity {
+	return predicate.UserIdentity(sql.FieldEQ(FieldLastLogin, v))
+}
+
+// LastLoginNEQ applies the NEQ predicate on the "last_login" field.
+func LastLoginNEQ(v time.Time) predicate.UserIdentity {
+	return predicate.UserIdentity(sql.FieldNEQ(FieldLastLogin, v))
+}
+
+// LastLoginIn applies the In predicate on the "last_login" field.
+func LastLoginIn(vs ...time.Time) predicate.UserIdentity {
+	return predicate.UserIdentity(sql.FieldIn(FieldLastLogin, vs...))
+}
+
+// LastLoginNotIn applies the NotIn predicate on the "last_login" field.
+func LastLoginNotIn(vs ...time.Time) predicate.UserIdentity {
+	return predicate.UserIdentity(sql.FieldNotIn(FieldLastLogin, vs...))
+}
+
+// LastLoginGT applies the GT predicate on the "last_login" field.
+func LastLoginGT(v time.Time) predicate.UserIdentity {
+	return predicate.UserIdentity(sql.FieldGT(FieldLastLogin, v))
+}
+
+// LastLoginGTE applies the GTE predicate on the "last_login" field.
+func LastLoginGTE(v time.Time) predicate.UserIdentity {
+	return predicate.UserIdentity(sql.FieldGTE(FieldLastLogin, v))
+}
+
+// LastLoginLT applies the LT predicate on the "last_login" field.
+func LastLoginLT(v time.Time) predicate.UserIdentity {
+	return predicate.UserIdentity(sql.FieldLT(FieldLastLogin, v))
+}
+
+// LastLoginLTE applies the LTE predicate on the "last_login" field.
+func LastLoginLTE(v time.Time) predicate.UserIdentity {
+	return predicate.UserIdentity(sql.FieldLTE(FieldLastLogin, v))
+}
+
+// BlockedUntilEQ applies the EQ predicate on the "blocked_until" field.
+func BlockedUntilEQ(v time.Time) predicate.UserIdentity {
+	return predicate.UserIdentity(sql.FieldEQ(FieldBlockedUntil, v))
+}
+
+// BlockedUntilNEQ applies the NEQ predicate on the "blocked_until" field.
+func BlockedUntilNEQ(v time.Time) predicate.UserIdentity {
+	return predicate.UserIdentity(sql.FieldNEQ(FieldBlockedUntil, v))
+}
+
+// BlockedUntilIn applies the In predicate on the "blocked_until" field.
+func BlockedUntilIn(vs ...time.Time) predicate.UserIdentity {
+	return predicate.UserIdentity(sql.FieldIn(FieldBlockedUntil, vs...))
+}
+
+// BlockedUntilNotIn applies the NotIn predicate on the "blocked_until" field.
+func BlockedUntilNotIn(vs ...time.Time) predicate.UserIdentity {
+	return predicate.UserIdentity(sql.FieldNotIn(FieldBlockedUntil, vs...))
+}
+
+// BlockedUntilGT applies the GT predicate on the "blocked_until" field.
+func BlockedUntilGT(v time.Time) predicate.UserIdentity {
+	return predicate.UserIdentity(sql.FieldGT(FieldBlockedUntil, v))
+}
+
+// BlockedUntilGTE applies the GTE predicate on the "blocked_until" field.
+func BlockedUntilGTE(v time.Time) predicate.UserIdentity {
+	return predicate.UserIdentity(sql.FieldGTE(FieldBlockedUntil, v))
+}
+
+// BlockedUntilLT applies the LT predicate on the "blocked_until" field.
+func BlockedUntilLT(v time.Time) predicate.UserIdentity {
+	return predicate.UserIdentity(sql.FieldLT(FieldBlockedUntil, v))
+}
+
+// BlockedUntilLTE applies the LTE predicate on the "blocked_until" field.
+func BlockedUntilLTE(v time.Time) predicate.UserIdentity {
+	return predicate.UserIdentity(sql.FieldLTE(FieldBlockedUntil, v))
+}
+
+// And groups predicates with the AND operator between them.
+func And(predicates ...predicate.UserIdentity) predicate.UserIdentity {
+	return predicate.UserIdentity(sql.AndPredicates(predicates...))
+}
+
+// Or groups predicates with the OR operator between them.
+func Or(predicates ...predicate.UserIdentity) predicate.UserIdentity {
+	return predicate.UserIdentity(sql.OrPredicates(predicates...))
+}
+
+// Not applies the not operator on the given predicate.
+func Not(p predicate.UserIdentity) predicate.UserIdentity {
+	return predicate.UserIdentity(sql.NotPredicates(p))
+}
diff --git a/storage/ent/db/useridentity_create.go b/storage/ent/db/useridentity_create.go
new file mode 100644
index 0000000000..adb17b2574
--- /dev/null
+++ b/storage/ent/db/useridentity_create.go
@@ -0,0 +1,436 @@
+// Code generated by ent, DO NOT EDIT.
+
+package db
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"time"
+
+	"entgo.io/ent/dialect/sql/sqlgraph"
+	"entgo.io/ent/schema/field"
+	"github.com/dexidp/dex/storage/ent/db/useridentity"
+)
+
+// UserIdentityCreate is the builder for creating a UserIdentity entity.
+type UserIdentityCreate struct {
+	config
+	mutation *UserIdentityMutation
+	hooks    []Hook
+}
+
+// SetUserID sets the "user_id" field.
+func (_c *UserIdentityCreate) SetUserID(v string) *UserIdentityCreate {
+	_c.mutation.SetUserID(v)
+	return _c
+}
+
+// SetConnectorID sets the "connector_id" field.
+func (_c *UserIdentityCreate) SetConnectorID(v string) *UserIdentityCreate {
+	_c.mutation.SetConnectorID(v)
+	return _c
+}
+
+// SetClaimsUserID sets the "claims_user_id" field.
+func (_c *UserIdentityCreate) SetClaimsUserID(v string) *UserIdentityCreate {
+	_c.mutation.SetClaimsUserID(v)
+	return _c
+}
+
+// SetNillableClaimsUserID sets the "claims_user_id" field if the given value is not nil.
+func (_c *UserIdentityCreate) SetNillableClaimsUserID(v *string) *UserIdentityCreate {
+	if v != nil {
+		_c.SetClaimsUserID(*v)
+	}
+	return _c
+}
+
+// SetClaimsUsername sets the "claims_username" field.
+func (_c *UserIdentityCreate) SetClaimsUsername(v string) *UserIdentityCreate {
+	_c.mutation.SetClaimsUsername(v)
+	return _c
+}
+
+// SetNillableClaimsUsername sets the "claims_username" field if the given value is not nil.
+func (_c *UserIdentityCreate) SetNillableClaimsUsername(v *string) *UserIdentityCreate {
+	if v != nil {
+		_c.SetClaimsUsername(*v)
+	}
+	return _c
+}
+
+// SetClaimsPreferredUsername sets the "claims_preferred_username" field.
+func (_c *UserIdentityCreate) SetClaimsPreferredUsername(v string) *UserIdentityCreate {
+	_c.mutation.SetClaimsPreferredUsername(v)
+	return _c
+}
+
+// SetNillableClaimsPreferredUsername sets the "claims_preferred_username" field if the given value is not nil.
+func (_c *UserIdentityCreate) SetNillableClaimsPreferredUsername(v *string) *UserIdentityCreate {
+	if v != nil {
+		_c.SetClaimsPreferredUsername(*v)
+	}
+	return _c
+}
+
+// SetClaimsEmail sets the "claims_email" field.
+func (_c *UserIdentityCreate) SetClaimsEmail(v string) *UserIdentityCreate {
+	_c.mutation.SetClaimsEmail(v)
+	return _c
+}
+
+// SetNillableClaimsEmail sets the "claims_email" field if the given value is not nil.
+func (_c *UserIdentityCreate) SetNillableClaimsEmail(v *string) *UserIdentityCreate {
+	if v != nil {
+		_c.SetClaimsEmail(*v)
+	}
+	return _c
+}
+
+// SetClaimsEmailVerified sets the "claims_email_verified" field.
+func (_c *UserIdentityCreate) SetClaimsEmailVerified(v bool) *UserIdentityCreate {
+	_c.mutation.SetClaimsEmailVerified(v)
+	return _c
+}
+
+// SetNillableClaimsEmailVerified sets the "claims_email_verified" field if the given value is not nil.
+func (_c *UserIdentityCreate) SetNillableClaimsEmailVerified(v *bool) *UserIdentityCreate {
+	if v != nil {
+		_c.SetClaimsEmailVerified(*v)
+	}
+	return _c
+}
+
+// SetClaimsGroups sets the "claims_groups" field.
+func (_c *UserIdentityCreate) SetClaimsGroups(v []string) *UserIdentityCreate {
+	_c.mutation.SetClaimsGroups(v)
+	return _c
+}
+
+// SetConsents sets the "consents" field.
+func (_c *UserIdentityCreate) SetConsents(v []byte) *UserIdentityCreate {
+	_c.mutation.SetConsents(v)
+	return _c
+}
+
+// SetMfaSecrets sets the "mfa_secrets" field.
+func (_c *UserIdentityCreate) SetMfaSecrets(v []byte) *UserIdentityCreate {
+	_c.mutation.SetMfaSecrets(v)
+	return _c
+}
+
+// SetWebauthnCredentials sets the "webauthn_credentials" field.
+func (_c *UserIdentityCreate) SetWebauthnCredentials(v []byte) *UserIdentityCreate {
+	_c.mutation.SetWebauthnCredentials(v)
+	return _c
+}
+
+// SetCreatedAt sets the "created_at" field.
+func (_c *UserIdentityCreate) SetCreatedAt(v time.Time) *UserIdentityCreate {
+	_c.mutation.SetCreatedAt(v)
+	return _c
+}
+
+// SetLastLogin sets the "last_login" field.
+func (_c *UserIdentityCreate) SetLastLogin(v time.Time) *UserIdentityCreate {
+	_c.mutation.SetLastLogin(v)
+	return _c
+}
+
+// SetBlockedUntil sets the "blocked_until" field.
+func (_c *UserIdentityCreate) SetBlockedUntil(v time.Time) *UserIdentityCreate {
+	_c.mutation.SetBlockedUntil(v)
+	return _c
+}
+
+// SetID sets the "id" field.
+func (_c *UserIdentityCreate) SetID(v string) *UserIdentityCreate {
+	_c.mutation.SetID(v)
+	return _c
+}
+
+// Mutation returns the UserIdentityMutation object of the builder.
+func (_c *UserIdentityCreate) Mutation() *UserIdentityMutation {
+	return _c.mutation
+}
+
+// Save creates the UserIdentity in the database.
+func (_c *UserIdentityCreate) Save(ctx context.Context) (*UserIdentity, error) {
+	_c.defaults()
+	return withHooks(ctx, _c.sqlSave, _c.mutation, _c.hooks)
+}
+
+// SaveX calls Save and panics if Save returns an error.
+func (_c *UserIdentityCreate) SaveX(ctx context.Context) *UserIdentity {
+	v, err := _c.Save(ctx)
+	if err != nil {
+		panic(err)
+	}
+	return v
+}
+
+// Exec executes the query.
+func (_c *UserIdentityCreate) Exec(ctx context.Context) error {
+	_, err := _c.Save(ctx)
+	return err
+}
+
+// ExecX is like Exec, but panics if an error occurs.
+func (_c *UserIdentityCreate) ExecX(ctx context.Context) {
+	if err := _c.Exec(ctx); err != nil {
+		panic(err)
+	}
+}
+
+// defaults sets the default values of the builder before save.
+func (_c *UserIdentityCreate) defaults() {
+	if _, ok := _c.mutation.ClaimsUserID(); !ok {
+		v := useridentity.DefaultClaimsUserID
+		_c.mutation.SetClaimsUserID(v)
+	}
+	if _, ok := _c.mutation.ClaimsUsername(); !ok {
+		v := useridentity.DefaultClaimsUsername
+		_c.mutation.SetClaimsUsername(v)
+	}
+	if _, ok := _c.mutation.ClaimsPreferredUsername(); !ok {
+		v := useridentity.DefaultClaimsPreferredUsername
+		_c.mutation.SetClaimsPreferredUsername(v)
+	}
+	if _, ok := _c.mutation.ClaimsEmail(); !ok {
+		v := useridentity.DefaultClaimsEmail
+		_c.mutation.SetClaimsEmail(v)
+	}
+	if _, ok := _c.mutation.ClaimsEmailVerified(); !ok {
+		v := useridentity.DefaultClaimsEmailVerified
+		_c.mutation.SetClaimsEmailVerified(v)
+	}
+}
+
+// check runs all checks and user-defined validators on the builder.
+func (_c *UserIdentityCreate) check() error {
+	if _, ok := _c.mutation.UserID(); !ok {
+		return &ValidationError{Name: "user_id", err: errors.New(`db: missing required field "UserIdentity.user_id"`)}
+	}
+	if v, ok := _c.mutation.UserID(); ok {
+		if err := useridentity.UserIDValidator(v); err != nil {
+			return &ValidationError{Name: "user_id", err: fmt.Errorf(`db: validator failed for field "UserIdentity.user_id": %w`, err)}
+		}
+	}
+	if _, ok := _c.mutation.ConnectorID(); !ok {
+		return &ValidationError{Name: "connector_id", err: errors.New(`db: missing required field "UserIdentity.connector_id"`)}
+	}
+	if v, ok := _c.mutation.ConnectorID(); ok {
+		if err := useridentity.ConnectorIDValidator(v); err != nil {
+			return &ValidationError{Name: "connector_id", err: fmt.Errorf(`db: validator failed for field "UserIdentity.connector_id": %w`, err)}
+		}
+	}
+	if _, ok := _c.mutation.ClaimsUserID(); !ok {
+		return &ValidationError{Name: "claims_user_id", err: errors.New(`db: missing required field "UserIdentity.claims_user_id"`)}
+	}
+	if _, ok := _c.mutation.ClaimsUsername(); !ok {
+		return &ValidationError{Name: "claims_username", err: errors.New(`db: missing required field "UserIdentity.claims_username"`)}
+	}
+	if _, ok := _c.mutation.ClaimsPreferredUsername(); !ok {
+		return &ValidationError{Name: "claims_preferred_username", err: errors.New(`db: missing required field "UserIdentity.claims_preferred_username"`)}
+	}
+	if _, ok := _c.mutation.ClaimsEmail(); !ok {
+		return &ValidationError{Name: "claims_email", err: errors.New(`db: missing required field "UserIdentity.claims_email"`)}
+	}
+	if _, ok := _c.mutation.ClaimsEmailVerified(); !ok {
+		return &ValidationError{Name: "claims_email_verified", err: errors.New(`db: missing required field "UserIdentity.claims_email_verified"`)}
+	}
+	if _, ok := _c.mutation.Consents(); !ok {
+		return &ValidationError{Name: "consents", err: errors.New(`db: missing required field "UserIdentity.consents"`)}
+	}
+	if _, ok := _c.mutation.CreatedAt(); !ok {
+		return &ValidationError{Name: "created_at", err: errors.New(`db: missing required field "UserIdentity.created_at"`)}
+	}
+	if _, ok := _c.mutation.LastLogin(); !ok {
+		return &ValidationError{Name: "last_login", err: errors.New(`db: missing required field "UserIdentity.last_login"`)}
+	}
+	if _, ok := _c.mutation.BlockedUntil(); !ok {
+		return &ValidationError{Name: "blocked_until", err: errors.New(`db: missing required field "UserIdentity.blocked_until"`)}
+	}
+	if v, ok := _c.mutation.ID(); ok {
+		if err := useridentity.IDValidator(v); err != nil {
+			return &ValidationError{Name: "id", err: fmt.Errorf(`db: validator failed for field "UserIdentity.id": %w`, err)}
+		}
+	}
+	return nil
+}
+
+func (_c *UserIdentityCreate) sqlSave(ctx context.Context) (*UserIdentity, error) {
+	if err := _c.check(); err != nil {
+		return nil, err
+	}
+	_node, _spec := _c.createSpec()
+	if err := sqlgraph.CreateNode(ctx, _c.driver, _spec); err != nil {
+		if sqlgraph.IsConstraintError(err) {
+			err = &ConstraintError{msg: err.Error(), wrap: err}
+		}
+		return nil, err
+	}
+	if _spec.ID.Value != nil {
+		if id, ok := _spec.ID.Value.(string); ok {
+			_node.ID = id
+		} else {
+			return nil, fmt.Errorf("unexpected UserIdentity.ID type: %T", _spec.ID.Value)
+		}
+	}
+	_c.mutation.id = &_node.ID
+	_c.mutation.done = true
+	return _node, nil
+}
+
+func (_c *UserIdentityCreate) createSpec() (*UserIdentity, *sqlgraph.CreateSpec) {
+	var (
+		_node = &UserIdentity{config: _c.config}
+		_spec = sqlgraph.NewCreateSpec(useridentity.Table, sqlgraph.NewFieldSpec(useridentity.FieldID, field.TypeString))
+	)
+	if id, ok := _c.mutation.ID(); ok {
+		_node.ID = id
+		_spec.ID.Value = id
+	}
+	if value, ok := _c.mutation.UserID(); ok {
+		_spec.SetField(useridentity.FieldUserID, field.TypeString, value)
+		_node.UserID = value
+	}
+	if value, ok := _c.mutation.ConnectorID(); ok {
+		_spec.SetField(useridentity.FieldConnectorID, field.TypeString, value)
+		_node.ConnectorID = value
+	}
+	if value, ok := _c.mutation.ClaimsUserID(); ok {
+		_spec.SetField(useridentity.FieldClaimsUserID, field.TypeString, value)
+		_node.ClaimsUserID = value
+	}
+	if value, ok := _c.mutation.ClaimsUsername(); ok {
+		_spec.SetField(useridentity.FieldClaimsUsername, field.TypeString, value)
+		_node.ClaimsUsername = value
+	}
+	if value, ok := _c.mutation.ClaimsPreferredUsername(); ok {
+		_spec.SetField(useridentity.FieldClaimsPreferredUsername, field.TypeString, value)
+		_node.ClaimsPreferredUsername = value
+	}
+	if value, ok := _c.mutation.ClaimsEmail(); ok {
+		_spec.SetField(useridentity.FieldClaimsEmail, field.TypeString, value)
+		_node.ClaimsEmail = value
+	}
+	if value, ok := _c.mutation.ClaimsEmailVerified(); ok {
+		_spec.SetField(useridentity.FieldClaimsEmailVerified, field.TypeBool, value)
+		_node.ClaimsEmailVerified = value
+	}
+	if value, ok := _c.mutation.ClaimsGroups(); ok {
+		_spec.SetField(useridentity.FieldClaimsGroups, field.TypeJSON, value)
+		_node.ClaimsGroups = value
+	}
+	if value, ok := _c.mutation.Consents(); ok {
+		_spec.SetField(useridentity.FieldConsents, field.TypeBytes, value)
+		_node.Consents = value
+	}
+	if value, ok := _c.mutation.MfaSecrets(); ok {
+		_spec.SetField(useridentity.FieldMfaSecrets, field.TypeBytes, value)
+		_node.MfaSecrets = &value
+	}
+	if value, ok := _c.mutation.WebauthnCredentials(); ok {
+		_spec.SetField(useridentity.FieldWebauthnCredentials, field.TypeBytes, value)
+		_node.WebauthnCredentials = &value
+	}
+	if value, ok := _c.mutation.CreatedAt(); ok {
+		_spec.SetField(useridentity.FieldCreatedAt, field.TypeTime, value)
+		_node.CreatedAt = value
+	}
+	if value, ok := _c.mutation.LastLogin(); ok {
+		_spec.SetField(useridentity.FieldLastLogin, field.TypeTime, value)
+		_node.LastLogin = value
+	}
+	if value, ok := _c.mutation.BlockedUntil(); ok {
+		_spec.SetField(useridentity.FieldBlockedUntil, field.TypeTime, value)
+		_node.BlockedUntil = value
+	}
+	return _node, _spec
+}
+
+// UserIdentityCreateBulk is the builder for creating many UserIdentity entities in bulk.
+type UserIdentityCreateBulk struct {
+	config
+	err      error
+	builders []*UserIdentityCreate
+}
+
+// Save creates the UserIdentity entities in the database.
+func (_c *UserIdentityCreateBulk) Save(ctx context.Context) ([]*UserIdentity, error) {
+	if _c.err != nil {
+		return nil, _c.err
+	}
+	specs := make([]*sqlgraph.CreateSpec, len(_c.builders))
+	nodes := make([]*UserIdentity, len(_c.builders))
+	mutators := make([]Mutator, len(_c.builders))
+	for i := range _c.builders {
+		func(i int, root context.Context) {
+			builder := _c.builders[i]
+			builder.defaults()
+			var mut Mutator = MutateFunc(func(ctx context.Context, m Mutation) (Value, error) {
+				mutation, ok := m.(*UserIdentityMutation)
+				if !ok {
+					return nil, fmt.Errorf("unexpected mutation type %T", m)
+				}
+				if err := builder.check(); err != nil {
+					return nil, err
+				}
+				builder.mutation = mutation
+				var err error
+				nodes[i], specs[i] = builder.createSpec()
+				if i < len(mutators)-1 {
+					_, err = mutators[i+1].Mutate(root, _c.builders[i+1].mutation)
+				} else {
+					spec := &sqlgraph.BatchCreateSpec{Nodes: specs}
+					// Invoke the actual operation on the latest mutation in the chain.
+					if err = sqlgraph.BatchCreate(ctx, _c.driver, spec); err != nil {
+						if sqlgraph.IsConstraintError(err) {
+							err = &ConstraintError{msg: err.Error(), wrap: err}
+						}
+					}
+				}
+				if err != nil {
+					return nil, err
+				}
+				mutation.id = &nodes[i].ID
+				mutation.done = true
+				return nodes[i], nil
+			})
+			for i := len(builder.hooks) - 1; i >= 0; i-- {
+				mut = builder.hooks[i](mut)
+			}
+			mutators[i] = mut
+		}(i, ctx)
+	}
+	if len(mutators) > 0 {
+		if _, err := mutators[0].Mutate(ctx, _c.builders[0].mutation); err != nil {
+			return nil, err
+		}
+	}
+	return nodes, nil
+}
+
+// SaveX is like Save, but panics if an error occurs.
+func (_c *UserIdentityCreateBulk) SaveX(ctx context.Context) []*UserIdentity {
+	v, err := _c.Save(ctx)
+	if err != nil {
+		panic(err)
+	}
+	return v
+}
+
+// Exec executes the query.
+func (_c *UserIdentityCreateBulk) Exec(ctx context.Context) error {
+	_, err := _c.Save(ctx)
+	return err
+}
+
+// ExecX is like Exec, but panics if an error occurs.
+func (_c *UserIdentityCreateBulk) ExecX(ctx context.Context) {
+	if err := _c.Exec(ctx); err != nil {
+		panic(err)
+	}
+}
diff --git a/storage/ent/db/useridentity_delete.go b/storage/ent/db/useridentity_delete.go
new file mode 100644
index 0000000000..0bc51e2411
--- /dev/null
+++ b/storage/ent/db/useridentity_delete.go
@@ -0,0 +1,88 @@
+// Code generated by ent, DO NOT EDIT.
+
+package db
+
+import (
+	"context"
+
+	"entgo.io/ent/dialect/sql"
+	"entgo.io/ent/dialect/sql/sqlgraph"
+	"entgo.io/ent/schema/field"
+	"github.com/dexidp/dex/storage/ent/db/predicate"
+	"github.com/dexidp/dex/storage/ent/db/useridentity"
+)
+
+// UserIdentityDelete is the builder for deleting a UserIdentity entity.
+type UserIdentityDelete struct {
+	config
+	hooks    []Hook
+	mutation *UserIdentityMutation
+}
+
+// Where appends a list predicates to the UserIdentityDelete builder.
+func (_d *UserIdentityDelete) Where(ps ...predicate.UserIdentity) *UserIdentityDelete {
+	_d.mutation.Where(ps...)
+	return _d
+}
+
+// Exec executes the deletion query and returns how many vertices were deleted.
+func (_d *UserIdentityDelete) Exec(ctx context.Context) (int, error) {
+	return withHooks(ctx, _d.sqlExec, _d.mutation, _d.hooks)
+}
+
+// ExecX is like Exec, but panics if an error occurs.
+func (_d *UserIdentityDelete) ExecX(ctx context.Context) int {
+	n, err := _d.Exec(ctx)
+	if err != nil {
+		panic(err)
+	}
+	return n
+}
+
+func (_d *UserIdentityDelete) sqlExec(ctx context.Context) (int, error) {
+	_spec := sqlgraph.NewDeleteSpec(useridentity.Table, sqlgraph.NewFieldSpec(useridentity.FieldID, field.TypeString))
+	if ps := _d.mutation.predicates; len(ps) > 0 {
+		_spec.Predicate = func(selector *sql.Selector) {
+			for i := range ps {
+				ps[i](selector)
+			}
+		}
+	}
+	affected, err := sqlgraph.DeleteNodes(ctx, _d.driver, _spec)
+	if err != nil && sqlgraph.IsConstraintError(err) {
+		err = &ConstraintError{msg: err.Error(), wrap: err}
+	}
+	_d.mutation.done = true
+	return affected, err
+}
+
+// UserIdentityDeleteOne is the builder for deleting a single UserIdentity entity.
+type UserIdentityDeleteOne struct {
+	_d *UserIdentityDelete
+}
+
+// Where appends a list predicates to the UserIdentityDelete builder.
+func (_d *UserIdentityDeleteOne) Where(ps ...predicate.UserIdentity) *UserIdentityDeleteOne {
+	_d._d.mutation.Where(ps...)
+	return _d
+}
+
+// Exec executes the deletion query.
+func (_d *UserIdentityDeleteOne) Exec(ctx context.Context) error {
+	n, err := _d._d.Exec(ctx)
+	switch {
+	case err != nil:
+		return err
+	case n == 0:
+		return &NotFoundError{useridentity.Label}
+	default:
+		return nil
+	}
+}
+
+// ExecX is like Exec, but panics if an error occurs.
+func (_d *UserIdentityDeleteOne) ExecX(ctx context.Context) {
+	if err := _d.Exec(ctx); err != nil {
+		panic(err)
+	}
+}
diff --git a/storage/ent/db/useridentity_query.go b/storage/ent/db/useridentity_query.go
new file mode 100644
index 0000000000..3e509038b0
--- /dev/null
+++ b/storage/ent/db/useridentity_query.go
@@ -0,0 +1,527 @@
+// Code generated by ent, DO NOT EDIT.
+
+package db
+
+import (
+	"context"
+	"fmt"
+	"math"
+
+	"entgo.io/ent"
+	"entgo.io/ent/dialect/sql"
+	"entgo.io/ent/dialect/sql/sqlgraph"
+	"entgo.io/ent/schema/field"
+	"github.com/dexidp/dex/storage/ent/db/predicate"
+	"github.com/dexidp/dex/storage/ent/db/useridentity"
+)
+
+// UserIdentityQuery is the builder for querying UserIdentity entities.
+type UserIdentityQuery struct {
+	config
+	ctx        *QueryContext
+	order      []useridentity.OrderOption
+	inters     []Interceptor
+	predicates []predicate.UserIdentity
+	// intermediate query (i.e. traversal path).
+	sql  *sql.Selector
+	path func(context.Context) (*sql.Selector, error)
+}
+
+// Where adds a new predicate for the UserIdentityQuery builder.
+func (_q *UserIdentityQuery) Where(ps ...predicate.UserIdentity) *UserIdentityQuery {
+	_q.predicates = append(_q.predicates, ps...)
+	return _q
+}
+
+// Limit the number of records to be returned by this query.
+func (_q *UserIdentityQuery) Limit(limit int) *UserIdentityQuery {
+	_q.ctx.Limit = &limit
+	return _q
+}
+
+// Offset to start from.
+func (_q *UserIdentityQuery) Offset(offset int) *UserIdentityQuery {
+	_q.ctx.Offset = &offset
+	return _q
+}
+
+// Unique configures the query builder to filter duplicate records on query.
+// By default, unique is set to true, and can be disabled using this method.
+func (_q *UserIdentityQuery) Unique(unique bool) *UserIdentityQuery {
+	_q.ctx.Unique = &unique
+	return _q
+}
+
+// Order specifies how the records should be ordered.
+func (_q *UserIdentityQuery) Order(o ...useridentity.OrderOption) *UserIdentityQuery {
+	_q.order = append(_q.order, o...)
+	return _q
+}
+
+// First returns the first UserIdentity entity from the query.
+// Returns a *NotFoundError when no UserIdentity was found.
+func (_q *UserIdentityQuery) First(ctx context.Context) (*UserIdentity, error) {
+	nodes, err := _q.Limit(1).All(setContextOp(ctx, _q.ctx, ent.OpQueryFirst))
+	if err != nil {
+		return nil, err
+	}
+	if len(nodes) == 0 {
+		return nil, &NotFoundError{useridentity.Label}
+	}
+	return nodes[0], nil
+}
+
+// FirstX is like First, but panics if an error occurs.
+func (_q *UserIdentityQuery) FirstX(ctx context.Context) *UserIdentity {
+	node, err := _q.First(ctx)
+	if err != nil && !IsNotFound(err) {
+		panic(err)
+	}
+	return node
+}
+
+// FirstID returns the first UserIdentity ID from the query.
+// Returns a *NotFoundError when no UserIdentity ID was found.
+func (_q *UserIdentityQuery) FirstID(ctx context.Context) (id string, err error) {
+	var ids []string
+	if ids, err = _q.Limit(1).IDs(setContextOp(ctx, _q.ctx, ent.OpQueryFirstID)); err != nil {
+		return
+	}
+	if len(ids) == 0 {
+		err = &NotFoundError{useridentity.Label}
+		return
+	}
+	return ids[0], nil
+}
+
+// FirstIDX is like FirstID, but panics if an error occurs.
+func (_q *UserIdentityQuery) FirstIDX(ctx context.Context) string {
+	id, err := _q.FirstID(ctx)
+	if err != nil && !IsNotFound(err) {
+		panic(err)
+	}
+	return id
+}
+
+// Only returns a single UserIdentity entity found by the query, ensuring it only returns one.
+// Returns a *NotSingularError when more than one UserIdentity entity is found.
+// Returns a *NotFoundError when no UserIdentity entities are found.
+func (_q *UserIdentityQuery) Only(ctx context.Context) (*UserIdentity, error) {
+	nodes, err := _q.Limit(2).All(setContextOp(ctx, _q.ctx, ent.OpQueryOnly))
+	if err != nil {
+		return nil, err
+	}
+	switch len(nodes) {
+	case 1:
+		return nodes[0], nil
+	case 0:
+		return nil, &NotFoundError{useridentity.Label}
+	default:
+		return nil, &NotSingularError{useridentity.Label}
+	}
+}
+
+// OnlyX is like Only, but panics if an error occurs.
+func (_q *UserIdentityQuery) OnlyX(ctx context.Context) *UserIdentity {
+	node, err := _q.Only(ctx)
+	if err != nil {
+		panic(err)
+	}
+	return node
+}
+
+// OnlyID is like Only, but returns the only UserIdentity ID in the query.
+// Returns a *NotSingularError when more than one UserIdentity ID is found.
+// Returns a *NotFoundError when no entities are found.
+func (_q *UserIdentityQuery) OnlyID(ctx context.Context) (id string, err error) {
+	var ids []string
+	if ids, err = _q.Limit(2).IDs(setContextOp(ctx, _q.ctx, ent.OpQueryOnlyID)); err != nil {
+		return
+	}
+	switch len(ids) {
+	case 1:
+		id = ids[0]
+	case 0:
+		err = &NotFoundError{useridentity.Label}
+	default:
+		err = &NotSingularError{useridentity.Label}
+	}
+	return
+}
+
+// OnlyIDX is like OnlyID, but panics if an error occurs.
+func (_q *UserIdentityQuery) OnlyIDX(ctx context.Context) string {
+	id, err := _q.OnlyID(ctx)
+	if err != nil {
+		panic(err)
+	}
+	return id
+}
+
+// All executes the query and returns a list of UserIdentities.
+func (_q *UserIdentityQuery) All(ctx context.Context) ([]*UserIdentity, error) {
+	ctx = setContextOp(ctx, _q.ctx, ent.OpQueryAll)
+	if err := _q.prepareQuery(ctx); err != nil {
+		return nil, err
+	}
+	qr := querierAll[[]*UserIdentity, *UserIdentityQuery]()
+	return withInterceptors[[]*UserIdentity](ctx, _q, qr, _q.inters)
+}
+
+// AllX is like All, but panics if an error occurs.
+func (_q *UserIdentityQuery) AllX(ctx context.Context) []*UserIdentity {
+	nodes, err := _q.All(ctx)
+	if err != nil {
+		panic(err)
+	}
+	return nodes
+}
+
+// IDs executes the query and returns a list of UserIdentity IDs.
+func (_q *UserIdentityQuery) IDs(ctx context.Context) (ids []string, err error) {
+	if _q.ctx.Unique == nil && _q.path != nil {
+		_q.Unique(true)
+	}
+	ctx = setContextOp(ctx, _q.ctx, ent.OpQueryIDs)
+	if err = _q.Select(useridentity.FieldID).Scan(ctx, &ids); err != nil {
+		return nil, err
+	}
+	return ids, nil
+}
+
+// IDsX is like IDs, but panics if an error occurs.
+func (_q *UserIdentityQuery) IDsX(ctx context.Context) []string {
+	ids, err := _q.IDs(ctx)
+	if err != nil {
+		panic(err)
+	}
+	return ids
+}
+
+// Count returns the count of the given query.
+func (_q *UserIdentityQuery) Count(ctx context.Context) (int, error) {
+	ctx = setContextOp(ctx, _q.ctx, ent.OpQueryCount)
+	if err := _q.prepareQuery(ctx); err != nil {
+		return 0, err
+	}
+	return withInterceptors[int](ctx, _q, querierCount[*UserIdentityQuery](), _q.inters)
+}
+
+// CountX is like Count, but panics if an error occurs.
+func (_q *UserIdentityQuery) CountX(ctx context.Context) int {
+	count, err := _q.Count(ctx)
+	if err != nil {
+		panic(err)
+	}
+	return count
+}
+
+// Exist returns true if the query has elements in the graph.
+func (_q *UserIdentityQuery) Exist(ctx context.Context) (bool, error) {
+	ctx = setContextOp(ctx, _q.ctx, ent.OpQueryExist)
+	switch _, err := _q.FirstID(ctx); {
+	case IsNotFound(err):
+		return false, nil
+	case err != nil:
+		return false, fmt.Errorf("db: check existence: %w", err)
+	default:
+		return true, nil
+	}
+}
+
+// ExistX is like Exist, but panics if an error occurs.
+func (_q *UserIdentityQuery) ExistX(ctx context.Context) bool {
+	exist, err := _q.Exist(ctx)
+	if err != nil {
+		panic(err)
+	}
+	return exist
+}
+
+// Clone returns a duplicate of the UserIdentityQuery builder, including all associated steps. It can be
+// used to prepare common query builders and use them differently after the clone is made.
+func (_q *UserIdentityQuery) Clone() *UserIdentityQuery {
+	if _q == nil {
+		return nil
+	}
+	return &UserIdentityQuery{
+		config:     _q.config,
+		ctx:        _q.ctx.Clone(),
+		order:      append([]useridentity.OrderOption{}, _q.order...),
+		inters:     append([]Interceptor{}, _q.inters...),
+		predicates: append([]predicate.UserIdentity{}, _q.predicates...),
+		// clone intermediate query.
+		sql:  _q.sql.Clone(),
+		path: _q.path,
+	}
+}
+
+// GroupBy is used to group vertices by one or more fields/columns.
+// It is often used with aggregate functions, like: count, max, mean, min, sum.
+//
+// Example:
+//
+//	var v []struct {
+//		UserID string `json:"user_id,omitempty"`
+//		Count int `json:"count,omitempty"`
+//	}
+//
+//	client.UserIdentity.Query().
+//		GroupBy(useridentity.FieldUserID).
+//		Aggregate(db.Count()).
+//		Scan(ctx, &v)
+func (_q *UserIdentityQuery) GroupBy(field string, fields ...string) *UserIdentityGroupBy {
+	_q.ctx.Fields = append([]string{field}, fields...)
+	grbuild := &UserIdentityGroupBy{build: _q}
+	grbuild.flds = &_q.ctx.Fields
+	grbuild.label = useridentity.Label
+	grbuild.scan = grbuild.Scan
+	return grbuild
+}
+
+// Select allows the selection one or more fields/columns for the given query,
+// instead of selecting all fields in the entity.
+//
+// Example:
+//
+//	var v []struct {
+//		UserID string `json:"user_id,omitempty"`
+//	}
+//
+//	client.UserIdentity.Query().
+//		Select(useridentity.FieldUserID).
+//		Scan(ctx, &v)
+func (_q *UserIdentityQuery) Select(fields ...string) *UserIdentitySelect {
+	_q.ctx.Fields = append(_q.ctx.Fields, fields...)
+	sbuild := &UserIdentitySelect{UserIdentityQuery: _q}
+	sbuild.label = useridentity.Label
+	sbuild.flds, sbuild.scan = &_q.ctx.Fields, sbuild.Scan
+	return sbuild
+}
+
+// Aggregate returns a UserIdentitySelect configured with the given aggregations.
+func (_q *UserIdentityQuery) Aggregate(fns ...AggregateFunc) *UserIdentitySelect {
+	return _q.Select().Aggregate(fns...)
+}
+
+func (_q *UserIdentityQuery) prepareQuery(ctx context.Context) error {
+	for _, inter := range _q.inters {
+		if inter == nil {
+			return fmt.Errorf("db: uninitialized interceptor (forgotten import db/runtime?)")
+		}
+		if trv, ok := inter.(Traverser); ok {
+			if err := trv.Traverse(ctx, _q); err != nil {
+				return err
+			}
+		}
+	}
+	for _, f := range _q.ctx.Fields {
+		if !useridentity.ValidColumn(f) {
+			return &ValidationError{Name: f, err: fmt.Errorf("db: invalid field %q for query", f)}
+		}
+	}
+	if _q.path != nil {
+		prev, err := _q.path(ctx)
+		if err != nil {
+			return err
+		}
+		_q.sql = prev
+	}
+	return nil
+}
+
+func (_q *UserIdentityQuery) sqlAll(ctx context.Context, hooks ...queryHook) ([]*UserIdentity, error) {
+	var (
+		nodes = []*UserIdentity{}
+		_spec = _q.querySpec()
+	)
+	_spec.ScanValues = func(columns []string) ([]any, error) {
+		return (*UserIdentity).scanValues(nil, columns)
+	}
+	_spec.Assign = func(columns []string, values []any) error {
+		node := &UserIdentity{config: _q.config}
+		nodes = append(nodes, node)
+		return node.assignValues(columns, values)
+	}
+	for i := range hooks {
+		hooks[i](ctx, _spec)
+	}
+	if err := sqlgraph.QueryNodes(ctx, _q.driver, _spec); err != nil {
+		return nil, err
+	}
+	if len(nodes) == 0 {
+		return nodes, nil
+	}
+	return nodes, nil
+}
+
+func (_q *UserIdentityQuery) sqlCount(ctx context.Context) (int, error) {
+	_spec := _q.querySpec()
+	_spec.Node.Columns = _q.ctx.Fields
+	if len(_q.ctx.Fields) > 0 {
+		_spec.Unique = _q.ctx.Unique != nil && *_q.ctx.Unique
+	}
+	return sqlgraph.CountNodes(ctx, _q.driver, _spec)
+}
+
+func (_q *UserIdentityQuery) querySpec() *sqlgraph.QuerySpec {
+	_spec := sqlgraph.NewQuerySpec(useridentity.Table, useridentity.Columns, sqlgraph.NewFieldSpec(useridentity.FieldID, field.TypeString))
+	_spec.From = _q.sql
+	if unique := _q.ctx.Unique; unique != nil {
+		_spec.Unique = *unique
+	} else if _q.path != nil {
+		_spec.Unique = true
+	}
+	if fields := _q.ctx.Fields; len(fields) > 0 {
+		_spec.Node.Columns = make([]string, 0, len(fields))
+		_spec.Node.Columns = append(_spec.Node.Columns, useridentity.FieldID)
+		for i := range fields {
+			if fields[i] != useridentity.FieldID {
+				_spec.Node.Columns = append(_spec.Node.Columns, fields[i])
+			}
+		}
+	}
+	if ps := _q.predicates; len(ps) > 0 {
+		_spec.Predicate = func(selector *sql.Selector) {
+			for i := range ps {
+				ps[i](selector)
+			}
+		}
+	}
+	if limit := _q.ctx.Limit; limit != nil {
+		_spec.Limit = *limit
+	}
+	if offset := _q.ctx.Offset; offset != nil {
+		_spec.Offset = *offset
+	}
+	if ps := _q.order; len(ps) > 0 {
+		_spec.Order = func(selector *sql.Selector) {
+			for i := range ps {
+				ps[i](selector)
+			}
+		}
+	}
+	return _spec
+}
+
+func (_q *UserIdentityQuery) sqlQuery(ctx context.Context) *sql.Selector {
+	builder := sql.Dialect(_q.driver.Dialect())
+	t1 := builder.Table(useridentity.Table)
+	columns := _q.ctx.Fields
+	if len(columns) == 0 {
+		columns = useridentity.Columns
+	}
+	selector := builder.Select(t1.Columns(columns...)...).From(t1)
+	if _q.sql != nil {
+		selector = _q.sql
+		selector.Select(selector.Columns(columns...)...)
+	}
+	if _q.ctx.Unique != nil && *_q.ctx.Unique {
+		selector.Distinct()
+	}
+	for _, p := range _q.predicates {
+		p(selector)
+	}
+	for _, p := range _q.order {
+		p(selector)
+	}
+	if offset := _q.ctx.Offset; offset != nil {
+		// limit is mandatory for offset clause. We start
+		// with default value, and override it below if needed.
+		selector.Offset(*offset).Limit(math.MaxInt32)
+	}
+	if limit := _q.ctx.Limit; limit != nil {
+		selector.Limit(*limit)
+	}
+	return selector
+}
+
+// UserIdentityGroupBy is the group-by builder for UserIdentity entities.
+type UserIdentityGroupBy struct {
+	selector
+	build *UserIdentityQuery
+}
+
+// Aggregate adds the given aggregation functions to the group-by query.
+func (_g *UserIdentityGroupBy) Aggregate(fns ...AggregateFunc) *UserIdentityGroupBy {
+	_g.fns = append(_g.fns, fns...)
+	return _g
+}
+
+// Scan applies the selector query and scans the result into the given value.
+func (_g *UserIdentityGroupBy) Scan(ctx context.Context, v any) error {
+	ctx = setContextOp(ctx, _g.build.ctx, ent.OpQueryGroupBy)
+	if err := _g.build.prepareQuery(ctx); err != nil {
+		return err
+	}
+	return scanWithInterceptors[*UserIdentityQuery, *UserIdentityGroupBy](ctx, _g.build, _g, _g.build.inters, v)
+}
+
+func (_g *UserIdentityGroupBy) sqlScan(ctx context.Context, root *UserIdentityQuery, v any) error {
+	selector := root.sqlQuery(ctx).Select()
+	aggregation := make([]string, 0, len(_g.fns))
+	for _, fn := range _g.fns {
+		aggregation = append(aggregation, fn(selector))
+	}
+	if len(selector.SelectedColumns()) == 0 {
+		columns := make([]string, 0, len(*_g.flds)+len(_g.fns))
+		for _, f := range *_g.flds {
+			columns = append(columns, selector.C(f))
+		}
+		columns = append(columns, aggregation...)
+		selector.Select(columns...)
+	}
+	selector.GroupBy(selector.Columns(*_g.flds...)...)
+	if err := selector.Err(); err != nil {
+		return err
+	}
+	rows := &sql.Rows{}
+	query, args := selector.Query()
+	if err := _g.build.driver.Query(ctx, query, args, rows); err != nil {
+		return err
+	}
+	defer rows.Close()
+	return sql.ScanSlice(rows, v)
+}
+
+// UserIdentitySelect is the builder for selecting fields of UserIdentity entities.
+type UserIdentitySelect struct {
+	*UserIdentityQuery
+	selector
+}
+
+// Aggregate adds the given aggregation functions to the selector query.
+func (_s *UserIdentitySelect) Aggregate(fns ...AggregateFunc) *UserIdentitySelect {
+	_s.fns = append(_s.fns, fns...)
+	return _s
+}
+
+// Scan applies the selector query and scans the result into the given value.
+func (_s *UserIdentitySelect) Scan(ctx context.Context, v any) error {
+	ctx = setContextOp(ctx, _s.ctx, ent.OpQuerySelect)
+	if err := _s.prepareQuery(ctx); err != nil {
+		return err
+	}
+	return scanWithInterceptors[*UserIdentityQuery, *UserIdentitySelect](ctx, _s.UserIdentityQuery, _s, _s.inters, v)
+}
+
+func (_s *UserIdentitySelect) sqlScan(ctx context.Context, root *UserIdentityQuery, v any) error {
+	selector := root.sqlQuery(ctx)
+	aggregation := make([]string, 0, len(_s.fns))
+	for _, fn := range _s.fns {
+		aggregation = append(aggregation, fn(selector))
+	}
+	switch n := len(*_s.selector.flds); {
+	case n == 0 && len(aggregation) > 0:
+		selector.Select(aggregation...)
+	case n != 0 && len(aggregation) > 0:
+		selector.AppendSelect(aggregation...)
+	}
+	rows := &sql.Rows{}
+	query, args := selector.Query()
+	if err := _s.driver.Query(ctx, query, args, rows); err != nil {
+		return err
+	}
+	defer rows.Close()
+	return sql.ScanSlice(rows, v)
+}
diff --git a/storage/ent/db/useridentity_update.go b/storage/ent/db/useridentity_update.go
new file mode 100644
index 0000000000..ada98ead90
--- /dev/null
+++ b/storage/ent/db/useridentity_update.go
@@ -0,0 +1,701 @@
+// Code generated by ent, DO NOT EDIT.
+
+package db
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"time"
+
+	"entgo.io/ent/dialect/sql"
+	"entgo.io/ent/dialect/sql/sqlgraph"
+	"entgo.io/ent/dialect/sql/sqljson"
+	"entgo.io/ent/schema/field"
+	"github.com/dexidp/dex/storage/ent/db/predicate"
+	"github.com/dexidp/dex/storage/ent/db/useridentity"
+)
+
+// UserIdentityUpdate is the builder for updating UserIdentity entities.
+type UserIdentityUpdate struct {
+	config
+	hooks    []Hook
+	mutation *UserIdentityMutation
+}
+
+// Where appends a list predicates to the UserIdentityUpdate builder.
+func (_u *UserIdentityUpdate) Where(ps ...predicate.UserIdentity) *UserIdentityUpdate {
+	_u.mutation.Where(ps...)
+	return _u
+}
+
+// SetUserID sets the "user_id" field.
+func (_u *UserIdentityUpdate) SetUserID(v string) *UserIdentityUpdate {
+	_u.mutation.SetUserID(v)
+	return _u
+}
+
+// SetNillableUserID sets the "user_id" field if the given value is not nil.
+func (_u *UserIdentityUpdate) SetNillableUserID(v *string) *UserIdentityUpdate {
+	if v != nil {
+		_u.SetUserID(*v)
+	}
+	return _u
+}
+
+// SetConnectorID sets the "connector_id" field.
+func (_u *UserIdentityUpdate) SetConnectorID(v string) *UserIdentityUpdate {
+	_u.mutation.SetConnectorID(v)
+	return _u
+}
+
+// SetNillableConnectorID sets the "connector_id" field if the given value is not nil.
+func (_u *UserIdentityUpdate) SetNillableConnectorID(v *string) *UserIdentityUpdate {
+	if v != nil {
+		_u.SetConnectorID(*v)
+	}
+	return _u
+}
+
+// SetClaimsUserID sets the "claims_user_id" field.
+func (_u *UserIdentityUpdate) SetClaimsUserID(v string) *UserIdentityUpdate {
+	_u.mutation.SetClaimsUserID(v)
+	return _u
+}
+
+// SetNillableClaimsUserID sets the "claims_user_id" field if the given value is not nil.
+func (_u *UserIdentityUpdate) SetNillableClaimsUserID(v *string) *UserIdentityUpdate {
+	if v != nil {
+		_u.SetClaimsUserID(*v)
+	}
+	return _u
+}
+
+// SetClaimsUsername sets the "claims_username" field.
+func (_u *UserIdentityUpdate) SetClaimsUsername(v string) *UserIdentityUpdate {
+	_u.mutation.SetClaimsUsername(v)
+	return _u
+}
+
+// SetNillableClaimsUsername sets the "claims_username" field if the given value is not nil.
+func (_u *UserIdentityUpdate) SetNillableClaimsUsername(v *string) *UserIdentityUpdate {
+	if v != nil {
+		_u.SetClaimsUsername(*v)
+	}
+	return _u
+}
+
+// SetClaimsPreferredUsername sets the "claims_preferred_username" field.
+func (_u *UserIdentityUpdate) SetClaimsPreferredUsername(v string) *UserIdentityUpdate {
+	_u.mutation.SetClaimsPreferredUsername(v)
+	return _u
+}
+
+// SetNillableClaimsPreferredUsername sets the "claims_preferred_username" field if the given value is not nil.
+func (_u *UserIdentityUpdate) SetNillableClaimsPreferredUsername(v *string) *UserIdentityUpdate {
+	if v != nil {
+		_u.SetClaimsPreferredUsername(*v)
+	}
+	return _u
+}
+
+// SetClaimsEmail sets the "claims_email" field.
+func (_u *UserIdentityUpdate) SetClaimsEmail(v string) *UserIdentityUpdate {
+	_u.mutation.SetClaimsEmail(v)
+	return _u
+}
+
+// SetNillableClaimsEmail sets the "claims_email" field if the given value is not nil.
+func (_u *UserIdentityUpdate) SetNillableClaimsEmail(v *string) *UserIdentityUpdate {
+	if v != nil {
+		_u.SetClaimsEmail(*v)
+	}
+	return _u
+}
+
+// SetClaimsEmailVerified sets the "claims_email_verified" field.
+func (_u *UserIdentityUpdate) SetClaimsEmailVerified(v bool) *UserIdentityUpdate {
+	_u.mutation.SetClaimsEmailVerified(v)
+	return _u
+}
+
+// SetNillableClaimsEmailVerified sets the "claims_email_verified" field if the given value is not nil.
+func (_u *UserIdentityUpdate) SetNillableClaimsEmailVerified(v *bool) *UserIdentityUpdate {
+	if v != nil {
+		_u.SetClaimsEmailVerified(*v)
+	}
+	return _u
+}
+
+// SetClaimsGroups sets the "claims_groups" field.
+func (_u *UserIdentityUpdate) SetClaimsGroups(v []string) *UserIdentityUpdate {
+	_u.mutation.SetClaimsGroups(v)
+	return _u
+}
+
+// AppendClaimsGroups appends value to the "claims_groups" field.
+func (_u *UserIdentityUpdate) AppendClaimsGroups(v []string) *UserIdentityUpdate {
+	_u.mutation.AppendClaimsGroups(v)
+	return _u
+}
+
+// ClearClaimsGroups clears the value of the "claims_groups" field.
+func (_u *UserIdentityUpdate) ClearClaimsGroups() *UserIdentityUpdate {
+	_u.mutation.ClearClaimsGroups()
+	return _u
+}
+
+// SetConsents sets the "consents" field.
+func (_u *UserIdentityUpdate) SetConsents(v []byte) *UserIdentityUpdate {
+	_u.mutation.SetConsents(v)
+	return _u
+}
+
+// SetMfaSecrets sets the "mfa_secrets" field.
+func (_u *UserIdentityUpdate) SetMfaSecrets(v []byte) *UserIdentityUpdate {
+	_u.mutation.SetMfaSecrets(v)
+	return _u
+}
+
+// ClearMfaSecrets clears the value of the "mfa_secrets" field.
+func (_u *UserIdentityUpdate) ClearMfaSecrets() *UserIdentityUpdate {
+	_u.mutation.ClearMfaSecrets()
+	return _u
+}
+
+// SetWebauthnCredentials sets the "webauthn_credentials" field.
+func (_u *UserIdentityUpdate) SetWebauthnCredentials(v []byte) *UserIdentityUpdate {
+	_u.mutation.SetWebauthnCredentials(v)
+	return _u
+}
+
+// ClearWebauthnCredentials clears the value of the "webauthn_credentials" field.
+func (_u *UserIdentityUpdate) ClearWebauthnCredentials() *UserIdentityUpdate {
+	_u.mutation.ClearWebauthnCredentials()
+	return _u
+}
+
+// SetCreatedAt sets the "created_at" field.
+func (_u *UserIdentityUpdate) SetCreatedAt(v time.Time) *UserIdentityUpdate {
+	_u.mutation.SetCreatedAt(v)
+	return _u
+}
+
+// SetNillableCreatedAt sets the "created_at" field if the given value is not nil.
+func (_u *UserIdentityUpdate) SetNillableCreatedAt(v *time.Time) *UserIdentityUpdate {
+	if v != nil {
+		_u.SetCreatedAt(*v)
+	}
+	return _u
+}
+
+// SetLastLogin sets the "last_login" field.
+func (_u *UserIdentityUpdate) SetLastLogin(v time.Time) *UserIdentityUpdate {
+	_u.mutation.SetLastLogin(v)
+	return _u
+}
+
+// SetNillableLastLogin sets the "last_login" field if the given value is not nil.
+func (_u *UserIdentityUpdate) SetNillableLastLogin(v *time.Time) *UserIdentityUpdate {
+	if v != nil {
+		_u.SetLastLogin(*v)
+	}
+	return _u
+}
+
+// SetBlockedUntil sets the "blocked_until" field.
+func (_u *UserIdentityUpdate) SetBlockedUntil(v time.Time) *UserIdentityUpdate {
+	_u.mutation.SetBlockedUntil(v)
+	return _u
+}
+
+// SetNillableBlockedUntil sets the "blocked_until" field if the given value is not nil.
+func (_u *UserIdentityUpdate) SetNillableBlockedUntil(v *time.Time) *UserIdentityUpdate {
+	if v != nil {
+		_u.SetBlockedUntil(*v)
+	}
+	return _u
+}
+
+// Mutation returns the UserIdentityMutation object of the builder.
+func (_u *UserIdentityUpdate) Mutation() *UserIdentityMutation {
+	return _u.mutation
+}
+
+// Save executes the query and returns the number of nodes affected by the update operation.
+func (_u *UserIdentityUpdate) Save(ctx context.Context) (int, error) {
+	return withHooks(ctx, _u.sqlSave, _u.mutation, _u.hooks)
+}
+
+// SaveX is like Save, but panics if an error occurs.
+func (_u *UserIdentityUpdate) SaveX(ctx context.Context) int {
+	affected, err := _u.Save(ctx)
+	if err != nil {
+		panic(err)
+	}
+	return affected
+}
+
+// Exec executes the query.
+func (_u *UserIdentityUpdate) Exec(ctx context.Context) error {
+	_, err := _u.Save(ctx)
+	return err
+}
+
+// ExecX is like Exec, but panics if an error occurs.
+func (_u *UserIdentityUpdate) ExecX(ctx context.Context) {
+	if err := _u.Exec(ctx); err != nil {
+		panic(err)
+	}
+}
+
+// check runs all checks and user-defined validators on the builder.
+func (_u *UserIdentityUpdate) check() error {
+	if v, ok := _u.mutation.UserID(); ok {
+		if err := useridentity.UserIDValidator(v); err != nil {
+			return &ValidationError{Name: "user_id", err: fmt.Errorf(`db: validator failed for field "UserIdentity.user_id": %w`, err)}
+		}
+	}
+	if v, ok := _u.mutation.ConnectorID(); ok {
+		if err := useridentity.ConnectorIDValidator(v); err != nil {
+			return &ValidationError{Name: "connector_id", err: fmt.Errorf(`db: validator failed for field "UserIdentity.connector_id": %w`, err)}
+		}
+	}
+	return nil
+}
+
+func (_u *UserIdentityUpdate) sqlSave(ctx context.Context) (_node int, err error) {
+	if err := _u.check(); err != nil {
+		return _node, err
+	}
+	_spec := sqlgraph.NewUpdateSpec(useridentity.Table, useridentity.Columns, sqlgraph.NewFieldSpec(useridentity.FieldID, field.TypeString))
+	if ps := _u.mutation.predicates; len(ps) > 0 {
+		_spec.Predicate = func(selector *sql.Selector) {
+			for i := range ps {
+				ps[i](selector)
+			}
+		}
+	}
+	if value, ok := _u.mutation.UserID(); ok {
+		_spec.SetField(useridentity.FieldUserID, field.TypeString, value)
+	}
+	if value, ok := _u.mutation.ConnectorID(); ok {
+		_spec.SetField(useridentity.FieldConnectorID, field.TypeString, value)
+	}
+	if value, ok := _u.mutation.ClaimsUserID(); ok {
+		_spec.SetField(useridentity.FieldClaimsUserID, field.TypeString, value)
+	}
+	if value, ok := _u.mutation.ClaimsUsername(); ok {
+		_spec.SetField(useridentity.FieldClaimsUsername, field.TypeString, value)
+	}
+	if value, ok := _u.mutation.ClaimsPreferredUsername(); ok {
+		_spec.SetField(useridentity.FieldClaimsPreferredUsername, field.TypeString, value)
+	}
+	if value, ok := _u.mutation.ClaimsEmail(); ok {
+		_spec.SetField(useridentity.FieldClaimsEmail, field.TypeString, value)
+	}
+	if value, ok := _u.mutation.ClaimsEmailVerified(); ok {
+		_spec.SetField(useridentity.FieldClaimsEmailVerified, field.TypeBool, value)
+	}
+	if value, ok := _u.mutation.ClaimsGroups(); ok {
+		_spec.SetField(useridentity.FieldClaimsGroups, field.TypeJSON, value)
+	}
+	if value, ok := _u.mutation.AppendedClaimsGroups(); ok {
+		_spec.AddModifier(func(u *sql.UpdateBuilder) {
+			sqljson.Append(u, useridentity.FieldClaimsGroups, value)
+		})
+	}
+	if _u.mutation.ClaimsGroupsCleared() {
+		_spec.ClearField(useridentity.FieldClaimsGroups, field.TypeJSON)
+	}
+	if value, ok := _u.mutation.Consents(); ok {
+		_spec.SetField(useridentity.FieldConsents, field.TypeBytes, value)
+	}
+	if value, ok := _u.mutation.MfaSecrets(); ok {
+		_spec.SetField(useridentity.FieldMfaSecrets, field.TypeBytes, value)
+	}
+	if _u.mutation.MfaSecretsCleared() {
+		_spec.ClearField(useridentity.FieldMfaSecrets, field.TypeBytes)
+	}
+	if value, ok := _u.mutation.WebauthnCredentials(); ok {
+		_spec.SetField(useridentity.FieldWebauthnCredentials, field.TypeBytes, value)
+	}
+	if _u.mutation.WebauthnCredentialsCleared() {
+		_spec.ClearField(useridentity.FieldWebauthnCredentials, field.TypeBytes)
+	}
+	if value, ok := _u.mutation.CreatedAt(); ok {
+		_spec.SetField(useridentity.FieldCreatedAt, field.TypeTime, value)
+	}
+	if value, ok := _u.mutation.LastLogin(); ok {
+		_spec.SetField(useridentity.FieldLastLogin, field.TypeTime, value)
+	}
+	if value, ok := _u.mutation.BlockedUntil(); ok {
+		_spec.SetField(useridentity.FieldBlockedUntil, field.TypeTime, value)
+	}
+	if _node, err = sqlgraph.UpdateNodes(ctx, _u.driver, _spec); err != nil {
+		if _, ok := err.(*sqlgraph.NotFoundError); ok {
+			err = &NotFoundError{useridentity.Label}
+		} else if sqlgraph.IsConstraintError(err) {
+			err = &ConstraintError{msg: err.Error(), wrap: err}
+		}
+		return 0, err
+	}
+	_u.mutation.done = true
+	return _node, nil
+}
+
+// UserIdentityUpdateOne is the builder for updating a single UserIdentity entity.
+type UserIdentityUpdateOne struct {
+	config
+	fields   []string
+	hooks    []Hook
+	mutation *UserIdentityMutation
+}
+
+// SetUserID sets the "user_id" field.
+func (_u *UserIdentityUpdateOne) SetUserID(v string) *UserIdentityUpdateOne {
+	_u.mutation.SetUserID(v)
+	return _u
+}
+
+// SetNillableUserID sets the "user_id" field if the given value is not nil.
+func (_u *UserIdentityUpdateOne) SetNillableUserID(v *string) *UserIdentityUpdateOne {
+	if v != nil {
+		_u.SetUserID(*v)
+	}
+	return _u
+}
+
+// SetConnectorID sets the "connector_id" field.
+func (_u *UserIdentityUpdateOne) SetConnectorID(v string) *UserIdentityUpdateOne {
+	_u.mutation.SetConnectorID(v)
+	return _u
+}
+
+// SetNillableConnectorID sets the "connector_id" field if the given value is not nil.
+func (_u *UserIdentityUpdateOne) SetNillableConnectorID(v *string) *UserIdentityUpdateOne {
+	if v != nil {
+		_u.SetConnectorID(*v)
+	}
+	return _u
+}
+
+// SetClaimsUserID sets the "claims_user_id" field.
+func (_u *UserIdentityUpdateOne) SetClaimsUserID(v string) *UserIdentityUpdateOne {
+	_u.mutation.SetClaimsUserID(v)
+	return _u
+}
+
+// SetNillableClaimsUserID sets the "claims_user_id" field if the given value is not nil.
+func (_u *UserIdentityUpdateOne) SetNillableClaimsUserID(v *string) *UserIdentityUpdateOne {
+	if v != nil {
+		_u.SetClaimsUserID(*v)
+	}
+	return _u
+}
+
+// SetClaimsUsername sets the "claims_username" field.
+func (_u *UserIdentityUpdateOne) SetClaimsUsername(v string) *UserIdentityUpdateOne {
+	_u.mutation.SetClaimsUsername(v)
+	return _u
+}
+
+// SetNillableClaimsUsername sets the "claims_username" field if the given value is not nil.
+func (_u *UserIdentityUpdateOne) SetNillableClaimsUsername(v *string) *UserIdentityUpdateOne {
+	if v != nil {
+		_u.SetClaimsUsername(*v)
+	}
+	return _u
+}
+
+// SetClaimsPreferredUsername sets the "claims_preferred_username" field.
+func (_u *UserIdentityUpdateOne) SetClaimsPreferredUsername(v string) *UserIdentityUpdateOne {
+	_u.mutation.SetClaimsPreferredUsername(v)
+	return _u
+}
+
+// SetNillableClaimsPreferredUsername sets the "claims_preferred_username" field if the given value is not nil.
+func (_u *UserIdentityUpdateOne) SetNillableClaimsPreferredUsername(v *string) *UserIdentityUpdateOne {
+	if v != nil {
+		_u.SetClaimsPreferredUsername(*v)
+	}
+	return _u
+}
+
+// SetClaimsEmail sets the "claims_email" field.
+func (_u *UserIdentityUpdateOne) SetClaimsEmail(v string) *UserIdentityUpdateOne {
+	_u.mutation.SetClaimsEmail(v)
+	return _u
+}
+
+// SetNillableClaimsEmail sets the "claims_email" field if the given value is not nil.
+func (_u *UserIdentityUpdateOne) SetNillableClaimsEmail(v *string) *UserIdentityUpdateOne {
+	if v != nil {
+		_u.SetClaimsEmail(*v)
+	}
+	return _u
+}
+
+// SetClaimsEmailVerified sets the "claims_email_verified" field.
+func (_u *UserIdentityUpdateOne) SetClaimsEmailVerified(v bool) *UserIdentityUpdateOne {
+	_u.mutation.SetClaimsEmailVerified(v)
+	return _u
+}
+
+// SetNillableClaimsEmailVerified sets the "claims_email_verified" field if the given value is not nil.
+func (_u *UserIdentityUpdateOne) SetNillableClaimsEmailVerified(v *bool) *UserIdentityUpdateOne {
+	if v != nil {
+		_u.SetClaimsEmailVerified(*v)
+	}
+	return _u
+}
+
+// SetClaimsGroups sets the "claims_groups" field.
+func (_u *UserIdentityUpdateOne) SetClaimsGroups(v []string) *UserIdentityUpdateOne {
+	_u.mutation.SetClaimsGroups(v)
+	return _u
+}
+
+// AppendClaimsGroups appends value to the "claims_groups" field.
+func (_u *UserIdentityUpdateOne) AppendClaimsGroups(v []string) *UserIdentityUpdateOne {
+	_u.mutation.AppendClaimsGroups(v)
+	return _u
+}
+
+// ClearClaimsGroups clears the value of the "claims_groups" field.
+func (_u *UserIdentityUpdateOne) ClearClaimsGroups() *UserIdentityUpdateOne {
+	_u.mutation.ClearClaimsGroups()
+	return _u
+}
+
+// SetConsents sets the "consents" field.
+func (_u *UserIdentityUpdateOne) SetConsents(v []byte) *UserIdentityUpdateOne {
+	_u.mutation.SetConsents(v)
+	return _u
+}
+
+// SetMfaSecrets sets the "mfa_secrets" field.
+func (_u *UserIdentityUpdateOne) SetMfaSecrets(v []byte) *UserIdentityUpdateOne {
+	_u.mutation.SetMfaSecrets(v)
+	return _u
+}
+
+// ClearMfaSecrets clears the value of the "mfa_secrets" field.
+func (_u *UserIdentityUpdateOne) ClearMfaSecrets() *UserIdentityUpdateOne {
+	_u.mutation.ClearMfaSecrets()
+	return _u
+}
+
+// SetWebauthnCredentials sets the "webauthn_credentials" field.
+func (_u *UserIdentityUpdateOne) SetWebauthnCredentials(v []byte) *UserIdentityUpdateOne {
+	_u.mutation.SetWebauthnCredentials(v)
+	return _u
+}
+
+// ClearWebauthnCredentials clears the value of the "webauthn_credentials" field.
+func (_u *UserIdentityUpdateOne) ClearWebauthnCredentials() *UserIdentityUpdateOne {
+	_u.mutation.ClearWebauthnCredentials()
+	return _u
+}
+
+// SetCreatedAt sets the "created_at" field.
+func (_u *UserIdentityUpdateOne) SetCreatedAt(v time.Time) *UserIdentityUpdateOne {
+	_u.mutation.SetCreatedAt(v)
+	return _u
+}
+
+// SetNillableCreatedAt sets the "created_at" field if the given value is not nil.
+func (_u *UserIdentityUpdateOne) SetNillableCreatedAt(v *time.Time) *UserIdentityUpdateOne {
+	if v != nil {
+		_u.SetCreatedAt(*v)
+	}
+	return _u
+}
+
+// SetLastLogin sets the "last_login" field.
+func (_u *UserIdentityUpdateOne) SetLastLogin(v time.Time) *UserIdentityUpdateOne {
+	_u.mutation.SetLastLogin(v)
+	return _u
+}
+
+// SetNillableLastLogin sets the "last_login" field if the given value is not nil.
+func (_u *UserIdentityUpdateOne) SetNillableLastLogin(v *time.Time) *UserIdentityUpdateOne {
+	if v != nil {
+		_u.SetLastLogin(*v)
+	}
+	return _u
+}
+
+// SetBlockedUntil sets the "blocked_until" field.
+func (_u *UserIdentityUpdateOne) SetBlockedUntil(v time.Time) *UserIdentityUpdateOne {
+	_u.mutation.SetBlockedUntil(v)
+	return _u
+}
+
+// SetNillableBlockedUntil sets the "blocked_until" field if the given value is not nil.
+func (_u *UserIdentityUpdateOne) SetNillableBlockedUntil(v *time.Time) *UserIdentityUpdateOne {
+	if v != nil {
+		_u.SetBlockedUntil(*v)
+	}
+	return _u
+}
+
+// Mutation returns the UserIdentityMutation object of the builder.
+func (_u *UserIdentityUpdateOne) Mutation() *UserIdentityMutation {
+	return _u.mutation
+}
+
+// Where appends a list predicates to the UserIdentityUpdate builder.
+func (_u *UserIdentityUpdateOne) Where(ps ...predicate.UserIdentity) *UserIdentityUpdateOne {
+	_u.mutation.Where(ps...)
+	return _u
+}
+
+// Select allows selecting one or more fields (columns) of the returned entity.
+// The default is selecting all fields defined in the entity schema.
+func (_u *UserIdentityUpdateOne) Select(field string, fields ...string) *UserIdentityUpdateOne {
+	_u.fields = append([]string{field}, fields...)
+	return _u
+}
+
+// Save executes the query and returns the updated UserIdentity entity.
+func (_u *UserIdentityUpdateOne) Save(ctx context.Context) (*UserIdentity, error) {
+	return withHooks(ctx, _u.sqlSave, _u.mutation, _u.hooks)
+}
+
+// SaveX is like Save, but panics if an error occurs.
+func (_u *UserIdentityUpdateOne) SaveX(ctx context.Context) *UserIdentity {
+	node, err := _u.Save(ctx)
+	if err != nil {
+		panic(err)
+	}
+	return node
+}
+
+// Exec executes the query on the entity.
+func (_u *UserIdentityUpdateOne) Exec(ctx context.Context) error {
+	_, err := _u.Save(ctx)
+	return err
+}
+
+// ExecX is like Exec, but panics if an error occurs.
+func (_u *UserIdentityUpdateOne) ExecX(ctx context.Context) {
+	if err := _u.Exec(ctx); err != nil {
+		panic(err)
+	}
+}
+
+// check runs all checks and user-defined validators on the builder.
+func (_u *UserIdentityUpdateOne) check() error {
+	if v, ok := _u.mutation.UserID(); ok {
+		if err := useridentity.UserIDValidator(v); err != nil {
+			return &ValidationError{Name: "user_id", err: fmt.Errorf(`db: validator failed for field "UserIdentity.user_id": %w`, err)}
+		}
+	}
+	if v, ok := _u.mutation.ConnectorID(); ok {
+		if err := useridentity.ConnectorIDValidator(v); err != nil {
+			return &ValidationError{Name: "connector_id", err: fmt.Errorf(`db: validator failed for field "UserIdentity.connector_id": %w`, err)}
+		}
+	}
+	return nil
+}
+
+func (_u *UserIdentityUpdateOne) sqlSave(ctx context.Context) (_node *UserIdentity, err error) {
+	if err := _u.check(); err != nil {
+		return _node, err
+	}
+	_spec := sqlgraph.NewUpdateSpec(useridentity.Table, useridentity.Columns, sqlgraph.NewFieldSpec(useridentity.FieldID, field.TypeString))
+	id, ok := _u.mutation.ID()
+	if !ok {
+		return nil, &ValidationError{Name: "id", err: errors.New(`db: missing "UserIdentity.id" for update`)}
+	}
+	_spec.Node.ID.Value = id
+	if fields := _u.fields; len(fields) > 0 {
+		_spec.Node.Columns = make([]string, 0, len(fields))
+		_spec.Node.Columns = append(_spec.Node.Columns, useridentity.FieldID)
+		for _, f := range fields {
+			if !useridentity.ValidColumn(f) {
+				return nil, &ValidationError{Name: f, err: fmt.Errorf("db: invalid field %q for query", f)}
+			}
+			if f != useridentity.FieldID {
+				_spec.Node.Columns = append(_spec.Node.Columns, f)
+			}
+		}
+	}
+	if ps := _u.mutation.predicates; len(ps) > 0 {
+		_spec.Predicate = func(selector *sql.Selector) {
+			for i := range ps {
+				ps[i](selector)
+			}
+		}
+	}
+	if value, ok := _u.mutation.UserID(); ok {
+		_spec.SetField(useridentity.FieldUserID, field.TypeString, value)
+	}
+	if value, ok := _u.mutation.ConnectorID(); ok {
+		_spec.SetField(useridentity.FieldConnectorID, field.TypeString, value)
+	}
+	if value, ok := _u.mutation.ClaimsUserID(); ok {
+		_spec.SetField(useridentity.FieldClaimsUserID, field.TypeString, value)
+	}
+	if value, ok := _u.mutation.ClaimsUsername(); ok {
+		_spec.SetField(useridentity.FieldClaimsUsername, field.TypeString, value)
+	}
+	if value, ok := _u.mutation.ClaimsPreferredUsername(); ok {
+		_spec.SetField(useridentity.FieldClaimsPreferredUsername, field.TypeString, value)
+	}
+	if value, ok := _u.mutation.ClaimsEmail(); ok {
+		_spec.SetField(useridentity.FieldClaimsEmail, field.TypeString, value)
+	}
+	if value, ok := _u.mutation.ClaimsEmailVerified(); ok {
+		_spec.SetField(useridentity.FieldClaimsEmailVerified, field.TypeBool, value)
+	}
+	if value, ok := _u.mutation.ClaimsGroups(); ok {
+		_spec.SetField(useridentity.FieldClaimsGroups, field.TypeJSON, value)
+	}
+	if value, ok := _u.mutation.AppendedClaimsGroups(); ok {
+		_spec.AddModifier(func(u *sql.UpdateBuilder) {
+			sqljson.Append(u, useridentity.FieldClaimsGroups, value)
+		})
+	}
+	if _u.mutation.ClaimsGroupsCleared() {
+		_spec.ClearField(useridentity.FieldClaimsGroups, field.TypeJSON)
+	}
+	if value, ok := _u.mutation.Consents(); ok {
+		_spec.SetField(useridentity.FieldConsents, field.TypeBytes, value)
+	}
+	if value, ok := _u.mutation.MfaSecrets(); ok {
+		_spec.SetField(useridentity.FieldMfaSecrets, field.TypeBytes, value)
+	}
+	if _u.mutation.MfaSecretsCleared() {
+		_spec.ClearField(useridentity.FieldMfaSecrets, field.TypeBytes)
+	}
+	if value, ok := _u.mutation.WebauthnCredentials(); ok {
+		_spec.SetField(useridentity.FieldWebauthnCredentials, field.TypeBytes, value)
+	}
+	if _u.mutation.WebauthnCredentialsCleared() {
+		_spec.ClearField(useridentity.FieldWebauthnCredentials, field.TypeBytes)
+	}
+	if value, ok := _u.mutation.CreatedAt(); ok {
+		_spec.SetField(useridentity.FieldCreatedAt, field.TypeTime, value)
+	}
+	if value, ok := _u.mutation.LastLogin(); ok {
+		_spec.SetField(useridentity.FieldLastLogin, field.TypeTime, value)
+	}
+	if value, ok := _u.mutation.BlockedUntil(); ok {
+		_spec.SetField(useridentity.FieldBlockedUntil, field.TypeTime, value)
+	}
+	_node = &UserIdentity{config: _u.config}
+	_spec.Assign = _node.assignValues
+	_spec.ScanValues = _node.scanValues
+	if err = sqlgraph.UpdateNode(ctx, _u.driver, _spec); err != nil {
+		if _, ok := err.(*sqlgraph.NotFoundError); ok {
+			err = &NotFoundError{useridentity.Label}
+		} else if sqlgraph.IsConstraintError(err) {
+			err = &ConstraintError{msg: err.Error(), wrap: err}
+		}
+		return nil, err
+	}
+	_u.mutation.done = true
+	return _node, nil
+}
diff --git a/storage/ent/generate.go b/storage/ent/generate.go
index 805e8cdb33..8f94740526 100644
--- a/storage/ent/generate.go
+++ b/storage/ent/generate.go
@@ -1,3 +1,3 @@
 package ent
 
-//go:generate go run -mod=mod entgo.io/ent/cmd/ent generate ./schema --target ./db
+//go:generate go tool entgo.io/ent/cmd/ent generate ./schema --target ./db
diff --git a/storage/ent/mysql.go b/storage/ent/mysql.go
index 4a9407f95c..bca6eba50f 100644
--- a/storage/ent/mysql.go
+++ b/storage/ent/mysql.go
@@ -7,6 +7,7 @@ import (
 	"crypto/x509"
 	"database/sql"
 	"fmt"
+	"log/slog"
 	"net"
 	"os"
 	"strconv"
@@ -15,7 +16,6 @@ import (
 	entSQL "entgo.io/ent/dialect/sql"
 	"github.com/go-sql-driver/mysql" // Register mysql driver.
 
-	"github.com/dexidp/dex/pkg/log"
 	"github.com/dexidp/dex/storage"
 	"github.com/dexidp/dex/storage/ent/client"
 	"github.com/dexidp/dex/storage/ent/db"
@@ -39,7 +39,7 @@ type MySQL struct {
 }
 
 // Open always returns a new in sqlite3 storage.
-func (m *MySQL) Open(logger log.Logger) (storage.Storage, error) {
+func (m *MySQL) Open(logger *slog.Logger) (storage.Storage, error) {
 	logger.Debug("experimental ent-based storage driver is enabled")
 	drv, err := m.driver()
 	if err != nil {
@@ -81,7 +81,7 @@ func (m *MySQL) driver() (*entSQL.Driver, error) {
 	}
 
 	if m.MaxIdleConns == 0 {
-		/* Override default behaviour to fix https://github.com/dexidp/dex/issues/1608 */
+		/* Override default behavior to fix https://github.com/dexidp/dex/issues/1608 */
 		drv.DB().SetMaxIdleConns(0)
 	} else {
 		drv.DB().SetMaxIdleConns(m.MaxIdleConns)
diff --git a/storage/ent/mysql_test.go b/storage/ent/mysql_test.go
index 6c2dfa1ddf..d7a06ffa0a 100644
--- a/storage/ent/mysql_test.go
+++ b/storage/ent/mysql_test.go
@@ -1,11 +1,11 @@
 package ent
 
 import (
+	"log/slog"
 	"os"
 	"strconv"
 	"testing"
 
-	"github.com/sirupsen/logrus"
 	"github.com/stretchr/testify/require"
 
 	"github.com/dexidp/dex/storage"
@@ -18,6 +18,12 @@ const (
 	MySQLEntDatabaseEnv = "DEX_MYSQL_ENT_DATABASE"
 	MySQLEntUserEnv     = "DEX_MYSQL_ENT_USER"
 	MySQLEntPasswordEnv = "DEX_MYSQL_ENT_PASSWORD"
+
+	MySQL8EntHostEnv     = "DEX_MYSQL8_ENT_HOST"
+	MySQL8EntPortEnv     = "DEX_MYSQL8_ENT_PORT"
+	MySQL8EntDatabaseEnv = "DEX_MYSQL8_ENT_DATABASE"
+	MySQL8EntUserEnv     = "DEX_MYSQL8_ENT_USER"
+	MySQL8EntPasswordEnv = "DEX_MYSQL8_ENT_PASSWORD"
 )
 
 func mysqlTestConfig(host string, port uint64) *MySQL {
@@ -30,7 +36,9 @@ func mysqlTestConfig(host string, port uint64) *MySQL {
 			Port:     uint16(port),
 		},
 		SSL: SSL{
-			Mode: mysqlSSLSkipVerify,
+			// This was originally mysqlSSLSkipVerify. It lead to handshake errors.
+			// See https://github.com/go-sql-driver/mysql/issues/1635 for more details.
+			Mode: mysqlSSLFalse,
 		},
 		params: map[string]string{
 			"innodb_lock_wait_timeout": "1",
@@ -38,12 +46,37 @@ func mysqlTestConfig(host string, port uint64) *MySQL {
 	}
 }
 
-func newMySQLStorage(host string, port uint64) storage.Storage {
-	logger := &logrus.Logger{
-		Out:       os.Stderr,
-		Formatter: &logrus.TextFormatter{DisableColors: true},
-		Level:     logrus.DebugLevel,
+func mysql8TestConfig(host string, port uint64) *MySQL {
+	return &MySQL{
+		NetworkDB: NetworkDB{
+			Database: getenv(MySQL8EntDatabaseEnv, "mysql"),
+			User:     getenv(MySQL8EntUserEnv, "mysql"),
+			Password: getenv(MySQL8EntPasswordEnv, "mysql"),
+			Host:     host,
+			Port:     uint16(port),
+		},
+		SSL: SSL{
+			Mode: mysqlSSLFalse,
+		},
+		params: map[string]string{
+			"innodb_lock_wait_timeout": "1",
+		},
 	}
+}
+
+func newMySQL8Storage(t *testing.T, host string, port uint64) storage.Storage {
+	logger := slog.New(slog.NewTextHandler(t.Output(), &slog.HandlerOptions{Level: slog.LevelDebug}))
+
+	cfg := mysql8TestConfig(host, port)
+	s, err := cfg.Open(logger)
+	if err != nil {
+		panic(err)
+	}
+	return s
+}
+
+func newMySQLStorage(t *testing.T, host string, port uint64) storage.Storage {
+	logger := slog.New(slog.NewTextHandler(t.Output(), &slog.HandlerOptions{Level: slog.LevelDebug}))
 
 	cfg := mysqlTestConfig(host, port)
 	s, err := cfg.Open(logger)
@@ -67,11 +100,42 @@ func TestMySQL(t *testing.T) {
 		require.NoError(t, err, "invalid mysql port %q: %s", rawPort, err)
 	}
 
-	newStorage := func() storage.Storage {
-		return newMySQLStorage(host, port)
+	newStorage := func(t *testing.T) storage.Storage {
+		return newMySQLStorage(t, host, port)
 	}
 	conformance.RunTests(t, newStorage)
 	conformance.RunTransactionTests(t, newStorage)
+
+	// TODO(nabokihms): ent MySQL does not retry on deadlocks (Error 1213, SQLSTATE 40001:
+	// Deadlock found when trying to get lock; try restarting transaction).
+	// Under high contention most updates fail.
+	// conformance.RunConcurrencyTests(t, newStorage)
+}
+
+func TestMySQL8(t *testing.T) {
+	host := os.Getenv(MySQL8EntHostEnv)
+	if host == "" {
+		t.Skipf("test environment variable %s not set, skipping", MySQL8EntHostEnv)
+	}
+
+	port := uint64(3306)
+	if rawPort := os.Getenv(MySQL8EntPortEnv); rawPort != "" {
+		var err error
+
+		port, err = strconv.ParseUint(rawPort, 10, 32)
+		require.NoError(t, err, "invalid mysql port %q: %s", rawPort, err)
+	}
+
+	newStorage := func(t *testing.T) storage.Storage {
+		return newMySQL8Storage(t, host, port)
+	}
+	conformance.RunTests(t, newStorage)
+	conformance.RunTransactionTests(t, newStorage)
+
+	// TODO(nabokihms): ent MySQL 8 does not retry on deadlocks (Error 1213, SQLSTATE 40001:
+	// Deadlock found when trying to get lock; try restarting transaction).
+	// Under high contention most updates fail.
+	// conformance.RunConcurrencyTests(t, newStorage)
 }
 
 func TestMySQLDSN(t *testing.T) {
diff --git a/storage/ent/postgres.go b/storage/ent/postgres.go
index 1953f5992f..dad81df445 100644
--- a/storage/ent/postgres.go
+++ b/storage/ent/postgres.go
@@ -5,6 +5,7 @@ import (
 	"crypto/sha256"
 	"database/sql"
 	"fmt"
+	"log/slog"
 	"net"
 	"regexp"
 	"strconv"
@@ -14,13 +15,11 @@ import (
 	entSQL "entgo.io/ent/dialect/sql"
 	_ "github.com/lib/pq" // Register postgres driver.
 
-	"github.com/dexidp/dex/pkg/log"
 	"github.com/dexidp/dex/storage"
 	"github.com/dexidp/dex/storage/ent/client"
 	"github.com/dexidp/dex/storage/ent/db"
 )
 
-// nolint
 const (
 	// postgres SSL modes
 	pgSSLDisable    = "disable"
@@ -37,7 +36,7 @@ type Postgres struct {
 }
 
 // Open always returns a new in sqlite3 storage.
-func (p *Postgres) Open(logger log.Logger) (storage.Storage, error) {
+func (p *Postgres) Open(logger *slog.Logger) (storage.Storage, error) {
 	logger.Debug("experimental ent-based storage driver is enabled")
 	drv, err := p.driver()
 	if err != nil {
diff --git a/storage/ent/postgres_test.go b/storage/ent/postgres_test.go
index c8e3a54df2..b53ed382cd 100644
--- a/storage/ent/postgres_test.go
+++ b/storage/ent/postgres_test.go
@@ -1,11 +1,11 @@
 package ent
 
 import (
+	"log/slog"
 	"os"
 	"strconv"
 	"testing"
 
-	"github.com/sirupsen/logrus"
 	"github.com/stretchr/testify/require"
 
 	"github.com/dexidp/dex/storage"
@@ -35,12 +35,8 @@ func postgresTestConfig(host string, port uint64) *Postgres {
 	}
 }
 
-func newPostgresStorage(host string, port uint64) storage.Storage {
-	logger := &logrus.Logger{
-		Out:       os.Stderr,
-		Formatter: &logrus.TextFormatter{DisableColors: true},
-		Level:     logrus.DebugLevel,
-	}
+func newPostgresStorage(t *testing.T, host string, port uint64) storage.Storage {
+	logger := slog.New(slog.NewTextHandler(t.Output(), &slog.HandlerOptions{Level: slog.LevelDebug}))
 
 	cfg := postgresTestConfig(host, port)
 	s, err := cfg.Open(logger)
@@ -64,11 +60,16 @@ func TestPostgres(t *testing.T) {
 		require.NoError(t, err, "invalid postgres port %q: %s", rawPort, err)
 	}
 
-	newStorage := func() storage.Storage {
-		return newPostgresStorage(host, port)
+	newStorage := func(t *testing.T) storage.Storage {
+		return newPostgresStorage(t, host, port)
 	}
 	conformance.RunTests(t, newStorage)
 	conformance.RunTransactionTests(t, newStorage)
+
+	// TODO(nabokihms): ent Postgres uses SERIALIZABLE transaction isolation for UpdateRefreshToken,
+	// but does not retry on serialization failures (pq: could not serialize access due to
+	// concurrent update, SQLSTATE 40001). Under high contention most updates fail immediately.
+	// conformance.RunConcurrencyTests(t, newStorage)
 }
 
 func TestPostgresDSN(t *testing.T) {
diff --git a/storage/ent/schema/authcode.go b/storage/ent/schema/authcode.go
index 1574347b30..e24de063c6 100644
--- a/storage/ent/schema/authcode.go
+++ b/storage/ent/schema/authcode.go
@@ -81,6 +81,13 @@ func (AuthCode) Fields() []ent.Field {
 		field.Text("code_challenge_method").
 			SchemaType(textSchema).
 			Default(""),
+		field.Time("auth_time").
+			SchemaType(timeSchema).
+			Optional(),
+		field.Text("session_id").
+			SchemaType(textSchema).
+			Default("").
+			Optional(),
 	}
 }
 
diff --git a/storage/ent/schema/authrequest.go b/storage/ent/schema/authrequest.go
index 7d41e83082..2d6cfebf1f 100644
--- a/storage/ent/schema/authrequest.go
+++ b/storage/ent/schema/authrequest.go
@@ -27,7 +27,8 @@ create table auth_request
     expiry                    timestamp not null,
     claims_preferred_username text default '' not null,
     code_challenge            text default '' not null,
-    code_challenge_method     text default '' not null
+    code_challenge_method     text default '' not null,
+    hmac_key                  blob
 );
 */
 
@@ -86,6 +87,15 @@ func (AuthRequest) Fields() []ent.Field {
 		field.Text("code_challenge_method").
 			SchemaType(textSchema).
 			Default(""),
+		field.Bytes("hmac_key"),
+		field.Bool("mfa_validated").
+			Default(false),
+		field.Bytes("webauthn_session_data").
+			Nillable().
+			Optional(),
+		field.Text("prompt").SchemaType(textSchema).Default(""),
+		field.Int("max_age").Default(-1),
+		field.Time("auth_time").SchemaType(timeSchema).Optional(),
 	}
 }
 
diff --git a/storage/ent/schema/authsession.go b/storage/ent/schema/authsession.go
new file mode 100644
index 0000000000..07f2ea645b
--- /dev/null
+++ b/storage/ent/schema/authsession.go
@@ -0,0 +1,52 @@
+package schema
+
+import (
+	"entgo.io/ent"
+	"entgo.io/ent/schema/field"
+)
+
+// AuthSession holds the schema definition for the AuthSession entity.
+type AuthSession struct {
+	ent.Schema
+}
+
+// Fields of the AuthSession.
+func (AuthSession) Fields() []ent.Field {
+	return []ent.Field{
+		field.Text("id").
+			SchemaType(textSchema).
+			NotEmpty().
+			Unique(),
+		field.Text("user_id").
+			SchemaType(textSchema).
+			NotEmpty(),
+		field.Text("connector_id").
+			SchemaType(textSchema).
+			NotEmpty(),
+		field.Text("secret").
+			SchemaType(textSchema).
+			NotEmpty(),
+		field.Bytes("client_states"),
+		field.Time("created_at").
+			SchemaType(timeSchema),
+		field.Time("last_activity").
+			SchemaType(timeSchema),
+		field.Text("ip_address").
+			SchemaType(textSchema).
+			Default(""),
+		field.Text("user_agent").
+			SchemaType(textSchema).
+			Default(""),
+		field.Time("absolute_expiry").
+			SchemaType(timeSchema),
+		field.Time("idle_expiry").
+			SchemaType(timeSchema),
+		field.Bytes("logout_state").
+			Optional(),
+	}
+}
+
+// Edges of the AuthSession.
+func (AuthSession) Edges() []ent.Edge {
+	return []ent.Edge{}
+}
diff --git a/storage/ent/schema/client.go b/storage/ent/schema/client.go
index b897c52a2e..21b9126444 100644
--- a/storage/ent/schema/client.go
+++ b/storage/ent/schema/client.go
@@ -3,6 +3,8 @@ package schema
 import (
 	"entgo.io/ent"
 	"entgo.io/ent/schema/field"
+
+	"github.com/dexidp/dex/storage"
 )
 
 /* Original SQL table:
@@ -45,6 +47,24 @@ func (OAuth2Client) Fields() []ent.Field {
 		field.Text("logo_url").
 			SchemaType(textSchema).
 			NotEmpty(),
+		field.JSON("allowed_connectors", []string{}).
+			Optional(),
+		field.JSON("mfa_chain", []string{}).
+			Optional(),
+		field.JSON("post_logout_redirect_uris", []string{}).
+			Optional(),
+		field.JSON("sso_shared_with", []string{}).
+			Optional(),
+		field.Text("backchannel_logout_uri").
+			SchemaType(textSchema).
+			Default("").
+			Optional(),
+		field.Text("refresh_token_lifetime").
+			SchemaType(textSchema).
+			Default("").
+			Optional(),
+		field.JSON("client_credentials_claims", &storage.ClientCredentialsClaims{}).
+			Optional(),
 	}
 }
 
diff --git a/storage/ent/schema/connector.go b/storage/ent/schema/connector.go
index 41b65eb4fb..191092c574 100644
--- a/storage/ent/schema/connector.go
+++ b/storage/ent/schema/connector.go
@@ -38,6 +38,8 @@ func (Connector) Fields() []ent.Field {
 		field.Text("resource_version").
 			SchemaType(textSchema),
 		field.Bytes("config"),
+		field.JSON("grant_types", []string{}).
+			Optional(),
 	}
 }
 
diff --git a/storage/ent/schema/keys.go b/storage/ent/schema/keys.go
index ec5cd3f6bb..b8e56817b5 100644
--- a/storage/ent/schema/keys.go
+++ b/storage/ent/schema/keys.go
@@ -3,7 +3,7 @@ package schema
 import (
 	"entgo.io/ent"
 	"entgo.io/ent/schema/field"
-	"gopkg.in/square/go-jose.v2"
+	"github.com/go-jose/go-jose/v4"
 
 	"github.com/dexidp/dex/storage"
 )
diff --git a/storage/ent/schema/password.go b/storage/ent/schema/password.go
index cbc72fc52e..adc0fbfd06 100644
--- a/storage/ent/schema/password.go
+++ b/storage/ent/schema/password.go
@@ -32,9 +32,20 @@ func (Password) Fields() []ent.Field {
 		field.Text("username").
 			SchemaType(textSchema).
 			NotEmpty(),
+		field.Text("name").
+			SchemaType(textSchema).
+			Default(""),
+		field.Text("preferred_username").
+			SchemaType(textSchema).
+			Default(""),
+		field.Bool("email_verified").
+			Optional().
+			Nillable(),
 		field.Text("user_id").
 			SchemaType(textSchema).
 			NotEmpty(),
+		field.JSON("groups", []string{}).
+			Optional(),
 	}
 }
 
diff --git a/storage/ent/schema/useridentity.go b/storage/ent/schema/useridentity.go
new file mode 100644
index 0000000000..b4fe75d087
--- /dev/null
+++ b/storage/ent/schema/useridentity.go
@@ -0,0 +1,62 @@
+package schema
+
+import (
+	"entgo.io/ent"
+	"entgo.io/ent/schema/field"
+)
+
+// UserIdentity holds the schema definition for the UserIdentity entity.
+type UserIdentity struct {
+	ent.Schema
+}
+
+// Fields of the UserIdentity.
+func (UserIdentity) Fields() []ent.Field {
+	return []ent.Field{
+		// Using id field here because it's impossible to create multi-key primary yet
+		field.Text("id").
+			SchemaType(textSchema).
+			NotEmpty().
+			Unique(),
+		field.Text("user_id").
+			SchemaType(textSchema).
+			NotEmpty(),
+		field.Text("connector_id").
+			SchemaType(textSchema).
+			NotEmpty(),
+		field.Text("claims_user_id").
+			SchemaType(textSchema).
+			Default(""),
+		field.Text("claims_username").
+			SchemaType(textSchema).
+			Default(""),
+		field.Text("claims_preferred_username").
+			SchemaType(textSchema).
+			Default(""),
+		field.Text("claims_email").
+			SchemaType(textSchema).
+			Default(""),
+		field.Bool("claims_email_verified").
+			Default(false),
+		field.JSON("claims_groups", []string{}).
+			Optional(),
+		field.Bytes("consents"),
+		field.Bytes("mfa_secrets").
+			Nillable().
+			Optional(),
+		field.Bytes("webauthn_credentials").
+			Nillable().
+			Optional(),
+		field.Time("created_at").
+			SchemaType(timeSchema),
+		field.Time("last_login").
+			SchemaType(timeSchema),
+		field.Time("blocked_until").
+			SchemaType(timeSchema),
+	}
+}
+
+// Edges of the UserIdentity.
+func (UserIdentity) Edges() []ent.Edge {
+	return []ent.Edge{}
+}
diff --git a/storage/ent/sqlite.go b/storage/ent/sqlite.go
index c0b442f400..8c5287ef50 100644
--- a/storage/ent/sqlite.go
+++ b/storage/ent/sqlite.go
@@ -3,12 +3,12 @@ package ent
 import (
 	"context"
 	"crypto/sha256"
+	"log/slog"
 	"strings"
 
 	"entgo.io/ent/dialect/sql"
 	_ "github.com/mattn/go-sqlite3" // Register sqlite driver.
 
-	"github.com/dexidp/dex/pkg/log"
 	"github.com/dexidp/dex/storage"
 	"github.com/dexidp/dex/storage/ent/client"
 	"github.com/dexidp/dex/storage/ent/db"
@@ -20,7 +20,7 @@ type SQLite3 struct {
 }
 
 // Open always returns a new in sqlite3 storage.
-func (s *SQLite3) Open(logger log.Logger) (storage.Storage, error) {
+func (s *SQLite3) Open(logger *slog.Logger) (storage.Storage, error) {
 	logger.Debug("experimental ent-based storage driver is enabled")
 
 	// Implicitly set foreign_keys pragma to "on" because it is required by ent
diff --git a/storage/ent/sqlite_test.go b/storage/ent/sqlite_test.go
index 301d769b4a..54638c19b7 100644
--- a/storage/ent/sqlite_test.go
+++ b/storage/ent/sqlite_test.go
@@ -1,21 +1,15 @@
 package ent
 
 import (
-	"os"
+	"log/slog"
 	"testing"
 
-	"github.com/sirupsen/logrus"
-
 	"github.com/dexidp/dex/storage"
 	"github.com/dexidp/dex/storage/conformance"
 )
 
-func newSQLiteStorage() storage.Storage {
-	logger := &logrus.Logger{
-		Out:       os.Stderr,
-		Formatter: &logrus.TextFormatter{DisableColors: true},
-		Level:     logrus.DebugLevel,
-	}
+func newSQLiteStorage(t *testing.T) storage.Storage {
+	logger := slog.New(slog.NewTextHandler(t.Output(), &slog.HandlerOptions{Level: slog.LevelDebug}))
 
 	cfg := SQLite3{File: ":memory:"}
 	s, err := cfg.Open(logger)
@@ -27,4 +21,5 @@ func newSQLiteStorage() storage.Storage {
 
 func TestSQLite3(t *testing.T) {
 	conformance.RunTests(t, newSQLiteStorage)
+	conformance.RunConcurrencyTests(t, newSQLiteStorage)
 }
diff --git a/storage/etcd/config.go b/storage/etcd/config.go
index 7f1a7b4fb7..b4850f3a4b 100644
--- a/storage/etcd/config.go
+++ b/storage/etcd/config.go
@@ -1,13 +1,13 @@
 package etcd
 
 import (
+	"log/slog"
 	"time"
 
 	"go.etcd.io/etcd/client/pkg/v3/transport"
 	clientv3 "go.etcd.io/etcd/client/v3"
 	"go.etcd.io/etcd/client/v3/namespace"
 
-	"github.com/dexidp/dex/pkg/log"
 	"github.com/dexidp/dex/storage"
 )
 
@@ -15,10 +15,10 @@ var defaultDialTimeout = 2 * time.Second
 
 // SSL represents SSL options for etcd databases.
 type SSL struct {
-	ServerName string `json:"serverName" yaml:"serverName"`
-	CAFile     string `json:"caFile" yaml:"caFile"`
-	KeyFile    string `json:"keyFile" yaml:"keyFile"`
-	CertFile   string `json:"certFile" yaml:"certFile"`
+	ServerName string `json:"serverName"`
+	CAFile     string `json:"caFile"`
+	KeyFile    string `json:"keyFile"`
+	CertFile   string `json:"certFile"`
 }
 
 // Etcd options for connecting to etcd databases.
@@ -26,19 +26,19 @@ type SSL struct {
 // configure an etcd namespace either via Namespace field or using `etcd grpc-proxy
 // --namespace=<prefix>`
 type Etcd struct {
-	Endpoints []string `json:"endpoints" yaml:"endpoints"`
-	Namespace string   `json:"namespace" yaml:"namespace"`
-	Username  string   `json:"username" yaml:"username"`
-	Password  string   `json:"password" yaml:"password"`
-	SSL       SSL      `json:"ssl" yaml:"ssl"`
+	Endpoints []string `json:"endpoints"`
+	Namespace string   `json:"namespace"`
+	Username  string   `json:"username"`
+	Password  string   `json:"password"`
+	SSL       SSL      `json:"ssl"`
 }
 
 // Open creates a new storage implementation backed by Etcd
-func (p *Etcd) Open(logger log.Logger) (storage.Storage, error) {
+func (p *Etcd) Open(logger *slog.Logger) (storage.Storage, error) {
 	return p.open(logger)
 }
 
-func (p *Etcd) open(logger log.Logger) (*conn, error) {
+func (p *Etcd) open(logger *slog.Logger) (*conn, error) {
 	cfg := clientv3.Config{
 		Endpoints:   p.Endpoints,
 		DialTimeout: defaultDialTimeout,
diff --git a/storage/etcd/etcd.go b/storage/etcd/etcd.go
index 13e815ec8d..1e85ee2af7 100644
--- a/storage/etcd/etcd.go
+++ b/storage/etcd/etcd.go
@@ -4,12 +4,12 @@ import (
 	"context"
 	"encoding/json"
 	"fmt"
+	"log/slog"
 	"strings"
 	"time"
 
 	clientv3 "go.etcd.io/etcd/client/v3"
 
-	"github.com/dexidp/dex/pkg/log"
 	"github.com/dexidp/dex/storage"
 )
 
@@ -24,22 +24,26 @@ const (
 	keysName             = "openid-connect-keys"
 	deviceRequestPrefix  = "device_req/"
 	deviceTokenPrefix    = "device_token/"
+	userIdentityPrefix   = "user_identity/"
+	authSessionPrefix    = "auth_session/"
 
 	// defaultStorageTimeout will be applied to all storage's operations.
 	defaultStorageTimeout = 5 * time.Second
 )
 
+var _ storage.Storage = (*conn)(nil)
+
 type conn struct {
 	db     *clientv3.Client
-	logger log.Logger
+	logger *slog.Logger
 }
 
 func (c *conn) Close() error {
 	return c.db.Close()
 }
 
-func (c *conn) GarbageCollect(now time.Time) (result storage.GCResult, err error) {
-	ctx, cancel := context.WithTimeout(context.Background(), defaultStorageTimeout)
+func (c *conn) GarbageCollect(ctx context.Context, now time.Time) (result storage.GCResult, err error) {
+	ctx, cancel := context.WithTimeout(ctx, defaultStorageTimeout)
 	defer cancel()
 	authRequests, err := c.listAuthRequests(ctx)
 	if err != nil {
@@ -50,7 +54,7 @@ func (c *conn) GarbageCollect(now time.Time) (result storage.GCResult, err error
 	for _, authRequest := range authRequests {
 		if now.After(authRequest.Expiry) {
 			if err := c.deleteKey(ctx, keyID(authRequestPrefix, authRequest.ID)); err != nil {
-				c.logger.Errorf("failed to delete auth request: %v", err)
+				c.logger.Error("failed to delete auth request", "err", err)
 				delErr = fmt.Errorf("failed to delete auth request: %v", err)
 			}
 			result.AuthRequests++
@@ -68,7 +72,7 @@ func (c *conn) GarbageCollect(now time.Time) (result storage.GCResult, err error
 	for _, authCode := range authCodes {
 		if now.After(authCode.Expiry) {
 			if err := c.deleteKey(ctx, keyID(authCodePrefix, authCode.ID)); err != nil {
-				c.logger.Errorf("failed to delete auth code %v", err)
+				c.logger.Error("failed to delete auth code", "err", err)
 				delErr = fmt.Errorf("failed to delete auth code: %v", err)
 			}
 			result.AuthCodes++
@@ -83,7 +87,7 @@ func (c *conn) GarbageCollect(now time.Time) (result storage.GCResult, err error
 	for _, deviceRequest := range deviceRequests {
 		if now.After(deviceRequest.Expiry) {
 			if err := c.deleteKey(ctx, keyID(deviceRequestPrefix, deviceRequest.UserCode)); err != nil {
-				c.logger.Errorf("failed to delete device request %v", err)
+				c.logger.Error("failed to delete device request", "err", err)
 				delErr = fmt.Errorf("failed to delete device request: %v", err)
 			}
 			result.DeviceRequests++
@@ -98,23 +102,39 @@ func (c *conn) GarbageCollect(now time.Time) (result storage.GCResult, err error
 	for _, deviceToken := range deviceTokens {
 		if now.After(deviceToken.Expiry) {
 			if err := c.deleteKey(ctx, keyID(deviceTokenPrefix, deviceToken.DeviceCode)); err != nil {
-				c.logger.Errorf("failed to delete device token %v", err)
+				c.logger.Error("failed to delete device token", "err", err)
 				delErr = fmt.Errorf("failed to delete device token: %v", err)
 			}
 			result.DeviceTokens++
 		}
 	}
+
+	authSessions, err := c.listAuthSessionsInternal(ctx)
+	if err != nil {
+		return result, err
+	}
+
+	for _, authSession := range authSessions {
+		if now.After(authSession.AbsoluteExpiry) || now.After(authSession.IdleExpiry) {
+			if err := c.deleteKey(ctx, keyAuthSession(authSession.ID)); err != nil {
+				c.logger.Error("failed to delete auth session", "err", err)
+				delErr = fmt.Errorf("failed to delete auth session: %v", err)
+			} else {
+				result.AuthSessions++
+			}
+		}
+	}
+
 	return result, delErr
 }
 
-func (c *conn) CreateAuthRequest(a storage.AuthRequest) error {
-	ctx, cancel := context.WithTimeout(context.Background(), defaultStorageTimeout)
-	defer cancel()
+func (c *conn) CreateAuthRequest(ctx context.Context, a storage.AuthRequest) error {
 	return c.txnCreate(ctx, keyID(authRequestPrefix, a.ID), fromStorageAuthRequest(a))
 }
 
-func (c *conn) GetAuthRequest(id string) (a storage.AuthRequest, err error) {
-	ctx, cancel := context.WithTimeout(context.Background(), defaultStorageTimeout)
+func (c *conn) GetAuthRequest(ctx context.Context, id string) (a storage.AuthRequest, err error) {
+	// TODO: Add this to other funcs??
+	ctx, cancel := context.WithTimeout(ctx, defaultStorageTimeout)
 	defer cancel()
 	var req AuthRequest
 	if err = c.getKey(ctx, keyID(authRequestPrefix, id), &req); err != nil {
@@ -123,8 +143,8 @@ func (c *conn) GetAuthRequest(id string) (a storage.AuthRequest, err error) {
 	return toStorageAuthRequest(req), nil
 }
 
-func (c *conn) UpdateAuthRequest(id string, updater func(a storage.AuthRequest) (storage.AuthRequest, error)) error {
-	ctx, cancel := context.WithTimeout(context.Background(), defaultStorageTimeout)
+func (c *conn) UpdateAuthRequest(ctx context.Context, id string, updater func(a storage.AuthRequest) (storage.AuthRequest, error)) error {
+	ctx, cancel := context.WithTimeout(ctx, defaultStorageTimeout)
 	defer cancel()
 	return c.txnUpdate(ctx, keyID(authRequestPrefix, id), func(currentValue []byte) ([]byte, error) {
 		var current AuthRequest
@@ -141,20 +161,18 @@ func (c *conn) UpdateAuthRequest(id string, updater func(a storage.AuthRequest)
 	})
 }
 
-func (c *conn) DeleteAuthRequest(id string) error {
-	ctx, cancel := context.WithTimeout(context.Background(), defaultStorageTimeout)
+func (c *conn) DeleteAuthRequest(ctx context.Context, id string) error {
+	ctx, cancel := context.WithTimeout(ctx, defaultStorageTimeout)
 	defer cancel()
 	return c.deleteKey(ctx, keyID(authRequestPrefix, id))
 }
 
-func (c *conn) CreateAuthCode(a storage.AuthCode) error {
-	ctx, cancel := context.WithTimeout(context.Background(), defaultStorageTimeout)
-	defer cancel()
+func (c *conn) CreateAuthCode(ctx context.Context, a storage.AuthCode) error {
 	return c.txnCreate(ctx, keyID(authCodePrefix, a.ID), fromStorageAuthCode(a))
 }
 
-func (c *conn) GetAuthCode(id string) (a storage.AuthCode, err error) {
-	ctx, cancel := context.WithTimeout(context.Background(), defaultStorageTimeout)
+func (c *conn) GetAuthCode(ctx context.Context, id string) (a storage.AuthCode, err error) {
+	ctx, cancel := context.WithTimeout(ctx, defaultStorageTimeout)
 	defer cancel()
 	var ac AuthCode
 	err = c.getKey(ctx, keyID(authCodePrefix, id), &ac)
@@ -164,20 +182,18 @@ func (c *conn) GetAuthCode(id string) (a storage.AuthCode, err error) {
 	return a, err
 }
 
-func (c *conn) DeleteAuthCode(id string) error {
-	ctx, cancel := context.WithTimeout(context.Background(), defaultStorageTimeout)
+func (c *conn) DeleteAuthCode(ctx context.Context, id string) error {
+	ctx, cancel := context.WithTimeout(ctx, defaultStorageTimeout)
 	defer cancel()
 	return c.deleteKey(ctx, keyID(authCodePrefix, id))
 }
 
-func (c *conn) CreateRefresh(r storage.RefreshToken) error {
-	ctx, cancel := context.WithTimeout(context.Background(), defaultStorageTimeout)
-	defer cancel()
+func (c *conn) CreateRefresh(ctx context.Context, r storage.RefreshToken) error {
 	return c.txnCreate(ctx, keyID(refreshTokenPrefix, r.ID), fromStorageRefreshToken(r))
 }
 
-func (c *conn) GetRefresh(id string) (r storage.RefreshToken, err error) {
-	ctx, cancel := context.WithTimeout(context.Background(), defaultStorageTimeout)
+func (c *conn) GetRefresh(ctx context.Context, id string) (r storage.RefreshToken, err error) {
+	ctx, cancel := context.WithTimeout(ctx, defaultStorageTimeout)
 	defer cancel()
 	var token RefreshToken
 	if err = c.getKey(ctx, keyID(refreshTokenPrefix, id), &token); err != nil {
@@ -186,8 +202,8 @@ func (c *conn) GetRefresh(id string) (r storage.RefreshToken, err error) {
 	return toStorageRefreshToken(token), nil
 }
 
-func (c *conn) UpdateRefreshToken(id string, updater func(old storage.RefreshToken) (storage.RefreshToken, error)) error {
-	ctx, cancel := context.WithTimeout(context.Background(), defaultStorageTimeout)
+func (c *conn) UpdateRefreshToken(ctx context.Context, id string, updater func(old storage.RefreshToken) (storage.RefreshToken, error)) error {
+	ctx, cancel := context.WithTimeout(ctx, defaultStorageTimeout)
 	defer cancel()
 	return c.txnUpdate(ctx, keyID(refreshTokenPrefix, id), func(currentValue []byte) ([]byte, error) {
 		var current RefreshToken
@@ -204,14 +220,14 @@ func (c *conn) UpdateRefreshToken(id string, updater func(old storage.RefreshTok
 	})
 }
 
-func (c *conn) DeleteRefresh(id string) error {
-	ctx, cancel := context.WithTimeout(context.Background(), defaultStorageTimeout)
+func (c *conn) DeleteRefresh(ctx context.Context, id string) error {
+	ctx, cancel := context.WithTimeout(ctx, defaultStorageTimeout)
 	defer cancel()
 	return c.deleteKey(ctx, keyID(refreshTokenPrefix, id))
 }
 
-func (c *conn) ListRefreshTokens() (tokens []storage.RefreshToken, err error) {
-	ctx, cancel := context.WithTimeout(context.Background(), defaultStorageTimeout)
+func (c *conn) ListRefreshTokens(ctx context.Context) (tokens []storage.RefreshToken, err error) {
+	ctx, cancel := context.WithTimeout(ctx, defaultStorageTimeout)
 	defer cancel()
 	res, err := c.db.Get(ctx, refreshTokenPrefix, clientv3.WithPrefix())
 	if err != nil {
@@ -227,21 +243,19 @@ func (c *conn) ListRefreshTokens() (tokens []storage.RefreshToken, err error) {
 	return tokens, nil
 }
 
-func (c *conn) CreateClient(cli storage.Client) error {
-	ctx, cancel := context.WithTimeout(context.Background(), defaultStorageTimeout)
-	defer cancel()
+func (c *conn) CreateClient(ctx context.Context, cli storage.Client) error {
 	return c.txnCreate(ctx, keyID(clientPrefix, cli.ID), cli)
 }
 
-func (c *conn) GetClient(id string) (cli storage.Client, err error) {
-	ctx, cancel := context.WithTimeout(context.Background(), defaultStorageTimeout)
+func (c *conn) GetClient(ctx context.Context, id string) (cli storage.Client, err error) {
+	ctx, cancel := context.WithTimeout(ctx, defaultStorageTimeout)
 	defer cancel()
 	err = c.getKey(ctx, keyID(clientPrefix, id), &cli)
 	return cli, err
 }
 
-func (c *conn) UpdateClient(id string, updater func(old storage.Client) (storage.Client, error)) error {
-	ctx, cancel := context.WithTimeout(context.Background(), defaultStorageTimeout)
+func (c *conn) UpdateClient(ctx context.Context, id string, updater func(old storage.Client) (storage.Client, error)) error {
+	ctx, cancel := context.WithTimeout(ctx, defaultStorageTimeout)
 	defer cancel()
 	return c.txnUpdate(ctx, keyID(clientPrefix, id), func(currentValue []byte) ([]byte, error) {
 		var current storage.Client
@@ -258,14 +272,14 @@ func (c *conn) UpdateClient(id string, updater func(old storage.Client) (storage
 	})
 }
 
-func (c *conn) DeleteClient(id string) error {
-	ctx, cancel := context.WithTimeout(context.Background(), defaultStorageTimeout)
+func (c *conn) DeleteClient(ctx context.Context, id string) error {
+	ctx, cancel := context.WithTimeout(ctx, defaultStorageTimeout)
 	defer cancel()
 	return c.deleteKey(ctx, keyID(clientPrefix, id))
 }
 
-func (c *conn) ListClients() (clients []storage.Client, err error) {
-	ctx, cancel := context.WithTimeout(context.Background(), defaultStorageTimeout)
+func (c *conn) ListClients(ctx context.Context) (clients []storage.Client, err error) {
+	ctx, cancel := context.WithTimeout(ctx, defaultStorageTimeout)
 	defer cancel()
 	res, err := c.db.Get(ctx, clientPrefix, clientv3.WithPrefix())
 	if err != nil {
@@ -281,21 +295,19 @@ func (c *conn) ListClients() (clients []storage.Client, err error) {
 	return clients, nil
 }
 
-func (c *conn) CreatePassword(p storage.Password) error {
-	ctx, cancel := context.WithTimeout(context.Background(), defaultStorageTimeout)
-	defer cancel()
+func (c *conn) CreatePassword(ctx context.Context, p storage.Password) error {
 	return c.txnCreate(ctx, passwordPrefix+strings.ToLower(p.Email), p)
 }
 
-func (c *conn) GetPassword(email string) (p storage.Password, err error) {
-	ctx, cancel := context.WithTimeout(context.Background(), defaultStorageTimeout)
+func (c *conn) GetPassword(ctx context.Context, email string) (p storage.Password, err error) {
+	ctx, cancel := context.WithTimeout(ctx, defaultStorageTimeout)
 	defer cancel()
 	err = c.getKey(ctx, keyEmail(passwordPrefix, email), &p)
 	return p, err
 }
 
-func (c *conn) UpdatePassword(email string, updater func(p storage.Password) (storage.Password, error)) error {
-	ctx, cancel := context.WithTimeout(context.Background(), defaultStorageTimeout)
+func (c *conn) UpdatePassword(ctx context.Context, email string, updater func(p storage.Password) (storage.Password, error)) error {
+	ctx, cancel := context.WithTimeout(ctx, defaultStorageTimeout)
 	defer cancel()
 	return c.txnUpdate(ctx, keyEmail(passwordPrefix, email), func(currentValue []byte) ([]byte, error) {
 		var current storage.Password
@@ -312,14 +324,14 @@ func (c *conn) UpdatePassword(email string, updater func(p storage.Password) (st
 	})
 }
 
-func (c *conn) DeletePassword(email string) error {
-	ctx, cancel := context.WithTimeout(context.Background(), defaultStorageTimeout)
+func (c *conn) DeletePassword(ctx context.Context, email string) error {
+	ctx, cancel := context.WithTimeout(ctx, defaultStorageTimeout)
 	defer cancel()
 	return c.deleteKey(ctx, keyEmail(passwordPrefix, email))
 }
 
-func (c *conn) ListPasswords() (passwords []storage.Password, err error) {
-	ctx, cancel := context.WithTimeout(context.Background(), defaultStorageTimeout)
+func (c *conn) ListPasswords(ctx context.Context) (passwords []storage.Password, err error) {
+	ctx, cancel := context.WithTimeout(ctx, defaultStorageTimeout)
 	defer cancel()
 	res, err := c.db.Get(ctx, passwordPrefix, clientv3.WithPrefix())
 	if err != nil {
@@ -335,14 +347,12 @@ func (c *conn) ListPasswords() (passwords []storage.Password, err error) {
 	return passwords, nil
 }
 
-func (c *conn) CreateOfflineSessions(s storage.OfflineSessions) error {
-	ctx, cancel := context.WithTimeout(context.Background(), defaultStorageTimeout)
-	defer cancel()
+func (c *conn) CreateOfflineSessions(ctx context.Context, s storage.OfflineSessions) error {
 	return c.txnCreate(ctx, keySession(s.UserID, s.ConnID), fromStorageOfflineSessions(s))
 }
 
-func (c *conn) UpdateOfflineSessions(userID string, connID string, updater func(s storage.OfflineSessions) (storage.OfflineSessions, error)) error {
-	ctx, cancel := context.WithTimeout(context.Background(), defaultStorageTimeout)
+func (c *conn) UpdateOfflineSessions(ctx context.Context, userID string, connID string, updater func(s storage.OfflineSessions) (storage.OfflineSessions, error)) error {
+	ctx, cancel := context.WithTimeout(ctx, defaultStorageTimeout)
 	defer cancel()
 	return c.txnUpdate(ctx, keySession(userID, connID), func(currentValue []byte) ([]byte, error) {
 		var current OfflineSessions
@@ -359,8 +369,8 @@ func (c *conn) UpdateOfflineSessions(userID string, connID string, updater func(
 	})
 }
 
-func (c *conn) GetOfflineSessions(userID string, connID string) (s storage.OfflineSessions, err error) {
-	ctx, cancel := context.WithTimeout(context.Background(), defaultStorageTimeout)
+func (c *conn) GetOfflineSessions(ctx context.Context, userID string, connID string) (s storage.OfflineSessions, err error) {
+	ctx, cancel := context.WithTimeout(ctx, defaultStorageTimeout)
 	defer cancel()
 	var os OfflineSessions
 	if err = c.getKey(ctx, keySession(userID, connID), &os); err != nil {
@@ -369,27 +379,132 @@ func (c *conn) GetOfflineSessions(userID string, connID string) (s storage.Offli
 	return toStorageOfflineSessions(os), nil
 }
 
-func (c *conn) DeleteOfflineSessions(userID string, connID string) error {
-	ctx, cancel := context.WithTimeout(context.Background(), defaultStorageTimeout)
+func (c *conn) DeleteOfflineSessions(ctx context.Context, userID string, connID string) error {
+	ctx, cancel := context.WithTimeout(ctx, defaultStorageTimeout)
 	defer cancel()
 	return c.deleteKey(ctx, keySession(userID, connID))
 }
 
-func (c *conn) CreateConnector(connector storage.Connector) error {
-	ctx, cancel := context.WithTimeout(context.Background(), defaultStorageTimeout)
+func (c *conn) CreateUserIdentity(ctx context.Context, u storage.UserIdentity) error {
+	return c.txnCreate(ctx, keyUserIdentity(u.UserID, u.ConnectorID), fromStorageUserIdentity(u))
+}
+
+func (c *conn) GetUserIdentity(ctx context.Context, userID, connectorID string) (u storage.UserIdentity, err error) {
+	ctx, cancel := context.WithTimeout(ctx, defaultStorageTimeout)
+	defer cancel()
+	var ui UserIdentity
+	if err = c.getKey(ctx, keyUserIdentity(userID, connectorID), &ui); err != nil {
+		return
+	}
+	return toStorageUserIdentity(ui), nil
+}
+
+func (c *conn) UpdateUserIdentity(ctx context.Context, userID, connectorID string, updater func(u storage.UserIdentity) (storage.UserIdentity, error)) error {
+	ctx, cancel := context.WithTimeout(ctx, defaultStorageTimeout)
+	defer cancel()
+	return c.txnUpdate(ctx, keyUserIdentity(userID, connectorID), func(currentValue []byte) ([]byte, error) {
+		var current UserIdentity
+		if len(currentValue) > 0 {
+			if err := json.Unmarshal(currentValue, &current); err != nil {
+				return nil, err
+			}
+		}
+		updated, err := updater(toStorageUserIdentity(current))
+		if err != nil {
+			return nil, err
+		}
+		return json.Marshal(fromStorageUserIdentity(updated))
+	})
+}
+
+func (c *conn) DeleteUserIdentity(ctx context.Context, userID, connectorID string) error {
+	ctx, cancel := context.WithTimeout(ctx, defaultStorageTimeout)
+	defer cancel()
+	return c.deleteKey(ctx, keyUserIdentity(userID, connectorID))
+}
+
+func (c *conn) ListUserIdentities(ctx context.Context) (identities []storage.UserIdentity, err error) {
+	ctx, cancel := context.WithTimeout(ctx, defaultStorageTimeout)
+	defer cancel()
+	res, err := c.db.Get(ctx, userIdentityPrefix, clientv3.WithPrefix())
+	if err != nil {
+		return identities, err
+	}
+	for _, v := range res.Kvs {
+		var ui UserIdentity
+		if err = json.Unmarshal(v.Value, &ui); err != nil {
+			return identities, err
+		}
+		identities = append(identities, toStorageUserIdentity(ui))
+	}
+	return identities, nil
+}
+
+func (c *conn) CreateAuthSession(ctx context.Context, s storage.AuthSession) error {
+	return c.txnCreate(ctx, keyAuthSession(s.ID), fromStorageAuthSession(s))
+}
+
+func (c *conn) GetAuthSession(ctx context.Context, id string) (storage.AuthSession, error) {
+	ctx, cancel := context.WithTimeout(ctx, defaultStorageTimeout)
+	defer cancel()
+	var s AuthSession
+	if err := c.getKey(ctx, keyAuthSession(id), &s); err != nil {
+		return storage.AuthSession{}, err
+	}
+	return toStorageAuthSession(s), nil
+}
+
+func (c *conn) UpdateAuthSession(ctx context.Context, id string, updater func(s storage.AuthSession) (storage.AuthSession, error)) error {
+	ctx, cancel := context.WithTimeout(ctx, defaultStorageTimeout)
+	defer cancel()
+	return c.txnUpdate(ctx, keyAuthSession(id), func(currentValue []byte) ([]byte, error) {
+		var current AuthSession
+		if len(currentValue) > 0 {
+			if err := json.Unmarshal(currentValue, &current); err != nil {
+				return nil, err
+			}
+		}
+		updated, err := updater(toStorageAuthSession(current))
+		if err != nil {
+			return nil, err
+		}
+		return json.Marshal(fromStorageAuthSession(updated))
+	})
+}
+
+func (c *conn) ListAuthSessions(ctx context.Context) (sessions []storage.AuthSession, err error) {
+	ctx, cancel := context.WithTimeout(ctx, defaultStorageTimeout)
+	defer cancel()
+
+	res, err := c.listAuthSessionsInternal(ctx)
+	if err != nil {
+		return sessions, err
+	}
+	for _, v := range res {
+		sessions = append(sessions, toStorageAuthSession(v))
+	}
+	return sessions, nil
+}
+
+func (c *conn) DeleteAuthSession(ctx context.Context, id string) error {
+	ctx, cancel := context.WithTimeout(ctx, defaultStorageTimeout)
 	defer cancel()
+	return c.deleteKey(ctx, keyAuthSession(id))
+}
+
+func (c *conn) CreateConnector(ctx context.Context, connector storage.Connector) error {
 	return c.txnCreate(ctx, keyID(connectorPrefix, connector.ID), connector)
 }
 
-func (c *conn) GetConnector(id string) (conn storage.Connector, err error) {
-	ctx, cancel := context.WithTimeout(context.Background(), defaultStorageTimeout)
+func (c *conn) GetConnector(ctx context.Context, id string) (conn storage.Connector, err error) {
+	ctx, cancel := context.WithTimeout(ctx, defaultStorageTimeout)
 	defer cancel()
 	err = c.getKey(ctx, keyID(connectorPrefix, id), &conn)
 	return conn, err
 }
 
-func (c *conn) UpdateConnector(id string, updater func(s storage.Connector) (storage.Connector, error)) error {
-	ctx, cancel := context.WithTimeout(context.Background(), defaultStorageTimeout)
+func (c *conn) UpdateConnector(ctx context.Context, id string, updater func(s storage.Connector) (storage.Connector, error)) error {
+	ctx, cancel := context.WithTimeout(ctx, defaultStorageTimeout)
 	defer cancel()
 	return c.txnUpdate(ctx, keyID(connectorPrefix, id), func(currentValue []byte) ([]byte, error) {
 		var current storage.Connector
@@ -406,14 +521,14 @@ func (c *conn) UpdateConnector(id string, updater func(s storage.Connector) (sto
 	})
 }
 
-func (c *conn) DeleteConnector(id string) error {
-	ctx, cancel := context.WithTimeout(context.Background(), defaultStorageTimeout)
+func (c *conn) DeleteConnector(ctx context.Context, id string) error {
+	ctx, cancel := context.WithTimeout(ctx, defaultStorageTimeout)
 	defer cancel()
 	return c.deleteKey(ctx, keyID(connectorPrefix, id))
 }
 
-func (c *conn) ListConnectors() (connectors []storage.Connector, err error) {
-	ctx, cancel := context.WithTimeout(context.Background(), defaultStorageTimeout)
+func (c *conn) ListConnectors(ctx context.Context) (connectors []storage.Connector, err error) {
+	ctx, cancel := context.WithTimeout(ctx, defaultStorageTimeout)
 	defer cancel()
 	res, err := c.db.Get(ctx, connectorPrefix, clientv3.WithPrefix())
 	if err != nil {
@@ -429,8 +544,8 @@ func (c *conn) ListConnectors() (connectors []storage.Connector, err error) {
 	return connectors, nil
 }
 
-func (c *conn) GetKeys() (keys storage.Keys, err error) {
-	ctx, cancel := context.WithTimeout(context.Background(), defaultStorageTimeout)
+func (c *conn) GetKeys(ctx context.Context) (keys storage.Keys, err error) {
+	ctx, cancel := context.WithTimeout(ctx, defaultStorageTimeout)
 	defer cancel()
 	res, err := c.db.Get(ctx, keysName)
 	if err != nil {
@@ -442,8 +557,8 @@ func (c *conn) GetKeys() (keys storage.Keys, err error) {
 	return keys, err
 }
 
-func (c *conn) UpdateKeys(updater func(old storage.Keys) (storage.Keys, error)) error {
-	ctx, cancel := context.WithTimeout(context.Background(), defaultStorageTimeout)
+func (c *conn) UpdateKeys(ctx context.Context, updater func(old storage.Keys) (storage.Keys, error)) error {
+	ctx, cancel := context.WithTimeout(ctx, defaultStorageTimeout)
 	defer cancel()
 	return c.txnUpdate(ctx, keysName, func(currentValue []byte) ([]byte, error) {
 		var current storage.Keys
@@ -512,6 +627,21 @@ func (c *conn) listAuthCodes(ctx context.Context) (codes []AuthCode, err error)
 	return codes, nil
 }
 
+func (c *conn) listAuthSessionsInternal(ctx context.Context) (sessions []AuthSession, err error) {
+	res, err := c.db.Get(ctx, authSessionPrefix, clientv3.WithPrefix())
+	if err != nil {
+		return sessions, err
+	}
+	for _, v := range res.Kvs {
+		var s AuthSession
+		if err = json.Unmarshal(v.Value, &s); err != nil {
+			return sessions, err
+		}
+		sessions = append(sessions, s)
+	}
+	return sessions, nil
+}
+
 func (c *conn) txnCreate(ctx context.Context, key string, value interface{}) error {
 	b, err := json.Marshal(value)
 	if err != nil {
@@ -568,17 +698,26 @@ func keySession(userID, connID string) string {
 	return offlineSessionPrefix + strings.ToLower(userID+"|"+connID)
 }
 
-func (c *conn) CreateDeviceRequest(d storage.DeviceRequest) error {
-	ctx, cancel := context.WithTimeout(context.Background(), defaultStorageTimeout)
-	defer cancel()
+func keyUserIdentity(userID, connectorID string) string {
+	return userIdentityPrefix + strings.ToLower(userID+"|"+connectorID)
+}
+
+func keyAuthSession(id string) string {
+	return authSessionPrefix + id
+}
+
+func (c *conn) CreateDeviceRequest(ctx context.Context, d storage.DeviceRequest) error {
 	return c.txnCreate(ctx, keyID(deviceRequestPrefix, d.UserCode), fromStorageDeviceRequest(d))
 }
 
-func (c *conn) GetDeviceRequest(userCode string) (r storage.DeviceRequest, err error) {
-	ctx, cancel := context.WithTimeout(context.Background(), defaultStorageTimeout)
+func (c *conn) GetDeviceRequest(ctx context.Context, userCode string) (r storage.DeviceRequest, err error) {
+	ctx, cancel := context.WithTimeout(ctx, defaultStorageTimeout)
 	defer cancel()
-	err = c.getKey(ctx, keyID(deviceRequestPrefix, userCode), &r)
-	return r, err
+	var dr DeviceRequest
+	if err = c.getKey(ctx, keyID(deviceRequestPrefix, userCode), &dr); err == nil {
+		r = toStorageDeviceRequest(dr)
+	}
+	return
 }
 
 func (c *conn) listDeviceRequests(ctx context.Context) (requests []DeviceRequest, err error) {
@@ -596,14 +735,12 @@ func (c *conn) listDeviceRequests(ctx context.Context) (requests []DeviceRequest
 	return requests, nil
 }
 
-func (c *conn) CreateDeviceToken(t storage.DeviceToken) error {
-	ctx, cancel := context.WithTimeout(context.Background(), defaultStorageTimeout)
-	defer cancel()
+func (c *conn) CreateDeviceToken(ctx context.Context, t storage.DeviceToken) error {
 	return c.txnCreate(ctx, keyID(deviceTokenPrefix, t.DeviceCode), fromStorageDeviceToken(t))
 }
 
-func (c *conn) GetDeviceToken(deviceCode string) (t storage.DeviceToken, err error) {
-	ctx, cancel := context.WithTimeout(context.Background(), defaultStorageTimeout)
+func (c *conn) GetDeviceToken(ctx context.Context, deviceCode string) (t storage.DeviceToken, err error) {
+	ctx, cancel := context.WithTimeout(ctx, defaultStorageTimeout)
 	defer cancel()
 	var dt DeviceToken
 	if err = c.getKey(ctx, keyID(deviceTokenPrefix, deviceCode), &dt); err == nil {
@@ -627,8 +764,8 @@ func (c *conn) listDeviceTokens(ctx context.Context) (deviceTokens []DeviceToken
 	return deviceTokens, nil
 }
 
-func (c *conn) UpdateDeviceToken(deviceCode string, updater func(old storage.DeviceToken) (storage.DeviceToken, error)) error {
-	ctx, cancel := context.WithTimeout(context.Background(), defaultStorageTimeout)
+func (c *conn) UpdateDeviceToken(ctx context.Context, deviceCode string, updater func(old storage.DeviceToken) (storage.DeviceToken, error)) error {
+	ctx, cancel := context.WithTimeout(ctx, defaultStorageTimeout)
 	defer cancel()
 	return c.txnUpdate(ctx, keyID(deviceTokenPrefix, deviceCode), func(currentValue []byte) ([]byte, error) {
 		var current DeviceToken
diff --git a/storage/etcd/etcd_test.go b/storage/etcd/etcd_test.go
index 8a9af5c9d5..55501b49b1 100644
--- a/storage/etcd/etcd_test.go
+++ b/storage/etcd/etcd_test.go
@@ -3,13 +3,13 @@ package etcd
 import (
 	"context"
 	"fmt"
+	"log/slog"
 	"os"
 	"runtime"
 	"strings"
 	"testing"
 	"time"
 
-	"github.com/sirupsen/logrus"
 	clientv3 "go.etcd.io/etcd/client/v3"
 
 	"github.com/dexidp/dex/storage"
@@ -55,12 +55,6 @@ func cleanDB(c *conn) error {
 	return nil
 }
 
-var logger = &logrus.Logger{
-	Out:       os.Stderr,
-	Formatter: &logrus.TextFormatter{DisableColors: true},
-	Level:     logrus.DebugLevel,
-}
-
 func TestEtcd(t *testing.T) {
 	testEtcdEnv := "DEX_ETCD_ENDPOINTS"
 	endpointsStr := os.Getenv(testEtcdEnv)
@@ -70,10 +64,11 @@ func TestEtcd(t *testing.T) {
 	}
 	endpoints := strings.Split(endpointsStr, ",")
 
-	newStorage := func() storage.Storage {
+	newStorage := func(t *testing.T) storage.Storage {
 		s := &Etcd{
 			Endpoints: endpoints,
 		}
+		logger := slog.New(slog.NewTextHandler(t.Output(), &slog.HandlerOptions{Level: slog.LevelDebug}))
 		conn, err := s.open(logger)
 		if err != nil {
 			fmt.Fprintln(os.Stdout, err)
@@ -94,4 +89,11 @@ func TestEtcd(t *testing.T) {
 	withTimeout(time.Minute*1, func() {
 		conformance.RunTransactionTests(t, newStorage)
 	})
+
+	// TODO(nabokihms): etcd uses compare-and-swap (txnUpdate) for UpdateRefreshToken,
+	// but does not retry on CAS conflicts ("concurrent conflicting update happened").
+	// Under high contention virtually all updates fail — only the first writer succeeds.
+	// withTimeout(time.Minute*1, func() {
+	// 	  conformance.RunConcurrencyTests(t, newStorage)
+	// })
 }
diff --git a/storage/etcd/types.go b/storage/etcd/types.go
index 1174a2d201..009ec2885a 100644
--- a/storage/etcd/types.go
+++ b/storage/etcd/types.go
@@ -3,7 +3,7 @@ package etcd
 import (
 	"time"
 
-	jose "gopkg.in/square/go-jose.v2"
+	"github.com/go-jose/go-jose/v4"
 
 	"github.com/dexidp/dex/storage"
 )
@@ -24,6 +24,9 @@ type AuthCode struct {
 
 	CodeChallenge       string `json:"code_challenge,omitempty"`
 	CodeChallengeMethod string `json:"code_challenge_method,omitempty"`
+
+	AuthTime  time.Time `json:"auth_time"`
+	SessionID string    `json:"session_id,omitempty"`
 }
 
 func toStorageAuthCode(a AuthCode) storage.AuthCode {
@@ -41,6 +44,8 @@ func toStorageAuthCode(a AuthCode) storage.AuthCode {
 			CodeChallenge:       a.CodeChallenge,
 			CodeChallengeMethod: a.CodeChallengeMethod,
 		},
+		AuthTime:  a.AuthTime,
+		SessionID: a.SessionID,
 	}
 }
 
@@ -57,6 +62,8 @@ func fromStorageAuthCode(a storage.AuthCode) AuthCode {
 		Expiry:              a.Expiry,
 		CodeChallenge:       a.PKCE.CodeChallenge,
 		CodeChallengeMethod: a.PKCE.CodeChallengeMethod,
+		AuthTime:            a.AuthTime,
+		SessionID:           a.SessionID,
 	}
 }
 
@@ -84,6 +91,16 @@ type AuthRequest struct {
 
 	CodeChallenge       string `json:"code_challenge,omitempty"`
 	CodeChallengeMethod string `json:"code_challenge_method,omitempty"`
+
+	HMACKey []byte `json:"hmac_key"`
+
+	MFAValidated bool `json:"mfa_validated"`
+
+	WebAuthnSessionData []byte `json:"webauthn_session_data,omitempty"`
+
+	Prompt   string    `json:"prompt,omitempty"`
+	MaxAge   int       `json:"max_age"`
+	AuthTime time.Time `json:"auth_time"`
 }
 
 func fromStorageAuthRequest(a storage.AuthRequest) AuthRequest {
@@ -103,6 +120,12 @@ func fromStorageAuthRequest(a storage.AuthRequest) AuthRequest {
 		ConnectorData:       a.ConnectorData,
 		CodeChallenge:       a.PKCE.CodeChallenge,
 		CodeChallengeMethod: a.PKCE.CodeChallengeMethod,
+		HMACKey:             a.HMACKey,
+		MFAValidated:        a.MFAValidated,
+		WebAuthnSessionData: a.WebAuthnSessionData,
+		Prompt:              a.Prompt,
+		MaxAge:              a.MaxAge,
+		AuthTime:            a.AuthTime,
 	}
 }
 
@@ -125,6 +148,12 @@ func toStorageAuthRequest(a AuthRequest) storage.AuthRequest {
 			CodeChallenge:       a.CodeChallenge,
 			CodeChallengeMethod: a.CodeChallengeMethod,
 		},
+		HMACKey:             a.HMACKey,
+		MFAValidated:        a.MFAValidated,
+		WebAuthnSessionData: a.WebAuthnSessionData,
+		Prompt:              a.Prompt,
+		MaxAge:              a.MaxAge,
+		AuthTime:            a.AuthTime,
 	}
 }
 
@@ -252,6 +281,106 @@ func toStorageOfflineSessions(o OfflineSessions) storage.OfflineSessions {
 	return s
 }
 
+// UserIdentity is a mirrored struct from storage with JSON struct tags
+type UserIdentity struct {
+	UserID              string                                  `json:"user_id,omitempty"`
+	ConnectorID         string                                  `json:"connector_id,omitempty"`
+	Claims              Claims                                  `json:"claims,omitempty"`
+	Consents            map[string][]string                     `json:"consents,omitempty"`
+	MFASecrets          map[string]*storage.MFASecret           `json:"mfa_secrets,omitempty"`
+	WebAuthnCredentials map[string][]storage.WebAuthnCredential `json:"webauthn_credentials,omitempty"`
+	CreatedAt           time.Time                               `json:"created_at"`
+	LastLogin           time.Time                               `json:"last_login"`
+	BlockedUntil        time.Time                               `json:"blocked_until"`
+}
+
+func fromStorageUserIdentity(u storage.UserIdentity) UserIdentity {
+	return UserIdentity{
+		UserID:              u.UserID,
+		ConnectorID:         u.ConnectorID,
+		Claims:              fromStorageClaims(u.Claims),
+		Consents:            u.Consents,
+		MFASecrets:          u.MFASecrets,
+		WebAuthnCredentials: u.WebAuthnCredentials,
+		CreatedAt:           u.CreatedAt,
+		LastLogin:           u.LastLogin,
+		BlockedUntil:        u.BlockedUntil,
+	}
+}
+
+func toStorageUserIdentity(u UserIdentity) storage.UserIdentity {
+	s := storage.UserIdentity{
+		UserID:              u.UserID,
+		ConnectorID:         u.ConnectorID,
+		Claims:              toStorageClaims(u.Claims),
+		Consents:            u.Consents,
+		MFASecrets:          u.MFASecrets,
+		WebAuthnCredentials: u.WebAuthnCredentials,
+		CreatedAt:           u.CreatedAt,
+		LastLogin:           u.LastLogin,
+		BlockedUntil:        u.BlockedUntil,
+	}
+	if s.Consents == nil {
+		// Server code assumes this will be non-nil.
+		s.Consents = make(map[string][]string)
+	}
+	return s
+}
+
+// AuthSession is a mirrored struct from storage with JSON struct tags.
+type AuthSession struct {
+	ID             string                              `json:"id"`
+	Secret         string                              `json:"secret,omitempty"`
+	UserID         string                              `json:"user_id,omitempty"`
+	ConnectorID    string                              `json:"connector_id,omitempty"`
+	ClientStates   map[string]*storage.ClientAuthState `json:"client_states,omitempty"`
+	CreatedAt      time.Time                           `json:"created_at"`
+	LastActivity   time.Time                           `json:"last_activity"`
+	IPAddress      string                              `json:"ip_address,omitempty"`
+	UserAgent      string                              `json:"user_agent,omitempty"`
+	AbsoluteExpiry time.Time                           `json:"absolute_expiry"`
+	IdleExpiry     time.Time                           `json:"idle_expiry"`
+	LogoutState    *storage.LogoutState                `json:"logout_state,omitempty"`
+}
+
+func fromStorageAuthSession(s storage.AuthSession) AuthSession {
+	return AuthSession{
+		ID:             s.ID,
+		Secret:         s.Secret,
+		UserID:         s.UserID,
+		ConnectorID:    s.ConnectorID,
+		ClientStates:   s.ClientStates,
+		CreatedAt:      s.CreatedAt,
+		LastActivity:   s.LastActivity,
+		IPAddress:      s.IPAddress,
+		UserAgent:      s.UserAgent,
+		AbsoluteExpiry: s.AbsoluteExpiry,
+		IdleExpiry:     s.IdleExpiry,
+		LogoutState:    s.LogoutState,
+	}
+}
+
+func toStorageAuthSession(s AuthSession) storage.AuthSession {
+	result := storage.AuthSession{
+		ID:             s.ID,
+		Secret:         s.Secret,
+		UserID:         s.UserID,
+		ConnectorID:    s.ConnectorID,
+		ClientStates:   s.ClientStates,
+		CreatedAt:      s.CreatedAt,
+		LastActivity:   s.LastActivity,
+		IPAddress:      s.IPAddress,
+		UserAgent:      s.UserAgent,
+		AbsoluteExpiry: s.AbsoluteExpiry,
+		IdleExpiry:     s.IdleExpiry,
+		LogoutState:    s.LogoutState,
+	}
+	if result.ClientStates == nil {
+		result.ClientStates = make(map[string]*storage.ClientAuthState)
+	}
+	return result
+}
+
 // DeviceRequest is a mirrored struct from storage with JSON struct tags
 type DeviceRequest struct {
 	UserCode     string    `json:"user_code"`
@@ -273,6 +402,17 @@ func fromStorageDeviceRequest(d storage.DeviceRequest) DeviceRequest {
 	}
 }
 
+func toStorageDeviceRequest(d DeviceRequest) storage.DeviceRequest {
+	return storage.DeviceRequest{
+		UserCode:     d.UserCode,
+		DeviceCode:   d.DeviceCode,
+		ClientID:     d.ClientID,
+		ClientSecret: d.ClientSecret,
+		Scopes:       d.Scopes,
+		Expiry:       d.Expiry,
+	}
+}
+
 // DeviceToken is a mirrored struct from storage with JSON struct tags
 type DeviceToken struct {
 	DeviceCode          string    `json:"device_code"`
diff --git a/storage/health.go b/storage/health.go
index 8a2f5a3d61..fe75a2da74 100644
--- a/storage/health.go
+++ b/storage/health.go
@@ -2,26 +2,28 @@ package storage
 
 import (
 	"context"
+	"crypto"
 	"fmt"
 	"time"
 )
 
 // NewCustomHealthCheckFunc returns a new health check function.
 func NewCustomHealthCheckFunc(s Storage, now func() time.Time) func(context.Context) (details interface{}, err error) {
-	return func(_ context.Context) (details interface{}, err error) {
+	return func(ctx context.Context) (details interface{}, err error) {
 		a := AuthRequest{
 			ID:       NewID(),
 			ClientID: NewID(),
 
 			// Set a short expiry so if the delete fails this will be cleaned up quickly by garbage collection.
-			Expiry: now().Add(time.Minute),
+			Expiry:  now().Add(time.Minute),
+			HMACKey: NewHMACKey(crypto.SHA256),
 		}
 
-		if err := s.CreateAuthRequest(a); err != nil {
+		if err := s.CreateAuthRequest(ctx, a); err != nil {
 			return nil, fmt.Errorf("create auth request: %v", err)
 		}
 
-		if err := s.DeleteAuthRequest(a.ID); err != nil {
+		if err := s.DeleteAuthRequest(ctx, a.ID); err != nil {
 			return nil, fmt.Errorf("delete auth request: %v", err)
 		}
 
diff --git a/storage/kubernetes/client.go b/storage/kubernetes/client.go
index 57f21e00cd..86d88cf774 100644
--- a/storage/kubernetes/client.go
+++ b/storage/kubernetes/client.go
@@ -13,11 +13,13 @@ import (
 	"hash"
 	"hash/fnv"
 	"io"
+	"log/slog"
 	"net"
 	"net/http"
 	"net/url"
 	"os"
 	"path"
+	"regexp"
 	"strconv"
 	"strings"
 	"time"
@@ -26,16 +28,26 @@ import (
 	"github.com/ghodss/yaml"
 	"golang.org/x/net/http2"
 
-	"github.com/dexidp/dex/pkg/log"
 	"github.com/dexidp/dex/storage"
 	"github.com/dexidp/dex/storage/kubernetes/k8sapi"
 )
 
+const (
+	serviceAccountPath          = "/var/run/secrets/kubernetes.io/serviceaccount/"
+	serviceAccountTokenPath     = serviceAccountPath + "token"
+	serviceAccountCAPath        = serviceAccountPath + "ca.crt"
+	serviceAccountNamespacePath = serviceAccountPath + "namespace"
+
+	kubernetesServiceHostENV  = "KUBERNETES_SERVICE_HOST"
+	kubernetesServicePortENV  = "KUBERNETES_SERVICE_PORT"
+	kubernetesPodNamespaceENV = "KUBERNETES_POD_NAMESPACE"
+)
+
 type client struct {
 	client    *http.Client
 	baseURL   string
 	namespace string
-	logger    log.Logger
+	logger    *slog.Logger
 
 	// Hash function to map IDs (which could span a large range) to Kubernetes names.
 	// While this is not currently upgradable, it could be in the future.
@@ -53,6 +65,11 @@ type client struct {
 	// storage opening.
 	crdAPIVersion string
 
+	// CRD handling behavior controls how missing Custom Resource Definitions are handled:
+	// - "ensure": Attempt to create all missing CRDs. Fails if any CRD creation fails. (default)
+	// - "check": Fail if any CRDs are missing, with error "storage is not initialized, CRDs are not created"
+	crdHandling string
+
 	// This is called once the client's Close method is called to signal goroutines,
 	// such as the one creating third party resources, to stop.
 	cancel context.CancelFunc
@@ -83,14 +100,27 @@ func offlineTokenName(userID string, connID string, h func() hash.Hash) string {
 	return strings.TrimRight(encoding.EncodeToString(hash.Sum(nil)), "=")
 }
 
+// https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#dns-subdomain-names
+const kubeResourceMaxLen = 253
+
+var kubeResourceNameRegex = regexp.MustCompile(`^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$`)
+
 func (cli *client) urlForWithParams(
 	apiVersion, namespace, resource, name string, params url.Values,
-) string {
+) (string, error) {
 	basePath := "apis/"
 	if apiVersion == "v1" {
 		basePath = "api/"
 	}
 
+	if name != "" && (len(name) > kubeResourceMaxLen || !kubeResourceNameRegex.MatchString(name)) {
+		// The actual name can be found in auth request or auth code objects and equals to the state value
+		return "", fmt.Errorf(
+			"invalid kubernetes resource name: must match the pattern %s and be no longer than %d characters",
+			kubeResourceNameRegex.String(),
+			kubeResourceMaxLen)
+	}
+
 	var p string
 	if namespace != "" {
 		p = path.Join(basePath, apiVersion, "namespaces", namespace, resource, name)
@@ -105,13 +135,13 @@ func (cli *client) urlForWithParams(
 	}
 
 	if strings.HasSuffix(cli.baseURL, "/") {
-		return cli.baseURL + p + paramsSuffix
+		return cli.baseURL + p + paramsSuffix, nil
 	}
 
-	return cli.baseURL + "/" + p + paramsSuffix
+	return cli.baseURL + "/" + p + paramsSuffix, nil
 }
 
-func (cli *client) urlFor(apiVersion, namespace, resource, name string) string {
+func (cli *client) urlFor(apiVersion, namespace, resource, name string) (string, error) {
 	return cli.urlForWithParams(apiVersion, namespace, resource, name, url.Values{})
 }
 
@@ -191,13 +221,20 @@ func (cli *client) getURL(url string, v interface{}) error {
 }
 
 func (cli *client) getResource(apiVersion, namespace, resource, name string, v interface{}) error {
-	return cli.getURL(cli.urlFor(apiVersion, namespace, resource, name), v)
+	u, err := cli.urlFor(apiVersion, namespace, resource, name)
+	if err != nil {
+		return err
+	}
+	return cli.getURL(u, v)
 }
 
-func (cli *client) listN(resource string, v interface{}, n int) error {
+func (cli *client) listN(resource string, v interface{}, n int) error { //nolint:unparam // In practice, n is the gcResultLimit constant.
 	params := url.Values{}
 	params.Add("limit", fmt.Sprintf("%d", n))
-	u := cli.urlForWithParams(cli.apiVersion, cli.namespace, resource, "", params)
+	u, err := cli.urlForWithParams(cli.apiVersion, cli.namespace, resource, "", params)
+	if err != nil {
+		return err
+	}
 	return cli.getURL(u, v)
 }
 
@@ -215,7 +252,10 @@ func (cli *client) postResource(apiVersion, namespace, resource string, v interf
 		return fmt.Errorf("marshal object: %v", err)
 	}
 
-	url := cli.urlFor(apiVersion, namespace, resource, "")
+	url, err := cli.urlFor(apiVersion, namespace, resource, "")
+	if err != nil {
+		return err
+	}
 	resp, err := cli.client.Post(url, "application/json", bytes.NewReader(body))
 	if err != nil {
 		return err
@@ -244,7 +284,7 @@ func (cli *client) detectKubernetesVersion() error {
 
 	clusterVersion, err := semver.NewVersion(version.GitVersion)
 	if err != nil {
-		cli.logger.Warnf("cannot detect Kubernetes version (%s): %v", clusterVersion, err)
+		cli.logger.Warn("cannot detect Kubernetes version", "version", clusterVersion, "err", err)
 		return nil
 	}
 
@@ -256,7 +296,10 @@ func (cli *client) detectKubernetesVersion() error {
 }
 
 func (cli *client) delete(resource, name string) error {
-	url := cli.urlFor(cli.apiVersion, cli.namespace, resource, name)
+	url, err := cli.urlFor(cli.apiVersion, cli.namespace, resource, name)
+	if err != nil {
+		return err
+	}
 	req, err := http.NewRequest("DELETE", url, nil)
 	if err != nil {
 		return fmt.Errorf("create delete request: %v", err)
@@ -295,7 +338,11 @@ func (cli *client) put(resource, name string, v interface{}) error {
 		return fmt.Errorf("marshal object: %v", err)
 	}
 
-	url := cli.urlFor(cli.apiVersion, cli.namespace, resource, name)
+	url, err := cli.urlFor(cli.apiVersion, cli.namespace, resource, name)
+	if err != nil {
+		return err
+	}
+
 	req, err := http.NewRequest("PUT", url, bytes.NewReader(body))
 	if err != nil {
 		return fmt.Errorf("create patch request: %v", err)
@@ -327,7 +374,7 @@ func defaultTLSConfig() *tls.Config {
 	}
 }
 
-func newClient(cluster k8sapi.Cluster, user k8sapi.AuthInfo, namespace string, logger log.Logger, inCluster bool) (*client, error) {
+func newClient(cluster k8sapi.Cluster, user k8sapi.AuthInfo, namespace string, logger *slog.Logger, inCluster bool, crdHandling string) (*client, error) {
 	tlsConfig := defaultTLSConfig()
 	data := func(b string, file string) ([]byte, error) {
 		if b != "" {
@@ -387,7 +434,7 @@ func newClient(cluster k8sapi.Cluster, user k8sapi.AuthInfo, namespace string, l
 
 	apiVersion := "dex.coreos.com/v1"
 
-	logger.Infof("kubernetes client apiVersion = %s", apiVersion)
+	logger.Info("kubernetes client", "api_version", apiVersion)
 	return &client{
 		client: &http.Client{
 			Transport: t,
@@ -398,6 +445,7 @@ func newClient(cluster k8sapi.Cluster, user k8sapi.AuthInfo, namespace string, l
 		namespace:     namespace,
 		apiVersion:    apiVersion,
 		crdAPIVersion: crdAPIVersion,
+		crdHandling:   crdHandling,
 		logger:        logger,
 	}, nil
 }
@@ -477,33 +525,27 @@ func getInClusterConfigNamespace(token, namespaceENV, namespacePath string) (str
 	return "", fmt.Errorf("%v: trying to get namespace from file: %v", err, fileErr)
 }
 
-func inClusterConfig() (k8sapi.Cluster, k8sapi.AuthInfo, string, error) {
-	const (
-		serviceAccountPath          = "/var/run/secrets/kubernetes.io/serviceaccount/"
-		serviceAccountTokenPath     = serviceAccountPath + "token"
-		serviceAccountCAPath        = serviceAccountPath + "ca.crt"
-		serviceAccountNamespacePath = serviceAccountPath + "namespace"
-
-		kubernetesServiceHostENV  = "KUBERNETES_SERVICE_HOST"
-		kubernetesServicePortENV  = "KUBERNETES_SERVICE_PORT"
-		kubernetesPodNamespaceENV = "KUBERNETES_POD_NAMESPACE"
-	)
-
-	host, port := os.Getenv(kubernetesServiceHostENV), os.Getenv(kubernetesServicePortENV)
+func getInClusterConnectOptions(host, port string) (k8sapi.Cluster, error) {
 	if len(host) == 0 || len(port) == 0 {
-		return k8sapi.Cluster{}, k8sapi.AuthInfo{}, "", fmt.Errorf(
+		return k8sapi.Cluster{}, fmt.Errorf(
 			"unable to load in-cluster configuration, %s and %s must be defined",
 			kubernetesServiceHostENV,
 			kubernetesServicePortENV,
 		)
 	}
-	// we need to wrap IPv6 addresses in square brackets
-	// IPv4 also works with square brackets
-	host = "[" + host + "]"
+
 	cluster := k8sapi.Cluster{
-		Server:               "https://" + host + ":" + port,
+		Server:               "https://" + net.JoinHostPort(host, port),
 		CertificateAuthority: serviceAccountCAPath,
 	}
+	return cluster, nil
+}
+
+func inClusterConfig() (k8sapi.Cluster, k8sapi.AuthInfo, string, error) {
+	cluster, err := getInClusterConnectOptions(os.Getenv(kubernetesServiceHostENV), os.Getenv(kubernetesServicePortENV))
+	if err != nil {
+		return cluster, k8sapi.AuthInfo{}, "", err
+	}
 
 	token, err := os.ReadFile(serviceAccountTokenPath)
 	if err != nil {
diff --git a/storage/kubernetes/client_test.go b/storage/kubernetes/client_test.go
index cfd04857b6..6375685ee9 100644
--- a/storage/kubernetes/client_test.go
+++ b/storage/kubernetes/client_test.go
@@ -3,6 +3,7 @@ package kubernetes
 import (
 	"hash"
 	"hash/fnv"
+	"log/slog"
 	"net/http"
 	"os"
 	"path/filepath"
@@ -10,7 +11,7 @@ import (
 	"testing"
 	"time"
 
-	"github.com/sirupsen/logrus"
+	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
 	"github.com/dexidp/dex/storage/kubernetes/k8sapi"
@@ -52,11 +53,7 @@ func TestOfflineTokenName(t *testing.T) {
 }
 
 func TestInClusterTransport(t *testing.T) {
-	logger := &logrus.Logger{
-		Out:       os.Stderr,
-		Formatter: &logrus.TextFormatter{DisableColors: true},
-		Level:     logrus.DebugLevel,
-	}
+	logger := slog.New(slog.DiscardHandler)
 
 	user := k8sapi.AuthInfo{Token: "abc"}
 	cli, err := newClient(
@@ -65,6 +62,7 @@ func TestInClusterTransport(t *testing.T) {
 		"test",
 		logger,
 		true,
+		"",
 	)
 	require.NoError(t, err)
 
@@ -220,6 +218,63 @@ func TestGetClusterConfigNamespace(t *testing.T) {
 	}
 }
 
+func TestGetInClusterConnectOptions(t *testing.T) {
+	type testCase struct {
+		name        string
+		host        string
+		port        string
+		expectedURL string
+		expectError bool
+	}
+
+	testCases := []testCase{
+		{
+			name:        "valid IPv4",
+			host:        "10.1.1.1",
+			port:        "443",
+			expectedURL: "https://10.1.1.1:443",
+		},
+		{
+			name:        "valid IPv6",
+			host:        "fd00::1",
+			port:        "8443",
+			expectedURL: "https://[fd00::1]:8443",
+		},
+		{
+			name:        "valid DNS name",
+			host:        "kubernetes.default.svc",
+			port:        "443",
+			expectedURL: "https://kubernetes.default.svc:443",
+		},
+		{
+			name:        "empty host",
+			host:        "",
+			port:        "443",
+			expectError: true,
+		},
+		{
+			name:        "empty port",
+			host:        "127.0.0.1",
+			port:        "",
+			expectError: true,
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			cluster, err := getInClusterConnectOptions(tc.host, tc.port)
+
+			if tc.expectError {
+				assert.Error(t, err)
+				return
+			}
+			require.NoError(t, err)
+			assert.Equal(t, tc.expectedURL, cluster.Server)
+			assert.Equal(t, "/var/run/secrets/kubernetes.io/serviceaccount/ca.crt", cluster.CertificateAuthority)
+		})
+	}
+}
+
 const serviceAccountToken = "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJrdWJlcm5ldGVzL3NlcnZpY2VhY2NvdW50Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9uYW1lc3BhY2UiOiJkZXgtdGVzdC1uYW1lc3BhY2UiLCJrdWJlcm5ldGVzLmlvL3NlcnZpY2VhY2NvdW50L3NlY3JldC5uYW1lIjoiZG90aGVyb2JvdC1zZWNyZXQiLCJrdWJlcm5ldGVzLmlvL3NlcnZpY2VhY2NvdW50L3NlcnZpY2UtYWNjb3VudC5uYW1lIjoiZG90aGVyb2JvdCIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VydmljZS1hY2NvdW50LnVpZCI6IjQyYjJhOTRmLTk4MjAtMTFlNi1iZDc0LTJlZmQzOGYxMjYxYyIsInN1YiI6InN5c3RlbTpzZXJ2aWNlYWNjb3VudDpkZXgtdGVzdC1uYW1lc3BhY2U6ZG90aGVyb2JvdCJ9.KViBpPwCiBwxDvAjYUUXoVvLVwqV011aLlYQpNtX12Bh8M-QAFch-3RWlo_SR00bcdFg_nZo9JKACYlF_jHMEsf__PaYms9r7vEaSg0jPfkqnL2WXZktzQRyLBr0n-bxeUrbwIWsKOAC0DfFB5nM8XoXljRmq8yAx8BAdmQp7MIFb4EOV9nYthhua6pjzYyaFSiDiYTjw7HtXOvoL8oepodJ3-37pUKS8vdBvnvUoqC4M1YAhkO5L36JF6KV_RfmG8GPEdNQfXotHcsR-3jKi1n8S5l7Xd-rhrGOhSGQizH3dORzo9GvBAhYeqbq1O-NLzm2EQUiMQayIUx7o4g3Kw"
 
 // The following program was used to generate the example token. Since we don't want to
diff --git a/storage/kubernetes/lock.go b/storage/kubernetes/lock.go
new file mode 100644
index 0000000000..092f6d0e31
--- /dev/null
+++ b/storage/kubernetes/lock.go
@@ -0,0 +1,147 @@
+package kubernetes
+
+import (
+	"fmt"
+	"time"
+)
+
+const (
+	lockAnnotation = "dexidp.com/resource-lock"
+	lockTimeFormat = time.RFC3339
+)
+
+var (
+	lockTimeout     = 10 * time.Second
+	lockCheckPeriod = 100 * time.Millisecond
+)
+
+// refreshTokenLock is an implementation of annotation-based optimistic locking.
+//
+// Refresh token contains data to refresh identity in external authentication system.
+// There is a requirement that refresh should be called only once because of several reasons:
+//   - Some of OIDC providers could use the refresh token rotation feature which requires calling refresh only once.
+//   - Providers can limit the rate of requests to the token endpoint, which will lead to the error
+//     in case of many concurrent requests.
+//
+// The lock uses a Kubernetes annotation on the refresh token resource as a mutex.
+// Only one goroutine can hold the lock at a time; others poll until the annotation
+// is removed (unlocked) or expires (broken). The Kubernetes resourceVersion on put
+// acts as compare-and-swap: if two goroutines race to set the annotation, only one
+// succeeds and the other gets a 409 Conflict.
+type refreshTokenLock struct {
+	cli *client
+	// waitingState tracks whether this lock instance has lost a compare-and-swap race
+	// and is now polling for the lock to be released. Used by Unlock to skip the
+	// annotation removal — only the goroutine that successfully wrote the annotation
+	// should remove it.
+	waitingState bool
+}
+
+func newRefreshTokenLock(cli *client) *refreshTokenLock {
+	return &refreshTokenLock{cli: cli}
+}
+
+// Lock polls until the lock annotation can be set on the refresh token resource.
+// Returns nil when the lock is acquired, or an error on timeout (200 attempts × 100ms).
+func (l *refreshTokenLock) Lock(id string) error {
+	for i := 0; i <= 200; i++ {
+		ok, err := l.setLockAnnotation(id)
+		if err != nil {
+			return err
+		}
+		if !ok {
+			return nil
+		}
+		time.Sleep(lockCheckPeriod)
+	}
+	return fmt.Errorf("timeout waiting for refresh token %s lock", id)
+}
+
+// Unlock removes the lock annotation from the refresh token resource.
+// Only the holder of the lock (waitingState == false) performs the removal.
+func (l *refreshTokenLock) Unlock(id string) {
+	if l.waitingState {
+		// This goroutine never successfully wrote the annotation, so there's
+		// nothing to remove. Another goroutine holds (or held) the lock.
+		return
+	}
+
+	r, err := l.cli.getRefreshToken(id)
+	if err != nil {
+		l.cli.logger.Debug("failed to get resource to release lock for refresh token", "token_id", id, "err", err)
+		return
+	}
+
+	r.Annotations = nil
+	err = l.cli.put(resourceRefreshToken, r.ObjectMeta.Name, r)
+	if err != nil {
+		l.cli.logger.Debug("failed to release lock for refresh token", "token_id", id, "err", err)
+	}
+}
+
+// setLockAnnotation attempts to acquire the lock by writing an annotation with
+// an expiration timestamp. Returns (true, nil) when the caller should keep waiting,
+// (false, nil) when the lock is acquired, or (false, err) on a non-retriable error.
+//
+// The locking protocol relies on Kubernetes optimistic concurrency: every put
+// includes the resource's current resourceVersion, so concurrent writes to the
+// same object result in a 409 Conflict for all but one writer.
+func (l *refreshTokenLock) setLockAnnotation(id string) (bool, error) {
+	r, err := l.cli.getRefreshToken(id)
+	if err != nil {
+		return false, err
+	}
+
+	currentTime := time.Now()
+	lockData := map[string]string{
+		lockAnnotation: currentTime.Add(lockTimeout).Format(lockTimeFormat),
+	}
+
+	val, ok := r.Annotations[lockAnnotation]
+	if !ok {
+		// No annotation means the lock is free. Every goroutine — whether it's
+		// a first-time caller or was previously waiting — must compete by writing
+		// the annotation. The put uses the current resourceVersion, so only one
+		// writer succeeds; the rest get a 409 Conflict and go back to polling.
+		r.Annotations = lockData
+		err := l.cli.put(resourceRefreshToken, r.ObjectMeta.Name, r)
+		if err == nil {
+			l.waitingState = false
+			return false, nil
+		}
+
+		if isKubernetesAPIConflictError(err) {
+			l.waitingState = true
+			return true, nil
+		}
+		return false, err
+	}
+
+	until, err := time.Parse(lockTimeFormat, val)
+	if err != nil {
+		return false, fmt.Errorf("lock annotation value is malformed: %v", err)
+	}
+
+	if !currentTime.After(until) {
+		// Lock is held by another goroutine and has not expired yet — keep polling.
+		l.waitingState = true
+		return true, nil
+	}
+
+	// Lock has expired (holder crashed or is too slow). Attempt to break it by
+	// overwriting the annotation with a new expiration. Again, only one writer
+	// can win the compare-and-swap race.
+	r.Annotations = lockData
+
+	err = l.cli.put(resourceRefreshToken, r.ObjectMeta.Name, r)
+	if err == nil {
+		return false, nil
+	}
+
+	l.cli.logger.Debug("break lock annotation", "error", err)
+	if isKubernetesAPIConflictError(err) {
+		l.waitingState = true
+		return true, nil
+	}
+	return false, err
+}
diff --git a/storage/kubernetes/storage.go b/storage/kubernetes/storage.go
index 033d3e2356..3f860bd831 100644
--- a/storage/kubernetes/storage.go
+++ b/storage/kubernetes/storage.go
@@ -4,12 +4,12 @@ import (
 	"context"
 	"errors"
 	"fmt"
+	"log/slog"
 	"math/rand"
 	"net/http"
 	"strings"
 	"time"
 
-	"github.com/dexidp/dex/pkg/log"
 	"github.com/dexidp/dex/storage"
 	"github.com/dexidp/dex/storage/kubernetes/k8sapi"
 )
@@ -25,6 +25,8 @@ const (
 	kindConnector       = "Connector"
 	kindDeviceRequest   = "DeviceRequest"
 	kindDeviceToken     = "DeviceToken"
+	kindUserIdentity    = "UserIdentity"
+	kindAuthSession     = "AuthSession"
 )
 
 const (
@@ -38,8 +40,17 @@ const (
 	resourceConnector       = "connectors"
 	resourceDeviceRequest   = "devicerequests"
 	resourceDeviceToken     = "devicetokens"
+	resourceUserIdentity    = "useridentities"
+	resourceAuthSession     = "authsessions"
 )
 
+const (
+	crdHandlingEnsure = "ensure"
+	crdHandlingCheck  = "check"
+)
+
+var _ storage.Storage = (*client)(nil)
+
 const (
 	gcResultLimit = 500
 )
@@ -48,15 +59,16 @@ const (
 type Config struct {
 	InCluster      bool   `json:"inCluster"`
 	KubeConfigFile string `json:"kubeConfigFile"`
+	// CRDHandling controls how the storage handles Custom Resource Definitions (CRDs).
+	// Supported values:
+	// - "ensure": Attempt to create all missing CRDs. If any CRD creation fails, initialization fails. (default)
+	// - "check": Fail immediately if any CRDs are missing with message "storage is not initialized, CRDs are not created"
+	CRDHandling string `json:"crdHandling"`
 }
 
 // Open returns a storage using Kubernetes third party resource.
-func (c *Config) Open(logger log.Logger) (storage.Storage, error) {
-	cli, err := c.open(logger, false)
-	if err != nil {
-		return nil, err
-	}
-	return cli, nil
+func (c *Config) Open(logger *slog.Logger) (storage.Storage, error) {
+	return c.open(logger, false)
 }
 
 // open returns a kubernetes client, initializing the third party resources used
@@ -64,7 +76,10 @@ func (c *Config) Open(logger log.Logger) (storage.Storage, error) {
 //
 // waitForResources controls if errors creating the resources cause this method to return
 // immediately (used during testing), or if the client will asynchronously retry.
-func (c *Config) open(logger log.Logger, waitForResources bool) (*client, error) {
+func (c *Config) open(logger *slog.Logger, waitForResources bool) (*client, error) {
+	if c.CRDHandling == "" {
+		c.CRDHandling = crdHandlingEnsure
+	}
 	if c.InCluster && (c.KubeConfigFile != "") {
 		return nil, errors.New("cannot specify both 'inCluster' and 'kubeConfigFile'")
 	}
@@ -87,7 +102,7 @@ func (c *Config) open(logger log.Logger, waitForResources bool) (*client, error)
 		return nil, err
 	}
 
-	cli, err := newClient(cluster, user, namespace, logger, c.InCluster)
+	cli, err := newClient(cluster, user, namespace, logger, c.InCluster, c.CRDHandling)
 	if err != nil {
 		return nil, fmt.Errorf("create client: %v", err)
 	}
@@ -141,45 +156,55 @@ func (c *Config) open(logger log.Logger, waitForResources bool) (*client, error)
 // It logs all errors, returning true if the resources were created successfully.
 //
 // Creating a custom resource does not mean that they'll be immediately available.
-func (cli *client) registerCustomResources() (ok bool) {
-	ok = true
-
+func (cli *client) registerCustomResources() bool {
 	definitions := customResourceDefinitions(cli.crdAPIVersion)
-	length := len(definitions)
 
-	for i := 0; i < length; i++ {
-		var err error
-		var resourceName string
+	// First pass: collect all CRDs that don't exist
+	var missingCRDs []k8sapi.CustomResourceDefinition
 
-		r := definitions[i]
+	for _, r := range definitions {
 		var i interface{}
-		cli.logger.Infof("checking if custom resource %s has already been created...", r.ObjectMeta.Name)
-		if err := cli.list(r.Spec.Names.Plural, &i); err == nil {
-			cli.logger.Infof("The custom resource %s already available, skipping create", r.ObjectMeta.Name)
-			continue
+		cli.logger.Info("checking if custom resource has already been created...", "object", r.ObjectMeta.Name)
+		if err := cli.listN(r.Spec.Names.Plural, &i, 1); err == nil {
+			cli.logger.Info("the custom resource already available, skipping create", "object", r.ObjectMeta.Name)
 		} else {
-			cli.logger.Infof("failed to list custom resource %s, attempting to create: %v", r.ObjectMeta.Name, err)
+			cli.logger.Info("custom resource not found", "object", r.ObjectMeta.Name, "err", err)
+			missingCRDs = append(missingCRDs, r)
 		}
+	}
 
-		err = cli.postResource(cli.crdAPIVersion, "", "customresourcedefinitions", r)
-		resourceName = r.ObjectMeta.Name
-
-		if err != nil {
-			switch err {
-			case storage.ErrAlreadyExists:
-				cli.logger.Infof("custom resource already created %s", resourceName)
-			case storage.ErrNotFound:
-				cli.logger.Errorf("custom resources not found, please enable the respective API group")
-				ok = false
-			default:
-				cli.logger.Errorf("creating custom resource %s: %v", resourceName, err)
-				ok = false
+	// Second pass: handle missing CRDs based on crdHandling option
+	if len(missingCRDs) > 0 {
+		cli.logger.Info("found missing CRDs", "count", len(missingCRDs))
+		switch cli.crdHandling {
+		case crdHandlingCheck:
+			// For "check" mode, fail and report that CRDs are not initialized
+			cli.logger.Error("storage is not initialized, CRDs are not created", "crdHandling", cli.crdHandling, "missing_count", len(missingCRDs))
+			return false
+		case crdHandlingEnsure:
+			cli.logger.Info("crdHandling is 'ensure', attempting to create missing CRDs")
+			for _, r := range missingCRDs {
+				resourceName := r.ObjectMeta.Name
+				err := cli.postResource(cli.crdAPIVersion, "", "customresourcedefinitions", r)
+				if err != nil {
+					if !errors.Is(err, storage.ErrAlreadyExists) {
+						cli.logger.Error("failed to create custom resource", "object", resourceName, "err", err)
+						return false
+					}
+					cli.logger.Info("custom resource already created", "object", resourceName)
+				} else {
+					cli.logger.Info("successfully created custom resource", "object", resourceName)
+				}
 			}
-			continue
+			return true
+		default:
+			cli.logger.Error("invalid crdHandling value", "value", cli.crdHandling)
+			return false
 		}
-		cli.logger.Errorf("create custom resource %s", resourceName)
 	}
-	return ok
+
+	// All CRDs exist
+	return true
 }
 
 // waitForCRDs waits for all CRDs to be in a ready state, and is used
@@ -195,7 +220,7 @@ func (cli *client) waitForCRDs(ctx context.Context) error {
 				break
 			}
 
-			cli.logger.Errorf("checking CRD: %v", err)
+			cli.logger.ErrorContext(ctx, "checking CRD", "err", err)
 
 			select {
 			case <-ctx.Done():
@@ -232,35 +257,35 @@ func (cli *client) Close() error {
 	return nil
 }
 
-func (cli *client) CreateAuthRequest(a storage.AuthRequest) error {
+func (cli *client) CreateAuthRequest(ctx context.Context, a storage.AuthRequest) error {
 	return cli.post(resourceAuthRequest, cli.fromStorageAuthRequest(a))
 }
 
-func (cli *client) CreateClient(c storage.Client) error {
+func (cli *client) CreateClient(ctx context.Context, c storage.Client) error {
 	return cli.post(resourceClient, cli.fromStorageClient(c))
 }
 
-func (cli *client) CreateAuthCode(c storage.AuthCode) error {
+func (cli *client) CreateAuthCode(ctx context.Context, c storage.AuthCode) error {
 	return cli.post(resourceAuthCode, cli.fromStorageAuthCode(c))
 }
 
-func (cli *client) CreatePassword(p storage.Password) error {
+func (cli *client) CreatePassword(ctx context.Context, p storage.Password) error {
 	return cli.post(resourcePassword, cli.fromStoragePassword(p))
 }
 
-func (cli *client) CreateRefresh(r storage.RefreshToken) error {
+func (cli *client) CreateRefresh(ctx context.Context, r storage.RefreshToken) error {
 	return cli.post(resourceRefreshToken, cli.fromStorageRefreshToken(r))
 }
 
-func (cli *client) CreateOfflineSessions(o storage.OfflineSessions) error {
+func (cli *client) CreateOfflineSessions(ctx context.Context, o storage.OfflineSessions) error {
 	return cli.post(resourceOfflineSessions, cli.fromStorageOfflineSessions(o))
 }
 
-func (cli *client) CreateConnector(c storage.Connector) error {
+func (cli *client) CreateConnector(ctx context.Context, c storage.Connector) error {
 	return cli.post(resourceConnector, cli.fromStorageConnector(c))
 }
 
-func (cli *client) GetAuthRequest(id string) (storage.AuthRequest, error) {
+func (cli *client) GetAuthRequest(ctx context.Context, id string) (storage.AuthRequest, error) {
 	var req AuthRequest
 	if err := cli.get(resourceAuthRequest, id, &req); err != nil {
 		return storage.AuthRequest{}, err
@@ -268,7 +293,7 @@ func (cli *client) GetAuthRequest(id string) (storage.AuthRequest, error) {
 	return toStorageAuthRequest(req), nil
 }
 
-func (cli *client) GetAuthCode(id string) (storage.AuthCode, error) {
+func (cli *client) GetAuthCode(ctx context.Context, id string) (storage.AuthCode, error) {
 	var code AuthCode
 	if err := cli.get(resourceAuthCode, id, &code); err != nil {
 		return storage.AuthCode{}, err
@@ -276,7 +301,7 @@ func (cli *client) GetAuthCode(id string) (storage.AuthCode, error) {
 	return toStorageAuthCode(code), nil
 }
 
-func (cli *client) GetClient(id string) (storage.Client, error) {
+func (cli *client) GetClient(ctx context.Context, id string) (storage.Client, error) {
 	c, err := cli.getClient(id)
 	if err != nil {
 		return storage.Client{}, err
@@ -296,7 +321,7 @@ func (cli *client) getClient(id string) (Client, error) {
 	return c, nil
 }
 
-func (cli *client) GetPassword(email string) (storage.Password, error) {
+func (cli *client) GetPassword(ctx context.Context, email string) (storage.Password, error) {
 	p, err := cli.getPassword(email)
 	if err != nil {
 		return storage.Password{}, err
@@ -318,7 +343,7 @@ func (cli *client) getPassword(email string) (Password, error) {
 	return p, nil
 }
 
-func (cli *client) GetKeys() (storage.Keys, error) {
+func (cli *client) GetKeys(ctx context.Context) (storage.Keys, error) {
 	var keys Keys
 	if err := cli.get(resourceKeys, keysName, &keys); err != nil {
 		return storage.Keys{}, err
@@ -326,7 +351,7 @@ func (cli *client) GetKeys() (storage.Keys, error) {
 	return toStorageKeys(keys), nil
 }
 
-func (cli *client) GetRefresh(id string) (storage.RefreshToken, error) {
+func (cli *client) GetRefresh(ctx context.Context, id string) (storage.RefreshToken, error) {
 	r, err := cli.getRefreshToken(id)
 	if err != nil {
 		return storage.RefreshToken{}, err
@@ -339,7 +364,7 @@ func (cli *client) getRefreshToken(id string) (r RefreshToken, err error) {
 	return
 }
 
-func (cli *client) GetOfflineSessions(userID string, connID string) (storage.OfflineSessions, error) {
+func (cli *client) GetOfflineSessions(ctx context.Context, userID string, connID string) (storage.OfflineSessions, error) {
 	o, err := cli.getOfflineSessions(userID, connID)
 	if err != nil {
 		return storage.OfflineSessions{}, err
@@ -358,7 +383,7 @@ func (cli *client) getOfflineSessions(userID string, connID string) (o OfflineSe
 	return o, nil
 }
 
-func (cli *client) GetConnector(id string) (storage.Connector, error) {
+func (cli *client) GetConnector(ctx context.Context, id string) (storage.Connector, error) {
 	var c Connector
 	if err := cli.get(resourceConnector, id, &c); err != nil {
 		return storage.Connector{}, err
@@ -366,34 +391,28 @@ func (cli *client) GetConnector(id string) (storage.Connector, error) {
 	return toStorageConnector(c), nil
 }
 
-func (cli *client) ListClients() ([]storage.Client, error) {
+func (cli *client) ListClients(ctx context.Context) ([]storage.Client, error) {
 	return nil, errors.New("not implemented")
 }
 
-func (cli *client) ListRefreshTokens() ([]storage.RefreshToken, error) {
+func (cli *client) ListRefreshTokens(ctx context.Context) ([]storage.RefreshToken, error) {
 	return nil, errors.New("not implemented")
 }
 
-func (cli *client) ListPasswords() (passwords []storage.Password, err error) {
+func (cli *client) ListPasswords(ctx context.Context) (passwords []storage.Password, err error) {
 	var passwordList PasswordList
 	if err = cli.list(resourcePassword, &passwordList); err != nil {
 		return passwords, fmt.Errorf("failed to list passwords: %v", err)
 	}
 
 	for _, password := range passwordList.Passwords {
-		p := storage.Password{
-			Email:    password.Email,
-			Hash:     password.Hash,
-			Username: password.Username,
-			UserID:   password.UserID,
-		}
-		passwords = append(passwords, p)
+		passwords = append(passwords, toStoragePassword(password))
 	}
 
 	return
 }
 
-func (cli *client) ListConnectors() (connectors []storage.Connector, err error) {
+func (cli *client) ListConnectors(ctx context.Context) (connectors []storage.Connector, err error) {
 	var connectorList ConnectorList
 	if err = cli.list(resourceConnector, &connectorList); err != nil {
 		return connectors, fmt.Errorf("failed to list connectors: %v", err)
@@ -407,15 +426,15 @@ func (cli *client) ListConnectors() (connectors []storage.Connector, err error)
 	return
 }
 
-func (cli *client) DeleteAuthRequest(id string) error {
+func (cli *client) DeleteAuthRequest(ctx context.Context, id string) error {
 	return cli.delete(resourceAuthRequest, id)
 }
 
-func (cli *client) DeleteAuthCode(code string) error {
+func (cli *client) DeleteAuthCode(ctx context.Context, code string) error {
 	return cli.delete(resourceAuthCode, code)
 }
 
-func (cli *client) DeleteClient(id string) error {
+func (cli *client) DeleteClient(ctx context.Context, id string) error {
 	// Check for hash collision.
 	c, err := cli.getClient(id)
 	if err != nil {
@@ -424,11 +443,11 @@ func (cli *client) DeleteClient(id string) error {
 	return cli.delete(resourceClient, c.ObjectMeta.Name)
 }
 
-func (cli *client) DeleteRefresh(id string) error {
+func (cli *client) DeleteRefresh(ctx context.Context, id string) error {
 	return cli.delete(resourceRefreshToken, id)
 }
 
-func (cli *client) DeletePassword(email string) error {
+func (cli *client) DeletePassword(ctx context.Context, email string) error {
 	// Check for hash collision.
 	p, err := cli.getPassword(email)
 	if err != nil {
@@ -437,7 +456,7 @@ func (cli *client) DeletePassword(email string) error {
 	return cli.delete(resourcePassword, p.ObjectMeta.Name)
 }
 
-func (cli *client) DeleteOfflineSessions(userID string, connID string) error {
+func (cli *client) DeleteOfflineSessions(ctx context.Context, userID string, connID string) error {
 	// Check for hash collision.
 	o, err := cli.getOfflineSessions(userID, connID)
 	if err != nil {
@@ -446,16 +465,24 @@ func (cli *client) DeleteOfflineSessions(userID string, connID string) error {
 	return cli.delete(resourceOfflineSessions, o.ObjectMeta.Name)
 }
 
-func (cli *client) DeleteConnector(id string) error {
+func (cli *client) DeleteConnector(ctx context.Context, id string) error {
 	return cli.delete(resourceConnector, id)
 }
 
-func (cli *client) UpdateRefreshToken(id string, updater func(old storage.RefreshToken) (storage.RefreshToken, error)) error {
-	return retryOnConflict(context.TODO(), func() error {
+func (cli *client) UpdateRefreshToken(ctx context.Context, id string, updater func(old storage.RefreshToken) (storage.RefreshToken, error)) error {
+	lock := newRefreshTokenLock(cli)
+
+	if err := lock.Lock(id); err != nil {
+		return err
+	}
+	defer lock.Unlock(id)
+
+	return retryOnConflict(ctx, func() error {
 		r, err := cli.getRefreshToken(id)
 		if err != nil {
 			return err
 		}
+
 		updated, err := updater(toStorageRefreshToken(r))
 		if err != nil {
 			return err
@@ -464,11 +491,12 @@ func (cli *client) UpdateRefreshToken(id string, updater func(old storage.Refres
 
 		newToken := cli.fromStorageRefreshToken(updated)
 		newToken.ObjectMeta = r.ObjectMeta
+
 		return cli.put(resourceRefreshToken, r.ObjectMeta.Name, newToken)
 	})
 }
 
-func (cli *client) UpdateClient(id string, updater func(old storage.Client) (storage.Client, error)) error {
+func (cli *client) UpdateClient(ctx context.Context, id string, updater func(old storage.Client) (storage.Client, error)) error {
 	c, err := cli.getClient(id)
 	if err != nil {
 		return err
@@ -485,7 +513,7 @@ func (cli *client) UpdateClient(id string, updater func(old storage.Client) (sto
 	return cli.put(resourceClient, c.ObjectMeta.Name, newClient)
 }
 
-func (cli *client) UpdatePassword(email string, updater func(old storage.Password) (storage.Password, error)) error {
+func (cli *client) UpdatePassword(ctx context.Context, email string, updater func(old storage.Password) (storage.Password, error)) error {
 	p, err := cli.getPassword(email)
 	if err != nil {
 		return err
@@ -502,8 +530,8 @@ func (cli *client) UpdatePassword(email string, updater func(old storage.Passwor
 	return cli.put(resourcePassword, p.ObjectMeta.Name, newPassword)
 }
 
-func (cli *client) UpdateOfflineSessions(userID string, connID string, updater func(old storage.OfflineSessions) (storage.OfflineSessions, error)) error {
-	return retryOnConflict(context.TODO(), func() error {
+func (cli *client) UpdateOfflineSessions(ctx context.Context, userID string, connID string, updater func(old storage.OfflineSessions) (storage.OfflineSessions, error)) error {
+	return retryOnConflict(ctx, func() error {
 		o, err := cli.getOfflineSessions(userID, connID)
 		if err != nil {
 			return err
@@ -520,7 +548,7 @@ func (cli *client) UpdateOfflineSessions(userID string, connID string, updater f
 	})
 }
 
-func (cli *client) UpdateKeys(updater func(old storage.Keys) (storage.Keys, error)) error {
+func (cli *client) UpdateKeys(ctx context.Context, updater func(old storage.Keys) (storage.Keys, error)) error {
 	firstUpdate := false
 	var keys Keys
 	if err := cli.get(resourceKeys, keysName, &keys); err != nil {
@@ -545,7 +573,7 @@ func (cli *client) UpdateKeys(updater func(old storage.Keys) (storage.Keys, erro
 		err = cli.post(resourceKeys, newKeys)
 		if err != nil && errors.Is(err, storage.ErrAlreadyExists) {
 			// We need to tolerate conflicts here in case of HA mode.
-			cli.logger.Debugf("Keys creation failed: %v. It is possible that keys have already been created by another dex instance.", err)
+			cli.logger.Debug("Keys creation failed. It is possible that keys have already been created by another dex instance.", "err", err)
 			return errors.New("keys already created by another server instance")
 		}
 
@@ -558,14 +586,14 @@ func (cli *client) UpdateKeys(updater func(old storage.Keys) (storage.Keys, erro
 	if isKubernetesAPIConflictError(err) {
 		// We need to tolerate conflicts here in case of HA mode.
 		// Dex instances run keys rotation at the same time because they use SigningKey.nextRotation CR field as a trigger.
-		cli.logger.Debugf("Keys rotation failed: %v. It is possible that keys have already been rotated by another dex instance.", err)
+		cli.logger.Debug("Keys rotation failed. It is possible that keys have already been rotated by another dex instance.", "err", err)
 		return errors.New("keys already rotated by another server instance")
 	}
 
 	return err
 }
 
-func (cli *client) UpdateAuthRequest(id string, updater func(a storage.AuthRequest) (storage.AuthRequest, error)) error {
+func (cli *client) UpdateAuthRequest(ctx context.Context, id string, updater func(a storage.AuthRequest) (storage.AuthRequest, error)) error {
 	var req AuthRequest
 	err := cli.get(resourceAuthRequest, id, &req)
 	if err != nil {
@@ -582,8 +610,8 @@ func (cli *client) UpdateAuthRequest(id string, updater func(a storage.AuthReque
 	return cli.put(resourceAuthRequest, id, newReq)
 }
 
-func (cli *client) UpdateConnector(id string, updater func(a storage.Connector) (storage.Connector, error)) error {
-	return retryOnConflict(context.TODO(), func() error {
+func (cli *client) UpdateConnector(ctx context.Context, id string, updater func(a storage.Connector) (storage.Connector, error)) error {
+	return retryOnConflict(ctx, func() error {
 		var c Connector
 		err := cli.get(resourceConnector, id, &c)
 		if err != nil {
@@ -601,7 +629,7 @@ func (cli *client) UpdateConnector(id string, updater func(a storage.Connector)
 	})
 }
 
-func (cli *client) GarbageCollect(now time.Time) (result storage.GCResult, err error) {
+func (cli *client) GarbageCollect(ctx context.Context, now time.Time) (result storage.GCResult, err error) {
 	var authRequests AuthRequestList
 	if err := cli.listN(resourceAuthRequest, &authRequests, gcResultLimit); err != nil {
 		return result, fmt.Errorf("failed to list auth requests: %v", err)
@@ -611,7 +639,7 @@ func (cli *client) GarbageCollect(now time.Time) (result storage.GCResult, err e
 	for _, authRequest := range authRequests.AuthRequests {
 		if now.After(authRequest.Expiry) {
 			if err := cli.delete(resourceAuthRequest, authRequest.ObjectMeta.Name); err != nil {
-				cli.logger.Errorf("failed to delete auth request: %v", err)
+				cli.logger.Error("failed to delete auth request", "err", err)
 				delErr = fmt.Errorf("failed to delete auth request: %v", err)
 			}
 			result.AuthRequests++
@@ -629,7 +657,7 @@ func (cli *client) GarbageCollect(now time.Time) (result storage.GCResult, err e
 	for _, authCode := range authCodes.AuthCodes {
 		if now.After(authCode.Expiry) {
 			if err := cli.delete(resourceAuthCode, authCode.ObjectMeta.Name); err != nil {
-				cli.logger.Errorf("failed to delete auth code %v", err)
+				cli.logger.Error("failed to delete auth code", "err", err)
 				delErr = fmt.Errorf("failed to delete auth code: %v", err)
 			}
 			result.AuthCodes++
@@ -644,7 +672,7 @@ func (cli *client) GarbageCollect(now time.Time) (result storage.GCResult, err e
 	for _, deviceRequest := range deviceRequests.DeviceRequests {
 		if now.After(deviceRequest.Expiry) {
 			if err := cli.delete(resourceDeviceRequest, deviceRequest.ObjectMeta.Name); err != nil {
-				cli.logger.Errorf("failed to delete device request: %v", err)
+				cli.logger.Error("failed to delete device request", "err", err)
 				delErr = fmt.Errorf("failed to delete device request: %v", err)
 			}
 			result.DeviceRequests++
@@ -659,24 +687,40 @@ func (cli *client) GarbageCollect(now time.Time) (result storage.GCResult, err e
 	for _, deviceToken := range deviceTokens.DeviceTokens {
 		if now.After(deviceToken.Expiry) {
 			if err := cli.delete(resourceDeviceToken, deviceToken.ObjectMeta.Name); err != nil {
-				cli.logger.Errorf("failed to delete device token: %v", err)
+				cli.logger.Error("failed to delete device token", "err", err)
 				delErr = fmt.Errorf("failed to delete device token: %v", err)
 			}
 			result.DeviceTokens++
 		}
 	}
 
+	var authSessions AuthSessionList
+	if err := cli.listN(resourceAuthSession, &authSessions, gcResultLimit); err != nil {
+		return result, fmt.Errorf("failed to list auth sessions: %v", err)
+	}
+
+	for _, authSession := range authSessions.AuthSessions {
+		if now.After(authSession.AbsoluteExpiry) || now.After(authSession.IdleExpiry) {
+			if err := cli.delete(resourceAuthSession, authSession.ObjectMeta.Name); err != nil {
+				cli.logger.Error("failed to delete auth session", "err", err)
+				delErr = fmt.Errorf("failed to delete auth session: %v", err)
+			} else {
+				result.AuthSessions++
+			}
+		}
+	}
+
 	if delErr != nil {
 		return result, delErr
 	}
 	return result, delErr
 }
 
-func (cli *client) CreateDeviceRequest(d storage.DeviceRequest) error {
+func (cli *client) CreateDeviceRequest(ctx context.Context, d storage.DeviceRequest) error {
 	return cli.post(resourceDeviceRequest, cli.fromStorageDeviceRequest(d))
 }
 
-func (cli *client) GetDeviceRequest(userCode string) (storage.DeviceRequest, error) {
+func (cli *client) GetDeviceRequest(ctx context.Context, userCode string) (storage.DeviceRequest, error) {
 	var req DeviceRequest
 	if err := cli.get(resourceDeviceRequest, strings.ToLower(userCode), &req); err != nil {
 		return storage.DeviceRequest{}, err
@@ -684,11 +728,11 @@ func (cli *client) GetDeviceRequest(userCode string) (storage.DeviceRequest, err
 	return toStorageDeviceRequest(req), nil
 }
 
-func (cli *client) CreateDeviceToken(t storage.DeviceToken) error {
+func (cli *client) CreateDeviceToken(ctx context.Context, t storage.DeviceToken) error {
 	return cli.post(resourceDeviceToken, cli.fromStorageDeviceToken(t))
 }
 
-func (cli *client) GetDeviceToken(deviceCode string) (storage.DeviceToken, error) {
+func (cli *client) GetDeviceToken(ctx context.Context, deviceCode string) (storage.DeviceToken, error) {
 	var token DeviceToken
 	if err := cli.get(resourceDeviceToken, deviceCode, &token); err != nil {
 		return storage.DeviceToken{}, err
@@ -701,8 +745,8 @@ func (cli *client) getDeviceToken(deviceCode string) (t DeviceToken, err error)
 	return
 }
 
-func (cli *client) UpdateDeviceToken(deviceCode string, updater func(old storage.DeviceToken) (storage.DeviceToken, error)) error {
-	return retryOnConflict(context.TODO(), func() error {
+func (cli *client) UpdateDeviceToken(ctx context.Context, deviceCode string, updater func(old storage.DeviceToken) (storage.DeviceToken, error)) error {
+	return retryOnConflict(ctx, func() error {
 		r, err := cli.getDeviceToken(deviceCode)
 		if err != nil {
 			return err
@@ -719,6 +763,130 @@ func (cli *client) UpdateDeviceToken(deviceCode string, updater func(old storage
 	})
 }
 
+func (cli *client) CreateUserIdentity(ctx context.Context, u storage.UserIdentity) error {
+	return cli.post(resourceUserIdentity, cli.fromStorageUserIdentity(u))
+}
+
+func (cli *client) GetUserIdentity(ctx context.Context, userID, connectorID string) (storage.UserIdentity, error) {
+	u, err := cli.getUserIdentity(userID, connectorID)
+	if err != nil {
+		return storage.UserIdentity{}, err
+	}
+	return toStorageUserIdentity(u), nil
+}
+
+func (cli *client) getUserIdentity(userID, connectorID string) (u UserIdentity, err error) {
+	name := cli.offlineTokenName(userID, connectorID)
+	if err = cli.get(resourceUserIdentity, name, &u); err != nil {
+		return UserIdentity{}, err
+	}
+	if userID != u.UserID || connectorID != u.ConnectorID {
+		return UserIdentity{}, fmt.Errorf("get user identity: wrong identity retrieved")
+	}
+	return u, nil
+}
+
+func (cli *client) UpdateUserIdentity(ctx context.Context, userID, connectorID string, updater func(old storage.UserIdentity) (storage.UserIdentity, error)) error {
+	return retryOnConflict(ctx, func() error {
+		u, err := cli.getUserIdentity(userID, connectorID)
+		if err != nil {
+			return err
+		}
+
+		updated, err := updater(toStorageUserIdentity(u))
+		if err != nil {
+			return err
+		}
+
+		newUserIdentity := cli.fromStorageUserIdentity(updated)
+		newUserIdentity.ObjectMeta = u.ObjectMeta
+		return cli.put(resourceUserIdentity, u.ObjectMeta.Name, newUserIdentity)
+	})
+}
+
+func (cli *client) DeleteUserIdentity(ctx context.Context, userID, connectorID string) error {
+	// Check for hash collision.
+	u, err := cli.getUserIdentity(userID, connectorID)
+	if err != nil {
+		return err
+	}
+	return cli.delete(resourceUserIdentity, u.ObjectMeta.Name)
+}
+
+func (cli *client) ListUserIdentities(ctx context.Context) ([]storage.UserIdentity, error) {
+	var userIdentityList UserIdentityList
+	if err := cli.list(resourceUserIdentity, &userIdentityList); err != nil {
+		return nil, fmt.Errorf("failed to list user identities: %v", err)
+	}
+
+	userIdentities := make([]storage.UserIdentity, len(userIdentityList.UserIdentities))
+	for i, u := range userIdentityList.UserIdentities {
+		userIdentities[i] = toStorageUserIdentity(u)
+	}
+
+	return userIdentities, nil
+}
+
+func (cli *client) CreateAuthSession(ctx context.Context, s storage.AuthSession) error {
+	return cli.post(resourceAuthSession, cli.fromStorageAuthSession(s))
+}
+
+func (cli *client) getAuthSession(id string) (AuthSession, error) {
+	var s AuthSession
+	if err := cli.get(resourceAuthSession, id, &s); err != nil {
+		return AuthSession{}, err
+	}
+	return s, nil
+}
+
+func (cli *client) GetAuthSession(ctx context.Context, id string) (storage.AuthSession, error) {
+	s, err := cli.getAuthSession(id)
+	if err != nil {
+		return storage.AuthSession{}, err
+	}
+	return toStorageAuthSession(s), nil
+}
+
+func (cli *client) UpdateAuthSession(ctx context.Context, id string, updater func(old storage.AuthSession) (storage.AuthSession, error)) error {
+	return retryOnConflict(ctx, func() error {
+		s, err := cli.getAuthSession(id)
+		if err != nil {
+			return err
+		}
+
+		updated, err := updater(toStorageAuthSession(s))
+		if err != nil {
+			return err
+		}
+
+		newSession := cli.fromStorageAuthSession(updated)
+		newSession.ObjectMeta = s.ObjectMeta
+		return cli.put(resourceAuthSession, s.ObjectMeta.Name, newSession)
+	})
+}
+
+func (cli *client) ListAuthSessions(ctx context.Context) ([]storage.AuthSession, error) {
+	var authSessionList AuthSessionList
+	if err := cli.list(resourceAuthSession, &authSessionList); err != nil {
+		return nil, fmt.Errorf("failed to list auth sessions: %v", err)
+	}
+
+	sessions := make([]storage.AuthSession, len(authSessionList.AuthSessions))
+	for i, s := range authSessionList.AuthSessions {
+		sessions[i] = toStorageAuthSession(s)
+	}
+
+	return sessions, nil
+}
+
+func (cli *client) DeleteAuthSession(ctx context.Context, id string) error {
+	s, err := cli.getAuthSession(id)
+	if err != nil {
+		return err
+	}
+	return cli.delete(resourceAuthSession, s.ObjectMeta.Name)
+}
+
 func isKubernetesAPIConflictError(err error) bool {
 	if httpErr, ok := err.(httpError); ok {
 		if httpErr.StatusCode() == http.StatusConflict {
diff --git a/storage/kubernetes/storage_test.go b/storage/kubernetes/storage_test.go
index 828ff472cf..906e5ce57e 100644
--- a/storage/kubernetes/storage_test.go
+++ b/storage/kubernetes/storage_test.go
@@ -5,14 +5,15 @@ import (
 	"crypto/tls"
 	"errors"
 	"fmt"
+	"log/slog"
 	"net/http"
 	"net/http/httptest"
 	"os"
 	"path/filepath"
 	"strings"
 	"testing"
+	"time"
 
-	"github.com/sirupsen/logrus"
 	"github.com/stretchr/testify/require"
 	"github.com/stretchr/testify/suite"
 
@@ -35,29 +36,28 @@ type StorageTestSuite struct {
 	client *client
 }
 
-func (s *StorageTestSuite) expandDir(dir string) string {
+func expandDir(dir string) (string, error) {
 	dir = strings.Trim(dir, `"`)
 	if strings.HasPrefix(dir, "~/") {
 		homedir, err := os.UserHomeDir()
-		s.Require().NoError(err)
+		if err != nil {
+			return "", err
+		}
 
 		dir = filepath.Join(homedir, strings.TrimPrefix(dir, "~/"))
 	}
-	return dir
+	return dir, nil
 }
 
 func (s *StorageTestSuite) SetupTest() {
-	kubeconfigPath := s.expandDir(os.Getenv(kubeconfigPathVariableName))
+	kubeconfigPath, err := expandDir(os.Getenv(kubeconfigPathVariableName))
+	s.Require().NoError(err)
 
 	config := Config{
 		KubeConfigFile: kubeconfigPath,
 	}
 
-	logger := &logrus.Logger{
-		Out:       os.Stderr,
-		Formatter: &logrus.TextFormatter{DisableColors: true},
-		Level:     logrus.DebugLevel,
-	}
+	logger := slog.New(slog.NewTextHandler(s.T().Output(), &slog.HandlerOptions{Level: slog.LevelDebug}))
 
 	kubeClient, err := config.open(logger, true)
 	s.Require().NoError(err)
@@ -66,7 +66,7 @@ func (s *StorageTestSuite) SetupTest() {
 }
 
 func (s *StorageTestSuite) TestStorage() {
-	newStorage := func() storage.Storage {
+	newStorage := func(t *testing.T) storage.Storage {
 		for _, resource := range []string{
 			resourceAuthCode,
 			resourceAuthRequest,
@@ -85,6 +85,7 @@ func (s *StorageTestSuite) TestStorage() {
 	}
 
 	conformance.RunTests(s.T(), newStorage)
+	conformance.RunConcurrencyTests(s.T(), newStorage)
 	conformance.RunTransactionTests(s.T(), newStorage)
 }
 
@@ -125,7 +126,11 @@ func TestURLFor(t *testing.T) {
 
 	for _, test := range tests {
 		c := &client{baseURL: test.baseURL}
-		got := c.urlFor(test.apiVersion, test.namespace, test.resource, test.name)
+		got, err := c.urlFor(test.apiVersion, test.namespace, test.resource, test.name)
+		if err != nil {
+			t.Errorf("got error: %v", err)
+		}
+
 		if got != test.want {
 			t.Errorf("(&client{baseURL:%q}).urlFor(%q, %q, %q, %q): expected %q got %q",
 				test.baseURL,
@@ -216,7 +221,7 @@ func TestUpdateKeys(t *testing.T) {
 	for _, test := range tests {
 		client := newStatusCodesResponseTestClient(test.getResponseCode, test.actionResponseCode)
 
-		err := client.UpdateKeys(test.updater)
+		err := client.UpdateKeys(context.TODO(), test.updater)
 		if err != nil {
 			if !test.wantErr {
 				t.Fatalf("Test %q: %v", test.name, err)
@@ -245,11 +250,7 @@ func newStatusCodesResponseTestClient(getResponseCode, actionResponseCode int) *
 	return &client{
 		client:  &http.Client{Transport: tr},
 		baseURL: s.URL,
-		logger: &logrus.Logger{
-			Out:       os.Stderr,
-			Formatter: &logrus.TextFormatter{DisableColors: true},
-			Level:     logrus.DebugLevel,
-		},
+		logger:  slog.New(slog.DiscardHandler),
 	}
 }
 
@@ -292,3 +293,92 @@ func TestRetryOnConflict(t *testing.T) {
 		})
 	}
 }
+
+func TestRefreshTokenLock(t *testing.T) {
+	ctx := context.Background()
+	if os.Getenv(kubeconfigPathVariableName) == "" {
+		t.Skipf("variable %q not set, skipping kubernetes storage tests\n", kubeconfigPathVariableName)
+	}
+
+	kubeconfigPath, err := expandDir(os.Getenv(kubeconfigPathVariableName))
+	require.NoError(t, err)
+
+	config := Config{
+		KubeConfigFile: kubeconfigPath,
+	}
+
+	logger := slog.New(slog.DiscardHandler)
+
+	kubeClient, err := config.open(logger, true)
+	require.NoError(t, err)
+
+	lockCheckPeriod = time.Nanosecond
+
+	// Creating a storage with an existing refresh token and offline session for the user.
+	id := storage.NewID()
+	r := storage.RefreshToken{
+		ID:          id,
+		Token:       "bar",
+		Nonce:       "foo",
+		ClientID:    "client_id",
+		ConnectorID: "client_secret",
+		Scopes:      []string{"openid", "email", "profile"},
+		CreatedAt:   time.Now().UTC().Round(time.Millisecond),
+		LastUsed:    time.Now().UTC().Round(time.Millisecond),
+		Claims: storage.Claims{
+			UserID:        "1",
+			Username:      "jane",
+			Email:         "jane.doe@example.com",
+			EmailVerified: true,
+			Groups:        []string{"a", "b"},
+		},
+		ConnectorData: []byte(`{"some":"data"}`),
+	}
+
+	err = kubeClient.CreateRefresh(ctx, r)
+	require.NoError(t, err)
+
+	t.Run("Timeout lock error", func(t *testing.T) {
+		err = kubeClient.UpdateRefreshToken(ctx, r.ID, func(r storage.RefreshToken) (storage.RefreshToken, error) {
+			r.Token = "update-result-1"
+			err := kubeClient.UpdateRefreshToken(ctx, r.ID, func(r storage.RefreshToken) (storage.RefreshToken, error) {
+				r.Token = "timeout-err"
+				return r, nil
+			})
+			require.Equal(t, fmt.Errorf("timeout waiting for refresh token %s lock", r.ID), err)
+			return r, nil
+		})
+		require.NoError(t, err)
+
+		token, err := kubeClient.GetRefresh(context.TODO(), r.ID)
+		require.NoError(t, err)
+		require.Equal(t, "update-result-1", token.Token)
+	})
+
+	t.Run("Break the lock", func(t *testing.T) {
+		var lockBroken bool
+		lockTimeout = -time.Hour
+
+		err = kubeClient.UpdateRefreshToken(ctx, r.ID, func(r storage.RefreshToken) (storage.RefreshToken, error) {
+			r.Token = "update-result-2"
+			if lockBroken {
+				return r, nil
+			}
+
+			err := kubeClient.UpdateRefreshToken(ctx, r.ID, func(r storage.RefreshToken) (storage.RefreshToken, error) {
+				r.Token = "should-break-the-lock-and-finish-updating"
+				return r, nil
+			})
+			require.NoError(t, err)
+
+			lockBroken = true
+			return r, nil
+		})
+		require.NoError(t, err)
+
+		token, err := kubeClient.GetRefresh(context.TODO(), r.ID)
+		require.NoError(t, err)
+		// Because concurrent update breaks the lock, the final result will be the value of the first update
+		require.Equal(t, "update-result-2", token.Token)
+	})
+}
diff --git a/storage/kubernetes/transport.go b/storage/kubernetes/transport.go
index 5d39c27fba..9c3cd2baac 100644
--- a/storage/kubernetes/transport.go
+++ b/storage/kubernetes/transport.go
@@ -62,15 +62,17 @@ func wrapRoundTripper(base http.RoundTripper, user k8sapi.AuthInfo, inCluster bo
 }
 
 // renewTokenPeriod is the interval after which dex will read the token from a well-known file.
-//   By Kubernetes documentation, this interval should be at least one minute long.
-//   Kubernetes client-go v0.15+ uses 10 seconds long interval.
-//   Dex uses the reasonable value between these two.
+//
+//	By Kubernetes documentation, this interval should be at least one minute long.
+//	Kubernetes client-go v0.15+ uses 10 seconds long interval.
+//	Dex uses the reasonable value between these two.
 const renewTokenPeriod = 30 * time.Second
 
 // inClusterTransportHelper is capable of safely updating the user token.
-//   BoundServiceAccountTokenVolume feature is enabled in Kubernetes >=1.21 by default.
-//   With this feature, the service account token in the pod becomes periodically updated.
-//   Therefore, Dex needs to re-read the token from the disk after some time to be sure that it uses the valid token.
+//
+//	BoundServiceAccountTokenVolume feature is enabled in Kubernetes >=1.21 by default.
+//	With this feature, the service account token in the pod becomes periodically updated.
+//	Therefore, Dex needs to re-read the token from the disk after some time to be sure that it uses the valid token.
 type inClusterTransportHelper struct {
 	mu   sync.RWMutex
 	info k8sapi.AuthInfo
diff --git a/storage/kubernetes/types.go b/storage/kubernetes/types.go
index 5149e3eec6..151c8ad112 100644
--- a/storage/kubernetes/types.go
+++ b/storage/kubernetes/types.go
@@ -4,7 +4,7 @@ import (
 	"strings"
 	"time"
 
-	jose "gopkg.in/square/go-jose.v2"
+	"github.com/go-jose/go-jose/v4"
 
 	"github.com/dexidp/dex/storage"
 	"github.com/dexidp/dex/storage/kubernetes/k8sapi"
@@ -226,6 +226,40 @@ func customResourceDefinitions(apiVersion string) []k8sapi.CustomResourceDefinit
 				},
 			},
 		},
+		{
+			ObjectMeta: k8sapi.ObjectMeta{
+				Name: "useridentities.dex.coreos.com",
+			},
+			TypeMeta: crdMeta,
+			Spec: k8sapi.CustomResourceDefinitionSpec{
+				Group:    apiGroup,
+				Version:  version,
+				Versions: versions,
+				Scope:    scope,
+				Names: k8sapi.CustomResourceDefinitionNames{
+					Plural:   "useridentities",
+					Singular: "useridentity",
+					Kind:     "UserIdentity",
+				},
+			},
+		},
+		{
+			ObjectMeta: k8sapi.ObjectMeta{
+				Name: "authsessions.dex.coreos.com",
+			},
+			TypeMeta: crdMeta,
+			Spec: k8sapi.CustomResourceDefinitionSpec{
+				Group:    apiGroup,
+				Version:  version,
+				Versions: versions,
+				Scope:    scope,
+				Names: k8sapi.CustomResourceDefinitionNames{
+					Plural:   "authsessions",
+					Singular: "authsession",
+					Kind:     "AuthSession",
+				},
+			},
+		},
 	}
 }
 
@@ -251,6 +285,18 @@ type Client struct {
 
 	Name    string `json:"name,omitempty"`
 	LogoURL string `json:"logoURL,omitempty"`
+
+	AllowedConnectors []string `json:"allowedConnectors,omitempty"`
+
+	MFAChain []string `json:"mfaChain,omitempty"`
+
+	PostLogoutRedirectURIs []string `json:"postLogoutRedirectURIs,omitempty"`
+
+	SSOSharedWith []string `json:"ssoSharedWith"`
+
+	BackchannelLogoutURI string `json:"backchannelLogoutURI,omitempty"`
+
+	RefreshTokenLifetime string `json:"refreshTokenLifetime,omitempty"`
 }
 
 // ClientList is a list of Clients.
@@ -270,25 +316,37 @@ func (cli *client) fromStorageClient(c storage.Client) Client {
 			Name:      cli.idToName(c.ID),
 			Namespace: cli.namespace,
 		},
-		ID:           c.ID,
-		Secret:       c.Secret,
-		RedirectURIs: c.RedirectURIs,
-		TrustedPeers: c.TrustedPeers,
-		Public:       c.Public,
-		Name:         c.Name,
-		LogoURL:      c.LogoURL,
+		ID:                     c.ID,
+		Secret:                 c.Secret,
+		RedirectURIs:           c.RedirectURIs,
+		TrustedPeers:           c.TrustedPeers,
+		Public:                 c.Public,
+		Name:                   c.Name,
+		LogoURL:                c.LogoURL,
+		AllowedConnectors:      c.AllowedConnectors,
+		MFAChain:               c.MFAChain,
+		PostLogoutRedirectURIs: c.PostLogoutRedirectURIs,
+		SSOSharedWith:          c.SSOSharedWith,
+		BackchannelLogoutURI:   c.BackchannelLogoutURI,
+		RefreshTokenLifetime:   c.RefreshTokenLifetime,
 	}
 }
 
 func toStorageClient(c Client) storage.Client {
 	return storage.Client{
-		ID:           c.ID,
-		Secret:       c.Secret,
-		RedirectURIs: c.RedirectURIs,
-		TrustedPeers: c.TrustedPeers,
-		Public:       c.Public,
-		Name:         c.Name,
-		LogoURL:      c.LogoURL,
+		ID:                     c.ID,
+		Secret:                 c.Secret,
+		RedirectURIs:           c.RedirectURIs,
+		TrustedPeers:           c.TrustedPeers,
+		Public:                 c.Public,
+		Name:                   c.Name,
+		LogoURL:                c.LogoURL,
+		AllowedConnectors:      c.AllowedConnectors,
+		MFAChain:               c.MFAChain,
+		PostLogoutRedirectURIs: c.PostLogoutRedirectURIs,
+		SSOSharedWith:          c.SSOSharedWith,
+		BackchannelLogoutURI:   c.BackchannelLogoutURI,
+		RefreshTokenLifetime:   c.RefreshTokenLifetime,
 	}
 }
 
@@ -356,6 +414,16 @@ type AuthRequest struct {
 
 	CodeChallenge       string `json:"code_challenge,omitempty"`
 	CodeChallengeMethod string `json:"code_challenge_method,omitempty"`
+
+	HMACKey []byte `json:"hmac_key"`
+
+	MFAValidated bool `json:"mfa_validated"`
+
+	WebAuthnSessionData []byte `json:"webauthn_session_data,omitempty"`
+
+	Prompt   string    `json:"prompt,omitempty"`
+	MaxAge   int       `json:"maxAge"`
+	AuthTime time.Time `json:"authTime,omitempty"`
 }
 
 // AuthRequestList is a list of AuthRequests.
@@ -384,6 +452,12 @@ func toStorageAuthRequest(req AuthRequest) storage.AuthRequest {
 			CodeChallenge:       req.CodeChallenge,
 			CodeChallengeMethod: req.CodeChallengeMethod,
 		},
+		HMACKey:             req.HMACKey,
+		MFAValidated:        req.MFAValidated,
+		WebAuthnSessionData: req.WebAuthnSessionData,
+		Prompt:              req.Prompt,
+		MaxAge:              req.MaxAge,
+		AuthTime:            req.AuthTime,
 	}
 	return a
 }
@@ -412,6 +486,12 @@ func (cli *client) fromStorageAuthRequest(a storage.AuthRequest) AuthRequest {
 		Claims:              fromStorageClaims(a.Claims),
 		CodeChallenge:       a.PKCE.CodeChallenge,
 		CodeChallengeMethod: a.PKCE.CodeChallengeMethod,
+		HMACKey:             a.HMACKey,
+		MFAValidated:        a.MFAValidated,
+		WebAuthnSessionData: a.WebAuthnSessionData,
+		Prompt:              a.Prompt,
+		MaxAge:              a.MaxAge,
+		AuthTime:            a.AuthTime,
 	}
 	return req
 }
@@ -427,9 +507,13 @@ type Password struct {
 	// This field is IMMUTABLE. Do not change.
 	Email string `json:"email,omitempty"`
 
-	Hash     []byte `json:"hash,omitempty"`
-	Username string `json:"username,omitempty"`
-	UserID   string `json:"userID,omitempty"`
+	Hash              []byte   `json:"hash,omitempty"`
+	Username          string   `json:"username,omitempty"`
+	Name              string   `json:"name,omitempty"`
+	PreferredUsername string   `json:"preferredUsername,omitempty"`
+	EmailVerified     *bool    `json:"emailVerified,omitempty"`
+	UserID            string   `json:"userID,omitempty"`
+	Groups            []string `json:"groups,omitempty"`
 }
 
 // PasswordList is a list of Passwords.
@@ -450,19 +534,27 @@ func (cli *client) fromStoragePassword(p storage.Password) Password {
 			Name:      cli.idToName(email),
 			Namespace: cli.namespace,
 		},
-		Email:    email,
-		Hash:     p.Hash,
-		Username: p.Username,
-		UserID:   p.UserID,
+		Email:             email,
+		Hash:              p.Hash,
+		Username:          p.Username,
+		Name:              p.Name,
+		PreferredUsername: p.PreferredUsername,
+		EmailVerified:     p.EmailVerified,
+		UserID:            p.UserID,
+		Groups:            p.Groups,
 	}
 }
 
 func toStoragePassword(p Password) storage.Password {
 	return storage.Password{
-		Email:    p.Email,
-		Hash:     p.Hash,
-		Username: p.Username,
-		UserID:   p.UserID,
+		Email:             p.Email,
+		Hash:              p.Hash,
+		Username:          p.Username,
+		Name:              p.Name,
+		PreferredUsername: p.PreferredUsername,
+		EmailVerified:     p.EmailVerified,
+		UserID:            p.UserID,
+		Groups:            p.Groups,
 	}
 }
 
@@ -488,6 +580,10 @@ type AuthCode struct {
 
 	CodeChallenge       string `json:"code_challenge,omitempty"`
 	CodeChallengeMethod string `json:"code_challenge_method,omitempty"`
+
+	AuthTime time.Time `json:"authTime,omitempty"`
+
+	SessionID string `json:"sessionID,omitempty"`
 }
 
 // AuthCodeList is a list of AuthCodes.
@@ -517,6 +613,8 @@ func (cli *client) fromStorageAuthCode(a storage.AuthCode) AuthCode {
 		Expiry:              a.Expiry,
 		CodeChallenge:       a.PKCE.CodeChallenge,
 		CodeChallengeMethod: a.PKCE.CodeChallengeMethod,
+		AuthTime:            a.AuthTime,
+		SessionID:           a.SessionID,
 	}
 }
 
@@ -535,6 +633,8 @@ func toStorageAuthCode(a AuthCode) storage.AuthCode {
 			CodeChallenge:       a.CodeChallenge,
 			CodeChallengeMethod: a.CodeChallengeMethod,
 		},
+		AuthTime:  a.AuthTime,
+		SessionID: a.SessionID,
 	}
 }
 
@@ -705,6 +805,8 @@ type Connector struct {
 	Name string `json:"name,omitempty"`
 	// Config holds connector specific configuration information
 	Config []byte `json:"config,omitempty"`
+	// GrantTypes is a list of grant types that this connector is allowed to be used with.
+	GrantTypes []string `json:"grantTypes,omitempty"`
 }
 
 func (cli *client) fromStorageConnector(c storage.Connector) Connector {
@@ -717,10 +819,11 @@ func (cli *client) fromStorageConnector(c storage.Connector) Connector {
 			Name:      c.ID,
 			Namespace: cli.namespace,
 		},
-		ID:     c.ID,
-		Type:   c.Type,
-		Name:   c.Name,
-		Config: c.Config,
+		ID:         c.ID,
+		Type:       c.Type,
+		Name:       c.Name,
+		Config:     c.Config,
+		GrantTypes: c.GrantTypes,
 	}
 }
 
@@ -731,6 +834,7 @@ func toStorageConnector(c Connector) storage.Connector {
 		Name:            c.Name,
 		ResourceVersion: c.ObjectMeta.ResourceVersion,
 		Config:          c.Config,
+		GrantTypes:      c.GrantTypes,
 	}
 }
 
@@ -848,3 +952,139 @@ func toStorageDeviceToken(t DeviceToken) storage.DeviceToken {
 		},
 	}
 }
+
+// UserIdentity is a mirrored struct from storage with JSON struct tags and Kubernetes
+// type metadata.
+type UserIdentity struct {
+	k8sapi.TypeMeta   `json:",inline"`
+	k8sapi.ObjectMeta `json:"metadata,omitempty"`
+
+	UserID              string                                  `json:"userID,omitempty"`
+	ConnectorID         string                                  `json:"connectorID,omitempty"`
+	Claims              Claims                                  `json:"claims,omitempty"`
+	Consents            map[string][]string                     `json:"consents,omitempty"`
+	MFASecrets          map[string]*storage.MFASecret           `json:"mfaSecrets,omitempty"`
+	WebAuthnCredentials map[string][]storage.WebAuthnCredential `json:"webauthnCredentials,omitempty"`
+	CreatedAt           time.Time                               `json:"createdAt,omitempty"`
+	LastLogin           time.Time                               `json:"lastLogin,omitempty"`
+	BlockedUntil        time.Time                               `json:"blockedUntil,omitempty"`
+}
+
+// UserIdentityList is a list of UserIdentities.
+type UserIdentityList struct {
+	k8sapi.TypeMeta `json:",inline"`
+	k8sapi.ListMeta `json:"metadata,omitempty"`
+	UserIdentities  []UserIdentity `json:"items"`
+}
+
+func (cli *client) fromStorageUserIdentity(u storage.UserIdentity) UserIdentity {
+	return UserIdentity{
+		TypeMeta: k8sapi.TypeMeta{
+			Kind:       kindUserIdentity,
+			APIVersion: cli.apiVersion,
+		},
+		ObjectMeta: k8sapi.ObjectMeta{
+			Name:      cli.offlineTokenName(u.UserID, u.ConnectorID),
+			Namespace: cli.namespace,
+		},
+		UserID:              u.UserID,
+		ConnectorID:         u.ConnectorID,
+		Claims:              fromStorageClaims(u.Claims),
+		Consents:            u.Consents,
+		MFASecrets:          u.MFASecrets,
+		WebAuthnCredentials: u.WebAuthnCredentials,
+		CreatedAt:           u.CreatedAt,
+		LastLogin:           u.LastLogin,
+		BlockedUntil:        u.BlockedUntil,
+	}
+}
+
+func toStorageUserIdentity(u UserIdentity) storage.UserIdentity {
+	s := storage.UserIdentity{
+		UserID:              u.UserID,
+		ConnectorID:         u.ConnectorID,
+		Claims:              toStorageClaims(u.Claims),
+		Consents:            u.Consents,
+		MFASecrets:          u.MFASecrets,
+		WebAuthnCredentials: u.WebAuthnCredentials,
+		CreatedAt:           u.CreatedAt,
+		LastLogin:           u.LastLogin,
+		BlockedUntil:        u.BlockedUntil,
+	}
+	if s.Consents == nil {
+		// Server code assumes this will be non-nil.
+		s.Consents = make(map[string][]string)
+	}
+	return s
+}
+
+// AuthSession is a Kubernetes representation of a storage AuthSession.
+type AuthSession struct {
+	k8sapi.TypeMeta   `json:",inline"`
+	k8sapi.ObjectMeta `json:"metadata,omitempty"`
+
+	UserID         string                              `json:"userID,omitempty"`
+	ConnectorID    string                              `json:"connectorID,omitempty"`
+	Nonce          string                              `json:"nonce,omitempty"`
+	Secret         string                              `json:"secret,omitempty"`
+	ClientStates   map[string]*storage.ClientAuthState `json:"clientStates,omitempty"`
+	CreatedAt      time.Time                           `json:"createdAt,omitempty"`
+	LastActivity   time.Time                           `json:"lastActivity,omitempty"`
+	IPAddress      string                              `json:"ipAddress,omitempty"`
+	UserAgent      string                              `json:"userAgent,omitempty"`
+	AbsoluteExpiry time.Time                           `json:"absoluteExpiry,omitempty"`
+	IdleExpiry     time.Time                           `json:"idleExpiry,omitempty"`
+	LogoutState    *storage.LogoutState                `json:"logoutState,omitempty"`
+}
+
+// AuthSessionList is a list of AuthSessions.
+type AuthSessionList struct {
+	k8sapi.TypeMeta `json:",inline"`
+	k8sapi.ListMeta `json:"metadata,omitempty"`
+	AuthSessions    []AuthSession `json:"items"`
+}
+
+func (cli *client) fromStorageAuthSession(s storage.AuthSession) AuthSession {
+	return AuthSession{
+		TypeMeta: k8sapi.TypeMeta{
+			Kind:       kindAuthSession,
+			APIVersion: cli.apiVersion,
+		},
+		ObjectMeta: k8sapi.ObjectMeta{
+			Name:      s.ID,
+			Namespace: cli.namespace,
+		},
+		Secret:         s.Secret,
+		UserID:         s.UserID,
+		ConnectorID:    s.ConnectorID,
+		ClientStates:   s.ClientStates,
+		CreatedAt:      s.CreatedAt,
+		LastActivity:   s.LastActivity,
+		IPAddress:      s.IPAddress,
+		UserAgent:      s.UserAgent,
+		AbsoluteExpiry: s.AbsoluteExpiry,
+		IdleExpiry:     s.IdleExpiry,
+		LogoutState:    s.LogoutState,
+	}
+}
+
+func toStorageAuthSession(s AuthSession) storage.AuthSession {
+	result := storage.AuthSession{
+		ID:             s.ObjectMeta.Name,
+		Secret:         s.Secret,
+		UserID:         s.UserID,
+		ConnectorID:    s.ConnectorID,
+		ClientStates:   s.ClientStates,
+		CreatedAt:      s.CreatedAt,
+		LastActivity:   s.LastActivity,
+		IPAddress:      s.IPAddress,
+		UserAgent:      s.UserAgent,
+		AbsoluteExpiry: s.AbsoluteExpiry,
+		IdleExpiry:     s.IdleExpiry,
+		LogoutState:    s.LogoutState,
+	}
+	if result.ClientStates == nil {
+		result.ClientStates = make(map[string]*storage.ClientAuthState)
+	}
+	return result
+}
diff --git a/storage/memory/memory.go b/storage/memory/memory.go
index a940665714..0fdac2b5d9 100644
--- a/storage/memory/memory.go
+++ b/storage/memory/memory.go
@@ -2,23 +2,28 @@
 package memory
 
 import (
+	"context"
+	"log/slog"
 	"strings"
 	"sync"
 	"time"
 
-	"github.com/dexidp/dex/pkg/log"
 	"github.com/dexidp/dex/storage"
 )
 
+var _ storage.Storage = (*memStorage)(nil)
+
 // New returns an in memory storage.
-func New(logger log.Logger) storage.Storage {
+func New(logger *slog.Logger) storage.Storage {
 	return &memStorage{
 		clients:         make(map[string]storage.Client),
 		authCodes:       make(map[string]storage.AuthCode),
 		refreshTokens:   make(map[string]storage.RefreshToken),
 		authReqs:        make(map[string]storage.AuthRequest),
 		passwords:       make(map[string]storage.Password),
-		offlineSessions: make(map[offlineSessionID]storage.OfflineSessions),
+		offlineSessions: make(map[compositeKeyID]storage.OfflineSessions),
+		userIdentities:  make(map[compositeKeyID]storage.UserIdentity),
+		authSessions:    make(map[string]storage.AuthSession),
 		connectors:      make(map[string]storage.Connector),
 		deviceRequests:  make(map[string]storage.DeviceRequest),
 		deviceTokens:    make(map[string]storage.DeviceToken),
@@ -33,7 +38,7 @@ type Config struct { // The in memory implementation has no config.
 }
 
 // Open always returns a new in memory storage.
-func (c *Config) Open(logger log.Logger) (storage.Storage, error) {
+func (c *Config) Open(logger *slog.Logger) (storage.Storage, error) {
 	return New(logger), nil
 }
 
@@ -45,17 +50,19 @@ type memStorage struct {
 	refreshTokens   map[string]storage.RefreshToken
 	authReqs        map[string]storage.AuthRequest
 	passwords       map[string]storage.Password
-	offlineSessions map[offlineSessionID]storage.OfflineSessions
+	offlineSessions map[compositeKeyID]storage.OfflineSessions
+	userIdentities  map[compositeKeyID]storage.UserIdentity
+	authSessions    map[string]storage.AuthSession
 	connectors      map[string]storage.Connector
 	deviceRequests  map[string]storage.DeviceRequest
 	deviceTokens    map[string]storage.DeviceToken
 
 	keys storage.Keys
 
-	logger log.Logger
+	logger *slog.Logger
 }
 
-type offlineSessionID struct {
+type compositeKeyID struct {
 	userID string
 	connID string
 }
@@ -68,7 +75,7 @@ func (s *memStorage) tx(f func()) {
 
 func (s *memStorage) Close() error { return nil }
 
-func (s *memStorage) GarbageCollect(now time.Time) (result storage.GCResult, err error) {
+func (s *memStorage) GarbageCollect(ctx context.Context, now time.Time) (result storage.GCResult, err error) {
 	s.tx(func() {
 		for id, a := range s.authCodes {
 			if now.After(a.Expiry) {
@@ -94,11 +101,17 @@ func (s *memStorage) GarbageCollect(now time.Time) (result storage.GCResult, err
 				result.DeviceTokens++
 			}
 		}
+		for id, a := range s.authSessions {
+			if now.After(a.AbsoluteExpiry) || now.After(a.IdleExpiry) {
+				delete(s.authSessions, id)
+				result.AuthSessions++
+			}
+		}
 	})
 	return result, nil
 }
 
-func (s *memStorage) CreateClient(c storage.Client) (err error) {
+func (s *memStorage) CreateClient(ctx context.Context, c storage.Client) (err error) {
 	s.tx(func() {
 		if _, ok := s.clients[c.ID]; ok {
 			err = storage.ErrAlreadyExists
@@ -109,7 +122,7 @@ func (s *memStorage) CreateClient(c storage.Client) (err error) {
 	return
 }
 
-func (s *memStorage) CreateAuthCode(c storage.AuthCode) (err error) {
+func (s *memStorage) CreateAuthCode(ctx context.Context, c storage.AuthCode) (err error) {
 	s.tx(func() {
 		if _, ok := s.authCodes[c.ID]; ok {
 			err = storage.ErrAlreadyExists
@@ -120,7 +133,7 @@ func (s *memStorage) CreateAuthCode(c storage.AuthCode) (err error) {
 	return
 }
 
-func (s *memStorage) CreateRefresh(r storage.RefreshToken) (err error) {
+func (s *memStorage) CreateRefresh(ctx context.Context, r storage.RefreshToken) (err error) {
 	s.tx(func() {
 		if _, ok := s.refreshTokens[r.ID]; ok {
 			err = storage.ErrAlreadyExists
@@ -131,7 +144,7 @@ func (s *memStorage) CreateRefresh(r storage.RefreshToken) (err error) {
 	return
 }
 
-func (s *memStorage) CreateAuthRequest(a storage.AuthRequest) (err error) {
+func (s *memStorage) CreateAuthRequest(ctx context.Context, a storage.AuthRequest) (err error) {
 	s.tx(func() {
 		if _, ok := s.authReqs[a.ID]; ok {
 			err = storage.ErrAlreadyExists
@@ -142,7 +155,7 @@ func (s *memStorage) CreateAuthRequest(a storage.AuthRequest) (err error) {
 	return
 }
 
-func (s *memStorage) CreatePassword(p storage.Password) (err error) {
+func (s *memStorage) CreatePassword(ctx context.Context, p storage.Password) (err error) {
 	lowerEmail := strings.ToLower(p.Email)
 	s.tx(func() {
 		if _, ok := s.passwords[lowerEmail]; ok {
@@ -154,8 +167,8 @@ func (s *memStorage) CreatePassword(p storage.Password) (err error) {
 	return
 }
 
-func (s *memStorage) CreateOfflineSessions(o storage.OfflineSessions) (err error) {
-	id := offlineSessionID{
+func (s *memStorage) CreateOfflineSessions(ctx context.Context, o storage.OfflineSessions) (err error) {
+	id := compositeKeyID{
 		userID: o.UserID,
 		connID: o.ConnID,
 	}
@@ -169,7 +182,135 @@ func (s *memStorage) CreateOfflineSessions(o storage.OfflineSessions) (err error
 	return
 }
 
-func (s *memStorage) CreateConnector(connector storage.Connector) (err error) {
+func (s *memStorage) CreateUserIdentity(ctx context.Context, u storage.UserIdentity) (err error) {
+	id := compositeKeyID{
+		userID: u.UserID,
+		connID: u.ConnectorID,
+	}
+	s.tx(func() {
+		if _, ok := s.userIdentities[id]; ok {
+			err = storage.ErrAlreadyExists
+		} else {
+			s.userIdentities[id] = u
+		}
+	})
+	return
+}
+
+func (s *memStorage) GetUserIdentity(ctx context.Context, userID, connectorID string) (u storage.UserIdentity, err error) {
+	id := compositeKeyID{
+		userID: userID,
+		connID: connectorID,
+	}
+	s.tx(func() {
+		var ok bool
+		if u, ok = s.userIdentities[id]; !ok {
+			err = storage.ErrNotFound
+			return
+		}
+	})
+	return
+}
+
+func (s *memStorage) UpdateUserIdentity(ctx context.Context, userID, connectorID string, updater func(u storage.UserIdentity) (storage.UserIdentity, error)) (err error) {
+	id := compositeKeyID{
+		userID: userID,
+		connID: connectorID,
+	}
+	s.tx(func() {
+		r, ok := s.userIdentities[id]
+		if !ok {
+			err = storage.ErrNotFound
+			return
+		}
+		if r, err = updater(r); err == nil {
+			s.userIdentities[id] = r
+		}
+	})
+	return
+}
+
+func (s *memStorage) DeleteUserIdentity(ctx context.Context, userID, connectorID string) (err error) {
+	id := compositeKeyID{
+		userID: userID,
+		connID: connectorID,
+	}
+	s.tx(func() {
+		if _, ok := s.userIdentities[id]; !ok {
+			err = storage.ErrNotFound
+			return
+		}
+		delete(s.userIdentities, id)
+	})
+	return
+}
+
+func (s *memStorage) ListUserIdentities(ctx context.Context) (identities []storage.UserIdentity, err error) {
+	s.tx(func() {
+		for _, u := range s.userIdentities {
+			identities = append(identities, u)
+		}
+	})
+	return
+}
+
+func (s *memStorage) ListAuthSessions(ctx context.Context) (sessions []storage.AuthSession, err error) {
+	s.tx(func() {
+		for _, session := range s.authSessions {
+			sessions = append(sessions, session)
+		}
+	})
+	return
+}
+
+func (s *memStorage) CreateAuthSession(ctx context.Context, session storage.AuthSession) (err error) {
+	id := session.ID
+	s.tx(func() {
+		if _, ok := s.authSessions[id]; ok {
+			err = storage.ErrAlreadyExists
+		} else {
+			s.authSessions[id] = session
+		}
+	})
+	return
+}
+
+func (s *memStorage) GetAuthSession(ctx context.Context, id string) (session storage.AuthSession, err error) {
+	s.tx(func() {
+		var ok bool
+		if session, ok = s.authSessions[id]; !ok {
+			err = storage.ErrNotFound
+		}
+	})
+	return
+}
+
+func (s *memStorage) UpdateAuthSession(ctx context.Context, id string, updater func(s storage.AuthSession) (storage.AuthSession, error)) (err error) {
+	s.tx(func() {
+		r, ok := s.authSessions[id]
+		if !ok {
+			err = storage.ErrNotFound
+			return
+		}
+		if r, err = updater(r); err == nil {
+			s.authSessions[id] = r
+		}
+	})
+	return
+}
+
+func (s *memStorage) DeleteAuthSession(ctx context.Context, id string) (err error) {
+	s.tx(func() {
+		if _, ok := s.authSessions[id]; !ok {
+			err = storage.ErrNotFound
+			return
+		}
+		delete(s.authSessions, id)
+	})
+	return
+}
+
+func (s *memStorage) CreateConnector(ctx context.Context, connector storage.Connector) (err error) {
 	s.tx(func() {
 		if _, ok := s.connectors[connector.ID]; ok {
 			err = storage.ErrAlreadyExists
@@ -180,7 +321,7 @@ func (s *memStorage) CreateConnector(connector storage.Connector) (err error) {
 	return
 }
 
-func (s *memStorage) GetAuthCode(id string) (c storage.AuthCode, err error) {
+func (s *memStorage) GetAuthCode(ctx context.Context, id string) (c storage.AuthCode, err error) {
 	s.tx(func() {
 		var ok bool
 		if c, ok = s.authCodes[id]; !ok {
@@ -191,7 +332,7 @@ func (s *memStorage) GetAuthCode(id string) (c storage.AuthCode, err error) {
 	return
 }
 
-func (s *memStorage) GetPassword(email string) (p storage.Password, err error) {
+func (s *memStorage) GetPassword(ctx context.Context, email string) (p storage.Password, err error) {
 	email = strings.ToLower(email)
 	s.tx(func() {
 		var ok bool
@@ -202,7 +343,7 @@ func (s *memStorage) GetPassword(email string) (p storage.Password, err error) {
 	return
 }
 
-func (s *memStorage) GetClient(id string) (client storage.Client, err error) {
+func (s *memStorage) GetClient(ctx context.Context, id string) (client storage.Client, err error) {
 	s.tx(func() {
 		var ok bool
 		if client, ok = s.clients[id]; !ok {
@@ -212,12 +353,12 @@ func (s *memStorage) GetClient(id string) (client storage.Client, err error) {
 	return
 }
 
-func (s *memStorage) GetKeys() (keys storage.Keys, err error) {
+func (s *memStorage) GetKeys(ctx context.Context) (keys storage.Keys, err error) {
 	s.tx(func() { keys = s.keys })
 	return
 }
 
-func (s *memStorage) GetRefresh(id string) (tok storage.RefreshToken, err error) {
+func (s *memStorage) GetRefresh(ctx context.Context, id string) (tok storage.RefreshToken, err error) {
 	s.tx(func() {
 		var ok bool
 		if tok, ok = s.refreshTokens[id]; !ok {
@@ -228,7 +369,7 @@ func (s *memStorage) GetRefresh(id string) (tok storage.RefreshToken, err error)
 	return
 }
 
-func (s *memStorage) GetAuthRequest(id string) (req storage.AuthRequest, err error) {
+func (s *memStorage) GetAuthRequest(ctx context.Context, id string) (req storage.AuthRequest, err error) {
 	s.tx(func() {
 		var ok bool
 		if req, ok = s.authReqs[id]; !ok {
@@ -239,8 +380,8 @@ func (s *memStorage) GetAuthRequest(id string) (req storage.AuthRequest, err err
 	return
 }
 
-func (s *memStorage) GetOfflineSessions(userID string, connID string) (o storage.OfflineSessions, err error) {
-	id := offlineSessionID{
+func (s *memStorage) GetOfflineSessions(ctx context.Context, userID string, connID string) (o storage.OfflineSessions, err error) {
+	id := compositeKeyID{
 		userID: userID,
 		connID: connID,
 	}
@@ -254,7 +395,7 @@ func (s *memStorage) GetOfflineSessions(userID string, connID string) (o storage
 	return
 }
 
-func (s *memStorage) GetConnector(id string) (connector storage.Connector, err error) {
+func (s *memStorage) GetConnector(ctx context.Context, id string) (connector storage.Connector, err error) {
 	s.tx(func() {
 		var ok bool
 		if connector, ok = s.connectors[id]; !ok {
@@ -264,7 +405,7 @@ func (s *memStorage) GetConnector(id string) (connector storage.Connector, err e
 	return
 }
 
-func (s *memStorage) ListClients() (clients []storage.Client, err error) {
+func (s *memStorage) ListClients(ctx context.Context) (clients []storage.Client, err error) {
 	s.tx(func() {
 		for _, client := range s.clients {
 			clients = append(clients, client)
@@ -273,7 +414,7 @@ func (s *memStorage) ListClients() (clients []storage.Client, err error) {
 	return
 }
 
-func (s *memStorage) ListRefreshTokens() (tokens []storage.RefreshToken, err error) {
+func (s *memStorage) ListRefreshTokens(ctx context.Context) (tokens []storage.RefreshToken, err error) {
 	s.tx(func() {
 		for _, refresh := range s.refreshTokens {
 			tokens = append(tokens, refresh)
@@ -282,7 +423,7 @@ func (s *memStorage) ListRefreshTokens() (tokens []storage.RefreshToken, err err
 	return
 }
 
-func (s *memStorage) ListPasswords() (passwords []storage.Password, err error) {
+func (s *memStorage) ListPasswords(ctx context.Context) (passwords []storage.Password, err error) {
 	s.tx(func() {
 		for _, password := range s.passwords {
 			passwords = append(passwords, password)
@@ -291,7 +432,7 @@ func (s *memStorage) ListPasswords() (passwords []storage.Password, err error) {
 	return
 }
 
-func (s *memStorage) ListConnectors() (conns []storage.Connector, err error) {
+func (s *memStorage) ListConnectors(ctx context.Context) (conns []storage.Connector, err error) {
 	s.tx(func() {
 		for _, c := range s.connectors {
 			conns = append(conns, c)
@@ -300,7 +441,7 @@ func (s *memStorage) ListConnectors() (conns []storage.Connector, err error) {
 	return
 }
 
-func (s *memStorage) DeletePassword(email string) (err error) {
+func (s *memStorage) DeletePassword(ctx context.Context, email string) (err error) {
 	email = strings.ToLower(email)
 	s.tx(func() {
 		if _, ok := s.passwords[email]; !ok {
@@ -312,7 +453,7 @@ func (s *memStorage) DeletePassword(email string) (err error) {
 	return
 }
 
-func (s *memStorage) DeleteClient(id string) (err error) {
+func (s *memStorage) DeleteClient(ctx context.Context, id string) (err error) {
 	s.tx(func() {
 		if _, ok := s.clients[id]; !ok {
 			err = storage.ErrNotFound
@@ -323,7 +464,7 @@ func (s *memStorage) DeleteClient(id string) (err error) {
 	return
 }
 
-func (s *memStorage) DeleteRefresh(id string) (err error) {
+func (s *memStorage) DeleteRefresh(ctx context.Context, id string) (err error) {
 	s.tx(func() {
 		if _, ok := s.refreshTokens[id]; !ok {
 			err = storage.ErrNotFound
@@ -334,7 +475,7 @@ func (s *memStorage) DeleteRefresh(id string) (err error) {
 	return
 }
 
-func (s *memStorage) DeleteAuthCode(id string) (err error) {
+func (s *memStorage) DeleteAuthCode(ctx context.Context, id string) (err error) {
 	s.tx(func() {
 		if _, ok := s.authCodes[id]; !ok {
 			err = storage.ErrNotFound
@@ -345,7 +486,7 @@ func (s *memStorage) DeleteAuthCode(id string) (err error) {
 	return
 }
 
-func (s *memStorage) DeleteAuthRequest(id string) (err error) {
+func (s *memStorage) DeleteAuthRequest(ctx context.Context, id string) (err error) {
 	s.tx(func() {
 		if _, ok := s.authReqs[id]; !ok {
 			err = storage.ErrNotFound
@@ -356,8 +497,8 @@ func (s *memStorage) DeleteAuthRequest(id string) (err error) {
 	return
 }
 
-func (s *memStorage) DeleteOfflineSessions(userID string, connID string) (err error) {
-	id := offlineSessionID{
+func (s *memStorage) DeleteOfflineSessions(ctx context.Context, userID string, connID string) (err error) {
+	id := compositeKeyID{
 		userID: userID,
 		connID: connID,
 	}
@@ -371,7 +512,7 @@ func (s *memStorage) DeleteOfflineSessions(userID string, connID string) (err er
 	return
 }
 
-func (s *memStorage) DeleteConnector(id string) (err error) {
+func (s *memStorage) DeleteConnector(ctx context.Context, id string) (err error) {
 	s.tx(func() {
 		if _, ok := s.connectors[id]; !ok {
 			err = storage.ErrNotFound
@@ -382,7 +523,7 @@ func (s *memStorage) DeleteConnector(id string) (err error) {
 	return
 }
 
-func (s *memStorage) UpdateClient(id string, updater func(old storage.Client) (storage.Client, error)) (err error) {
+func (s *memStorage) UpdateClient(ctx context.Context, id string, updater func(old storage.Client) (storage.Client, error)) (err error) {
 	s.tx(func() {
 		client, ok := s.clients[id]
 		if !ok {
@@ -396,7 +537,7 @@ func (s *memStorage) UpdateClient(id string, updater func(old storage.Client) (s
 	return
 }
 
-func (s *memStorage) UpdateKeys(updater func(old storage.Keys) (storage.Keys, error)) (err error) {
+func (s *memStorage) UpdateKeys(ctx context.Context, updater func(old storage.Keys) (storage.Keys, error)) (err error) {
 	s.tx(func() {
 		var keys storage.Keys
 		if keys, err = updater(s.keys); err == nil {
@@ -406,7 +547,7 @@ func (s *memStorage) UpdateKeys(updater func(old storage.Keys) (storage.Keys, er
 	return
 }
 
-func (s *memStorage) UpdateAuthRequest(id string, updater func(old storage.AuthRequest) (storage.AuthRequest, error)) (err error) {
+func (s *memStorage) UpdateAuthRequest(ctx context.Context, id string, updater func(old storage.AuthRequest) (storage.AuthRequest, error)) (err error) {
 	s.tx(func() {
 		req, ok := s.authReqs[id]
 		if !ok {
@@ -420,7 +561,7 @@ func (s *memStorage) UpdateAuthRequest(id string, updater func(old storage.AuthR
 	return
 }
 
-func (s *memStorage) UpdatePassword(email string, updater func(p storage.Password) (storage.Password, error)) (err error) {
+func (s *memStorage) UpdatePassword(ctx context.Context, email string, updater func(p storage.Password) (storage.Password, error)) (err error) {
 	email = strings.ToLower(email)
 	s.tx(func() {
 		req, ok := s.passwords[email]
@@ -435,7 +576,7 @@ func (s *memStorage) UpdatePassword(email string, updater func(p storage.Passwor
 	return
 }
 
-func (s *memStorage) UpdateRefreshToken(id string, updater func(p storage.RefreshToken) (storage.RefreshToken, error)) (err error) {
+func (s *memStorage) UpdateRefreshToken(ctx context.Context, id string, updater func(p storage.RefreshToken) (storage.RefreshToken, error)) (err error) {
 	s.tx(func() {
 		r, ok := s.refreshTokens[id]
 		if !ok {
@@ -449,8 +590,8 @@ func (s *memStorage) UpdateRefreshToken(id string, updater func(p storage.Refres
 	return
 }
 
-func (s *memStorage) UpdateOfflineSessions(userID string, connID string, updater func(o storage.OfflineSessions) (storage.OfflineSessions, error)) (err error) {
-	id := offlineSessionID{
+func (s *memStorage) UpdateOfflineSessions(ctx context.Context, userID string, connID string, updater func(o storage.OfflineSessions) (storage.OfflineSessions, error)) (err error) {
+	id := compositeKeyID{
 		userID: userID,
 		connID: connID,
 	}
@@ -467,7 +608,7 @@ func (s *memStorage) UpdateOfflineSessions(userID string, connID string, updater
 	return
 }
 
-func (s *memStorage) UpdateConnector(id string, updater func(c storage.Connector) (storage.Connector, error)) (err error) {
+func (s *memStorage) UpdateConnector(ctx context.Context, id string, updater func(c storage.Connector) (storage.Connector, error)) (err error) {
 	s.tx(func() {
 		r, ok := s.connectors[id]
 		if !ok {
@@ -481,7 +622,7 @@ func (s *memStorage) UpdateConnector(id string, updater func(c storage.Connector
 	return
 }
 
-func (s *memStorage) CreateDeviceRequest(d storage.DeviceRequest) (err error) {
+func (s *memStorage) CreateDeviceRequest(ctx context.Context, d storage.DeviceRequest) (err error) {
 	s.tx(func() {
 		if _, ok := s.deviceRequests[d.UserCode]; ok {
 			err = storage.ErrAlreadyExists
@@ -492,7 +633,7 @@ func (s *memStorage) CreateDeviceRequest(d storage.DeviceRequest) (err error) {
 	return
 }
 
-func (s *memStorage) GetDeviceRequest(userCode string) (req storage.DeviceRequest, err error) {
+func (s *memStorage) GetDeviceRequest(ctx context.Context, userCode string) (req storage.DeviceRequest, err error) {
 	s.tx(func() {
 		var ok bool
 		if req, ok = s.deviceRequests[userCode]; !ok {
@@ -503,7 +644,7 @@ func (s *memStorage) GetDeviceRequest(userCode string) (req storage.DeviceReques
 	return
 }
 
-func (s *memStorage) CreateDeviceToken(t storage.DeviceToken) (err error) {
+func (s *memStorage) CreateDeviceToken(ctx context.Context, t storage.DeviceToken) (err error) {
 	s.tx(func() {
 		if _, ok := s.deviceTokens[t.DeviceCode]; ok {
 			err = storage.ErrAlreadyExists
@@ -514,7 +655,7 @@ func (s *memStorage) CreateDeviceToken(t storage.DeviceToken) (err error) {
 	return
 }
 
-func (s *memStorage) GetDeviceToken(deviceCode string) (t storage.DeviceToken, err error) {
+func (s *memStorage) GetDeviceToken(ctx context.Context, deviceCode string) (t storage.DeviceToken, err error) {
 	s.tx(func() {
 		var ok bool
 		if t, ok = s.deviceTokens[deviceCode]; !ok {
@@ -525,7 +666,7 @@ func (s *memStorage) GetDeviceToken(deviceCode string) (t storage.DeviceToken, e
 	return
 }
 
-func (s *memStorage) UpdateDeviceToken(deviceCode string, updater func(p storage.DeviceToken) (storage.DeviceToken, error)) (err error) {
+func (s *memStorage) UpdateDeviceToken(ctx context.Context, deviceCode string, updater func(p storage.DeviceToken) (storage.DeviceToken, error)) (err error) {
 	s.tx(func() {
 		r, ok := s.deviceTokens[deviceCode]
 		if !ok {
diff --git a/storage/memory/memory_test.go b/storage/memory/memory_test.go
index 84a8826ef2..acd0be1b74 100644
--- a/storage/memory/memory_test.go
+++ b/storage/memory/memory_test.go
@@ -1,24 +1,19 @@
 package memory
 
 import (
-	"os"
+	"log/slog"
 	"testing"
 
-	"github.com/sirupsen/logrus"
-
 	"github.com/dexidp/dex/storage"
 	"github.com/dexidp/dex/storage/conformance"
 )
 
 func TestStorage(t *testing.T) {
-	logger := &logrus.Logger{
-		Out:       os.Stderr,
-		Formatter: &logrus.TextFormatter{DisableColors: true},
-		Level:     logrus.DebugLevel,
-	}
+	newStorage := func(t *testing.T) storage.Storage {
+		logger := slog.New(slog.NewTextHandler(t.Output(), &slog.HandlerOptions{Level: slog.LevelDebug}))
 
-	newStorage := func() storage.Storage {
 		return New(logger)
 	}
 	conformance.RunTests(t, newStorage)
+	conformance.RunConcurrencyTests(t, newStorage)
 }
diff --git a/storage/memory/static_test.go b/storage/memory/static_test.go
index 8513e0ee89..49e0b28496 100644
--- a/storage/memory/static_test.go
+++ b/storage/memory/static_test.go
@@ -1,29 +1,25 @@
 package memory
 
 import (
+	"context"
 	"fmt"
-	"os"
+	"log/slog"
 	"strings"
 	"testing"
 
-	"github.com/sirupsen/logrus"
-
 	"github.com/dexidp/dex/storage"
 )
 
 func TestStaticClients(t *testing.T) {
-	logger := &logrus.Logger{
-		Out:       os.Stderr,
-		Formatter: &logrus.TextFormatter{DisableColors: true},
-		Level:     logrus.DebugLevel,
-	}
+	ctx := context.Background()
+	logger := slog.New(slog.DiscardHandler)
 	backing := New(logger)
 
 	c1 := storage.Client{ID: "foo", Secret: "foo_secret"}
 	c2 := storage.Client{ID: "bar", Secret: "bar_secret"}
 	c3 := storage.Client{ID: "spam", Secret: "spam_secret"}
 
-	backing.CreateClient(c1)
+	backing.CreateClient(ctx, c1)
 	s := storage.WithStaticClients(backing, []storage.Client{c2})
 
 	tests := []struct {
@@ -34,14 +30,14 @@ func TestStaticClients(t *testing.T) {
 		{
 			name: "get client from static storage",
 			action: func() error {
-				_, err := s.GetClient(c2.ID)
+				_, err := s.GetClient(ctx, c2.ID)
 				return err
 			},
 		},
 		{
 			name: "get client from backing storage",
 			action: func() error {
-				_, err := s.GetClient(c1.ID)
+				_, err := s.GetClient(ctx, c1.ID)
 				return err
 			},
 		},
@@ -52,7 +48,7 @@ func TestStaticClients(t *testing.T) {
 					c.Secret = "new_" + c.Secret
 					return c, nil
 				}
-				return s.UpdateClient(c2.ID, updater)
+				return s.UpdateClient(ctx, c2.ID, updater)
 			},
 			wantErr: true,
 		},
@@ -63,13 +59,13 @@ func TestStaticClients(t *testing.T) {
 					c.Secret = "new_" + c.Secret
 					return c, nil
 				}
-				return s.UpdateClient(c1.ID, updater)
+				return s.UpdateClient(ctx, c1.ID, updater)
 			},
 		},
 		{
 			name: "list clients",
 			action: func() error {
-				clients, err := s.ListClients()
+				clients, err := s.ListClients(ctx)
 				if err != nil {
 					return err
 				}
@@ -82,7 +78,7 @@ func TestStaticClients(t *testing.T) {
 		{
 			name: "create client",
 			action: func() error {
-				return s.CreateClient(c3)
+				return s.CreateClient(ctx, c3)
 			},
 		},
 	}
@@ -99,11 +95,8 @@ func TestStaticClients(t *testing.T) {
 }
 
 func TestStaticPasswords(t *testing.T) {
-	logger := &logrus.Logger{
-		Out:       os.Stderr,
-		Formatter: &logrus.TextFormatter{DisableColors: true},
-		Level:     logrus.DebugLevel,
-	}
+	ctx := context.Background()
+	logger := slog.New(slog.DiscardHandler)
 	backing := New(logger)
 
 	p1 := storage.Password{Email: "foo@example.com", Username: "foo_secret"}
@@ -111,7 +104,7 @@ func TestStaticPasswords(t *testing.T) {
 	p3 := storage.Password{Email: "spam@example.com", Username: "spam_secret"}
 	p4 := storage.Password{Email: "Spam@example.com", Username: "Spam_secret"}
 
-	backing.CreatePassword(p1)
+	backing.CreatePassword(ctx, p1)
 	s := storage.WithStaticPasswords(backing, []storage.Password{p2}, logger)
 
 	tests := []struct {
@@ -122,21 +115,21 @@ func TestStaticPasswords(t *testing.T) {
 		{
 			name: "get password from static storage",
 			action: func() error {
-				_, err := s.GetPassword(p2.Email)
+				_, err := s.GetPassword(ctx, p2.Email)
 				return err
 			},
 		},
 		{
 			name: "get password from backing storage",
 			action: func() error {
-				_, err := s.GetPassword(p1.Email)
+				_, err := s.GetPassword(ctx, p1.Email)
 				return err
 			},
 		},
 		{
 			name: "get password from static storage with casing",
 			action: func() error {
-				_, err := s.GetPassword(strings.ToUpper(p2.Email))
+				_, err := s.GetPassword(ctx, strings.ToUpper(p2.Email))
 				return err
 			},
 		},
@@ -147,7 +140,7 @@ func TestStaticPasswords(t *testing.T) {
 					p.Username = "new_" + p.Username
 					return p, nil
 				}
-				return s.UpdatePassword(p2.Email, updater)
+				return s.UpdatePassword(ctx, p2.Email, updater)
 			},
 			wantErr: true,
 		},
@@ -158,23 +151,23 @@ func TestStaticPasswords(t *testing.T) {
 					p.Username = "new_" + p.Username
 					return p, nil
 				}
-				return s.UpdatePassword(p1.Email, updater)
+				return s.UpdatePassword(ctx, p1.Email, updater)
 			},
 		},
 		{
 			name: "create passwords",
 			action: func() error {
-				if err := s.CreatePassword(p4); err != nil {
+				if err := s.CreatePassword(ctx, p4); err != nil {
 					return err
 				}
-				return s.CreatePassword(p3)
+				return s.CreatePassword(ctx, p3)
 			},
 			wantErr: true,
 		},
 		{
 			name: "get password",
 			action: func() error {
-				p, err := s.GetPassword(p4.Email)
+				p, err := s.GetPassword(ctx, p4.Email)
 				if err != nil {
 					return err
 				}
@@ -187,7 +180,7 @@ func TestStaticPasswords(t *testing.T) {
 		{
 			name: "list passwords",
 			action: func() error {
-				passwords, err := s.ListPasswords()
+				passwords, err := s.ListPasswords(ctx)
 				if err != nil {
 					return err
 				}
@@ -211,11 +204,8 @@ func TestStaticPasswords(t *testing.T) {
 }
 
 func TestStaticConnectors(t *testing.T) {
-	logger := &logrus.Logger{
-		Out:       os.Stderr,
-		Formatter: &logrus.TextFormatter{DisableColors: true},
-		Level:     logrus.DebugLevel,
-	}
+	ctx := context.Background()
+	logger := slog.New(slog.DiscardHandler)
 	backing := New(logger)
 
 	config1 := []byte(`{"issuer": "https://accounts.google.com"}`)
@@ -226,7 +216,7 @@ func TestStaticConnectors(t *testing.T) {
 	c2 := storage.Connector{ID: storage.NewID(), Type: "ldap", Name: "ldap", ResourceVersion: "1", Config: config2}
 	c3 := storage.Connector{ID: storage.NewID(), Type: "saml", Name: "saml", ResourceVersion: "1", Config: config3}
 
-	backing.CreateConnector(c1)
+	backing.CreateConnector(ctx, c1)
 	s := storage.WithStaticConnectors(backing, []storage.Connector{c2})
 
 	tests := []struct {
@@ -237,14 +227,14 @@ func TestStaticConnectors(t *testing.T) {
 		{
 			name: "get connector from static storage",
 			action: func() error {
-				_, err := s.GetConnector(c2.ID)
+				_, err := s.GetConnector(ctx, c2.ID)
 				return err
 			},
 		},
 		{
 			name: "get connector from backing storage",
 			action: func() error {
-				_, err := s.GetConnector(c1.ID)
+				_, err := s.GetConnector(ctx, c1.ID)
 				return err
 			},
 		},
@@ -255,7 +245,7 @@ func TestStaticConnectors(t *testing.T) {
 					c.Name = "New"
 					return c, nil
 				}
-				return s.UpdateConnector(c2.ID, updater)
+				return s.UpdateConnector(ctx, c2.ID, updater)
 			},
 			wantErr: true,
 		},
@@ -266,13 +256,13 @@ func TestStaticConnectors(t *testing.T) {
 					c.Name = "New"
 					return c, nil
 				}
-				return s.UpdateConnector(c1.ID, updater)
+				return s.UpdateConnector(ctx, c1.ID, updater)
 			},
 		},
 		{
 			name: "list connectors",
 			action: func() error {
-				connectors, err := s.ListConnectors()
+				connectors, err := s.ListConnectors(ctx)
 				if err != nil {
 					return err
 				}
@@ -285,7 +275,7 @@ func TestStaticConnectors(t *testing.T) {
 		{
 			name: "create connector",
 			action: func() error {
-				return s.CreateConnector(c3)
+				return s.CreateConnector(ctx, c3)
 			},
 		},
 	}
diff --git a/storage/sql/config.go b/storage/sql/config.go
index 1aedf04cae..602e7f8a7a 100644
--- a/storage/sql/config.go
+++ b/storage/sql/config.go
@@ -5,6 +5,7 @@ import (
 	"crypto/x509"
 	"database/sql"
 	"fmt"
+	"log/slog"
 	"net"
 	"os"
 	"regexp"
@@ -15,7 +16,6 @@ import (
 	"github.com/go-sql-driver/mysql"
 	"github.com/lib/pq"
 
-	"github.com/dexidp/dex/pkg/log"
 	"github.com/dexidp/dex/storage"
 )
 
@@ -31,7 +31,6 @@ const (
 	mysqlErrUnknownSysVar       = 1193
 )
 
-// nolint
 const (
 	// postgres SSL modes
 	pgSSLDisable    = "disable"
@@ -40,7 +39,6 @@ const (
 	pgSSLVerifyFull = "verify-full"
 )
 
-// nolint
 const (
 	// MySQL SSL modes
 	mysqlSSLTrue       = "true"
@@ -80,11 +78,11 @@ type SSL struct {
 type Postgres struct {
 	NetworkDB
 
-	SSL SSL `json:"ssl" yaml:"ssl"`
+	SSL SSL `json:"ssl"`
 }
 
 // Open creates a new storage implementation backed by Postgres.
-func (p *Postgres) Open(logger log.Logger) (storage.Storage, error) {
+func (p *Postgres) Open(logger *slog.Logger) (storage.Storage, error) {
 	conn, err := p.open(logger)
 	if err != nil {
 		return nil, err
@@ -164,7 +162,7 @@ func (p *Postgres) createDataSourceName() string {
 	return strings.Join(parameters, " ")
 }
 
-func (p *Postgres) open(logger log.Logger) (*conn, error) {
+func (p *Postgres) open(logger *slog.Logger) (*conn, error) {
 	dataSourceName := p.createDataSourceName()
 
 	db, err := sql.Open("postgres", dataSourceName)
@@ -208,7 +206,7 @@ func (p *Postgres) open(logger log.Logger) (*conn, error) {
 type MySQL struct {
 	NetworkDB
 
-	SSL SSL `json:"ssl" yaml:"ssl"`
+	SSL SSL `json:"ssl"`
 
 	// TODO(pborzenkov): used by tests to reduce lock wait timeout. Should
 	// we make it exported and allow users to provide arbitrary params?
@@ -216,7 +214,7 @@ type MySQL struct {
 }
 
 // Open creates a new storage implementation backed by MySQL.
-func (s *MySQL) Open(logger log.Logger) (storage.Storage, error) {
+func (s *MySQL) Open(logger *slog.Logger) (storage.Storage, error) {
 	conn, err := s.open(logger)
 	if err != nil {
 		return nil, err
@@ -224,7 +222,7 @@ func (s *MySQL) Open(logger log.Logger) (storage.Storage, error) {
 	return conn, nil
 }
 
-func (s *MySQL) open(logger log.Logger) (*conn, error) {
+func (s *MySQL) open(logger *slog.Logger) (*conn, error) {
 	cfg := mysql.Config{
 		User:                 s.User,
 		Passwd:               s.Password,
@@ -274,7 +272,7 @@ func (s *MySQL) open(logger log.Logger) (*conn, error) {
 	}
 
 	if s.MaxIdleConns == 0 {
-		/*Override default behaviour to fix https://github.com/dexidp/dex/issues/1608*/
+		/*Override default behavior to fix https://github.com/dexidp/dex/issues/1608*/
 		db.SetMaxIdleConns(0)
 	} else {
 		db.SetMaxIdleConns(s.MaxIdleConns)
diff --git a/storage/sql/config_test.go b/storage/sql/config_test.go
index 1178728c1a..c098919b0c 100644
--- a/storage/sql/config_test.go
+++ b/storage/sql/config_test.go
@@ -2,15 +2,13 @@ package sql
 
 import (
 	"fmt"
+	"log/slog"
 	"os"
 	"runtime"
 	"strconv"
 	"testing"
 	"time"
 
-	"github.com/sirupsen/logrus"
-
-	"github.com/dexidp/dex/pkg/log"
 	"github.com/dexidp/dex/storage"
 	"github.com/dexidp/dex/storage/conformance"
 )
@@ -48,24 +46,19 @@ func cleanDB(c *conn) error {
 	return nil
 }
 
-var logger = &logrus.Logger{
-	Out:       os.Stderr,
-	Formatter: &logrus.TextFormatter{DisableColors: true},
-	Level:     logrus.DebugLevel,
-}
-
 type opener interface {
-	open(logger log.Logger) (*conn, error)
+	open(logger *slog.Logger) (*conn, error)
 }
 
-func testDB(t *testing.T, o opener, withTransactions bool) {
+func testDB(t *testing.T, o opener, withTransactions, withConcurrentTests bool) {
 	// t.Fatal has a bad habit of not actually printing the error
-	fatal := func(i interface{}) {
+	fatal := func(i any) {
 		fmt.Fprintln(os.Stdout, i)
 		t.Fatal(i)
 	}
 
-	newStorage := func() storage.Storage {
+	newStorage := func(t *testing.T) storage.Storage {
+		logger := slog.New(slog.NewTextHandler(t.Output(), &slog.HandlerOptions{Level: slog.LevelDebug}))
 		conn, err := o.open(logger)
 		if err != nil {
 			fatal(err)
@@ -78,11 +71,18 @@ func testDB(t *testing.T, o opener, withTransactions bool) {
 	withTimeout(time.Minute*1, func() {
 		conformance.RunTests(t, newStorage)
 	})
+
 	if withTransactions {
 		withTimeout(time.Minute*1, func() {
 			conformance.RunTransactionTests(t, newStorage)
 		})
 	}
+
+	if withConcurrentTests {
+		withTimeout(time.Minute*1, func() {
+			conformance.RunConcurrencyTests(t, newStorage)
+		})
+	}
 }
 
 func getenv(key, defaultVal string) string {
@@ -243,7 +243,7 @@ func TestPostgres(t *testing.T) {
 			Mode: pgSSLDisable, // Postgres container doesn't support SSL.
 		},
 	}
-	testDB(t, p, true)
+	testDB(t, p, true, false)
 }
 
 const testMySQLEnv = "DEX_MYSQL_HOST"
@@ -280,5 +280,42 @@ func TestMySQL(t *testing.T) {
 			"innodb_lock_wait_timeout": "3",
 		},
 	}
-	testDB(t, s, true)
+	testDB(t, s, true, false)
+}
+
+const testMySQL8Env = "DEX_MYSQL8_HOST"
+
+func TestMySQL8(t *testing.T) {
+	host := os.Getenv(testMySQL8Env)
+	if host == "" {
+		t.Skipf("test environment variable %q not set, skipping", testMySQL8Env)
+	}
+
+	port := uint64(3306)
+	if rawPort := os.Getenv("DEX_MYSQL8_PORT"); rawPort != "" {
+		var err error
+
+		port, err = strconv.ParseUint(rawPort, 10, 32)
+		if err != nil {
+			t.Fatalf("invalid mysql port %q: %s", rawPort, err)
+		}
+	}
+
+	s := &MySQL{
+		NetworkDB: NetworkDB{
+			Database:          getenv("DEX_MYSQL8_DATABASE", "mysql"),
+			User:              getenv("DEX_MYSQL8_USER", "mysql"),
+			Password:          getenv("DEX_MYSQL8_PASSWORD", "mysql"),
+			Host:              host,
+			Port:              uint16(port),
+			ConnectionTimeout: 5,
+		},
+		SSL: SSL{
+			Mode: mysqlSSLFalse,
+		},
+		params: map[string]string{
+			"innodb_lock_wait_timeout": "3",
+		},
+	}
+	testDB(t, s, true, false)
 }
diff --git a/storage/sql/crud.go b/storage/sql/crud.go
index ac67bf288c..3a82260ff9 100644
--- a/storage/sql/crud.go
+++ b/storage/sql/crud.go
@@ -1,6 +1,7 @@
 package sql
 
 import (
+	"context"
 	"database/sql"
 	"database/sql/driver"
 	"encoding/json"
@@ -21,19 +22,18 @@ const keysRowID = "keys"
 // encoder wraps the underlying value in a JSON marshaler which is automatically
 // called by the database/sql package.
 //
-//		s := []string{"planes", "bears"}
-//		err := db.Exec(`insert into t1 (id, things) values (1, $1)`, encoder(s))
-//		if err != nil {
-//			// handle error
-//		}
-//
-//		var r []byte
-//		err = db.QueryRow(`select things from t1 where id = 1;`).Scan(&r)
-//		if err != nil {
-//			// handle error
-//		}
-//		fmt.Printf("%s\n", r) // ["planes","bears"]
+//	s := []string{"planes", "bears"}
+//	err := db.Exec(`insert into t1 (id, things) values (1, $1)`, encoder(s))
+//	if err != nil {
+//		// handle error
+//	}
 //
+//	var r []byte
+//	err = db.QueryRow(`select things from t1 where id = 1;`).Scan(&r)
+//	if err != nil {
+//		// handle error
+//	}
+//	fmt.Printf("%s\n", r) // ["planes","bears"]
 func encoder(i interface{}) driver.Valuer {
 	return jsonEncoder{i}
 }
@@ -84,7 +84,9 @@ type scanner interface {
 	Scan(dest ...interface{}) error
 }
 
-func (c *conn) GarbageCollect(now time.Time) (storage.GCResult, error) {
+var _ storage.Storage = (*conn)(nil)
+
+func (c *conn) GarbageCollect(ctc context.Context, now time.Time) (storage.GCResult, error) {
 	result := storage.GCResult{}
 
 	r, err := c.Exec(`delete from auth_request where expiry < $1`, now)
@@ -119,10 +121,18 @@ func (c *conn) GarbageCollect(now time.Time) (storage.GCResult, error) {
 		result.DeviceTokens = n
 	}
 
-	return result, err
+	r, err = c.Exec(`delete from auth_session where absolute_expiry < $1 OR idle_expiry < $2`, now, now)
+	if err != nil {
+		return result, fmt.Errorf("gc auth_session: %v", err)
+	}
+	if n, err := r.RowsAffected(); err == nil {
+		result.AuthSessions = n
+	}
+
+	return result, nil
 }
 
-func (c *conn) CreateAuthRequest(a storage.AuthRequest) error {
+func (c *conn) CreateAuthRequest(ctx context.Context, a storage.AuthRequest) error {
 	_, err := c.Exec(`
 		insert into auth_request (
 			id, client_id, response_types, scopes, redirect_uri, nonce, state,
@@ -131,10 +141,14 @@ func (c *conn) CreateAuthRequest(a storage.AuthRequest) error {
 			claims_email, claims_email_verified, claims_groups,
 			connector_id, connector_data,
 			expiry,
-			code_challenge, code_challenge_method
+			code_challenge, code_challenge_method,
+			hmac_key,
+			mfa_validated,
+			webauthn_session_data,
+			prompt, max_age, auth_time
 		)
 		values (
-			$1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14, $15, $16, $17, $18, $19, $20
+			$1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14, $15, $16, $17, $18, $19, $20, $21, $22, $23, $24, $25, $26
 		);
 	`,
 		a.ID, a.ClientID, encoder(a.ResponseTypes), encoder(a.Scopes), a.RedirectURI, a.Nonce, a.State,
@@ -144,6 +158,10 @@ func (c *conn) CreateAuthRequest(a storage.AuthRequest) error {
 		a.ConnectorID, a.ConnectorData,
 		a.Expiry,
 		a.PKCE.CodeChallenge, a.PKCE.CodeChallengeMethod,
+		a.HMACKey,
+		a.MFAValidated,
+		a.WebAuthnSessionData,
+		a.Prompt, a.MaxAge, a.AuthTime,
 	)
 	if err != nil {
 		if c.alreadyExistsCheck(err) {
@@ -154,9 +172,9 @@ func (c *conn) CreateAuthRequest(a storage.AuthRequest) error {
 	return nil
 }
 
-func (c *conn) UpdateAuthRequest(id string, updater func(a storage.AuthRequest) (storage.AuthRequest, error)) error {
+func (c *conn) UpdateAuthRequest(ctx context.Context, id string, updater func(a storage.AuthRequest) (storage.AuthRequest, error)) error {
 	return c.ExecTx(func(tx *trans) error {
-		r, err := getAuthRequest(tx, id)
+		r, err := getAuthRequest(ctx, tx, id)
 		if err != nil {
 			return err
 		}
@@ -175,8 +193,12 @@ func (c *conn) UpdateAuthRequest(id string, updater func(a storage.AuthRequest)
 				claims_groups = $14,
 				connector_id = $15, connector_data = $16,
 				expiry = $17,
-				code_challenge = $18, code_challenge_method = $19
-			where id = $20;
+				code_challenge = $18, code_challenge_method = $19,
+				hmac_key = $20,
+				mfa_validated = $21,
+				webauthn_session_data = $22,
+				prompt = $23, max_age = $24, auth_time = $25
+			where id = $26;
 		`,
 			a.ClientID, encoder(a.ResponseTypes), encoder(a.Scopes), a.RedirectURI, a.Nonce, a.State,
 			a.ForceApprovalPrompt, a.LoggedIn,
@@ -185,7 +207,10 @@ func (c *conn) UpdateAuthRequest(id string, updater func(a storage.AuthRequest)
 			encoder(a.Claims.Groups),
 			a.ConnectorID, a.ConnectorData,
 			a.Expiry,
-			a.PKCE.CodeChallenge, a.PKCE.CodeChallengeMethod,
+			a.PKCE.CodeChallenge, a.PKCE.CodeChallengeMethod, a.HMACKey,
+			a.MFAValidated,
+			a.WebAuthnSessionData,
+			a.Prompt, a.MaxAge, a.AuthTime,
 			r.ID,
 		)
 		if err != nil {
@@ -195,11 +220,11 @@ func (c *conn) UpdateAuthRequest(id string, updater func(a storage.AuthRequest)
 	})
 }
 
-func (c *conn) GetAuthRequest(id string) (storage.AuthRequest, error) {
-	return getAuthRequest(c, id)
+func (c *conn) GetAuthRequest(ctx context.Context, id string) (storage.AuthRequest, error) {
+	return getAuthRequest(ctx, c, id)
 }
 
-func getAuthRequest(q querier, id string) (a storage.AuthRequest, err error) {
+func getAuthRequest(ctx context.Context, q querier, id string) (a storage.AuthRequest, err error) {
 	err = q.QueryRow(`
 		select
 			id, client_id, response_types, scopes, redirect_uri, nonce, state,
@@ -207,7 +232,10 @@ func getAuthRequest(q querier, id string) (a storage.AuthRequest, err error) {
 			claims_user_id, claims_username, claims_preferred_username,
 			claims_email, claims_email_verified, claims_groups,
 			connector_id, connector_data, expiry,
-			code_challenge, code_challenge_method
+			code_challenge, code_challenge_method, hmac_key,
+			mfa_validated,
+			webauthn_session_data,
+			prompt, max_age, auth_time
 		from auth_request where id = $1;
 	`, id).Scan(
 		&a.ID, &a.ClientID, decoder(&a.ResponseTypes), decoder(&a.Scopes), &a.RedirectURI, &a.Nonce, &a.State,
@@ -216,7 +244,10 @@ func getAuthRequest(q querier, id string) (a storage.AuthRequest, err error) {
 		&a.Claims.Email, &a.Claims.EmailVerified,
 		decoder(&a.Claims.Groups),
 		&a.ConnectorID, &a.ConnectorData, &a.Expiry,
-		&a.PKCE.CodeChallenge, &a.PKCE.CodeChallengeMethod,
+		&a.PKCE.CodeChallenge, &a.PKCE.CodeChallengeMethod, &a.HMACKey,
+		&a.MFAValidated,
+		&a.WebAuthnSessionData,
+		&a.Prompt, &a.MaxAge, &a.AuthTime,
 	)
 	if err != nil {
 		if err == sql.ErrNoRows {
@@ -227,7 +258,7 @@ func getAuthRequest(q querier, id string) (a storage.AuthRequest, err error) {
 	return a, nil
 }
 
-func (c *conn) CreateAuthCode(a storage.AuthCode) error {
+func (c *conn) CreateAuthCode(ctx context.Context, a storage.AuthCode) error {
 	_, err := c.Exec(`
 		insert into auth_code (
 			id, client_id, scopes, nonce, redirect_uri,
@@ -235,14 +266,16 @@ func (c *conn) CreateAuthCode(a storage.AuthCode) error {
 			claims_email, claims_email_verified, claims_groups,
 			connector_id, connector_data,
 			expiry,
-			code_challenge, code_challenge_method
+			code_challenge, code_challenge_method,
+			auth_time, session_id
 		)
-		values ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14, $15, $16);
+		values ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14, $15, $16, $17, $18);
 	`,
 		a.ID, a.ClientID, encoder(a.Scopes), a.Nonce, a.RedirectURI, a.Claims.UserID,
 		a.Claims.Username, a.Claims.PreferredUsername, a.Claims.Email, a.Claims.EmailVerified,
 		encoder(a.Claims.Groups), a.ConnectorID, a.ConnectorData, a.Expiry,
 		a.PKCE.CodeChallenge, a.PKCE.CodeChallengeMethod,
+		a.AuthTime, a.SessionID,
 	)
 	if err != nil {
 		if c.alreadyExistsCheck(err) {
@@ -253,7 +286,7 @@ func (c *conn) CreateAuthCode(a storage.AuthCode) error {
 	return nil
 }
 
-func (c *conn) GetAuthCode(id string) (a storage.AuthCode, err error) {
+func (c *conn) GetAuthCode(ctx context.Context, id string) (a storage.AuthCode, err error) {
 	err = c.QueryRow(`
 		select
 			id, client_id, scopes, nonce, redirect_uri,
@@ -261,13 +294,15 @@ func (c *conn) GetAuthCode(id string) (a storage.AuthCode, err error) {
 			claims_email, claims_email_verified, claims_groups,
 			connector_id, connector_data,
 			expiry,
-			code_challenge, code_challenge_method
+			code_challenge, code_challenge_method,
+			auth_time, session_id
 		from auth_code where id = $1;
 	`, id).Scan(
 		&a.ID, &a.ClientID, decoder(&a.Scopes), &a.Nonce, &a.RedirectURI, &a.Claims.UserID,
 		&a.Claims.Username, &a.Claims.PreferredUsername, &a.Claims.Email, &a.Claims.EmailVerified,
 		decoder(&a.Claims.Groups), &a.ConnectorID, &a.ConnectorData, &a.Expiry,
 		&a.PKCE.CodeChallenge, &a.PKCE.CodeChallengeMethod,
+		&a.AuthTime, &a.SessionID,
 	)
 	if err != nil {
 		if err == sql.ErrNoRows {
@@ -278,7 +313,7 @@ func (c *conn) GetAuthCode(id string) (a storage.AuthCode, err error) {
 	return a, nil
 }
 
-func (c *conn) CreateRefresh(r storage.RefreshToken) error {
+func (c *conn) CreateRefresh(ctx context.Context, r storage.RefreshToken) error {
 	_, err := c.Exec(`
 		insert into refresh_token (
 			id, client_id, scopes, nonce,
@@ -305,9 +340,9 @@ func (c *conn) CreateRefresh(r storage.RefreshToken) error {
 	return nil
 }
 
-func (c *conn) UpdateRefreshToken(id string, updater func(old storage.RefreshToken) (storage.RefreshToken, error)) error {
+func (c *conn) UpdateRefreshToken(ctx context.Context, id string, updater func(old storage.RefreshToken) (storage.RefreshToken, error)) error {
 	return c.ExecTx(func(tx *trans) error {
-		r, err := getRefresh(tx, id)
+		r, err := getRefresh(ctx, tx, id)
 		if err != nil {
 			return err
 		}
@@ -349,11 +384,11 @@ func (c *conn) UpdateRefreshToken(id string, updater func(old storage.RefreshTok
 	})
 }
 
-func (c *conn) GetRefresh(id string) (storage.RefreshToken, error) {
-	return getRefresh(c, id)
+func (c *conn) GetRefresh(ctx context.Context, id string) (storage.RefreshToken, error) {
+	return getRefresh(ctx, c, id)
 }
 
-func getRefresh(q querier, id string) (storage.RefreshToken, error) {
+func getRefresh(ctx context.Context, q querier, id string) (storage.RefreshToken, error) {
 	return scanRefresh(q.QueryRow(`
 		select
 			id, client_id, scopes, nonce,
@@ -366,7 +401,7 @@ func getRefresh(q querier, id string) (storage.RefreshToken, error) {
 	`, id))
 }
 
-func (c *conn) ListRefreshTokens() ([]storage.RefreshToken, error) {
+func (c *conn) ListRefreshTokens(ctx context.Context) ([]storage.RefreshToken, error) {
 	rows, err := c.Query(`
 		select
 			id, client_id, scopes, nonce,
@@ -413,12 +448,12 @@ func scanRefresh(s scanner) (r storage.RefreshToken, err error) {
 	return r, nil
 }
 
-func (c *conn) UpdateKeys(updater func(old storage.Keys) (storage.Keys, error)) error {
+func (c *conn) UpdateKeys(ctx context.Context, updater func(old storage.Keys) (storage.Keys, error)) error {
 	return c.ExecTx(func(tx *trans) error {
 		firstUpdate := false
 		// TODO(ericchiang): errors may cause a transaction be rolled back by the SQL
 		// server. Test this, and consider adding a COUNT() command beforehand.
-		old, err := getKeys(tx)
+		old, err := getKeys(ctx, tx)
 		if err != nil {
 			if err != storage.ErrNotFound {
 				return fmt.Errorf("get keys: %v", err)
@@ -466,11 +501,11 @@ func (c *conn) UpdateKeys(updater func(old storage.Keys) (storage.Keys, error))
 	})
 }
 
-func (c *conn) GetKeys() (keys storage.Keys, err error) {
-	return getKeys(c)
+func (c *conn) GetKeys(ctx context.Context) (keys storage.Keys, err error) {
+	return getKeys(ctx, c)
 }
 
-func getKeys(q querier) (keys storage.Keys, err error) {
+func getKeys(ctx context.Context, q querier) (keys storage.Keys, err error) {
 	err = q.QueryRow(`
 		select
 			verification_keys, signing_key, signing_key_pub, next_rotation
@@ -489,9 +524,9 @@ func getKeys(q querier) (keys storage.Keys, err error) {
 	return keys, nil
 }
 
-func (c *conn) UpdateClient(id string, updater func(old storage.Client) (storage.Client, error)) error {
+func (c *conn) UpdateClient(ctx context.Context, id string, updater func(old storage.Client) (storage.Client, error)) error {
 	return c.ExecTx(func(tx *trans) error {
-		cli, err := getClient(tx, id)
+		cli, err := getClient(ctx, tx, id)
 		if err != nil {
 			return err
 		}
@@ -508,9 +543,15 @@ func (c *conn) UpdateClient(id string, updater func(old storage.Client) (storage
 				trusted_peers = $3,
 				public = $4,
 				name = $5,
-				logo_url = $6
-			where id = $7;
-		`, nc.Secret, encoder(nc.RedirectURIs), encoder(nc.TrustedPeers), nc.Public, nc.Name, nc.LogoURL, id,
+				logo_url = $6,
+				allowed_connectors = $7,
+				mfa_chain = $8,
+				post_logout_redirect_uris = $9,
+				sso_shared_with = $10,
+				backchannel_logout_uri = $11,
+				refresh_token_lifetime = $12
+			where id = $13;
+		`, nc.Secret, encoder(nc.RedirectURIs), encoder(nc.TrustedPeers), nc.Public, nc.Name, nc.LogoURL, encoder(nc.AllowedConnectors), encoder(nc.MFAChain), encoder(nc.PostLogoutRedirectURIs), encoder(nc.SSOSharedWith), nc.BackchannelLogoutURI, nc.RefreshTokenLifetime, id,
 		)
 		if err != nil {
 			return fmt.Errorf("update client: %v", err)
@@ -519,15 +560,15 @@ func (c *conn) UpdateClient(id string, updater func(old storage.Client) (storage
 	})
 }
 
-func (c *conn) CreateClient(cli storage.Client) error {
+func (c *conn) CreateClient(ctx context.Context, cli storage.Client) error {
 	_, err := c.Exec(`
 		insert into client (
-			id, secret, redirect_uris, trusted_peers, public, name, logo_url
+			id, secret, redirect_uris, trusted_peers, public, name, logo_url, allowed_connectors, mfa_chain, post_logout_redirect_uris, sso_shared_with, backchannel_logout_uri, refresh_token_lifetime
 		)
-		values ($1, $2, $3, $4, $5, $6, $7);
+		values ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13);
 	`,
 		cli.ID, cli.Secret, encoder(cli.RedirectURIs), encoder(cli.TrustedPeers),
-		cli.Public, cli.Name, cli.LogoURL,
+		cli.Public, cli.Name, cli.LogoURL, encoder(cli.AllowedConnectors), encoder(cli.MFAChain), encoder(cli.PostLogoutRedirectURIs), encoder(cli.SSOSharedWith), cli.BackchannelLogoutURI, cli.RefreshTokenLifetime,
 	)
 	if err != nil {
 		if c.alreadyExistsCheck(err) {
@@ -538,22 +579,22 @@ func (c *conn) CreateClient(cli storage.Client) error {
 	return nil
 }
 
-func getClient(q querier, id string) (storage.Client, error) {
+func getClient(ctx context.Context, q querier, id string) (storage.Client, error) {
 	return scanClient(q.QueryRow(`
 		select
-			id, secret, redirect_uris, trusted_peers, public, name, logo_url
+			id, secret, redirect_uris, trusted_peers, public, name, logo_url, allowed_connectors, mfa_chain, post_logout_redirect_uris, sso_shared_with, backchannel_logout_uri, refresh_token_lifetime
 	    from client where id = $1;
 	`, id))
 }
 
-func (c *conn) GetClient(id string) (storage.Client, error) {
-	return getClient(c, id)
+func (c *conn) GetClient(ctx context.Context, id string) (storage.Client, error) {
+	return getClient(ctx, c, id)
 }
 
-func (c *conn) ListClients() ([]storage.Client, error) {
+func (c *conn) ListClients(ctx context.Context) ([]storage.Client, error) {
 	rows, err := c.Query(`
 		select
-			id, secret, redirect_uris, trusted_peers, public, name, logo_url
+			id, secret, redirect_uris, trusted_peers, public, name, logo_url, allowed_connectors, mfa_chain, post_logout_redirect_uris, sso_shared_with, backchannel_logout_uri, refresh_token_lifetime
 		from client;
 	`)
 	if err != nil {
@@ -576,9 +617,13 @@ func (c *conn) ListClients() ([]storage.Client, error) {
 }
 
 func scanClient(s scanner) (cli storage.Client, err error) {
+	var allowedConnectors []byte
+	var mfaChain []byte
+	var postLogoutRedirectURIs []byte
+	var ssoSharedWith []byte
 	err = s.Scan(
 		&cli.ID, &cli.Secret, decoder(&cli.RedirectURIs), decoder(&cli.TrustedPeers),
-		&cli.Public, &cli.Name, &cli.LogoURL,
+		&cli.Public, &cli.Name, &cli.LogoURL, &allowedConnectors, &mfaChain, &postLogoutRedirectURIs, &ssoSharedWith, &cli.BackchannelLogoutURI, &cli.RefreshTokenLifetime,
 	)
 	if err != nil {
 		if err == sql.ErrNoRows {
@@ -586,20 +631,40 @@ func scanClient(s scanner) (cli storage.Client, err error) {
 		}
 		return cli, fmt.Errorf("get client: %v", err)
 	}
+	if len(allowedConnectors) > 0 {
+		if err := json.Unmarshal(allowedConnectors, &cli.AllowedConnectors); err != nil {
+			return cli, fmt.Errorf("unmarshal client allowed connectors: %v", err)
+		}
+	}
+	if len(mfaChain) > 0 {
+		if err := json.Unmarshal(mfaChain, &cli.MFAChain); err != nil {
+			return cli, fmt.Errorf("unmarshal client mfa chain: %v", err)
+		}
+	}
+	if len(postLogoutRedirectURIs) > 0 {
+		if err := json.Unmarshal(postLogoutRedirectURIs, &cli.PostLogoutRedirectURIs); err != nil {
+			return cli, fmt.Errorf("unmarshal client post logout redirect uris: %v", err)
+		}
+	}
+	if len(ssoSharedWith) > 0 {
+		if err := json.Unmarshal(ssoSharedWith, &cli.SSOSharedWith); err != nil {
+			return cli, fmt.Errorf("unmarshal client sso shared with: %v", err)
+		}
+	}
 	return cli, nil
 }
 
-func (c *conn) CreatePassword(p storage.Password) error {
+func (c *conn) CreatePassword(ctx context.Context, p storage.Password) error {
 	p.Email = strings.ToLower(p.Email)
 	_, err := c.Exec(`
 		insert into password (
-			email, hash, username, user_id
+			email, hash, username, preferred_username, user_id, groups, name, email_verified
 		)
 		values (
-			$1, $2, $3, $4
+			$1, $2, $3, $4, $5, $6, $7, $8
 		);
 	`,
-		p.Email, p.Hash, p.Username, p.UserID,
+		p.Email, p.Hash, p.Username, p.PreferredUsername, p.UserID, encoder(p.Groups), p.Name, p.EmailVerified,
 	)
 	if err != nil {
 		if c.alreadyExistsCheck(err) {
@@ -610,9 +675,9 @@ func (c *conn) CreatePassword(p storage.Password) error {
 	return nil
 }
 
-func (c *conn) UpdatePassword(email string, updater func(p storage.Password) (storage.Password, error)) error {
+func (c *conn) UpdatePassword(ctx context.Context, email string, updater func(p storage.Password) (storage.Password, error)) error {
 	return c.ExecTx(func(tx *trans) error {
-		p, err := getPassword(tx, email)
+		p, err := getPassword(ctx, tx, email)
 		if err != nil {
 			return err
 		}
@@ -624,10 +689,10 @@ func (c *conn) UpdatePassword(email string, updater func(p storage.Password) (st
 		_, err = tx.Exec(`
 			update password
 			set
-				hash = $1, username = $2, user_id = $3
-			where email = $4;
+				hash = $1, username = $2, preferred_username = $3, user_id = $4, groups = $5, name = $6, email_verified = $7
+			where email = $8;
 		`,
-			np.Hash, np.Username, np.UserID, p.Email,
+			np.Hash, np.Username, np.PreferredUsername, np.UserID, encoder(np.Groups), np.Name, np.EmailVerified, p.Email,
 		)
 		if err != nil {
 			return fmt.Errorf("update password: %v", err)
@@ -636,22 +701,22 @@ func (c *conn) UpdatePassword(email string, updater func(p storage.Password) (st
 	})
 }
 
-func (c *conn) GetPassword(email string) (storage.Password, error) {
-	return getPassword(c, email)
+func (c *conn) GetPassword(ctx context.Context, email string) (storage.Password, error) {
+	return getPassword(ctx, c, email)
 }
 
-func getPassword(q querier, email string) (p storage.Password, err error) {
+func getPassword(ctx context.Context, q querier, email string) (p storage.Password, err error) {
 	return scanPassword(q.QueryRow(`
 		select
-			email, hash, username, user_id
+			email, hash, username, preferred_username, user_id, groups, name, email_verified
 		from password where email = $1;
 	`, strings.ToLower(email)))
 }
 
-func (c *conn) ListPasswords() ([]storage.Password, error) {
+func (c *conn) ListPasswords(ctx context.Context) ([]storage.Password, error) {
 	rows, err := c.Query(`
 		select
-			email, hash, username, user_id
+			email, hash, username, preferred_username, user_id, groups, name, email_verified
 		from password;
 	`)
 	if err != nil {
@@ -674,8 +739,9 @@ func (c *conn) ListPasswords() ([]storage.Password, error) {
 }
 
 func scanPassword(s scanner) (p storage.Password, err error) {
+	var emailVerified sql.NullBool
 	err = s.Scan(
-		&p.Email, &p.Hash, &p.Username, &p.UserID,
+		&p.Email, &p.Hash, &p.Username, &p.PreferredUsername, &p.UserID, decoder(&p.Groups), &p.Name, &emailVerified,
 	)
 	if err != nil {
 		if err == sql.ErrNoRows {
@@ -683,10 +749,13 @@ func scanPassword(s scanner) (p storage.Password, err error) {
 		}
 		return p, fmt.Errorf("select password: %v", err)
 	}
+	if emailVerified.Valid {
+		p.EmailVerified = &emailVerified.Bool
+	}
 	return p, nil
 }
 
-func (c *conn) CreateOfflineSessions(s storage.OfflineSessions) error {
+func (c *conn) CreateOfflineSessions(ctx context.Context, s storage.OfflineSessions) error {
 	_, err := c.Exec(`
 		insert into offline_session (
 			user_id, conn_id, refresh, connector_data
@@ -706,9 +775,9 @@ func (c *conn) CreateOfflineSessions(s storage.OfflineSessions) error {
 	return nil
 }
 
-func (c *conn) UpdateOfflineSessions(userID string, connID string, updater func(s storage.OfflineSessions) (storage.OfflineSessions, error)) error {
+func (c *conn) UpdateOfflineSessions(ctx context.Context, userID string, connID string, updater func(s storage.OfflineSessions) (storage.OfflineSessions, error)) error {
 	return c.ExecTx(func(tx *trans) error {
-		s, err := getOfflineSessions(tx, userID, connID)
+		s, err := getOfflineSessions(ctx, tx, userID, connID)
 		if err != nil {
 			return err
 		}
@@ -733,11 +802,11 @@ func (c *conn) UpdateOfflineSessions(userID string, connID string, updater func(
 	})
 }
 
-func (c *conn) GetOfflineSessions(userID string, connID string) (storage.OfflineSessions, error) {
-	return getOfflineSessions(c, userID, connID)
+func (c *conn) GetOfflineSessions(ctx context.Context, userID string, connID string) (storage.OfflineSessions, error) {
+	return getOfflineSessions(ctx, c, userID, connID)
 }
 
-func getOfflineSessions(q querier, userID string, connID string) (storage.OfflineSessions, error) {
+func getOfflineSessions(ctx context.Context, q querier, userID string, connID string) (storage.OfflineSessions, error) {
 	return scanOfflineSessions(q.QueryRow(`
 		select
 			user_id, conn_id, refresh, connector_data
@@ -759,16 +828,334 @@ func scanOfflineSessions(s scanner) (o storage.OfflineSessions, err error) {
 	return o, nil
 }
 
-func (c *conn) CreateConnector(connector storage.Connector) error {
+func (c *conn) CreateUserIdentity(ctx context.Context, u storage.UserIdentity) error {
 	_, err := c.Exec(`
+		insert into user_identity (
+			user_id, connector_id,
+			claims_user_id, claims_username, claims_preferred_username,
+			claims_email, claims_email_verified, claims_groups,
+			consents, mfa_secrets, webauthn_credentials,
+			created_at, last_login, blocked_until
+		)
+		values (
+			$1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14
+		);
+	`,
+		u.UserID, u.ConnectorID,
+		u.Claims.UserID, u.Claims.Username, u.Claims.PreferredUsername,
+		u.Claims.Email, u.Claims.EmailVerified, encoder(u.Claims.Groups),
+		encoder(u.Consents), encoder(u.MFASecrets), encoder(u.WebAuthnCredentials),
+		u.CreatedAt, u.LastLogin, u.BlockedUntil,
+	)
+	if err != nil {
+		if c.alreadyExistsCheck(err) {
+			return storage.ErrAlreadyExists
+		}
+		return fmt.Errorf("insert user identity: %v", err)
+	}
+	return nil
+}
+
+func (c *conn) UpdateUserIdentity(ctx context.Context, userID, connectorID string, updater func(u storage.UserIdentity) (storage.UserIdentity, error)) error {
+	return c.ExecTx(func(tx *trans) error {
+		u, err := getUserIdentity(ctx, tx, userID, connectorID)
+		if err != nil {
+			return err
+		}
+
+		newIdentity, err := updater(u)
+		if err != nil {
+			return err
+		}
+		_, err = tx.Exec(`
+			update user_identity
+			set
+				claims_user_id = $1,
+				claims_username = $2,
+				claims_preferred_username = $3,
+				claims_email = $4,
+				claims_email_verified = $5,
+				claims_groups = $6,
+				consents = $7,
+				mfa_secrets = $8,
+				webauthn_credentials = $9,
+				created_at = $10,
+				last_login = $11,
+				blocked_until = $12
+			where user_id = $13 AND connector_id = $14;
+		`,
+			newIdentity.Claims.UserID, newIdentity.Claims.Username, newIdentity.Claims.PreferredUsername,
+			newIdentity.Claims.Email, newIdentity.Claims.EmailVerified, encoder(newIdentity.Claims.Groups),
+			encoder(newIdentity.Consents), encoder(newIdentity.MFASecrets), encoder(newIdentity.WebAuthnCredentials),
+			newIdentity.CreatedAt, newIdentity.LastLogin, newIdentity.BlockedUntil,
+			u.UserID, u.ConnectorID,
+		)
+		if err != nil {
+			return fmt.Errorf("update user identity: %v", err)
+		}
+		return nil
+	})
+}
+
+func (c *conn) GetUserIdentity(ctx context.Context, userID, connectorID string) (storage.UserIdentity, error) {
+	return getUserIdentity(ctx, c, userID, connectorID)
+}
+
+func getUserIdentity(ctx context.Context, q querier, userID, connectorID string) (storage.UserIdentity, error) {
+	return scanUserIdentity(q.QueryRow(`
+		select
+			user_id, connector_id,
+			claims_user_id, claims_username, claims_preferred_username,
+			claims_email, claims_email_verified, claims_groups,
+			consents, mfa_secrets, webauthn_credentials,
+			created_at, last_login, blocked_until
+		from user_identity
+		where user_id = $1 AND connector_id = $2;
+		`, userID, connectorID))
+}
+
+func (c *conn) ListUserIdentities(ctx context.Context) ([]storage.UserIdentity, error) {
+	rows, err := c.Query(`
+		select
+			user_id, connector_id,
+			claims_user_id, claims_username, claims_preferred_username,
+			claims_email, claims_email_verified, claims_groups,
+			consents, mfa_secrets, webauthn_credentials,
+			created_at, last_login, blocked_until
+		from user_identity;
+	`)
+	if err != nil {
+		return nil, fmt.Errorf("query: %v", err)
+	}
+	defer rows.Close()
+
+	var identities []storage.UserIdentity
+	for rows.Next() {
+		u, err := scanUserIdentity(rows)
+		if err != nil {
+			return nil, err
+		}
+		identities = append(identities, u)
+	}
+	if err := rows.Err(); err != nil {
+		return nil, fmt.Errorf("scan: %v", err)
+	}
+	return identities, nil
+}
+
+func scanUserIdentity(s scanner) (u storage.UserIdentity, err error) {
+	var mfaSecrets, webauthnCreds []byte
+	err = s.Scan(
+		&u.UserID, &u.ConnectorID,
+		&u.Claims.UserID, &u.Claims.Username, &u.Claims.PreferredUsername,
+		&u.Claims.Email, &u.Claims.EmailVerified, decoder(&u.Claims.Groups),
+		decoder(&u.Consents), &mfaSecrets, &webauthnCreds,
+		&u.CreatedAt, &u.LastLogin, &u.BlockedUntil,
+	)
+	if err != nil {
+		if err == sql.ErrNoRows {
+			return u, storage.ErrNotFound
+		}
+		return u, fmt.Errorf("select user identity: %v", err)
+	}
+	if u.Consents == nil {
+		u.Consents = make(map[string][]string)
+	}
+	if len(mfaSecrets) > 0 {
+		if err := json.Unmarshal(mfaSecrets, &u.MFASecrets); err != nil {
+			return u, fmt.Errorf("unmarshal user identity mfa secrets: %v", err)
+		}
+	}
+	if len(webauthnCreds) > 0 {
+		if err := json.Unmarshal(webauthnCreds, &u.WebAuthnCredentials); err != nil {
+			return u, fmt.Errorf("unmarshal user identity webauthn credentials: %v", err)
+		}
+	}
+	return u, nil
+}
+
+func (c *conn) DeleteUserIdentity(ctx context.Context, userID, connectorID string) error {
+	result, err := c.Exec(`delete from user_identity where user_id = $1 AND connector_id = $2`, userID, connectorID)
+	if err != nil {
+		return fmt.Errorf("delete user_identity: user_id = %s, connector_id = %s: %w", userID, connectorID, err)
+	}
+
+	// For now mandate that the driver implements RowsAffected. If we ever need to support
+	// a driver that doesn't implement this, we can run this in a transaction with a get beforehand.
+	n, err := result.RowsAffected()
+	if err != nil {
+		return fmt.Errorf("rows affected: %v", err)
+	}
+	if n < 1 {
+		return storage.ErrNotFound
+	}
+	return nil
+}
+
+func (c *conn) CreateAuthSession(ctx context.Context, s storage.AuthSession) error {
+	_, err := c.Exec(`
+		insert into auth_session (
+			id, secret, user_id, connector_id,
+			client_states,
+			created_at, last_activity,
+			ip_address, user_agent,
+			absolute_expiry, idle_expiry,
+			logout_state
+		)
+		values ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12);
+	`,
+		s.ID, s.Secret, s.UserID, s.ConnectorID,
+		encoder(s.ClientStates),
+		s.CreatedAt, s.LastActivity,
+		s.IPAddress, s.UserAgent,
+		s.AbsoluteExpiry, s.IdleExpiry,
+		encoder(s.LogoutState),
+	)
+	if err != nil {
+		if c.alreadyExistsCheck(err) {
+			return storage.ErrAlreadyExists
+		}
+		return fmt.Errorf("insert auth session: %v", err)
+	}
+	return nil
+}
+
+func (c *conn) UpdateAuthSession(ctx context.Context, id string, updater func(s storage.AuthSession) (storage.AuthSession, error)) error {
+	return c.ExecTx(func(tx *trans) error {
+		s, err := getAuthSession(ctx, tx, id)
+		if err != nil {
+			return err
+		}
+
+		newSession, err := updater(s)
+		if err != nil {
+			return err
+		}
+		_, err = tx.Exec(`
+			update auth_session
+			set
+				client_states = $1,
+				last_activity = $2,
+				ip_address = $3,
+				user_agent = $4,
+				idle_expiry = $5,
+				logout_state = $6
+			where id = $7;
+		`,
+			encoder(newSession.ClientStates),
+			newSession.LastActivity,
+			newSession.IPAddress, newSession.UserAgent,
+			newSession.IdleExpiry,
+			encoder(newSession.LogoutState),
+			id,
+		)
+		if err != nil {
+			return fmt.Errorf("update auth session: %v", err)
+		}
+		return nil
+	})
+}
+
+func (c *conn) GetAuthSession(ctx context.Context, id string) (storage.AuthSession, error) {
+	return getAuthSession(ctx, c, id)
+}
+
+const authSessionColumns = `
+	id, secret, user_id, connector_id,
+	client_states,
+	created_at, last_activity,
+	ip_address, user_agent,
+	absolute_expiry, idle_expiry,
+	logout_state
+`
+
+func getAuthSession(ctx context.Context, q querier, id string) (storage.AuthSession, error) {
+	return scanAuthSession(q.QueryRow(`
+		select `+authSessionColumns+`
+		from auth_session
+		where id = $1;
+	`, id))
+}
+
+func scanAuthSession(s scanner) (session storage.AuthSession, err error) {
+	var logoutState []byte
+	err = s.Scan(
+		&session.ID, &session.Secret, &session.UserID, &session.ConnectorID,
+		decoder(&session.ClientStates),
+		&session.CreatedAt, &session.LastActivity,
+		&session.IPAddress, &session.UserAgent,
+		&session.AbsoluteExpiry, &session.IdleExpiry,
+		&logoutState,
+	)
+	if err != nil {
+		if err == sql.ErrNoRows {
+			return session, storage.ErrNotFound
+		}
+		return session, fmt.Errorf("select auth session: %v", err)
+	}
+	if session.ClientStates == nil {
+		session.ClientStates = make(map[string]*storage.ClientAuthState)
+	}
+	if len(logoutState) > 0 && string(logoutState) != "null" {
+		session.LogoutState = new(storage.LogoutState)
+		if err := json.Unmarshal(logoutState, session.LogoutState); err != nil {
+			return session, fmt.Errorf("unmarshal auth session logout state: %v", err)
+		}
+	}
+	return session, nil
+}
+
+func (c *conn) ListAuthSessions(ctx context.Context) ([]storage.AuthSession, error) {
+	rows, err := c.Query(`select ` + authSessionColumns + ` from auth_session;`)
+	if err != nil {
+		return nil, fmt.Errorf("query: %v", err)
+	}
+	defer rows.Close()
+
+	var sessions []storage.AuthSession
+	for rows.Next() {
+		s, err := scanAuthSession(rows)
+		if err != nil {
+			return nil, err
+		}
+		sessions = append(sessions, s)
+	}
+	if err := rows.Err(); err != nil {
+		return nil, fmt.Errorf("scan: %v", err)
+	}
+	return sessions, nil
+}
+
+func (c *conn) DeleteAuthSession(ctx context.Context, id string) error {
+	result, err := c.Exec(`delete from auth_session where id = $1`, id)
+	if err != nil {
+		return fmt.Errorf("delete auth_session: id = %s: %w", id, err)
+	}
+
+	n, err := result.RowsAffected()
+	if err != nil {
+		return fmt.Errorf("rows affected: %v", err)
+	}
+	if n < 1 {
+		return storage.ErrNotFound
+	}
+	return nil
+}
+
+func (c *conn) CreateConnector(ctx context.Context, connector storage.Connector) error {
+	grantTypes, err := json.Marshal(connector.GrantTypes)
+	if err != nil {
+		return fmt.Errorf("marshal connector grant types: %v", err)
+	}
+	_, err = c.Exec(`
 		insert into connector (
-			id, type, name, resource_version, config
+			id, type, name, resource_version, config, grant_types
 		)
 		values (
-			$1, $2, $3, $4, $5
+			$1, $2, $3, $4, $5, $6
 		);
 	`,
-		connector.ID, connector.Type, connector.Name, connector.ResourceVersion, connector.Config,
+		connector.ID, connector.Type, connector.Name, connector.ResourceVersion, connector.Config, grantTypes,
 	)
 	if err != nil {
 		if c.alreadyExistsCheck(err) {
@@ -779,9 +1166,9 @@ func (c *conn) CreateConnector(connector storage.Connector) error {
 	return nil
 }
 
-func (c *conn) UpdateConnector(id string, updater func(s storage.Connector) (storage.Connector, error)) error {
+func (c *conn) UpdateConnector(ctx context.Context, id string, updater func(s storage.Connector) (storage.Connector, error)) error {
 	return c.ExecTx(func(tx *trans) error {
-		connector, err := getConnector(tx, id)
+		connector, err := getConnector(ctx, tx, id)
 		if err != nil {
 			return err
 		}
@@ -790,16 +1177,21 @@ func (c *conn) UpdateConnector(id string, updater func(s storage.Connector) (sto
 		if err != nil {
 			return err
 		}
+		grantTypes, err := json.Marshal(newConn.GrantTypes)
+		if err != nil {
+			return fmt.Errorf("marshal connector grant types: %v", err)
+		}
 		_, err = tx.Exec(`
 			update connector
 			set
 			    type = $1,
 			    name = $2,
 			    resource_version = $3,
-			    config = $4
-			where id = $5;
+			    config = $4,
+			    grant_types = $5
+			where id = $6;
 		`,
-			newConn.Type, newConn.Name, newConn.ResourceVersion, newConn.Config, connector.ID,
+			newConn.Type, newConn.Name, newConn.ResourceVersion, newConn.Config, grantTypes, connector.ID,
 		)
 		if err != nil {
 			return fmt.Errorf("update connector: %v", err)
@@ -808,22 +1200,23 @@ func (c *conn) UpdateConnector(id string, updater func(s storage.Connector) (sto
 	})
 }
 
-func (c *conn) GetConnector(id string) (storage.Connector, error) {
-	return getConnector(c, id)
+func (c *conn) GetConnector(ctx context.Context, id string) (storage.Connector, error) {
+	return getConnector(ctx, c, id)
 }
 
-func getConnector(q querier, id string) (storage.Connector, error) {
+func getConnector(ctx context.Context, q querier, id string) (storage.Connector, error) {
 	return scanConnector(q.QueryRow(`
 		select
-			id, type, name, resource_version, config
+			id, type, name, resource_version, config, grant_types
 		from connector
 		where id = $1;
 		`, id))
 }
 
 func scanConnector(s scanner) (c storage.Connector, err error) {
+	var grantTypes []byte
 	err = s.Scan(
-		&c.ID, &c.Type, &c.Name, &c.ResourceVersion, &c.Config,
+		&c.ID, &c.Type, &c.Name, &c.ResourceVersion, &c.Config, &grantTypes,
 	)
 	if err != nil {
 		if err == sql.ErrNoRows {
@@ -831,13 +1224,18 @@ func scanConnector(s scanner) (c storage.Connector, err error) {
 		}
 		return c, fmt.Errorf("select connector: %v", err)
 	}
+	if len(grantTypes) > 0 {
+		if err := json.Unmarshal(grantTypes, &c.GrantTypes); err != nil {
+			return c, fmt.Errorf("unmarshal connector grant types: %v", err)
+		}
+	}
 	return c, nil
 }
 
-func (c *conn) ListConnectors() ([]storage.Connector, error) {
+func (c *conn) ListConnectors(ctx context.Context) ([]storage.Connector, error) {
 	rows, err := c.Query(`
 		select
-			id, type, name, resource_version, config
+			id, type, name, resource_version, config, grant_types
 		from connector;
 	`)
 	if err != nil {
@@ -859,16 +1257,31 @@ func (c *conn) ListConnectors() ([]storage.Connector, error) {
 	return connectors, nil
 }
 
-func (c *conn) DeleteAuthRequest(id string) error { return c.delete("auth_request", "id", id) }
-func (c *conn) DeleteAuthCode(id string) error    { return c.delete("auth_code", "id", id) }
-func (c *conn) DeleteClient(id string) error      { return c.delete("client", "id", id) }
-func (c *conn) DeleteRefresh(id string) error     { return c.delete("refresh_token", "id", id) }
-func (c *conn) DeletePassword(email string) error {
+func (c *conn) DeleteAuthRequest(ctx context.Context, id string) error {
+	return c.delete("auth_request", "id", id)
+}
+
+func (c *conn) DeleteAuthCode(ctx context.Context, id string) error {
+	return c.delete("auth_code", "id", id)
+}
+
+func (c *conn) DeleteClient(ctx context.Context, id string) error {
+	return c.delete("client", "id", id)
+}
+
+func (c *conn) DeleteRefresh(ctx context.Context, id string) error {
+	return c.delete("refresh_token", "id", id)
+}
+
+func (c *conn) DeletePassword(ctx context.Context, email string) error {
 	return c.delete("password", "email", strings.ToLower(email))
 }
-func (c *conn) DeleteConnector(id string) error { return c.delete("connector", "id", id) }
 
-func (c *conn) DeleteOfflineSessions(userID string, connID string) error {
+func (c *conn) DeleteConnector(ctx context.Context, id string) error {
+	return c.delete("connector", "id", id)
+}
+
+func (c *conn) DeleteOfflineSessions(ctx context.Context, userID string, connID string) error {
 	result, err := c.Exec(`delete from offline_session where user_id = $1 AND conn_id = $2`, userID, connID)
 	if err != nil {
 		return fmt.Errorf("delete offline_session: user_id = %s, conn_id = %s", userID, connID)
@@ -905,7 +1318,7 @@ func (c *conn) delete(table, field, id string) error {
 	return nil
 }
 
-func (c *conn) CreateDeviceRequest(d storage.DeviceRequest) error {
+func (c *conn) CreateDeviceRequest(ctx context.Context, d storage.DeviceRequest) error {
 	_, err := c.Exec(`
 		insert into device_request (
 			user_code, device_code, client_id, client_secret, scopes, expiry
@@ -924,7 +1337,7 @@ func (c *conn) CreateDeviceRequest(d storage.DeviceRequest) error {
 	return nil
 }
 
-func (c *conn) CreateDeviceToken(t storage.DeviceToken) error {
+func (c *conn) CreateDeviceToken(ctx context.Context, t storage.DeviceToken) error {
 	_, err := c.Exec(`
 		insert into device_token (
 			device_code, status, token, expiry, last_request, poll_interval, code_challenge, code_challenge_method
@@ -943,11 +1356,11 @@ func (c *conn) CreateDeviceToken(t storage.DeviceToken) error {
 	return nil
 }
 
-func (c *conn) GetDeviceRequest(userCode string) (storage.DeviceRequest, error) {
-	return getDeviceRequest(c, userCode)
+func (c *conn) GetDeviceRequest(ctx context.Context, userCode string) (storage.DeviceRequest, error) {
+	return getDeviceRequest(ctx, c, userCode)
 }
 
-func getDeviceRequest(q querier, userCode string) (d storage.DeviceRequest, err error) {
+func getDeviceRequest(ctx context.Context, q querier, userCode string) (d storage.DeviceRequest, err error) {
 	err = q.QueryRow(`
 		select
             device_code, client_id, client_secret, scopes, expiry
@@ -965,11 +1378,11 @@ func getDeviceRequest(q querier, userCode string) (d storage.DeviceRequest, err
 	return d, nil
 }
 
-func (c *conn) GetDeviceToken(deviceCode string) (storage.DeviceToken, error) {
-	return getDeviceToken(c, deviceCode)
+func (c *conn) GetDeviceToken(ctx context.Context, deviceCode string) (storage.DeviceToken, error) {
+	return getDeviceToken(ctx, c, deviceCode)
 }
 
-func getDeviceToken(q querier, deviceCode string) (a storage.DeviceToken, err error) {
+func getDeviceToken(ctx context.Context, q querier, deviceCode string) (a storage.DeviceToken, err error) {
 	err = q.QueryRow(`
 		select
             status, token, expiry, last_request, poll_interval, code_challenge, code_challenge_method
@@ -987,9 +1400,9 @@ func getDeviceToken(q querier, deviceCode string) (a storage.DeviceToken, err er
 	return a, nil
 }
 
-func (c *conn) UpdateDeviceToken(deviceCode string, updater func(old storage.DeviceToken) (storage.DeviceToken, error)) error {
+func (c *conn) UpdateDeviceToken(ctx context.Context, deviceCode string, updater func(old storage.DeviceToken) (storage.DeviceToken, error)) error {
 	return c.ExecTx(func(tx *trans) error {
-		r, err := getDeviceToken(tx, deviceCode)
+		r, err := getDeviceToken(ctx, tx, deviceCode)
 		if err != nil {
 			return err
 		}
@@ -999,7 +1412,7 @@ func (c *conn) UpdateDeviceToken(deviceCode string, updater func(old storage.Dev
 		_, err = tx.Exec(`
 			update device_token
 			set
-				status = $1, 
+				status = $1,
 				token = $2,
 				last_request = $3,
 				poll_interval = $4,
diff --git a/storage/sql/migrate.go b/storage/sql/migrate.go
index 57720e17f1..1b7619b77e 100644
--- a/storage/sql/migrate.go
+++ b/storage/sql/migrate.go
@@ -291,4 +291,220 @@ var migrations = []migration{
 				add column code_challenge_method text not null default '';`,
 		},
 	},
+	{
+		stmts: []string{
+			`
+			alter table auth_request
+				add column hmac_key bytea;`,
+		},
+	},
+	{
+		stmts: []string{
+			`
+			alter table password
+				add column preferred_username text not null default '';`,
+			`
+			alter table password
+				add column groups bytea not null default convert_to('[]', 'UTF8');`,
+		},
+		flavor: &flavorPostgres,
+	},
+	{
+		stmts: []string{
+			`
+			alter table password
+				add column preferred_username text not null default '';`,
+			`
+			alter table password
+				add column groups bytea not null default '[]';`,
+		},
+		flavor: &flavorSQLite3,
+	},
+	{
+		stmts: []string{
+			`
+			alter table password
+				add column preferred_username text not null default '';`,
+			`
+			alter table password
+				add column groups bytea;`,
+			`
+			update password
+				set groups = '[]'
+				where groups is null;`,
+			`
+			alter table password
+				modify column groups bytea not null;`,
+		},
+		flavor: &flavorMySQL,
+	},
+	// Migration for adding name and email_verified to password table (Postgres)
+	{
+		stmts: []string{
+			`
+			alter table password
+				add column name text not null default '';`,
+			`
+			alter table password
+				add column email_verified boolean;`,
+		},
+		flavor: &flavorPostgres,
+	},
+	// Migration for adding name and email_verified to password table (SQLite3)
+	{
+		stmts: []string{
+			`
+			alter table password
+				add column name text not null default '';`,
+			`
+			alter table password
+				add column email_verified boolean;`,
+		},
+		flavor: &flavorSQLite3,
+	},
+	// Migration for adding name and email_verified to password table (MySQL)
+	{
+		stmts: []string{
+			`
+			alter table password
+				add column name text not null default '';`,
+			`
+			alter table password
+				add column email_verified boolean;`,
+		},
+		flavor: &flavorMySQL,
+	},
+	{
+		stmts: []string{
+			`
+			alter table connector
+				add column grant_types bytea;`,
+		},
+	},
+	// Migration for adding allowed_connectors to client table
+	{
+		stmts: []string{
+			`
+			alter table client
+				add column allowed_connectors bytea;`,
+		},
+	},
+	{
+		stmts: []string{
+			`
+			create table user_identity (
+				user_id text not null,
+				connector_id text not null,
+				claims_user_id text not null,
+				claims_username text not null,
+				claims_preferred_username text not null default '',
+				claims_email text not null,
+				claims_email_verified boolean not null,
+				claims_groups bytea not null,
+				consents bytea not null,
+				created_at timestamptz not null,
+				last_login timestamptz not null,
+				blocked_until timestamptz not null,
+				PRIMARY KEY (user_id, connector_id)
+			);`,
+		},
+	},
+	{
+		stmts: []string{
+			`
+			create table auth_session (
+				user_id text not null,
+				connector_id text not null,
+				nonce text not null default '',
+				client_states bytea not null,
+				created_at timestamptz not null,
+				last_activity timestamptz not null,
+				ip_address text not null default '',
+				user_agent text not null default '',
+				PRIMARY KEY (user_id, connector_id)
+			);`,
+		},
+	},
+	{
+		stmts: []string{
+			`
+			alter table auth_request
+				add column mfa_validated boolean not null default false;`,
+			`
+			alter table user_identity
+				add column mfa_secrets bytea;`,
+			`
+			alter table client
+				add column mfa_chain bytea;`,
+			`alter table auth_request add column prompt text not null default '';`,
+			`alter table auth_request add column max_age integer not null default -1;`,
+			`alter table auth_request add column auth_time timestamptz not null default '1970-01-01 00:00:00';`,
+			`alter table auth_code add column auth_time timestamptz not null default '1970-01-01 00:00:00';`,
+		},
+	},
+	{
+		stmts: []string{
+			`
+			alter table auth_session
+				add column absolute_expiry timestamptz not null default '1970-01-01 00:00:00';`,
+			`
+			alter table auth_session
+				add column idle_expiry timestamptz not null default '1970-01-01 00:00:00';`,
+			`alter table client add column post_logout_redirect_uris bytea;`,
+			`alter table auth_session add column logout_state bytea;`,
+		},
+	},
+	{
+		stmts: []string{
+			`alter table auth_request add column webauthn_session_data bytea;`,
+			`alter table user_identity add column webauthn_credentials bytea;`,
+		},
+	},
+	{
+		stmts: []string{
+			`
+			alter table client
+				add column sso_shared_with bytea;`,
+		},
+	},
+	{
+		stmts: []string{
+			`
+			alter table client
+				add column backchannel_logout_uri text not null default '';`,
+			`
+			alter table client
+				add column refresh_token_lifetime text not null default '';`,
+		},
+	},
+	{
+		// A session is keyed by its own id now, not by the user and connector it
+		// belongs to, so the table is rebuilt rather than altered: the primary key
+		// changes and the nonce is replaced by a secret the cookie carries.
+		//
+		// Rebuilt and not edited in place further up, because migrations are applied
+		// by number and never re-read: a database that already ran that step would
+		// otherwise never see these columns. Signed-in users are signed out once,
+		// which is what an unreleased session feature costs to reshape.
+		stmts: []string{
+			`drop table if exists auth_session;`,
+			`
+			create table auth_session (
+				id text not null primary key,
+				secret text not null default '',
+				user_id text not null,
+				connector_id text not null,
+				client_states bytea not null,
+				created_at timestamptz not null,
+				last_activity timestamptz not null,
+				ip_address text not null default '',
+				user_agent text not null default '',
+				absolute_expiry timestamptz not null default '1970-01-01 00:00:00',
+				idle_expiry timestamptz not null default '1970-01-01 00:00:00',
+				logout_state bytea
+			);`,
+			`create index auth_session_user_idx on auth_session (user_id, connector_id);`,
+			`alter table auth_code add column session_id text not null default '';`,
+		},
+	},
 }
diff --git a/storage/sql/migrate_test.go b/storage/sql/migrate_test.go
index 4b77eb2fbe..707da5433a 100644
--- a/storage/sql/migrate_test.go
+++ b/storage/sql/migrate_test.go
@@ -5,11 +5,10 @@ package sql
 
 import (
 	"database/sql"
-	"os"
+	"log/slog"
 	"testing"
 
 	sqlite3 "github.com/mattn/go-sqlite3"
-	"github.com/sirupsen/logrus"
 )
 
 func TestMigrate(t *testing.T) {
@@ -19,11 +18,7 @@ func TestMigrate(t *testing.T) {
 	}
 	defer db.Close()
 
-	logger := &logrus.Logger{
-		Out:       os.Stderr,
-		Formatter: &logrus.TextFormatter{DisableColors: true},
-		Level:     logrus.DebugLevel,
-	}
+	logger := slog.New(slog.DiscardHandler)
 
 	errCheck := func(err error) bool {
 		sqlErr, ok := err.(sqlite3.Error)
diff --git a/storage/sql/postgres_test.go b/storage/sql/postgres_test.go
index 3e5f8a8f65..085c068a93 100644
--- a/storage/sql/postgres_test.go
+++ b/storage/sql/postgres_test.go
@@ -4,6 +4,7 @@
 package sql
 
 import (
+	"log/slog"
 	"os"
 	"strconv"
 	"testing"
@@ -40,6 +41,7 @@ func TestPostgresTunables(t *testing.T) {
 
 	t.Run("with nothing set, uses defaults", func(t *testing.T) {
 		cfg := *baseCfg
+		logger := slog.New(slog.NewTextHandler(t.Output(), &slog.HandlerOptions{Level: slog.LevelDebug}))
 		c, err := cfg.open(logger)
 		if err != nil {
 			t.Fatalf("error opening connector: %s", err.Error())
@@ -53,6 +55,7 @@ func TestPostgresTunables(t *testing.T) {
 	t.Run("with something set, uses that", func(t *testing.T) {
 		cfg := *baseCfg
 		cfg.MaxOpenConns = 101
+		logger := slog.New(slog.NewTextHandler(t.Output(), &slog.HandlerOptions{Level: slog.LevelDebug}))
 		c, err := cfg.open(logger)
 		if err != nil {
 			t.Fatalf("error opening connector: %s", err.Error())
diff --git a/storage/sql/sql.go b/storage/sql/sql.go
index 0a29216936..1965f5ff25 100644
--- a/storage/sql/sql.go
+++ b/storage/sql/sql.go
@@ -3,14 +3,13 @@ package sql
 
 import (
 	"database/sql"
+	"log/slog"
 	"regexp"
 	"time"
 
 	// import third party drivers
 	_ "github.com/lib/pq"
 	_ "github.com/mattn/go-sqlite3"
-
-	"github.com/dexidp/dex/pkg/log"
 )
 
 // flavor represents a specific SQL implementation, and is used to translate query strings
@@ -96,7 +95,7 @@ var (
 			// For compound indexes (with two keys) even less.
 			{matchLiteral("text"), "varchar(384)"},
 			// Quote keywords and reserved words used as identifiers.
-			{regexp.MustCompile(`\b(keys)\b`), "`$1`"},
+			{regexp.MustCompile(`\b(keys|groups)\b`), "`$1`"},
 			// Change default timestamp to fit datetime.
 			{regexp.MustCompile(`0001-01-01 00:00:00 UTC`), "1000-01-01 00:00:00"},
 		},
@@ -131,7 +130,7 @@ func (c *conn) translateArgs(args []interface{}) []interface{} {
 type conn struct {
 	db                 *sql.DB
 	flavor             *flavor
-	logger             log.Logger
+	logger             *slog.Logger
 	alreadyExistsCheck func(err error) bool
 }
 
diff --git a/storage/sql/sqlite.go b/storage/sql/sqlite.go
index 43df671a7c..2d29e607dc 100644
--- a/storage/sql/sqlite.go
+++ b/storage/sql/sqlite.go
@@ -6,10 +6,10 @@ package sql
 import (
 	"database/sql"
 	"fmt"
+	"log/slog"
 
 	sqlite3 "github.com/mattn/go-sqlite3"
 
-	"github.com/dexidp/dex/pkg/log"
 	"github.com/dexidp/dex/storage"
 )
 
@@ -20,7 +20,7 @@ type SQLite3 struct {
 }
 
 // Open creates a new storage implementation backed by SQLite3
-func (s *SQLite3) Open(logger log.Logger) (storage.Storage, error) {
+func (s *SQLite3) Open(logger *slog.Logger) (storage.Storage, error) {
 	conn, err := s.open(logger)
 	if err != nil {
 		return nil, err
@@ -28,7 +28,7 @@ func (s *SQLite3) Open(logger log.Logger) (storage.Storage, error) {
 	return conn, nil
 }
 
-func (s *SQLite3) open(logger log.Logger) (*conn, error) {
+func (s *SQLite3) open(logger *slog.Logger) (*conn, error) {
 	db, err := sql.Open("sqlite3", s.File)
 	if err != nil {
 		return nil, err
diff --git a/storage/sql/sqlite_no_cgo.go b/storage/sql/sqlite_no_cgo.go
new file mode 100644
index 0000000000..80d1410825
--- /dev/null
+++ b/storage/sql/sqlite_no_cgo.go
@@ -0,0 +1,19 @@
+//go:build !cgo
+// +build !cgo
+
+// This is a stub for the no CGO compilation (CGO_ENABLED=0)
+
+package sql
+
+import (
+	"fmt"
+	"log/slog"
+
+	"github.com/dexidp/dex/storage"
+)
+
+type SQLite3 struct{}
+
+func (s *SQLite3) Open(logger *slog.Logger) (storage.Storage, error) {
+	return nil, fmt.Errorf("SQLite storage is not available: binary compiled without CGO support. Recompile with CGO_ENABLED=1 or use a different storage backend.")
+}
diff --git a/storage/sql/sqlite_test.go b/storage/sql/sqlite_test.go
index 89d06aee29..e21cbcc26c 100644
--- a/storage/sql/sqlite_test.go
+++ b/storage/sql/sqlite_test.go
@@ -8,5 +8,5 @@ import (
 )
 
 func TestSQLite3(t *testing.T) {
-	testDB(t, &SQLite3{":memory:"}, false)
+	testDB(t, &SQLite3{":memory:"}, false, true)
 }
diff --git a/storage/static.go b/storage/static.go
index 806b61f9cd..386b2b2883 100644
--- a/storage/static.go
+++ b/storage/static.go
@@ -1,10 +1,10 @@
 package storage
 
 import (
+	"context"
 	"errors"
+	"log/slog"
 	"strings"
-
-	"github.com/dexidp/dex/pkg/log"
 )
 
 // Tests for this code are in the "memory" package, since this package doesn't
@@ -31,11 +31,11 @@ func WithStaticClients(s Storage, staticClients []Client) Storage {
 	return staticClientsStorage{s, staticClients, clientsByID}
 }
 
-func (s staticClientsStorage) GetClient(id string) (Client, error) {
+func (s staticClientsStorage) GetClient(ctx context.Context, id string) (Client, error) {
 	if client, ok := s.clientsByID[id]; ok {
 		return client, nil
 	}
-	return s.Storage.GetClient(id)
+	return s.Storage.GetClient(ctx, id)
 }
 
 func (s staticClientsStorage) isStatic(id string) bool {
@@ -43,8 +43,8 @@ func (s staticClientsStorage) isStatic(id string) bool {
 	return ok
 }
 
-func (s staticClientsStorage) ListClients() ([]Client, error) {
-	clients, err := s.Storage.ListClients()
+func (s staticClientsStorage) ListClients(ctx context.Context) ([]Client, error) {
+	clients, err := s.Storage.ListClients(ctx)
 	if err != nil {
 		return nil, err
 	}
@@ -60,25 +60,25 @@ func (s staticClientsStorage) ListClients() ([]Client, error) {
 	return append(clients[:n], s.clients...), nil
 }
 
-func (s staticClientsStorage) CreateClient(c Client) error {
+func (s staticClientsStorage) CreateClient(ctx context.Context, c Client) error {
 	if s.isStatic(c.ID) {
 		return errors.New("static clients: read-only cannot create client")
 	}
-	return s.Storage.CreateClient(c)
+	return s.Storage.CreateClient(ctx, c)
 }
 
-func (s staticClientsStorage) DeleteClient(id string) error {
+func (s staticClientsStorage) DeleteClient(ctx context.Context, id string) error {
 	if s.isStatic(id) {
 		return errors.New("static clients: read-only cannot delete client")
 	}
-	return s.Storage.DeleteClient(id)
+	return s.Storage.DeleteClient(ctx, id)
 }
 
-func (s staticClientsStorage) UpdateClient(id string, updater func(old Client) (Client, error)) error {
+func (s staticClientsStorage) UpdateClient(ctx context.Context, id string, updater func(old Client) (Client, error)) error {
 	if s.isStatic(id) {
 		return errors.New("static clients: read-only cannot update client")
 	}
-	return s.Storage.UpdateClient(id, updater)
+	return s.Storage.UpdateClient(ctx, id, updater)
 }
 
 type staticPasswordsStorage struct {
@@ -89,17 +89,17 @@ type staticPasswordsStorage struct {
 	// A map of passwords that is indexed by lower-case email ids
 	passwordsByEmail map[string]Password
 
-	logger log.Logger
+	logger *slog.Logger
 }
 
 // WithStaticPasswords returns a storage with a read-only set of passwords.
-func WithStaticPasswords(s Storage, staticPasswords []Password, logger log.Logger) Storage {
+func WithStaticPasswords(s Storage, staticPasswords []Password, logger *slog.Logger) Storage {
 	passwordsByEmail := make(map[string]Password, len(staticPasswords))
 	for _, p := range staticPasswords {
 		// Enable case insensitive email comparison.
 		lowerEmail := strings.ToLower(p.Email)
 		if _, ok := passwordsByEmail[lowerEmail]; ok {
-			logger.Errorf("Attempting to create StaticPasswords with the same email id: %s", p.Email)
+			logger.Error("attempting to create StaticPasswords with the same email id", "email", p.Email)
 		}
 		passwordsByEmail[lowerEmail] = p
 	}
@@ -112,18 +112,18 @@ func (s staticPasswordsStorage) isStatic(email string) bool {
 	return ok
 }
 
-func (s staticPasswordsStorage) GetPassword(email string) (Password, error) {
+func (s staticPasswordsStorage) GetPassword(ctx context.Context, email string) (Password, error) {
 	// TODO(ericchiang): BLAH. We really need to figure out how to handle
 	// lower cased emails better.
 	email = strings.ToLower(email)
 	if password, ok := s.passwordsByEmail[email]; ok {
 		return password, nil
 	}
-	return s.Storage.GetPassword(email)
+	return s.Storage.GetPassword(ctx, email)
 }
 
-func (s staticPasswordsStorage) ListPasswords() ([]Password, error) {
-	passwords, err := s.Storage.ListPasswords()
+func (s staticPasswordsStorage) ListPasswords(ctx context.Context) ([]Password, error) {
+	passwords, err := s.Storage.ListPasswords(ctx)
 	if err != nil {
 		return nil, err
 	}
@@ -140,25 +140,25 @@ func (s staticPasswordsStorage) ListPasswords() ([]Password, error) {
 	return append(passwords[:n], s.passwords...), nil
 }
 
-func (s staticPasswordsStorage) CreatePassword(p Password) error {
+func (s staticPasswordsStorage) CreatePassword(ctx context.Context, p Password) error {
 	if s.isStatic(p.Email) {
 		return errors.New("static passwords: read-only cannot create password")
 	}
-	return s.Storage.CreatePassword(p)
+	return s.Storage.CreatePassword(ctx, p)
 }
 
-func (s staticPasswordsStorage) DeletePassword(email string) error {
+func (s staticPasswordsStorage) DeletePassword(ctx context.Context, email string) error {
 	if s.isStatic(email) {
 		return errors.New("static passwords: read-only cannot delete password")
 	}
-	return s.Storage.DeletePassword(email)
+	return s.Storage.DeletePassword(ctx, email)
 }
 
-func (s staticPasswordsStorage) UpdatePassword(email string, updater func(old Password) (Password, error)) error {
+func (s staticPasswordsStorage) UpdatePassword(ctx context.Context, email string, updater func(old Password) (Password, error)) error {
 	if s.isStatic(email) {
 		return errors.New("static passwords: read-only cannot update password")
 	}
-	return s.Storage.UpdatePassword(email, updater)
+	return s.Storage.UpdatePassword(ctx, email, updater)
 }
 
 // staticConnectorsStorage represents a storage with read-only set of connectors.
@@ -185,15 +185,15 @@ func (s staticConnectorsStorage) isStatic(id string) bool {
 	return ok
 }
 
-func (s staticConnectorsStorage) GetConnector(id string) (Connector, error) {
+func (s staticConnectorsStorage) GetConnector(ctx context.Context, id string) (Connector, error) {
 	if connector, ok := s.connectorsByID[id]; ok {
 		return connector, nil
 	}
-	return s.Storage.GetConnector(id)
+	return s.Storage.GetConnector(ctx, id)
 }
 
-func (s staticConnectorsStorage) ListConnectors() ([]Connector, error) {
-	connectors, err := s.Storage.ListConnectors()
+func (s staticConnectorsStorage) ListConnectors(ctx context.Context) ([]Connector, error) {
+	connectors, err := s.Storage.ListConnectors(ctx)
 	if err != nil {
 		return nil, err
 	}
@@ -210,23 +210,23 @@ func (s staticConnectorsStorage) ListConnectors() ([]Connector, error) {
 	return append(connectors[:n], s.connectors...), nil
 }
 
-func (s staticConnectorsStorage) CreateConnector(c Connector) error {
+func (s staticConnectorsStorage) CreateConnector(ctx context.Context, c Connector) error {
 	if s.isStatic(c.ID) {
 		return errors.New("static connectors: read-only cannot create connector")
 	}
-	return s.Storage.CreateConnector(c)
+	return s.Storage.CreateConnector(ctx, c)
 }
 
-func (s staticConnectorsStorage) DeleteConnector(id string) error {
+func (s staticConnectorsStorage) DeleteConnector(ctx context.Context, id string) error {
 	if s.isStatic(id) {
 		return errors.New("static connectors: read-only cannot delete connector")
 	}
-	return s.Storage.DeleteConnector(id)
+	return s.Storage.DeleteConnector(ctx, id)
 }
 
-func (s staticConnectorsStorage) UpdateConnector(id string, updater func(old Connector) (Connector, error)) error {
+func (s staticConnectorsStorage) UpdateConnector(ctx context.Context, id string, updater func(old Connector) (Connector, error)) error {
 	if s.isStatic(id) {
 		return errors.New("static connectors: read-only cannot update connector")
 	}
-	return s.Storage.UpdateConnector(id, updater)
+	return s.Storage.UpdateConnector(ctx, id, updater)
 }
diff --git a/storage/storage.go b/storage/storage.go
index af39228a74..84976c5df6 100644
--- a/storage/storage.go
+++ b/storage/storage.go
@@ -1,15 +1,18 @@
 package storage
 
 import (
+	"context"
+	"crypto"
 	"crypto/rand"
 	"encoding/base32"
 	"errors"
+	"fmt"
 	"io"
 	"math/big"
 	"strings"
 	"time"
 
-	jose "gopkg.in/square/go-jose.v2"
+	"github.com/go-jose/go-jose/v4"
 )
 
 var (
@@ -47,12 +50,18 @@ func newSecureID(len int) string {
 	return string(buff[0]%26+'a') + strings.TrimRight(encoding.EncodeToString(buff[1:]), "=")
 }
 
+// NewHMACKey returns a random key which can be used in the computation of an HMAC
+func NewHMACKey(h crypto.Hash) []byte {
+	return []byte(newSecureID(h.Size()))
+}
+
 // GCResult returns the number of objects deleted by garbage collection.
 type GCResult struct {
 	AuthRequests   int64
 	AuthCodes      int64
 	DeviceRequests int64
 	DeviceTokens   int64
+	AuthSessions   int64
 }
 
 // IsEmpty returns whether the garbage collection result is empty or not.
@@ -60,7 +69,8 @@ func (g *GCResult) IsEmpty() bool {
 	return g.AuthRequests == 0 &&
 		g.AuthCodes == 0 &&
 		g.DeviceRequests == 0 &&
-		g.DeviceTokens == 0
+		g.DeviceTokens == 0 &&
+		g.AuthSessions == 0
 }
 
 // Storage is the storage interface used by the server. Implementations are
@@ -70,42 +80,50 @@ type Storage interface {
 	Close() error
 
 	// TODO(ericchiang): Let the storages set the IDs of these objects.
-	CreateAuthRequest(a AuthRequest) error
-	CreateClient(c Client) error
-	CreateAuthCode(c AuthCode) error
-	CreateRefresh(r RefreshToken) error
-	CreatePassword(p Password) error
-	CreateOfflineSessions(s OfflineSessions) error
-	CreateConnector(c Connector) error
-	CreateDeviceRequest(d DeviceRequest) error
-	CreateDeviceToken(d DeviceToken) error
+	CreateAuthRequest(ctx context.Context, a AuthRequest) error
+	CreateClient(ctx context.Context, c Client) error
+	CreateAuthCode(ctx context.Context, c AuthCode) error
+	CreateRefresh(ctx context.Context, r RefreshToken) error
+	CreatePassword(ctx context.Context, p Password) error
+	CreateOfflineSessions(ctx context.Context, s OfflineSessions) error
+	CreateUserIdentity(ctx context.Context, u UserIdentity) error
+	CreateAuthSession(ctx context.Context, s AuthSession) error
+	CreateConnector(ctx context.Context, c Connector) error
+	CreateDeviceRequest(ctx context.Context, d DeviceRequest) error
+	CreateDeviceToken(ctx context.Context, d DeviceToken) error
 
 	// TODO(ericchiang): return (T, bool, error) so we can indicate not found
 	// requests that way instead of using ErrNotFound.
-	GetAuthRequest(id string) (AuthRequest, error)
-	GetAuthCode(id string) (AuthCode, error)
-	GetClient(id string) (Client, error)
-	GetKeys() (Keys, error)
-	GetRefresh(id string) (RefreshToken, error)
-	GetPassword(email string) (Password, error)
-	GetOfflineSessions(userID string, connID string) (OfflineSessions, error)
-	GetConnector(id string) (Connector, error)
-	GetDeviceRequest(userCode string) (DeviceRequest, error)
-	GetDeviceToken(deviceCode string) (DeviceToken, error)
-
-	ListClients() ([]Client, error)
-	ListRefreshTokens() ([]RefreshToken, error)
-	ListPasswords() ([]Password, error)
-	ListConnectors() ([]Connector, error)
+	GetAuthRequest(ctx context.Context, id string) (AuthRequest, error)
+	GetAuthCode(ctx context.Context, id string) (AuthCode, error)
+	GetClient(ctx context.Context, id string) (Client, error)
+	GetKeys(ctx context.Context) (Keys, error)
+	GetRefresh(ctx context.Context, id string) (RefreshToken, error)
+	GetPassword(ctx context.Context, email string) (Password, error)
+	GetOfflineSessions(ctx context.Context, userID string, connID string) (OfflineSessions, error)
+	GetUserIdentity(ctx context.Context, userID, connectorID string) (UserIdentity, error)
+	GetAuthSession(ctx context.Context, id string) (AuthSession, error)
+	GetConnector(ctx context.Context, id string) (Connector, error)
+	GetDeviceRequest(ctx context.Context, userCode string) (DeviceRequest, error)
+	GetDeviceToken(ctx context.Context, deviceCode string) (DeviceToken, error)
+
+	ListClients(ctx context.Context) ([]Client, error)
+	ListRefreshTokens(ctx context.Context) ([]RefreshToken, error)
+	ListPasswords(ctx context.Context) ([]Password, error)
+	ListConnectors(ctx context.Context) ([]Connector, error)
+	ListUserIdentities(ctx context.Context) ([]UserIdentity, error)
+	ListAuthSessions(ctx context.Context) ([]AuthSession, error)
 
 	// Delete methods MUST be atomic.
-	DeleteAuthRequest(id string) error
-	DeleteAuthCode(code string) error
-	DeleteClient(id string) error
-	DeleteRefresh(id string) error
-	DeletePassword(email string) error
-	DeleteOfflineSessions(userID string, connID string) error
-	DeleteConnector(id string) error
+	DeleteAuthRequest(ctx context.Context, id string) error
+	DeleteAuthCode(ctx context.Context, code string) error
+	DeleteClient(ctx context.Context, id string) error
+	DeleteRefresh(ctx context.Context, id string) error
+	DeletePassword(ctx context.Context, email string) error
+	DeleteOfflineSessions(ctx context.Context, userID string, connID string) error
+	DeleteUserIdentity(ctx context.Context, userID, connectorID string) error
+	DeleteAuthSession(ctx context.Context, id string) error
+	DeleteConnector(ctx context.Context, id string) error
 
 	// Update methods take a function for updating an object then performs that update within
 	// a transaction. "updater" functions may be called multiple times by a single update call.
@@ -121,49 +139,125 @@ type Storage interface {
 	//			// update failed, handle error
 	//		}
 	//
-	UpdateClient(id string, updater func(old Client) (Client, error)) error
-	UpdateKeys(updater func(old Keys) (Keys, error)) error
-	UpdateAuthRequest(id string, updater func(a AuthRequest) (AuthRequest, error)) error
-	UpdateRefreshToken(id string, updater func(r RefreshToken) (RefreshToken, error)) error
-	UpdatePassword(email string, updater func(p Password) (Password, error)) error
-	UpdateOfflineSessions(userID string, connID string, updater func(s OfflineSessions) (OfflineSessions, error)) error
-	UpdateConnector(id string, updater func(c Connector) (Connector, error)) error
-	UpdateDeviceToken(deviceCode string, updater func(t DeviceToken) (DeviceToken, error)) error
+	UpdateClient(ctx context.Context, id string, updater func(old Client) (Client, error)) error
+	UpdateKeys(ctx context.Context, updater func(old Keys) (Keys, error)) error
+	UpdateAuthRequest(ctx context.Context, id string, updater func(a AuthRequest) (AuthRequest, error)) error
+	UpdateRefreshToken(ctx context.Context, id string, updater func(r RefreshToken) (RefreshToken, error)) error
+	UpdatePassword(ctx context.Context, email string, updater func(p Password) (Password, error)) error
+	UpdateOfflineSessions(ctx context.Context, userID string, connID string, updater func(s OfflineSessions) (OfflineSessions, error)) error
+	UpdateUserIdentity(ctx context.Context, userID, connectorID string, updater func(u UserIdentity) (UserIdentity, error)) error
+	UpdateAuthSession(ctx context.Context, id string, updater func(s AuthSession) (AuthSession, error)) error
+	UpdateConnector(ctx context.Context, id string, updater func(c Connector) (Connector, error)) error
+	UpdateDeviceToken(ctx context.Context, deviceCode string, updater func(t DeviceToken) (DeviceToken, error)) error
 
 	// GarbageCollect deletes all expired AuthCodes,
 	// AuthRequests, DeviceRequests, and DeviceTokens.
-	GarbageCollect(now time.Time) (GCResult, error)
+	GarbageCollect(ctx context.Context, now time.Time) (GCResult, error)
 }
 
 // Client represents an OAuth2 client.
 //
 // For further reading see:
-//   * Trusted peers: https://developers.google.com/identity/protocols/CrossClientAuth
-//   * Public clients: https://developers.google.com/api-client-library/python/auth/installed-app
+//   - Trusted peers: https://developers.google.com/identity/protocols/CrossClientAuth
+//   - Public clients: https://developers.google.com/api-client-library/python/auth/installed-app
 type Client struct {
 	// Client ID and secret used to identify the client.
-	ID        string `json:"id" yaml:"id"`
-	IDEnv     string `json:"idEnv" yaml:"idEnv"`
-	Secret    string `json:"secret" yaml:"secret"`
-	SecretEnv string `json:"secretEnv" yaml:"secretEnv"`
+	ID        string `json:"id"`
+	IDEnv     string `json:"idEnv"`
+	Secret    string `json:"secret"`
+	SecretEnv string `json:"secretEnv"`
 
 	// A registered set of redirect URIs. When redirecting from dex to the client, the URI
 	// requested to redirect to MUST match one of these values, unless the client is "public".
-	RedirectURIs []string `json:"redirectURIs" yaml:"redirectURIs"`
+	RedirectURIs []string `json:"redirectURIs"`
+
+	// PostLogoutRedirectURIs is a registered set of URIs that the client can redirect to
+	// after logout. Per OIDC RP-Initiated Logout Section 2, the post_logout_redirect_uri
+	// parameter MUST match one of these values.
+	PostLogoutRedirectURIs []string `json:"postLogoutRedirectURIs"`
+
+	// BackchannelLogoutURI is where dex POSTs a logout token when the user's session
+	// ends, per OIDC Back-Channel Logout 1.0. Empty means the client does not
+	// participate: it simply will not be told, and its own session outlives dex's.
+	BackchannelLogoutURI string `json:"backchannelLogoutURI"`
+
+	// RefreshTokenLifetime says whether this client's refresh tokens outlive the
+	// session that issued them. See the constants below; empty means Standalone.
+	RefreshTokenLifetime string `json:"refreshTokenLifetime"`
 
 	// TrustedPeers are a list of peers which can issue tokens on this client's behalf using
 	// the dynamic "oauth2:server:client_id:(client_id)" scope. If a peer makes such a request,
 	// this client's ID will appear as the ID Token's audience.
 	//
 	// Clients inherently trust themselves.
-	TrustedPeers []string `json:"trustedPeers" yaml:"trustedPeers"`
+	TrustedPeers []string `json:"trustedPeers"`
 
 	// Public clients must use either use a redirectURL 127.0.0.1:X or "urn:ietf:wg:oauth:2.0:oob"
-	Public bool `json:"public" yaml:"public"`
+	Public bool `json:"public"`
 
 	// Name and LogoURL used when displaying this client to the end user.
-	Name    string `json:"name" yaml:"name"`
-	LogoURL string `json:"logoURL" yaml:"logoURL"`
+	Name    string `json:"name"`
+	LogoURL string `json:"logoURL"`
+
+	// AllowedConnectors is a list of connector IDs that the client is allowed to use for authentication.
+	// If empty, all connectors are allowed.
+	AllowedConnectors []string `json:"allowedConnectors"`
+
+	// MFAChain is an ordered list of MFA authenticator IDs that a user must complete
+	// during login. Empty means no MFA required.
+	MFAChain []string `json:"mfaChain"`
+
+	// SSOSharedWith defines which other clients can reuse this client's authentication session.
+	// When a user is authenticated for this client, clients listed here can skip authentication.
+	// Special value "*" means share with all clients (Keycloak-like realm-wide SSO).
+	// nil means use ssoSharedWithDefault from sessions config.
+	// Empty slice [] means explicitly share with no one.
+	SSOSharedWith []string `json:"ssoSharedWith" yaml:"ssoSharedWith"`
+
+	// ClientCredentialsClaims holds identity claims used when issuing tokens via the
+	// client_credentials grant. Kept separate from core Client fields to avoid mixing
+	// application identity (ID, secret, redirect URIs) with user-like identity attributes.
+	ClientCredentialsClaims *ClientCredentialsClaims `json:"clientCredentialsClaims,omitempty"`
+}
+
+// Refresh token lifetimes, the values Client.RefreshTokenLifetime accepts.
+const (
+	// RefreshTokenLifetimeStandalone, the default, lets a refresh token live out its
+	// configured expiry whatever happens to the session that issued it. This is what
+	// keeps a kubectl credential working after the user signs out of a web app.
+	RefreshTokenLifetimeStandalone = "standalone"
+
+	// RefreshTokenLifetimeSession ends the token with that session: redeeming it then
+	// fails and deletes it. For clients that are a browser session and nothing else,
+	// such as an authenticating proxy, where a token outliving the session is a way
+	// back in after logout. Dex requires offline_access for every refresh token, so
+	// nothing in the request tells the two apart — the client has to say so.
+	RefreshTokenLifetimeSession = "session"
+)
+
+// ValidateRefreshTokenLifetime rejects unknown values, so that a typo fails at
+// configuration time instead of silently leaving the tokens standalone.
+func ValidateRefreshTokenLifetime(lifetime string) error {
+	switch lifetime {
+	case "", RefreshTokenLifetimeStandalone, RefreshTokenLifetimeSession:
+		return nil
+	default:
+		return fmt.Errorf("invalid refresh token lifetime %q: want %q or %q",
+			lifetime, RefreshTokenLifetimeStandalone, RefreshTokenLifetimeSession)
+	}
+}
+
+// RefreshBoundToSession reports whether this client's refresh tokens end with the
+// browser session that issued them.
+func (c Client) RefreshBoundToSession() bool {
+	return c.RefreshTokenLifetime == RefreshTokenLifetimeSession
+}
+
+// ClientCredentialsClaims contains claims that are included in tokens issued via
+// the client_credentials grant. This is scoped to client_credentials to keep the
+// Client struct focused on application-level concerns.
+type ClientCredentialsClaims struct {
+	Groups []string `json:"groups,omitempty"`
 }
 
 // Claims represents the ID Token claims supported by the server.
@@ -205,6 +299,20 @@ type AuthRequest struct {
 	// attempts.
 	ForceApprovalPrompt bool
 
+	// OIDC prompt parameter. Controls authentication and consent UI behavior.
+	// Values: "none", "login", "consent", "select_account".
+	Prompt string
+
+	// MaxAge is the OIDC max_age parameter — maximum allowable elapsed time
+	// in seconds since the user last actively authenticated.
+	// -1 means not specified.
+	MaxAge int
+
+	// AuthTime is when the user last actively authenticated (entered credentials).
+	// Set during finalizeLogin (= now) or trySessionLogin (= UserIdentity.LastLogin).
+	// Used in ID token as "auth_time" claim.
+	AuthTime time.Time
+
 	Expiry time.Time
 
 	// Has the user proved their identity through a backing identity provider?
@@ -223,6 +331,16 @@ type AuthRequest struct {
 
 	// PKCE CodeChallenge and CodeChallengeMethod
 	PKCE PKCE
+
+	// HMACKey is used when generating an AuthRequest-specific HMAC
+	HMACKey []byte
+
+	// MFAValidated is set to true if the user has completed multi-factor authentication.
+	MFAValidated bool
+
+	// WebAuthnSessionData stores temporary WebAuthn ceremony data (challenge, etc.)
+	// between Begin and Finish calls. JSON-encoded webauthn.SessionData.
+	WebAuthnSessionData []byte
 }
 
 // AuthCode represents a code which can be exchanged for an OAuth2 token response.
@@ -259,6 +377,15 @@ type AuthCode struct {
 
 	Expiry time.Time
 
+	// SessionID is the browser session this code was issued from, carried into the
+	// tokens as their "sid" claim. Empty when sessions are off, or when the flow
+	// had no browser session behind it.
+	SessionID string
+
+	// AuthTime is when the user last actively authenticated.
+	// Carried over from AuthRequest to include in ID tokens.
+	AuthTime time.Time
+
 	// PKCE CodeChallenge and CodeChallengeMethod
 	PKCE PKCE
 }
@@ -304,11 +431,125 @@ type RefreshTokenRef struct {
 
 	CreatedAt time.Time
 	LastUsed  time.Time
+
+	// SessionID is the browser session this token was issued under, empty for
+	// tokens from flows that never touched a browser. It records origin, not
+	// lifetime: the token outlives the session, but a token that was never part of
+	// one must not start claiming a session on refresh.
+	SessionID string
+}
+
+// MFASecret stores the enrollment state and secret for an MFA authenticator.
+// Note: Secret is stored without encryption. Encrypting secrets at rest is the
+// responsibility of the storage backend (e.g., encrypted etcd, disk encryption).
+type MFASecret struct {
+	AuthenticatorID string    `json:"authenticatorID"`
+	Type            string    `json:"type"`
+	Secret          string    `json:"secret"`
+	Confirmed       bool      `json:"confirmed"`
+	CreatedAt       time.Time `json:"createdAt"`
+
+	// LastUsedCounter is the TOTP time-step counter of the most recently accepted
+	// code. Codes whose counter is <= this value are rejected to make each code
+	// single-use (replay protection). Zero means no code has been accepted yet.
+	LastUsedCounter int64 `json:"lastUsedCounter,omitempty"`
+}
+
+// WebAuthnCredential stores a registered WebAuthn credential for a user.
+type WebAuthnCredential struct {
+	CredentialID    []byte    `json:"credentialID"`
+	PublicKey       []byte    `json:"publicKey"`
+	AttestationType string    `json:"attestationType"`
+	AAGUID          []byte    `json:"aaguid"`
+	SignCount       uint32    `json:"signCount"`
+	CloneWarning    bool      `json:"cloneWarning"`
+	Transport       []string  `json:"transport"`
+	BackupEligible  bool      `json:"backupEligible"`
+	BackupState     bool      `json:"backupState"`
+	DisplayName     string    `json:"displayName"`
+	CreatedAt       time.Time `json:"createdAt"`
+}
+
+// UserIdentity represents persistent per-user identity data.
+type UserIdentity struct {
+	UserID              string
+	ConnectorID         string
+	Claims              Claims
+	Consents            map[string][]string             // clientID -> approved scopes
+	MFASecrets          map[string]*MFASecret           // authenticatorID -> secret
+	WebAuthnCredentials map[string][]WebAuthnCredential // authenticatorID -> credentials
+	CreatedAt           time.Time
+	LastLogin           time.Time
+	BlockedUntil        time.Time
+}
+
+// ClientAuthState represents authentication state for a specific client within an auth session.
+type ClientAuthState struct {
+	AuthenticatedAt   time.Time
+	LastActivity      time.Time
+	LastTokenIssuedAt time.Time
+
+	// ViaSSO is true when this state was derived from another client's session
+	// via ssoSharedWith rather than a direct authentication. SSO-derived states
+	// are not eligible as SSO sources themselves, which keeps sharing
+	// unidirectional and prevents transitive A->B->C chains.
+	ViaSSO bool
+}
+
+// LogoutState holds RP parameters saved in the auth session during logout.
+// These are written before the upstream logout redirect and read back in the callback.
+type LogoutState struct {
+	PostLogoutRedirectURI string
+	State                 string // RP's opaque state parameter
+	ClientID              string
+	ConnectorID           string
+}
+
+// AuthSession is one signed-in browser: a user, the connector they authenticated
+// with, and the clients they have reached since.
+//
+// A session belongs to the browser holding its cookie and to no other. Dex does not
+// identify devices — it cannot, since a user agent string and an IP address are both
+// forgeable and both change under a user who has not moved — so the cookie is the
+// device: a browser presenting one continues that session, and a browser without one
+// starts another. Signing in from a phone therefore leaves the laptop's session
+// alone, and signing out of the phone ends only the phone's.
+type AuthSession struct {
+	// ID identifies the session. It is random, it is what the cookie names, and it
+	// is published as the "sid" claim in tokens and logout tokens.
+	ID string
+
+	// Secret proves the bearer of the cookie is the browser this session was issued
+	// to. It is compared in constant time and never leaves dex except in that
+	// cookie — ID alone cannot be trusted, precisely because dex publishes it.
+	Secret string
+
+	UserID       string
+	ConnectorID  string
+	ClientStates map[string]*ClientAuthState // clientID -> auth state
+	CreatedAt    time.Time
+	LastActivity time.Time
+
+	// IPAddress and UserAgent are the last seen, refreshed at every authentication.
+	// A session outlives the network and the browser build it started on, so the
+	// values recorded at creation would describe a device that no longer exists.
+	IPAddress string
+	UserAgent string
+
+	// AbsoluteExpiry is CreatedAt + AbsoluteLifetime, set once at creation.
+	AbsoluteExpiry time.Time
+	// IdleExpiry is LastActivity + ValidIfNotUsedFor, updated on every activity.
+	IdleExpiry time.Time
+
+	// LogoutState is set during RP-Initiated Logout before redirecting to the
+	// upstream provider. The callback handler reads it back to complete the flow.
+	// Nil when no logout is in progress.
+	LogoutState *LogoutState
 }
 
 // OfflineSessions objects are sessions pertaining to users with refresh tokens.
 type OfflineSessions struct {
-	// UserID of an end user who has logged in to the server.
+	// UserID of an end user who has logged into the server.
 	UserID string
 
 	// The ID of the connector used to login the user.
@@ -342,8 +583,22 @@ type Password struct {
 	// Optional username to display. NOT used during login.
 	Username string `json:"username"`
 
+	// Optional full name for OIDC "name" claim.
+	// Defaults to Username when empty.
+	Name string `json:"name"`
+
+	// Optional preferred username for OIDC "preferred_username" claim.
+	PreferredUsername string `json:"preferredUsername"`
+
+	// Optional value for OIDC "email_verified" claim.
+	// Defaults to true for backwards compatibility when nil.
+	EmailVerified *bool `json:"emailVerified,omitempty"`
+
 	// Randomly generated user ID. This is NOT the primary ID of the Password object.
 	UserID string `json:"userID"`
+
+	// Groups assigned to the user
+	Groups []string `json:"groups"`
 }
 
 // Connector is an object that contains the metadata about connectors used to login to Dex.
@@ -359,7 +614,15 @@ type Connector struct {
 	ResourceVersion string `json:"resourceVersion"`
 	// Config holds all the configuration information specific to the connector type. Since there
 	// no generic struct we can use for this purpose, it is stored as a byte stream.
+	//
+	// NOTE: This is a bug. The JSON tag should be `config`.
+	// However, fixing this requires migrating Kubernetes objects for all previously created connectors,
+	// or making Dex reading both tags and act accordingly.
 	Config []byte `json:"email"`
+
+	// GrantTypes is a list of grant types that this connector is allowed to be used with.
+	// If empty, all grant types are allowed.
+	GrantTypes []string `json:"grantTypes,omitempty"`
 }
 
 // VerificationKey is a rotated signing key which can still be used to verify
diff --git a/web/robots.txt b/web/robots.txt
new file mode 100644
index 0000000000..1f53798bb4
--- /dev/null
+++ b/web/robots.txt
@@ -0,0 +1,2 @@
+User-agent: *
+Disallow: /
diff --git a/web/static/img/gitea-icon.svg b/web/static/img/gitea-icon.svg
new file mode 100644
index 0000000000..afeeacb77c
--- /dev/null
+++ b/web/static/img/gitea-icon.svg
@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 640 640" style="enable-background:new 0 0 640 640" xml:space="preserve" width="32" height="32"><path style="fill:#fff" d="m395.9 484.2-126.9-61c-12.5-6-17.9-21.2-11.8-33.8l61-126.9c6-12.5 21.2-17.9 33.8-11.8 17.2 8.3 27.1 13 27.1 13l-.1-109.2 16.7-.1.1 117.1s57.4 24.2 83.1 40.1c3.7 2.3 10.2 6.8 12.9 14.4 2.1 6.1 2 13.1-1 19.3l-61 126.9c-6.2 12.7-21.4 18.1-33.9 12z"/><path style="fill:#609926" d="M622.7 149.8c-4.1-4.1-9.6-4-9.6-4s-117.2 6.6-177.9 8c-13.3.3-26.5.6-39.6.7v117.2c-5.5-2.6-11.1-5.3-16.6-7.9 0-36.4-.1-109.2-.1-109.2-29 .4-89.2-2.2-89.2-2.2s-141.4-7.1-156.8-8.5c-9.8-.6-22.5-2.1-39 1.5-8.7 1.8-33.5 7.4-53.8 26.9C-4.9 212.4 6.6 276.2 8 285.8c1.7 11.7 6.9 44.2 31.7 72.5 45.8 56.1 144.4 54.8 144.4 54.8s12.1 28.9 30.6 55.5c25 33.1 50.7 58.9 75.7 62 63 0 188.9-.1 188.9-.1s12 .1 28.3-10.3c14-8.5 26.5-23.4 26.5-23.4S547 483 565 451.5c5.5-9.7 10.1-19.1 14.1-28 0 0 55.2-117.1 55.2-231.1-1.1-34.5-9.6-40.6-11.6-42.6zM125.6 353.9c-25.9-8.5-36.9-18.7-36.9-18.7S69.6 321.8 60 295.4c-16.5-44.2-1.4-71.2-1.4-71.2s8.4-22.5 38.5-30c13.8-3.7 31-3.1 31-3.1s7.1 59.4 15.7 94.2c7.2 29.2 24.8 77.7 24.8 77.7s-26.1-3.1-43-9.1zm300.3 107.6s-6.1 14.5-19.6 15.4c-5.8.4-10.3-1.2-10.3-1.2s-.3-.1-5.3-2.1l-112.9-55s-10.9-5.7-12.8-15.6c-2.2-8.1 2.7-18.1 2.7-18.1L322 273s4.8-9.7 12.2-13c.6-.3 2.3-1 4.5-1.5 8.1-2.1 18 2.8 18 2.8L467.4 315s12.6 5.7 15.3 16.2c1.9 7.4-.5 14-1.8 17.2-6.3 15.4-55 113.1-55 113.1z"/><path style="fill:#609926" d="M326.8 380.1c-8.2.1-15.4 5.8-17.3 13.8-1.9 8 2 16.3 9.1 20 7.7 4 17.5 1.8 22.7-5.4 5.1-7.1 4.3-16.9-1.8-23.1l24-49.1c1.5.1 3.7.2 6.2-.5 4.1-.9 7.1-3.6 7.1-3.6 4.2 1.8 8.6 3.8 13.2 6.1 4.8 2.4 9.3 4.9 13.4 7.3.9.5 1.8 1.1 2.8 1.9 1.6 1.3 3.4 3.1 4.7 5.5 1.9 5.5-1.9 14.9-1.9 14.9-2.3 7.6-18.4 40.6-18.4 40.6-8.1-.2-15.3 5-17.7 12.5-2.6 8.1 1.1 17.3 8.9 21.3 7.8 4 17.4 1.7 22.5-5.3 5-6.8 4.6-16.3-1.1-22.6 1.9-3.7 3.7-7.4 5.6-11.3 5-10.4 13.5-30.4 13.5-30.4.9-1.7 5.7-10.3 2.7-21.3-2.5-11.4-12.6-16.7-12.6-16.7-12.2-7.9-29.2-15.2-29.2-15.2s0-4.1-1.1-7.1c-1.1-3.1-2.8-5.1-3.9-6.3 4.7-9.7 9.4-19.3 14.1-29-4.1-2-8.1-4-12.2-6.1-4.8 9.8-9.7 19.7-14.5 29.5-6.7-.1-12.9 3.5-16.1 9.4-3.4 6.3-2.7 14.1 1.9 19.8l-24.6 50.4z"/></svg>
\ No newline at end of file
diff --git a/web/static/img/mock-icon.svg b/web/static/img/mock-icon.svg
new file mode 100644
index 0000000000..fda905ca7c
--- /dev/null
+++ b/web/static/img/mock-icon.svg
@@ -0,0 +1,5 @@
+<svg width="24" height="24" viewBox="0 0 24 24" fill="none" xmlns="http://www.w3.org/2000/svg">
+  <path d="M9 3V8.5L5.1 15.1C4.1 16.8 5.3 19 7.2 19H16.8C18.7 19 19.9 16.8 18.9 15.1L15 8.5V3" stroke="#fff" stroke-width="1.8" stroke-linecap="round" stroke-linejoin="round"/>
+  <path d="M9 3H15" stroke="#fff" stroke-width="1.8" stroke-linecap="round"/>
+  <path d="M7 15H17" stroke="#fff" stroke-width="1.8" stroke-linecap="round"/>
+</svg>
diff --git a/web/static/main.css b/web/static/main.css
index 0ce2c2530b..b1f2658fc3 100644
--- a/web/static/main.css
+++ b/web/static/main.css
@@ -8,44 +8,82 @@ body {
 
 .dex-container {
   color: #333;
-  margin: 45px auto;
-  max-width: 500px;
+  margin: 60px auto;
+  max-width: 480px;
   min-width: 320px;
+  padding: 0 16px;
   text-align: center;
 }
 
 .dex-btn {
-  border-radius: 4px;
+  border-radius: 8px;
   border: 0;
-  box-shadow: inset 0 1px 0 rgba(255, 255, 255, 0.2), 0 1px 2px rgba(0, 0, 0, 0.25), 0 0 1px rgba(0, 0, 0, 0.25);
   cursor: pointer;
-  font-size: 16px;
+  /* Buttons do not inherit the page's typeface on their own, so without this
+   * every button label on every screen came out in the browser's default —
+   * Arial next to the system font the rest of the page is set in. */
+  font-family: inherit;
+  font-size: 15px;
   padding: 0;
+  transition: background-color 0.15s ease, box-shadow 0.15s ease, transform 0.1s ease;
 }
 
-.dex-btn:focus {
-  outline: none;
+.dex-btn:focus-visible {
+  outline: 2px solid #4A90D9;
+  outline-offset: 2px;
 }
 
 .dex-btn:active {
-  box-shadow: inset 0 3px 5px rgba(0, 0, 0, 0.125);
-  outline: none;
+  transform: scale(0.98);
+}
+
+.dex-btn:disabled {
+  cursor: not-allowed;
+  opacity: 0.5;
 }
 
+/* A connector button is an icon and a label. The label used to sit next to a
+ * floated icon on a single 40px line, which held together only while the name
+ * was short: a longer one stretched its button past the others, and once it
+ * wrapped, the second line cleared the float while the icon stayed a 40px
+ * square at the top of a taller button.
+ *
+ * The button is a row instead, at a width that does not depend on the name, so
+ * a label that does not fit wraps inside it and the icon spans the full height
+ * however many lines that turns out to be. */
+.dex-btn-provider {
+  align-items: stretch;
+  /* inline-flex, not flex: the button sits inside the connector's link, and an
+   * atomic inline-level box is where the link's underline stops. A block-level
+   * flex container would take that underline across the label, and no rule on
+   * the label can turn off a decoration its ancestor is drawing. */
+  display: inline-flex;
+  max-width: 100%;
+  /* It is a link: it navigates to the connector, and it is the only thing on
+   * the row that should take focus. */
+  text-decoration: none;
+}
+
+/* The icon keeps its own size instead of stretching down the side of a button
+ * a long name has made two or three lines tall. */
 .dex-btn-icon {
+  align-self: center;
+  /* Not every connector type has a rule below — oauth, authproxy and openshift
+   * are shipped without one. They used to render as a transparent hole with the
+   * label pushed off to the side of it; a plain tile is at least a tile. */
+  background-color: #84B6EF;
   background-position: center;
   background-repeat: no-repeat;
-  background-size: 24px;
-  border-radius: 4px 0 0 4px;
-  float: left;
+  background-size: 18px;
+  border-radius: 6px;
+  flex: 0 0 36px;
   height: 36px;
-  margin-right: 5px;
-  width: 36px;
+  margin: 0 4px 0 3px;
 }
 
 .dex-btn-icon--google {
   background-color: #FFFFFF;
-  background-image: url(../static/img/google-icon.svg);;
+  background-image: url(../static/img/google-icon.svg);
 }
 
 .dex-btn-icon--local {
@@ -53,6 +91,11 @@ body {
   background-image: url(../static/img/email-icon.svg);
 }
 
+.dex-btn-icon--gitea {
+  background-color: #F5F5F5;
+  background-image: url(../static/img/gitea-icon.svg);
+}
+
 .dex-btn-icon--github {
   background-color: #F5F5F5;
   background-image: url(../static/img/github-icon.svg);
@@ -105,39 +148,247 @@ body {
   background-image: url(../static/img/microsoft-icon.svg);
 }
 
+.dex-btn-icon--mockCallback,
+.dex-btn-icon--mockPassword {
+  background-color: #6c5ce7;
+  background-image: url(../static/img/mock-icon.svg);
+}
+
+/* Also the label of the approval buttons, which have no icon: the min-height
+ * keeps those the size they were when a 40px line box set it. */
 .dex-btn-text {
+  align-items: center;
+  display: flex;
+  flex: 1;
   font-weight: 600;
-  line-height: 36px;
+  justify-content: center;
+  line-height: 1.35;
+  min-height: 40px;
+  overflow-wrap: anywhere;
   padding: 6px 12px;
   text-align: center;
 }
 
 .dex-subtle-text {
-  color: #999;
-  font-size: 12px;
+  color: #888;
+  font-size: 13px;
 }
 
 .dex-separator {
-  color: #999;
+  color: #aaa;
 }
 
 .dex-list {
-  color: #999;
+  color: #888;
   display: inline-block;
-  font-size: 12px;
+  font-size: 13px;
   list-style: circle;
   text-align: left;
 }
 
 .dex-error-box {
-  background-color: #DD1327;
+  background-color: #e5383b;
+  border-radius: 6px;
   color: #fff;
   font-size: 14px;
   font-weight: normal;
+  margin: 20px auto;
   max-width: 320px;
-  padding: 4px 0;
+  padding: 8px 12px;
 }
 
-.dex-error-box {
-  margin: 20px auto;
+/* Home page.
+ *
+ * Colours come from custom properties so a theme can restyle the page by
+ * setting a handful of values. The fallbacks are the light-theme values, so a
+ * custom theme that defines none of them still renders exactly as before. */
+.dex-home {
+  --dex-home-fg: var(--dex-fg, #1a1a1a);
+  --dex-home-muted: var(--dex-fg-muted, #6b7280);
+  --dex-home-border: var(--dex-border, #e8eaed);
+  --dex-home-accent: var(--dex-accent, #2f6fb0);
+
+  color: var(--dex-home-fg);
+  text-align: left;
+}
+
+.dex-identity__name {
+  font-size: 17px;
+  font-weight: 600;
+  line-height: 1.3;
+  margin: 0;
+  overflow-wrap: anywhere;
+}
+
+.dex-identity__email {
+  color: var(--dex-home-muted);
+  font-size: 13px;
+  line-height: 1.5;
+  margin-top: 3px;
+  overflow-wrap: anywhere;
+}
+
+/* Whether the connector vouched for the address belongs next to the address,
+ * not in a row of its own further down. */
+.dex-identity__state {
+  white-space: nowrap;
+}
+
+/* An address nobody verified is the case worth noticing, so it is the one that
+ * gets full contrast. */
+.dex-identity__state--warn {
+  color: var(--dex-home-fg);
+}
+
+.dex-count {
+  font-variant-numeric: tabular-nums;
+  opacity: 0.75;
+}
+
+/* Groups are a row like the others, so their values start where every other
+ * value on the page starts. A directory can hand back dozens of them, so the
+ * list is capped and scrolls instead of pushing the rest of the page out of
+ * view. The count in the label says how many there are; tabindex on the
+ * template keeps the overflow reachable by keyboard. */
+.dex-groups {
+  font-size: 13px;
+  line-height: 1.6;
+  list-style: none;
+  margin: 0;
+  max-height: 120px;
+  overflow-y: auto;
+  padding: 0 2px 0 0;
+  scrollbar-color: var(--dex-home-border) transparent;
+  scrollbar-width: thin;
+}
+
+.dex-groups li {
+  overflow-wrap: anywhere;
+}
+
+.dex-groups::-webkit-scrollbar {
+  width: 6px;
+}
+
+.dex-groups::-webkit-scrollbar-thumb {
+  background-color: var(--dex-home-border);
+  border-radius: 3px;
+}
+
+/* Overlay scrollbars stay invisible until touched, so a clipped list would read
+ * as complete. The template adds this class while there is more below, and the
+ * fade says so. It covers only the row the cap cuts through — a longer gradient
+ * would dim the readable rows above it too. */
+.dex-groups--clipped {
+  -webkit-mask-image: linear-gradient(to bottom, #000 calc(100% - 22px), transparent);
+  mask-image: linear-gradient(to bottom, #000 calc(100% - 22px), transparent);
+}
+
+.dex-groups:focus-visible {
+  outline: 2px solid var(--dex-home-accent);
+  outline-offset: 3px;
+}
+
+/* Facts are label/value pairs on a fixed label column. Pushing values to the
+ * right edge instead would leave a hand's width of empty panel between a label
+ * and the value it belongs to, and would be the third alignment on a card that
+ * only needs one. They stack on narrow viewports, where the column costs more
+ * room than it buys. */
+.dex-facts {
+  border-top: 1px solid var(--dex-home-border);
+  margin: 20px 0 0;
+  padding: 0;
+}
+
+.dex-fact {
+  border-bottom: 1px solid var(--dex-home-border);
+  display: grid;
+  font-size: 13px;
+  gap: 4px 16px;
+  grid-template-columns: 116px minmax(0, 1fr);
+  padding: 9px 0;
+}
+
+.dex-fact dt {
+  color: var(--dex-home-muted);
+}
+
+.dex-fact dd {
+  margin: 0;
+  overflow-wrap: anywhere;
+}
+
+/* The User-Agent is the longest and least urgent value on the page. */
+.dex-fact dd.dex-fact__long {
+  color: var(--dex-home-muted);
+  font-size: 12px;
+  line-height: 1.5;
+}
+
+.dex-home__actions {
+  margin-top: 24px;
+  text-align: center;
+}
+
+/* Logging out is a link here and a form button on /logout, so the anchor needs
+ * the few properties a <button> brings on its own. Everything else comes from
+ * theme-btn--primary, the same class the rest of the pages use. */
+.dex-home__actions .dex-btn {
+  display: inline-block;
+  font-size: 14px;
+  font-weight: 600;
+  line-height: 22px;
+  text-decoration: none;
+}
+
+.dex-home__empty {
+  padding: 8px 0 4px;
+  text-align: center;
+}
+
+.dex-home__empty-title {
+  font-size: 16px;
+  font-weight: 600;
+}
+
+.dex-home__empty-text {
+  color: var(--dex-home-muted);
+  font-size: 13px;
+  line-height: 1.6;
+  margin: 6px auto 0;
+  max-width: 34ch;
+}
+
+.dex-home__footer {
+  border-top: 1px solid var(--dex-home-border);
+  margin-top: 24px;
+  padding-top: 16px;
+}
+
+/* Underlined and in the accent colour from the start: as grey unadorned text it
+ * did not read as something you could click, which is the only thing this line
+ * is there for. */
+.dex-home__link {
+  color: var(--dex-home-accent);
+  font-size: 13px;
+  text-decoration: underline;
+  text-underline-offset: 2px;
+}
+
+.dex-home__link:hover {
+  text-decoration-thickness: 2px;
+}
+
+/* Matches the focus ring the buttons and the group list use, rather than
+ * leaving this one link to the browser default. */
+.dex-home__link:focus-visible {
+  outline: 2px solid var(--dex-home-accent);
+  outline-offset: 3px;
+  text-decoration-thickness: 2px;
+}
+
+@media (max-width: 420px) {
+  .dex-fact {
+    grid-template-columns: minmax(0, 1fr);
+  }
 }
diff --git a/web/templates/device.html b/web/templates/device.html
index 674cbdc32f..944861c773 100644
--- a/web/templates/device.html
+++ b/web/templates/device.html
@@ -2,7 +2,7 @@
 
 <div class="theme-panel">
   <h2 class="theme-heading">Enter User Code</h2>
-  <form method="post" action="{{ .PostURL }}" method="get">
+  <form method="post" action="{{ .PostURL }}">
     <div class="theme-form-row">
       {{ if( .UserCode  )}}
       <input tabindex="2" required id="user_code" name="user_code" type="text" class="theme-form-input" autocomplete="off" value="{{.UserCode}}" {{ if .Invalid }} autofocus {{ end }}/>
diff --git a/web/templates/home.html b/web/templates/home.html
new file mode 100644
index 0000000000..ef24d0dc22
--- /dev/null
+++ b/web/templates/home.html
@@ -0,0 +1,106 @@
+{{ template "header.html" . }}
+
+<div class="theme-panel dex-home">
+  {{ if .LoggedIn }}
+  <div class="dex-identity">
+    {{ if .Username }}<h2 class="dex-identity__name">{{ .Username }}</h2>{{ end }}
+    {{ if .Email }}
+    <div class="dex-identity__email">
+      {{ .Email }}
+      {{ if .EmailVerified }}<span class="dex-identity__state">(verified)</span>
+      {{ else }}<span class="dex-identity__state dex-identity__state--warn">(not verified)</span>{{ end }}
+    </div>
+    {{ end }}
+  </div>
+
+  <dl class="dex-facts">
+    {{ if .ConnectorName }}
+    <div class="dex-fact">
+      <dt>Signed in with</dt>
+      <dd>{{ .ConnectorName }}</dd>
+    </div>
+    {{ end }}
+    {{ if .SignedInISO }}
+    <div class="dex-fact">
+      <dt>Signed in</dt>
+      <dd><time datetime="{{ .SignedInISO }}">{{ .SignedInText }}</time></dd>
+    </div>
+    {{ end }}
+    {{ if .SessionExpiresISO }}
+    <div class="dex-fact">
+      <dt>{{ if .SessionExpiryIsIdle }}Expires if idle{{ else }}Session ends{{ end }}</dt>
+      <dd><time datetime="{{ .SessionExpiresISO }}">{{ .SessionExpiresText }}</time></dd>
+    </div>
+    {{ end }}
+    {{ if .IPAddress }}
+    <div class="dex-fact">
+      <dt>Signed in from</dt>
+      <dd>{{ .IPAddress }}</dd>
+    </div>
+    {{ end }}
+    {{ if .Groups }}
+    <div class="dex-fact">
+      <dt id="groups-label">Groups <span class="dex-count">{{ len .Groups }}</span></dt>
+      <dd>
+        <ul class="dex-groups" tabindex="0" aria-labelledby="groups-label">
+          {{ range .Groups }}<li>{{ . }}</li>{{ end }}
+        </ul>
+      </dd>
+    </div>
+    {{ end }}
+    {{ if .UserAgent }}
+    <div class="dex-fact">
+      <dt>Browser</dt>
+      <dd class="dex-fact__long">{{ .UserAgent }}</dd>
+    </div>
+    {{ end }}
+  </dl>
+
+  <div class="dex-home__actions">
+    <a href="{{ .LogoutURL }}" class="dex-btn theme-btn--primary">Log out</a>
+  </div>
+  {{ else }}
+  <div class="dex-home__empty">
+    <h2 class="dex-home__empty-title">Not signed in</h2>
+    <p class="dex-home__empty-text">
+      This is the dex identity provider. Sign in from the application you want to use.
+    </p>
+  </div>
+  {{ end }}
+
+  <div class="dex-home__footer">
+    <a href="{{ .DiscoveryURL }}" class="dex-home__link">OpenID configuration</a>
+  </div>
+</div>
+
+{{ if .LoggedIn }}
+<script>
+  (function () {
+    // A long group list is capped by CSS; fade its bottom edge so the cut is
+    // visible on platforms whose scrollbars only appear while scrolling. The
+    // fade tracks the scroll position — left up permanently it would dim the
+    // last group even once you had scrolled down to read it.
+    var groups = document.querySelector('.dex-groups');
+    if (groups) {
+      var syncFade = function () {
+        var more = groups.scrollTop + groups.clientHeight < groups.scrollHeight - 1;
+        groups.classList.toggle('dex-groups--clipped', more);
+      };
+      syncFade();
+      groups.addEventListener('scroll', syncFade, {passive: true});
+      // A narrower window wraps long group names onto more lines, so whether
+      // the list overflows is not settled once at load.
+      window.addEventListener('resize', syncFade, {passive: true});
+    }
+
+    // The server states these in UTC; restate them in the visitor's own zone.
+    document.querySelectorAll('time[datetime]').forEach(function (el) {
+      var date = new Date(el.getAttribute('datetime'));
+      if (isNaN(date.getTime())) return;
+      el.textContent = date.toLocaleString([], {dateStyle: 'medium', timeStyle: 'short'});
+    });
+  })();
+</script>
+{{ end }}
+
+{{ template "footer.html" . }}
diff --git a/web/templates/login.html b/web/templates/login.html
index f432dd0096..2c1a6997f0 100644
--- a/web/templates/login.html
+++ b/web/templates/login.html
@@ -5,11 +5,9 @@ <h2 class="theme-heading">Log in to {{ issuer }} </h2>
   <div>
     {{ range $c := .Connectors }}
       <div class="theme-form-row">
-        <a href="{{ $c.URL }}" target="_self">
-          <button class="dex-btn theme-btn-provider">
-            <span class="dex-btn-icon dex-btn-icon--{{ $c.Type }}"></span>
-            <span class="dex-btn-text">Log in with {{ $c.Name }}</span>
-          </button>
+        <a href="{{ $c.URL }}" class="dex-btn dex-btn-provider theme-btn-provider">
+          <span class="dex-btn-icon dex-btn-icon--{{ $c.Type }}"></span>
+          <span class="dex-btn-text">Log in with {{ $c.Name }}</span>
         </a>
       </div>
     {{ end }}
diff --git a/web/templates/logout.html b/web/templates/logout.html
new file mode 100644
index 0000000000..b3d8d66b17
--- /dev/null
+++ b/web/templates/logout.html
@@ -0,0 +1,34 @@
+{{ template "header.html" . }}
+
+<div class="theme-panel">
+  {{ if .ShowConfirmation }}
+  <h2 class="theme-heading">Logging Out</h2>
+  <div>
+    <div class="dex-subtle-text">Do you want to log out?</div>
+  </div>
+  <div class="theme-form-row">
+    <form method="post" action="{{ .ReqPath }}">
+      <button type="submit" class="dex-btn theme-btn--primary">Log Out</button>
+    </form>
+  </div>
+  {{ else if .LoggedOut }}
+  <h2 class="theme-heading">Logged Out</h2>
+  <div>
+    <div class="dex-subtle-text">You have been successfully logged out.</div>
+  </div>
+  {{ else }}
+  <h2 class="theme-heading">Session Not Found</h2>
+  <div>
+    <div class="dex-subtle-text">No active session found.</div>
+  </div>
+  {{ end }}
+
+  {{ if .BackURL }}
+  <div class="theme-form-row">
+    <a href="{{ .BackURL }}" class="dex-subtle-text">&larr; Back to Application</a>
+  </div>
+  {{ end }}
+
+</div>
+
+{{ template "footer.html" . }}
diff --git a/web/templates/password.html b/web/templates/password.html
index 8c77b26e98..ed529a2e31 100644
--- a/web/templates/password.html
+++ b/web/templates/password.html
@@ -5,7 +5,7 @@ <h2 class="theme-heading">Log in to Your Account</h2>
   <form method="post" action="{{ .PostURL }}">
     <div class="theme-form-row">
       <div class="theme-form-label">
-        <label for="userid">{{ .UsernamePrompt }}</label>
+        <label for="login">{{ .UsernamePrompt }}</label>
       </div>
 	  <input tabindex="1" required id="login" name="login" type="text" class="theme-form-input" placeholder="{{ .UsernamePrompt | lower }}" {{ if .Username }} value="{{ .Username }}" {{ else }} autofocus {{ end }}/>
     </div>
@@ -22,7 +22,16 @@ <h2 class="theme-heading">Log in to Your Account</h2>
       </div>
     {{ end }}
 
-    <button tabindex="3" id="submit-login" type="submit" class="dex-btn theme-btn--primary">Login</button>
+    {{ if .ShowRememberMe }}
+    <div class="theme-form-row">
+      <label class="theme-remember-me">
+        <input tabindex="3" type="checkbox" name="remember_me" {{ if .RememberMeChecked }}checked{{ end }}/>
+        Remember me
+      </label>
+    </div>
+    {{ end }}
+
+    <button tabindex="4" id="submit-login" type="submit" class="dex-btn theme-btn--primary">Login</button>
 
   </form>
   {{ if .BackLink }}
@@ -32,4 +41,12 @@ <h2 class="theme-heading">Log in to Your Account</h2>
   {{ end }}
 </div>
 
+
+<script type="text/javascript">
+  document.querySelector('form').onsubmit = function(e) {
+    var el = document.querySelector('#submit-login');
+    el.setAttribute('disabled', 'disabled');
+  };
+</script>
+
 {{ template "footer.html" . }}
diff --git a/web/templates/totp_verify.html b/web/templates/totp_verify.html
new file mode 100644
index 0000000000..2e00c3263e
--- /dev/null
+++ b/web/templates/totp_verify.html
@@ -0,0 +1,36 @@
+{{ template "header.html" . }}
+
+<div class="theme-panel">
+  <h2 class="theme-heading">Two-factor authentication</h2>
+  {{ if not (eq .QRCode "") }}
+  <p>Scan the QR code below using your authenticator app, then enter the code.</p>
+  <div style="text-align: center; margin: 1em 0;">
+    <img src="data:image/png;base64,{{ .QRCode }}" alt="QR code" width="200" height="200"/>
+  </div>
+  {{ else }}
+  <p>Enter the code from your authenticator app.</p>
+  <p class="theme-heading">{{ .Issuer }}</p>
+  {{ end }}
+  <form method="post" action="{{ .PostURL }}">
+    <div class="theme-form-row">
+      <div class="theme-form-label">
+        <label for="totp">One-time code</label>
+      </div>
+      <input tabindex="1" required id="totp" name="totp" type="text"
+             inputmode="numeric" pattern="[0-9]*" maxlength="6"
+             autocomplete="one-time-code"
+             class="theme-form-input" placeholder="000000"
+             autofocus/>
+    </div>
+
+    {{ if .Invalid }}
+    <div id="login-error" class="dex-error-box">
+      Invalid code. Please try again.
+    </div>
+    {{ end }}
+
+    <button tabindex="2" id="submit-login" type="submit" class="dex-btn theme-btn--primary">Verify</button>
+  </form>
+</div>
+
+{{ template "footer.html" . }}
diff --git a/web/templates/webauthn_verify.html b/web/templates/webauthn_verify.html
new file mode 100644
index 0000000000..7f5d90f352
--- /dev/null
+++ b/web/templates/webauthn_verify.html
@@ -0,0 +1,173 @@
+{{ template "header.html" . }}
+
+<div class="theme-panel">
+  {{ if eq .Mode "register" }}
+  <h2 class="theme-heading">Register security key</h2>
+  <p>Register a security key for two-factor authentication.</p>
+  {{ else }}
+  <h2 class="theme-heading">Two-factor authentication</h2>
+  <p>Use your security key to verify your identity.</p>
+  {{ end }}
+
+  <div id="webauthn-error" class="dex-error-box" style="display: none;"></div>
+  <div id="webauthn-working" style="display: none; text-align: center; margin: 1em 0;">
+    <p>Waiting for security key...</p>
+  </div>
+
+  <button id="webauthn-btn" type="button" class="dex-btn theme-btn--primary" onclick="startWebAuthn()">
+    {{ if eq .Mode "register" }}Register Security Key{{ else }}Use Security Key{{ end }}
+  </button>
+</div>
+
+<script>
+(function() {
+  const mode = {{ .Mode }};
+  const basePath = window.location.pathname.replace(/\/mfa\/webauthn$/, "");
+
+  const params = new URLSearchParams(window.location.search);
+  const reqID = params.get("req");
+  const hmacVal = params.get("hmac");
+  const authenticator = params.get("authenticator");
+
+  function apiParams() {
+    return "req=" + encodeURIComponent(reqID) +
+           "&hmac=" + encodeURIComponent(hmacVal) +
+           "&authenticator=" + encodeURIComponent(authenticator);
+  }
+
+  function showError(msg) {
+    document.getElementById("webauthn-error").textContent = msg;
+    document.getElementById("webauthn-error").style.display = "block";
+    document.getElementById("webauthn-working").style.display = "none";
+    document.getElementById("webauthn-btn").style.display = "";
+  }
+
+  function bufferToBase64url(buffer) {
+    const bytes = new Uint8Array(buffer);
+    let str = "";
+    for (let i = 0; i < bytes.length; i++) {
+      str += String.fromCharCode(bytes[i]);
+    }
+    return btoa(str).replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
+  }
+
+  function base64urlToBuffer(value) {
+    let base64 = value.replace(/-/g, "+").replace(/_/g, "/");
+    while (base64.length % 4) { base64 += "="; }
+    const binary = atob(base64);
+    const bytes = new Uint8Array(binary.length);
+    for (let i = 0; i < binary.length; i++) {
+      bytes[i] = binary.charCodeAt(i);
+    }
+    return bytes.buffer;
+  }
+
+  function handleFetchError(resp, fallbackMsg) {
+    if (resp.ok) { return resp.json(); }
+    return resp.json()
+      .then(function(j) { throw new Error(j.error || fallbackMsg); })
+      .catch(function() { throw new Error(fallbackMsg + " (status " + resp.status + ")"); });
+  }
+
+  function decodeCredentialIDs(list) {
+    if (!list) { return; }
+    for (let i = 0; i < list.length; i++) {
+      list[i].id = base64urlToBuffer(list[i].id);
+    }
+  }
+
+  function formatError(err) {
+    if (err.name === "NotAllowedError") {
+      return "Request was cancelled or timed out. Please try again.";
+    }
+    if (err.name === "SecurityError") {
+      return "Security key operation not allowed on this domain.";
+    }
+    return err.message || "An unexpected error occurred.";
+  }
+
+  window.startWebAuthn = function() {
+    document.getElementById("webauthn-error").style.display = "none";
+    document.getElementById("webauthn-working").style.display = "block";
+    document.getElementById("webauthn-btn").style.display = "none";
+
+    if (mode === "register") {
+      doRegister();
+    } else {
+      doLogin();
+    }
+  };
+
+  function doRegister() {
+    fetch(basePath + "/mfa/webauthn/register/begin?" + apiParams(), {method: "POST"})
+      .then(function(resp) { return handleFetchError(resp, "Registration failed"); })
+      .then(function(options) {
+        options.publicKey.challenge = base64urlToBuffer(options.publicKey.challenge);
+        options.publicKey.user.id = base64urlToBuffer(options.publicKey.user.id);
+        decodeCredentialIDs(options.publicKey.excludeCredentials);
+        return navigator.credentials.create(options);
+      })
+      .then(function(credential) {
+        const body = JSON.stringify({
+          id: credential.id,
+          rawId: bufferToBase64url(credential.rawId),
+          type: credential.type,
+          response: {
+            attestationObject: bufferToBase64url(credential.response.attestationObject),
+            clientDataJSON: bufferToBase64url(credential.response.clientDataJSON)
+          }
+        });
+        return fetch(basePath + "/mfa/webauthn/register/finish?" + apiParams(), {
+          method: "POST",
+          headers: {"Content-Type": "application/json"},
+          body: body
+        });
+      })
+      .then(function(resp) { return handleFetchError(resp, "Registration failed"); })
+      .then(function(result) {
+        if (result.redirect) { window.location.href = result.redirect; }
+      })
+      .catch(function(err) { showError(formatError(err)); });
+  }
+
+  function doLogin() {
+    fetch(basePath + "/mfa/webauthn/login/begin?" + apiParams(), {method: "POST"})
+      .then(function(resp) { return handleFetchError(resp, "Authentication failed"); })
+      .then(function(options) {
+        options.publicKey.challenge = base64urlToBuffer(options.publicKey.challenge);
+        decodeCredentialIDs(options.publicKey.allowCredentials);
+        return navigator.credentials.get(options);
+      })
+      .then(function(assertion) {
+        const body = JSON.stringify({
+          id: assertion.id,
+          rawId: bufferToBase64url(assertion.rawId),
+          type: assertion.type,
+          response: {
+            authenticatorData: bufferToBase64url(assertion.response.authenticatorData),
+            clientDataJSON: bufferToBase64url(assertion.response.clientDataJSON),
+            signature: bufferToBase64url(assertion.response.signature),
+            userHandle: assertion.response.userHandle ? bufferToBase64url(assertion.response.userHandle) : ""
+          }
+        });
+        return fetch(basePath + "/mfa/webauthn/login/finish?" + apiParams(), {
+          method: "POST",
+          headers: {"Content-Type": "application/json"},
+          body: body
+        });
+      })
+      .then(function(resp) { return handleFetchError(resp, "Authentication failed"); })
+      .then(function(result) {
+        if (result.redirect) { window.location.href = result.redirect; }
+      })
+      .catch(function(err) { showError(formatError(err)); });
+  }
+
+  // Auto-start login flow (not registration — user should click to register).
+  if (mode === "login") {
+    startWebAuthn();
+  }
+})();
+</script>
+
+{{ template "footer.html" . }}
diff --git a/web/themes/dark/styles.css b/web/themes/dark/styles.css
index edf30412fa..61bcad7e24 100644
--- a/web/themes/dark/styles.css
+++ b/web/themes/dark/styles.css
@@ -1,122 +1,151 @@
 .theme-body {
-  background-color: #0f1218;
-  color: #c8d1d9;
-  font-family: 'Source Sans Pro', Helvetica, sans-serif;
+  background-color: #131519;
+  color: #b8bcc4;
+  font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, Helvetica, Arial, sans-serif;
 }
 
 .theme-navbar {
-  background-color: #161b22;
-  box-shadow: 0 2px 2px rgba(0, 0, 0, 0.2);
-  color: #161B2B;
+  background-color: #1a1d23;
+  border-bottom: 1px solid #2a2d35;
+  color: #b8bcc4;
   font-size: 13px;
-  font-weight: 100;
-  height: 46px;
+  font-weight: 400;
+  height: 52px;
   overflow: hidden;
-  padding: 0 10px;
+  padding: 0 16px;
 }
 
 .theme-navbar__logo-wrap {
   display: inline-block;
   height: 100%;
   overflow: hidden;
-  padding: 10px 15px;
+  padding: 12px 15px;
   width: 300px;
 }
 
 .theme-navbar__logo {
   height: 100%;
-  max-height: 25px;
+  max-height: 26px;
 }
 
 .theme-heading {
+  color: #dcdfe5;
   font-size: 20px;
-  font-weight: 500;
+  font-weight: 600;
+  margin-bottom: 16px;
   margin-top: 0;
-  color: #c8d1d9;
 }
 
 .theme-panel {
-  background-color: #161b22;
-  box-shadow: 0 5px 15px rgba(0, 0, 0, 0.5);
-  padding: 30px;
+  background-color: #1a1d23;
+  border: 1px solid #2a2d35;
+  border-radius: 12px;
+  box-shadow: 0 2px 8px rgba(0, 0, 0, 0.25);
+  padding: 32px;
 }
 
+/* A width rather than a minimum: the button has to be the same size whatever
+ * the connector is called, and it has to give way on a screen too narrow to
+ * hold it rather than push out of the panel. */
 .theme-btn-provider {
-  background-color: #1e242d;
-  color: #c8d1d9;
-  border: 1px solid #30373c;
-  min-width: 250px;
+  background-color: #22252c;
+  border: 1px solid #33363e;
+  color: #b8bcc4;
+  max-width: 100%;
+  width: 260px;
 }
 
 .theme-btn-provider:hover {
-  background-color: #212731;
-  color: #ffffff;
+  background-color: #2a2d35;
+  border-color: #3e414a;
+  color: #dcdfe5;
 }
 
 .theme-btn--primary {
-  background-color: #1e242d;
+  background-color: #3d3f47;
   border: none;
-  color: #c8d1d9;
+  color: #e8eaed;
   min-width: 200px;
-  padding: 6px 12px;
+  padding: 8px 16px;
 }
 
 .theme-btn--primary:hover {
-  background-color: #212731;
-  color: #e9e9e9;
+  background-color: #4a4c55;
+  color: #fff;
 }
 
 .theme-btn--success {
-  background-color: #1891bb;
-  color: #e9e9e9;
-  width: 250px;
+  background-color: #2d7d9a;
+  color: #e8eaed;
+  width: 260px;
 }
 
 .theme-btn--success:hover {
-  background-color: #1da5d4;
+  background-color: #358fae;
 }
 
 .theme-form-row {
   display: block;
-  margin: 20px auto;
+  margin: 16px auto;
 }
 
 .theme-form-input {
+  background-color: #131519;
+  border: 1px solid #33363e;
+  border-radius: 8px;
+  color: #b8bcc4;
   display: block;
-  height: 36px;
-  padding: 6px 12px;
   font-size: 14px;
-  line-height: 1.42857143;
-  border: 1px solid #515559;
-  border-radius: 4px;
-  color: #c8d1d9;
-  background-color: #0f1218;
-  box-shadow: inset 0 1px 1px rgb(27, 40, 46);
-  width: 250px;
+  height: 40px;
+  line-height: 1.5;
   margin: auto;
+  padding: 8px 12px;
+  transition: border-color 0.15s ease, box-shadow 0.15s ease;
+  width: 260px;
 }
 
 .theme-form-input:focus,
 .theme-form-input:active {
+  border-color: #5a9bb5;
+  box-shadow: 0 0 0 3px rgba(90, 155, 181, 0.15);
+  color: #dcdfe5;
   outline: none;
-  border-color: #f8f9f9;
-  color: #c8d1d9;
 }
 
 .theme-form-label {
-  width: 250px;
+  color: #b8bcc4;
+  font-size: 14px;
+  font-weight: 500;
   margin: 4px auto;
-  text-align: left;
   position: relative;
-  font-size: 13px;
-  font-weight: 600;
-  color: #c8d1d9;
+  text-align: left;
+  width: 260px;
 }
 
 .theme-link-back {
-  margin-top: 4px;
+  margin-top: 8px;
+}
+
+.theme-remember-me {
+    display: flex;
+    align-items: center;
+    gap: 8px;
+    cursor: pointer;
+    font-size: 14px;
+    width: 260px;
+    margin: 4px auto;
 }
 
 .dex-container {
-  color: #c8d1d9;
+  color: #b8bcc4;
+}
+
+/* Palette the shared stylesheet reads for the home page. Without these the
+ * page would fall back to the light values and render dark text on the dark
+ * panel. */
+.theme-body {
+  --dex-fg: #dcdfe5;
+  --dex-fg-muted: #8b909b;
+  --dex-border: #2a2d35;
+  --dex-accent: #5a9bb5;
 }
diff --git a/web/themes/light/styles.css b/web/themes/light/styles.css
index 2d92057119..713f4a8905 100644
--- a/web/themes/light/styles.css
+++ b/web/themes/light/styles.css
@@ -1,113 +1,141 @@
 .theme-body {
-  background-color: #efefef;
-  color: #333;
-  font-family: 'Source Sans Pro', Helvetica, sans-serif;
+  background-color: #f4f5f7;
+  color: #1a1a1a;
+  font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, Helvetica, Arial, sans-serif;
 }
 
 .theme-navbar {
   background-color: #fff;
-  box-shadow: 0 2px 2px rgba(0, 0, 0, 0.2);
-  color: #333;
+  border-bottom: 1px solid #e1e4e8;
+  color: #1a1a1a;
   font-size: 13px;
-  font-weight: 100;
-  height: 46px;
+  font-weight: 400;
+  height: 52px;
   overflow: hidden;
-  padding: 0 10px;
+  padding: 0 16px;
 }
 
 .theme-navbar__logo-wrap {
   display: inline-block;
   height: 100%;
   overflow: hidden;
-  padding: 10px 15px;
+  padding: 12px 15px;
   width: 300px;
 }
 
 .theme-navbar__logo {
   height: 100%;
-  max-height: 25px;
+  max-height: 26px;
 }
 
 .theme-heading {
   font-size: 20px;
-  font-weight: 500;
-  margin-bottom: 10px;
+  font-weight: 600;
+  margin-bottom: 16px;
   margin-top: 0;
 }
 
 .theme-panel {
   background-color: #fff;
-  box-shadow: 0 5px 15px rgba(0, 0, 0, 0.5);
-  padding: 30px;
+  border: 1px solid #e1e4e8;
+  border-radius: 12px;
+  box-shadow: 0 1px 3px rgba(0, 0, 0, 0.08), 0 1px 2px rgba(0, 0, 0, 0.06);
+  padding: 32px;
 }
 
+/* A width rather than a minimum: the button has to be the same size whatever
+ * the connector is called, and it has to give way on a screen too narrow to
+ * hold it rather than push out of the panel. */
 .theme-btn-provider {
   background-color: #fff;
-  color: #333;
-  min-width: 250px;
+  border: 1px solid #d0d5dd;
+  color: #1a1a1a;
+  max-width: 100%;
+  width: 260px;
 }
 
 .theme-btn-provider:hover {
-  color: #999;
+  background-color: #f9fafb;
+  border-color: #b0b5bd;
+  color: #1a1a1a;
 }
 
 .theme-btn--primary {
-  background-color: #333;
+  background-color: #1a1a1a;
   border: none;
   color: #fff;
   min-width: 200px;
-  padding: 6px 12px;
+  padding: 8px 16px;
 }
 
 .theme-btn--primary:hover {
-  background-color: #666;
+  background-color: #333;
   color: #fff;
 }
 
 .theme-btn--success {
-  background-color: #2FC98E;
+  background-color: #16a34a;
   color: #fff;
-  width: 250px;
+  width: 260px;
 }
 
 .theme-btn--success:hover {
-  background-color: #49E3A8;
+  background-color: #15803d;
 }
 
 .theme-form-row {
   display: block;
-  margin: 20px auto;
+  margin: 16px auto;
 }
 
 .theme-form-input {
-  border-radius: 4px;
-  border: 1px solid #CCC;
-  box-shadow: inset 0 1px 1px rgba(0, 0, 0, 0.075);
-  color: #666;
+  border-radius: 8px;
+  border: 1px solid #d0d5dd;
+  color: #1a1a1a;
   display: block;
   font-size: 14px;
-  height: 36px;
-  line-height: 1.42857143;
+  height: 40px;
+  line-height: 1.5;
   margin: auto;
-  padding: 6px 12px;
-  width: 250px;
+  padding: 8px 12px;
+  transition: border-color 0.15s ease, box-shadow 0.15s ease;
+  width: 260px;
 }
 
 .theme-form-input:focus,
 .theme-form-input:active {
-  border-color: #66AFE9;
+  border-color: #4A90D9;
+  box-shadow: 0 0 0 3px rgba(74, 144, 217, 0.15);
   outline: none;
 }
 
 .theme-form-label {
-  font-size: 13px;
-  font-weight: 600;
+  font-size: 14px;
+  font-weight: 500;
   margin: 4px auto;
   position: relative;
   text-align: left;
-  width: 250px;
+  width: 260px;
 }
 
 .theme-link-back {
-  margin-top: 4px;
+  margin-top: 8px;
+}
+
+.theme-remember-me {
+  display: flex;
+  align-items: center;
+  gap: 8px;
+  cursor: pointer;
+  font-size: 14px;
+  width: 260px;
+  margin: 4px auto;
+}
+
+/* Palette the shared stylesheet reads for the home page. */
+.theme-body {
+  --dex-fg: #1a1a1a;
+  --dex-fg-muted: #6b7280;
+  --dex-border: #e8eaed;
+  --dex-accent: #2f6fb0;
 }
diff --git a/web/web.go b/web/web.go
index c5ff751490..0c7e9873a7 100644
--- a/web/web.go
+++ b/web/web.go
@@ -5,7 +5,7 @@ import (
 	"io/fs"
 )
 
-//go:embed static/* templates/* themes/*
+//go:embed static/* templates/* themes/* robots.txt
 var files embed.FS
 
 // FS returns a filesystem with the default web assets.